VCF Load Balancer Insight: Deployment

Version: 2026.1.2.1

This page covers installing the Management Pack and configuring an adapter instance.

User Permissions and Connection Requirements

Category	Description
Cloud Proxy to BIG-IP	Reachable over HTTPS on port 443 from the collector group.
BIG-IP account	A read-only account with the F5 Auditor role plus iControl REST permissions.
LTM module	The ltm module must be provisioned on the BIG-IP for the virtual servers, pools, pool members, nodes, monitors and profiles to be collected. On an LTM and an SSL instance alike, an instance whose ltm is not provisioned emits no LTM object and no ssl group.
F5 Device Group	Requires the Administrator role and is therefore not readable with the read-only account; the cluster is synthesized from the device member list instead.
System metrics	Some CPU, memory and disk counters require administrator rights; where they cannot be read, no data point is emitted (never a zero).
Cipher groups (SSL model)	/mgmt/tm/ltm/cipher/group is read best-effort to resolve a profile's cipher-group reference to its full path; a denial costs nothing, because the field is emitted from the profile reference either way.
Container registry	HTTPS/443 to the container registry to pre-pull the adapter image.

Installing the addon

1. Pre-pull the adapter image on the cloud proxies belonging to the collector group, using the image name shown on the release page for the matching version.
2. Install the PAK: in VMware Aria Operations go to Data Sources > Integrations > Repository > Add, upload the PAK and tick both Install the PAK file even if it is already installed and Ignore the PAK file signature checking.
3. Configure the adapter account: add an adapter instance and supply the credentials and instance parameters below.

Adapter fields

Credentials. One credential type, LB credentials, with two fields:

Field Name	Definition
User name	BIG-IP account name.
Password	BIG-IP account password.

Instance parameters. The address is the only required field; every other parameter is advanced and falls back to its default.

Field Name	Default	Definition
Address (IP or FQDN)	required	IP address or FQDN of the target device management interface, reachable from the Cloud Proxy on the management port.
Management port	443	iControl REST port. 443 for production; the local emulator uses 8080.
Accept self-signed certificates	0	1 accepts any certificate presented by the BIG-IP. For lab targets; production should import the CA instead.
Authentication	token	token uses the F5 login endpoint (recommended). basic sends the account on every call and needs TLS; some hardened instances disable the login endpoint.
Token refresh threshold (seconds)	960	Re-login once the token has lived this long. The F5 token TTL is about 1200 s, so the default leaves a full 300 s collection cycle of margin.
API timeout (seconds)	60	Per-request timeout for calls to the BIG-IP management interface.
Partitions	empty	Comma separated partition whitelist. Empty means every partition.
Max concurrent requests	8	Bounded worker pool for the per-pool member fan-out. Requests above 429/503 are retried with backoff. There is no cap on the number of members collected.
Vendor	F5	Load-balancer vendor to collect from this instance. F5 uses the iControl REST API; the parameter exists so a second vendor can be added without a new adapter kind.
Model	LTM	Model reported as the top-level model property. LTM and SSL are values of the same F5 iControl REST client and the same endpoint set; the value only labels the instance. Collection is still driven by the ltm capability gate, so an SSL-labelled instance whose ltm module is not provisioned emits no LTM object and no ssl group.

Adding an F5 SSL instance

An F5 SSL (SSL-offload) appliance is added as an ordinary instance of the same adapter kind:

1. Add an account under Data Sources > Integrations > Accounts > VCF Load Balancer Insight.
2. Set Vendor to F5, Model to SSL, and the address / management port of the SSL appliance.
3. Supply the read-only account credentials (Auditor role plus iControl REST permissions).
4. Run the connection test; after the first collection cycle the instance produces the same object kinds as an LTM instance, with model = SSL and the ssl group populated on the client-ssl and server-ssl profiles.