Forum Discussion

Sergio_Magra's avatar
Sergio_Magra
Icon for Nimbostratus rankNimbostratus
Aug 13, 2018

Deploying ISP load balancing

Hi all,

 

We already have 2 BIG-IP APM behind 2 Cisco Firewalls. We want to use the same BIG-IP for load balancing between 2 ISP links (I think, in front of the firewalls). We already have a full license, so we can configure the BIG-IPs for doing that.

 

We have experience in LTM and APM, but not in load balancing ISP links.

 

Today, the APM module consumes 2 network ports for incoming traffic from internet and for internal traffic.

 

We think in add 3 more network ports (2 for ISPs and the 3rd for traffic going to Firewall).

 

Is it a good idea to have the same BIG-IP Hardware in front of and behind the Firewall?

 

On the other hand, for incoming traffic, is it strictly necessary to delegate DNS traffic to BIG-IP? Is it not possible for BIG-IP to send an update to the external DNS server, every time the ISP links fails?

 

Thanks in advance

 

Best regards

 

application delivery
BIG-IP Access Policy Manager (APM)
BIG-IP DNS
  • youssef1's avatar
    youssef1
    Icon for Cumulonimbus rankCumulonimbus
    Aug 13, 2018

    Hi Sergio,

     

    It is possible of course. you can even use the RD (Route Domain) to isolate the apm stream from the LC stream. If you want to use RD let APM part in RD 0 it will more simple.

     

    Let me know how I can help you to achieve your need.

     

    Regards

     

  • Techgeeeg_28888's avatar
    Techgeeeg_28888
    Icon for Nimbostratus rankNimbostratus
    Aug 14, 2018

    Hi Sergio,

     

    What you are trying to achieve is possible. Below i am listing as to how...

     

    1. The current physical connectivity of your F5 box is serving APM.

       

    2. In order to use the same unit for Link (both in & out bound) Load balancing it's better to use separate physical connectivity.

       

    3. This new connectivity should be in a fashion that F5 comes between F5 & Firewall.

       

    4. All of your Public IP addresses will terminate on F5.

       

    5. To ensure complete separation you can create a new Route-domain for LC part.

       

    Regards, Techgeeg

     

  • Techgeeeg's avatar
    Techgeeeg
    Icon for Nimbostratus rankNimbostratus
    Aug 14, 2018

    Hi Sergio,

     

    What you are trying to achieve is possible. Below i am listing as to how...

     

    1. The current physical connectivity of your F5 box is serving APM.

       

    2. In order to use the same unit for Link (both in & out bound) Load balancing it's better to use separate physical connectivity.

       

    3. This new connectivity should be in a fashion that F5 comes between F5 & Firewall.

       

    4. All of your Public IP addresses will terminate on F5.

       

    5. To ensure complete separation you can create a new Route-domain for LC part.

       

    Regards, Techgeeg