# bigip_profile_fastl4 – Manages Fast L4 profiles

New in version 2.8.

- Synopsis
- Parameters
- Notes
- Examples
- Return Values
- Status

## Synopsis

- Manages Fast L4 profiles.

## Parameters

Parameter | Choices/Defaults | Comments
--- | --- | ---

client_timeout
string

Specifies a timeout for Late Binding.
This is the time limit for the client to provide the application data required to select a back-end server. That is, this is the maximum time that the BIG-IP system waits for information about the sender and the target.
This information typically arrives at the beginning of the FIX logon packet.
When `0`, or `immediate`, allows for no time beyond the moment of the first packet transmission.
When `indefinite`, disables the limit. This allows the client unlimited time to send the sender and target information.

description string |  | Description of the profile.

explicit_flow_migration
boolean

Choices:
- no
- yes

Specifies whether a qualified late-binding connection requires an explicit iRule command to migrate down to ePVA hardware.
When `no`, a late-binding connection migrates down to ePVA immediately after establishing the server-side connection.
When `yes`, this parameter stops automatic migration to ePVA, and requires that the iRule explicitly trigger ePVA processing by invoking the `release_flow` iRule command. This allows an iRule author to control when the connection uses the ePVA hardware.

idle_timeout
string

Specifies the length of time that a connection is idle (has no traffic) before the connection is eligible for deletion.
When creating a new profile, if this parameter is not specified, the remote device will choose a default value appropriate for the profile, based on its `parent` profile.
When a number is specified, indicates the number of seconds that the TCP connection can remain idle before the system deletes it.
When `indefinite`, specifies that the system does not delete TCP connections regardless of how long they remain idle.
When `0`, or `immediate`, specifies that the system deletes connections immediately when they become idle.

ip_df_mode
string

Choices:
- pmtu
- preserve
- set
- clear

Specifies the Don't Fragment (DF) bit setting in the IP Header of the outgoing TCP packet.
When `pmtu`, sets the outgoing IP Header DF bit based on IP pmtu setting.
When `preserve`, sets the outgoing Packet's IP Header DF bit to be same as incoming IP Header DF bit.
When `set`, sets the outgoing packet's IP Header DF bit.
When `clear`, clears the outgoing packet's IP Header DF bit.

ip_tos_to_client
string

Specifies, for IP traffic passing through the system to clients, whether the system modifies the IP type-of-service (ToS) setting in an IP packet header.
May be a number between 0 and 255 (inclusive). When a number, specifies the IP ToS setting that the system inserts in the IP packet header.
When `pass-through`, specifies that the IP ToS setting remains unchanged.
When `mimic`, specifies that the system sets the ToS level of outgoing packets to the same ToS level of the most-recently received incoming packet.

ip_tos_to_server
string

Specifies, for IP traffic passing through the system to back-end servers, whether the system modifies the IP type-of-service (ToS) setting in an IP packet header.
May be a number between 0 and 255 (inclusive). When a number, specifies the IP ToS setting that the system inserts in the IP packet header.
When `pass-through`, specifies that the IP ToS setting remains unchanged.
When `mimic`, specifies that the system sets the ToS level of outgoing packets to the same ToS level of the most-recently received incoming packet.

ip_ttl_mode
string

Choices:
- proxy
- preserve
- decrement
- set

Specifies the outgoing TCP packet's IP Header TTL mode.
When `proxy`, sets the outgoing IP Header TTL value to 255/64 for IPv4/IPv6 respectively.
When `preserve`, sets the outgoing IP Header TTL value to be same as the incoming IP Header TTL value.
When `decrement`, sets the outgoing IP Header TTL value to be one less than the incoming TTL value.
When `set`, sets the outgoing IP Header TTL value to a specific value(as specified by `ip_ttl_v4` or `ip_ttl_v6`.

ip_ttl_v4 integer |  | Specifies the outgoing packet's IP Header TTL value for IPv4 traffic. Maximum TTL value that can be specified is 255.
ip_ttl_v6 integer |  | Specifies the outgoing packet's IP Header TTL value for IPv6 traffic. Maximum TTL value that can be specified is 255.
keep_alive_interval integer |  | Specifies the keep-alive probe interval, in seconds.

late_binding
boolean

Choices:
- no
- yes

Enables intelligent selection of a back-end server or pool, using an iRule to make the selection.

link_qos_to_client
string

Specifies, for IP traffic passing through the system to clients, whether the system modifies the link quality-of-service (QoS) setting in an IP packet header.
The link QoS value prioritizes the IP packet relative to other Layer 2 traffic.
You can specify a number between 0 (lowest priority) and 7 (highest priority).
When a number, specifies the link QoS setting that the system inserts in the IP packet header.
When `pass-through`, specifies that the link QoS setting remains unchanged.

