254339736 F5 Big Ip Ltm Essentials Wbt Lab Guide V11 6r3l49

[email protected]

to quit scrolling mode and return to the Linux bash prompt. 11. Use the Traffic Management Shell (tmsh) command to view various configuration settings. a.

At the command line in PuTTY, type: tmsh list /net vlan |less

Compare the results with what you see in the Web Configuration utility (the “GUI") at Network » VLANs. b. Type the following command: tmsh list /net self |less

Compare the results with what you see in the Configuration utility at Network » Self IPs. c. Type the following command: tmsh list /net interface |less

Compare the results with what you see in the Configuration utility at Network » Interfaces. d. Type the following command: tmsh show /sys license |less

Compare the results with what you see in the Configuration utility (GUI) at System » License. What is the registration key for your BIG-IP system?

BIG-IP LTM Essentials Web-Based Training Lab Guide

1-9

1-10

Chapter 1 - Initial Setup What is the software version number this license was first activated for? What is the service check date for your BIG-IP system? e. Close the PuTTY window and terminate the session.

Configure command line access for the 12. Open an SSH session to 10.10.1.31 or to 192.168.1.31 and attempt to as the with . Were you successful? Your attempt to to the command line interface in the previous step as the should fail because by default, the does not have access to the command line. 13. Update the settings to permit access to the command line interface but only to tmsh (i.e., not full Linux istrative privileges). Configuration utility System » s then click on Properties section tmsh

Terminal Access When finished, click:

Update

14. Open an SSH session to 10.10.1.31 or to 192.168.1.31 and try to with the credentials again. Were you able to connect this time? 15. How is your access different from the root ? (Hint: Check the prompt after you as each . Close your “” PuTTY session and open a new PuTTY session and with the root credentials.) What do you have access to as the root that you do not have access to as the ? 16. Close the PuTTY windows and terminate the sessions.

Check root access to the GUI 17. Open a browser window to https://10.10.1.31 or https://192.168.1.31 and attempt to as the root . Were you successful? Note: “root” has access to BIG-IP only with the command line, and not with the Web Configuration utility.

1-10


Chapter 1 - Initial Setup

1-11

Configuration Backup Lab Objective: 

Create a backup of the BIG-IP System on both the BIG-IP and your desktop.



Estimated time for completion: 5 minutes

Lab Requirements: 

External IP address of the BIG-IP LTM system

Create a UCS Archive of Your Configuration 1. Open a browser window to https://10.10.1.31 or https://192.168.1.31 and create a backup of your current configuration Configuration utility System » Archives then click Create General Properties section File Name

train1_base.ucs

Encryption

Disabled

Private Keys

Include

When complete, click…

Finished, then click OK when the archive is complete

2. your new UCS backup to your workstation hard drive for use possible in a later lab. Configuration utility System » Archives then click train1_base.ucs train1_base.ucs section Archive File

Click : train1_base.ucs, then save to folder.

View the backup UCS file using the command line interface 3. Open an SSH session to BIG-IP system. 4. At the config# prompt, make a new directory: mkdir /var/tmp/test

5. Change to the new directory: cd /var/tmp/test

6. Copy the backup previously ed to the new directory (and replace, if necessary). /var/local/ucs/train1_base.ucs train1_base.ucs


1-11

1-12


7. Decompress and extract the file contents: tar –xvzf train1_base.ucs

The resulting files show the directory structure and all files stored within the UCS backup. Individual files can be viewed with cat, tail, more, less, and other command line tools. 8. If you want to continue to the next lab exercise, skip the “Lab Instructions” on the next page and go directly to the “Creating an HTTP Pool and Virtual Server Lab.”

1-12



1-13


1-13

Chapter 2 - Traffic Processing

2-1

Chapter 2: Traffic Processing Module 2 Lab – Processing Traffic Objectives: 

Configure pools for servers



Configure virtual servers and associate them with a pool



functionality



IP address/port combinations for BIG-IP LTM that can be reached by the client systems



Servers configured with appropriate routes to return traffic through each BIG-IP LTM system

Lab Instructions 1. After connecting to the F5 Training Lab, click the Ubuntu Client icon. 2. Click the Firefox Web browser icon in the left . When prompted, as with a of . 3. In the Navigation pane, expand the System section, and then click Archives. 4. Click the Module2_Lab_begin.ucs archive and then click Restore. It will take a minute to restore the .ucs archive. A status message appears telling you how the configuration process is proceeding. Disregard any error messages (which are an artifact of the training environment) and click OK. 5. Reconfiguring from the .ucs archive installs a known, good configuration at the beginning of the lab. As you can see, after reconfiguring, your system is licensed, has two VLANs (named “external” and “internal”), and four self IPs: 10.10.1.31, 10.10.1.33, 172.16.1.31 and 172.16.1.33.


2-1

2-2 Processing

Chapter 2 - Traffic

Creating an HTTP Pool and Virtual Server Lab Create a Pool 1. Create a Pool using the information in the following table. Configuration utility Local Traffic  Pools  Pool List, then click Create Configuration section Configuration

Basic

Name

http_pool

Description

HTTP pool

Resource section: Load Balancing Method

Round Robin

Priority Group Activation

Disabled

Node Name

(Leave blank) Address:Port 172.16.20.1:80 Click Add Address:Port 172.16.20.2:80 Click Add Address:Port 172.16.20.3:80 Click Add

New When complete, click…

Finished

Create a Virtual Server 2. Create a Virtual Server that uses the pool created in the previous step. Configuration utility Local Traffic  Virtual Servers  Virtual Server List, then click Create General Properties section Name

vs_http

Destination

Type: Standard Address: 10.10.1.100

Service Port

80 (or type or select HTTP)

State

Enabled

Resources section: Default Pool When complete, click…

2-2 Guide

http_pool Finished

BIG-IP LTM Essentials Web-Based Training Lab


2-3

Test Your Configurations Examining Virtual Server Statistics Verification through Statistics 3. Open a new browser session on your PC and point it to the virtual server at http://10.10.1.100. Note the results and refresh the screen 5-10 times. You may need to refresh using Ctrl + F5 to force the browser not to use its cache. 4. View statistics and configuration information. Configuration utility Statistics  Module Statistics  Local Traffic Display Options section Statistics Type Did traffic go to the virtual server?

Virtual Servers

Statistics Type Did traffic go to each pool member?

Change to Pools

Did each pool member manage the same number of connections? Did each pool member manage the same number of bytes? How many T connections are opened each time you refresh the browser page?

Expected Results and Troubleshooting 

Expected result: Five connections per refresh, distributed evenly among the pool . The Web page consists of index.html and four objects. The Web servers have keep-alives disabled.



If not, the following: •

Is traffic getting to the virtual server? 

Does 10.10.1.100 appear in your workstation’s ARP table? Type arp -a at the workstation’s terminal (command prompt).



Does the Statistics page show traffic received by vs_http? that the address and port are correctly configured



Is traffic getting to the pool ? •

•

If no traffic is going to the pool : 

http_pool has been assigned to vs_http



that ’ addresses and ports are correct

If traffic goes to pool member, but does not return: 

that self IP address 172.16.1.33 is configured on port 1.2. (This address is the pool ’ default route.)


2-3

2-4 Processing

Chapter 2 - Traffic

Create a Second Pool and Virtual Server Next, you will create a second virtual server that has the same IP address as the virtual server you created previously (10.10.1.100). The port, however, will be different (443 instead of 80). This time, you will “forget” to create a pool first, and you will learn how to create a pool during the virtual server configuration. 5. Create another virtual server and pool. Configuration utility Local Traffic  Virtual Servers : Virtual Server List, then click Create General Properties section Name

vs_https

Destination

Type: Standard Address: 10.10.1.100

Service Port

443 (or type or select HTTPS)

State

Enabled

Resources section: Click + (This opens the New Pool screen)

Default Pool

Local Traffic  Pools : Pool List  New Pool New Pool screen Configuration section https_pool

Name

Resources section (on “New Pool” screen) Load Balancing Method

Round Robin

Node Name

(Leave blank) Click Node List and use the resulting pull-down to select the nodes to add to the member list: Address: 172.16.20.1 Service Port: 443 Click Add Address: 172.16.20.2 Service Port: 443 Click Add Address: 172.16.20.3 Service Port: 443 Click Add

New


Finished (This will return you to the New Virtual Server screen)

Local Traffic  Virtual Servers : Virtual Server List  New Virtual Server… Resources section (back on the “New Virtual Server” screen) Default Pool When complete, click…

2-4 Guide

https_pool Finished



2-5

Test Your Configuration Note: When sending traffic to your virtual servers during testing, make sure that you are connected to the correct one: http://10.10.1.100 for virtual server 10.10.1.100:80, and https://10.10.1.100 for virtual server 10.10.1.100:443.

