Moving ASM to Standalone Configuration

I can tell you that we have something similar currently deployed. Our LTMs and ASMs are on seperate hardware. Basically we run LTMs and ASMs in our DMZ and then LTMs on the internal network in front of the servers. So the traffic for an external facing web application hit the LTM gets load balanced to an ASM and the ASM runs the traffic through policy, then sends the traffic to an internal LTM pool which load balances it to a server. This design has worked pretty well for us. Let me know if you have any specific questions

 

Thanks so if you check page 3 on the deployment guide;

 

http://www.f5.com/pdf/deployment-guides/big-ip-ltm-asm-dg.pdf

 

Do you have something like this?

 

 

So on your LTM you have all your Virtual servers defined "exterior" the traffic is then passed onto the ASM which runs its policy on the traffic, then sends traffic to an internal virtual server or pool back up to the LTM that then load balances to your web servers?

 

 

Are your ASM's in an Active/Active setup behind the exterior Virtual server on the LTM?

Similar but actually our external and internal LTMs are physically seperate devices. The externals live in a DMZ behind our firewall and the internals, obviously live behind a firewall on our internal network.

 

 

Yes our ASMs are both Active behind the external LTM.

 

 

I guess it would depend how you feel about the security of VLANing if you wanted to use the design concept in this document. Personally I prefer the physical separation of the 2 LTMs. From a security perspective having the external LTM out in a DMZ allows us to only allow the ASMs access to the internal LTM. I would rather have the external traffic stop in the DMZ and be proxied by the ASM, that way the external requests are never directly going to a device on our internal network.

 

Thanks Mike

 

 

We currently have LTM and ASM running on the same unit anyway but will take the security concern into consideration.

 

 

Does anyone know if F5 are able to exchange the LTM licenses that the new units came with for ASM licenses?