Pyats F5 Platform

F5 BIG-IP Platform Operations via pyATS

Testbed Requirements

F5 BIG-IP devices in the pyATS testbed:

devices:
  bigip-01:
    os: bigip
    type: load-balancer
    connections:
      rest:
        class: rest
        ip: 10.0.0.20
        port: 443
        protocol: https
    credentials:
      default:
        username: "%ENV{F5_USERNAME}"
        password: "%ENV{F5_PASSWORD}"

How to Call

Use pyats_run_show_command with iControl REST API paths:

PYATS_TESTBED_PATH=$PYATS_TESTBED_PATH python3 $MCP_CALL "${PYATS_PYTHON:-python3} -u $PYATS_MCP_SCRIPT" pyats_run_show_command '{"device_name":"bigip-01","command":"show sys version"}'

System Endpoints (/mgmt/tm/sys/*)

Platform & Version

CPU, Memory & Disk

System Configuration

Time Services

Logging & Syslog

SNMP

Crypto & Certificates

Licensing

iCall & iApps

Monitoring & Health

Management Access

Miscellaneous System

Network Endpoints (/mgmt/tm/net/*)

Interfaces & VLANs

Routing

Tunnels

ARP & NDP

IPsec

Other Networking

Cluster Management (/mgmt/tm/cm/*)

Authentication & Authorization (/mgmt/tm/auth/*)

Analytics (/mgmt/tm/analytics/*)

Security (/mgmt/tm/security/*)

Access Policy Manager (/mgmt/tm/access/*)

Cloud Endpoints (/mgmt/tm/cloud/*)

Shared Endpoints (/mgmt/tm/shared/*)

Live Update (/mgmt/tm/live-update/*)

ADC Certificate Management (/mgmt/tm/adc/*)

File Management (/mgmt/tm/file/*)

CLI Settings (/mgmt/tm/cli/*)

WOM / iSession (/mgmt/tm/wom/*)

Workflows

1. BIG-IP Platform Health Check

/mgmt/tm/sys/version → software version, build
→ /mgmt/tm/sys/hardware → platform model, serial, memory
→ /mgmt/tm/sys/cpu → CPU utilization per core
→ /mgmt/tm/sys/memory → TMM and host memory usage
→ /mgmt/tm/sys/disk/logical-disk → disk space remaining
→ /mgmt/tm/sys/performance/all-stats → throughput, connections
→ /mgmt/tm/sys/ntp → NTP sync status
→ /mgmt/tm/sys/provision → module allocation (LTM, GTM, ASM, APM)
→ /mgmt/tm/sys/license → license expiration, feature flags
→ Flag: CPU >80%, memory >85%, disk >90%, NTP out of sync, license expiring
→ GAIT

2. HA / Cluster Verification

/mgmt/tm/cm/sync-status → config sync state (In Sync / Changes Pending / Disconnected)
→ /mgmt/tm/cm/failover-status → active/standby/forced-offline
→ /mgmt/tm/cm/device → device trust domain members, versions
→ /mgmt/tm/cm/device-group → sync-failover groups, members, type
→ /mgmt/tm/cm/traffic-group → floating IPs, failover order
→ /mgmt/tm/net/self → self IPs with traffic-group assignments
→ Flag: sync status not "In Sync", mismatched versions, traffic-group imbalance
→ GAIT

3. Network Infrastructure Audit

/mgmt/tm/net/interface → physical interfaces, speed, duplex, status
→ /mgmt/tm/net/vlan → VLANs, tagged interfaces, failsafe
→ /mgmt/tm/net/self → self IPs, VLAN bindings, allow-service
→ /mgmt/tm/net/trunk → LACP trunks, member status, hash
→ /mgmt/tm/net/route → static routes
→ /mgmt/tm/net/route-domain → route domains (VRFs)
→ /mgmt/tm/net/arp → ARP entries (cross-reference with NetBox)
→ /mgmt/tm/net/tunnels/tunnel → active tunnels (GRE, VXLAN, IPsec)
→ Flag: interfaces down, trunk members missing, orphan self IPs
→ GAIT

4. Security & Certificate Audit

/mgmt/tm/sys/crypto/cert → all installed certificates
→ /mgmt/tm/sys/crypto/key → private keys (verify matching)
→ /mgmt/tm/sys/crypto/crl → CRLs (check freshness)
→ /mgmt/tm/auth/source → authentication source (local/remote)
→ /mgmt/tm/auth/password-policy → password complexity and lockout
→ /mgmt/tm/sys/httpd → HTTPS cipher/protocol settings
→ /mgmt/tm/sys/sshd → SSH cipher/MAC settings
→ /mgmt/tm/security/firewall/management-ip-rules → management access rules
→ /mgmt/tm/sys/snmp/communities → SNMP community strings
→ Flag: expiring certs (<30d), weak ciphers, default SNMP communities, no password policy
→ Cross-reference BIG-IP version with NVD CVE
→ GAIT

5. Analytics Deep Dive

/mgmt/tm/analytics/http/report → HTTP request rates, response times, errors
→ /mgmt/tm/analytics/tcp/report → TCP connections, retransmissions, RTT
→ /mgmt/tm/analytics/dns/report → DNS query patterns, response codes
→ /mgmt/tm/analytics/dos/report → DoS detection/mitigation events
→ /mgmt/tm/analytics/asm/report → WAF violations, attack types
→ /mgmt/tm/analytics/cpu/report → CPU utilization trends
→ /mgmt/tm/analytics/memory/report → memory trends
→ Flag: high retransmission rate, rising DoS events, WAF violation spike
→ GAIT

6. Live Update Status

/mgmt/tm/live-update/asm-attack-signatures/installations → ASM sig version, last update
→ /mgmt/tm/live-update/bot-signatures/installations → bot sig freshness
→ /mgmt/tm/live-update/threat-campaigns/installations → threat campaign updates
→ /mgmt/tm/live-update/browser-challenges/installations → browser challenge updates
→ /mgmt/tm/live-update/server-technologies/installations → server tech detection
→ Flag: signatures >7 days old, threat campaigns stale
→ GAIT

Integration with Other Skills

Guardrails

• All queries are read-only — GET requests to iControl REST API only
• No configuration changes — never POST/PUT/PATCH/DELETE via this skill
• Monitor sync-status first — always check /mgmt/tm/cm/sync-status before any HA pair operations
• Check license expiration — flag licenses expiring within 30 days
• Verify NTP — out-of-sync NTP causes cert validation failures and log correlation issues
• Gate changes behind ServiceNow — any platform changes go through f5-config-mgmt with CR
• Record in GAIT — every API query must be logged