Configuration Resources
Configuration resources map to objects in the Traffic Manager's configuration system. The Terraform provider uses these resource definitions to provision services hosted on your Traffic Manager instances.
Setting Configuration Values Using the Resource Model
The following code samples show how to set configuration properties for different resource types:
# Single object configuration
resource "vtm_global_settings" "global_settings" {
admin_support_tls1 = false
connection_idle_timeout = 30
}
# Collection-type key/value object configuration
resource "vtm_pool" "my_pool" {
name = "MyPool"
monitors = ["Ping", "Simple HTTP"]
load_balancing_algorithm = "weighted_least_connections"
nodes_table {
node = "192.0.2.101:80"
weight = 1
}
nodes_table {
node = "192.0.2.102:80"
weight = 3
}
nodes_table {
node = "192.0.2.103:80"
weight = 3
state = "disabled"
}
}# Collection-type raw text object configuration
resource "vtm_rule" "my_rule" {
name = "MyRule"
content = <<EOF
$hostHeader = http.getHostHeader();
if($hostHeader == "www.example.com") {
pool.use("ExamplePool");
}
EOF
}Dependancy Tree
Generally speaking, the Traffic Manager REST API is tolerant of objects being created out-of-order. In other words, the REST API allows you to create a virtual server that references a TrafficScript rule that does not yet exist, even though this would trigger an error in the Traffic Manager diagnostics and event log. This error is suppressed after the corresponding rule is subsequently added. However, there are exceptions to this arrangement.
Ivanti recommends that all resource dependencies are explicitly specified by using parameter interpolation when creating relationships, rather than hard-coding names. For example, rather than providing a list of rule names to a virtual server as strings, specify the names as variables to aid Terraform in building the correct dependancy tree. The following code samples demonstrate this process.
The code sample below shows the partial configuration of a virtual server with named request rules:
resource "vtm_virtual_server" "example" {
name = "ExampleVS"
request_rules = ["rule1", "rule2"]
...
}Rather than specifying the hard-coded strings "rule1" and "rule2" in the list of request rules, use instead a set of variables to provide the rule names. The following code sample demonstrates the syntax used to reference properties of other resource objects in the provider:
resource "vtm_virtual_server" "example" {
name = "ExampleVS"
request_rules = ["${vtm_rule.rule1.name}", "${vtm_rule.rule2.name}"]
...
}Resource Reference
Use the configuration resource definitions in this section to provision services on your Traffic Manager instances.
vtm_action_program
URI Endpoint: /api/tm/8.3/config/active/action_programs
This is a program or script that can be referenced and used by actions of type 'Program'
# Example usage of vtm_action_program resource...
resource "vtm_action_program" "my_action_program" {
content = ""
name = "MyActionProgram"
}Property | Description |
|---|---|
name | Name of the object
|
content | Object content
|
vtm_ssl_admin_ca
URI Endpoint: /api/tm/8.3/config/active/ssl/admin_cas
The conf/ssl/admin_cas directory contains SSL certificate authority certificates (CAs) and certificate revocation lists (CRLs) which can be used when validating connections made by the admin server for user authentication. CAs and CRLs can be managed under the Catalogs > SSL > Admin CAs and CRLs section of the Admin Server UI or by using functions under the Catalog.SSL.AdminCertificateAuthorities section of the SOAP API and CLI.
Property | Description |
|---|---|
name | Name of the object
|
content | Object content
|
vtm_action
URI Endpoint: /api/tm/8.3/config/active/actions
A response to an event occurring in your traffic manager. An example of an action might be sending an email or writing a line to a log file.
# Example usage of vtm_action resource...
resource "vtm_action" "my_action" {
name = "MyAction"
type =
}Property | Description |
|---|---|
name | Name of the object
|
email_from | The e-mail address from which messages will appear to originate.
|
email_server | The SMTP server to which messages should be sent. This must be a valid IPv4 address or resolvable hostname (with optional port).
|
email_to | A set of e-mail addresses to which messages will be sent.
|
log_file | The full path of the file to log to. The text %zeushome% will be replaced with the location where the software is installed.
|
note | A description of the action.
|
program_arguments | A table containing arguments and argument values to be passed to the event handling program.
|
program_arguments_json | A Traffic Manager REST-compatible JSON representation of the "program_arguments" table property. Use this field with the "vtm_action_arguments_table" data source for dynamic table generation from input variables.
|
program_program | The program to run.
|
soap_additional_data | Additional information to send with the SOAP call.
|
soap_password | The password for HTTP basic authentication.
|
soap_proxy | The address of the server implementing the SOAP interface (For example, https://example.com).
|
soap_username | Username for HTTP basic authentication. Leave blank if you do not wish to use authentication.
|
syslog_msg_len_limit | Maximum length in bytes of a message sent to the remote syslog. Messages longer than this will be truncated before they are sent.
|
syslog_sysloghost | The host and optional port to send syslog messages to (if empty, messages will be sent to localhost).
|
timeout | How long the action can run for before it is stopped automatically (set to 0 to disable timeouts).
|
trap_auth_password | The authentication password for sending a Notify over SNMPv3. Blank to send unauthenticated traps.
|
trap_community | The community string to use when sending a Trap over SNMPv1 or a Notify over SNMPv2c.
|
trap_hash_algorithm | The hash algorithm for SNMPv3 authentication.
"md5": MD5 "sha1": SHA-1 |
trap_priv_password | The encryption password to encrypt a Notify message for SNMPv3. Requires that authentication also be configured. Blank to send unencrypted traps.
|
trap_traphost | The hostname or IPv4 address and optional port number that should receive traps.
|
trap_username | The SNMP username to use to send the Notify over SNMPv3.
|
trap_version | The SNMP version to use to send the Trap/Notify.
"snmpv1": SNMPv1 "snmpv2c": SNMPv2c "snmpv3": SNMPv3 |
type | The action type.
"email": E-Mail "log": Log to File "program": Program "soap": SOAP Callback "syslog": Log to Syslog "trap": SNMP Notify or Trap |
verbose | Enable or disable verbose logging for this action.
|
vtm_aptimizer_scope
URI Endpoint: /api/tm/8.3/config/active/aptimizer/scopes
Application scopes define criteria that match URLs to specific logical web applications hosted by a virtual server.
# Example usage of vtm_aptimizer_scope resource...
resource "vtm_aptimizer_scope" "my_aptimizer_scope" {
name = "MyAptimizerScope"
}Property | Description |
|---|---|
name | Name of the object
|
canonical_hostname | If the hostnames for this scope are aliases of each other, the canonical hostname will be used for requests to the server.
|
hostnames | The hostnames to limit acceleration to.
|
root | The root path of the application defined by this application scope.
|
vtm_bgpneighbor
URI Endpoint: /api/tm/8.3/config/active/bgpneighbors
The conf/bgpneighbors directory contains configuration files for BGP neighbors. The name of a file is the name of the neighbor configuration that it defines. BGP neighbors can be managed under the System > Fault Tolerance > BGP Neighbors section of the Admin UI, or by using functions under the BGPNeighbors section of the SOAP API and CLI.
# Example usage of vtm_bgpneighbor resource...
resource "vtm_bgpneighbor" "my_bgpneighbor" {
name = "MyBgpneighbor"
}Property | Description |
|---|---|
name | Name of the object
|
address | The IP address of the BGP neighbor
|
advertisement_interval | The minimum interval between the sending of BGP routing updates to neighbors. Note that as a result of jitter, as defined for BGP, the interval during which no advertisements are sent will be between 75% and 100% of this value.
|
as_number | The AS number for the BGP neighbor
|
authentication_password | The password to be used for authentication of sessions with neighbors
|
holdtime | The period after which the BGP session with the neighbor is deemed to have become idle - and requires re-establishment - if the neighbor falls silent.
|
keepalive | The interval at which messages are sent to the BGP neighbor to keep the mutual BGP session established.
|
machines | The traffic managers that are to use this neighbor
|
vtm_bandwidth
URI Endpoint: /api/tm/8.3/config/active/bandwidth
A Bandwidth class, which can be assigned to a virtual server or pool in order to limit the number of bytes per second used by inbound or outbound traffic.
# Example usage of vtm_bandwidth resource...
resource "vtm_bandwidth" "my_bandwidth" {
name = "MyBandwidth"
}Property | Description |
|---|---|
name | Name of the object
|
maximum | The maximum bandwidth to allocate to connections that are associated with this bandwidth class (in kbits/second).
|
note | A description of this bandwidth class.
|
sharing | The scope of the bandwidth class.
"cluster": Bandwidth is shared across all traffic managers "connection": Each connection can use the maximum rate "machine": Bandwidth is shared per traffic manager |
vtm_cloud_api_credential
URI Endpoint: /api/tm/8.3/config/active/cloud_api_credentials
Cloud credentials used in cloud API calls
# Example usage of vtm_cloud_api_credential resource...
resource "vtm_cloud_api_credential" "my_cloud_api_credential" {
name = "MyCloudApiCredential"
}Property | Description |
|---|---|
name | Name of the object
|
api_server | The vCenter server hostname or IP address.
|
cloud_api_timeout | The traffic manager creates and destroys nodes via API calls. This setting specifies (in seconds) how long to wait for such calls to complete.
|
cred1 | The first part of the credentials for the cloud user. Typically this is some variation on the username concept.
|
cred2 | The second part of the credentials for the cloud user. Typically this is some variation on the password concept.
|
cred3 | The third part of the credentials for the cloud user. Typically this is some variation on the authentication token concept.
|
script | The script to call for communication with the cloud API.
|
update_interval | The traffic manager will periodically check the status of the cloud through an API call. This setting specifies the interval between such updates.
|
vtm_custom
URI Endpoint: /api/tm/8.3/config/active/custom
Custom configuration sets store arbitrary named values. These values can be read by SOAP or REST clients.
# Example usage of vtm_custom resource...
resource "vtm_custom" "my_custom" {
name = "MyCustom"
}Property | Description |
|---|---|
name | Name of the object
|
string_lists | This table contains named lists of strings
|
string_lists_json | A Traffic Manager REST-compatible JSON representation of the "string_lists" table property. Use this field with the "vtm_custom_string_lists_table" data source for dynamic table generation from input variables.
|
vtm_dns_server_zone
URI Endpoint: /api/tm/8.3/config/active/dns_server/zones
The conf/dnsserver/zones/ file contains zone metadata
# Example usage of vtm_dns_server_zone resource...
resource "vtm_dns_server_zone" "my_dns_server_zone" {
name = "MyDnsServerZone"
origin =
zonefile =
}Property | Description |
|---|---|
name | Name of the object
|
origin | The domain origin of this Zone.
|
zonefile | The Zone File encapsulated by this Zone.
|
vtm_dns_server_zone_file
URI Endpoint: /api/tm/8.3/config/active/dns_server/zone_files
The conf/dnsserver/zonefiles/ directory contains files that define DNS zones.
# Example usage of vtm_dns_server_zone_file resource...
resource "vtm_dns_server_zone_file" "my_dns_server_zone_file" {
content = ""
name = "MyDnsServerZoneFile"
}Property | Description |
|---|---|
name | Name of the object
|
content | Object content
|
vtm_event_type
URI Endpoint: /api/tm/8.3/config/active/event_types
Configuration that ties actions to a set of events that trigger them.
# Example usage of vtm_event_type resource...
resource "vtm_event_type" "my_event_type" {
name = "MyEventType"
}Property | Description |
|---|---|
name | Name of the object
|
actions | The actions triggered by events matching this event type, as a list of action references.
|
built_in | If set to Yes this indicates that this configuration is built-in (provided as part of the software) and must not be deleted or edited.
|
cloudcredentials_event_tags | Cloud credentials event tags
|
cloudcredentials_objects | Cloud credentials object names
|
config_event_tags | Configuration file event tags
|
faulttolerance_event_tags | Fault tolerance event tags
|
general_event_tags | General event tags
|
glb_event_tags | GLB service event tags
|
glb_objects | GLB service object names
|
java_event_tags | Java event tags
|
licensekeys_event_tags | License key event tags
|
licensekeys_objects | License key object names
|
locations_event_tags | Location event tags
|
locations_objects | Location object names
|
monitors_event_tags | Monitor event tags
|
monitors_objects | Monitors object names
|
note | A description of this event type.
|
pools_event_tags | Pool key event tags
|
pools_objects | Pool object names
|
protection_event_tags | Service protection class event tags
|
protection_objects | Service protection class object names
|
rules_event_tags | Rule event tags
|
rules_objects | Rule object names
|
slm_event_tags | SLM class event tags
|
slm_objects | SLM class object names
|
ssl_event_tags | SSL event tags
|
sslhw_event_tags | SSL hardware event tags
|
trafficscript_event_tags | TrafficScript event tags
|
vservers_event_tags | Virtual server event tags
|
vservers_objects | Virtual server object names
|
zxtms_event_tags | Traffic manager event tags
|
zxtms_objects | Traffic manager object names
|
vtm_extra_file
URI Endpoint: /api/tm/8.3/config/active/extra_files
A user-uploaded file. Such files can be used in TrafficScript code using the resource.get function.
# Example usage of vtm_extra_file resource...
resource "vtm_extra_file" "my_extra_file" {
content = ""
name = "MyExtraFile"
}Property | Description |
|---|---|
name | Name of the object
|
content | Object content
|
vtm_glb_service
URI Endpoint: /api/tm/8.3/config/active/glb_services
A global load balancing service is used by a virtual server to modify DNS requests in order load balance data across different GLB locations.
# Example usage of vtm_glb_service resource...
resource "vtm_glb_service" "my_glb_service" {
name = "MyGlbService"
}Property | Description |
|---|---|
name | Name of the object
|
algorithm | Defines the global load balancing algorithm to be used.
"chained": Sends traffic to one location at a time, until that location fails where the next one in the chain is used. "geo": Distributes traffic based solely on the geographic location of each client. "hybrid": Distribute traffic based on both the load and geographic location. "load": Distributes traffic based on the current load to each location. "round_robin": Distributes traffic by assigning each request to a new location in turn. Over a period of time, all locations will receive the same number of requests. "weighted_random": Distributes traffic in a random way, but according to a weighted policy defined by individual location weights |
all_monitors_needed | Do all monitors assigned to a location need to report success in order for it to be considered healthy?
|
autorecovery | The last location to fail will be available as soon as it recovers.
|
chained_auto_failback | Enable/Disable automatic failback mode.
|
chained_location_order | The locations this service operates for and defines the order in which locations fail.
|
disable_on_failure | Locations recovering from a failure will become disabled.
|
dnssec_keys | A table mapping domains to the private keys that authenticate them
|
dnssec_keys_json | A Traffic Manager REST-compatible JSON representation of the "dnssec_keys" table property. Use this field with the "vtm_glb_service_dnssec_keys_table" data source for dynamic table generation from input variables.
|
domains | The domains shown here should be a list of Fully Qualified Domain Names that you would like to balance globally. Responses from the back end DNS servers for queries that do not match this list will be forwarded to the client unmodified. Note: "*" may be used as a wild card.
|
enabled | Enable/Disable our response manipulation of DNS.
|
geo_effect | How much should the locality of visitors affect the choice of location used? This value is a percentage, 0% means that no locality information will be used, and 100% means that locality will always control which location is used. Values between the two extremes will act accordingly.
|
last_resort_response | The response to be sent in case there are no locations available.
|
location_draining | This is the list of locations for which this service is draining. A location that is draining will never serve any of its service IP addresses for this domain. This can be used to take a location off-line.
|
location_settings | Table containing location specific settings.
|
location_settings_json | A Traffic Manager REST-compatible JSON representation of the "location_settings" table property. Use this field with the "vtm_glb_service_location_settings_table" data source for dynamic table generation from input variables.
|
log_enabled | Log connections to this GLB service?
|
log_filename | The filename the verbose query information should be logged to. Appliances will ignore this.
|
log_format | The format of the log lines.
|
return_ips_on_fail | Return all or none of the IPs under complete failure.
|
rules | Response rules to be applied in the context of the service, in order, comma separated.
|
ttl | The TTL for the DNS resource records handled by the GLB service.
|
vtm_global_settings
URI Endpoint: /api/tm/8.3/config/active/global_settings
General settings that apply to every machine in the cluster.
# Example usage of vtm_global_settings resource...
resource "vtm_global_settings" "my_global_settings" {
}Property | Description |
|---|---|
accepting_delay | How often, in milliseconds, each traffic manager child process (that isn't listening for new connections) checks to see whether it should start listening for new connections.
|
admin_honor_fallback_scsv | Whether or not the admin server, the internal control port and the config daemon honor the Fallback SCSV to protect connections against downgrade attacks.
|
admin_ssl3_allow_rehandshake | Whether or not SSL3/TLS re-handshakes should be supported for admin server and internal connections.
"always": Always allow "never": Never allow "rfc5746": Only if client uses RFC 5746 (Secure Renegotiation Extension) "safe": Allow safe re-handshakes |
admin_ssl3_ciphers | The SSL ciphers to use for admin server and internal connections. For information on supported ciphers see the online help.
|
admin_ssl3_diffie_hellman_key_length | The length in bits of the Diffie-Hellman key for ciphers that use Diffie-Hellman key agreement for admin server and internal connections.
