6. Lights Out Management
-Two operating systems
-TMM for primary use
-AOM/SCCP for lights
Out management
-Always on Mansgment
-Switch card control processing
15. File System
Built on top Linux
Has Linux files structure
Files are relevant to the operation
Main file in BIG-IP LTM are mentioned below:
-/coinfig/bigip.conf
-/config/bigip_base.conf
-/config/BigDB.dat
-/etc/hosts.allow
-/config/bigip.license
-/var/log/ltm
16. /coinfig/bigip.conf
- Holds all information relevant to the load
balancing
Like: virtual, pool, profile, monitor, irules etc
-Shared between 2 units if in a pair configuration
/config/bigip_base.conf
-Holds all information relevant to the basic
elements of the BigIP
Like: management IP, vlans, routes few more things
/etc/hosts.allow
-hosts which are allowed to use the local INET
services.
Such as services are SSH, snmp for the snmp devices
17. /config/BigDB.dat
-bigdb database holds a set of bigdb configuration
keys
-Keys define the behaviours of various aspects of the
BIG-IP system
-For example, the bigdb key Failover.Active Mode, when
set to enable, causes a redundant system to operate
in active-active mode, instead of the default
active/standby mode.
-We can edit these values by using
-The Configuration utility
-The bigpipe db command
#bigpipe db all list
18. /config/bigip.license
-Holds all information about the license of the
BigIP system
-Without this file or a valid license file, the BigIP
will not operate
There are few more vital files
/config/ssl/ssl.crt
/config/ssl/ssl.key
25. Virtual Server
-Big-IP is default deny device, so listener (virtual) is must
-Virtual server gules everything together
-Typically virtual are associated with pool
26. -Before virtual server can load balance it should mapped to pool
-Big-IP translate the destination ip address from virtual server to
actual server
-Client see the pool servers as single server, hence the term Virtual
Server
28. Full Proxy Architecture
-Big-IP do much more than translating the network Address
-F5 implemented full proxy architecture in Big-IP
-Separate tcp connections for the client & the server
30. Load Balancing Methods
-Static method do not take server performance in to consideration
-Dynamic method does consider server performance
31. Round Robin
-Round Robin is default & most commonly used method
-Big-IP evenly distributes client request across all available pool
member
32. Ratio
-Ratio method is appropriate to use if some of the members are
powerful than other.
-Since Ratio is static method, this means that server with highest
ratio value will receive more request then others even if the
performance of the server is slow.
#b pool lab_Pool { lb method member/node ratio }
33. Least Connections
-This method consider the current connections count to decide
where to send next request
#b pool lab_Pool { lb method least conn }
35. Fastest
-Fastest uses the outstanding layer 7 request to decide where to
send the next request
-Request or Response ?
#b pool lab_Pool { lb method fastest }
36. Fastest
-Ping response form server doesn’t take into account how fast
server will response at port 80.
-SYN-ACK response form server at port 80 doesn’t take into
account how fast backend database server will populate the
content of web page
37. Observed
-It is basically Ratio load balancing but with Ratio assigned by Big-
IP
-Servers with connections lower than average will given ratio of 3
-Servers with connections higher than average will given ratio of 2
#b pool lab_Pool { lb method member observed }
41. Pool Member vs. Node
Load Balancing by:
>Node
-Total service for one IP Address
-Take all transactions for the IP address into account
#b node <ip_addr> { ratio <no.>/ session <enable/disable>}
>Pool Member
-IP Address & Service
-Take the decision based transactions happening on
the service port.
42. Priority Group Activation
-Use to designate preferred & backup sets of pool members with
in a pool
-Once priority group activated
-The available member with highest priority will consider first
43. Priority Group Activation
-If the number of member falls below the priority group
activation set,
-The next highest priority member also start serving
the requests.
44. Priority Group Activation
Configuration example
#b pool lab_pool '{
lb_method predictive
min_active_members 2
member 10.100.10.10:80 priority 10
member 10.100.10.20:80 priority 10
member 10.100.10.30:80 priority 10
member 10.100.10.30:80 priority 5
member 10.100.10.40:80 priority 5
member 10.100.10.50:80 priority 5 }’
45. Fallback Host
-Fallback host feature is designed for HTTP protocol only.
