Forum Discussion

igssv's avatar
igssv
Icon for Cirrus rankCirrus
Nov 11, 2023

Removing Additional Settings Added After Migration

I've recently migrated from i2800 v12 through r2600 v15 to r2600 v17 using journeys.

I noticed that several settings, which weren't originally present, have been added, and I'd like to remove them. These include:

  • Under the Distributed Cloud Services in the left pane:
    • Application Traffic Insight: ati
    • Bot Defense: bd
    • Client-Side Defense: csd
    • Account Protection & Authentication Intelligence: ap-ai
    • Cloud Services: f5-credential-stuffing-cloud-app

 

  • Inside big-ip.conf:
    • Objects related to Protocol Inspection (It's not a problem if Protocol Inspection itself is not active):
      security protocol-inspection compliance-map { ... }
      security protocol-inspection compliance-objects { ... }
    • The setting for compatibility-level, which didn't exist in v12:
      sys compatibility-level {
          level 0
      }
    • The iHealth settings. I don't want to use it, but is it enabled with “no-ihealth false”? Can I safely disable it?
      sys diags ihealth {
          expiration 30
          no-ihealth false
          options none
          password none
          user none
      }

There are about 30 discrepancies in total, and I've determined that most of them don't have an impact. However, I'm unsure about the ones listed above. I'd like to remove them, or at least disable them if removal is not possible. If leaving them as they are wouldn't cause any problems, that's also fine.

Could I get some support on this?

security

1 Reply

Sort By
  • jaikumar_f5's avatar
    jaikumar_f5
    Icon for MVP rankMVP
    Nov 13, 2023

    I'd strongly suggest to go through the release notes to understand the behavioural changes, functionality changes etc. These will help one decide what to see new on the boxes when one upgrades. 

    I personally feel, no one will be able to justify what is expected as the code changes/fixes would be many considering you have made a big software upgrade from v12 to v17. 

    You are required to manually find this out, referring the release notes. As long as the default configurations don't affect your Infra, which I take is the case, you should be fine leaving the default settings that got added up in v17.