F5 Response Integration via API

Purpose

This guide explains how to configure the F5 Response integration in Logsign so that Incidents and Alarms can automatically, or an analyst can manually, block and unblock an IP address on an F5 BIG-IP device. This is not a log collection poller: it is a Response (action) integration, configured under Settings > Integrations > Responses, that lets a Logsign correlation rule or manual incident action reach out to BIG-IP and change its firewall configuration in real time.

The integration works against F5's Advanced Firewall Manager (AFM) module. Blocking and unblocking are implemented as create/delete operations on individual rules inside an existing Network Firewall policy, not as entries in an AFM data group. Logsign authenticates to BIG-IP over iControl REST using a local username and password, obtains a session token, and issues the rule create/delete call under that token.

Prerequisites

Before configuring the integration, confirm the following on the BIG-IP side:

• AFM (Advanced Firewall Manager) is licensed and provisioned on the BIG-IP. Without AFM, the Network Firewall policy endpoint this integration writes to does not exist.
• A Network Firewall policy already exists in the partition you plan to use, and it is attached wherever you want the block to take effect (globally, on a virtual server, or on a route domain). Logsign only adds and removes rules inside a policy you name; it does not create the policy or attach it to anything.
• Network connectivity from the Logsign server to the BIG-IP management interface, on whatever port you use for iControl REST (commonly 443, but this is not enforced by Logsign and depends on your deployment).
• A local BIG-IP account with the least-privilege role described in Step 1. Logsign authenticates using BIG-IP's local ("tmos") authentication provider; accounts that only exist in a remote authentication source (LDAP, RADIUS, TACACS+, Active Directory) have not been verified to work with this integration.

Step 1: Create a Least-Privilege iControl REST User on F5 BIG-IP

Do not use the Administrator or Resource Administrator role for this integration. Both roles require universal (all-partitions) access and grant control over the entire BIG-IP configuration, well beyond what block/unblock actions need.

Use the built-in Firewall Manager role instead. According to F5's documentation, Firewall Manager grants permission to manage firewall rules and supporting objects, and explicitly has no permission to create, update, or delete non-network-firewall configuration such as Application Security or Protocol Security policies. Unlike Administrator and Resource Administrator, Firewall Manager can be scoped to a single partition rather than requiring access to all partitions, which lines up with the Partition field you will fill in on the Logsign side.

1. Log in to the BIG-IP Configuration utility (TMUI) with an administrator account.
2. Go to System > Users > User List > Create.
3. Set a username and password. This is the local account Logsign will use, so keep the credentials handled the same way you would any other service account.
4. Under Partition Access, add the specific partition where your Network Firewall policy lives (for example Common) and set the role to Firewall Manager. Do not select "All" unless you actually need the policy rules managed across every partition.
5. If the policy you intend to use is a global or management-port policy, note that F5's own documentation states Firewall Manager needs the Common partition assigned to modify those; scope the account to Common in that case.
6. Terminal Access can be left as None; this integration only calls the REST API, it never opens a shell session.
7. Save the user.

This role assignment has not been tested live against a BIG-IP instance as part of this write-up (not independently verified); it is based on F5's published role descriptions matched against the exact REST endpoint this integration calls (mgmt/tm/security/firewall/policy/.../rules). If you find in testing that Firewall Manager is insufficient for your BIG-IP version, treat that as a correction to confirm with F5 support rather than defaulting back to Administrator.

Step 2: Configure the Integration in Logsign

In Logsign, go to Settings > Integrations > Responses, search for F5, click Configure, then +Device. Fill in the following fields:

After saving, use Logsign's connection test on this device before relying on it in a correlation rule. The test only opens an authenticated session against BIG-IP; it does not create or touch any firewall rule, so it will not tell you whether the account's role/partition access is sufficient for the actual block-ip call. Confirm that separately with a manual test block/unblock on a non-production IP.

Available Methods

Once the device is configured, these methods become available as response actions in Incident/Alarm automation rules or as manual actions from the incident view.

block-ip

Creates a new rule in the configured Network Firewall policy (Partition/Policy) that rejects traffic from the given address. The rule is submitted as a reject action, inserted at the top of the policy (placed before every existing rule), matching the source address as a single host (the address with a /32 mask). The rule's name on BIG-IP is set to the IP address itself, which is what makes the matching unblock-ip call able to find and remove it later.

block-ip supports an optional auto-expire setting in the automation rule. When enabled, set an Expire Time in seconds (defaults to 3600, one hour); Logsign will automatically call unblock-ip with the same IP address once that time elapses, removing the rule without any manual follow-up. If you leave auto-expire off, the block is permanent until someone runs unblock-ip (manually or through a separate rule).

unblock-ip

Deletes the rule matching the given IP address from the same configured policy, reversing a prior block-ip call.

unblock-ip only works if a rule named exactly that IP address exists in the configured policy. If the block was created by something other than this integration, or the rule was renamed or already removed, unblock-ip will not find anything to delete (see Troubleshooting).

Notes and Limits

• There is no update/modify method. block-ip always creates a reject rule placed first in the policy; there is no way from Logsign to change the rule's action, priority, or match criteria beyond the source IP.
• The rule's source address is always submitted with a /32 mask regardless of address family. This is correct for IPv4 but not valid for IPv6 (which needs a /128 mask); IPv6 support has not been independently verified and should be treated as unsupported until confirmed against a live BIG-IP.
• Every block-ip call adds one rule to the policy and nothing currently cleans these up automatically unless you use the auto-expire setting. On a busy environment with block-ip wired into frequent correlation matches and no expiry configured, the policy's rule count will grow over time; review and prune it periodically if that matters for your BIG-IP's manageability or performance.
• Logsign's connection test only validates that a login/session token can be obtained; it does not verify that the configured account actually has permission to create or delete rules in the specified partition and policy. A successful test does not guarantee block-ip or unblock-ip will succeed.
• This integration authenticates using BIG-IP's local ("tmos") authentication provider only. If your BIG-IP is configured to authenticate against a remote directory and the account used here only exists there, authentication is expected to fail; use a locally-defined BIG-IP account.
• This integration is limited to the block-ip and unblock-ip actions against a single Network Firewall policy. It does not cover other AFM objects (data groups, DoS profiles, IP intelligence lists) or any BIG-IP LTM/GTM functionality.

Troubleshooting