pyats-f5-ltm

name	pyats-f5-ltm
description	F5 BIG-IP LTM/GTM operations via pyATS iControl REST — virtual servers, pools, nodes, monitors, profiles, iRules, persistence, GTM wide IPs, DNS, data groups. Use when checking F5 virtual server status, auditing pool members, reviewing iRules, or inspecting GTM wide IP health.
license	Apache-2.0
user-invocable	true
metadata	{"openclaw":{"requires":{"bins":"[Truncated]","env":"[Truncated]"}}}

F5 BIG-IP LTM/GTM Operations via pyATS

Testbed Requirements

F5 BIG-IP devices in the pyATS testbed:

devices:
  bigip-01:
    os: bigip
    type: load-balancer
    connections:
      rest:
        class: rest
        ip: 10.0.0.20
        port: 443
        protocol: https
    credentials:
      default:
        username: "%ENV{F5_USERNAME}"
        password: "%ENV{F5_PASSWORD}"

How to Call

Use pyats_run_show_command with iControl REST API paths:

PYATS_TESTBED_PATH=$PYATS_TESTBED_PATH python3 $MCP_CALL "${PYATS_PYTHON:-python3} -u $PYATS_MCP_SCRIPT" pyats_run_show_command '{"device_name":"bigip-01","command":"show ltm virtual"}'

Or for direct REST endpoints, the pyATS F5 connection maps these to iControl REST GETs.

---

LTM Endpoints

Virtual Servers

Endpoint	Description
/mgmt/tm/ltm/virtual	All virtual servers — name, destination, pool, profiles, status
/mgmt/tm/ltm/virtual-address	Virtual server IP addresses and availability
/mgmt/tm/ltm/traffic-matching-criteria	Traffic matching rules for virtual servers
/mgmt/tm/ltm/traffic-class	Traffic classification rules

Pools & Nodes

Endpoint	Description
/mgmt/tm/ltm/pool	All pools — name, members, monitor, load balancing method
/mgmt/tm/ltm/node	All nodes — address, state (enabled/disabled), monitor status
/mgmt/tm/ltm/default-node-monitor	Default monitor for nodes

Monitors

Endpoint	Description
/mgmt/tm/ltm/monitor/http	HTTP health monitors
/mgmt/tm/ltm/monitor/https	HTTPS health monitors
/mgmt/tm/ltm/monitor/tcp	TCP health monitors
/mgmt/tm/ltm/monitor/tcp-half-open	TCP half-open monitors
/mgmt/tm/ltm/monitor/tcp-echo	TCP echo monitors
/mgmt/tm/ltm/monitor/udp	UDP health monitors
/mgmt/tm/ltm/monitor/icmp	ICMP (ping) monitors
/mgmt/tm/ltm/monitor/gateway-icmp	Gateway ICMP monitors
/mgmt/tm/ltm/monitor/dns	DNS monitors
/mgmt/tm/ltm/monitor/ftp	FTP monitors
/mgmt/tm/ltm/monitor/sip	SIP monitors
/mgmt/tm/ltm/monitor/smtp	SMTP monitors
/mgmt/tm/ltm/monitor/pop3	POP3 monitors
/mgmt/tm/ltm/monitor/imap	IMAP monitors
/mgmt/tm/ltm/monitor/ldap	LDAP monitors
/mgmt/tm/ltm/monitor/mysql	MySQL monitors
/mgmt/tm/ltm/monitor/mssql	MSSQL monitors
/mgmt/tm/ltm/monitor/oracle	Oracle monitors
/mgmt/tm/ltm/monitor/postgresql	PostgreSQL monitors
/mgmt/tm/ltm/monitor/radius	RADIUS monitors
/mgmt/tm/ltm/monitor/radius-accounting	RADIUS accounting monitors
/mgmt/tm/ltm/monitor/snmp-dca	SNMP DCA monitors
/mgmt/tm/ltm/monitor/snmp-dca-base	SNMP DCA base monitors