Examining Virtual Server Statistics 6. Open a new browser session on your Linux Ubuntu virtual computer and enter the address of the virtual server at https://10.10.1.100. Note the results, then press Ctrl +F5 to refresh the screen 510 times. 7. View statistics and configuration information. Configuration utility Statistics  Module Statistics  Local Traffic Display Options section Statistics Type Did traffic go to the virtual server?

Virtual Servers

Statistics Type Did traffic go to each pool member?

Change to Pools

Did each pool member manage the same number of connections? Did each pool member manage the same number of bytes? How many T connections are opened each time you refresh the browser page?

Examining Statistics Using the Command Line 8. Using PuTTY, open an SSH session to your BIG-IP device at either the management IP address (192.168.1.31) or the self-IP address (10.10.1.31). 9. At the prompt, enter the root credentials you set up in the first lab. 10. Back on your browser window connected to https://10.10.1.100, refresh the page once using Ctrl+F5. 11. In your SSH client window, view pool statistics and virtual server statistics by entering the following commands at the config# prompt: tmsh show /ltm pool https_pool |more tmsh show /ltm virtual vs_https |more

Expected Results and Troubleshooting 

Expected result: You might see six connections the first time you request the page, (because of the SSL key exchange), but you should see only five connections each time you refresh the screen thereafter. The requests should be evenly distributed among the pool .



If you do not get the expected result, the following:


2-5

2-6 Processing

Chapter 2 - Traffic •

Confirm that the virtual server was created. (Did you forget to click Finish for the virtual server after clicking Finish for the pool?)

•

Is traffic getting to the virtual server? 

Does 10.10.1.100 appear in your workstation’s ARP table? (You may need to clear your ARP table before testing to remove the entry from the vs_http virtual server.)



Does the Statistics page show traffic received by vs_https? that the address and port are correctly configured.

•

Is traffic getting to the pool ? Check Pool statistics: 

If no traffic is going to the pool : https_pool has been assigned to vs_https the correct address and port

•

If traffic goes to pool member but does not return: 

that the self IP address 172.16.1.33 is configured on port 1.2. (This address is the pool ’ default route).

Continue to the next lab.

2-6 Guide



2-7

Network Map Lab View Configuration and Status from Network Map 1. If you have not done so, in your web browser, type the address https://10.10.1.31. 2. In the Navigation menu, click Local Traffic » Network Map, then click Update Map. 3. In Local Traffic Network Map, place your cursor over both virtual server and pool objects and notice what information is displayed about each object. 4. Select a pool member and disable it. You can do this by clicking the pool member in the Network Map, clicking Disabled, and then clicking Update. 5. Return to the Local Traffic Network Map and notice that status changed to disabled, indicated by a black square. 6. Re-enable the disabled pool member so that it will be used in later lab exercises. 7. Type 20.1 in the search field and then click Update Map. Notice that all are still listed, but matches are highlighted. 8. Click System » Preferences and change the Start Screen from Welcome to Network Map. Click Update. 9. Click Log out and then log back in to https://10.10.1.31 and notice that your default screen is now Network Map. 10. If you want to continue to the next lab exercise, skip the “Lab Instructions” on the next page and go directly to the “Review Round Robin Load Balancing Statistics Lab.”


2-7

2-8 Processing

2-8 Guide

Chapter 2 - Traffic


Chapter 3 - Load Balancing

3-1

Chapter 3: Load Balancing Module 3 Lab – Load Balancing Objectives: 

Choose differing load balancing methods and view the resulting behavior



Choose differing member priority and ratio values and view the resulting behavior



Access to a BIG-IP LTM with at least one pool that has two or more working

Lab Instructions 1. After connecting to the F5 Training Lab, click the Ubuntu Client icon. 2. Click the Firefox Web browser icon in the left . When prompted, as with a of . 3. In the Navigation pane, expand the System section, and then click Archives. 4. Click the Module3_Lab_begin.ucs archive and then click Restore. It will take a minute to restore the .ucs archive. A status message appears telling you how the configuration process is proceeding. Disregard any error messages (which are an artifact of the training environment) and click OK. 5. Reconfiguring from the .ucs archive installs a known, good configuration at the beginning of the lab. As you can see, after reconfiguring, your system is licensed, has two VLANs (named “external” and “internal”), and four self IPs: 10.10.1.31, 10.10.1.33, 172.16.1.31 and 172.16.1.33. Click on Local Traffic >> Network Map and you should see vs_http configured with the http_pool and the vs_https configured with https_pool.


3-1

3-2 Balancing

Chapter 3 - Load

Review Round Robin Load Balancing Statistics Reset the Statistics for http_pool 1. From the Navigation pane, click Statistics » Module Statistics : Local Traffic. 2. In the Statistics Type menu, select Pools. 3. Select (check) the checkbox next to http_pool, and then click Reset.

View Results using Round Robin Load Balancing 4. Open a browser session and access http://10.10.1.100 (not https://10.10.1.100). 5. Refresh the screen three times by pressing Ctrl+F5. 6. Return to the pools statistics on the Local Traffic page and click Refresh. 7. What are the results? Were the connection requests distributed evenly? 8. Reset the statistics for http_pool again.

Ratio (member) Load Balancing Lab Configure Ratio (member) Load Balancing and test. 9. In the Navigation pane, expand the Local Traffic section. 10. Click Pools. 11. Click http_pool. 12. Click the tab. 13. In the Load Balancing section, change Load Balancing Method to Ratio (member) and then click Update. 14. In the Current section, click each member, set Ratio to the value in the table and then click Update. Click the tab to return to the Current list. Member 172.16.20.1:80 172.16.20.2:80 172.16.20.3:80

Ratio 1 2 3

15. Open a new browser session and connect to http://10.10.1.100. 16. Refresh the browser 5-10 times by pressing Ctrl+F5. 17. In the Configuration Utility, view the pool statistics. You may need to refresh the view. What are the results? Traffic should be distributed to the with a 1:2:3 ratio.

3-2 Guide


Chapter 3 - Load Balancing

3-3

Priority Group Activation Lab Configure Priority Group Activation 1. Reset the statistics for http_pool. 2. From the Navigation pane, expand the Local Traffic section and select Pools. 3. Select http_pool. 4. Select the tab. 5. In the Load Balancing section, change the Priority Group Activation setting to Less than …, the number of Available to 2, and click Update. 6. Within the Configuration section of each member, set the Priority values as follows: Member 172.16.20.1:80 172.16.20.2:80 172.16.20.3:80

Ratio 1 2 3

Priority Group 0 4 4

to click Update after each entry. 7. Open a new browser session and connect to http://10.10.1.100. 8. Refresh the screen 5-10 times by pressing Ctrl+F5. 9. View the pool statistics. What are the results? 10. Reset the statistics for http_pool. 11. Disable pool member 172.16.20.2:80 in http_pool. 12. In the browser session connected to http://10.10.1.100, refresh the screen 5-10 times by pressing Ctrl+F5. 13. Refresh and view the pool statistics. What are the results? 14. Enable pool member 172.16.20.2:80 in http_pool.

Expected Results and Troubleshooting • With Priority Group Activation set to less than 2 and all pool enabled, 172.16.20.1:80 should receive no traffic. Traffic is distributed to 172.16.20.2 and 172.16.20.3 in a 2:3 ratio. • With Priority Group Activation set to less than 2 and pool member 172.16.20.2:80 disabled, 172.16.20.2:80 is not eligible to receive traffic. The next lower priority group (0) is activated as the number of available in the pool has now fallen below the minimum 2. Traffic is distributed to 172.16.20.1 and 172.16.20.3 in a 1:3 ratio


3-3

3-4 Balancing

Chapter 3 - Load

Reset Configuration Reset http_pool and to the following settings: •

Load Balancing: Round Robin

•

Priority Group Activation: Disabled

If you want to continue to the next lab exercise, skip the “Lab Instructions” on the next page and go directly to the “Monitor for Nodes Lab.”

