For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

ed_torres_18109's avatar
ed_torres_18109
Icon for Nimbostratus rankNimbostratus
Feb 11, 2015

Hi Stephan, Great information, appreciated, thank you.

 

When it comes to the right topology, would you think that Best Practice would be:

 

1) Have a layer 2 switch between the BigIP and the router? For example, just have BigIP 1.1 attached to SW1 g0/1, and then SW1 g0/2, g0/3 attach to Router A/B respectively.

 

2) Or, have BigIP attached to Routers A/B directly (no devices in between). For example, BigIP 1.1 attached to Router A, and BigIP 1.2 attached to Router B. This topology would utilize 2 interfaces in the BigIP (1.1 & 1.2).

 

Again, your comments are much appreciated...Thanks...ET

 

  • StephanManthey's avatar
    StephanManthey
    Icon for Nacreous rankNacreous
    Feb 11, 2015
    Hi Ed, since a couple of infrastructure components support virtual trunks/channels (aggregated links with LACP across multiple physical switches/routers acting as as single virtual switch/router) this becomes a more common approach from my perspective. I.e. this would mean to have a trunk coming from a BIG-IP controller being connected to two physical switches. TMOS currently does not have this virtual switch capability. This way you get redundant uplinks from each BIG-IP controller of your sync-failover device group. Alternatively I see U-shaped connectivity: means there is a trunk (aka Cisco channel) between routers and single trunks to get each load balancer connected. Using trunks provides link redundancy and increased throughput. Make sure to use LACP in active short mode to recognize link failures as soon as possible. Link availability can be used in HA groups to force traffic-group failover. If possible, avoid using spanning tree. Of course it may help in case of two components fail, but it adds complexity and sometimes has interoperability issues. If you still want to mesh, just leave the BIG-IP in spanning tree path through mode. Additional switches are not necessary from my perspective. Thanks, Stephan