F5

From Network Security Wiki


Configuration

Interfaces
  • Control Plane
eth0 - Mgmt
Syslog traffic uses this interface
  • Data Plane
tmm interfaces - usually trunk
HSL - High Speed Logging uses this interface

- Self IP -> Monitoring Traffic
- Float IP -> Application traffic
           -> Only active on Active Unit
           -> Pcaps filter with this IP else it will have Monitoring traffic as well.
Change Hostname
tmsh
modify /sys global-settings hostname bigip1.example.net
save /sys config

F5 Training

LTM How BIG IP process Traffic
  • Node - represent the Ip address
  • Pool member - combination of Ip address and port number, in other words pool member is application server on which F5 will redirect the traffic Pool-combination of pool member.
  • Virtual server - combination of virtual IP and port, is also known as listener and we associate virtual server to pool members.

Loadbalancing Methods

  • Static - Round robin, Ratio
  • Dynamic -LFOPD -> Least connection, Fastest, Observed, Predictive, Dynamic ratio
Details
  • Least connection - Load balancing is based on no of connection counts, if the connection counts are equal it will use round robin.
  • Fastest - No of layer 7 request pending on each member.
  • Observed - ration load balancing method but ratio assigned by BIG IP, No off least connections counts BIG IP assign the request and check dynamically and assign the ratio's of the request.
  • Predictive - similar to observed but assigns the ratio aggressively based on average connection counts .
Load balancing by pool member or node
  • Priority activation -helps to configure back sets for existing pool members .BIG IP will use high priority pool member first .
  • Fallback host is only used for HTTP request ,if all the pool members are not available BIG will redirect the client request

Monitors

  • Check the status of nodes and pool members, if any pool member response time is not good or is not responding Big IP will not send the request to that node.
Monitor type
  • Address check - BIG IP send ICMP request and wait for reply if there is no reply it considers nei down does not send the traffic further to that node.
  • Service check - will check TCP port number on which server is listening ,if no response it considers down ----
  • Content check - we can check if the server is responding with right contest ,like for http request get/http .... request is send .
  • Interactive check - TEST for FTP connection .once connection is open username and password is send then request is send get /file once file is received connection is closed .
  • F5 recommends time out = 3n+1 (frequency) for setting the monitor for http
  • Customization of monitor
  • Assign nodes to monitor


Profiles

  • Defining traffic behavior for virtual server.
  • Profiles contains setting how to process traffic though virtual servers. If for certain application BIG IP load balance the traffic then it will break the client connection

to avoid this we use prescience profile so that return request for the client is send to same server.

  • Persistence profile - is configured for clients and group of clients how BIG IP knows the returning client request need to send to same server, persistence profile is configured taking source IP address of http cookie.
  • SSL termination
  • FTP profile
  • All virtual servers have layer four profile includes TCP, UDP, Fast, l4
  • Profile types - service profile, persistence profile, protocol profile, SSL profile, authentication profile, other profiles.

Persistence Types

  • Source address persistence: keeps the track of source IP address, administrator can set the net mask in persistence record so that all clients in same mask will assigned to same pool member.
  • Limitation - if the client address being NAt'ed.
  • Cookie persistence - only uses http protocol
  • Three modes : (insert ,rewrite ,passive ) mode.
Insert mode - BIG ip create special cookie in HTTP response to client .
rewrite - pool member created blanK cookie and big ip inserts special cookie 
passive - pool member created special cookie and BIG IP let it pass through

SSL Profile

  • SSL is secured socket layer .
  • Website which uses HTTPS we need to us SSL profile as traffic is being Nated for source clients and web app is using https protocol.
  • Using SSL termination BIG can decrypt the traffic and assigned to pool member.
  • BIG IP contains SSL encryption hardware so all the encruption and key exchange are done in hardware .centralized certifiacte management.


iRule

  • iRule is a script that direct traffic though BIG IP , based on TCL command language.
  • iRule give control of inbound and outbound traffic from Big IP.
  • iRule contains following events -> Irule name, events, condition, action