Profiles

Endpoint	Description
/mgmt/tm/ltm/profile/http	HTTP profiles (X-Forwarded-For, compression, pipelining)
/mgmt/tm/ltm/profile/http2	HTTP/2 profiles
/mgmt/tm/ltm/profile/http-compression	HTTP compression profiles
/mgmt/tm/ltm/profile/http-proxy-connect	HTTP proxy connect profiles
/mgmt/tm/ltm/profile/httprouter	HTTP router profiles
/mgmt/tm/ltm/profile/tcp	TCP profiles (congestion, timeouts, MSS)
/mgmt/tm/ltm/profile/tcp-analytics	TCP analytics profiles
/mgmt/tm/ltm/profile/udp	UDP profiles
/mgmt/tm/ltm/profile/fastl4	FastL4 profiles (layer 4 acceleration)
/mgmt/tm/ltm/profile/fasthttp	FastHTTP profiles
/mgmt/tm/ltm/profile/client-ssl	Client SSL profiles (certs, ciphers, TLS versions)
/mgmt/tm/ltm/profile/server-ssl	Server SSL profiles
/mgmt/tm/ltm/profile/one-connect	OneConnect profiles (connection pooling)
/mgmt/tm/ltm/profile/web-acceleration	Web acceleration / caching profiles
/mgmt/tm/ltm/profile/dns	DNS profiles
/mgmt/tm/ltm/profile/dns-logging	DNS logging profiles
/mgmt/tm/ltm/profile/ftp	FTP profiles
/mgmt/tm/ltm/profile/sip	SIP profiles
/mgmt/tm/ltm/profile/diameter	Diameter profiles
/mgmt/tm/ltm/profile/fix	FIX protocol profiles
/mgmt/tm/ltm/profile/mqtt	MQTT profiles
/mgmt/tm/ltm/profile/rtsp

Persistence

Endpoint	Description
/mgmt/tm/ltm/persistence/cookie	Cookie persistence
/mgmt/tm/ltm/persistence/source-addr	Source address persistence
/mgmt/tm/ltm/persistence/dest-addr	Destination address persistence
/mgmt/tm/ltm/persistence/ssl	SSL session ID persistence
/mgmt/tm/ltm/persistence/sip	SIP call-ID persistence
/mgmt/tm/ltm/persistence/hash	Hash persistence
/mgmt/tm/ltm/persistence/host	Host persistence
/mgmt/tm/ltm/persistence/msrdp	MS RDP persistence
/mgmt/tm/ltm/persistence/universal	Universal persistence (iRule-based)
/mgmt/tm/ltm/persistence/persist-records	Active persistence records
/mgmt/tm/ltm/persistence/global-settings	Persistence global settings

iRules, Policies & Data Groups

Endpoint	Description
/mgmt/tm/ltm/rule	iRules — custom traffic management logic
/mgmt/tm/ltm/rule-profiler	iRule profiler (performance stats)
/mgmt/tm/ltm/policy	LTM policies (L7 routing decisions)
/mgmt/tm/ltm/policy-strategy	Policy strategies
/mgmt/tm/ltm/data-group/internal	Internal data groups (key-value lists)
/mgmt/tm/ltm/data-group/external	External data groups (file-based)
/mgmt/tm/ltm/ifile	iFiles (iRule-accessible files)

SNAT & NAT

Endpoint	Description
/mgmt/tm/ltm/snat	SNAT configurations
/mgmt/tm/ltm/snat-translation	SNAT translation addresses
/mgmt/tm/ltm/snatpool	SNAT pools
/mgmt/tm/ltm/nat	NAT configurations

Authentication (LTM-specific)

Endpoint	Description
/mgmt/tm/ltm/auth/profile	LTM auth profiles
/mgmt/tm/ltm/auth/ldap	LTM LDAP auth
/mgmt/tm/ltm/auth/radius	LTM RADIUS auth
/mgmt/tm/ltm/auth/radius-server	LTM RADIUS servers
/mgmt/tm/ltm/auth/tacacs	LTM TACACS auth
/mgmt/tm/ltm/auth/ssl-cc-ldap	SSL client cert LDAP auth
/mgmt/tm/ltm/auth/ssl-crldp	SSL CRLDP auth
/mgmt/tm/ltm/auth/ssl-ocsp	SSL OCSP auth
/mgmt/tm/ltm/auth/crldp-server	CRLDP server
/mgmt/tm/ltm/auth/kerberos-delegation	Kerberos delegation
/mgmt/tm/ltm/auth/ocsp-responder	OCSP responder

Cipher & Eviction

Endpoint	Description
/mgmt/tm/ltm/cipher/group	Cipher groups
/mgmt/tm/ltm/cipher/rule	Cipher rules
/mgmt/tm/ltm/eviction-policy	Cache eviction policies

DNS (LTM)

Endpoint	Description
/mgmt/tm/ltm/dns/analytics/global-settings	DNS analytics settings
/mgmt/tm/ltm/dns/cache/resolver	DNS resolver cache
/mgmt/tm/ltm/dns/cache/transparent	DNS transparent cache
/mgmt/tm/ltm/dns/cache/validating-resolver	DNSSEC validating resolver cache
/mgmt/tm/ltm/dns/dnssec/key	DNSSEC keys
/mgmt/tm/ltm/dns/nameserver	DNS nameservers
/mgmt/tm/ltm/dns/tsig-key	TSIG keys
/mgmt/tm/ltm/dns/zone	DNS zones

Message Routing

Endpoint	Description
/mgmt/tm/ltm/message-routing/diameter/peer	Diameter peers
/mgmt/tm/ltm/message-routing/diameter/profile	Diameter routing profiles
/mgmt/tm/ltm/message-routing/generic/protocol	Generic message protocol
/mgmt/tm/ltm/message-routing/generic/route	Generic message routes
/mgmt/tm/ltm/message-routing/generic/transport-config	Generic transport config
/mgmt/tm/ltm/message-routing/sip	SIP message routing
/mgmt/tm/ltm/message-routing/mqtt/profile/router	MQTT router profile
/mgmt/tm/ltm/message-routing/mqtt/profile/session	MQTT session profile

HTML Rules & TACDB

Endpoint	Description
/mgmt/tm/ltm/html-rule/tag-append-html	HTML tag append rules
/mgmt/tm/ltm/html-rule/tag-prepend-html	HTML tag prepend rules
/mgmt/tm/ltm/html-rule/tag-remove	HTML tag remove rules
/mgmt/tm/ltm/html-rule/tag-remove-attribute	HTML tag attribute remove
/mgmt/tm/ltm/html-rule/tag-raise-event	HTML tag raise event
/mgmt/tm/ltm/html-rule/comment-raise-event	HTML comment raise event
/mgmt/tm/ltm/html-rule/comment-remove	HTML comment remove
/mgmt/tm/ltm/tacdb/customdb	Custom TACDB
/mgmt/tm/ltm/tacdb/licenseddb	Licensed TACDB
/mgmt/tm/ltm/tacdb/query	TACDB query

Global Settings

Endpoint	Description
/mgmt/tm/ltm/global-settings/connection	Connection global settings
/mgmt/tm/ltm/global-settings/general	General global settings
/mgmt/tm/ltm/global-settings/rule	iRule global settings
/mgmt/tm/ltm/global-settings/traffic-control	Traffic control global settings

---

GTM Endpoints

Wide IPs (GSLB)

Endpoint	Description
/mgmt/tm/gtm/wideip/a	A record wide IPs
/mgmt/tm/gtm/wideip/aaaa	AAAA record wide IPs
/mgmt/tm/gtm/wideip/cname	CNAME record wide IPs
/mgmt/tm/gtm/wideip/mx	MX record wide IPs
/mgmt/tm/gtm/wideip/naptr	NAPTR record wide IPs
/mgmt/tm/gtm/wideip/srv	SRV record wide IPs

GTM Pools

Endpoint	Description
/mgmt/tm/gtm/pool/a	A record pools
/mgmt/tm/gtm/pool/aaaa	AAAA record pools
/mgmt/tm/gtm/pool/cname	CNAME record pools
/mgmt/tm/gtm/pool/mx	MX record pools
/mgmt/tm/gtm/pool/naptr	NAPTR record pools
/mgmt/tm/gtm/pool/srv	SRV record pools

GTM Infrastructure

Endpoint	Description
/mgmt/tm/gtm/datacenter	GTM data centers
/mgmt/tm/gtm/server	GTM servers (virtual server discovery)
/mgmt/tm/gtm/prober-pool	Prober pools
/mgmt/tm/gtm/listener	GTM listeners
/mgmt/tm/gtm/link	GTM links (ISP connections)
/mgmt/tm/gtm/distributed-app	Distributed applications
/mgmt/tm/gtm/iquery	iQuery connections between GTM devices
/mgmt/tm/gtm/ldns	LDNS probes
/mgmt/tm/gtm/path	GTM paths
/mgmt/tm/gtm/region	GTM regions (topology-based routing)
/mgmt/tm/gtm/topology	GTM topology records
/mgmt/tm/gtm/rule	GTM iRules
/mgmt/tm/gtm/persist	GTM persistence
/mgmt/tm/gtm/traffic	GTM traffic statistics
/mgmt/tm/gtm/sync-status	GTM sync status

