Skip to main content
An agent with this tool answers a load balancer ticket from the client’s LoadMaster: which virtual service it is about, which real servers behind it are up, how busy the appliance is, and when its licence ends. It also takes a real server out of service for maintenance and puts it back.
Automatically enabled when you configure Kemp LoadMaster permissions in your agent workflow. No manual toggle needed.

​
What It Does

  • List virtual services, SubVSs and real servers with their status, and the up, down and disabled totals
  • Read statistics per virtual service, and the appliance’s CPU, memory, disk, network, RAID and HA state
  • Read the licence type, its end date and the support end date
  • Disable a real server on one virtual service or on all of them, so its sessions drain, and enable it again after the work
  • Enable or disable a virtual service
  • Ping or traceroute a real server from the LoadMaster, and read top and memory
  • Change virtual services, real servers, rules, health checks, limits, certificates, WAF, GEO, network, HA, users and system settings, with the access and approvals you choose
The agent calls the LoadMaster through the Vendor API tool, with kemp_loadmaster as the vendor id. Sandbox scripts can call it too, under the same permissions. Each client’s LoadMaster is its own connection (see Kemp LoadMaster).

​
Permission Groups

Every group can be Disabled, Read Only or Read/Write. Neo never sends these commands: addapikey, listapikeys and delapikey (API keys stay out of the agent’s context), set_initial_passwd, usersetsyspassword and accepteula (first start), setadminaccess (it moves the address Neo calls), backup, restore, backupcert and restorecert (whole configurations and private keys), userreadcert and userdownloadcert (a private key), and logging.savelogs, logging.saveextlogs, logging.savemlogcdata and tcpdump (binary archives). Neo also never changes the API switch, the API or web interface port and interface, session management or basic authentication, because those carry Neo’s own connection. Neo removes passwords, secrets, pre-shared keys, session cookies and private keys from every answer.

​
Access Profiles

Every group Read Only. The agent reads, and never changes anything.
Enable and Disable Services and Edge Security and SSO are Read/Write with technician approval. Everything else is Read Only.
Every group Read/Write. Web Application Firewall, Edge Security and SSO, Network, Users and Remote Access, and System Administration require technician approval.
Every group Read/Write without approval, except the changes below, which still require technician approval.

​
Changes that always ask a technician

These require technician approval under every access profile, whatever the group’s own approval setting:
  • Deleting a virtual service, an FQDN or a GEO cluster, and turning GEO off.
  • A reboot or a shutdown, a firmware rollback, and adding or removing an add-on pack.
  • A licence change, and the commands that deactivate the licence.
  • Adding, changing or removing a local user or a remote user group, its permissions, password or certificate.
  • Adding, changing or removing an SSO domain, an LDAP endpoint, RSA SecurID settings or a SAML identity provider.
  • Removing a WAF rule set from a virtual service, disabling WAF rules, turning a virtual service’s WAF off, and turning the packet routing filter off.
  • Changing a remote access setting: web interface, SSH, session or RADIUS access, password rules and certificates for sign-in.
  • Any change that stores a credential, such as a password, a secret, a VPN pre-shared key or a certificate with its private key.