"dh_1024": Use 1024 bit keys for Diffie-Hellman ciphers. "dh_2048": Use 2048 bit keys for Diffie-Hellman ciphers. "dh_3072": Use 3072 bit keys for Diffie-Hellman ciphers. "dh_4096": Use 4096 bit keys for Diffie-Hellman ciphers. |
admin_ssl3_min_rehandshake_interval | If SSL3/TLS re-handshakes are supported on the admin server, this defines the minimum time interval (in milliseconds) between handshakes on a single SSL3/TLS connection that is permitted. To disable the minimum interval for handshakes the key should be set to the value 0.
|
admin_ssl_elliptic_curves | The SSL elliptic curve preference list for admin and internal connections. The named curves P256, P384 and P521 may be configured.
|
admin_ssl_insert_extra_fragment | Whether or not SSL3 and TLS1 use one-byte fragments as a BEAST countermeasure for admin server and internal connections.
|
admin_ssl_max_handshake_message_size | The maximum size (in bytes) of SSL handshake messages that the admin server and internal connections will accept. To accept any size of handshake message the key should be set to the value 0.
|
admin_ssl_signature_algorithms | The SSL signature algorithms preference list for admin and internal connections using TLS version 1.2 or higher. For information on supported algorithms see the online help.
|
admin_support_ssl3 | Whether or not SSL3 support is enabled for admin server and internal connections.
|
admin_support_tls1 | Whether or not TLS1.0 support is enabled for admin server and internal connections.
|
admin_support_tls1_1 | Whether or not TLS1.1 support is enabled for admin server and internal connections.
|
admin_support_tls1_2 | Whether or not TLS1.2 support is enabled for admin server and internal connections.
|
admin_support_tls1_3 | Whether or not TLS1.3 support is enabled for admin server and internal connections.
|
afm_enabled | Is the application firewall enabled.
|
appliance_bootloader_password | The password used to protect the bootloader. An empty string means there will be no protection.
|
appliance_return_path_routing_enabled | Whether or not the traffic manager will attempt to route response packets back to clients via the same route on which the corresponding request arrived. Note that this applies only to the last hop of the route - the behaviour of upstream routers cannot be altered by the traffic manager.
|
aptimizer_max_dependent_fetch_size | The maximum size of a dependent resource that can undergo Web Accelerator optimization. Any content larger than this size will not be optimized. Units of KB and MB can be used, no postfix denotes bytes. A value of 0 disables the limit.
|
aptimizer_max_original_content_buffer_size | The maximum size of unoptimized content buffered in the traffic manager for a single backend response that is undergoing Web Accelerator optimization. Responses larger than this will not be optimized. Note that if the backend response is compressed then this setting pertains to the compressed size, before Web Accelerator decompresses it. Units of KB and MB can be used, no postfix denotes bytes. Value range is 1 - 128MB.
|
aptimizer_watchdog_interval | The period of time (in seconds) after which a previous failure will no longer count towards the watchdog limit.
|
aptimizer_watchdog_limit | The maximum number of times the Web Accelerator sub-process will be started or restarted within the interval defined by the aptimizer!watchdog_interval setting. If the process fails this many times, it must be restarted manually from the Diagnose page. Zero means no limit.
|
auditlog_via_eventd | Whether to mirror the audit log to EventD.
|
auditlog_via_syslog | Whether to output audit log message to the syslog.
|
auth_saml_key_lifetime | Lifetime in seconds of cryptographic keys used to decrypt SAML SP sessions stored externally (client-side).
|
auth_saml_key_rotation_interval | Rotation interval in seconds for cryptographic keys used to encrypt SAML SP sessions stored externally (client-side).
|
autoscaler_verbose | Whether or not detailed messages about the autoscaler's activity are written to the error log.
|
bgp_as_number | The number of the BGP AS in which the traffic manager will operate. Must be entered in decimal.
|
bgp_enabled | Whether BGP Route Health Injection is enabled
|
chunk_size | The default chunk size for reading/writing requests.
|
client_first_opt | Whether or not your traffic manager should make use of TCP optimisations to defer the processing of new client-first connections until the client has sent some data.
|
cluster_comms_allow_update_default | The default value of allow_update for new cluster members. If you have cluster members joining from less trusted locations (such as cloud instances) this can be set to false in order to make them effectively "read-only" cluster members.
|
cluster_comms_allowed_update_hosts | The hosts that can contact the internal administration port on each traffic manager. This should be a list containing IP addresses, CIDR IP subnets, and localhost; or it can be set to all to allow any host to connect.
|
cluster_comms_state_sync_interval | How often to propagate the session persistence and bandwidth information to other traffic managers in the same cluster. Set this to 0 (zero) to disable propagation. Note that a cluster using "unicast" heartbeat messages cannot turn off these messages.
|
cluster_comms_state_sync_timeout | The maximum amount of time to wait when propagating session persistence and bandwidth information to other traffic managers in the same cluster. Once this timeout is hit the transfer is aborted and a new connection created.
|
cluster_identifier | Cluster identifier. Generally supplied by Services Director.
|
connection_idle_connections_max | The maximum number of unused HTTP keepalive connections with back-end nodes that the traffic manager should maintain for re-use. Setting this to 0 (zero) will cause the traffic manager to auto-size this parameter based on the available number of file-descriptors.
|
connection_idle_timeout | How long an unused HTTP keepalive connection should be kept before it is discarded.
|
connection_listen_queue_size | The listen queue size for managing incoming connections. It may be necessary to increase the system's listen queue size if this value is altered. If the value is set to 0 then the default system setting will be used.
|
connection_max_accepting | Number of processes that should accept new connections. Only this many traffic manager child processes will listen for new connections at any one time. Setting this to 0 (zero) will cause your traffic manager to select an appropriate default value based on the architecture and number of CPUs.
|
connection_multiple_accept | Whether or not the traffic manager should try to read multiple new connections each time a new client connects. This can improve performance under some very specific conditions. However, in general it is recommended that this be set to 'false'.
|
connection_udp_read_multiple | Whether or not the traffic manager should try to read multiple UDP packets from clients each time the kernel reports data received from clients. This can improve performance for the situation with high UDP traffic throughput from clients to the traffic manager. Therefore, in general it is recommended that this be set to 'Yes'.
|
dns_max_ttl | Maximum Time To Live (expiry time) for entries in the DNS cache.
|
dns_min_ttl | Minimum Time To Live (expiry time) for entries in the DNS cache.
|
dns_negative_expiry | Expiry time for failed lookups in the DNS cache.
|
dns_size | Maximum number of entries in the DNS cache.
|
dns_timeout | Timeout for receiving a response from a DNS server.
|
ec2_access_key_id | Deprecated: This key is unused. Amazon authentication credentials are now extracted from IAM Roles assigned to an EC2 instance.
|
ec2_awstool_timeout | The maximum amount of time requests to the AWS Query API can take before timing out.
|
ec2_metadata_server | URL for the EC2 metadata server, http://169.254.169.254/latest/meta-data for example.
|
ec2_query_server | URL for the Amazon EC2 endpoint, https://ec2.amazonaws.com/ for example.
|
ec2_secret_access_key | Deprecated: This key is unused. Amazon authentication credentials are now extracted from IAM Roles assigned to an EC2 instance.
|
ec2_verify_query_server_cert | Whether to verify Amazon EC2 endpoint's certificate using CA(s) present in SSL Certificate Authorities Catalog.
|
eventing_mail_interval | The minimum length of time that must elapse between alert emails being sent. Where multiple alerts occur inside this timeframe, they will be retained and sent within a single email rather than separately.
|
eventing_max_attempts | The number of times to attempt to send an alert email before giving up.
|
fault_tolerance_arp_count | The number of ARP packets a traffic manager should send when an IP address is raised.
|
fault_tolerance_auto_failback | Whether or not traffic IPs automatically move back to machines that have recovered from a failure and have dropped their traffic IPs.
|
fault_tolerance_autofailback_delay | Configure the delay of automatic failback after a previous failover event. This setting has no effect if autofailback is disabled.
|
fault_tolerance_child_timeout | How long the traffic manager should wait for status updates from any of the traffic manager's child processes before assuming one of them is no longer servicing traffic.
|
fault_tolerance_frontend_check_ips | The IP addresses used to check front-end connectivity. The text %gateway% will be replaced with the default gateway on each system. Set this to an empty string if the traffic manager is on an Intranet with no external connectivity.
|
fault_tolerance_heartbeat_method | The method traffic managers should use to exchange cluster heartbeat messages.
"multicast": multicast "unicast": unicast |
fault_tolerance_igmp_interval | The interval between unsolicited periodic IGMP Membership Report messages for Multi-Hosted Traffic IP Groups.
|
fault_tolerance_monitor_interval | The frequency, in milliseconds, that each traffic manager machine should check and announce its connectivity.
|
fault_tolerance_monitor_timeout | How long, in seconds, each traffic manager should wait for a response from its connectivity tests or from other traffic manager machines before registering a failure.
|
fault_tolerance_multicast_address | The multicast address and port to use to exchange cluster heartbeat messages.
|
fault_tolerance_unicast_port | The unicast UDP port to use to exchange cluster heartbeat messages.
|
fault_tolerance_use_bind_ip | Whether or not cluster heartbeat messages should only be sent and received over the management network.
|
fault_tolerance_verbose | Whether or not a traffic manager should log all connectivity tests. This is very verbose, and should only be used for diagnostic purposes.
|
fips_enabled | Enable FIPS Mode (requires software restart).
|
ftp_data_bind_low | Whether or not the traffic manager should permit use of FTP data connection source ports lower than 1024. If No the traffic manager can completely drop root privileges, if Yes some or all privileges may be retained in order to bind to low ports.
|
glb_verbose | Write a message to the logs for every DNS query that is load balanced, showing the source IP address and the chosen datacenter.
|
historical_activity_keep_days | Number of days to store historical traffic information, if set to 0 the data will be kept indefinitely.
|
ip_appliance_returnpath | A table of MAC address/network interface to IP address mappings for each router where return path routing is required.
|
ip_appliance_returnpath_json | A Traffic Manager REST-compatible JSON representation of the "ip_appliance_returnpath" table property. Use this field with the "vtm_global_settings_appliance_returnpath_table" data source for dynamic table generation from input variables.
|
java_classpath | CLASSPATH to use when starting the Java runner.
|
java_command | Java command to use when starting the Java runner, including any additional options.
|
java_enabled | Whether or not Java support should be enabled. If this is set to No, then your traffic manager will not start any Java processes. Java support is only required if you are using the TrafficScript java.run() function.
|
java_lib | Java library directory for additional jar files. The Java runner will load classes from any .jar files stored in this directory, as well as the * jar files and classes stored in traffic manager's catalog.
|
java_max_connections | Maximum number of simultaneous Java requests. If there are more than this many requests, then further requests will be queued until the earlier requests are completed. This setting is per-CPU, so if your traffic manager is running on a machine with 4 CPU cores, then each core can make this many requests at one time.
|
java_session_age | Default time to keep a Java session.
|
kerberos_verbose | Whether or not a traffic manager should log all Kerberos related activity. This is very verbose, and should only be used for diagnostic purposes.
|
license_servers | A list of license servers for FLA licensing. A license server should be specified as a <ip/host>:<port> pair.
|
log_error_level | The minimum severity of events/alerts that should be logged to disk. INFO will log all events; a higher severity setting will log fewer events. More fine-grained control can be achieved using events and actions.
"fatal": Only fatal errors are logged "info": All events are logged to disk "serious": Only serious errors or worse "warn": Only warnings and errors are logged |
log_export_auth_hec_token | The HTTP Event Collector token to use for HTTP authentication with a Splunk server.
|
log_export_auth_http | The HTTP authentication method to use when exporting log entries.
"basic": Basic (Username and Password) "none": None "splunk": Splunk (HEC token) |
log_export_auth_password | The password to use for HTTP basic authentication.
|
log_export_auth_username | The username to use for HTTP basic authentication.
|
log_export_enabled | Monitor log files and export entries to the configured endpoint.
|
log_export_endpoint | The URL to which log entries should be sent. Entries are sent using HTTP(S) POST requests.
|
log_export_request_timeout | The number of seconds after which HTTP requests sent to the configured endpoint will be considered to have failed if no response is received. A value of 0 means that HTTP requests will not time out.
|
log_export_tls_verify | Whether the server certificate should be verified when connecting to the endpoint. If enabled, server certificates that do not match the server name, are self-signed, have expired, have been revoked, or that are signed by an unknown CA will be rejected.
|
log_flush_time | How long to wait before flushing the request log files for each virtual server.
|
log_log_file | The file to log event messages to.
|
log_rate | The maximum number of connection errors logged per second when connection error reporting is enabled.
|
log_reopen | How long to wait before re-opening request log files, this ensures that log files will be recreated in the case of log rotation.
|
log_time | The minimum time between log messages for log intensive features such as SLM.
|
max_fds | The maximum number of file descriptors that your traffic manager will allocate.
|
max_tcp_buff_mem | The maximum amount of memory allowed to be used to buffer network data in user space for all TCP connections. The TCP data buffered are either received from clients but before sending to pool nodes, or recevied from pool nodes but before sending to clients. This is specified as either a percentage of system RAM, 5% for example, or an absolute size such as 1024MB and 2GB. A numeric value without suffix MB, GB or % defaults to MB. A value of 800 means 800MB. A value of 0 means unlimited.
|
monitor_memory_size | The maximum number of each of nodes, pools or locations that can be monitored. The memory used to store information about nodes, pools and locations is allocated at start-up, so the traffic manager must be restarted after changing this setting.
|
ospfv2_area | The OSPF area in which the traffic manager will operate. May be entered in decimal or IPv4 address format.
|
ospfv2_area_type | The type of OSPF area in which the traffic manager will operate. This must be the same for all routers in the area, as required by OSPF.
"normal": Normal area "nssa": Not So Stubby Area (RFC3101) "stub": Stub area |
ospfv2_authentication_key_id_a | OSPFv2 authentication key ID. If set to 0, which is the default value, the key is disabled.
|
ospfv2_authentication_key_id_b | OSPFv2 authentication key ID. If set to 0, which is the default value, the key is disabled.
|
ospfv2_authentication_shared_secret_a | OSPFv2 authentication shared secret (MD5). If set to blank, which is the default value, the key is disabled.
|
ospfv2_authentication_shared_secret_b | OSPFv2 authentication shared secret (MD5). If set to blank, which is the default value, the key is disabled.
|
ospfv2_dead_interval | The number of seconds before declaring a silent router down.
|
ospfv2_enabled | Whether OSPFv2 Route Health Injection is enabled
|
ospfv2_hello_interval | The interval at which OSPF "hello" packets are sent to the network.
|
protection_conncount_size | The amount of shared memory reserved for an inter-process table of combined connection counts, used by all Service Protection classes that have per_process_connection_count set to No. The amount is specified as an absolute size, eg 20MB.
|
rate_class_limit | The maximum number of Rate classes that can be created. Approximately 100 bytes will be pre-allocated per Rate class.
|
recent_connections_max_per_process | How many recently closed connections each traffic manager process should save. These saved connections will be shown alongside currently active connections when viewing the Connections page. You should set this value to 0 in a benchmarking or performance-critical environment.
|
recent_connections_retain_time | The amount of time for which snapshots will be retained on the Connections page.
|
recent_connections_snapshot_size | The maximum number of connections each traffic manager process should show when viewing a snapshot on the Connections page. This value includes both currently active connections and saved connections. If set to 0 all active and saved connection will be displayed on the Connections page.
|
remote_licensing_comm_channel_enabled | Whether to create a Communications Channel agent to send and receive messages from the Services Director Registration Server. This will be disabled when performing self-registration with a Services Director which does not support this feature.
|
remote_licensing_comm_channel_port | The port number the Services Director instance is using for access to the traffic manager Communications Channel.
|
remote_licensing_owner | The Owner of a Services Director instance, used for self-registration.
|
remote_licensing_owner_secret | The secret associated with the Owner.
|
remote_licensing_policy_id | The auto-accept Policy ID that this instance should attempt to use.
|
remote_licensing_registration_server | A Services Director address for self-registration. A registration server should be specified as a <ip/host>:<port> pair.
|
remote_licensing_server_certificate | The certificate of a Services Director instance, used for self-registration.
|
rest_api_auth_timeout | The length of time after a successful request that the authentication of a given username and password will be cached for an IP address. A setting of 0 disables the cache forcing every REST request to be authenticated which will adversely affect performance.
|
rest_api_enabled | Whether or not the REST service is enabled.
|
rest_api_http_max_header_length | The maximum allowed length in bytes of a HTTP request's headers.
|
rest_api_maxfds | Maximum number of file descriptors that the REST API will allocate. The REST API must be restarted for a change to this setting to take effect.
|
rest_api_replicate_absolute | Configuration changes will be replicated across the cluster after this period of time, regardless of whether additional API requests are being made.
|
rest_api_replicate_lull | Configuration changes made via the REST API will be propagated across the cluster when no further API requests have been made for this period of time.
|
rest_api_replicate_timeout | The period of time after which configuration replication across the cluster will be cancelled if it has not completed.
|
security_login_banner | Banner text displayed on the Admin Server login page and before logging in to appliance SSH servers.
|
security_login_banner_accept | Whether or not users must explicitly agree to the displayed login_banner text before logging in to the Admin Server.
|
security_login_delay | The number of seconds before another login attempt can be made after a failed attempt.
|
security_max_login_attempts | The number of sequential failed login attempts that will cause a user account to be suspended. Setting this to 0 disables this feature. To apply this to users who have never successfully logged in, track_unknown_users must also be enabled.
|
security_max_login_external | Whether or not usernames blocked due to the max_login_attempts limit should also be blocked from authentication against external services (such as LDAP and RADIUS).
|
security_max_login_suspension_time | The number of minutes to suspend users who have exceeded the max_login_attempts limit.
|
security_password_allow_consecutive_chars | Whether or not to allow the same character to appear consecutively in passwords.
|
security_password_changes_per_day | The maximum number of times a password can be changed in a 24-hour period. Set to 0 to disable this restriction.
|
security_password_min_alpha_chars | Minimum number of alphabetic characters a password must contain. Set to 0 to disable this restriction.
|
security_password_min_length | Minimum number of characters a password must contain. Set to 0 to disable this restriction.
|
security_password_min_numeric_chars | Minimum number of numeric characters a password must contain. Set to 0 to disable this restriction.
|
security_password_min_special_chars | Minimum number of special (non-alphanumeric) characters a password must contain. Set to 0 to disable this restriction.
|
security_password_min_uppercase_chars | Minimum number of uppercase characters a password must contain. Set to 0 to disable this restriction.
|
security_password_reuse_after | The number of times a password must have been changed before it can be reused. Set to 0 to disable this restriction.
|
security_post_login_banner | Banner text to be displayed on the appliance console after login.
|
security_track_unknown_users | Whether to remember past login attempts from usernames that are not known to exist (should be set to false for an Admin Server accessible from the public Internet). This does not affect the audit log.
|
security_ui_page_banner | Banner text to be displayed on all Admin Server pages.
|
session_asp_cache_size | The maximum number of entries in the ASP session persistence cache. This is used for storing session mappings for ASP session persistence. Approximately 100 bytes will be pre-allocated per entry.
|
session_ip_cache_expiry | IP session persistence cache expiry time in seconds. A session will not be reused if the time since it was last used exceeds this value. 0 indicates no expiry timeout.
|
session_ip_cache_size | The maximum number of entries in the IP session persistence cache. This is used to provide session persistence based on the source IP address. Approximately 100 bytes will be pre-allocated per entry.
|
session_j2ee_cache_expiry | J2EE session persistence cache expiry time in seconds. A session will not be reused if the time since it was last used exceeds this value. 0 indicates no expiry timeout.
|
session_j2ee_cache_size | The maximum number of entries in the J2EE session persistence cache. This is used for storing session mappings for J2EE session persistence. Approximately 100 bytes will be pre-allocated per entry.
|
session_ssl_cache_size | The maximum number of entries in the SSL session persistence cache. This is used to provide session persistence based on the SSL session ID. Approximately 200 bytes will be pre-allocated per entry.
|
session_universal_cache_expiry | Universal session persistence cache expiry time in seconds. A session will not be reused if the time since it was last used exceeds this value. 0 indicates no expiry timeout.
|
session_universal_cache_size | The maximum number of entries in the global universal session persistence cache. This is used for storing session mappings for universal session persistence. Approximately 100 bytes will be pre-allocated per entry.
|
shared_pool_size | The size of the shared memory pool used for shared storage across worker processes (e.g. bandwidth shared data).This is specified as either a percentage of system RAM, 5% for example, or an absolute size such as 10MB.
|
slm_class_limit | The maximum number of SLM classes that can be created. Approximately 100 bytes will be pre-allocated per SLM class.
|
snmp_user_counters | The number of user defined SNMP counters. Approximately 100 bytes will be pre-allocated at start-up per user defined SNMP counter.
|
so_rbuff_size | The size of the operating system's read buffer. A value of 0 (zero) means to use the OS default; in normal circumstances this is what should be used.
|
so_wbuff_size | The size of the operating system's write buffer. A value of 0 (zero) means to use the OS default; in normal circumstances this is what should be used.
|
soap_idle_minutes | The number of minutes that the SOAP server should remain idle before exiting. The SOAP server has a short startup delay the first time a SOAP request is made, subsequent SOAP requests don't have this delay.
|
socket_optimizations | Whether or not the traffic manager should use potential network socket optimisations. If set to auto, a decision will be made based on the host platform.
"auto": Decide based on local platform "no": Disable socket optimizations "yes": Enable socket optimizations |
ssl_allow_rehandshake | Whether or not SSL/TLS re-handshakes should be supported. Enabling support for re-handshakes can expose services to Man-in-the-Middle attacks. It is recommended that only "safe" handshakes be permitted, or none at all.
"always": Always allow "never": Never allow "rfc5746": Only if client uses RFC 5746 (Secure Renegotiation Extension) "safe": Allow safe re-handshakes |
ssl_cache_enabled | Whether or not the SSL server session cache is enabled, unless overridden by virtual server settings.
|
ssl_cache_expiry | How long the SSL session IDs for SSL decryption should be stored for.
|
ssl_cache_per_virtualserver | Whether an SSL session created by a given virtual server can only be resumed by a connection to the same virtual server.
|
ssl_cache_size | How many entries the SSL session ID cache should hold. This cache is used to cache SSL sessions to help speed up SSL handshakes when performing SSL decryption. Each entry will allocate approximately 1.75kB of metadata.
|
ssl_cipher_suites | The SSL/TLS cipher suites preference list for SSL/TLS connections, unless overridden by virtual server or pool settings. For information on supported cipher suites see the online help.
|
ssl_client_cache_enabled | Whether or the SSL client cache will be used, unless overridden by pool settings.
|
ssl_client_cache_expiry | How long in seconds SSL sessions should be stored in the client cache for, by default. Servers returning session tickets may also provide a lifetime hint, which will be used if it is less than this value.
|
ssl_client_cache_size | How many entries the SSL client session cache should hold, per child. This cache is used to cache SSL sessions to help speed up SSL handshakes when performing SSL encryption. Each entry will require approx 100 bytes of memory plus space for either an SSL session id or an SSL session ticket, which may be as small as 16 bytes or may be as large as a few kilobytes, depending upon the server behavior.
|
ssl_client_cache_tickets_enabled | Whether or not session tickets, including TLS >= 1.3 PSKs, may be requested and stored in the SSL client cache.
|
ssl_crl_mem_size | How much shared memory to allocate for loading Certificate Revocation Lists. This should be at least 3 times the total size of all CRLs on disk. This is specified as either a percentage of system RAM, 1% for example, or an absolute size such as 10MB.
|
ssl_diffie_hellman_modulus_size | The size in bits of the modulus for the domain parameters used for cipher suites that use finite field Diffie-Hellman key agreement.
"dh_1024": 1024 bit modulus "dh_2048": 2048 bit modulus "dh_3072": 3072 bit modulus "dh_4096": 4096 bit modulus |
ssl_elliptic_curves | The SSL/TLS elliptic curve preference list for SSL/TLS connections using TLS version 1.0 or higher, unless overridden by virtual server or pool settings. For information on supported curves see the online help.
|
ssl_hardware_accel | Whether or not the SSL hardware is an "accelerator" (faster than software). By default the traffic manager will only use the SSL hardware if a key requires it (i.e. the key is stored on secure hardware and the traffic manager only has a placeholder/identifier key). With this option enabled, your traffic manager will instead try to use hardware for all SSL decrypts.
|
ssl_hardware_azure_client_id | The client identifier used when accessing the Microsoft Azure Key Vault.
|
ssl_hardware_azure_client_secret | The client secret used when accessing the Microsoft Azure Key Vault.
|
ssl_hardware_azure_vault_url | The URL for the REST API of the Microsoft Azure Key Vault.
|
ssl_hardware_azure_verify_rest_api_cert | Whether or not the Azure Key Vault REST API certificate should be verified.
|
ssl_hardware_driver_pkcs11_debug | Print verbose information about the PKCS11 hardware security module to the event log.
|
ssl_hardware_driver_pkcs11_lib | The location of the PKCS#11 library for your SSL hardware if it is not in a standard location. The traffic manager will search the standard locations by default.
|
ssl_hardware_driver_pkcs11_slot_desc | The label of the SSL Hardware slot to use. Only required if you have multiple HW accelerator slots.
|
ssl_hardware_driver_pkcs11_slot_type | The type of SSL hardware slot to use.
"module": Module Protected "operator": Operator Card Set "softcard": Soft Card |
ssl_hardware_driver_pkcs11_user_pin | The User PIN for the PKCS token (PKCS#11 devices only).
|
ssl_hardware_failure_count | The number of consecutive failures from the SSL hardware that will be tolerated before the traffic manager assumes its session with the device is invalid and tries to log in again. This is necessary when the device reboots following a power failure.
|
ssl_hardware_library | The type of SSL hardware to use. The drivers for the SSL hardware should be installed and accessible to the traffic manager software.
"azure": Microsoft Azure Key Vault "none": None "pkcs11": PKCS#11 |
ssl_honor_fallback_scsv | Whether or not ssl-decrypting Virtual Servers honor the Fallback SCSV to protect connections against downgrade attacks.
|
ssl_insert_extra_fragment | Whether or not SSL3 and TLS1 use one-byte fragments as a BEAST countermeasure.
|
ssl_log_keys | Whether SSL connection key logging should be available via the ssl.sslkeylogline() TrafficScript function. If this setting is disabled then ssl.sslkeylogline() will always return the empty string.
|
ssl_max_handshake_message_size | The maximum size (in bytes) of SSL handshake messages that SSL connections will accept. To accept any size of handshake message the key should be set to the value 0.
|
ssl_middlebox_compatibility | Whether or not TLS 1.3 middlebox compatibility mode as described in RFC 8446 appendix D.4 will be used in connections to pool nodes, unless overridden by pool settings.
|
ssl_min_rehandshake_interval | If SSL3/TLS re-handshakes are supported, this defines the minimum time interval (in milliseconds) between handshakes on a single SSL3/TLS connection that is permitted. To disable the minimum interval for handshakes the key should be set to the value 0.
|
ssl_ocsp_cache_size | The maximum number of cached client certificate OCSP results stored. This cache is used to speed up OCSP checks against client certificates by caching results. Approximately 1040 bytes are pre-allocated per entry.
|
ssl_ocsp_stapling_default_refresh_interval | How long to wait before refreshing requests on behalf of the store of certificate status responses used by OCSP stapling, if we don't have an up-to-date OCSP response.
|
ssl_ocsp_stapling_maximum_refresh_interval | Maximum time to wait before refreshing requests on behalf of the store of certificate status responses used by OCSP stapling. (0 means no maximum.)
|
ssl_ocsp_stapling_mem_size | How much shared memory to allocate for the store of certificate status responses for OCSP stapling. This should be at least 2kB times the number of certificates configured to use OCSP stapling. This is specified as either a percentage of system RAM, 1% for example, or an absolute size such as 10MB.
|
ssl_ocsp_stapling_time_tolerance | How many seconds to allow the current time to be outside the validity time of an OCSP response before considering it invalid.
|
ssl_ocsp_stapling_verify_response | Whether the OCSP response signature should be verified before the OCSP response is cached.
|
ssl_signature_algorithms | The SSL/TLS signature algorithms preference list for SSL/TLS connections using TLS version 1.2 or higher, unless overridden by virtual server or pool settings. For information on supported algorithms see the online help.
|
ssl_support_ssl3 | Whether or not SSL3 support is enabled.
|
ssl_support_tls1 | Whether or not TLS1.0 support is enabled.
|
ssl_support_tls1_1 | Whether or not TLS1.1 support is enabled.
|
ssl_support_tls1_2 | Whether or not TLS1.2 support is enabled.
|
ssl_support_tls1_3 | Whether or not TLS1.3 support is enabled.
|
ssl_tickets_enabled | Whether or not session tickets will be issued to and accepted from clients that support them, unless overridden by virtual server settings.
|
ssl_tickets_reissue_policy | When an SSL session ticket will be reissued (ie when a new ticket will be generated for the same SSL session).
"always": always "never": never |
ssl_tickets_ticket_expiry | The length of time for which an SSL session ticket will be accepted by a virtual server after the ticket is created. If a ticket is reissued (if ssl!tickets!reissue_policy is set to 'always') this time starts at the time when the ticket was reissued.
|
ssl_tickets_ticket_key_expiry | The length of time for which an auto-generated SSL ticket key will be used to decrypt old session ticket, before being deleted from memory. This setting is ignored if there are any entries in the (REST-only) SSL ticket keys catalog.
|
ssl_tickets_ticket_key_rotation | The length of time for which an auto-generated SSL ticket key will be used to encrypt new session tickets, before a new SSL ticket key is generated. The ticket encryption key will be held in memory for ssl!tickets!ticket_key_expiry, so that tickets encrypted using the key can still be decrypted and used. This setting is ignored if there are any entries in the (REST-only) SSL ticket keys catalog.
|
ssl_tickets_time_tolerance | How many seconds to allow the current time to be outside the validity time of an SSL ticket before considering it invalid.
|
ssl_validate_server_certificates_catalog | Whether the traffic manager should validate that SSL server certificates form a matching key pair before the certificate gets used on an SSL decrypting virtual server.
|
telemetry_enabled | Allow the reporting of anonymized usage data for product improvement and customer support purposes.
|
tip_class_limit | The maximum number of Traffic IP Groups that can be created.
|
trafficscript_data_local_size | The maximum amount of memory available to store TrafficScript data.local.set() information. This can be specified as a percentage of system RAM, 5% for example; or an absolute size such as 200MB.
|
trafficscript_data_size | The maximum amount of memory available to store TrafficScript data.set() information. This can be specified as a percentage of system RAM, 5% for example; or an absolute size such as 200MB.
|
trafficscript_execution_time_warning | Raise an event if a TrafficScript rule runs for more than this number of milliseconds in a single invocation. If you get such events repeatedly, you may want to consider re-working some of your TrafficScript rules. A value of 0 means no warnings will be issued.
|
trafficscript_max_instr | The maximum number of instructions a TrafficScript rule will run. A rule will be aborted if it runs more than this number of instructions without yielding, preventing infinite loops.
|
trafficscript_memory_warning | Raise an event if a TrafficScript rule requires more than this amount of buffered network data. If you get such events repeatedly, you may want to consider re-working some of your TrafficScript rules to use less memory or to stream the data that they process rather than storing it all in memory. This setting also limits the amount of data that can be returned by request.GetLine().
|
trafficscript_regex_cache_size | The maximum number of regular expressions to cache in TrafficScript. Regular expressions will be compiled in order to speed up their use in the future.
|
trafficscript_regex_match_limit | The maximum number of ways TrafficScript will attempt to match a regular expression at each position in the subject string, before it aborts the rule and reports a TrafficScript error.
|
trafficscript_regex_match_warn_percentage | The percentage of regex_match_limit at which TrafficScript reports a performance warning.
|
trafficscript_variable_pool_use | Allow the pool.use and pool.select TrafficScript functions to accept variables instead of requiring literal strings. Enabling this feature has the following effects1. Your traffic manager may no longer be able to know whether a pool is in use.2. Errors for pools that aren't in use will not be hidden.3. Some settings displayed for a Pool may not be appropriate for the type of traffic being managed.4. Pool usage information on the pool edit pages and config summary may not be accurate.5. Monitors will run for all pools (with this option disabled monitors will only run for Pools that are used).
|
transaction_export_enabled | Export metadata about transactions processed by the traffic manager to an external location.
|
transaction_export_endpoint | The endpoint to which transaction metadata should be exported. The endpoint is specified as a hostname or IP address with a port.
|
transaction_export_tls | Whether the connection to the specified endpoint should be encrypted.
|
transaction_export_tls_verify | Whether the server certificate presented by the endpoint should be verified, preventing a connection from being established if the certificate does not match the server name, is self-signed, is expired, is revoked, or has an unknown CA.
|
watchdog_timeout | The maximum time in seconds a process can fail to update its heartbeat, before the watchdog considers it to have stalled.
|
web_cache_avg_path_length | The estimated average length of the path (including query string) for resources being cached. An amount of memory equal to this figure multiplied by max_file_num will be allocated for storing the paths for cache entries. This setting can be increased if your web site makes extensive use of long URLs.
|
web_cache_disk | Whether or not to use a disk-backed (typically SSD) cache. If set to Yes cached web pages will be stored in a file on disk. This enables the traffic manager to use a cache that is larger than available RAM. The size setting should also be adjusted to select a suitable maximum size based on your disk space. Note that the disk caching is optimized for use with SSD storage.
|
web_cache_disk_dir | If disk caching is enabled, this sets the directory where the disk cache file will be stored. The traffic manager will create a file called webcache.data in this location. Note that the disk caching is optimized for use with SSD storage.
|
web_cache_max_file_num | Maximum number of entries in the cache. Approximately 0.9 KB will be pre-allocated per entry for metadata, this is in addition to the memory reserved for the content cache and for storing the paths of the cached resources.
|
web_cache_max_file_size | Largest size of a cacheable object in the cache. This is specified as either a percentage of the total cache size, 2% for example, or an absolute size such as 20MB.
|
web_cache_max_path_length | The maximum length of the path (including query string) for the resource being cached. If the path exceeds this length then it will not be added to the cache.
|
web_cache_normalize_query | Enable normalization (lexical ordering of the parameter-assignments) of the query string.
|
web_cache_size | The maximum size of the HTTP web page cache. This is specified as either a percentage of system RAM, 20% for example, or an absolute size such as 200MB.
|
web_cache_verbose | Add an X-Cache-Info header to every HTTP response, showing whether the request and/or the response was cacheable.
|
vtm_kerberos_krb5conf
URI Endpoint: /api/tm/8.3/config/active/kerberos/krb5confs
A Kerberos krb5.conf file that provides the raw configuration for a Kerberos principal.
# Example usage of vtm_kerberos_krb5conf resource...
resource "vtm_kerberos_krb5conf" "my_kerberos_krb5conf" {
content = ""
name = "MyKerberosKrb5Conf"
}Property | Description |
|---|---|
name | Name of the object
|
content | Object content
|
vtm_kerberos_keytab
URI Endpoint: /api/tm/8.3/config/active/kerberos/keytabs
A Kerberos keytab file contains credentials to authenticate as (a number of) Kerberos principals.
# Example usage of vtm_kerberos_keytab resource...
resource "vtm_kerberos_keytab" "my_kerberos_keytab" {
content = ""
name = "MyKerberosKeytab"
}Property | Description |
|---|---|
name | Name of the object
|
content | Object content
|
vtm_kerberos_principal
URI Endpoint: /api/tm/8.3/config/active/kerberos/principals
A Kerberos principal can be used by the traffic manager to participate in a Kerberos realm.
# Example usage of vtm_kerberos_principal resource...
resource "vtm_kerberos_principal" "my_kerberos_principal" {
keytab =
name = "MyKerberosPrincipal"
service =
}Property | Description |
|---|---|
name | Name of the object
|
kdcs | A list of <hostname/ip>:<port> pairs for Kerberos key distribution center (KDC) services to be explicitly used for the realm of the principal. If no KDCs are explicitly configured, DNS will be used to discover the KDC(s) to use.
|
keytab | The name of the Kerberos keytab file containing suitable credentials to authenticate as the specified Kerberos principal.
|
krb5conf | The name of an optional Kerberos configuration file (krb5.conf).
|
realm | The Kerberos realm where the principal belongs.
|
service | The service name part of the Kerberos principal name the traffic manager should use to authenticate itself.
|
vtm_license_key
URI Endpoint: /api/tm/8.3/config/active/license_keys
A license key is an encoded text file that controls what functionality is available from each traffic manager in the cluster. Every production traffic manager must have a valid licence key in order to function; a traffic manager without a license will operate as Community Edition, which provides most of the functionality, but places restrictions on bandwidth and cluster size.
# Example usage of vtm_license_key resource...
resource "vtm_license_key" "my_license_key" {
content = ""
name = "MyLicenseKey"
}Property | Description |
|---|---|
name | Name of the object
|
content | Object content
|
vtm_location
URI Endpoint: /api/tm/8.3/config/active/locations
These are geographic locations as used by Global Load Balancing services. Such a location may not necessarily contain a traffic manager; instead it could refer to the location of a remote datacenter.