3-4 Guide


Chapter 4 - Monitors

4-1

Chapter 4: Monitors Module 4 Lab – Monitors Objective: 

Associate nodes, pools and pool with monitors



Create custom monitors





Access to a BIG-IP LTM with at least one pool with two working



Some knowledge of the traffic sent by the



4-1

4-2 Monitors

Chapter 4 -

Monitor for Nodes Lab Configure Monitors for Nodes Check current nodes status 1. Observe the node status indicators and answer the questions in the spaces provided. Configuration utility Local Traffic  Nodes  Node List Node List section What are the nodes’ statuses? Will BIG-IP load-balance traffic to nodes with status Unknown?

Assign a default monitor to all nodes 2. Click Default Monitor tab in the menu bar. 3. Add icmp as the default monitor for all three nodes. Configuration section Select icmp Press << button

Health Monitors When complete, click…

Update

Each time you click the Node List tab, the screen is refreshed. 4. Click Node List in the menu bar. 5. Recheck node status indicators. What are the nodes’ statuses? Was the change immediate?

4-2 Guide



4-3

Create a Custom ICMP Monitor 6. Create a new ICMP monitor called my_icmp. Configuration utility Local Traffic  Monitors  Create General Properties section Name

my_icmp

Type

ICMP

Configuration section Interval

10 seconds

Timeout

31 seconds

Transparent

No


Finished

Assign the custom monitor to selected node 7. Add my_icmp as the default monitor for node 172.16.20.1. Configuration utility Local Traffic  Nodes: Node List  172.16.20.1 Configuration section Health Monitors

Node Specific

Select Monitors

Select my_icmp Press << button


Update

8. Recheck node status indicators. What are the nodes’ statuses?


4-3

4-4 Monitors

Chapter 4 -

Disassociate all monitors from selected node 9. Remove the monitor from node 172.16.20.2. Leave monitor my_icmp on 172.16.20.1. Configuration utility Local Traffic  Nodes: Node List  172.16.20.2 Configuration section Health Monitors When complete, click…

None Update

10. Check the nodes’ statuses. What is the node status of Node 172.16.20.1? What is the node status of Node 172.16.20.2? What is the node status of Node 172.16.20.3? Was the change immediate?

Conclusion Now each node is being tested differently: •

Node 172.16.20.1 has a specific assignment, my_icmp.

•

Node 172.16.20.2 has no monitor assigned.

•

Node 172.16.20.3 is using the Node Default monitor, which is currently icmp.

This is not a recommended configuration; rather it is used to demonstrate the three ways monitors can be associated with nodes.

4-4 Guide



4-5

Monitors for Pools and Pool Lab #1 Objective: •

Associate pool with monitors

•


•


Check Current Member State 1. From the Navigation pane, click Local Traffic » Pools and then click http_pool. 2. Click the tab. 3. Check the status of the . What are the ’ statuses? Will BIG-IP load-balance traffic to nodes with status Unknown?

Assign a Standard Monitor to a Pool 4. Assign the default http monitor to the http_pool. Configuration utility Local Traffic ›› Pools : Pool List ›› http_pool Properties tab Configuration section Click http Press the << button


Update

5. Recheck the member statuses. Each time you press the tab, the screen is refreshed.


4-5

4-6 Monitors

Chapter 4 -

Create a New HTTP Monitor 6. Create a customized monitor based on the HTTP Monitor. Configuration utility Local Traffic  Monitors  New Monitor General Properties Name

my_http

Type

HTTP

Parent Monitor

http

Configuration section Send String

GET /index.html\r\n

Receive String

Server


Finished

Assign the Custom Monitor to a Pool Member 7. From the Navigation pane, click Local Traffic » Pools and then click http_pool. 8. Click the tab. 9. Click the member 172.16.20.2:80. Configuration utility Local Traffic ›› Pools : Pool List ›› http_pool Select Advanced from the dropdown list.

Configuration section Health Monitors

Member Specific

Select Monitors

Select my_http Press << button


Update

10. Check the ’ statuses. What are the ’ statuses?

4-6 Guide



4-7

Disassociate all Monitors for Selected Member 11. From the Navigation pane, click Local Traffic » Pools and click http_pool. 12. Click the tab. 13. Click the member 172.16.20.3:80. Configuration utility Local Traffic ›› Pools : Pool List ›› http_pool Select Advanced from the dropdown list.

Configuration section

None


Update

14. Check the status. What are the ’ statuses? Was the change immediate?

Conclusion Now each member is being tested differently: •

Member 172.16.20.1:80 has its health monitor set to inherit from pool, so it inherits an http health monitor.

•

Member 172.16.20.2:80 has a specific monitor assigned: my_http.

•

Member 172.16.20.3:80 does not have an assigned monitor.

This configuration is not recommended; rather it is used to demonstrate the three ways monitors can be associated with pool .


4-7

4-8 Monitors

Chapter 4 -

Monitors for Pools and Pool Lab #2 Objective: 

Associate with monitors







Check Current Member State 1. From the Navigation pane, select Local Traffic » Pools and select https_pool. 2. Click tab. 3. Check the ’ statuses. What are the ’ statuses?

Create a New HTTPS-based Monitor 4. Create a custom monitor based on the HTTPS Monitor. Configuration utility Local Traffic  Monitors  New Monitor General Properties Name

my_https

Type

HTTPS

Parent Monitor

https

Configuration section Send String

GET /index.html\r\n

Receive String

Server 2


4-8 Guide

Finished



4-9

Assign the Custom Monitor to Pool 5. From the Navigation pane, click Local Traffic » Pools and then click https_pool. Configuration utility Local Traffic ›› Pools : Pool List ›› https_pool Configuration section Click my_https Press << button


Update

6. Check the ’ statuses. What are the ’ statuses? Was the change immediate? What is the status of the virtual server vs_https?

Check Status of Nodes and from Network Map 7. From the Navigation pane, expand the Local Traffic section, and then click the Network Map. 8. Move the cursor over the pool . Notice that the status of a node state can be different from the status of a pool member. What are the ’ statuses?

Recall that you have assigned different monitors to nodes and pool .

Change the Definition of the Custom Monitor 9. From the Navigation pane, expand the Local Traffic section. 10. Click Monitors. 11. Click my_https. 12. In the Configuration section, change the Receive String to Server [1-3] [1-3] is a regular expression that matches any single character in the range from 1 to 3.

13. When complete, click Update. 14. Check the status of in https_pool. What are the ’ statuses? Was the change immediate?


4-9

4-10 Monitors

Chapter 4 -

Reset Configuration 15. Make sure all pool for both http_pool and https_pool are in one of the following states:



Available or Green



Unknown or Blue

16. If you want to continue to the next lab exercise, skip the “Lab Instructions” on the next page and go directly to the “Source Address Persistence Lab.”

4-10 Guide


Chapter 5 - Profiles

5-1

Chapter 5: Profiles Module 5 Lab – Profiles There is no lab for Module 5 Profiles. There are labs using Profiles in both Modules 6: Persistence and Module 7: SSL Termination.


5-1

5-2 Profiles

5-2 Guide

Chapter 5 -


Chapter 6 - Persistence

6-1

Chapter 6: Persistence Module 6 Labs – Persistence Objective: 

Configure persistence profiles and associate them with virtual servers



functionality





Two or more working in https_pool



A virtual server at https://10.10.1.100 that is associated with https_pool



6-1

6-2


Source Address Persistence Lab Objective: 

Configure a Source Address Persistence profile and associate it with virtual servers



functionality




Configure Source Address Affinity Confirm traffic behavior before persistence 1. Ensure that the load balancing method for https_pool is Round Robin and that Priority Group Activation is disabled. Although this step is not required to enable persistence, it ensures that the recurring direction of a connection to a pool member is due to persistence and not due to a load balancing choice. 2. Access and reset the statistics for the pool https_pool. 3. Open a new browser session and connect to https://10.10.1.100. 4. Refresh the browser 5-10 times by clicking Ctrl+F5. 5. Refresh and view pool statistics.

Q. What are the results?

Expected results and troubleshooting You should see BIG-IP load-balance the traffic from each refresh request across all pool , and each pool member should receive approximately the same amount of traffic. If you do not see these results, make sure you reset the statistics properly in step 1, and then repeat the steps through step 4 again.

6-2



6-3

Configure a Source Address Affinity persistence profile and assign it to a virtual server 6. Create a Persistence Profile based on the following: Configuration utility Local Traffic  Profiles  Persistence  Create General Properties section Name

Pr_Src_Persist

Persistence Type

Source Address Affinity

Configuration section Timeout Mask When complete, click…

Select (check) the Custom checkbox for Timeout and then set Timeout to 15 seconds. Click on the Custom checkbox for Mask and specify a network mask of 255.255.255.0. Finished

7. Assign Pr_Src_Persist to vs_https Configuration utility Local Traffic  Virtual Servers  vs_https  Resources Load Balancing section Default Pool

https_pool

Default Persistence Profile

Pr_Src_Persist


Update

Confirm traffic behavior after persistence 8. Access and reset the statistics for https_pool. 9. Open a new browser session and connect to https://10.10.1.100. 10. Press Ctrl+F5 to refresh the screen five to ten times. 11. View the pool statistics.


12. Wait for at least 30 seconds, and then refresh again the https://10.10.1.100 website again. Now the web traffic should be load-balanced to another pool member. Confirm this by refreshing and viewing the pool member statistics. 13. View persistence records statistics.


6-3

6-4

Chapter 6 - Persistence Configuration utility Statistics  Module Statistics  Local Traffic Display Options section Statistics Type

Persistence Records

Data Format

Normalized


Refresh

14. If persistence records do not appear, go back to the browser connected to https://10.10.1.100 and refresh by clicking Ctrl+F5 the screen three times. Check for persistence records statistics again.

Q. Why might persistence records statistics not appear the first time?

Expected results and troubleshooting While the persistence entry is active for the chosen client IP address, all of the traffic generated each time you refresh the display is directed to the same pool member. Because the persistence profile is configured with a timeout value of 15 seconds, your persistence entry may time out before you are able to view the persistence statistics in the Configuration utility. Continue to the next lab.

6-4



6-5

Cookie Persistence Lab Objectives: •

Configure a cookie persistence profile, assign it to a virtual server, functionality, and observe changes in traffic behavior.

•


Lab Requirements: •

Two or more working pool in http_pool

•

A virtual server at http://10.10.1.100 associated with http_pool

Configure Cookie Persistence Confirm traffic behavior before persistence 1. Set the load balancing method for http_pool to Round Robin and make sure that Priority Group Activation is disabled. (Although this step is not required to enable persistence, it ensures that the recurring direction of a connection to a pool member is determined by persistence settings and not by the load balancing choice.) 2. Access and reset the statistics for pool http_pool. 3. Open a new browser session and connect to http://10.10.1.100. 4. Refresh the screen 5-10 times by clicking Ctrl+F5. 5. Refresh and view pool statistics.


Expected results and troubleshooting The BIG-IP device should load-balance the traffic resulting from each refresh request across all pool , with each pool member receiving approximately the same amount of traffic. If you do not see these results, make sure that you changed the load balancing method to Round Robin and that you reset the statistics, and then repeat the preceding lab steps.


6-5

6-6


Create a cookie persistence profile and assign it to a virtual server 6. Create a custom cookie persistence profile named Pr_Cookie_Persist. When you select Cookie as the Persistence Type, the Configuration Section appears. Leave all of the settings in the Configuration section in their default state for now. Configuration utility Local Traffic  Profiles  Persistence  Create General Properties section Name

Pr_Cookie_Persist

Persistence Type

Cookie


Finished

7. Assign Pr_Cookie_Persist to vs_http. Configuration utility Local Traffic  Virtual Servers  vs_http  Resources Load Balancing section Default Pool

http_pool


Pr_Cookie_Persist


Update

Hint: If you received an error message in the preceding section, think about profile dependencies. Modify vs_http to include an HTTP Profile and repeat the step above.

Confirm traffic behavior after persistence 8. Access and reset the statistics for http_pool. 9. On the browser connected to http://10.10.1.100, refresh the screen 5 to 10 times. 10. View the pool statistics.


11. Click the Display Cookie link in the web page to view the cookie.

Expected Results and Troubleshooting All traffic is directed to one member. If not, ensure that the browser allows cookies to be saved and disable persistence on the virtual server.

6-6



6-7

12. Set the default persistence profile on the virtual server vs_http to None. Configuration utility Local Traffic  Virtual Servers  vs_http  Resources Load Balancing section Default Pool

http_pool


None


Update

Continue to the next lab.


6-7

6-8


Disabled Lab Objective: 

Observe the interaction between persistence and the disabled status





Virtual server vs_https configured with the pool https_pool and the persistence profile Pr_Src_Persist

Persistence and Disabled Pool Preconfiguration steps 1. Update the timeout value in the Pr_Src_Persist profile. Configuration utility Local Traffic  Profiles  Persistence  Pr_Src_Persist Configuration section 800 seconds

Timeout When complete, click…

Update

Establish a persistent session and disable a member 2. Open a Web browser to https://10.10.1.100. Refresh the page several times to that there is a persistent connection to the same pool member.

Q. What is the IP address of the pool member to which there is a persistent connection? 3. Disable the pool member to which there is a persistent connection (as noted in Step 2). Configuration utility Local Traffic  Pools  https_pool  Current section Click the checkbox on the left side of the pool member that you identified in previous step. When complete, click…

Disable

4. In the browser connected to https://10.10.1.100, refresh the page by clicking Ctrl+F5 several times.

6-8



6-9

Q. Is the persistent connection still to the same pool member?

5. Force offline the pool member to which there is a persistent connection. Configuration utility Local Traffic  Pools  https_pool  Current section In the Member column, click the IP address:port link of the pool member that you identified in previous step. Member Properties section Click the Forced Offline (Only active connections allowed) radio button

State When complete, click…

Update

6. In the browser connected to https://10.10.1.100, refresh the page several times.

Q. Is the persistent connection still to the same pool member?

Disable the parent node and test the results 7. Disable the parent node of the pool member to which there is a persistent connection. Configuration utility Local Traffic  Nodes  Node List Node List section Click the checkbox to the left of the parent node of the pool member to which there is a persistent connection. In this class, the name of the parent node is the IP address part of the pool member. When complete, click…

Disable

8. Refresh the page at https://10.10.1.100 several times.

Q. Is the persistent connection still to the same node?

View object status from the Network Map 9. View the status of all your configuration objects in the Network Map. Hover your cursor over the entry for the pool member with the persistent connection and note the status of the pool member. 10. Enable the node and the pool member that you disabled earlier in this lab.


6-9

6-10


Clean up at end of lab 11. Remove the Pr_Src_Persist profile from vs_https. 12. If you want to continue to the next lab exercise, skip the “Lab Instructions” on the next page and go directly to the “Client SSL Lab.”

6-10


Chapter 7 - SSL Termination

7-1

Chapter 7: SSL Termination Module 7 Lab – SSL Termination Objective: 

Create a self-signed certificates



Create a clientssl profile



Create a virtual server that uses the clientssl profile and load-balances traffic


A pool of at port 80 (http_pool)



A Web browser



7-1

7-2 Termination

Chapter 7 - SSL

Client SSL Lab Behavior before configuration: SSL traffic is encrypted from client. 1. Open a Web browser and connect to https://10.10.1.100. 2. Depending on the browser, you may see a lock in the lower right corner of the window; it indicates the session is encrypted and secure. Alternately, find the certificate that is being used for the session. Right click on the web page, choose “View Page Info” and click the Security tab. 3. On the Web page, note the pool member address and port in the body of the Web page (for example: 172.16.20.1:443).

