Network Security Wiki

F5: Difference between revisions

Page Discussion

F5 (view source)

Revision as of 17:16, 1 May 2024

5,308 bytes added ,  18 days ago
→‎F5 Configuration
(46 intermediate revisions by the same user not shown)
Line 112:
 
= Deploy F5 in KVM =
 
* Topology
 
[client]-------------------------[ F5 ]------------------------[server]
192.168.45.121 192.168.45.21 | 192.168.68.15 192.168.68.108
|
192.168.122.217
|
|
{10.157.146.116}
Host
 
* Install [https://aman.awiki.org/wiki/Virtualization#KVM_Installation KVM]
 
* Download the Image from F5 Portal:
sudo mv BIGIP-16.1.3-0.0.12.qcow2 /var/lib/libvirt/images/
 
* Create 3 virtual bridge interfaces:
 
;virbr0 (Ignore if already existing)
 
vim virbr0.xml
 
Add bridge details to the file:
<syntaxhighlight lang=ini><network>
<name>virbr0</name>
<forward mode='nat'>
<nat>
<port start='1024' end='65535'/>
</nat>
</forward>
<bridge name='virbr0' stp='on' delay='0'/>
<ip address='192.168.30.1' netmask='255.255.255.0'>
<dhcp>
<range start='192.168.30.50' end='192.168.30.200'/>
</dhcp>
</ip>
</network>
</syntaxhighlight>
 
sudo virsh net-define virbr0.xml
sudo virsh net-start virbr0
sudo virsh net-autostart virbr0
sudo virsh net-list --all
ip addr show dev virbr0
 
;virbr1
 
vim virbr1.xml
 
Add bridge details to the file:
<syntaxhighlight lang=ini><network>
<name>virbr1</name>
<forward mode='nat'>
<nat>
<port start='1024' end='65535'/>
</nat>
</forward>
<bridge name='virbr1' stp='on' delay='0'/>
<ip address='192.168.45.1' netmask='255.255.255.0'>
<dhcp>
<range start='192.168.45.50' end='192.168.45.200'/>
</dhcp>
</ip>
</network>
</syntaxhighlight>
 
sudo virsh net-define virbr1.xml
sudo virsh net-start virbr1
sudo virsh net-autostart virbr1
sudo virsh net-list --all
ip addr show dev virbr1
 
;virbr2
 
vim virbr2.xml
 
Add bridge details to the file:
<syntaxhighlight lang=ini><network>
<name>virbr2</name>
<forward mode='nat'>
<nat>
<port start='1024' end='65535'/>
</nat>
</forward>
<bridge name='virbr2' stp='on' delay='0'/>
<ip address='192.168.68.1' netmask='255.255.255.0'>
<dhcp>
<range start='192.168.68.50' end='192.168.68.200'/>
</dhcp>
</ip>
</network>
</syntaxhighlight>
 
sudo virsh net-define virbr2.xml
sudo virsh net-start virbr2
sudo virsh net-autostart virbr2
sudo virsh net-list --all
ip addr show dev virbr2
 
 
 
* Install F5 VM:
sudo virt-install \
--name=F5-BIGIPbigip \
--description="BIG-IP Local Traffic Manager (LTM) Virtual Edition (VE)" \
--disk path=/var/lib/libvirt/images/BIGIP-16.1.4.3-0.0.123.qcow2,bus=virtio,format=qcow2 \
--disk path=/var/lib/libvirt/images/BIGIP-16.1.4.3-0.0.123.DATASTOR.ALL.qcow2,size=8,bus=virtio,format=qcow2 \
--network=bridge=virbr0,model=virtio \
--network=bridge=virbr0,model=virtio \
--network=bridge=virbr0,model=virtio \
--network=bridge=virbr1,model=virtio \
--network=bridge=virbr2,model=virtio \
--graphics vnc,password=admin123,listen=0.0.0.0,port=5902 \
--console pty,target_type=serial \
--vcpus=2 --cpu host --ram=8096 \
--os-type=linux --os-variant=rhel6.0 \
--import --autostart --noautoconsole
 
Line 140 ⟶ 238:
 
* Obtaining Console access:
sudo virsh console <vm-name>bigip
 
* Default F5CLI Credentials:
root / default
 
* Set WebUI Credentials using below command:
passwd admin
 
* Iptables enable Web UI access using NAT from Host VM:
sudo iptables -t nat -I PREROUTING -p tcp -d 10.170157.131146.132116 --dport 8443 -j DNAT --to-destination 192.168.122.109217:443
sudo iptables -I FORWARD -m state -d 192.168.122.0/24 --state NEW,RELATED,ESTABLISHED -j ACCEPT
 
* The above rules might not survive reboot of host, hardcoding them:
sudo yum install iptables-services
sudo systemctl start iptables
sudo systemctl enable iptables
sudo service iptables save
 