# Example usage of vtm_location resource...
resource "vtm_location" "my_location" {
id =
name = "MyLocation"
}Property | Description |
|---|---|
name | Name of the object
|
identifier | The identifier of this location.
|
latitude | The latitude of this location.
|
longitude | The longitude of this location.
|
note | A note, used to describe this location.
|
type | Does this location contain traffic managers and configuration or is it a recipient of GLB requests?
"config": Configuration "glb": GLB |
vtm_log_export
URI Endpoint: /api/tm/8.3/config/active/log_export
Definitions of log files which should be exported to the analytics engine
# Example usage of vtm_log_export resource...
resource "vtm_log_export" "my_log_export" {
name = "MyLogExport"
}Property | Description |
|---|---|
name | Name of the object
|
appliance_only | Whether entries from the specified log files should be exported only from appliances.
|
enabled | Export entries from the log files included in this category.
|
files | The set of files to export as part of this category, specified as a list of glob patterns.
|
history | How much historic log activity should be exported.
"all": Export all historic entries "none": Do not export any historic entries "recent": Export recent historic entries, according to the 'history_period' setting |
history_period | The number of days of historic log entries that should be exported.
|
metadata | This is table 'metadata'
|
metadata_json | A Traffic Manager REST-compatible JSON representation of the "metadata" table property. Use this field with the "vtm_log_export_metadata_table" data source for dynamic table generation from input variables.
|
note | A description of this category of log files.
|
vtm_monitor
URI Endpoint: /api/tm/8.3/config/active/monitors
Monitors check important remote services are running, by periodically sending them traffic and checking the response is correct. They are used by virtual servers to detect the failure of backend nodes.
# Example usage of vtm_monitor resource...
resource "vtm_monitor" "my_monitor" {
name = "MyMonitor"
}Property | Description |
|---|---|
name | Name of the object
|
back_off | Should the monitor slowly increase the delay after it has failed?
|
delay | The minimum time between calls to a monitor.
|
failures | The number of times in a row that a node must fail execution of the monitor before it is classed as unavailable.
|
health_only | Should this monitor only report health (ignore load)?
|
http_authentication | The HTTP basic-auth <user>:<password> to use for the test HTTP request.
|
http_body_regex | A regular expression that the HTTP response body must match. If the response body content doesn't matter then set this to .* (match anything).
|
http_host_header | The host header to use in the test HTTP request.
|
http_path | The path to use in the test HTTP request. This must be a string beginning with a / (forward slash).
|
http_status_regex | A regular expression that the HTTP status code must match. If the status code doesn't matter then set this to .* (match anything).
|
machine | The machine to monitor, where relevant this should be in the form <hostname>:<port>, for "ping" monitors the :<port> part must not be specified.
|
note | A description of the monitor.
|
rtsp_body_regex | The regular expression that the RTSP response body must match.
|
rtsp_path | The path to use in the RTSP request (some servers will return 500 Internal Server Error unless this is a valid media file).
|
rtsp_status_regex | The regular expression that the RTSP response status code must match.
|
scope | A monitor can either monitor each node in the pool separately and disable an individual node if it fails, or it can monitor a specific machine and disable the entire pool if that machine fails. GLB location monitors must monitor a specific machine.
"pernode": Node: Monitor each node in the pool separately "poolwide": Pool/GLB: Monitor a specified machine |
script_arguments | A table containing arguments and argument values to be passed to the monitor program.
|
script_arguments_json | A Traffic Manager REST-compatible JSON representation of the "script_arguments" table property. Use this field with the "vtm_monitor_arguments_table" data source for dynamic table generation from input variables.
|
script_program | The program to run. This must be an executable file, either within the monitor scripts directory or specified as an absolute path to some other location on the filesystem.
|
sip_body_regex | The regular expression that the SIP response body must match.
|
sip_status_regex | The regular expression that the SIP response status code must match.
|
sip_transport | Which transport protocol the SIP monitor will use to query the server.
"tcp": TCP "udp": UDP |
tcp_close_string | An optional string to write to the server before closing the connection.
|
tcp_max_response_len | The maximum amount of data to read back from a server, use 0 for unlimited. Applies to TCP and HTTP monitors.
|
tcp_response_regex | A regular expression to match against the response from the server. Applies to TCP monitors only.
|
tcp_write_string | The string to write down the TCP connection.
|
timeout | The maximum runtime for an individual instance of the monitor.
|
type | The internal monitor implementation of this monitor.
"connect": TCP Connect monitor "http": HTTP monitor "ping": Ping monitor "program": External program monitor "rtsp": RTSP monitor "sip": SIP monitor "tcp_transaction": TCP transaction monitor |
udp_accept_all | If this monitor uses UDP, should it accept responses from any IP and port?
|
use_ssl | Whether or not the monitor should connect using SSL.
|
verbose | Whether or not the monitor should emit verbose logging. This is useful for diagnosing problems.
|
vtm_monitor_script
URI Endpoint: /api/tm/8.3/config/active/monitor_scripts
An executable program that can be used to by external program monitors to report the health of backend services.
# Example usage of vtm_monitor_script resource...
resource "vtm_monitor_script" "my_monitor_script" {
content = ""
name = "MyMonitorScript"
}Property | Description |
|---|---|
name | Name of the object
|
content | Object content
|
vtm_appliance_nat
URI Endpoint: /api/tm/8.3/config/active/appliance/nat
The NAT configuration file stores rules controlling NAT on an appliance.
# Example usage of vtm_appliance_nat resource...
resource "vtm_appliance_nat" "my_appliance_nat" {
}Property | Description |
|---|---|
many_to_one_all_ports | This is table 'many_to_one_all_ports'
|
many_to_one_all_ports_json | A Traffic Manager REST-compatible JSON representation of the "many_to_one_all_ports" table property. Use this field with the "vtm_appliance_nat_many_to_one_all_ports_table" data source for dynamic table generation from input variables.
|
many_to_one_port_locked | This is table 'many_to_one_port_locked'
Permitted values: "icmp": ICMP "sctp": SCTP "tcp": TCP "udp": UDP "udplite": UDPLITE
|
many_to_one_port_locked_json | A Traffic Manager REST-compatible JSON representation of the "many_to_one_port_locked" table property. Use this field with the "vtm_appliance_nat_many_to_one_port_locked_table" data source for dynamic table generation from input variables.
|
one_to_one | This is table 'one_to_one'
|
one_to_one_json | A Traffic Manager REST-compatible JSON representation of the "one_to_one" table property. Use this field with the "vtm_appliance_nat_one_to_one_table" data source for dynamic table generation from input variables.
|
port_mapping | This is table 'port_mapping'
|
port_mapping_json | A Traffic Manager REST-compatible JSON representation of the "port_mapping" table property. Use this field with the "vtm_appliance_nat_port_mapping_table" data source for dynamic table generation from input variables.
|
vtm_pool
URI Endpoint: /api/tm/8.3/config/active/pools
The conf/pools directory contains configuration files for backend node pools. The name of a file is the name of the pool it defines. Pools can be configured under the Services > Pools section of the Admin Server UI or by using functions under the Pool section of the SOAP API and CLI.
# Example usage of vtm_pool resource...
resource "vtm_pool" "my_pool" {
name = "MyPool"
}Property | Description |
|---|---|
name | Name of the object
|
auto_scaling_addnode_delaytime | The time in seconds from the creation of the node which the traffic manager should wait before adding the node to the autoscaled pool. Set this to allow applications on the newly created node time to intialize before being sent traffic.
|
auto_scaling_cloud_credentials | The Cloud Credentials object containing authentication credentials to use in cloud API calls.
|
auto_scaling_cluster | The ESX host or ESX cluster name to put the new virtual machine instances on.
|
auto_scaling_data_center | The name of the logical datacenter on the vCenter server. Virtual machines will be scaled up and down under the datacenter root folder.
|
auto_scaling_data_store | The name of the datastore to be used by the newly created virtual machine.
|
auto_scaling_enabled | Are the nodes of this pool subject to autoscaling? If yes, nodes will be automatically added and removed from the pool by the chosen autoscaling mechanism.
|
auto_scaling_external | Whether or not autoscaling is being handled by an external system. Set this value to Yes if all aspects of autoscaling are handled by an external system, such as RightScale. If set to No, the traffic manager will determine when to scale the pool and will communicate with the cloud provider to create and destroy nodes as necessary.
|
auto_scaling_extraargs | Any extra arguments to the autoscaling API. Each argument can be separated by comma. E.g in case of EC2, it can take extra parameters to the Amazon's RunInstance API say DisableApiTermination=false,Placement.Tenancy=default.
|
auto_scaling_hysteresis | The time period in seconds for which a change condition must persist before the change is actually instigated.
|
auto_scaling_imageid | The identifier for the image of the instances to create.
|
auto_scaling_ips_to_use | Which type of IP addresses on the node to use. Choose private IPs if the traffic manager is in the same cloud as the nodes, otherwise choose public IPs.
"private_ips": Private IP addresses "publicips": Public IP addresses |
auto_scaling_last_node_idle_time | The time in seconds for which the last node in an autoscaled pool must have been idle before it is destroyed. This is only relevant if min_nodes is 0.
|
auto_scaling_max_nodes | The maximum number of nodes in this autoscaled pool.
|
auto_scaling_min_nodes | The minimum number of nodes in this autoscaled pool.
|
auto_scaling_name | The beginning of the name of nodes in the cloud that are part of this autoscaled pool.
|
auto_scaling_port | The port number to use for each node in this autoscaled pool.
|
auto_scaling_refractory | The time period in seconds after the instigation of a re-size during which no further changes will be made to the pool size.
|
auto_scaling_response_time | The expected response time of the nodes in ms. This time is used as a reference when deciding whether a node's response time is conforming. All responses from all the nodes will be compared to this reference and the percentage of conforming responses is the base for decisions about scaling the pool up or down.
|
auto_scaling_scale_down_level | The fraction, in percent, of conforming requests above which the pool size is decreased. If the percentage of conforming requests exceeds this value, the pool is scaled down.
|
auto_scaling_scale_up_level | The fraction, in percent, of conforming requests below which the pool size is increased. If the percentage of conforming requests drops below this value, the pool is scaled up.
|
auto_scaling_securitygroupids | List of security group IDs to associate to the new EC2 instance.
|
auto_scaling_size_id | The identifier for the size of the instances to create.
|
auto_scaling_subnetids | List of subnet IDs where the new EC2-VPC instance(s) will be launched. Instances will be evenly distributed among the subnets. If the list is empty, instances will be launched inside EC2-Classic.
|
bandwidth_class | The Bandwidth Management Class this pool uses, if any.
|
connection_max_connect_time | How long the pool should wait for a connection to a node to be established before giving up and trying another node.
|
connection_max_connections_per_node | The maximum number of concurrent connections allowed to each back-end node in this pool per machine. A value of 0 means unlimited connections.
|
connection_max_queue_size | The maximum number of connections that can be queued due to connections limits. A value of 0 means unlimited queue size.
|
connection_max_reply_time | How long the pool should wait for a response from the node before either discarding the request or trying another node (retryable requests only).
|
connection_max_transactions_per_node | The maximum number of concurrent transactions allowed to each back-end node in this pool per machine. A value of 0 means unlimited transactions. Idle connections kept alive for reuse do not count against this limit. A transaction begins by allocating a connection for sending the request, and ends (for the purposes of queuing) after a complete response has been received from the node.
|
connection_queue_timeout | The maximum time to keep a connection queued in seconds.
|
dns_autoscale_enabled | When enabled, the Traffic Manager will periodically resolve the hostnames in the "hostnames" list using a DNS query, and use the results to automatically add, remove or update the IP addresses of the nodes in the pool.
|
dns_autoscale_hostnames | A list of hostnames which will be used for DNS-derived autoscaling
|
dns_autoscale_port | The port number to use for each node when using DNS-derived autoscaling
|
failure_pool | If all of the nodes in this pool have failed, then requests can be diverted to another pool.
|
ftp_support_rfc_2428 | Whether or not the backend IPv4 nodes understand the EPRT and EPSV command from RFC 2428. It is always assumed that IPv6 nodes support these commands.
|
http_keepalive | Whether or not the pool should maintain HTTP keepalive connections to the nodes.
|
http_keepalive_non_idempotent | Whether or not the pool should maintain HTTP keepalive connections to the nodes for non-idempotent requests.
|
kerberos_protocol_transition_principal | The Kerberos principal the traffic manager should use when performing Kerberos Protocol Transition.
|
kerberos_protocol_transition_target | The Kerberos principal name of the service this pool targets.
|
load_balancing_algorithm | The load balancing algorithm that this pool uses to distribute load across its nodes.
"fastest_response_time": The Response Time algorithm monitors the response times for recent requests to each node. It sends each new request to the node that has recently been responding the most quickly. "least_connections": This algorithm sends each new request to the node with the fewest currently active connections. "perceptive": The Perceptive algorithm uses a combination of response time data and connection counts to predict which node is likely to have the fastest response time for each request. "random": This algorithm chooses a random node for each request. "round_robin": This algorithm distributes traffic by assigning each request to a new node in turn. "weighted_least_connections": This algorithm works in a similar way to the Least Connections algorithm, but assigns more requests to nodes with a greater 'weight'. "weighted_round_robin": Weighted Round Robin works in a similar way to Round Robin, but assigns more requests to nodes with a greater 'weight'. |
load_balancing_priority_enabled | Enable priority lists.
|
load_balancing_priority_nodes | Minimum number of highest-priority active nodes.
|
max_connection_attempts | The maximum number of nodes to which the traffic manager will attempt to send a request before returning an error to the client. Requests that are non-retryable will be attempted against only one node. Zero signifies no limit.
|
max_idle_connections_pernode | The maximum number of unused HTTP keepalive connections that should be maintained to an individual node. Zero signifies no limit.
|
max_timed_out_connection_attempts | The maximum number of connection attempts the traffic manager will make where the server fails to respond within the time limit defined by the max_reply_time setting. Zero signifies no limit.
|
monitors | The monitors assigned to this pool, used to detect failures in the back end nodes.
|
node_close_on_death | Close all connections to a node once we detect that it has failed.
|
node_close_with_rst | Whether or not connections to the back-end nodes should be closed with a RST packet, rather than a FIN packet. This avoids the TIME_WAIT state, which on rare occasions allows wandering duplicate packets to be safely ignored.
|
node_connection_attempts | The number of times the software will attempt to connect to the same back-end node before marking it as failed. This is only used when passive_monitoring is enabled.
|
node_delete_behavior | Specify the deletion behavior for nodes in this pool.
"drain": Allow existing connections to the node to finish before deletion. "immediate": All connections to the node are closed immediately. |
node_drain_to_delete_timeout | The maximum time that a node will be allowed to remain in a draining state after it has been deleted. A value of 0 means no maximum time.
|
node_retry_fail_time | The amount of time, in seconds, that a traffic manager will wait before re-trying a node that has been marked as failed by passive monitoring.
|
nodes_table | A table of all nodes in this pool. A node should be specified as a <ip>:<port> pair, and has a state, weight and priority.
Permitted values: "active": The node is is active. "disabled": The node is disabled. "draining": The node is draining.
|
nodes_table_json | A Traffic Manager REST-compatible JSON representation of the "nodes_table" table property. Use this field with the "vtm_pool_nodes_table_table" data source for dynamic table generation from input variables.
|
note | A description of the pool.
|
passive_monitoring | Whether or not the software should check that 'real' requests (i.e. not those from monitors) to this pool appear to be working. This should normally be enabled, so that when a node is refusing connections, responding too slowly, or sending back invalid data, it can mark that node as failed, and stop sending requests to it. If this is disabled, you should ensure that suitable health monitors are configured to check your servers instead, otherwise failed requests will not be detected and subsequently retried.
|
persistence_class | The default Session Persistence class this pool uses, if any.
|
service_discovery_enabled | Are the nodes of this pool determined by a Service Discovery plugin? If yes, nodes will be automatically added and removed from the pool by the traffic manager.
|
service_discovery_interval | The minimum time before rerunning the Service Discovery plugin
|
service_discovery_plugin | The plugin script a Service Discovery autoscaled pool should use to retrieve the list of nodes.
|
service_discovery_plugin_args | The arguments for the script specified in "service_discovery!plugin", e.g. a common instance tag, or name of a managed group of cloud instances.
|
service_discovery_timeout | The maximum time a plugin should be allowed to run before timing out. Set to 0 for no timeout.
|
smtp_send_starttls | If we are encrypting traffic for an SMTP connection, should we upgrade to SSL using STARTTLS.
|
ssl_ca_sites | This is table 'ca_sites'
Permitted values: "all": Fields and PEM "none": None "simple": Fields
Permitted values: "dont_request": No "request": Yes, allow if absent "require": Yes, deny if absent |
ssl_ca_sites_json | A Traffic Manager REST-compatible JSON representation of the "ssl_ca_sites" table property. Use this field with the "vtm_virtual_server_ca_sites_table" data source for dynamic table generation from input variables.
|
ssl_cipher_suites | The SSL/TLS cipher suites to allow for connections to a back-end node. Leaving this empty will make the pool use the globally configured cipher suites, see configuration key ssl!cipher_suites in the Global Settings section of the System tab. See there for how to specify SSL/TLS cipher suites.
|
ssl_client_auth | Whether or not a suitable certificate and private key from the SSL Client Certificates catalog be used if the back-end server requests client authentication.
|
ssl_common_name_match | A list of names against which the 'common name' of the certificate is matched; these names are used in addition to the node's hostname or IP address as specified in the config file or added by the autoscaler process.
|
ssl_elliptic_curves | The SSL elliptic curve preference list for SSL connections from this pool using TLS version 1.0 or higher. Leaving this empty will make the pool use the globally configured preference list. The named curves P256, P384 and P521 may be configured.
|
ssl_enable | Whether or not the pool should encrypt data before sending it to a back-end node.
|
ssl_enhance | SSL protocol enhancements allow your traffic manager to prefix each new SSL connection with information about the client. This enables Virtual Traffic Manager virtual servers referenced by this pool to discover the original client's IP address. Only enable this if you are using nodes for this pool which are vTMs, whose virtual servers have the ssl_trust_magic setting enabled.
|
ssl_middlebox_compatibility | Whether or not TLS 1.3 middlebox compatibility mode as described in RFC 8446 appendix D.4 will be used in connections to pool nodes. Choosing the global setting means the value of configuration key ssl!middlebox_compatibility from the Global Settings section of the System tab will be enforced.
