Integrating F5 BIG-IP

To integrate F5 BIG-IP, do the following:

• Enable F5 BIG-IP

• Install the XDR Collector

• Configure the firewall

• Open the port on the XDR Collector Host

Enable F5 BIG-IP

1. In Barracuda XDR Dashboard, navigate to Integrations .

2. On the F5 BIG-IP card, click Setup.

   Open

   

3. Select the Enabled check box.

   Open

   

4. If the default UDP port can't be forwarded because it is already in use, type a different UDP port number.

5. Click Save.

Install the XDR Collector

When collecting logs from one or more integrated data sources, always set up the XDR Collector on a dedicated host server. Don't use an existing server because the amount of data produced by logs can impact critical infrastructure.

• If you haven't already set up the XDR Collector, do one of the following:

  • Setting up the XDR Collector for Windows

  • Setting up the XDR Collector for Linux

Configuring the Firewall

To add a Syslog server to the F5 BIG-IP Firewall follow the steps that can be found in the F5 BIG-IP Documentation.

When entering the necessary information for each syslog server that is added, make sure that the port is pointing to 9256, not to the default port that is mentioned in the documentation.

Open the Port on the XDR Collector Host

Ensure incoming traffic is allowed on UDP port 9256.

Linux

sudo ufw allow 9256/udp

Windows

netsh advfirewall firewall add rule name="F5 BIG-IP Events" dir=in action=allow protocol=UDP localport=9256

Integrating F5 BIG-IP for a physical or virtual sensor

Applies To

• Product: BIG-IP, BIG-IP AAM, BIG-IP AFM, BIG-IP APM, BIG-IP ASM, BIG-IP DNS, BIG-IP GTM, BIG-IP Link Controller, BIG-IP LTM, BIG-IP PEM

  • 15.X.X, 14.X.X, 13.X.X, 12.X.X, 11.6.X, 11.5.X

• Product: Legacy Products, BIG-IP WebAccelerator, BIG-IP WOM, BIG-IP PSM, BIG-IP Edge Gateway

  • 15.X.X, 14.X.X, 13.X.X, 12.X.X, 11.6.X, 11.5.X

Adding a remote syslog server using the Configuration utility Performing the following procedure should not have a negative impact on your system.

Adding remote syslog servers using the Configuration utility is available in BIG-IP 11.1.0 and later.

1. Log in to the Configuration utility.

2. Click System > Logs > Configuration > Remote Logging.

3. For Remote IP, enter the destination syslog server IP address, or FQDN. (DNS server configuration required)

4. For Remote Port, enter the remote syslog server UDP port (default is 514).

5. (Optional) For Local IP, enter the local IP address of the BIG-IP system.
   NOTE For BIG-IP systems in a high availability (HA) configuration, the non-floating self IP address is recommended if using a Traffic Management Microkernel (TMM) based IP address. 

6. Select Add.

7. Select Update.

8. For BIG-IP systems in a high availability (HA) configuration, perform a ConfigSync to synchronize the changes to the other devices in the device group.