F5: Difference between revisions

 

= Interfaces =

 

;LTM How BIG IP process Traffic

 

* Node - represent the Ip address

* Check the status of nodes and pool members, if any pool member response time is not good or is not responding Big IP will not send the request to that node.

 

 

* Address check - BIG IP send ICMP request and wait for reply if there is no reply it considers nei down does not send the traffic further to that node.

* Service check - will check TCP port number on which server is listening ,if no response it considers down ----

* Content check - we can check if the server is responding with right contest ,like for http request get/http .... request is send .

 

 

 

to avoid this we use prescience profile so that return request for the client is send to same server.

 

 

* SSL termination

* All virtual servers have layer four profile includes TCP, UDP, Fast, l4

 

 

== Persistence Types ==

 

 

 

 

* Three modes : (insert ,rewrite ,passive ) mode.

 

 

== SSL Profile ==

= Deploy F5 in KVM =

 

 

* Download the Image from F5 Portal:

<pre>

virt-install --name ubuntu-trusty --ram 256 --disk path=/var/kvm/images/trusty.img,size=3 --vcpus 1 --os-type linux --os-variant ubuntutrusty --graphics none --console pty,target_type=serial --location 'http://fr.archive.ubuntu.com/ubuntu/dists/trusty/main/installer-amd64/' --extra-args 'console=ttyS0,115200n8 serial'

 

sudo virt-install --name bigip\

--os-variant=rhel6 \

--import --autostart --noautoconsole

 

sudo virsh shutdown bigip

sudo virsh destroy bigip

sudo virsh undefine --domain bigip

 

sudo virsh list --all

 

sudo virsh net-dhcp-leases default

 

10.170.131.132

192.168.122.109

 

sudo virsh console bigip

tmsh show sys management-ip --> notworking

tmsh show running-config

 

nano /etc/libvirt/hooks/qemu

 

#!/bin/bash

# avoid duplicate as this hook get called for each VM

[ $v -le 2 ] && /sbin/iptables -I FORWARD 1 -o virbr0 -m state -s 10.170.131.0/24 -d 192.168.122.109/32 --state NEW,RELATED,ESTABLISHED -j ACCEPT

 

chmod -v +x /etc/libvirt/hooks/qemu

-A PREROUTING -d 10.170.131.132 -p tcp --dport 443 -j DNAT --to-destination 192.168.122.109:443 -m comment --comment "Port443 for BigIP"

COMMIT

 

sudo iptables -t nat -I PREROUTING -p tcp -d 10.170.131.132 --dport 8443 -j DNAT --to-destination 192.168.122.109:8443

sudo iptables -I FORWARD -m state -d 192.168.122.0/24 --state NEW,RELATED,ESTABLISHED -j ACCEPT

sudo service netfilter-persistent save

 

curl -sk -u root:kIr@t#29 -H "Content-Type: application/json" -X GET https://192.168.122.109/mgmt/tm/sys/management-ip | jq -M .

 

192.168.122.145

root/kIr@t#29

 

 

tmsh

modify /security firewall management-ip-rules rules add { example_mgmt_rule { action accept destination { addresses add { 192.168.122.109 } ports add { 443 } } ip-protocol tcp log yes place-before first source { addresses add { 10.170.131.1-10.170.131.254 } ports none } status enabled uuid auto-generate } }

save /sys config

 

=== Install CentOS ===

virt-customize -a CentOS-7-x86_64-GenericCloud-2111.qcow2 --root-password password:DDYrTXJZTJldOqimb68ZK5KCmRpbdBOe

Now able to login to new guest as root / DDYrTXJZTJldOqimb68ZK5KCmRpbdBOe

 

sudo virt-install \

--os-variant=rhel6 \

--import --autostart --noautoconsole

 

sudo iptables -t nat -I PREROUTING -p tcp -d 10.170.131.132 --dport 443 -j DNAT --to-destination 192.168.122.110:443

sudo iptables -I FORWARD -m state -d 192.168.122.0/24 --state NEW,RELATED,ESTABLISHED -j ACCEPT

</pre>