"disabled": Disable use of middlebox compatibility "enabled": Enable use of middlebox compatibility "use_default": Use the global setting for use of middlebox compatibility |
ssl_send_close_alerts | Whether or not to send an SSL/TLS "close alert" when initiating a socket disconnection.
|
ssl_server_name | Whether or not the software should use the TLS 1.0 server_name extension, which may help the back-end node provide the correct certificate. Enabling this setting will force the use of at least TLS 1.0.
|
ssl_session_cache_enabled | Whether or not the SSL client cache will be used for this pool. Choosing the global setting means the value of the configuration key ssl!client_cache!enabled from the Global Settings section of the System tab will be enforced.
"disabled": Disable use of the session cache "enabled": Enable use of the session cache "use_default": Use the global setting for use of the session cache |
ssl_session_tickets_enabled | Whether or not SSL session tickets, including TLS >= 1.3 PSKs, will be used for this pool if the session cache is also enabled. Choosing the global setting means the value of the configuration key ssl!client_cache!tickets_enabled from the Global Settings section of the System tab will be enforced.
"disabled": Disable use of session tickets "enabled": Enable use of session tickets "use_default": Use the global setting for use of session tickets |
ssl_signature_algorithms | The SSL signature algorithms preference list for SSL connections from this pool using TLS version 1.2 or higher. Leaving this empty will make the pool use the globally configured preference list, signature_algorithms in the ssl section of the global_settings resource. See there and in the online help for how to specify SSL signature algorithms.
|
ssl_ssl_fixed_client_certificate | An entry in the SSL client certificates catalog, containing a certificate and private key to be used whenever client authentication is requested. If set, this overrides server request parameters.
|
ssl_strict_verify | Whether or not strict certificate verification should be performed. This will turn on checks to disallow server certificates that don't match the server name or a name in the ssl_common_name_match list, are self-signed, expired, revoked, or have an unknown CA.
|
ssl_support_ssl3 | Whether or not SSLv3 is enabled for this pool. Choosing the global setting means the value of the configuration key ssl!support_ssl3 from the Global Settings section of the System tab will be enforced.
"disabled": Disable SSLv3 "enabled": Enable SSLv3 "use_default": Use the global setting for SSLv3 |
ssl_support_tls1 | Whether or not TLSv1.0 is enabled for this pool. Choosing the global setting means the value of the configuration key ssl!support_tls1 from the Global Settings section of the System tab will be enforced.
"disabled": Disable TLSv1.0 "enabled": Enable TLSv1.0 "use_default": Use the global setting for TLSv1.0 |
ssl_support_tls1_1 | Whether or not TLSv1.1 is enabled for this pool. Choosing the global setting means the value of the configuration key ssl!support_tls1_1 from the Global Settings section of the System tab will be enforced.
"disabled": Disable TLSv1.1 "enabled": Enable TLSv1.1 "use_default": Use the global setting for TLSv1.1 |
ssl_support_tls1_2 | Whether or not TLSv1.2 is enabled for this pool. Choosing the global setting means the value of the configuration key ssl!support_tls1_2 from the Global Settings section of the System tab will be enforced.
"disabled": Disable TLSv1.2 "enabled": Enable TLSv1.2 "use_default": Use the global setting for TLSv1.2 |
ssl_support_tls1_3 | Whether or not TLSv1.3 is enabled for this pool. Choosing the global setting means the value of the configuration key ssl!support_tls1_3 from the Global Settings section of the System tab will be enforced.
"disabled": Disable TLSv1.3 "enabled": Enable TLSv1.3 "use_default": Use the global setting for TLSv1.3 |
tcp_nagle | Whether or not Nagle's algorithm should be used for TCP connections to the back-end nodes.
|
transparent | Whether or not connections to the back-ends appear to originate from the source client IP address.
|
udp_accept_from | The IP addresses and ports from which responses to UDP requests should be accepted. If set to accept responses from a specific set of IP addresses, you will need to enter a CIDR Mask (such as 10.100.0.0/16).
"all": Any IP address and any port. "dest_ip_only": Only the IP address to which the request was sent, but from any port. "dest_only": Only the IP address and port to which the request was sent. "ip_mask": Only a specific set of IP addresses, but from any port. |
udp_accept_from_mask | The CIDR mask that matches IPs we want to receive responses from.
|
udp_response_timeout | The maximum length of time that a node is permitted to take after receiving a UDP request packet before sending a reply packet. Zero indicates that there is no maximum, preventing a node that does not send replies from being presumed to have failed.
|
vtm_protection
URI Endpoint: /api/tm/8.3/config/active/protection
A protection class specifies the level of protection against network attacks for a virtual server.
# Example usage of vtm_protection resource...
resource "vtm_protection" "my_protection" {
name = "MyProtection"
}Property | Description |
|---|---|
name | Name of the object
|
access_restriction_allowed | Always allow access to these IP addresses. This overrides the connection limits for these machines, but does not stop other restrictions such as HTTP validity checks.
|
access_restriction_banned | Disallow access to these IP addresses.
|
concurrent_connections_max_10_connections | Additional limit on maximum concurrent connections from the top 10 busiest connecting IP addresses combined. The value should be between 1 and 10 times the max_1_connections limit. (This limit is disabled if per_process_connection_count is No, or max_1_connections is 0, or min_connections is 0.)
|
concurrent_connections_max_1_connections | Maximum concurrent connections each connecting IP address is allowed. Set to 0 to disable this limit.
|
concurrent_connections_min_connections | Entry threshold for the max_10_connections limit: the max_10_connections limit is not applied to connecting IP addresses with this many or fewer concurrent connections. Setting to 0 disables both the max_1_connections and max_10_connections limits, if per_process_connection_count is Yes. (If per_process_connection_count is No, this setting is ignored.)
|
concurrent_connections_per_process_connection_count | Whether concurrent connection counting and limits are per-process. (Each Traffic Manager typically has several processes: one process per available CPU core.) If Yes, a connecting IP address may make that many connections to each process within a Traffic Manager. If No, a connecting IP address may make that many connections to each Traffic Manager as a whole.
|
connection_rate_max_connection_rate | Maximum number of new connections each connecting IP address is allowed to make in the rate_timer interval. Set to 0 to disable this limit. If applied to an HTTP Virtual Server each request sent on a connection that is kept alive counts as a new connection. The rate limit is per process: each process within a Traffic Manager accepts new connections from the connecting IP address at this rate. (Each Traffic Manager typically has several processes: one process per available CPU core).
|
connection_rate_rate_timer | How frequently the max_connection_rate is assessed. For example, a value of 1 (second) will impose a limit of max_connection_rate connections per second; a value of 60 will impose a limit of max_connection_rate connections per minute. The valid range is 1-99999 seconds.
|
debug | Whether or not to output verbose logging.
|
enabled | Enable or disable this service protection class.
|
http_check_rfc2396 | Whether or not requests with poorly-formed URLs be should be rejected. This tests URL compliance as defined in RFC2396. Note that enabling this may block some older, non-conforming web browsers.
|
http_max_body_length | Maximum permitted length of HTTP request body data, set to 0 to disable the limit.
|
http_max_header_length | Maximum permitted length of a single HTTP request header (key and value), set to 0 to disable the limit.
|
http_max_request_length | Maximum permitted size of all the HTTP request headers, set to 0 to disable the limit.
|
http_max_url_length | Maximum permitted URL length, set to 0 to disable the limit.
|
http_reject_binary | Whether or not URLs and HTTP request headers that contain binary data (after decoding) should be rejected.
|
http_send_error_page | This setting tells the traffic manager to send an HTTP error message if a connection fails the service protection tests, instead of just dropping it. Details of which HTTP response will be sent when particular tests fail can be found in the Help section for this page.
|
log_time | Log service protection messages at these intervals. If set to 0 no messages will be logged and no alerts will be sent.
|
note | A description of the service protection class.
|
rule | A TrafficScript rule that will be run on the connection after the service protection criteria have been evaluated. This rule will be executed prior to normal rules configured for the virtual server.
|
testing | Place the service protection class into testing mode. (Log when this class would have dropped a connection, but allow all connections through).
|
vtm_application_firewall
URI Endpoint: /api/tm/8.3/config/active/application_firewall
The conf/zeusafm.conf file contains configuration files for the application firewall. Some keys present in the zeusafm.conf are not documented here. Refer to the Web Application Firewall documentation for further details. The configuration can be edited under the System > Application Firewall section of the Administration Server or by using functions under the AFM section of the SOAP API and CLI.
Property | Description |
|---|---|
There are no properties to display for this resource. | |
vtm_rate
URI Endpoint: /api/tm/8.3/config/active/rate
A rate shaping class restricts the number of connections being processed by a virtual server at once.
# Example usage of vtm_rate resource...
resource "vtm_rate" "my_rate" {
name = "MyRate"
}Property | Description |
|---|---|
name | Name of the object
|
max_rate_per_minute | Requests that are associated with this rate class will be rate-shaped to this many requests per minute, set to 0 to disable the limit.
|
max_rate_per_second | Although requests will be rate-shaped to the max_rate_per_minute, the traffic manager will also rate limit per-second. This smooths traffic so that a full minute's traffic will not be serviced in the first second of the minute, set this to 0 to disable the per-second limit.
|
note | A description of the rate class.
|
vtm_rule
URI Endpoint: /api/tm/8.3/config/active/rules
TrafficScript rules allow traffic inspection and modification.
# Example usage of vtm_rule resource...
resource "vtm_rule" "my_rule" {
content = ""
name = "MyRule"
}Property | Description |
|---|---|
name | Name of the object
|
content | Object content
|
vtm_service_level_monitor
URI Endpoint: /api/tm/8.3/config/active/service_level_monitors
Service level monitoring is used to produce alerts when an application's performance is degraded. This is done by monitoring the response time of connections to a virtual server.
# Example usage of vtm_service_level_monitor resource...
resource "vtm_service_level_monitor" "my_service_level_monitor" {
name = "MyServiceLevelMonitor"
}Property | Description |
|---|---|
name | Name of the object
|
note | A description for the SLM class.
|
response_time | Responses that start being sent to the client within this time limit, expressed in milliseconds, are treated as conforming.
|
serious_threshold | When the percentage of conforming responses drops below this level, a serious error level message will be emitted.
|
warning_threshold | When the percentage of conforming responses drops below this level, a warning message will be emitted.
|
vtm_ssl_client_key
URI Endpoint: /api/tm/8.3/config/active/ssl/client_keys
SSL Client Certificates are used when connecting to backend nodes that require client certificate authentication.
# Example usage of vtm_ssl_client_key resource...
resource "vtm_ssl_client_key" "my_ssl_client_key" {
name = "MySslClientKey"
note =
private =
public =
request =
}Property | Description |
|---|---|
name | Name of the object
|
note | Notes for this certificate
|
private | Private key for certificate
|
public | Public certificate
|
request | Certificate Signing Request for certificate
|
vtm_ssl_server_key
URI Endpoint: /api/tm/8.3/config/active/ssl/server_keys
SSL Server Certificates are presented to clients by virtual servers when SSL decryption is enabled.
# Example usage of vtm_ssl_server_key resource...
resource "vtm_ssl_server_key" "my_ssl_server_key" {
name = "MySslServerKey"
note =
private =
public =
request =
}Property | Description |
|---|---|
name | Name of the object
|
note | Notes for this certificate
|
private | Private key for certificate
|
public | Public certificate
|
request | Certificate Signing Request for certificate
|
vtm_ssl_ticket_key
URI Endpoint: /api/tm/8.3/config/active/ssl/ticket_keys
Configuration for SSL ticket encryption keys when managed externally via the ssl/ticket_keys REST API endpoints.
# Example usage of vtm_ssl_ticket_key resource...
resource "vtm_ssl_ticket_key" "my_ssl_ticket_key" {
id =
key =
name = "MySslTicketKey"
validity_end =
validity_start =
}Property | Description |
|---|---|
name | Name of the object
|
algorithm | The algorithm used to encrypt session tickets. The algorithm determines the length of the key that must be provided.
"aes_256_cbc_hmac_sha256": AES-256 CBC with HMAC-SHA256. Requires a total of 64 bytes of key material. |
identifier | A 16-byte key identifier, with each byte encoded as two hexadecimal digits. Key identifiers are transmitted in plaintext at the beginning of a TLS session ticket, and are used to identify the ticket encryption key that was used to encrypt a ticket. (They correspond to the 'key_name' field in RFC 5077.) They are required to be unique across the set of SSL ticket encryption keys.
|
key | The session ticket encryption key, with each byte encoded as two hexadecimal digits. The required key length is determined by the chosen key algorithm. See the documentation for the 'algorithm' field for more details.
|
validity_end | The latest time at which this key may be used to encrypt new session tickets. Given as number of seconds since the epoch (1970-01-01T00:00:00Z).
|
validity_start | The earliest time at which this key may be used to encrypt new session tickets. Given as number of seconds since the epoch (1970-01-01T00:00:00Z).
|
vtm_ssl_ca
URI Endpoint: /api/tm/8.3/config/active/ssl/cas
SSL certificate authority certificates (CAs) and certificate revocation lists (CRLs) can be used when validating server and client certificates.
# Example usage of vtm_ssl_ca resource...
resource "vtm_ssl_ca" "my_ssl_ca" {
content = ""
name = "MySslCa"
}Property | Description |
|---|---|
name | Name of the object
|
content | Object content
|
vtm_security
URI Endpoint: /api/tm/8.3/config/active/security
Security settings that restrict remote administration for the cluster. Additional security options can be found in Global Settings.
# Example usage of vtm_security resource...
resource "vtm_security" "my_security" {
}Property | Description |
|---|---|
access | Access to the admin server and REST API is restricted by usernames and passwords. You can further restrict access to just trusted IP addresses, CIDR IP subnets or DNS wildcards. These access restrictions are also used when another traffic manager initially joins the cluster, after joining the cluster these restrictions are no longer used. Care must be taken when changing this setting, as it can cause the administration server to become inaccessible.Access to the admin UI will not be affected until it is restarted.
|
ssh_intrusion_bantime | The amount of time in seconds to ban an offending host for.
|
ssh_intrusion_blacklist | The list of hosts to permanently ban, identified by IP address or DNS hostname in a space-separated list.
|
ssh_intrusion_enabled | Whether or not the SSH Intrusion Prevention tool is enabled.
|
ssh_intrusion_findtime | The window of time in seconds the maximum number of connection attempts applies to. More than (maxretry) failed attempts in this time span will trigger a ban.
|
ssh_intrusion_maxretry | The number of failed connection attempts a host can make before being banned.
|
ssh_intrusion_whitelist | The list of hosts to never ban, identified by IP address, DNS hostname or subnet mask, in a space-separated list.
|
vtm_servicediscovery
URI Endpoint: /api/tm/8.3/config/active/servicediscovery
The conf/servicediscovery directory contains plugins for use with Service Discovery for pool nodes.
Property | Description |
|---|---|
name | Name of the object
|
content | Object content
|
vtm_persistence
URI Endpoint: /api/tm/8.3/config/active/persistence
A session persistence class is used to identify the session a new connection belongs too and deliver it to the same backend node.
# Example usage of vtm_persistence resource...
resource "vtm_persistence" "my_persistence" {
name = "MyPersistence"
}Property | Description |
|---|---|
name | Name of the object
|
cookie | The cookie name to use for tracking session persistence.
|
delete | Whether or not the session should be deleted when a session failure occurs. (Note, setting a failure mode of 'choose a new node' implicitly deletes the session.)
|
failure_mode | The action the pool should take if the session data is invalid or it cannot contact the node specified by the session.
"close": Close the connection (using error_file on Virtual Servers > Edit > Protocol Settings) "new_node": Choose a new node to use "url": Redirect the user to a given URL |
note | A description of the session persistence class.
|
subnet_prefix_length_v4 | When using IP-based session persistence, ensure all requests from this IPv4 subnet, specified as a prefix length, are sent to the same node. If set to 0, requests from different IPv4 addresses will be load-balanced individually.
|
subnet_prefix_length_v6 | When using IP-based session persistence, ensure all requests from this IPv6 subnet, specified as a prefix length, are sent to the same node. If set to 0, requests from different IPv6 addresses will be load-balanced individually.
|
transparent_always_set_cookie | Whether or not the cookie should be inserted in every response sent to the client when using transparent session affinity. If set to No then the cookie is inserted only if the corresponding request did not already contain a matching cookie.
|
transparent_directives | The cookie directives to include in the cookie sent when using transparent session affinity. If more than one directive is included, the semi-colon separator between them must be included in this string. The semi-colon separator between the cookie value and the first directive should not be included in this string.
|
type | The type of session persistence to use.
"asp": ASP and ASP.NET session persistence "cookie": Monitor application cookies "ip": IP-based persistence "j2ee": J2EE session persistence "named": Named Node session persistence "ssl": SSL Session ID persistence "transparent": Transparent session affinity "universal": Universal session persistence "x_zeus": X-Zeus-Backend cookies |
url | The redirect URL to send clients to if the session persistence is configured to redirect users when a node dies.
|
vtm_traffic_ip_group
URI Endpoint: /api/tm/8.3/config/active/traffic_ip_groups
Traffic IP groups are sets of IP addresses that are distributed across a cluster for fault tolerance.
# Example usage of vtm_traffic_ip_group resource...
resource "vtm_traffic_ip_group" "my_traffic_ip_group" {
name = "MyTrafficIpGroup"
}Property | Description |
|---|---|
name | Name of the object
|
enabled | If set to No, the traffic IP group will be disabled and none of the traffic IP addresses will be raised.
|
hash_source_port | Whether or not the source port should be taken into account when deciding which traffic manager should handle a request.
|
ip_assignment_mode | Configure how traffic IPs are assigned to traffic managers in Single-Hosted mode
"alphabetic": Alphabetical order of traffic manager hostnames "balanced": Approximately balanced between traffic managers |
ip_mapping | A table assigning traffic IP addresses to machines that should host them. Traffic IP addresses not specified in this table will automatically be assigned to a machine.
|
ip_mapping_json | A Traffic Manager REST-compatible JSON representation of the "ip_mapping" table property. Use this field with the "vtm_traffic_ip_group_ip_mapping_table" data source for dynamic table generation from input variables.
|
ipaddresses | The IP addresses that belong to the Traffic IP group.
|
keeptogether | If set to Yes then all the traffic IPs will be raised on a single traffic manager. By default they're distributed across all active traffic managers in the traffic IP group.
|
location | The location in which the Traffic IP group is based.
|
machines | The traffic managers that can host the traffic IP group's IP addresses.
|
mode | The method used to distribute traffic IPs across machines in the cluster. If "multihosted" is used then multicast must be set to an appropriate multicast IP address.