* Apply License
Line 153 ⟶ 260:
 
* Save Config
tmsh save /sys config
 
 
* Increase bash Columns
Line 191 ⟶ 297:
 
stty -F /dev/ttyS0 rows 100
stty -F /dev/ttyS0 cols 1000100
 
 
 
== Prepare the Ubuntu Minimal Image ==
=== Install CentOS ===
 
* Download Image file:
virt-builder --list
wget https://cloud.centos.org/centos/7/images/CentOS-7-x86_64-GenericCloud.qcow2
virt-builder centos-7.5 --format qcow2 --size 20G -o centos75-client.qcow2 --root-password password # no root password set
sudo mv centos75-client.qcow2 /var/lib/libvirt/images/
sudo cp /var/lib/libvirt/images/centos75-client.qcow2 /var/lib/libvirt/images/centos75-server.qcow2
 
=== Install Client ===
* Customize root password:
virt-customize -a CentOS-7-x86_64-GenericCloud-2111.qcow2 --root-password password:DDYrTXJZTJldOqimb68ZK5KCmRpbdBOe
 
* Start VM:
Now able to login to new guest as root / DDYrTXJZTJldOqimb68ZK5KCmRpbdBOe
<syntaxhighlight lang="bash">
sudo virt-install \
--name=client \
--description="Ubuntu Minimal Client" \
--disk path=/var/lib/libvirt/images/centos75-client.qcow2,bus=virtio,format=qcow2 \
--network=bridge=virbr1,model=virtio \
--graphics none \
--console pty,target_type=serial \
--vcpus=1 --cpu host --ram=1024 \
--os-type=linux \
--os-variant=rhel6.0 \
--import --autostart --noautoconsole
</syntaxhighlight>
 
* Obtaining Console access:
sudo virsh console client
 
* Basic config:
sudo vi /etc/hostname # change hostname
 
sudo yum install httpd
sudo systemctl enable httpd
sudo systemctl start httpd
sudo systemctl status httpd
 
sudo iptables -F
 
=== Install WebServer ===
 
* Start VM:
<syntaxhighlight lang="bash">
sudo virt-install \
--name=CentOSserver \
--description="CentOS WebServer" \
--disk path=/var/lib/libvirt/images/CentOScentos75-7-x86_64-GenericCloudserver.qcow2,bus=virtio,format=qcow2 \
--network=bridge=virbr0virbr2,model=virtio \
--graphics none \
--console pty,target_type=serial \
--vcpus=1 --cpu host --ram=20481024 \
--os-type=linux \
--os-variant=rhel6.0 \
--import --autostart --noautoconsole
</syntaxhighlight>
 
* Obtaining Console access:
sudo virsh console server
sudo iptables -F
 
== F5 Configuration ==
 
=== Create VLAN ===
 
<pre>
net vlan myVlan {
fwd-mode l3
if-index 128
interfaces {
1.2 { }
}
sflow {
poll-interval-global no
sampling-rate-global no
}
tag 4094
}
</pre>
 
=== Create SelfIP ===
<pre>
net self SelfIpforPool {
address 192.168.68.15/24
traffic-group traffic-group-local-only
vlan myVlan
}
</pre>
 
=== Create Pool ===
<pre>
ltm pool myPool {
members {
server1:http {
address 192.168.68.108
logging enabled
session monitor-enabled
state up
}
}
monitor http
}
 
</pre>
=== Create VS ===
<pre>
ltm snat-translation 192.168.68.7 {
address 192.168.68.7
inherited-traffic-group true
traffic-group traffic-group-1
}
ltm snatpool mySNatIP {
members {
192.168.68.7
}
}
</pre>
 
<pre>
ltm virtual myVS {
creation-time 2024-04-30:09:50:10
destination 192.168.45.21:http
ip-protocol tcp
last-modified-time 2024-05-01:02:29:35
mask 255.255.255.255
pool myPool
profiles {
tcp { }
}
serverssl-use-sni disabled
source 0.0.0.0/0
source-address-translation {
pool mySNatIP
type snat
}
translate-address enabled
translate-port enabled
vlans {
ExternalVlan
}
vlans-enabled
vs-index 2
}
</pre>
 
=== Enable Internet Access on VMs ===
 
; On VMs:
 
* Add Interface for the common network on host to the VMs:
sudo virsh attach-interface --type bridge --source virbr0 --model virtio client
 
; On Host:
sudo sysctl -w net.ipv4.ip_forward=1
sudo iptables --table nat --append POSTROUTING --out-interface ens192 -j MASQUERADE # ens192 is default exit interface in Host
sudo iptables --insert FORWARD --in-interface virbr0 -j ACCEPT # virbr0 is newly added interface in VM
 
 
 
Retrieved from "https://aman.awiki.org/wiki/Special:MobileDiff/4732...4857"