-It comes into play if all the members in a pool are unavailable
46. Configuring Load Balancing
bigpipe pool <pool_name> { lb method
<method_name> }
(rr | node ratio | member ratio | member least conn |
member observed | member predictive | fastest |
least conn | predictive | observed | dynamic ratio |
fastest app resp)
48. Intro to monitor
Big-IP system can monitor the health of nodes &
member
Monitor is the test that Big-IP performed
-simple test
-Highly interactive test
The result of these test will define the status of
respective node or member is available
Big-IP perform continues monitoring irrespective of
the status of node or member
49. Step to set-up a monitor
Step 1: Create
Step 2: Name & Type
-name the new monitor select the type from system
templates
Step 3: Customize
Step 4: Assign
- to pool/node/pool member
Step 5: Status
50. Types of monitoring
Address Check
-IP address –node
Service Check
-IP:port
Content Check
-IP:port & check data returned
Interactive Check
-Interactive with servers
-Multiple commands and multiple response
52. Example
System
#b monitor icmp list
monitorroot icmp {
interval 5
timeout 16
dest *
}
Custom
#b monitor icmp_mon list
monitor icmp_mon {
defaults from icmp
interval 7
timeout 22
}
53. Service Check
-Service checks only test whether server is listening to respective
port.
-Doesn’t provide any insight into quality of the content that might
return
54. Example
System
#b monitor tcp list
monitorroot tcp {
interval 5
timeout 16
dest *:*
recv ""
send ""
}
Custom
#b monitor tcp_port_mon
list
monitor tcp_port_mon {
defaults from tcp
interval 15
timeout 47
}
55. Content Check
-Content check go beyond testing whether a node is
responding/listening
-It also test if it is responding with correct content
56. Example
System:
#b monitor http list
monitorroot http {
interval 5
timeout 16
dest *:*
password ""
recv ""
send "GET /"
username ""
}
Custom:
#b monitor http_mon list
monitor http_mon {
defaults from http
recv "Health Check"
send "GET /health_check.html
HTTP/1.0nn"
}
58. Example
#b monitor ftp list
monitorroot ftp {
interval 10
timeout 31
dest *:*
debug ""
get ""
mode "passive"
password ""
username ""
}
59. Assigning Monitor to Nodes
#b node 192.168.230.172 ‘{ ratio 100
monitor testwmi_mon
}’
#b node 10.10.10.10 { monitor gateway_icmp and icmp }
60. Assign Monitor to Pool & member
Assigning Monitor to Pool
#b pool bluecoat_pool { monitor all tcp }
#b pool bsd01_pool { monitor all bsd_mon }
Assigning Monitor to Pool member
#b pool lab_Pool '{
member 10.101.23.55:80 monitor tcp
member 10.101.23.56:80 monitor http
}‘
67. Profile Concept
Contain settings that instruct how to pass the traffic
through virtual server
Why any one want to change default traffic processing
behavior of virtual server ?
Are profile overrides the load balancing property ?
How does profile help to improve the performance of
actual servers ?
75. Concept
What is the need of Persistence ?
Persistence profile is required to achieve to change
the load balancing behavior of virtual server
Upon the initial connection:
-Big-IP store session data in persistence record
Persistence Record store
-client characteristics
-Pool member information which is serving request
Big-IP use persistence record to serve the next
traffic
78. Cookie Persistence
Why cookie Persistence ?
Modes:
>Insert Mode
-LTM insert special cookie in HTTP response
-Pool name & Pool Member (encoded)
>Rewrite Mode
-Web server Creates a “blank” cookie
-LTM Rewrites to make Special Cookie
>Passive Mode
-Web server Creates Special Cookie
-LTM Passively lets it through
84. Review of SSL Concepts
Establish an encrypted link between a Web server &
browser by using SSL protocol
This encryption uses PKI
Encrypting & decrypting SSL is impact the server
performance
Packet processing time can increase 20 to 30 times
Use of SSL Accelerator Cards
85. Advantage of SSL Termination
Allow iRules processing and cookie persistence
Offload SSL traffic from web server
SSL key exchange and bulk encryption dane by
hardware
Centralize certificate management
90. Configuring Client SSL Profile
Configuring clientssl profile :
#b profile clientssl pan.com_ssl {