"ec2elastic": Use an EC2-Classic Elastic IP address. "ec2vpcelastic": Use an EC2-VPC Elastic IP address. "ec2vpcprivate": Use an EC2-VPC Private IP address. "gceexternal": Use GCE External IP addresses. "multihosted": Raise each address on every machine in the group (Multi-Hosted mode) - IPv4 only "rhi": Use route health injection to route traffic to the active machine - IPv4 only "singlehosted": Raise each address on a single machine (Single-Hosted mode) |
multicast | The multicast IP address used to duplicate traffic to all traffic managers in the group.
|
note | A note, used to describe this Traffic IP Group
|
rhi_bgp_metric_base | The base BGP routing metric for this Traffic IP group. This is the advertised routing cost for the active traffic manager in the cluster. It can be used to set up inter-cluster failover.
|
rhi_bgp_passive_metric_offset | The BGP routing metric offset for this Traffic IP group. This is the difference between the advertised routing cost for the active and passive traffic manager in the cluster.
|
rhi_ospfv2_metric_base | The base OSPFv2 routing metric for this Traffic IP group. This is the advertised routing cost for the active traffic manager in the cluster. It can be used to set up inter-cluster failover.
|
rhi_ospfv2_passive_metric_offset | The OSPFv2 routing metric offset for this Traffic IP group. This is the difference between the advertised routing cost for the active and passive traffic manager in the cluster.
|
rhi_protocols | A list of protocols to be used for RHI. Currently must be 'ospf' or 'bgp' or both. The default, if empty, is 'ospf', which means that it is not possible to specify no protocol.
|
slaves | A list of traffic managers that are in 'passive' mode. This means that in a fully working environment, they will not have any traffic IP addresses assigned to them.
|
vtm_traffic_manager
URI Endpoint: /api/tm/8.3/config/active/traffic_managers
The conf/zxtms directory contains a configuration file for each traffic manager in your cluster. The name of each file is the hostname of the traffic manager it represents. These files contain host-specific configuration data and on each installation of the software, the conf/../global.cfg file is sym-linked to the host's own configuration in the conf/zxtms directory. The files may contain a variety of configuration options that are configured in various locations under the System section of the Admin Server UI and the System section of the SOAP API and CLI.
# Example usage of vtm_traffic_manager resource...
resource "vtm_traffic_manager" "my_traffic_manager" {
name = "MyTrafficManager"
}Property | Description |
|---|---|
name | Name of the object
|
admin_hsts_enable | Whether or not HSTS (RFC 6797) is enabled for admin server connections.
|
admin_hsts_max_age | The number of seconds that the HSTS header field max-age will be set to
|
adminmasterxmlip | The Application Firewall master XML IP.
|
adminslavexmlip | The Application Firewall slave XML IP.
|
appliance_card | The table of network cards of a hardware appliance
|
appliance_card_json | A Traffic Manager REST-compatible JSON representation of the "appliance_card" table property. Use this field with the "vtm_traffic_manager_appliance_card_table" data source for dynamic table generation from input variables.
|
appliance_disable_kpti | Whether the traffic manager appliance should run without kernel page table isolation (KPTI). KPTI provides protection to prevent unprivileged software from being potentially able to read arbitrary memory from the kernel (i.e. the Meltdown attack, CVE-2017-5754); however this protection incurs a general system performance penalty. If you are running trusted software on the appliance, and the trade-off between performance at the cost of 'defense in depth' favors the former in your deployment, you may wish to enable this configuration key. If you are unsure, it is recommended that you leave this key disabled, which is also the default.
|
appliance_dnscache | The DNS cache setting the appliance should use and place in /etc/systemd/resolved.conf.
|
appliance_dnssec | The DNSSEC setting the appliance should use and place in /etc/systemd/resolved.conf.
"allow_downgrade": Use DNSSEC when available "no": DNSSEC disabled "yes": DNSSEC enabled |
appliance_gateway_ipv4 | The default gateway.
|
appliance_gateway_ipv6 | The default IPv6 gateway.
|
appliance_hostname | Name (hostname.domainname) of the appliance.
|
appliance_hosts | A table of hostname to static ip address mappings, to be placed in the /etc/hosts file.
|
appliance_hosts_json | A Traffic Manager REST-compatible JSON representation of the "appliance_hosts" table property. Use this field with the "vtm_traffic_manager_hosts_table" data source for dynamic table generation from input variables.
|
appliance_if | A table of network interface specific settings.
Permitted values: "802_3ad": IEEE 802.3ad "balance_alb": Adaptive Load Balancing
Permitted values: "dhcp": DHCP "static": Static
Permitted values: "10": 10Mbs "100": 100Mbs "1000": 1Gbs "10000": 10Gbs "100000": 100Gbs "40000": 40Gbs |
appliance_if_json | A Traffic Manager REST-compatible JSON representation of the "appliance_if" table property. Use this field with the "vtm_traffic_manager_if_table" data source for dynamic table generation from input variables.
|
appliance_ip | A table of network interfaces and their network settings.
|
appliance_ip_json | A Traffic Manager REST-compatible JSON representation of the "appliance_ip" table property. Use this field with the "vtm_traffic_manager_ip_table" data source for dynamic table generation from input variables.
|
appliance_ipmi_lan_access | Whether IPMI LAN access should be enabled or not.
|
appliance_ipmi_lan_addr | The IP address of the appliance IPMI LAN channel.
|
appliance_ipmi_lan_gateway | The default gateway of the IPMI LAN channel.
|
appliance_ipmi_lan_ipsrc | The addressing mode the IPMI LAN channel operates.
"dhcp": Address obtained by DHCP "static": Static IP Address |
appliance_ipmi_lan_mask | Set the IP netmask for the IPMI LAN channel.
|
appliance_ipv4_forwarding | Whether or not IPv4 forwarding is enabled.
|
appliance_ipv6_forwarding | Whether or not IPv6 forwarding is enabled.
|
appliance_licence_agreed | Whether or not the license agreement has been accepted. This determines whether or not the Initial Configuration wizard is displayed.
|
appliance_manageazureroutes | Whether or not the software manages the Azure policy routing.
|
appliance_manageec2conf | Whether or not the software manages the EC2 config.
|
appliance_managegceroutes | Whether or not the software manages the GCE routing.
|
appliance_manageiptrans | Whether or not the software manages the IP transparency
|
appliance_managereservedports | Whether or not the software manages the system configuration for reserved ports
|
appliance_managereturnpath | Whether or not the software manages return path routing. If disabled, the appliance won't modify iptables / rules / routes for this feature.
|
appliance_manageservices | Whether or not the software manages the system services
|
appliance_managevpcconf | Whether or not the software manages the EC2-VPC secondary IPs.
|
appliance_name_servers | The IP addresses of the nameservers the appliance should use and place in /etc/systemd/resolved.conf.
|
appliance_ntpservers | The NTP servers the appliance should use to synchronize its clock.
|
appliance_routes | A table of destination IP addresses and routing details to reach them.
|
appliance_routes_json | A Traffic Manager REST-compatible JSON representation of the "appliance_routes" table property. Use this field with the "vtm_traffic_manager_routes_table" data source for dynamic table generation from input variables.
|
appliance_search_domains | The search domains the appliance should use and place in /etc/systemd/resolved.conf.
|
appliance_ssh_enabled | Whether or not the SSH server is enabled on the appliance.
|
appliance_ssh_password_allowed | Whether or not the SSH server allows password based login.
|
appliance_ssh_port | The port that the SSH server should listen on.
|
appliance_sysctl | Custom kernel parameters applied by the user with sysctl interface
|
appliance_sysctl_json | A Traffic Manager REST-compatible JSON representation of the "appliance_sysctl" table property. Use this field with the "vtm_traffic_manager_appliance_sysctl_table" data source for dynamic table generation from input variables.
|
appliance_timezone | The timezone the appliance should use. This must be a path to a timezone file that exists under /usr/share/zoneinfo/.
|
appliance_vlans | The VLANs the software should raise. A VLAN should be configured using the format <dev>.<vlanid>, where <dev> is the name of a network device that exists in the host system, eth0.100 for example.
|
authenticationserverip | The Application Firewall Authentication Server IP.
|
cloud_platform | Cloud platform where the traffic manager is running.
|
cluster_comms_allow_update | Whether or not this instance of the software can send configuration updates to other members of the cluster. When not clustered this key is ignored. When clustered the value can only be changed by another machine in the cluster that has allow_update set to true. If set to false then it will not be possible to log into the admin server for this instance.
|
cluster_comms_bind_ip | The IP address that the software should bind to for internal administration communications. See also port. If the software is not part of a cluster the default is to use 127.0.0.1 and there should be no reason to touch this setting. If the software is part of a cluster then the default is to listen on all raised IPs, in this case an alternative configuration is to listen on a single IP address. This may be useful if you have a separate management network and wish to restrict control messages to it. It is important to ensure that the allowed_update_hosts (in the Global Settings resource) is compatible with the IP configured here.
|
cluster_comms_external_ip | This is the optional external ip of the traffic manager, which is used to circumvent natting when traffic managers in a cluster span different networks.
|
cluster_comms_port | The port that the software should listen on for internal administration communications. See also bind_ip.
|
ec2_trafficips_public_enis | List of MAC addresses of interfaces which the traffic manager can use to associate the EC2 elastic IPs (Traffic IPs) to the instance.
|
fault_tolerance_bgp_router_id | The BGP router id If set to empty, then the IPv4 address used to communicate with the default IPv4 gateway is used instead. Specifying 0.0.0.0 will stop the traffic manager routing software from running the BGP protocol.
|
fault_tolerance_ospfv2_ip | The traffic manager's permanent IPv4 address which the routing software will use for peering and transit traffic, and as its OSPF router ID. If set to empty, then the address used to communicate with the default IPv4 gateway is used instead. Specifying 0.0.0.0 will stop the traffic manager routing software from running the OSPF protocol.
|
fault_tolerance_ospfv2_neighbor_addrs | The IP addresses of routers which are expected to be found as OSPFv2 neighbors of the traffic manager. A warning will be reported if some of the expected routers are not peered, and an error will be reported if none of the expected routers are peered. An empty list disables monitoring. The special value %gateway% is a placeholder for the default gateway.
|
iptables_config_enabled | Whether the Traffic Manager should configure the iptables built-in chains to call Traffic Manager defined rules (e.g. the IP transparency chain). This should only be disabled in case of conflict with other software that manages iptables, e.g. firewalls. When disabled, you will need to add rules manually to use these features - see the user manual for details.
|
iptrans_fwmark | The netfilter forwarding mark to use for IP transparency rules
|
iptrans_iptables_enabled | Whether IP transparency may be used via netfilter/iptables. This requires the iptables socket extension.
|
iptrans_routing_table | The special routing table ID to use for IP transparency rules
|
java_port | The port the Java Extension handler process should listen on. This port will be bound for localhost communications only.
|
location | This is the location of the local traffic manager is in.
|
nameip | Replace Traffic Manager name with an IP address.
|
num_aptimizer_threads | How many worker threads the Web Accelerator process should create to optimise content. By default, one thread will be created for each CPU on the system.
|
num_children | The number of worker processes the software will run. By default, one child process will be created for each CPU on the system. You may wish to reduce this to effectively "reserve" CPU(s) for other processes running on the host system.
|
numberofcpus | The number of Application Firewall decider process to run.
|
remote_licensing_email_address | The e-mail address sent as part of a remote licensing request.
|
remote_licensing_message | A free-text field sent as part of a remote licensing request.
|
rest_api_bind_ips | A list of IP Addresses which the REST API will listen on for connections. The list should contain IP addresses (IPv4 or IPv6) or a single entry containing an asterisk (*). This indicates that the REST API should listen on all IP Addresses.
|
rest_api_port | The port on which the REST API should listen for requests.
|
restserverport | The Application Firewall REST Internal API port, this port should not be accessed directly
|
snmp_allow | Restrict which IP addresses can access the SNMP command responder service. The value can be all, localhost, or a list of IP CIDR subnet masks. For example 10.100.0.0/16 would allow connections from any IP address beginning with 10.100.
|
snmp_auth_password | The authentication password. Required (minimum length 8 characters) if security_level includes authentication.
|
snmp_bind_ip | The IP address the SNMP service should bind its listen port to. The value * (asterisk) means SNMP will listen on all IP addresses.
|
snmp_community | The community string required for SNMPv1 and SNMPv2c commands. (If empty, all SNMPv1 and SNMPv2c commands will be rejected).
|
snmp_enabled | Whether or not the SNMP command responder service should be enabled on this traffic manager.
|
snmp_hash_algorithm | The hash algorithm for authenticated SNMPv3 communications.
"md5": MD5 "sha1": SHA-1 |
snmp_port | The port the SNMP command responder service should listen on. The value default denotes port 161 if the software is running with root privileges, and 1161 otherwise.
|
snmp_priv_password | The privacy password. Required (minimum length 8 characters) if security_level includes privacy (message encryption).
|
snmp_security_level | The security level for SNMPv3 communications.
"authnopriv": Authentication only "authpriv": Authentication and Privacy "noauthnopriv": No Authentication, No Privacy |
snmp_username | The username required for SNMPv3 commands. (If empty, all SNMPv3 commands will be rejected).
|
trafficip | A table mapping interfaces to networks, used by the traffic manager to select which interface to raise a Traffic IP on.
|
trafficip_json | A Traffic Manager REST-compatible JSON representation of the "trafficip" table property. Use this field with the "vtm_traffic_manager_trafficip_table" data source for dynamic table generation from input variables.
|
updaterip | The Application Firewall Updater IP.
|
vtm_rule_authenticator
URI Endpoint: /api/tm/8.3/config/active/rule_authenticators
TrafficScript authenticators define remote authentication services that can be queried via a TrafficScript rule.
# Example usage of vtm_rule_authenticator resource...
resource "vtm_rule_authenticator" "my_rule_authenticator" {
name = "MyRuleAuthenticator"
}Property | Description |
|---|---|
name | Name of the object
|
host | The hostname or IP address of the remote authenticator.
|
ldap_attributes | A list of attributes to return from the search. If blank, no attributes will be returned. If set to '*' then all user attributes will be returned.
|
ldap_bind_dn | The distinguished name (DN) of the 'bind' user. The traffic manager will connect to the LDAP server as this user when searching for user records.
|
ldap_bind_password | The password for the bind user.
|
ldap_filter | The filter used to locate the LDAP record for the user being authenticated. Any occurrences of '%u' in the filter will be replaced by the name of the user being authenticated.
|
ldap_filter_base_dn | The base distinguished name (DN) under which user records are located on the server.
|
ldap_ssl_cert | The SSL certificate that the traffic manager should use to validate the remote server. If no certificate is specified then no signature validation will be performed.
|
ldap_ssl_enabled | Whether or not to enable SSL encryption to the LDAP server.
|
ldap_ssl_type | The type of LDAP SSL encryption to use.
"ldaps": LDAPS "starttls": Start TLS |
note | A description of the authenticator.
|
port | The port on which the remote authenticator should be contacted.
|
vtm_saml_trustedidp
URI Endpoint: /api/tm/8.3/config/active/saml/trustedidps
Configuration for SAML IDP trust relationships.
# Example usage of vtm_saml_trustedidp resource...
resource "vtm_saml_trustedidp" "my_saml_trustedidp" {
certificate =
entity_id =
name = "MySamlTrustedidp"
url =
}Property | Description |
|---|---|
name | Name of the object
|
add_zlib_header | Whether or not to add the zlib header when compressing the AuthnRequest
|
certificate | The certificate used to verify Assertions signed by the identity provider
|
entity_id | The entity id of the IDP
|
strict_verify | Whether or not SAML responses will be verified strictly
|
url | The IDP URL to which Authentication Requests should be sent
|
vtm_user_authenticator
URI Endpoint: /api/tm/8.3/config/active/user_authenticators
A user authenticator is used to allow access to the UI and REST API by querying a remote authentication service.
# Example usage of vtm_user_authenticator resource...
resource "vtm_user_authenticator" "my_user_authenticator" {
name = "MyUserAuthenticator"
type =
}Property | Description |
|---|---|
name | Name of the object
|
description | A description of the authenticator.
|
enabled | Whether or not this authenticator is enabled.
|
ldap_base_dn | The base DN (Distinguished Name) under which directory searches will be applied. The entries for your users should all appear under this DN. An example of a typical base DN is: OU=users, DC=mycompany, DC=local
|
ldap_bind_dn | Template to construct the bind DN (Distinguished Name) from the username. The string %u will be replaced by the username. Examples: %[email protected] for Active Directory or cn=%u, dc=mycompany, dc=local for both LDAP and Active Directory.
|
ldap_dn_method | The bind DN (Distinguished Name) for a user can either be searched for in the directory using the base distinguished name and filter values, or it can be constructed from the username.
"construct": Construct "none": No setting configured "search": Search |
ldap_fallback_group | If the group attribute is not defined, or returns no results for the user logging in, the group named here will be used. If not specified, users will be denied access to the traffic manager if no groups matching a Permission Group can be found for them in the directory.
|
ldap_filter | A filter that can be used to extract a unique user record located under the base DN (Distinguished Name). The string %u will be replaced by the username. This filter is used to find a user's bind DN when dn_method is set to "Search", and to extract group information if the group filter is not specified. Examples: sAMAccountName=%u for Active Directory, or uid=%u for some Unix LDAP schemas.
|
ldap_group_attribute | The LDAP attribute that gives a user's group. If there are multiple entries for the attribute all will be extracted and they'll be lexicographically sorted, then the first one to match a Permission Group name will be used.
|
ldap_group_field | The sub-field of the group attribute that gives a user's group. For example, if group_attribute is memberOf and this retrieves values of the form CN=mygroup, OU=groups, OU=users, DC=mycompany, DC=local you would set group_field to CN. If there are multiple matching fields only the first matching field will be used.
|
ldap_group_filter | If the user record returned by filter does not contain the required group information you may specify an alternative group search filter here. This will usually be required if you have Unix/POSIX-style user records. If multiple records are returned the list of group names will be extracted from all of them. The string %u will be replaced by the username. Example: (&(memberUid=%u)(objectClass=posixGroup))
|
ldap_port | The port to connect to the LDAP server on.
|
ldap_search_dn | The bind DN (Distinguished Name) to use when searching the directory for a user's bind DN. You can leave this blank if it is possible to perform the bind DN search using an anonymous bind.
|
ldap_search_password | If binding to the LDAP server using search_dn requires a password, enter it here.
|
ldap_server | The IP or hostname of the LDAP server.
|
ldap_ssl | The type of TLS encryption, if any, to use. Usually STARTTLS will be used with port 389, and LDAPS with port 636. A Certificate Authority that the LDAP server's certificate chains back to must be present in the "Admin Certificate Authorities and Certificate Revocation Lists Catalog" under "SSL catalogs", otherwise the connection will fail.
