Forum Discussion

Sonny's avatar
Sonny
Icon for Cirrus rankCirrus
Oct 01, 2015

Configuring VS to access LTM

I have 2 management interfaces, x.x.10.1 and x.x.20.1. I normally access the device through 20.1. So I created a vs to access 10.1. However, looking at the tcpdump, I don't see any response back from 10.1 when I access it through the vs. Thus, I get page cannot display. IF I access 10.1, without going through the vs, it works fine. Just wondering if anyone knows what the issue may be off the top of their heads.

 

The reason I created a vs to access the device was so I can apply an access policy I created to use 2FA. The policy authn the user against the LDAP and then if successful will prompt for your CAC and then does a check for validity and if successful, allows the user to the pool member. In this case, 10.1. From the tcpdump, I see this happening. Again, I just don't see and response from 10.1.

 

  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    Oct 01, 2015

    Okay, I just booted into 11.6HF5 and can confirm that it works it you point the node command at the management port IP (not a VLAN self IP).

     

  • Sonny's avatar
    Sonny
    Icon for Cirrus rankCirrus
    Oct 01, 2015

    Correct, 10.1 is the management port. 20.1 is the self IP. I noticed you used brackets [] for the IP...if I used them, I get "undefined procedure" message.

     

  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    Oct 01, 2015

    I'm using brackets to indicate "put some data here".

    when ACCESS_ACL_ALLOWED {
    node 192.168.1.245 443
}
  • Sonny's avatar
    Sonny
    Icon for Cirrus rankCirrus
    Oct 01, 2015

    okay, still scratching my head on why it works for you and not me. I'll noodle on it. Just to correct my earlier post, the irule in place is:

     

    when ACCESS_ACL_ALLOWED { node x.x.10.1 443 }

     

  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    Oct 01, 2015

    Yes, but to be absolutely clear:

    1. This is the management port IP, not a VLAN self-IP

    2. Serverssl must be applied to the APM VIP

    Try this. Just create a very simple access policy with a logon page and test your config with that:

    start -> logon page -> allow
  • Sonny's avatar
    Sonny
    Icon for Cirrus rankCirrus
    Oct 01, 2015

    Yes, it's the management ip...from bigip_base.conf: edition "Engineering Hotfix HF5" hostname XXXXXXXX key /Common/dtdi.key management-ip x.x.10.1 marketing-name "BIG-IP 10200"

     

    "serverssl must be applied to the APM VIP"? I'm not sure what you mean with this statement. My VS uses a clientssl. It doesn't work when a server ssl profile is used. How would apply a serverssl profile to APM VIP?

     

    I tried the simple access policy and it has the same results: 2015-10-01 12:57:54 Following rule 'fallback' from item 'Logon Page(1)' to ending 'Allow'

     

  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    Oct 01, 2015

    "serverssl must be applied to the APM VIP"? I'm not sure what you mean with this statement. My VS uses a clientssl. It doesn't work when a server ssl profile is used. How would apply a serverssl profile to APM VIP?

     

    The management GUI is only listening on port 443 HTTPS, so you absolutely have to have a server SSL profile applied to the VIP.

     

  • Sonny's avatar
    Sonny
    Icon for Cirrus rankCirrus
    Oct 01, 2015

    Okay, I've never applied a server SSL profile to a management VIP. How would you go about it? I'm on system, platform, config and I don't see anywhere I can apply one.

     

  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    Oct 01, 2015

    No. In order to use APM in front of the BIG-IP management GUI, to achieve 2FA, you're going to have to create a standard LTM virtual server with an access policy. In that LTM virtual server you're going to have to apply an HTTP profile, the access profile, a client AND server SSL profile, and the aforementioned iRule. I'm not quite sure what you mean by "management VIP". You can't use the BIG-IP VLAN self-IPs here. 

    client -> standard HTTPS APM VIP -> iRule -> BIG-IP management port IP:443

    Instead of a load balanced pool, you're using an iRule with the node command to send the traffic to a specific IP: the management port IP. And because the management port is only listening on HTTPS 443, you need a server SSL profile on the LTM/APM VIP.

  • Sonny's avatar
    Sonny
    Icon for Cirrus rankCirrus
    Oct 01, 2015

    I get what you are saying. I think we had a misunderstanding. Yes, I created a VS applied the AP and the client and server profiles along with the irule.

     

    ltm virtual /Common/vs_CAC_test { description "Testing CAC and AD authn" destination /Common/x.x.20.254:443 ip-protocol tcp mask 255.255.255.255 profiles { /Common/ap_simpleLogon { } /Common/apm-default-serverssl { context serverside } /Common/clientssl-eis2-lbtest { context clientside } /Common/http { } /Common/rba { } /Common/tcp { } /Common/websso { } } rules { /Common/irule_LTM_access } source 0.0.0.0/0 translate-address enabled translate-port enabled }