defaults from clientssl
key “www.pan.com.key"
cert “www.pan.com.crt"
chain “ca-intermediate.crt"
}
Associating the clientssl profile to virtual server
#b virtual pan.com_https { profile pan.com_ssl }
91. Configuring Server SSL Profile
Configuring Serverssl profile :
#b profile serverssl pan.com_ssl ‘{
defaults from serverssl"
Associating the clientssl profile to virtual server
#b virtual pan.com_https { profile pan.com_ssl }
92. Chapter 8
Nat & SNAT
NAT Concepts and Configuration
SNAT Concepts and Configuration
93. Nat Concepts
One to One mapping
Bi-directional traffic
Dedicated IP Address
Can’t Configure port
94. Configuring NAT
#b nat 172.16.20.1 to 207.10.1.101
#b nat 172.17.20.3 to 207.10.1.103
#b nat list
#b nat show
95. SNAT Concept
“Secure” NAT
Performs Source Nat
Many to one mapping
Traffic initiated to SNAT
Address refused
SNAT’s used for
Routing problem
96. SNAT Configuration
#b snat pan { origin any translation 4.2.2.2 }
# b snat pan ‘{ origin any translation 4.2.2.2 vlan
clau_vlan enable }’
#b snatpool pan_spool ‘{ member 3.2.2.2 member
3.2.2.3 }’
#b snat pan ‘{ origin 172.16.16.0 mask
255.255.255.0 snatpool pan_spool }’
98. Virtual
Big-IP is default deny device, so listener (virtual) is
must
Virtual server gules everything together
Virtual are first point of call for traffic
99. Types of VIP
Standard
Most common type of VIP for general purpose load balancing
Can make use of all functions including iRules, WebAccelerator, ASM etc
Forwarding (Layer 2)
Generally used when LTM is configured in a bridge mode (VLAN Groups)
Essentially just forwards packets at Layer 2
Forwarding (IP)
Used when LTM needs to forward or route packets
Can either just route them based on it’s IP routing table of load balance
multiple routers/firewalls etc
Performance (HTTP)
Used for very simple, very fast HTTP load balancing
Loose a number of features (see next slide)
Performance (Layer 4)
Used for general purpose fast load balancing of packets using the PVA ASIC
Loose a number of features depending on PVA Acceleration mode (see next
few slides)
100. Configuration of virtual
>Forwarding (IP)
#b virtual forward_vip { destination any:any ip forward }
>Forwarding (Layer 2)
#b virtual forward_vip { destination any:any l2 forward }
>Standard
b virtual accel_vip ‘{
destination 10.118.10.12:https
ip protocol tcp
profile http_profile oneconnect_master www.foo.com tcp
persist simple_1800_profile
pool https_pool
}’
102. What is an iRule?
An iRule is a TCL script to give more control over
how traffic is processed via the LTM
Can do this based on just about anything found
in a packet, including client IP address, headers,
URI, destination port, etc.
The use of the Universal Inspection Engine (UIE)
is also done via iRules, allowing for rule based
persistence
103. What can an iRule work with?
Most commonly seen are HTTP events
Can also work with other protocols, such as SIP,
RTSP, XML, others
Can make adjustments to TCP behavior, such as
MSS, checking the RTT, looking into the payload
Can work with authentication or encryption, via
x509 commands, and AES encryption/decryption
Cache, compression, profiles are also available
104. Example iRules
Change server headers
when HTTP_RESPONSE {
HTTP::header replace Server "Microsoft-IIS/5.1"
}
Remove all server headers
when HTTP_RESPONSE {
HTTP::header sanitize ?ETag? ?Header01? ?Header02?
}
On 404 error, re-load balance
when HTTP_REQUEST {
set RequestedPage [HTTP::uri]
}
when HTTP_RESPONSE {
if { [HTTP::status] eq "404" } {
log "Dooh, page '$RequestedPage' not found on server
[IP::server_addr]!"
HTTP::redirect $RequestedPage
}
}
106. iRule Logging (really handy!)
You can turn on logging for any iRule and record anything
you like from requests or responses!
Often used when troubleshooting an iRule
Simply add the line “log xxx” (where “xxx” is anything you
like) to any iRule, for example:
when HTTP_REQUEST {
log "Client [IP::remote_addr] has requested page
[HTTP::uri] from server [HTTP::host]."
}
You can use the CLI command “tail –f /var/log/ltm” to view
these logs in real time
107. Troubleshooting Section
File System Overview and Vi
UCS file extracting
Qkview
Look at the Statistics!