"ldaps": LDAPS "none": None "starttls": STARTTLS |
ldap_timeout | Connection timeout in seconds.
|
radius_fallback_group | If no group is found using the vendor and group identifiers, or the group found is not valid, the group specified here will be used.
|
radius_group_attribute | The RADIUS identifier for the attribute that specifies an account's group. May be left blank if fallback group is specified.
|
radius_group_vendor | The RADIUS identifier for the vendor of the RADIUS attribute that specifies an account's group. Leave blank if using a standard attribute (i.e. for Filter-Id set group_attribute to 11).
|
radius_nas_identifier | This value is sent to the RADIUS server.
|
radius_nas_ip_address | This value is sent to the RADIUS server, if left blank the address of the interfaced used to connect to the server will be used.
|
radius_port | The port to connect to the RADIUS server on.
|
radius_secret | Secret key shared with the RADIUS server.
|
radius_server | The IP or hostname of the RADIUS server.
|
radius_timeout | Connection timeout in seconds.
|
tacacs_plus_auth_type | Authentication type to use.
"ascii": ASCII "pap": PAP |
tacacs_plus_fallback_group | If group_service is not used, or no group value is provided for the user by the TACACS+ server, the group specified here will be used. If this is not specified, users with no TACACS+ defined group will be denied access.
|
tacacs_plus_group_field | The TACACS+ "service" field that provides each user's group.
|
tacacs_plus_group_service | The TACACS+ "service" that provides each user's group field.
|
tacacs_plus_port | The port to connect to the TACACS+ server on.
|
tacacs_plus_secret | Secret key shared with the TACACS+ server.
|
tacacs_plus_server | The IP or hostname of the TACACS+ server.
|
tacacs_plus_timeout | Connection timeout in seconds.
|
type | The type and protocol used by this authentication service.
"ldap": LDAP "radius": RADIUS "tacacs_plus": TACACS+ |
vtm_user_group
URI Endpoint: /api/tm/8.3/config/active/user_groups
Permission groups specify permissions for groups of users. These groups can be given read-write or read-only access to different parts of the configuration hierarchy. Each group will contain a table of permissions. Each table entry has a name that corresponds to a part of the configuration hierarchy, and a corresponding access level. The access level may have values of either none, ro (read only, this is the default), or full. Some permissions have sub-permissions, these are denoted by following the parent permission name with a colon (:) followed by the sub-permission name. The built-in admin group has a special permission key of all with the value full, this must not be altered for the admin group but can be used in other group configuration files to change the default permission level for the group.
# Example usage of vtm_user_group resource...
resource "vtm_user_group" "my_user_group" {
name = "MyUserGroup"
}Property | Description |
|---|---|
name | Name of the object
|
description | A description for the group.
|
password_expire_time | Members of this group must renew their passwords after this number of days. To disable password expiry for the group set this to 0 (zero). Note that this setting applies only to local users.
|
permissions | A table defining which level of permission this group has for specific configuration elements.
|
permissions_json | A Traffic Manager REST-compatible JSON representation of the "permissions" table property. Use this field with the "vtm_user_group_permissions_table" data source for dynamic table generation from input variables.
|
timeout | Inactive UI sessions will timeout after this number of seconds. To disable inactivity timeouts for the group set this to 0 (zero).
|
vtm_virtual_server
URI Endpoint: /api/tm/8.3/config/active/virtual_servers
The conf/vservers directory contains configuration files that define virtual servers. The name of a file is the name of the virtual server it defines. Virtual servers can be configured under the Services > Virtual Servers section of the Admin Server UI or by using functions under the VirtualServer section of the SOAP API and CLI.
# Example usage of vtm_virtual_server resource...
resource "vtm_virtual_server" "my_virtual_server" {
name = "MyVirtualServer"
pool =
port =
}Property | Description |
|---|---|
name | Name of the object
|
aptimizer_enabled | Whether the virtual server should optimize web content.
|
aptimizer_profile | A table of Aptimizer profiles and the application scopes that apply to them.
|
aptimizer_profile_json | A Traffic Manager REST-compatible JSON representation of the "aptimizer_profile" table property. Use this field with the "vtm_virtual_server_profile_table" data source for dynamic table generation from input variables.
|
auth_saml_idp | Name of the Trusted Identity Provider configuration to use. To create Identity Providers, please visit section Trusted Identity Providers
|
auth_saml_nameid_format | The NameID format to request and expect from the identity provider.
"emailaddress": emailAddress "none": none "unspecified": unspecified |
auth_saml_sp_acs_url | The 'Assertion Consumer Service' endpoint for the SAML service provider on this virtual server, ie the endpoint to which the identity provider will cause the user agent to send SAML assertions. This should be an HTTPS URL, must be in the same cookie domain as all hostnames used by the end user to access the virtual server (see cookie configuration) and the port must be the port on which this virtual server is listening. It must match the URI placed by the identity provider in the 'Recipient' attribute in the SAML assertion, if present.
|
auth_saml_sp_entity_id | The entity ID to be used by the SAML service provider function on this virtual server. This should usually be a URL, or a URN, however it may be any string. It must match the entity ID placed by the identity provider in the 'Audience' field in the SAML assertion.
|
auth_saml_time_tolerance | Time tolerance on authentication checks. When checking time-stamps and expiry dates against the current time on the system, allow a tolerance of this many seconds. For example, if a SAML response contains a 'NotOnOrAfter' that is 4 seconds in the past according to the local time, and the tolerance is set to 5 seconds, it will still be accepted. This is to prevent a lack of clock synchronization from resulting in rejection of SAML responses.
|
auth_session_cookie_attributes | Attributes of cookie used for authentication session.
|
auth_session_cookie_name | Name of cookie used for authentication session.
|
auth_session_log_external_state | Whether or not to include state of authentication sessions stored encrypted on the client as plaintext in the logs.
|
auth_session_timeout | Timeout on authentication session.
|
auth_type | Type of authentication to apply to requests to the virtual server.
"none": None "saml_sp": SAML Service Provider |
auth_verbose | Whether or not detailed messages about virtual server authentication should be written to the error log.
|
bandwidth_class | The bandwidth management class that this server should use, if any.
|
completion_rules | Rules that are run at the end of a transaction, in order, comma separated.
|
connect_timeout | The time, in seconds, for which an established connection can remain idle waiting for some initial data to be received from the client. The initial data is defined as a complete set of request headers for HTTP, SIP and RTSP services, or the first byte of data for all other services. A value of 0 will disable the timeout.
|
connection_errors_error_file | The error message to be sent to the client when the traffic manager detects an internal or backend error for the virtual server.
|
connection_keepalive | Whether or not the virtual server should use keepalive connections with the remote clients.
|
connection_keepalive_timeout | The length of time that the virtual server should keep an idle keepalive connection before discarding it. A value of 0 (zero) will mean that the keepalives are never closed by the traffic manager.
|
connection_max_client_buffer | The amount of memory, in bytes, that the virtual server should use to store data sent by the client through one TCP connection or HTTP/2 stream. Larger values will use more memory, but will minimise the number of read() and write() system calls that the traffic manager must perform.
|
connection_max_server_buffer | The amount of memory, in bytes, that the virtual server should use to store data returned by the server through one TCP connection. Larger values will use more memory, but will minimise the number of read() and write() system calls that the traffic manager must perform.
|
connection_max_transaction_duration | The total amount of time a transaction can take, counted from the first byte being received until the transaction is complete. For HTTP, this can mean all data has been written in both directions, or the connection has been closed; in most other cases it is the same as the connection being closed. The default value of 0 means there is no maximum duration, i.e., transactions can take arbitrarily long if none of the other timeouts occur.
|
connection_server_first_banner | If specified, the traffic manager will use the value as the banner to send for server-first protocols such as FTP, POP, SMTP and IMAP. This allows rules to use the first part of the client data (such as the username) to select a pool. The banner should be in the correct format for the protocol, e.g. for FTP it should start with "220 "
|
connection_timeout | A connection should be closed if no additional data has been received for this period of time. A value of 0 (zero) will disable this timeout.
|
cookie_domain | The way in which the traffic manager should rewrite the domain portion of any cookies set by a back-end web server.
"no_rewrite": Do not rewrite the domain "set_to_named": Rewrite the domain to the named domain value "set_to_request": Rewrite the domain to the host header of the request |
cookie_new_domain | The domain to use when rewriting a cookie's domain to a named value.
|
cookie_path_regex | If you wish to rewrite the path portion of any cookies set by a back-end web server, provide a regular expression to match the path:
|
cookie_path_replace | If cookie path regular expression matches, it will be replaced by this substitution. Parameters $1-$9 can be used to represent bracketed parts of the regular expression.
|
cookie_secure | Whether or not the traffic manager should modify the "secure" tag of any cookies set by a back-end web server.
"no_modify": Do not modify the 'secure' tag "set_secure": Set the 'secure' tag "unset_secure": Unset the 'secure' tag |
dns_edns_client_subnet | Enable/Disable use of EDNS client subnet option
|
dns_edns_udpsize | EDNS UDP size advertised in responses.
|
dns_max_udpsize | Maximum UDP answer size.
|
dns_rrset_order | Response record ordering.
"cyclic": Cyclic "fixed": Fixed |
dns_verbose | Whether or not the DNS Server should emit verbose logging. This is useful for diagnosing problems.
|
dns_zones | The DNS zones
|
enabled | Whether the virtual server is enabled.
|
ftp_data_source_port | The source port to be used for active-mode FTP data connections. If 0, a random high port will be used, otherwise the specified port will be used. If a port below 1024 is required you must first explicitly permit use of low ports with the data_bind_low global setting.
|
ftp_force_client_secure | Whether or not the virtual server should require that incoming FTP data connections from the client originate from the same IP address as the corresponding client control connection.
|
ftp_force_server_secure | Whether or not the virtual server should require that incoming FTP data connections from the nodes originate from the same IP address as the node.
|
ftp_port_range_high | If non-zero, then this controls the upper bound of the port range to use for FTP data connections.
|
ftp_port_range_low | If non-zero, then this controls the lower bound of the port range to use for FTP data connections.
|
ftp_ssl_data | Use SSL on the data connection as well as the control connection (if not enabled it is left to the client and server to negotiate this).
|
glb_services | The associated GLB services for this DNS virtual server.
|
gzip_compress_level | Compression level (1-9, 1=low, 9=high).
|
gzip_enabled | Compress web pages sent back by the server.
|
gzip_etag_rewrite | How the ETag header should be manipulated when compressing content.
"delete": Delete the ETag header "ignore": Leave the ETag unchanged "weaken": Change the ETag header to specify a weak match "wrap": Wrap the ETag, and attempt to unwrap safe conditional requests |
gzip_include_mime | MIME types to compress. Complete MIME types can be used, or a type can end in a '*' to match multiple types.
|
gzip_max_size | Maximum document size to compress (0 means unlimited).
|
gzip_min_size | Minimum document size to compress.
|
gzip_no_size | Compress documents with no given size.
|
http2_connect_timeout | The time, in seconds, to wait for a request on a new HTTP/2 connection. If no request is received within this time, the connection will be closed. This setting overrides the connect_timeout setting. If set to 0 (zero), the value of connect_timeout will be used instead.
|
http2_data_frame_size | This setting controls the preferred frame size used when sending body data to the client. If the client specifies a smaller maximum size than this setting, the client's maximum size will be used. Every data frame sent has at least a 9-byte header, in addition to this frame size, prepended to it.
|
http2_enabled | This setting allows the HTTP/2 protocol to be used by a HTTP virtual server. Unless use of HTTP/2 is negotiated by the client, the virtual server will fall back to HTTP 1.x automatically.
|
http2_header_table_size | This setting controls the amount of memory allowed for header compression on each HTTP/2 connection.
|
http2_headers_index_blacklist | A list of header names that should never be compressed using indexing.
|
http2_headers_index_default | The HTTP/2 HPACK compression scheme allows for HTTP headers to be compressed using indexing. Sensitive headers can be marked as "never index", which prevents them from being compressed using indexing. When this setting is Yes, only headers included in http2!headers_index_blacklist are marked as "never index". When this setting is No, all headers will be marked as "never index" unless they are included in http2!headers_index_whitelist.
|
http2_headers_index_whitelist | A list of header names that can be compressed using indexing when the value of http2!headers_index_default is set to No.
|
http2_headers_size_limit | The maximum size, in bytes, of decompressed headers for an HTTP/2 request. If the limit is exceeded, the connection on which the request was sent will be dropped. A value of 0 disables the limit check. If a service protection class with http!max_header_length configured is associated with this service then that setting will take precedence.
|
http2_http2_client_buffer_multiplier | The amount of memory, in multiples of the value specified by max_client_buffer, that the virtual server should use to store data sent by a client through a HTTP/2 connection. The value specified can be between 0 and 200. The value of 0 means unlimited. This setting limits buffer size for a HTTP/2 connection and does not affect buffer size for HTTP/1 connections or TCP stream connections. The number of HTTP/2 streams that can be opened in a single HTTP/2 connection is given by the http2!max_concurrent_streams. An overall cap to the amount of memory allocated for buffers for all TCP connections is given by the global max_tcp_buff_mem setting.
|
http2_http2_server_buffer_multiplier | The amount of memory, in multiples of the value specified by max_server_buffer, that the virtual server should use to store data sent to a client through HTTP/2 connection. The value specified can be between 0 and 200. The value of 0 means unlimited. This setting limits buffer size for a HTTP/2 connection and does not affect buffer size for HTTP/1 connections or TCP stream connections. The number of HTTP/2 streams that can be opened in a single HTTP/2 connection is given by the http2!max_concurrent_streams. An overall cap to the amount of memory allocated for buffers for all TCP connections is given by the global max_tcp_buff_mem setting.
|
http2_idle_timeout_no_streams | The time, in seconds, to wait for a new HTTP/2 request on a previously used HTTP/2 connection that has no open HTTP/2 streams. If an HTTP/2 request is not received within this time, the connection will be closed. A value of 0 (zero) will disable the timeout.
|
http2_idle_timeout_open_streams | The time, in seconds, to wait for data on an idle HTTP/2 connection, which has open streams, when no data has been sent recently (e.g. for long-polled requests). If data is not sent within this time, all open streams and the HTTP/2 connection will be closed. A value of 0 (zero) will disable the timeout.
|
http2_max_concurrent_streams | This setting controls the number of streams a client is permitted to open concurrently on a single connection.
|
http2_max_frame_size | This setting controls the maximum HTTP/2 frame size clients are permitted to send to the traffic manager.
|
http2_max_header_padding | The maximum size, in bytes, of the random-length padding to add to HTTP/2 header frames. The padding, a random number of zero bytes up to the maximum specified.
|
http2_merge_cookie_headers | Whether Cookie headers received from an HTTP/2 client should be merged into a single Cookie header using RFC6265 rules before forwarding to an HTTP/1.1 server. Some web applications do not handle multiple Cookie headers correctly.
|
http2_stream_window_size | This setting controls the flow control window for each HTTP/2 stream. This will limit the memory used for buffering when the client is sending body data faster than the pool node is reading it.
|
http_add_cluster_ip | Whether or not the virtual server should add an "X-Cluster-Client-Ip" header to the request that contains the remote client's IP address.
|
http_add_x_forwarded_for | Whether or not the virtual server should append the remote client's IP address to the X-Forwarded-For header. If the header does not exist, it will be added.
|
http_add_x_forwarded_proto | Whether or not the virtual server should add an "X-Forwarded-Proto" header to the request that contains the original protocol used by the client to connect to the traffic manager.
|
http_autodetect_upgrade_headers | Whether the traffic manager should check for HTTP responses that confirm an HTTP connection is transitioning to the WebSockets protocol. If that such a response is detected, the traffic manager will cease any protocol-specific processing on the connection and just pass incoming data to the client/server as appropriate.
|
http_chunk_overhead_forwarding | Handling of HTTP chunk overhead. When vTM receives data from a server or client that consists purely of protocol overhead (contains no payload), forwarding of such segments is delayed until useful payload data arrives (setting "lazy"). Changing this key to "eager" will make vTM incur the overhead of immediately passing such data on; it should only be used with HTTP peers whose chunk handling requires it.
"eager": Forward all data, even when no new payload information is available. "lazy": Only forward segments when useful payload data is available. |
http_location_regex | If the 'Location' header matches this regular expression, rewrite the header using the 'location_replace' pattern.
|
http_location_replace | If the 'Location' header matches the 'location_regex' regular expression, rewrite the header with this pattern (parameters such as $1-$9 can be used to match parts of the regular expression):
|
http_location_rewrite | The action the virtual server should take if the "Location" header does not match the location_regex regular expression.
