Forum Discussion
NimbostratusF5 LTM as Reverse Proxy
Thanks--Chenna
17 Replies
HamishCirrocumulus
Just treat it as normal really... Think of the reverse proxy as really just load balancing over one backend... Since the number of backends is pretty much irrelevant (Assuming you can do persistence, and since you say web servers you can do active cookies), you can forget that bit.
The more important question is what functionality do they want to achieve from using the 'reverse proxy'?
Client Authentication? No problem, it's a separate license module though I think...
Authorisation? Hmm... That's a good question... I'm not sure how you'd do something like lookup arbitrary attribute sin an external LDAP (Or similar) directory for authorisation decisions...
You may still need some external web host to do the authorisation lookups for you... And then scrape the results from the reply and put them in persistence records for later... Hmmm... I wonder if iRules are flexible enough to do a separate lookup itself against an auth service then direct the user request based on the results of that... Anyone?
H
wowchensThanks for the response. Actual requirement is something like this:
Internet
|
|
External Firewall
|
|
F5 LTM
|
|
Internal Firewall
|
|
Servers
Excuse my poor drawing skills. F5 will be acting like a DMZ between actual servers and internet users. For the most part, its a straight forward configuration where in requests come in from internet, land on the firewall, get NATed to a private IP which is local only between F5 and Ext Firewall, gets to F5, F5 will have a VIP listening on the NATed IP and F5 sends to internal firewall, internal firewall NATs it again to the actual core IP on the server VLAN and send to servers.
I don't know if this is a feasible solution yet since this is all in the POC stage right now.
Please give your recommendations.- HamishYes it's feasable, but why are you NAT'ing so many times*? Is there a problem with your network numbering? Supporting legacy addresses where people haven't configured things correctly?
One thing I would note is that I'd normally configure the F5 directly in front of the servers. (Usually by moving the serves to a DMZ behind the F5's). The internal firewall doesn't seem to be gaining you anything... (** Assuming this is a new requirement and not simply a new requirement to load balance existing internal only servers from external).
e.g.
Internet -> Firewall -> (F5 -> Servers) all in a DMZ.
or
Internet -> Ext Firewall
\
F5 -> DMZ with Servers
/
Internal -> Internal Firewall
(So the F5 becomes the router to/from your DMZ's).
More info as to your reasoning & what can or can't be altered may help...
H
* - I don't adhere to the commonly mis-stated view that NAT'ing is automatic security... 
Yong_Yuen_ChongI used to work in a telco and my setup is something like hamish mentioned. I placed a pair of Apache Reverse Proxy servers in the DMZ who will then direct traffic to App tier servers (in the backend). I guess this is the best and cleanest.
Now that I am in another company, I seem to have similar requirement as dchenna, that is, using F5 as the reverse proxy server. I think it is feasible and am still figuring out how to do it since F5 needs to see the servers that are configured in the pool.
Anyone can help?- Hi,
I am looking to do something similar and was wondering how the OP went with their implementation.
Thanks. 
L4L7_53191This will work. Just remember that if you want to do anything intelligent with the traffic you'll need to have a NAT for each pool member so the BigIP can do traffic management. Another idea is to have another BigIP pair downstream (behind the internal FW) that will do your heavy lifting with traffic management. You'd point to these Virtual Servers from your "proxy" BigIP. While you'd need another pair, it would give you the maximum flexibility.
It sounds like the goal may be to collapse a farm of reverse proxies into a BigIP pair, correct? This sounds like a perfectly valid use case to me.
-Matt- Neeraj_Jags_152
Cirrus
I have similar requirement. Source= Internet --> Ext Firewall --> F5 LB doing Proxy --> Int Firewall --> F5 LB --> Pool Member
Both F5 LB are same physical device. but different route domain means different VLAN and so between VLAN firewall required.
is it feasible solution and what else needs to take care.
- nitass
Employee
is it feasible solution
why not? :)
- Kevin_Stewart
One could argue that you wouldn't necessarily need the internal firewall layer here. The BIG-IP appliance is a default deny device and can itself perform firewall functions. What you're asking for can absolutely be done, but you could reduce complexity by removing the inner firewall layer.
- Neeraj_Jags_152
Kevin, Agree with you. but firewall should be there as per customer. and outside traffic should not hit directly to F5-LB, that is why F5-PROXY-LB placed before that.
I have configured the same however pool is down and so virtual server is down.
ports and traffic is open.. Checked SSL dump traffic via command line at LB and found that handshake is being done between both LB instances (PROXY-LB and int-LB) but final RST packet seen,, why ?
Regards, Neeraj
