F5 ML-KEM Lab on AWS

Review the purchase details and click Subscribe. This is a usage-based agreement - you are only charged while instances are running, billed hourly at the combined EC2 + software rate.

The subscription activates in up to 3 minutes - do not close the page:

Once confirmed, click Launch your software:

• Version - change to 17.5.1. The page defaults to the latest stable release (21.x at time of writing) but this lab is verified on 17.5.1 which introduced ML-KEM support.
• Region - select your preferred region.
• Launch method - select Launch from EC2 for full control over instance type, networking, and security groups.

TCP 22     -  SSH (initial access)         source: My IP
TCP 443    -  VIP with ML-KEM              source: My IP
TCP 8443   -  BIG-IP management UI        source: My IP
TCP 9443   -  VIP without ML-KEM          source: My IP

A success banner confirms the launch. Click the instance ID link to go directly to it in EC2 Instances:

The instance takes 3–5 minutes to pass both EC2 status checks and complete BIG-IP's internal initialisation. Wait until both checks show passed before proceeding.

ssh -i F5.pem admin@<PUBLIC-IP>

The first connection will ask you to confirm the host fingerprint - type yes. You land directly at the tmsh prompt:

Change the password and save:

modify auth user admin password <NEW-PASSWORD>
save sys config

# Linux / WSL (Ubuntu)
chmod 400 F5.pem

# Windows PowerShell (native SSH)
icacls F5.pem /inheritance:r /grant:r "$($env:USERNAME):(R)"

show sys version

create ltm pool lab-pool { members add { 192.0.2.1:443 { address 192.0.2.1 } } }

show sys version

Confirm Version 17.1.3.1 before proceeding.

create ltm cipher rule ml-kem-rule { cipher DEFAULT dh-groups "X25519MLKEM768:DEFAULT" signature-algorithms DEFAULT }

tmsh rejects it immediately - no object is created:

01071d2a:3: Cipher rule (/Common/ml-kem-rule): 'X25519MLKEM768' is not a valid DH Groups.

create ltm cipher rule classical-rule { cipher DEFAULT dh-groups DEFAULT signature-algorithms DEFAULT }
create ltm cipher group classical-group { allow add { classical-rule } }

Verify:

list ltm cipher rule classical-rule
list ltm cipher group classical-group

Expected output:

ltm cipher rule classical-rule {
    cipher DEFAULT
    dh-groups DEFAULT
    signature-algorithms DEFAULT
}
ltm cipher group classical-group {
    allow {
        classical-rule { }
    }
}

create ltm profile client-ssl lab-ssl-classical { defaults-from clientssl options { dont-insert-empty-fragments no-dtlsv1.2 } cipher-group classical-group ciphers none }

Verify:

list ltm profile client-ssl lab-ssl-classical

Expected output (key fields):

ltm profile client-ssl lab-ssl-classical {
    cipher-group classical-group
    ciphers none
    defaults-from clientssl
    options { dont-insert-empty-fragments no-dtlsv1.2 }
}

create ltm virtual lab-vip-classical { destination 0.0.0.0:9443 ip-protocol tcp pool lab-pool profiles add { lab-ssl-classical { context clientside } tcp { } } source-address-translation { type automap } vlans-disabled }

Verify:

show ltm virtual lab-vip-classical

Look for State: enabled and Destination: any:9443. Traffic counters will be zero until you run the first test.

save sys config

create ltm cipher rule ml-kem-rule { cipher DEFAULT dh-groups "X25519MLKEM768:DEFAULT" signature-algorithms DEFAULT }
create ltm cipher group ml-kem-group { allow add { ml-kem-rule } }

Verify:

list ltm cipher rule ml-kem-rule
list ltm cipher group ml-kem-group

Expected output:

ltm cipher rule ml-kem-rule {
    cipher DEFAULT
    dh-groups "X25519MLKEM768:DEFAULT"
    signature-algorithms DEFAULT
}
ltm cipher group ml-kem-group {
    allow {
        ml-kem-rule { }
    }
}

create ltm profile client-ssl lab-ssl-mlkem { defaults-from clientssl options { dont-insert-empty-fragments no-dtlsv1.2 } cipher-group ml-kem-group ciphers none }

Verify:

list ltm profile client-ssl lab-ssl-mlkem

Expected output (key fields):

ltm profile client-ssl lab-ssl-mlkem {
    cipher-group ml-kem-group
    ciphers none
    defaults-from clientssl
    options { dont-insert-empty-fragments no-dtlsv1.2 }
}

create ltm virtual lab-vip-mlkem { destination 0.0.0.0:443 ip-protocol tcp pool lab-pool profiles add { lab-ssl-mlkem { context clientside } tcp { } } source-address-translation { type automap } vlans-disabled }

Verify:

show ltm virtual lab-vip-mlkem

Look for State: enabled and Destination: any:443.

save sys config