F5-Loadbalancer

Introduction

Set of application delivery product that work together to ensure high availability, improved performance, application security and access control.

 

 

Primary function are

1. Divert different types of traffic to appropriate destination
2. Fast and secure dns services
3. Protecting online business application
4. Intercept, inspect and / or transformer requests and / o r response
5. Applying security polices
6. Accelerating http connections
7. Optimizing connection across wide area network.
8. Verify the health of band end server

SSL acceleration

HW compression

One connect

EPVA (embedded packet velocity acceleration)

 

IOS used TMOS (Traffic Management Operating System)

 

Application deliver controller (ADCs)

• Big-IP appliance
• VIPRION Chassis / blade
• BIG-IP virtual edition ( cloud)

 

 

Big IP F5 interface and vlan ?

• Bundle of interface – vlan trunk

• Tagged and untagged: logic similar to HP procurve switch
• Vlan group :

• Internal and external interface are bound to vlan group – which will have self ip. Vlan group handle bridging group
• Self ip – ip address which is bind to vlan or vlan group. For HA we have floating IP
  • Self IP  = Static IP  (interface IP) or  floating IP  ( not bound to interface/ pool IP / used for natting)
    • MUST HAVE STATIC IP
    • MAY HAVE FLOATING IP
  • Node     = IP address of server
  • Pool member = server ip  + port
    • Server pool, gateway pool, clone pool ( clone traffic)  ~ span port

• Virtual server
  • Define virtual server to pass traffic to F5

 

 

 

 

Big IP administration:

1. Big IP is default deny system, configure listener to permit certain traffic
   1. port lock down exception, port allowed by default
      1. UDP 53 (DNS)  161 (SNMP) 520 (RIP)
      2. TCP 22 (SSH) 53 (DNS) 161 (SNMP traps) 443 (SSL Web)  4303 (iQuery language)

 

1. Traffic policy  type
   1. traffic group local : static ip (non fialover ) 
   2. traffic group-1 (default) : regular rule for floating IP (failover ip)
1. Full proxy architecture
2. It acts like end-point and originator of protocol.
   1. Connection between client and big ip is independent of server and big ip
   2. It has its own tcp connection behavior such as buffering, retransmit and tcp option.
   3. It optimizes every connection uniquely irrespective of destination or originator
   4. Actively participate in application it delivers
   5. It act like centralized device offloading time consuming and resource intensive function from application server e.g.  ssl encryption, compression, encryption and caching.
   6. System can be configured to inspect, accept, reject or modify packet based on known attack signature.

 

The big-IP system

            |

            |

           V

 Two function area

1: TMOS : application deliver system

• Real time os
• High performance hardware
• Ssl compression

 

2: Linux : administration  ( GUI / TMSH* / CLI )    * TMOS Shell

 

Set of independent module run on TMOS

LTM, GTM, AAM, AFM, APM, ASM, CGNAT, PEM

 

BIG-IP software Modules:

 

BIG-IP Local Traffic Manager (LTM) – Core module
the purpose of the Local Traffic Manager is to load balance applications in your environment by using advanced TCP connection management, TCP optimization and server offloading and also provides a high security solution. The LTMs iApps functionality is a powerful set of features that enable you to manage application services rather than individual devices and objects.

 

BIG-IP Access Policy Manager (APM) – Single sign on

The purpose of the Access Policy Manager is to create a secure access to internal applications by using a single authentication and provide control using a single management interface.

 

 

BIG-IP Application Security Manager (ASM) – Standalone module
The purpose of the Application Security Manager is to secure web applications using a certified web application firewall and offer threat assessment and visibility.

 

BIG-IP Global Traffic Manager (GTM)  - for DNS to protect DDos
The purpose of the Global Traffic Manager is to ensure availability and access to the applications in your environment by using comprehensive health checks and load balancing methods to determine what site the user should access to get the best application experience.

 

BIG-IP Application Acceleration Manager (AAM)
The purpose of the Application Acceleration Manager is to overcome WAN latency, maximizes server capacity, and speeds application response times. AAM decreases the need for additional bandwidth and hardware so users get fast access to applications, while you gain greater revenue and free up IT resources.

 

BIG-IP Advanced Firewall Manager (AFM)
The purpose of the Application Delivery Firewall is to combine the network firewall with anti-DDoS, traffic management, application security, user access management, and DNS security. By integrating these core datacenter features, F5 application delivery firewall reduces management complexity and overhead and is ideal for protecting internet-facing data centers wherever they reside.

 

 

Setting up the big ip system

 

 

 

Step to configure.

1. Configure MGMT Port
• Methods CLI / MGMT port / LCD panel, default management ip is  192.168.1.245 /24
2. License
3. Registration key – 27 characters
• Appliance comes with base registration key, use it to generate Dossier, send Dossier to license server (online / offline) and get license.
• BIG IP    ßà Dossier  (file)            
• License  ßà License server
• License status
• Licensed module
• Unlicensed modules
• Limite
4. Provision
• Allocating CPU, memory and disk space to module is called Provisioning
• Provisioning Levels
• Nominal (recommended) : Allocate additional resource as needed
• Minimum  : no additional resources
• Dedicated : take everything  (preferred if using one module only
5. Install Device certificate
6. Configure platform.
7. Configure Network & HA

• Ihealth  ßà QKView file