CLI Tools
Logs
Running TCPDUMP and SSLDUMP
PXE booting tips
108. File System Overview
Main VIP, Pool and iRule config is stored in:
/config/bigip.conf
Main IP and VLAN settings are stored in:
/config/bigip_base.conf
BIG-IP license file is stored in:
/config/bigip.license
Log files are stored in:
/var/log/
Archived configs are stored in:
/var/local/ucs/
109. Tools/Commands to help
Change directory: cd
Print working directory: pwd
List directory contents: ls
View file: more <filename>
Edit file: vi <filename>
Copy file: cp <source> <dest>
Delete file: rm <filename>
110. Useful “vi” commands
“i” to start inserting text where the cursor is
“A” to start inserting text at the end of the line
“Esc” exits the editing mode
“dd” delete entire line
“x” delete single character
“Esc” then “:” then “w” to write the file
“Esc” then “:” then “q” to quit vi
“/” starts a search through the file
Note: “:wq” would write the file and quit in one go
Note: “:w!” would write the file even if read-only file
Note: “:q!” would force vi to quit
111. UCS file extracting
UCS files are simply “.tar.gz” files with a number of
configuration files inside
Rename the file with a “.tar.gz” extension and use
WinRAR to extract the file
Note that a UCS file contains both the “root” password
and license key for that unit – don’t put it on another
box unless you have a backup!
112. “Qkview”
Support will often request these
Can be executed from the GUI or CLI
Contains box configuration, route information,
statistics etc
113. Logs
Logs can often highlight problems
Can be viewed from the GUI
Can be downloaded from the directory
“/var/log”
Useful command to watch the LTM log file in
real time from the CLI:
tail –f /var/log/ltm
114. CLI Tools
“bigtop” – utility for a quick look at how the BIG-IP
is functioning. Provides statistics and information
on traffic flow, node operations and
troubleshooting (“bigtop –delay 2” useful)
115. Running TCPDUMP
TCPDUMP is an inbuilt network sniffer
To run TCPDUMP from the CLI and save the output to a file
that can be opened in Ethereal/Wireshark use the following
command:
tcpdump -ni <VLAN> -v -s 1600 -w /var/tmp/filename.dmp
Example:
tcpdump -ni external -v -s 1600 -w /var/tmp/external.dmp
TIP: Use WinSCP to copy the file from the BIG-IP to your PC
TCPDUMP can be run from the GUI also
116. Running SSLDUMP
SSLDUMP is a utility available on the BIG-IP that can be used
to decode your SSL sessions by pre-loading your SSL keys
and using those to convert the session data into ASCII text.
SSLDUMP takes a raw TCPDUMP file as input
To display the handshake only
ssldump –r <capture file>
To display the actual application data (with the key file)
ssldump –r <capture file> -k <key file> -d
Example:
ssldump -r /var/tmp/internal.dmp -k
/config/ssl/ssl.key/default.key -d > /var/tmp/ssldump.dmp
Documentation for ssldump can be found on
www.rtfm.com/ssldump/ssldump.html
119. Concept..
When is high Availability is required ?
Increases Reliability
It consist of two identically configured Big-IP
system
There are two basic aspect:
Synchronizing configurations between two BIG-IP
units
Configuring fail-safe settings for the VLANs
120.
121. Big-ip Individual System Settings
Big-IP LTM System -1
Hostname:- bigip1.cw.com
Admin Password:- XXXXX
Unit ID:- 1
Internal VLAN
-Self: 172.16.1.31
-Float : 172.16.1.33
-Peer : 172.16.1.32
Big-IP LTM System -2
Hostname:- bigip2.cw.com
Admin Password:- XXXXX
Unit ID:- 2
Internal VLAN
-Self: 172.16.1.32
-Float : 172.16.1.33
-Peer : 172.16.1.31
122. Unit ID used for Identification, do not designate
primary and secondary
127. Synchronization condition
Administrative password must be same on each
system
Port 443 must not be blocked by the port lockdown
setting or by another system between the
redundant pair.
Clock of the system must be within a certain
number of minutes of each other.
Pull or Push Operation –Sync in Correct Direction
128. Synchronization Process
1-Create UCS file.
-Which contain all configurations + licensing information
2-Send to peer
3-Peer creates backup of itself
4-Peer opens UCS file
a) Matching Hostname > Full Installation
b) Different Hostname >Shared Installation
133. Failover Managers
Failover Mangers detects a failed process,
takes one of the several action restarting the
process, failing back to the standby, reboot the big-
ip
Watchdog
Performs hardware health checks
Overdog
Software to correct hardware failures
SOD
monitors the switch fabric and takes corrective action for
switch failures
All failover Managers update and monitor the high
Availability Table
134. High Availability Table
Update & Monitor by Failover Managers
Table Fields
-Feature Name
-Action on Failure
-Enabled
-Failed State
Command Line: b ha table show
141. Network Failover
Heartbeat sent over network
No 50 foot (15.24 meter) limitation
Slower than Hardware Failover
Setting not synchronized between peers
If Both Hardware Failover & Network Failover are being
used…..