Generate a Certificate Create an SSL Certificate 4. Create a custom SSL Certificate. Configuration utility System ›› File Management : SSL Certificate List ›› click Create... General Properties section StudentCertificate

Name Certificate Properties section Issuer

Self

Common Name

www.student.com

Division

Training

Organization

F5 Networks

Locality

Seattle

State or Province

Washington

Country

US

E-mail Address

Leave blank

Lifetime

365

Key Properties section 2048

Size When complete, click…

7-2 Guide

Finished


Chapter 7 - SSL Termination

7-3

Create an SSL Profile 5. Create a Client SSL profile called Pr_Client_SSL with clientssl as its parent. Configuration utility Local Traffic  Profiles  SSL  Client and click Create General Properties section Name

Pr_Client_SSL

Parent Profile

clientssl


Finished

Create a New Virtual Server 6. Create a new virtual server called vs_ssl with an IP address of 10.10.1.101:443 and assign pool https_pool as its default pool. Configuration utility Local Traffic  Virtual Servers  Virtual Server List, then click Create General Properties section Name

vs_ssl

Service Port

Type: Standard Address: 10.10.1.101 443 (or type or select HTTPS)

State

Enabled

Destination

Configuration section SSL Profile (Client)

Pr_Client_SSL

Resources section: Default Pool When complete, click…

http_pool Finished

7. In your Web browser, go to https://10.10.1.101. If prompted, accept the SSL certificate. The browser session is encrypted on the client side, but not on the server side.

8. Note the Pool Member address:port combination in the body of the web page (172.16.20.1:80).

Expected Results Unless otherwise configured, traffic is encrypted from client to the BIG-IP system, but unencrypted between the BIG-IP and the pool . In other words, the pool member should be using port 80, which is unencrypted. 9. If you want to continue to the next lab exercise, skip the “Lab Instructions” on the next page and go directly to the “Configuring a NAT Lab.”


7-3

7-4 Termination

7-4 Guide

Chapter 7 - SSL


Chapter 8 - NATs and SNATs

8-1

Chapter 8: NATs and SNATs Module 8 Labs – NATs and SNATs Lab Objectives: 

Configure a NAT to traffic between an external device and an internal node



Configure SNAT Auto Map and a SNAT Pool and test address translation


One or more servers on the internal side of the BIG-IP system



An available IP address to use for the NAT



8-1

8-2 SNATs

Chapter 8 - NATs and

Configuring a NAT Lab The Network Address Translation screen displays the NAT address and the associated node address for each NAT.

Configure a NAT 1. In the Navigation pane, expand Local Traffic. Configuration utility Local Traffic  Address Translation  NAT List, then click Create Configuration section Name

Nat_200_to_2

NAT Address

10.10.1.200

Origin Address

172.16.20.2

State

Enabled


Finished

Testing the NAT - Inbound 2. Open a browser session to http://10.10.1.200. 3. Note what is on the page. 4. Using PuTTY, open an SSH session to 10.10.1.200 port 22. 5. If prompted, accept the certificate and with a ID of student and of student. Note that you can connect to multiple services through the NAT (in this example, using both a Web browser and PuTTY) and that the connection always connects to 172.16.20.2. NOTE: Although the NAT that you configured could provide outbound connections as well, the routing tables on the server do not allow that in the lab environment.

Delete the NAT 6. In the Navigation pane, expand Local Traffic. 7. Click Address Translation and then the NAT List tab. 8. Check the box next to the NAT you just created, 10.10.1.200, and then click the Delete button. 9. Click Delete to confirm the deletion

8-2 Guide



8-3

SNAT Labs Lab Requirements: 

Access to a BIG-IP LTM System



An available IP address to use for the SNAT

Test Behavior Without a SNAT 1. Open two browser sessions: one to http://10.10.1.100 and the other to https://10.10.1.100. 2. On both of the resulting Web pages, click the link that says Source IP Address (as shown in the image below) and note the source IP addresses as ed from BIG-IP to the internal application server.


8-3

8-4 SNATs


3. The three Web servers have IP addresses of 172.16.20.1, 172.16.20.2, and 172.16.20.3. The servers can return response traffic to your computer at 10.10.1.30 through the BIG-IP device because each contains the following server route: Destination

Gateway

10.10.1/24

172.16.1.33

Configure SNAT Auto Map Add SNAT Auto Map to the virtual server 1. Refresh (Ctrl+F5) the browser window that is connected to https://10.10.1.100. 2. View your source IP address again by clicking the Source IP Address link on the page. Your source IP address should still be 10.10.1.30. 3. Now add SNAT Auto Map to vs_https: Configuration utility Local Traffic  Virtual Servers, then click vs_https Configuration section Source Address Translation When complete, click…

Select Auto Map

Update

Test connectivity with the SNAT 4. Refresh (Ctrl+F5) the browser that is connected to https://10.10.1.100 and view your source IP address there. It should have changed to 172.16.1.33, which is the floating IP address of VLAN internal, the egress VLAN for traffic flowing from the BIG-IP system to the pool . Continue to the next lab.

8-4 Guide



8-5

Configure SNAT Pool Configure a SNAT pool SNAT pools were not discussed during the lecture portion of the LTM Essentials WBT, but are another common method to accomplish SNAT’ing so lab steps are included here. 5. Follow the instructions in the table below to create a new SNAT pool called MySnatPool. Configuration utility Local Traffic  Address Translation  SNAT Pool List, then click Create Configuration section Name

MySnatPool

Member List

IP Address: 10.10.1.150, then click Add IP Address: 172.16.1.150, then click Add


Finished

Change the virtual server to use a SNAT pool 6. Refresh (Ctrl+F5) the browser window that is connected to http://10.10.1.100. 7. View your source IP address again by clicking on the Source IP Address link on the page. Your source IP address should still be 10.10.1.30. 8. Change the source address translation method on vs_http to SNAT pool. Configuration utility Local Traffic  Virtual Servers, then click vs_http Configuration section Source Address Translation

Select SNAT

SNAT Pool

Select MySnatPool


Update

Test connectivity with the SNAT Pool 9. Refresh (Ctrl+F5) the browser that is connected to http://10.10.1.100 and view your source IP address there. It should have changed to 172.16.1.150, the translation IP address in the SNAT pool that is on VLAN internal, which is the egress VLAN for traffic flowing from the BIG-IP system to the pool .

Clean up and Delete the SNATs 10. Remove the SNAT option from virtual server vs_http and vs_https by setting Source Address Translation to None. 11. In the Configuration utility, navigate to Local Traffic » Address Translation : SNAT Pool List and delete MySnatPool.


8-5

8-6 SNATs


12. If you want to continue to the next lab exercise, skip the “Lab Instructions” on the next page and go directly to the “iRules Lab #1.”

8-6 Guide


Chapter 9 - iRules

9-1

Chapter 9: iRules Module 9 Labs – iRules Objective: 

Configure a series of iRules, pools, and virtual servers to demonstrate a variety of rule features and functions.



Estimated time for completion: 30 minutes.


External IP address of the virtual server



IP address(es) of internal node(s)



9-1

9-2

Chapter 9 - iRules

iRules Lab Create and use an iRule that processes requests based on the T port.

iRules Lab Steps Create pools for application services deployment 1. In Local Traffic » Pools, create three new pools. 2. Create pool1 that contains one member, 172.16.20.1:* (Port is “All services”) 3. Create pool2 that contains one member, 172.16.20.2:* (Port is “All services”) 4. Create pool3 that contains one member, 172.16.20.3:* (Port is “All services”)

Create an iRule for T port checking 5. Navigate to Local Traffic and create an iRule as follows: Configuration Utility Local Traffic ›› iRules : iRule List then click Create General Properties section Name

Definition

Rule_t_port

when CLIENT_ACCEPTED { if {[T::local_port] == 80} { pool pool1 } elseif {[T::local_port] == 443} { pool pool2 } }


9-2

Finished


Chapter 9 - iRules

9-3

6. Create a virtual server that uses this iRule: Configuration Utility Local Traffic ›› Virtual Servers : Virtual Server List then click Create General Properties section Name

vs_tport

Destination

10.10.1.103

Service Port

*All Ports

Resources section iRules

rule_t_port

Default Pool

pool3


Finished

behavior through statistics 7. Open a new browser session on your computer and direct it to your Virtual Server address and files: •

http://10.10.1.103

•

https://10.10.1.103

•

Using Putty, open an SSH session to 10.10.1.103 port 22

NOTE: You can that your SSH session went to Pool3 using Statistics.

