Forum Discussion
PeteTheFarmer_3
Nimbostratus
NimbostratusUsing dynamic IPs in a Virtual Server
Hi Team,
We use an Australian based SMS provider, whisper, to send OTPs to mobile devices. I've setup a http authentication server that constructs the SMS that sends the SMS' to Whisper's api.whisper.com address.
api.whisper.com only accepts https connections so I setup two virtual server's both of Whisper's destination IP addresses (they use DNS RR with 2 IPs) listening on port 80, then I created a pool, then finally some nodes using the hostname: api.whisper.com on service port 443 so the connection to whisper will be on 443.
I also enabled FQDN auto populate and the associated the pool to both virtual servers.
The problem is that api.whisper.com lives in Amazon EC2 and the hostname's IP address constantly changes. Therefore, I have to constantly update the VS IP address to match - this is not a problem for the pool of nodes because auto-populate updates the addresses dynamically for me. How can I dynamically update the Virtual servers to match the ever-changing IP's of the hostname api.whisper.com?
SMS OTP works perfectly using the above scenario - except when the IP dynamically change.
Thanks!
Pete
Stephane_ViauWhy do you have your clients connecting to api.whisper.com? Can you have them connect to another hostname instead that would have a static IP? And then you can still forward the requests to the "true" api.whisper.com servers.
PeteTheFarmer_3Nah, no users connect to this. There is a static VS for users. This setup is only for http authentication purposes (ie: the mechanism that sends an API string to api.whispir.com).
BigIP won't let me configure a https host in my http authentication server (ie get this error: 01071346:3: In AAA HTTP server (/Common/myportal_aaa_whispir_sms_gateway), Using Http auth agent against SSL backend is not allowed, please, create a layered virtual server with serverssl profile).
So I did - that's what I created with the help of some f5 support techs.
api.whispir.com only works with https, they reject http connections, so with the help of f5, I created a VS on port 80 for the IP destination address (ie: what api.whispir.com resolves to) and then use nodes and pool lists to communicate out on 443 to api.whispir.com.
cjuniorNacreous
Interesting this implementation,
So, and what about create a wildcard virtual server "0.0.0.0/0:80" and an iRule that checks name resolution (RESOLV::lookup) or getting adresses from list members whitin fqdn pool (active_members -list ) and accepting connections only to that match destinations?Just an idea.
Brad_Parker_139Why not just make your http AAA server a hostname you control with those api.whispir.co FQDN nodes in the pool and then use an iRule to change the host header to api.whispir.com on the server side?
Ruggerfly1Implementing in the same type situation - haven't finished testing but for the VS I used a made up IP for the destination, made sure Vlans and tunnels was set to Enabled on - in the selected box empty. Then created a Host entry under System DNS for the FQDN to that IP. Since it's static local the F5 should never try to resolve off box, then use the FQDN nodes for the pool. Used the resolved Cnames for the pools members.
Just an option. Follows what Brad noted.
Brad_ParkerCirrus
Why not just make your http AAA server a hostname you control with those api.whispir.co FQDN nodes in the pool and then use an iRule to change the host header to api.whispir.com on the server side?
- Ruggerfly1
Implementing in the same type situation - haven't finished testing but for the VS I used a made up IP for the destination, made sure Vlans and tunnels was set to Enabled on - in the selected box empty. Then created a Host entry under System DNS for the FQDN to that IP. Since it's static local the F5 should never try to resolve off box, then use the FQDN nodes for the pool. Used the resolved Cnames for the pools members.
Just an option. Follows what Brad noted.
- PeteTheFarmer_3
I like the idea - I tried to specify the entire Amazon EC2 range of IPs for the Sydney region but it didn't work - looks like I might need the iRules to match the pools. I think this is what I was missing.
- PeteTheFarmer_3
I ended up with my own solution. My feeble brain couldn't figure out how to do any of the suggested answers with success. The biggest issue for me was to resolve the layered virtual server and the only way I know how to do that was to update the IP's of my two Virtual Servers that represent Whispir's two IP addresses.
My solution, while not very elegant or really aligned with best practice, was to create a bash script that compares latest resolved DNS entries for api.whispir.com (both of them) using DIG against the current Virtual Server IPs (there are two VS's, each with a different IP) - if any of them are different, then update the virtual server destination address with the new IP via a tmsh command.
I use cron to run the script every 5 minutes to ensure I capture any recent changes.
Like I said, not elegant and my scripting skills are novice at best but so far, it's been working a treat for me.