Getting started

Deploy with a group sync feature

Before you deploy with a Config Sync Group, you need to create one in the NGINX One Console.
If you haven’t created a group yet, see Manage Config Sync Groups for instructions.

1. In the NGINX One Console, go to Manage > Config Sync Groups, then select your group.

2. Open the Configuration tab and select Edit Configuration.

3. Select Add File, then choose New Configuration File.

4. In the File name field, enter the exact path:

   • On Linux: /etc/nginx/license.jwt
   • On FreeBSD: /usr/local/etc/nginx/license.jwt

5. Paste the contents of your JWT license file into the editor.

6. Select Next to preview the changes, then choose Save and Publish to apply the update.

In NGINX Instance Manager, instance groups provide the same sync functionality as Config Sync Groups in the NGINX One Console.
See Manage instance groups for setup instructions.

Deploy manually

Copy the JWT license file to each NGINX Plus instance.

1. Copy the license file to:

   • /etc/nginx/license.jwt on Linux
   • /usr/local/etc/nginx/license.jwt on FreeBSD

2. Reload NGINX:

   Copy

   systemctl reload nginx

3. If SELinux is enabled, set the correct file context so NGINX can read the license:

   Copy

   chcon -t httpd_config_t /etc/nginx/license.jwt

Custom paths

If you’re upgrading from NGINX Plus R32 or earlier to R33 or later and plan to use a custom path for the license file, note that the custom path isn’t recognized until after the upgrade. You must first create a placeholder file at /etc/nginx/license.jwt (or /usr/local/etc/nginx/license.jwt on FreeBSD).

1. Before upgrading: Create the placeholder file:

   Copy

   touch /etc/nginx/license.jwt

2. After upgrading: Update the license_token directive in the mgmt block of the configuration to point to your custom path:

   nginx

   Copy

   mgmt {
     license_token <custom_path>;
   }

Internet-connected environments

In connected environments, NGINX Plus sends usage reports directly to the F5 licensing endpoint.

Allow the necessary outbound traffic so reports can reach F5.

1. Allow NGINX Plus instances to connect to the F5 licensing endpoint (product.connect.nginx.com) over HTTPS (TCP 443). Make sure the following IP addresses are allowed:

   • 3.135.72.139
   • 3.133.232.50
   • 52.14.85.249

2. (R34 and later) If your company restricts outbound traffic, configure NGINX Plus instances to connect through an outbound proxy. Update the proxy directive in the mgmt block of (/etc/nginx/nginx.conf) to point to your proxy server:

   nginx

   Copy

   mgmt {
       proxy          PROXY_ADDR:PORT; # can be http or https
       proxy_username USER;            # optional
       proxy_password PASS;            # optional
   }

Network-restricted environments

In environments without internet access, NGINX Plus sends usage reports to NGINX Instance Manager. NGINX Instance Manager collects the reports and later forwards them to F5.

To configure NGINX Plus to send usage reports to NGINX Instance Manager:

1. Allow NGINX Plus instances to connect to NGINX Instance Manager over HTTPS (TCP 443).

2. On each NGINX Plus instance, set the usage_report directive in the mgmt block of /etc/nginx/nginx.conf to point to your NGINX Instance Manager host:

   nginx

   Copy

   mgmt {
    usage_report endpoint=<NGINX-INSTANCE-MANAGER-FQDN>;
   }

3. Reload NGINX:

   Copy

   systemctl reload nginx

If you’re using self-signed certificates with NGINX Instance Manager,
see Configure SSL verification for self-signed certificates for additional steps.

For instructions on forwarding usage reports from NGINX Instance Manager to F5, see Report usage data to F5 (disconnected).

Automatic update (R35 and later)

Starting in NGINX Plus R35, JWT licenses are updated automatically for instances that report directly to the F5 licensing endpoint. NGINX Plus downloads the new license and applies it without requiring a reload or restart.

Here’s how the automatic update works:

• Beginning 30 days before the current license expires, NGINX Plus notifies the licensing endpoint as part of usage reporting.
• The licensing endpoint checks for a renewed subscription with F5.
• After the subscription is renewed, the licensing endpoint sends the updated JWT license to the instance.
• NGINX Plus applies the updated license automatically and stores it as nginx-mgmt-license in the state_path directory.
• The original JWT license file at /etc/nginx/license.jwt (or a custom path set by license_token) is not modified. You can replace the original file manually if needed, but this does not affect NGINX Plus operation.
• This process also applies if the license has already expired but is still within the 90-day grace period.
• Traffic continues without interruption.

Important

Automatic updates only work if:

• License reporting is configured, and
• At least one usage report has already been sent successfully.

If these conditions aren’t met, you must update the JWT license manually.

Manual update (all releases)

If automatic updates are not available (for example, in disconnected environments), update the license manually:

1. Download the new JWT license from MyF5.
2. Deploy the JWT license to your NGINX Plus instances.