link_qos_to_server
string

Specifies, for IP traffic passing through the system to back-end servers, whether the system modifies the link quality-of-service (QoS) setting in an IP packet header.
The link QoS value prioritizes the IP packet relative to other Layer 2 traffic.
You can specify a number between 0 (lowest priority) and 7 (highest priority).
When a number, specifies the link QoS setting that the system inserts in the IP packet header.
When `pass-through`, specifies that the link QoS setting remains unchanged.

loose_close
boolean

Choices:
- no
- yes

When `yes`, specifies, that the system closes a loosely-initiated connection when the system receives the first FIN packet from either the client or the server.

loose_initialization
boolean

Choices:
- no
- yes

When `yes`, specifies that the system initializes a connection when it receives any TCP packet, rather that requiring a SYN packet for connection initiation.

mss_override integer |  | Specifies a maximum segment size (MSS) override for server-side connections. Valid range is 256 to 9162 or 0 to disable.
name string / required |  | Specifies the name of the profile.
parent string |  | Specifies the profile from which this profile inherits settings. When creating a new profile, if this parameter is not specified, the default is the system-supplied `fastL4` profile.
partition string | Default: "Common" | Device partition to manage resources on.
provider dictionary added in 2.5 |  | A dict object containing connection details.
| auth_provider string |  | Configures the auth provider for to obtain authentication tokens from the remote device. This option is really used when working with BIG-IQ devices.
| password string / required |  | The password for the user account used to connect to the BIG-IP. You may omit this option by setting the environment variable `F5_PASSWORD`. aliases: pass, pwd
| server string / required |  | The BIG-IP host. You may omit this option by setting the environment variable `F5_SERVER`.
| server_port integer | Default: 443 | The BIG-IP server port. You may omit this option by setting the environment variable `F5_SERVER_PORT`.
| ssh_keyfile path |  | Specifies the SSH keyfile to use to authenticate the connection to the remote device. This argument is only used for cli transports. You may omit this option by setting the environment variable `ANSIBLE_NET_SSH_KEYFILE`.
| timeout integer |  | Specifies the timeout in seconds for communicating with the network device for either connecting or sending commands. If the timeout is exceeded before the operation is completed, the module will error.

transport
string

Choices:
- cli
- rest ←

Configures the transport connection to use when connecting to the remote device.

| user string / required |  | The username to connect to the BIG-IP with. This user must have administrative privileges on the device. You may omit this option by setting the environment variable `F5_USER`.

validate_certs
boolean

Choices:
- no
- yes ←

If `no`, SSL certificates are not validated. Use this only on personally controlled sites using self-signed certificates.
You may omit this option by setting the environment variable `F5_VALIDATE_CERTS`.

reassemble_fragments
boolean

Choices:
- no
- yes

When `yes`, specifies that the system reassembles IP fragments.

receive_window_size integer |  | Specifies the amount of data the BIG-IP system can accept without acknowledging the server.

reset_on_timeout
boolean

Choices:
- no
- yes

When `yes`, specifies that the system sends a reset packet (RST) in addition to deleting the connection, when a connection exceeds the idle timeout value.

rtt_from_client
boolean

Choices:
- no
- yes

When `yes`, specifies that the system uses TCP timestamp options to measure the round-trip time to the client.

rtt_from_server
boolean

Choices:
- no
- yes

When `yes`, specifies that the system uses TCP timestamp options to measure the round-trip time to the server.

server_sack
boolean

Choices:
- no
- yes

Specifies whether the BIG-IP system processes Selective ACK (Sack) packets in cookie responses from the server.

server_timestamp
boolean

Choices:
- no
- yes

Specifies whether the BIG-IP system processes timestamp request packets in cookie responses from the server.

state
string

Choices:
- present ←
- absent

When `present`, ensures that the profile exists.
When `absent`, ensures the profile is removed.

syn_cookie_mss integer |  | Specifies a value that overrides the SYN cookie maximum segment size (MSS) value in the SYN-ACK packet that is returned to the client. Valid values are 0, and values from 256 through 9162.
tcp_close_timeout string |  | Specifies the length of time a connection can remain idle before deletion.

tcp_generate_isn
boolean

Choices:
- no
- yes

When `yes`, specifies that the system generates initial sequence numbers for SYN packets, according to RFC 1948.

tcp_handshake_timeout
string

Specifies the acceptable duration for a TCP handshake, that is, the maximum idle time between a client synchronization (SYN) and a client acknowledgment (ACK). If the TCP handshake takes longer than the timeout, the system automatically closes the connection.
When a number, specifies how long the system can try to establish a TCP handshake before timing out.
When `disabled`, specifies that the system does not apply a timeout to a TCP handshake.
When `indefinite`, specifies that attempting a TCP handshake never times out.

tcp_strip_sack
boolean

Choices:
- no
- yes

When `yes`, specifies that the system blocks a TCP selective ACK SackOK option from passing to the server on an initiating SYN.

tcp_time_wait_timeout integer |  | Specifies the number of milliseconds that a connection is in the TIME-WAIT state before closing.

tcp_timestamp_mode
string

Choices:
- preserve
- rewrite
- strip

Specifies the action that the system should take on TCP timestamps.

tcp_wscale_mode
string

Choices:
- preserve
- rewrite
- strip

Specifies the action that the system should take on TCP windows.

timeout_recovery
string

Choices:
- disconnect
- fallback

Specifies how to handle client-timeout errors for Late Binding.
Timeout errors may be caused by a DoS attack or a lossy connection.
When `disconnect`, causes the BIG-IP system to drop the connection.
When `fallback`, reverts the connection to normal FastL4 load-balancing, based on the client's TCP header. This causes the BIG-IP system to choose a back-end server based only on the source address and port.

## Notes

Note

- For more information on using Ansible to manage F5 Networks devices see https://www.ansible.com/integrations/networks/f5.
- Requires BIG-IP software version >= 12.
- The F5 modules only manipulate the running configuration of the F5 product. To ensure that BIG-IP specific configuration persists to disk, be sure to include at least one task that uses the bigip_config module to save the running configuration. Refer to the module’s documentation for the correct usage of the module to save your running configuration.

## Examples

    - name: Create a fastL4 profile
      bigip_profile_fastl4:
        name: foo
        provider:
          password: secret
          server: lb.mydomain.com
          user: admin
      delegate_to: localhost

## Return Values

Common return values are documented here, the following are the fields unique to this module:

Key | Returned | Description
--- | --- | ---
client_timeout string | changed | The new client timeout value of the resource. Sample: True
description string | changed | The new description. Sample: My description
explicit_flow_migration boolean | changed | The new flow migration setting. Sample: True
idle_timeout string | changed | The new idle timeout setting. Sample: 123
ip_df_mode string | changed | The new Don't Fragment Flag (DF) setting. Sample: clear
ip_tos_to_client string | changed | The new IP ToS to Client setting. Sample: 100
ip_tos_to_server string | changed | The new IP ToS to Server setting. Sample: 100
ip_ttl_mode string | changed | The new Time To Live (TTL) setting. Sample: proxy
ip_ttl_v4 integer | changed | The new Time To Live (TTL) v4 setting. Sample: 200
ip_ttl_v6 integer | changed | The new Time To Live (TTL) v6 setting. Sample: 200
keep_alive_interval integer | changed | The new TCP Keep Alive Interval setting. Sample: 100
late_binding boolean | changed | The new Late Binding setting. Sample: True
link_qos_to_client string | changed | The new Link QoS to Client setting. Sample: pass-through
link_qos_to_server string | changed | The new Link QoS to Server setting. Sample: 123
loose_close boolean | changed | The new Loose Close setting.
loose_initialization boolean | changed | The new Loose Initiation setting.
mss_override integer | changed | The new Maximum Segment Size Override setting. Sample: 300
reassemble_fragments boolean | changed | The new Reassemble IP Fragments setting. Sample: True
receive_window_size integer | changed | The new Receive Window setting. Sample: 1024
reset_on_timeout boolean | changed | The new Reset on Timeout setting.
rtt_from_client boolean | changed | The new RTT from Client setting.
rtt_from_server boolean | changed | The new RTT from Server setting.
server_sack boolean | changed | The new Server Sack setting. Sample: True
server_timestamp boolean | changed | The new Server Timestamp setting. Sample: True
syn_cookie_mss integer | changed | The new SYN Cookie MSS setting. Sample: 1024
tcp_close_timeout string | changed | The new TCP Close Timeout setting. Sample: 100
tcp_generate_isn boolean | changed | The new Generate Initial Sequence Number setting.
tcp_handshake_timeout integer | changed | The new TCP Handshake Timeout setting. Sample: 5
tcp_strip_sack boolean | changed | The new Strip Sack OK setting.
tcp_time_wait_timeout integer | changed | The new TCP Time Wait Timeout setting. Sample: 100
tcp_timestamp_mode string | changed | The new TCP Timestamp Mode setting. Sample: rewrite
tcp_wscale_mode string | changed | The new TCP Window Scale Mode setting. Sample: strip
timeout_recovery string | changed | The new Timeout Recovery setting. Sample: fallback

## Status

- This module is not guaranteed to have a backwards compatible interface. [preview]
- This module is maintained by an Ansible Partner. [certified]

### Authors

- Tim Rupp (@caphrim007)

Hint

If you notice any issues in this documentation, you can edit this document to improve it.