GTM Monitors

Endpoint	Description
/mgmt/tm/gtm/monitor/bigip	BIG-IP monitor
/mgmt/tm/gtm/monitor/bigip-link	BIG-IP link monitor
/mgmt/tm/gtm/monitor/http	GTM HTTP monitor
/mgmt/tm/gtm/monitor/https	GTM HTTPS monitor
/mgmt/tm/gtm/monitor/gateway-icmp	GTM ICMP monitor
/mgmt/tm/gtm/monitor/tcp	GTM TCP monitor
/mgmt/tm/gtm/monitor/tcp-half-open	GTM TCP half-open monitor
/mgmt/tm/gtm/monitor/udp	GTM UDP monitor
/mgmt/tm/gtm/monitor/external	GTM external monitor
/mgmt/tm/gtm/monitor/firepass	GTM FirePass monitor
/mgmt/tm/gtm/monitor/ftp	GTM FTP monitor
/mgmt/tm/gtm/monitor/gtp	GTM GTP monitor
/mgmt/tm/gtm/monitor/imap	GTM IMAP monitor
/mgmt/tm/gtm/monitor/ldap	GTM LDAP monitor
/mgmt/tm/gtm/monitor/mssql	GTM MSSQL monitor
/mgmt/tm/gtm/monitor/mysql	GTM MySQL monitor
/mgmt/tm/gtm/monitor/nntp	GTM NNTP monitor
/mgmt/tm/gtm/monitor/oracle	GTM Oracle monitor
/mgmt/tm/gtm/monitor/pop3	GTM POP3 monitor
/mgmt/tm/gtm/monitor/postgresql	GTM PostgreSQL monitor
/mgmt/tm/gtm/monitor/radius	GTM RADIUS monitor
/mgmt/tm/gtm/monitor/radius-accounting	GTM RADIUS accounting monitor
/mgmt/tm/gtm/monitor/real-server

GTM Global Settings

Endpoint	Description
/mgmt/tm/gtm/global-settings/general	GTM general settings
/mgmt/tm/gtm/global-settings/load-balancing	GTM LB settings
/mgmt/tm/gtm/global-settings/metrics	GTM metrics settings
/mgmt/tm/gtm/global-settings/metrics-exclusions	GTM metrics exclusions

---

Workflows

1. LTM Application Health Check

/mgmt/tm/ltm/virtual → list all virtual servers, status
→ /mgmt/tm/ltm/pool → pool status, member states
→ /mgmt/tm/ltm/node → node availability
→ /mgmt/tm/ltm/persistence/persist-records → active sessions
→ Flag: virtuals down, pools with no available members, nodes offline
→ GAIT

2. SSL/TLS Certificate Audit

/mgmt/tm/ltm/profile/client-ssl → client SSL profiles
→ /mgmt/tm/ltm/profile/server-ssl → server SSL profiles
→ /mgmt/tm/ltm/cipher/group → cipher groups in use
→ /mgmt/tm/ltm/cipher/rule → cipher rules
→ Flag: weak ciphers, TLS 1.0/1.1 enabled, expiring certs
→ GAIT

3. GTM/GSLB Audit

/mgmt/tm/gtm/wideip/a → all A-record wide IPs
→ /mgmt/tm/gtm/pool/a → GTM pool health
→ /mgmt/tm/gtm/datacenter → datacenter status
→ /mgmt/tm/gtm/server → server availability
→ /mgmt/tm/gtm/sync-status → GTM sync state
→ Flag: wide IPs with no available pools, datacenters offline
→ GAIT

4. iRule Review

/mgmt/tm/ltm/rule → list all iRules
→ /mgmt/tm/ltm/rule-profiler → iRule performance stats
→ /mgmt/tm/ltm/virtual → which virtuals use which iRules
→ Flag: iRules with high CPU, unused iRules, deprecated commands
→ GAIT

---

Integration with Other Skills

Skill	Integration
f5-health-check	F5 MCP for operational monitoring; pyATS REST for full object inventory
f5-config-mgmt	F5 MCP for safe config changes; pyATS REST for pre/post audit
f5-troubleshoot	F5 MCP for troubleshooting; pyATS REST for deep object inspection
pyats-f5-platform	Platform/system endpoints complement LTM/GTM traffic management view
nvd-cve	Scan F5 software version against NVD
gait-session-tracking	Every REST query logged in GAIT

---

Guardrails

• All queries are read-only — GET requests to iControl REST API only
• No configuration changes — never POST/PUT/PATCH/DELETE via this skill
• Gate changes behind ServiceNow — any config changes go through f5-config-mgmt with CR
• Record in GAIT — every API query must be logged