F5® BIG-IP® Monitoring Integration Guide


IBM SevOne Network Performance Management (NPM) provides one of the most powerful integrations of performance metrics and flow data in the market today. When troubleshooting an alert such as a spike in utilization derived via SNMP polling or consumption of externally available statistical data, SevOne NPM provides one-click navigation to flow reports that instantly show the associated traffic for the exact period of time for that specific interface. This integration of raw flows into the troubleshooting workflow speeds problem resolution, and saves valuable time and effort when trying to understand and answer the who, what, when and where questions regarding traffic on your network. SevOne NPM is delivered as a distributed network of turnkey appliances, where each system is a collector, a reporter and a distributed storage system. The robust peer-to-peer software architecture with multi-threaded collection and distributed reporting algorithms scales from a single interface to tens of thousands of flow interfaces.

SevOne NPM's reporting algorithms generate network-wide reports that utilize the computing resources of all SevOne appliances in parallel, enabling reporting capacity to be scaled in step with collection capacity. This innovative peer-to-peer appliance architecture reduces the complexity and footprint of the solution, and therefore the Total Cost of Ownership (TCO).

How Does SevOne NPM Monitor F5® BIG-IP®

SevOne NPM collects data from F5 BIG-IP devices via SNMP and sFlow. SevOne NPM's integration allows for the collection of key F5 BIG-IP Local Traffic Manager™ (BIG-IP LTM) and F5 BIG-IP Advanced Firewall Manager™ (BIG-IP AFM) statistics which allow users to monitor the performance of their F5 BIG-IP deployment both in real time and historically. SevOne NPM software appliances are configured to store 365 days of raw polled data and 365 days of aggregated sFlow data. This retention of data allows users to look back historically and understand performance over time and also allows accurate projection of trends to come.

SevOne NPM collects statistical data from F5 BIG-IP products, specifically from BIG-IP LTM and BIG-IP AFM currently. Below is a graphic which shows some of the metrics and collection methods used. Additionally, mobile operators face the challenge of monitoring large scale networks as LTE/IMS architecture collapses what were previously two separate networks (voice and data) into a single all- IP system. These networks may include as many as five core, multivendor systems: radio access network, aggregation and backhaul, Ethernet packet core, MPLS transport/backbone, and the IMS core.


F5 Big-IP Performance Monitoring Setup

There are three integration technologies that the SevOne NPM software appliances use to gather, report, and alert on performance metrics for BIG-IP LTM and BIG-IP AFM.

They are as follows:

  • BIG-IP LTM statistics
  • sFlow used for collecting flow data on the conversations passing through the appliance

SNMP Configuration

F5 BIG-IP SNMP Monitoring Configuration

For detailed SNMP configuration please refer to the BIG-IP TMOS Implementation documentation relevant to your BIG-IP version.

In the F5 BIG-IP Configuration Utility, specify which hosts have SNMP access.

Make sure your SevOne NPM software appliance is in this list:

Then specify the SNMP community string you intend to use within SevOne NPM:

Leave the Access option as Read Only as SevOne does not have the ability to send SNMP commands to a device, it simply reads SNMP data in.

SevOne NPM Device SNMP Configuration

To setup SNMP monitoring of F5 BIG-IP, each BIG-IP must be added to SevOne NPM.

To do this go to Devices → Device Manager → Add Device

Then fill out the device credentials

F5 BIG-IP sFlow Monitoring Setup

F5 BIG-IP sFlow configuration

For detailed sFlow configuration within the F5 BIG-IP Platform please refer to the BIG-IP External Monitoring Implementation documentation relevant to your BIG-IP version.

In the F5 BIG-IP Configuration Utility perform the following steps:

Go to System → sFlow → Receiver List

Then fill in the appropriate information. Note that SevOne NPM's default configuration is set to listen on port 6343 which is the default port within the F5 BIG-IP.

SevOne NPM sFlow configuration

SevOne NPM configured to listen for sFlow on port 6343 so there is no configuration needed on SevOne NPM to receive flows. There are several screens to check to make sure the configuration is successful. To ensure SevOne NPM is receiving the flows go to Administration → Flow Configuration → Flow Interface Manager

You should see the F5 BIG-IP listed and the amount of flows that are coming in

To run a sample report in SevOne NPM Application → FlowFalcon Reports, select the F5 BIG-IP, All Interfaces, All Directions, and click Add Source.

Leave all other settings and scroll down and click Get Results.


A sample F5 BIG-IP AFM Dashboard would look like this: