Customer Edge controlled access guidance
Overview
F5 recommends that you secure access to deployed F5 Distributed Cloud Customer Edge (CE) nodes to help meet your organization's security policies and industry standards.
Each of the following sections provides information for access security controls for CE node configuration. Review each of the sections to determine if the specific configuration modification is appropriate for your environment.
Local access
F5 requires that you modify passwords for CE node management accounts from their default values. F5 also strongly recommends that you use SSH key pairs for all ongoing access to CE nodes.
As of the September 2026 SaaS release, root access is disabled for CEs.
Disable local node services
You can disable SSH/CE command-line interface (CLI) or configuration utility/web UI, to achieve greater security control or mitigate threats. Within the Multi-Cloud Network Connect workspace and under the Site Management section, disable local administrative service access individually by type and virtual routing and forwarding (VRF).
The following highlights the menu navigation location for various CE Site types where SSH/CE CLI or configuration utility/web UI can be disabled:
- Customer Edges > Secure Mesh Sites v2: Node Local Services
- Legacy Site types:
- Secure Mesh Site (legacy manual Site type): Advanced Configuration > Services to be blocked on site
- Cloud service provider Site types (Azure, AWS TGW, AWS VPC, and GCP): Advanced Configuration > Blocked Service
Further configuration details can be found in the How-to CE Site deployment guides based on Site type.
Control network access
F5 recommends that you limit the exposure of administrative IP addresses and ports for CE nodes to only trusted IP addresses or IP ranges. Doing so will control access to the following CE node administrative services:
- Configuration utility
- SSH/CE CLI
- Any associated virtual Kubernetes (K8s) workloads
You must restrict management access for each CE node configuration utility and SSH/CLI to known or trusted hosts and clients. Use organizational or network-based deployment security controls.
Monitor login attempts
F5 strongly recommends that you closely monitor login attempts to CE nodes. You can set up log streaming with security information and event management (SIEM) tools as noted in the following documentation for further auditing controls: Configure Log Streaming.
Maintain current CE software
F5 strongly recommends that you upgrade to the latest supported software versions. Use the Node Operating System and Software Changelogs to find CE software release information.
Additional information
For more information about securing and monitoring nodes, see the following: