For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Thompso7540_201's avatar
Thompso7540_201
Icon for Nimbostratus rankNimbostratus
Oct 12, 2015

Deciding on vCMPs

We've purchased a bigip 5050v that will run the following modules: APM, LTM, and ASM (replacing an old Cisco WAF). Our SE told us that ASM requires four cpu's; but we might use less than that because we only have one application that requires appfirewall. The LTM guest will have partitions and route-domains.

 

Would you suggest one for APM, one for LTM, one for ASM, and one spare?

 

Also, can you adjust the resources of the guest after it's been created?

 

thanks,

 

advanced firewall manager
application delivery
ASM Advanced WAF
deployment
design
LTM
security

1 Reply

  • R_Marc's avatar
    R_Marc
    Icon for Nimbostratus rankNimbostratus
    Oct 12, 2015

    I, personally, wouldn't separate them out by function. I would only create separate VCMP instances out if you had, say, a reason to:

    1. Load balance on different segments, so a VCMP guest per segment, and that really depends on your security posture, since you didn't say anything about AFM (so there wouldn't be FW's between segments in this case).
2. If it's to be on a single segment, if you had apps with different maintenance windows or different user role/access requirements (but there would have to be, IMNSHO a really, really strong case to warrant the latter).

    Otherwise, you'd have to maintain, ostensibly, duplicate configs if you had different guests for different functions and that's just asking for outages and troubleshooting nightmares.