8. View statistics and configuration information by navigating to Statistics » Module Statistics : Local Traffic 9. In the Statistics Type menu, select Virtual Servers 10. In the Statistics Type menu, select Pools 11. To which node is traffic being directed for each client request above and why? 12. If you want to continue to the next lab exercise, skip the “Lab Instructions” on the next page and go directly to the


9-3

9-4

Chapter 9 - iRules

9-4


Chapter 10 - Redundant Pair Setup

10-1

Chapter 10: Redundant Pair Setup

The online lab environment does not setting up a redundant pair. If you would like to get hands-on training with redundant systems, please enroll in the Configuring BIG-IP Local Traffic Manager (LTM) v11 instructor-led course. For current course offerings and schedules, visit the Training page at F5.com. The steps to set up a redundant pair in BIG-IP Version 10 can be found in Appendix A.


10-1

10-2 Setup

Chapter 10 - Redundant Pair

10-2 Guide


Chapter 11 - High Availability

11-1

Chapter 11: High Availability

The Online Lab Environment does not High Availability. If you would like to get hands-on training with high availability, please enroll in the Configuring BIG-IP Local Traffic Manager (LTM) v11 instructor-led course. For current course offerings and schedules, visit the Training page at F5.com. The steps to set up High Availability in BIG-IP Version 10 can be found in Appendix A.


11-1

11-2 Availability

11-2 Guide

Chapter 11 - High


Chapter 12 - Configuration Lab Project

12-1

Configuration Lab Project Configuration Lab Project Lab Objectives: In this lab, you will work with many of the concepts that you learned in Modules 1 to 8. In those modules, the lab steps were very specific and told you exactly what to do. One of the objectives of this lab configuration project is to see if you how to configure each feature. Therefore, the lab steps in this configuration project are not specific but rather given at a much higher level. Another objective of this configuration project is to give you an opportunity to configure all features together rather than individually. Upon completion, you will have configured a BIG-IP system with working virtual servers, profiles, monitors, and pools. There are two stages to this lab: 1. Create new pools, profiles, monitors, and virtual servers. 2. that the configuration works as expected.

Lab Instructions – Loading a Base Configuration 1. After connecting to the F5 Training Lab, click the Ubuntu Client icon. 2. Click the Firefox Web browser icon in the left . When prompted, as with a of . 3. In the Navigation pane, expand the System section, and then click Archives. 4. Click the Module2_Lab_begin.ucs archive and then click Restore. It will take a minute to restore the .ucs archive. A status message appears telling you how the configuration process is proceeding. Disregard any error messages (which are an artifact of the training environment) and click OK. 5. Reconfiguring from the .ucs archive installs a known, good configuration at the beginning of the lab. As you can see, after reconfiguring, your system is licensed, has two VLANs (named “external” and “internal”), and four self IPs: 10.10.1.31, 10.10.1.33, 172.16.1.31 and 172.16.1.33.


12-1

12-2


Reconfigure the BIG-IP LTM System A. Create monitors according to the following table Name

Type

Settings

Associations

my_http

http

Interval – 5, Timeout – 16 Receive String – Server Others – leave at defaults

http_pool (Once pool below.)

is

created,

B. Assign monitors according to the following table Name icmp Monitor)

(Default

Type

Settings

Associations

icmp

Use all default settings

Node Default

C. Create pools according to the following table Name

Load Balance

Port

Ratio

Priortity

ssh_pool

Round Robin

172.16.20.1 172.16.20.2 172.16.20.3

22 22 22

1 1 1

1 1 1

http_pool

Ratio Member Priority Group Activation Less than 2

172.16.20.1 172.16.20.2 172.16.20.3

80 80 80

2 2 1

1 4 4

https_pool

Round Robin

172.16.20.1 172.16.20.2 172.16.20.3

443 443 443

1 1 1

1 1 1

Monitors

my_http

D. Create profiles as listed in the following table Name Pr_Src_Persist

Pr_SSL_term

12-2

Profile

Type

Persistence

Source Address

SSL

Client

Parent Profile

Settings

source_addr

Timeout of 30 seconds and mask of 255.255.255.0

clientssl

Create a self-signed certificate: “TestCertificate.” Assign it to this profile. Refer to Lab 7 for example.



12-3

E. Create virtual servers according to the following table NOTE: that persistence profiles are configured on the Resources tab of the virtual server configuration page and that all other profile types on the Properties tab.

Name

IP Address

Port

Resources

Profiles & SNAT

vs_ssh

10.10.1.100

22

ssh_pool

Defaults only

vs_http

10.10.1.100

80

http_pool

SNAT Automap

vs_https

10.10.1.100

443

https_pool

Pr_Src_Persist

vs_ssl

10.10.1.102

443

http_pool

Pr_SSL_term

F. Save your new configuration Back up your new configuration as Lab_Project.ucs.


12-3

12-4


Verification Activity

Questions

Open a browser and connect to http://10.10.1.100 Refresh the screen 5-10 times

Is the system performing load balancing? Why or why not?

Open a browser and connect to https://10.10.1.100 Refresh the screen 5-10 times View the node statistics

Open a PuTTY SSH session to: 10.10.1.100:22 After connecting, ID: student and : student View the node statistics. Open a browser and connect (again) to https://10.10.1.100 Refresh the screen 5-10 times View the node statistics.

Open a browser and connect to both https://10.10.1.100 and http://10.10.1.100 Click the link to show the source address. Open a browser and connect to https://10.10.1.102

12-4

Working?

Is the system performing load balancing? Why or why not?

Were you able to connect? Which node did you connect to? Do you have an open connection? Is the system performing load balancing? Why or why not? Are you connecting to the same node as when tested above?

What is the source address for http and https? Why are they different?

Is the session secure? Is the data from BIG-IP LTM to the server encrypted?



12-5

Review Questions 1. Which s’ s are changed by the BIG-IP setup utility, and what type access do those s get by default (Web GUI or Command Line or both)?

2. What is a node? What are a pool and pool member? What is a profile? What is a virtual server?

3. Name the load-balancing modes.

4. How are monitors created, and to what can they be assigned?

5. If a particular node is in a node-disabled condition, will any types of client requests still be directed to that pool member?

6. What is the difference between the client SSL and the server SSL Profiles?

7. Why would you use SNATs?

This completes the BIG-IP LTM Essentials Web-Based Training Lab Guide. Thank you for taking the time to complete the exercises.


12-5

12-6


Answers to Configuration Project Questions Activity

Questions

Answers

Are you load balancing? Why or why not?

Yes, but should only be using Nodes 20.2 & 20.3 because they have higher priorities for Priority Group Activation

Are you load balancing? Why or why not?

Actually this is a trick question. The first request is load balanced but subsequent requests within the 30 second timeout window should persist to same Node.

Did you connect? Which node did you connect to? Do you have an open connection?

Should have connected ok. You have to go to statistics to figure out which node and your SSH connection remains open until you exit putty or logoff.

Are you load balancing? Why or why not? Are you connecting to the same node as 2 steps above?

Your previous 30 second persistence record should have timed out by now. The first request should go to a different member than previous session and then should persist for another 30 seconds.

For both https and http Click link source address

What is source address for http and https? Why are they different?

http should have a source IP of 172.16.1.33 because of SNAT Automap, and https should have a source IP of 10.10.1.30.

Browser session to https://10.10.1.102

Is the session secure? Is the data encrypted from the Server to the BIG-IP LTM?

The session should be secure (using https) from client PC to BIG-IP, then unencrypted (http) from BIG-IP to Server.