"always": Rewrite the hostname to the request's "Host" header, and rewrite the protocol and port if necessary; "if_host_matches": Do not rewrite the hostname. Rewrite the protocol and port if the hostname matches the request's "Host" header. "never": Nothing; |
http_mime_default | Auto-correct MIME types if the server sends the "default" MIME type for files.
|
http_mime_detect | Auto-detect MIME types if the server does not provide them.
|
http_strip_x_forwarded_proto | Whether or not the virtual server should strip the 'X-Forwarded-Proto' header from incoming requests.
|
kerberos_protocol_transition_enabled | Whether or not the virtual server should use Kerberos Protocol Transition.
|
kerberos_protocol_transition_principal | The Kerberos principal this virtual server should use to perform Kerberos Protocol Transition.
|
kerberos_protocol_transition_target | The Kerberos principal name of the service this virtual server targets.
|
listen_on_any | Whether to listen on all IP addresses
|
listen_on_hosts | Hostnames and IP addresses to listen on
|
listen_on_traffic_ips | Traffic IP Groups to listen on
|
log_client_connection_failures | Should the virtual server log failures occurring on connections to clients.
|
log_enabled | Whether or not to log connections to the virtual server to a disk on the file system.
|
log_filename | The name of the file in which to store the request logs. The filename can contain macros which will be expanded by the traffic manager to generate the full filename.
|
log_format | The log file format. This specifies the line of text that will be written to the log file when a connection to the traffic manager is completed. Many parameters from the connection can be recorded using macros.
|
log_save_all | Whether to log all connections by default, or log no connections by default. Specific connections can be selected for addition to or exclusion from the log using the TrafficScript function requestlog.include().
|
log_server_connection_failures | Should the virtual server log failures occurring on connections to nodes.
|
log_session_persistence_verbose | Should the virtual server log session persistence events.
|
log_ssl_failures | Should the virtual server log failures occurring on SSL secure negotiation.
|
log_ssl_resumption_failures | Should the virtual server log messages when attempts to resume SSL sessions (either from the session cache or a session ticket) fail. Note that failure to resume an SSL session does not result in the SSL connection being closed, but it does cause a full SSL handshake to take place.
|
max_concurrent_connections | The maximum number of concurrent TCP connections that will be handled by this virtual server. If set to a non-zero value, the traffic manager will limit the number of concurrent TCP connections that this virtual server will accept to the value specified. When the limit is reached, new connections to this virtual server will not be accepted. If set to 0 the number of concurrent TCP connections will not be limited.
|
note | A description for the virtual server.
|
pool | The default pool to use for traffic.
|
port | The port on which to listen for incoming connections.
|
protection_class | The service protection class that should be used to protect this server, if any.
|
protocol | The protocol that the virtual server is using.
"client_first": Generic client first "dns": DNS (UDP) "dns_tcp": DNS (TCP) "ftp": FTP "http": HTTP "https": SSL (HTTPS) "imaps": SSL (IMAPS) "imapv2": IMAPv2 "imapv3": IMAPv3 "imapv4": IMAPv4 "ldap": LDAP "ldaps": SSL (LDAPS) "pop3": POP3 "pop3s": SSL (POP3S) "rtsp": RTSP "server_first": Generic server first "siptcp": SIP (TCP) "sipudp": SIP (UDP) "smtp": SMTP "ssl": SSL "stream": Generic streaming "telnet": Telnet "udp": UDP "udpstreaming": UDP - Streaming |
proxy_protocol | Expect connections to the traffic manager to be prefixed with a PROXY protocol header. If enabled, the information contained in the PROXY header will be available in TrafficScript. Connections that are not prefixed with a valid PROXY protocol header will be discarded.
|
recent_connections_enabled | Whether or not connections handled by this virtual server should be shown on the Activity > Connections page.
|
recent_connections_save_all | Whether or not all connections handled by this virtual server should be shown on the Connections page. Individual connections can be selectively shown on the Connections page using the recentconns.include() TrafficScript function.
|
request_rules | Rules to be applied to incoming requests, in order, comma separated.
|
request_tracing_enabled | Record a trace of major connection processing events for each request and response.
|
request_tracing_trace_io | Include details of individual I/O events in request and response traces. Requires request tracing to be enabled.
|
response_rules | Rules to be applied to responses, in order, comma separated.
|
rtsp_streaming_port_range_high | If non-zero this controls the upper bound of the port range to use for streaming data connections.
|
rtsp_streaming_port_range_low | If non-zero this controls the lower bound of the port range to use for streaming data connections.
|
rtsp_streaming_timeout | If non-zero data-streams associated with RTSP connections will timeout if no data is transmitted for this many seconds.
|
sip_dangerous_requests | The action to take when a SIP request with body data arrives that should be routed to an external IP.
"forbid": Send a 403 Forbidden response to the client "forward": Forward the request to its target URI (dangerous) "node": Send the request to a back-end node |
sip_follow_route | Should the virtual server follow routing information contained in SIP requests. If set to No requests will be routed to the chosen back-end node regardless of their URI or Route header.
|
sip_max_connection_mem | SIP clients can have several pending requests at one time. To protect the traffic manager against DoS attacks, this setting limits the amount of memory each client can use. When the limit is reached new requests will be sent a 413 response. If the value is set to 0 (zero) the memory limit is disabled.
|
sip_mode | The mode that this SIP virtual server should operate in.
"full_gateway": All SIP requests and responses and all session data will pass through vTM. A port range to use for the session data and a timeout value for inactive data connections can be specified in the additional settings that are displayed when the Full Gateway mode is selected. "route": The first SIP request in a session will pass through vTM, along with its responses, but all future requests that are part of the same session will go directly to the back-end node that was chosen by the traffic manager. "sip_gateway": All SIP requests and responses will pass through the traffic manager. |
sip_rewrite_uri | Replace the Request-URI of SIP requests with the address of the selected back-end node.
|
sip_streaming_port_range_high | If non-zero this controls the upper bound of the port range to use for streaming data connections.
|
sip_streaming_port_range_low | If non-zero, then this controls the lower bound of the port range to use for streaming data connections.
|
sip_streaming_timeout | If non-zero a UDP stream will timeout when no data has been seen within this time.
|
sip_timeout_messages | When timing out a SIP transaction, send a 'timed out' response to the client and, in the case of an INVITE transaction, a CANCEL request to the server.
|
sip_transaction_timeout | The virtual server should discard a SIP transaction when no further messages have been seen within this time.
|
sip_udp_associate_by_source | Require that SIP datagrams which are part of the same transaction are received from the same address and port.
|
slm_class | The service level monitoring class that this server should use, if any.
|
smtp_expect_starttls | Whether or not the traffic manager should expect the connection to start off in plain text and then upgrade to SSL using STARTTLS when handling SMTP traffic.
|
ssl_add_http_headers | Whether or not the virtual server should add HTTP headers to each request to show the SSL connection parameters.
|
ssl_cipher_suites | The SSL/TLS cipher suites to allow for connections to this virtual server. Leaving this empty will make the virtual server use the globally configured cipher suites, see configuration key ssl!cipher_suites in the Global Settings section of the System tab. See there for how to specify SSL/TLS cipher suites.
|
ssl_client_cert_cas | The certificate authorities that this virtual server should trust to validate client certificates. If no certificate authorities are selected, and client certificates are requested, then all client certificates will be accepted.
|
ssl_client_cert_headers | What HTTP headers the virtual server should add to each request to show the data in the client certificate.
"all": Certificate fields and certificate text "none": No data "simple": Certificate fields |
ssl_decrypt | Whether or not the virtual server should decrypt incoming SSL traffic.
|
ssl_elliptic_curves | The SSL elliptic curve preference list for SSL connections to this virtual server using TLS version 1.0 or higher. Leaving this empty will make the virtual server use the globally configured curve preference list. The named curves P256, P384 and P521 may be configured.
|
ssl_honor_fallback_scsv | Whether or not the Fallback SCSV sent by TLS clients is honored by this virtual server. Choosing the global setting means the value of configuration key ssl!honor_fallback_scsv from the Global Settings section of the System tab will be enforced.
"disabled": Disable Fallback SCSV "enabled": Enable Fallback SCSV "use_default": Use the global setting for Fallback SCSV |
ssl_issued_certs_never_expire | When the virtual server verifies certificates signed by these certificate authorities, it doesn't check the 'not after' date, i.e., they are considered valid even after their expiration date has passed (but not if they have been revoked).
|
ssl_issued_certs_never_expire_depth | This setting gives the number of certificates in a certificate chain beyond those listed as issued_certs_never_expire whose certificate expiry will not be checked. For example "0" will result in the expiry checks being made for certificates issued by issued_certs_never_expire certificates, "1" will result in no expiry checks being performed for the certificates directly issued by issued_certs_never_expire certificates, "2" will avoid checking expiry for certificates issued by certificates issued by the issued_certs_never_expire certificates as well, and so on.
|
ssl_ocsp_enable | Whether or not the traffic manager should use OCSP to check the revocation status of client certificates.
|
ssl_ocsp_issuers | A table of certificate issuer specific OCSP settings.
Permitted values: "off": No nonce check "on": Use nonce, server does not have to reply with nonce "strict": Use nonce, server must reply with nonce
Permitted values: "none": None "optional": OCSP check optional "strict": OCSP check required
|
ssl_ocsp_issuers_json | A Traffic Manager REST-compatible JSON representation of the "ssl_ocsp_issuers" table property. Use this field with the "vtm_virtual_server_ocsp_issuers_table" data source for dynamic table generation from input variables.
|
ssl_ocsp_max_response_age | The number of seconds for which an OCSP response is considered valid if it has not yet exceeded the time specified in the 'nextUpdate' field. If set to 0 (zero) then OCSP responses are considered valid until the time specified in their 'nextUpdate' field.
|
ssl_ocsp_stapling | If OCSP URIs are present in certificates used by this virtual server, then enabling this option will allow the traffic manager to provide OCSP responses for these certificates as part of the handshake, if the client sends a TLS status_request extension in the ClientHello.
|
ssl_ocsp_time_tolerance | The number of seconds outside the permitted range for which the 'thisUpdate' and 'nextUpdate' fields of an OCSP response are still considered valid.
|
ssl_ocsp_timeout | The number of seconds after which OCSP requests will be timed out.
|
ssl_request_client_cert | Whether or not the virtual server should request an identifying SSL certificate from each client.
"dont_request": Do not request a client certificate "request": Request, but do not require a client certificate "require": Require a client certificate |
ssl_send_close_alerts | Whether or not to send an SSL/TLS "close alert" when the traffic manager is initiating an SSL socket disconnection.
|
ssl_server_cert_alt_certificates | The SSL certificates and corresponding private keys.
|
ssl_server_cert_default | The default SSL certificate to use for this virtual server.
|
ssl_server_cert_host_mapping | Host specific SSL server certificate mappings.
|
ssl_server_cert_host_mapping_json | A Traffic Manager REST-compatible JSON representation of the "ssl_server_cert_host_mapping" table property. Use this field with the "vtm_virtual_server_server_cert_host_mapping_table" data source for dynamic table generation from input variables.
|
ssl_session_cache_enabled | Whether or not use of the session cache is enabled for this virtual server. Choosing the global setting means the value of configuration key ssl!session_cache_enabled from the Global Settings section of the System tab will be enforced.
"disabled": Disable use of the session cache "enabled": Enable use of the session cache "use_default": Use the global setting for use of the session cache |
ssl_session_tickets_enabled | Whether or not use of session tickets is enabled for this virtual server. Choosing the global setting means the value of configuration key ssl!tickets!enabled from the Global Settings section of the System tab will be enforced.
"disabled": Disable use of the session tickets "enabled": Enable use of the session tickets "use_default": Use the global setting for use of session tickets |
ssl_signature_algorithms | The SSL signature algorithms preference list for SSL connections to this virtual server using TLS version 1.2 or higher. Leaving this empty will make the virtual server use the globally configured preference list, signature_algorithms in the ssl section of the global_settings resource. See there and in the online help for how to specify SSL signature algorithms.
|
ssl_support_ssl3 | Whether or not SSLv3 is enabled for this virtual server. Choosing the global setting means the value of configuration key ssl!support_ssl3 from the Global Settings section of the System tab will be enforced.
"disabled": Disable SSLv3 "enabled": Enable SSLv3 "use_default": Use the global setting for SSLv3 |
ssl_support_tls1 | Whether or not TLSv1.0 is enabled for this virtual server. Choosing the global setting means the value of configuration key ssl!support_tls1 from the Global Settings section of the System tab will be enforced.
"disabled": Disable TLSv1.0 "enabled": Enable TLSv1.0 "use_default": Use the global setting for TLSv1.0 |
ssl_support_tls1_1 | Whether or not TLSv1.1 is enabled for this virtual server. Choosing the global setting means the value of configuration key ssl!support_tls1_1 from the Global Settings section of the System tab will be enforced.
"disabled": Disable TLSv1.1 "enabled": Enable TLSv1.1 "use_default": Use the global setting for TLSv1.1 |
ssl_support_tls1_2 | Whether or not TLSv1.2 is enabled for this virtual server. Choosing the global setting means the value of configuration key ssl!support_tls1_2 from the Global Settings section of the System tab will be enforced.
"disabled": Disable TLSv1.2 "enabled": Enable TLSv1.2 "use_default": Use the global setting for TLSv1.2 |
ssl_support_tls1_3 | Whether or not TLSv1.3 is enabled for this virtual server. Choosing the global setting means the value of configuration key ssl!support_tls1_3 from the Global Settings section of the System tab will be enforced.
"disabled": Disable TLSv1.3 "enabled": Enable TLSv1.3 "use_default": Use the global setting for TLSv1.3 |
ssl_trust_magic | If the traffic manager is receiving traffic sent from another traffic manager, then enabling this option will allow it to decode extra information on the true origin of the SSL connection. This information is supplied by the first traffic manager.
|
syslog_enabled | Whether or not to log connections to the virtual server to a remote syslog host.
|
syslog_format | The log format for the remote syslog. This specifies the line of text that will be sent to the remote syslog when a connection to the traffic manager is completed. Many parameters from the connection can be recorded using macros.
|
syslog_ip_end_point | The remote host and port (default is 514) to send request log lines to.
|
syslog_msg_len_limit | Maximum length in bytes of a message sent to the remote syslog. Messages longer than this will be truncated before they are sent.
|
tcp_close_with_rst | Whether or not connections from clients should be closed with a RST packet, rather than a FIN packet. This avoids the TIME_WAIT state, which on rare occasions allows wandering duplicate packets to be safely ignored.
|
tcp_nagle | Whether or not Nagle's algorithm should be used for TCP connections.
|
tcp_proxy_close | If set to Yes the traffic manager will send the client FIN to the back-end server and wait for a server response instead of closing the connection immediately. This is only necessary for protocols that require half-close support to function correctly, such as "rsh". If the traffic manager is responding to the request itself, setting this key to Yes will cause the traffic manager to continue writing the response even after it has received a FIN from the client.
|
transaction_export_brief | Whether to export a restricted set of metadata about transactions processed by this virtual server. If enabled, more verbose information such as client and server headers and request tracing events will be omitted from the exported data.
|
transaction_export_enabled | Export metadata about transactions handled by this service to the globally configured endpoint. Data will be exported only if the global transaction_export!enabled setting is enabled.
|
transaction_export_hi_res | Whether the transaction processing timeline included in the metadata export is recorded with a high, microsecond, resolution. If set to No, timestamps will be recorded with a resolution of milliseconds.
|
transaction_export_http_header_blacklist | The set of HTTP header names for which corresponding values should be redacted from the metadata exported by this virtual server.
|
transparent | Whether or not bound sockets should be configured for transparent proxying.
|
udp_end_point_persistence | Whether UDP datagrams received from the same IP address and port are sent to the same pool node if they match an existing UDP session. Sessions are defined by the protocol being handled, for example SIP datagrams are grouped based on the value of the Call-ID header.
|
udp_port_smp | Whether or not UDP datagrams should be distributed across all traffic manager processes, if this behaviour is not normally selected automatically due to other settings.
|
udp_rbuff_size | If this setting is non-zero, the virtual server will set the socket receive buffer size to this number of bytes. If set, this will override the so_rbuff_size setting. An OS-specified limit on socket buffer sizes such as given by sysctl net.core.rmem_max can be exceeded using this setting.
|
udp_response_datagrams_expected | The virtual server should discard any UDP connection and reclaim resources when the node has responded with this number of datagrams. For simple request/response protocols this can be often set to 1. If set to -1, the connection will not be discarded until the timeout is reached.
|
udp_smp_mode | Whether the traffic manager should try to use SO_REUSEPORT for distributing incoming UDP datagrams across multiple processes (if kernel support is detected) or whether the legacy (pre-20.2) multi-processing mode should be used.
"auto": auto "legacy": legacy |
udp_timeout | The virtual server should discard any UDP connection and reclaim resources when no further UDP traffic has been seen within this time.
|
udp_wbuff_size | If this setting is non-zero, the virtual server will set the socket send buffer size to this number of bytes. If set, this will override the so_wbuff_size setting. An OS-specified limit on socket buffer sizes such as given by sysctl net.core.wmem_max can be exceeded using this setting.
|
web_cache_control_out | The "Cache-Control" header to add to every cached HTTP response, no-cache or max-age=600 for example.
|
web_cache_enabled | If set to Yes the traffic manager will attempt to cache web server responses.
|
web_cache_error_page_time | Time period to cache error pages for.
|
web_cache_max_time | Maximum time period to cache web pages for.
|
web_cache_refresh_time | If a cached page is about to expire within this time, the traffic manager will start to forward some new requests on to the web servers. A maximum of one request per second will be forwarded; the remainder will continue to be served from the cache. This prevents "bursts" of traffic to your web servers when an item expires from the cache. Setting this value to 0 will stop the traffic manager updating the cache before it expires.
|
vtm_aptimizer_profile
URI Endpoint: /api/tm/8.3/config/active/aptimizer/profiles
A Web Accelerator profile can be applied to an HTTP virtual server to enable automatic web content optimization.
# Example usage of vtm_aptimizer_profile resource...
resource "vtm_aptimizer_profile" "my_aptimizer_profile" {
name = "MyAptimizerProfile"
}Property | Description |
|---|---|
name | Name of the object
|
background_after | If Web Accelerator can finish optimizing the resource within this time limit then serve the optimized content to the client, otherwise complete the optimization in the background and return the original content to the client. If set to 0, Web Accelerator will always wait for the optimization to complete before sending a response to the client.
|
background_on_additional_resources | If a web page contains resources that have not yet been optimized, fetch and optimize those resources in the background and send a partially optimized web page to clients until all resources on that page are ready.
|
mode | Set the Web Accelerator mode to turn acceleration on or off.
"active": On - Web Accelerator acceleration is enabled "idle": Off - Acceleration is disabled, but requests for Web Accelerator resources are served "stealth": Stealth - Acceleration is controlled by a cookie |
show_info_bar | Show the Web Accelerator information bar on optimized web pages. This requires HTML optimization to be enabled in the acceleration settings.
|