F5 BIG-IP iRules

Download the Centinel F5 iRules package:

# Download the package
curl -O https://docs.centinelanalytica.com/downloads/centinel-f5-irules.zip

# Extract files
unzip centinel-f5-irules.zip

# You should see:
# - Centinel.tcl
# - Centinel-SSL-Helper.tcl

Or download via browser: centinel-f5-irules.zip

Log into your F5 BIG-IP management interface and upload both iRule files:

Via Web UI:

1. Navigate to Local Traffic → iRules → iRules List
2. Click Create
3. Enter name: Centinel
4. Paste the contents of Centinel.tcl
5. Click Finished
6. Repeat for Centinel-SSL-Helper with Centinel-SSL-Helper.tcl

Via TMSH:

# Copy files to BIG-IP first
scp Centinel.tcl Centinel-SSL-Helper.tcl root@<bigip-mgmt-ip>:/var/tmp/

# Wrap and load each iRule
{ echo 'ltm rule Centinel {'; cat /var/tmp/Centinel.tcl; echo '}'; } > /var/tmp/Centinel.conf
tmsh load sys config merge file /var/tmp/Centinel.conf

{ echo 'ltm rule Centinel-SSL-Helper {'; cat /var/tmp/Centinel-SSL-Helper.tcl; echo '}'; } > /var/tmp/Centinel-SSL-Helper.conf
tmsh load sys config merge file /var/tmp/Centinel-SSL-Helper.conf

Edit the Centinel iRule and update the secret key on line 8:

# Replace with your actual API key
set static::CENTINEL_SECRET_KEY "sk_live_your_key_here"

Via Web UI:

1. Navigate to Local Traffic → iRules → iRules List
2. Click on Centinel
3. Click Edit
4. Update line 8 with your secret key
5. Click Finished

Via TMSH:

tmsh edit ltm rule Centinel
# Update the key, then save and exit

Create a virtual server for making outbound HTTPS calls to the Centinel API:

Via Web UI:

1. Navigate to Local Traffic → Virtual Servers → Virtual Server List
2. Click Create
3. Configure:
   • Name: centinel_api_ssl_vs
   • Destination Address/Mask: 0.0.0.0/0 (any)
   • Service Port: 443
   • Protocol: TCP
   • HTTP Profile (Client): http
   • SSL Profile (Server): serverssl-insecure-compatible
   • Source Address Translation: Auto Map
   • Address Translation: Enabled
   • Port Translation: Enabled
4. Click Finished

Via TMSH:

tmsh create ltm virtual centinel_api_ssl_vs \
    destination 0.0.0.0:443 \
    ip-protocol tcp \
    mask 0.0.0.0 \
    profiles add { tcp http { context all } serverssl-insecure-compatible { context serverside } } \
    source 0.0.0.0/0 \
    source-address-translation { type automap } \
    translate-address enabled \
    translate-port enabled

Attach the Centinel-SSL-Helper iRule to the API virtual server:

Via Web UI:

1. Navigate to Local Traffic → Virtual Servers
2. Click on centinel_api_ssl_vs
3. Go to Resources tab
4. Under iRules, click Manage
5. Move Centinel-SSL-Helper from Available to Enabled
6. Click Finished

Via TMSH:

tmsh modify ltm virtual centinel_api_ssl_vs rules { Centinel-SSL-Helper }

Attach the Centinel iRule to your application's virtual server(s):

Via Web UI:

1. Navigate to Local Traffic → Virtual Servers
2. Click on your application virtual server (e.g. www_vs)
3. Go to Resources tab
4. Under iRules, click Manage
5. Move Centinel from Available to Enabled
6. Click Finished

Via TMSH:

tmsh modify ltm virtual your_application_vs rules { Centinel }

Save your changes to persistent storage:

Via Web UI: Click System → Configuration → Save Configuration

Via TMSH:

tmsh save sys config

Make sure TMM has DNS servers configured (needed for RESOLV::lookup in the iRule):

tmsh list sys dns

Expected output:

sys dns {
    name-servers { 8.8.8.8 1.1.1.1 }
    search { example.com }
}

If no name-servers are shown, add DNS servers:

tmsh modify sys dns name-servers add { 8.8.8.8 1.1.1.1 }
tmsh save sys config

Test DNS resolution:

run /util dig validator.centinelanalytica.com

You should see an ANSWER SECTION with IP addresses.

1. Check logs: Monitor for Centinel activity

   tail -f /var/log/ltm

2. Test normal traffic: Visit your application to confirm requests work normally

3. Check statistics: View iRule execution stats

   tmsh show ltm rule Centinel

4. Monitor Centinel dashboard: Verify requests appear in your Centinel dashboard