Refresh http://10.10.1.100

Refresh https://10.10.1.100

SSH to: 10.10.1.100:22 with ID and of student View the node statistics

Refresh (again) https://10.10.1.100

12-6



12-7

Answers to Review Questions 1. Which s s are changed by the BIG-IP setup utility, and what access do they have (Web GUI or Command Line)? • root – and it should have access only to command line not the web GUI. • – and it should initially have access only to the web GUI, but command line access can be added 2. What is a node? A pool and pool member? A virtual server? • Node is IP Address only of a server where Pool Member typically contains both IP Address and Port • A Pool is a group of Pool , and the Virtual Server is the client representation of the application. Clients seldom know there are multiple Pool behind a Virtual. 3. List the load balancing modes. • Round Robin is the default load balancing mode but we can also use Ratio, Least Connections, Fastest, Observed and Predictive. • F5 Networks continues to add new features to BIG-IP LTM including new load balancing modes, so you might see more depending on what version you are running. 4. How are monitors created, and what can they be assigned to? • Just like other objects, they are created by selecting Monitors and clicking the create button or the sign from the flyout menu. • Monitors also need to be assigned before they will be used. Monitors can be assigned to all Nodes or an individual Node, or at the Pool level or to an individual Pool Member 5. If a particular node is in a node disabled condition, will any types of client requests still be directed to that pool member? • Yes, client requests can still be directed to a disabled Node if there is still a persistent session (i.e. within the timeout window) • On the other hand, if the Node is istratively “Forced Offline” rather than Disabled then no more client requests will be sent until the Node is Enabled again. 6. What is the difference between the client SSL and server SSL Profiles? • The Client SSL Profile encrypts (https) network traffic between the client and BIG-IP. • The Server SSL Profile encrypts (https) network traffic between BIG-IP and the servers. 7. Why would you use SNATs? • SNATs are used to fix or assist with routing issues. There are MANY ways a SNAT can be used to resolve the many different types of routing issues, two are listed below. o RFC1918 (non-routable) client traffic outbound to internet o Pool default route cannot be pointed at BIG-IP. But --if BIG-IP changes an IP Address then response packet must return through BIG-IP.


12-7

Appendix A – Redundant Pair and High-Availability

A-1

Appendix A Setting up a Redundant Pair and High Availability in BIG-IP Version 10

Setting up a Redundant Pair Configuration of BIG-IP #1 and BIG-IP #2 BIG-IP #1 should now be configured like the diagram shown below and also have Virtual Servers, Pools, Monitors and Profiles. On the next page we will configure BIG-IP #2 from a clean system.

BIG-IP Redundant Pair Configuration

10-2 A-2

Appendix A – Redundant Module 10 PairLab and– High-Availability Redundant Pair

Setup of BIG-IP #2 Lab NOTE: The second system in your lab pair is licensed but not currently configured. Connect to https://192.168.1.246 and run the Setup Utility using the configuration options below.

Step Management Port IP address Management Port Netmask Hostname High Availability Unit ID root SSH Access

System Y 192.168.1.246 255.255.255.0 bigip2.f5trn.com Redundant Pair 2 default * All Addresses

VLAN Name on 1.2 Self IP Address Netmask Port Lockdown Floating IP Failover Peer IP Port Association

Internal 172.16.1.32 255.255.0.0 Allow Default 172.16.1.33 172.16.1.31 1.2 Untagged

VLAN Name on 1.1 Self IP Address Netmask Port Lockdown Default Gateway Floating IP Port Association

External 10.10.1.32 255.255.0.0 Allow Default Leave Blank 10.10.1.33 1.1 Untagged

Status of BIG-IP #1 and BIG-IP #2 Note: You may notice that both BIG-IP #1 and #2 are in an Active state. This is not a desired state, but we will wait to resolve this in the next Module 11 Lab when we setup Network Failover.

Appendix A – Redundant Pair and High-Availability

A-3

Synchronization Lab Synchronization should always be from the system’s whose configuration is desired. In our case, we wish to Synchronize the BIG-IP #1 configuration to BIG-IP #2 since it has no configuration.

BIG-IP #2 configuration before Synchronization At this point, the BIG-IP #2 should have a base configuration set with s, VLANs and Self IPs. the Self IPs (Network / Self IPs) for BIG-IP #2 are set to 10.10.1.xx, 10.10.1.33, 172.16.1.xx and 172.16.1.33.

Synchronizing Configuration from BIG-IP #1 to #2 1. Open a browser to https://192.168.1.245. (BIG-IP #1) 2. From the Navigation pane of the active system, expand the System section. 3. Either select High Availability and then the ConfigSync tab or use the flyout menus to expand High Availability  ConfigSync and click ConfigSync. 4. Click the Synchronize TO Peer button for a push operation to BIG-IP #2. 5. At the Synchronize this BIG-IP LTM to its failover partner prompt, click OK. The synchronization process takes 15-60 seconds. 6. your configuration was copied to the second System.

Expected Results and Troubleshooting •

At this point, the BIG-IP #1 and #2 system configurations should be similar. that BIG-IP #2 has the same Virtual Servers, Pools, Profiles, Monitors and iRules as BIG-IP #1. The License, Hostname and Self IPs (Network / Self IPs) should be different.

•

If the Self IPs are the same for both systems, the following:

• •

The hostnames (System / Platform) should be different (bigip1… and bigip2)

If BIG-IP #2 does not have Virtual Servers from BIG-IP #1, the following:

•

Were there errors during Synchronization? (System / Logs / System)

•

Did you Synchronize the wrong way? (from BIG-IP #2 to #1)

A-4

Chapter A - Appendix A

High Availability Lesson Objective: During this lesson, you will failover features of a redundant pair of BIG-IP systems.

Restoring BIG-IP #1 from previous Lab 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11.

12. 13.

A-4

After connecting to F5 Training Lab, open a browser to https://192.168.1.245. When prompted, as with a of . If you have an existing lab environment, skip to step 10 below. If starting with a new lab environment, on the Welcome / Setup Utility screen click Next. On both the License and Resource Provisioning screens click Next. On the Setup Utility / Platform screen enter a Host Name of bigip1.f5trn.com and change High Availability setting to Redundant Pair. Enter a Root of default twice and an of twice and then click Next. You will be prompted to again because of changing the . After logging in, click the Finished button under Advanced Network Configuration. From the Navigation pane, expand the System section, then select Archives. Click the Module11_Lab_BIGIP1.ucs archive and then click the Restore button. An Ok button appears to acknowledge the restore has started. It will take a minute, but watch this screen and you should see messages that your restore completed successfully. You might receive one error message but that is ok and is due to the F5 Training Lab environment only. Because of the state of BIG-IP, we need to reboot so that our Licensing and Provisioning takes effect. Select System / Configuration and click the Reboot box under Operations. Your configuration should be as if you had just finished all Module 10 labs. Please this is the case. BIG-IP #1 should be licensed and include five Pools, two iRules, five Virtual Servers, and Monitors assigned to some but not all Pool . No Pool should be marked Offline (red) or Disabled (black). It should have a hostname of bigip1.f5trn.com and Self IPs (Network / Self IPs) of 10.10.1.31, 10.10.1.33, 172.16.1.31 and 172.16.1.33.



A-5

Restoring BIG-IP #2 from previous Lab 1. After connecting to F5 Training Lab, open a browser to https://192.168.1.246. 2. When prompted, as with a of . 3. If you have an existing lab environment, skip to step 10 below. 4. If starting with a new lab environment, on the Welcome / Setup Utility screen click Next. 5. On both the License and Resource Provisioning screens click Next. 6. On the Setup Utility / Platform screen enter a Host Name of bigip2.f5trn.com and change High Availability setting to Redundant Pair. 7. Enter a Root of default twice and an of twice and then click Next. 8. You will be prompted to again because of changing the . 9. After logging in, click the Finished button under Advanced Network Configuration. 10. From the Navigation pane, expand the System section, then select Archives. 11. Click the Module11_Lab_BIGIP2.ucs archive and then click the Restore button. An Ok button appears to acknowledge the restore has started. It will take a minute, but watch this screen and you should see messages that your restore completed successfully. You might receive one error message but that is ok and is due to the F5 Training Lab environment only. 12. Because of the state of BIG-IP, we need to reboot so that our Licensing and Provisioning takes effect. Select System / Configuration and click the Reboot box under Operations. 13. Your configuration should be as if you had just finished all Module10 Labs. Please this is the case. BIG-IP #2 should be licensed and include five Pools, two iRules, five Virtual Servers, and Monitors assigned to some but not all Pool . No Pool should be marked Offline (red) or Disabled (black). It should have a hostname of bigip2.f5trn.com and Self IPs (Network / Self IPs) of 10.10.1.32, 10.10.1.33, 172.16.1.32 and 172.16.1.33.


A-5

A-6


Network Failover Lab Objectives: During this lab, you will configure network failover.

Determining State Prior to Configuration 1. Open an SSH session to each system, 10.10.1.31 and 10.10.1.32. Press Enter to update the prompt repeatedly. Note that both systems are in Active state because we haven’t configured Network Failover yet. Note: The F5 virtual environment does not the use of hardware failover cables.