Deploy F5 in KVM

  • Install KVM KVM
  • Download the Image from F5 Portal:
sudo mv BIGIP-16.1.3-0.0.12.qcow2 /var/lib/libvirt/images/
  • Install F5 VM:
sudo virt-install \
--name=F5-BIGIP \
--description="BIG-IP Local Traffic Manager (LTM) Virtual Edition (VE)" \
--disk path=/var/lib/libvirt/images/BIGIP-16.1.3-0.0.12.qcow2,bus=virtio,format=qcow2 \
--disk path=/var/lib/libvirt/images/BIGIP-16.1.3-0.0.12.DATASTOR.ALL.qcow2,size=8,bus=virtio,format=qcow2 \
--network=bridge=virbr0,model=virtio \
--network=bridge=virbr0,model=virtio \
--network=bridge=virbr0,model=virtio \
--graphics vnc,password=admin123,listen=0.0.0.0,port=5902 \
--console pty,target_type=serial \
--vcpus=2 --cpu host --ram=8096 \
--os-type=linux --os-variant=rhel6 \
--import --autostart --noautoconsole
  • VM Operations and information:
sudo virsh shutdown bigip
sudo virsh destroy bigip
sudo virsh undefine --domain bigip

sudo virsh list --all
sudo virsh net-dhcp-leases default
  • Obtaining Console access:
sudo virsh console <vm-name>
  • Default CLI Credentials:
root / default
  • Set WebUI Credentials using below command:
passwd admin
  • Iptables enable Web UI access using NAT from Host VM:
sudo iptables -t nat -I PREROUTING -p tcp -d 10.170.131.132 --dport 8443 -j DNAT --to-destination 192.168.122.109:443
sudo iptables -I FORWARD -m state -d 192.168.122.0/24 --state NEW,RELATED,ESTABLISHED -j ACCEPT
  • The above rules might not survive reboot of host, hardcoding them:
        This section is under construction.
  • Apply License
tmsh install /sys license registration-key <KEY>
  • Save Config
tmsh save /sys config


  • Increase bash Columns
vi /root/.bashrc

#!/bin/bash -i
# .bashrc

# User specific aliases and functions

alias rm='rm -i'
alias cp='cp -i'
alias mv='mv -i'

# Source global definitions
if [ -f /etc/bashrc ]; then
        . /etc/bashrc
fi
resize() {

  old=$(stty -g)
  stty raw -echo min 0 time 5

  printf '\033[18t' > /dev/tty
  IFS=';t' read -r _ rows cols _ < /dev/tty
  stty "$old"
  stty cols $cols
  stty rows $rows
  export COLUMNS=$cols
  export LINES=$rows
}
[[ $(tty) = '/dev/ttyS0' ]] && stty cols 1000



stty -F /dev/ttyS0 rows 100
stty -F /dev/ttyS0 cols 100


Install CentOS

  • Download Image file:
wget https://cloud.centos.org/centos/7/images/CentOS-7-x86_64-GenericCloud.qcow2
  • Customize root password:
virt-customize -a CentOS-7-x86_64-GenericCloud-2111.qcow2 --root-password password:admin@123

Now able to login to new guest as root / admin@123

  • Start VM:
sudo virt-install \
--name=CentOS \
--description="CentOS WebServer" \
--disk path=/var/lib/libvirt/images/CentOS-7-x86_64-GenericCloud.qcow2,bus=virtio,format=qcow2 \
--network=bridge=virbr0,model=virtio \
--graphics none \
--console pty,target_type=serial \
--vcpus=1 --cpu host --ram=2048 \
--os-type=linux \
--os-variant=rhel6 \
--import --autostart --noautoconsole



References





{{#widget:DISQUS |id=networkm |uniqid=F5 |url=https://aman.awiki.org/wiki/F5 }}

Retrieved from "https://aman.awiki.org/wiki/F5?oldid=4808"