Network Failover Configuration and Testing 1. This feature is not synchronized, so you must configure each system separately. 2. Navigate to System / High Availability / Network Failover. 3. On BIG-IP #1, Enter the following in the Configuration section: Network Failover Peer Management Address Unicast Multicast

Check the box 192.168.1.246 Configuration Identifier: peer_bigip2 Local Address: Self IP address 172.16.1.31 Remote Address: 172.16.1.32 Port: Blank (defaults to 1026) Leave Blank

4. When complete, click Update. 5. On BIG-IP #2, Enter the following in the Configuration section: Network Failover Peer Management Address Unicast Multicast

Check the box 192.168.1.245 Configuration Identifier: peer_bigip1 Local Address: Self IP address 172.16.1.32 Remote Address: 172.16.1.31 Port: Blank (defaults to 1026) Leave Blank

6. When complete, click Update. 7. When both systems have been set, note that the systems change to active-standby mode. BIG-IP #2 should be the one to fallback to standby state because it is unit 2.

A-6



A-7

8. Normally you would remove the Ethernet cable but for remote labs we will disable “Network Failover” on unit #2. 9. How quickly did the standby system change to the active role also? 10. If disabling “Network Failover” on unit #2 does not cause it to go active then you may need to disable Network Failover on unit #1 also. 11. Note that when both systems are in active mode; both are trying to service all virtual servers, NATs and SNATs. 12. Again, normally we would now replace the Ethernet cable but for remote labs we will enable “Network Failover” again on both units. 13. Unit #2 should now fall back to standby state.

Force to Standby and Failover 1. On both BIG-IPs, navigate to System / High Availability / Redundancy. 2. Currently, BIG-IP #1 should be Active and BIG-IP #2 should be Standby. 3. On BIG-IP #1, click the Force to Standby button: Notice that BIG-IP #1 falls back to Standby state, and BIG-IP #2 takes over the Active roll.


A-7

A-8


Connection Mirroring Lab Objective: During this lesson, you will learn how to configure connection mirroring.

Lab Requirements: A working Active / Standby redundant pair of BIG-IP’s.

Create an ssh Pool 1. Create a Pool with the following characteristics, Configuration section: Configuration Level Name Health Monitors

Basic ssh_pool Leave Blank

2. In the Resources section, enter the following: Load Balancing Method Priority Group Activation New For each, enter Address and Service Port and press Add

Round Robin Disabled 172.16.20.1 port 22 172.16.20.2 port 22 172.16.20.3 port 22

3. When complete, click Finished.

Create a Virtual Server that uses this pool 4. Create a Virtual Server with the following characteristics, General Properties section: Name Destination Service Port State

vs_ssh 10.10.1.100 22 (or SSH) Enabled

5. In the Configuration section, accept all defaults. 6. In the Resources section, accept all defaults except the following: Default Pool

ssh_pool

1. When complete, click Finished. Synchronize the configuration 1. Synchronize from the same system (System / High Availability / ConfigSync) and click the Synchronize TO Peer button. 2. Click OK when prompted.

A-8



A-9

Testing before Mirroring 1. Using an SSH client, such as Putty, open an SSH session to: 10.10.1.100:22. 2. as student / student. 3. Test your connection by typing ls <enter> or similar command. Perform Failover 1. Force the Active system to standby (System / High Availability / Force to Standby). 2. Notice that the SSH connection has been lost.

Testing with Connection Mirroring enabled 1. From the same system’s Navigation Pane, click Local Traffic / Virtual Servers and select the SSH virtual server. 2. Select Advanced from the Configuration menu. 3. Check the Connection Mirroring checkbox. 4. Click Update to set changes. 5. Synchronize from the same system (System / High Availability / ConfigSync) and click the Synchronize TO Peer button. 6. Click OK when prompted. Establish a new SSH connection and Failover again 1. Using an SSH client such as Putty open an SSH session to: 10.10.1.100:22. 2. as student / student. 3. Test your connection by typing ls <enter> or similar command. 4. Force the Active system to standby. (System / High Availability / Force to Standby). 5. Test your connection by typing ls <enter> or similar command. Note the connection is maintained.


A-9

A-10


Persistence Mirroring Lab Objective: During this lesson, you will learn how to activate persistence mirroring for a pool where simple persistence in enabled.

Lab Requirements: You must have a virtual server and pool appropriate for persistence other than cookie persistence.

Behavior Prior to Configuring Persistence Mirroring Configure Persistence, Establish an https session 1. From the Navigation Pane, expand the Local Traffic section. 2. Select Virtual Servers and the virtual server vs_https. 3. Select the Resources tab, and ensure that Pr_Src_Persist is still listed as the Default Persistence Profile. 4. Select Local Traffic / Profiles / Persistence and the Pr_Src_Persist profile. Set the Timeout value to 30 seconds and click Update. 5. Synchronize from the same system (System / High Availability / ConfigSync / Synchronize TO Peer). 6. Open a browser session to: https://10.10.1.100. 7. Ensure your session persists by hitting the -F5 key combination several times. View the Persistence Record 1. View the persistence records on both systems. a. From the Configuration Utility, Navigate to Overview / Statistics. In the Display Options section, choose Persistence Records. b. From the Command Line, enter: b persist all show all 2. On the active system, you should see a record. On the standby, you should not. 3. Re-enter this command several times and notice the Age of the record changes. 4. Let the Age count up to 30 seconds and then re-enter the command again. What happened to the persistence record? 5. Refresh the https://10.10.1.100 browser session again and then re-enter the command again. Did the Age count start over?

A-10



A-11

Perform Failover 1. Force the Active system to standby. (System / High Availability / Redundancy / Force to Standby). 2. Refresh the session to https://10.10.1.100. While there is some chance the same node may be chosen, the https session does not persist to the same server. If it does seem to persist to the same node, failover again and test. You may need to refresh by pressing Ctrl-F5 to ensure the browser does not simply display its cache.

Configuring Persistence Mirroring and Testing Subsequent Behavior 1. From the Navigation Pane, select Local Traffic menu, Profiles option, Persistence tab, and then click the Pr_Src_Persist profile. 2. Check the Custom box for Mirror Persistence, check Enabled, and then click Update. 3. Synchronize from the same system (System / High Availability / ConfigSync / Synchronize to Peer). 4. Make sure to check that the Mirror Persistence option was set on the other System for the Pr_Src_Persist profile. Re-establish the https session, failover and retest 1. Open a browser session to https://10.10.1.100. 2. Ensure your session persists by pressing the CTL-F5 several times. 3. Force the Active system to standby. (System / High Availability / Redundancy / Force to Standby). 4. Refresh the browser session to https://10.10.1.100. Notice that the https session does persist to the same server. 5. View the persistence records on both systems. a. From the Configuration Utility, Navigate to Overview / Statistics. In the Display Options section, choose Persistence Records. b. From the Command Line, enter: b persist all show all 6. You should see a persistence record on both systems. 7. Re-enter this command several times and notice the Age of the record for each system. Does the Age remain the same on both Systems? 8. Refresh the https://10.10.1.100 browser session again and then re-enter the command again. Explain the Age count on each system?


A-11

A-12


A-12


254339736 F5 Big Ip Ltm Essentials Wbt Lab Guide V11 6r3l49

Overview 6h3y3j

More details h6z72

Related Documents 543cg

254339736 F5 Big Ip Ltm Essentials Wbt Lab Guide V11 6r3l49

F5 Big-ip Ltm Essentials Wbt Lab Guide V11 5y323m

F5 Ltm istering Big-ip V11 296y6s

284657446-f5-configuring-big-ip-ltm-v11-student-guide.pdf 3qn6g

F5-configuring Big-ip Ltm V11 Student Guide.pdf 533s6v

F5 - Configuring Big-ip Ltm V11 - Instructor Ppt v1j2z

More Documents from "Karan Mehta" 363a26

Competitive Analysis 49tj

137892702-kyrion-ethical-hacking-workshop-handouts.pdf 69126k

254339736 F5 Big Ip Ltm Essentials Wbt Lab Guide V11 6r3l49

Troubleshooting Bgp A Practical Guide To Understanding And Troubleshooting Bgp-1 2q6a71

The 75 Kpis Every Manager Needs To Know 3mm2r

Arduino Severino Manual 555r6y