Super-NetOps

217 Topics

301a Study Guide and Lab
Hello, I have an old link for 301a and b exam prep materials on clouddocs.f5.com, but its seems missing now? Any idea where it was moved? This was the link I had https://clouddocs.f5.com/training/community/f5cert/html/class7/modules/module1.html Thanks, Joanne
Solved
joanne2019
Apr 02, 2021 Place Technical Forum
4KViews
1like
8Comments
iRule to decrypt and rewrite RADIUS User-Password AVP
In the RADIUS protocol, the user's cleartext password is transmitted inside Attribute-Value Pair (AVP) 2, padded with null characters as necessary, and then encrypted by the shared secret by XOR'ing it across the authenticator somehow or other. The technical details of how this works is a bit above my level of understanding as I'm not a cryptography expert. We have an infrastructure where our PAN VPN Gateway prompts a user for their username and password. In our environment, after the password, the user appends a fixed-length HOTP token from a Yubikey. The backend FreeRADIUS server has been configured to decrypt the password received, extract the fixed-length token, and perform backend checks to our LDAP and token servers. FYI, the password is encoded as PAP prior to RADIUS encryption in our setup, which is why this works; CHAP would prevent this from working. We've been having trouble with the stability of our FreeRADIUS server and we would like to leverage our much more stable Aruba ClearPass infrastructure which is load balanced globally with our GTMs and LTMs and highly stable. This also moves control of the RADIUS piece away from the systems team and onto the network team (me, specifically). Unfortunately, ClearPass doesn't have a direct mechanism to break the password from the token, and PAN doesn't have a way to transmit the token separately. This is where we would like to leverage an iRule. Basically, the way I envision this working is as such: Decrypt the password+OTP that is received from PAN using the authenticator value and shared secret Rewrite AVP 2 as just the password, encrypted by the shared secret (make sure to adjust the length of the AVP) Insert AVP 17 (which is not defined by the IEFT) with the token (ClearPass can be configured to look for this by modifying its RADIUS dictionary). Rewrite the length value at layer 7 if necessary - not sure if this would happen automatically by the F5; probably not. Ship the modified RADIUS packet to ClearPass I know how to accomplish all of this on the ClearPass side, but my dev skills are weak, I'm not very familiary with Tcl, and I don't have a solid understanding of how to encrypt/decrypt the password correctly. I've search high and low but the only solutions for decrypting the password seem to be written in languages that are even more difficult to understand like C. I obviously understand it is too much to expect someone to write the entire solution for me, but any advice on where to start would be very helpful. I think the trickiest part for me would be the encrypt/decrypt step.
Solved
Tim_Haynie_3150
Oct 11, 2018 Place Technical Forum
2.8KViews
0likes
21Comments
How to config BGP peering for F5 in HA-pair?
Hi I've setup F5 BGP peering with router and have problem due to we can't use floating IP as IP BGP neighbor address https://support.f5.com/csp/article/K62454350 . So we need to use self IP as IP BGP neighbor address. Problem is It's make router can't decide which path is correct when they send response traffic to F5. F5 active unit or standby unit. Router can't know status on F5. I try to add prepend on BGP which is standby unit and it's fine. but when standby unit takeover . it's failed again. Is there a way to deploy BGP with F5 HA-pair? Thank you
kridsana
Jan 29, 2021 Place Technical Forum
2.7KViews
0likes
2Comments
Tcpdump Capture
Hello, I am trying to do a packet capture on the F5 LTM where F5 is just acting as a gateway however i am not able to capture the complete tcp stream, i just get the tcp 3 way handshake packets and there is no application data.. Below is the syntax i am using, Please help. tcpdump -s0 -venni 0.0:nnnp -w/var/tmp/dot_slowness_5.pcap host x.x.x.x Where x.x.x.x is the source ip address.
Solved
Ashu
Aug 24, 2020 Place Technical Forum
2KViews
2likes
2Comments
CLI command to see load balancing method for all Virtual Servers?
Is there a command in CLI I can use to display the load balancing method for all virtual servers? Thanks.
gdoyle
Feb 20, 2018 Place Technical Forum
1.6KViews
0likes
2Comments
Crontab for backups - Entries not running
Trying to configure a cron-based daily backup for a vCMP guest, running v13.1.1. As root, using crontab -e, I've added the following lines: 27 8 * * * /usr/bin/tmsh save sys ucs config1.ucs 29 8 * * * /usr/bin/scp /var/local/ucs/config1.ucs user@server:/backups/config1.ucs After exiting, I've verified the changes have saved. Logs reflect that a change has been made. These jobs never happen based on the timestamp of the backup not changing, nor is either job recorded in the logs. I can manually run the same command, and they work successfully. Any help is appreciated.
Solved
Chuck_383680
Feb 13, 2019 Place Technical Forum
1.6KViews
0likes
22Comments
Redundancy Between two Data Centers
Hello guys, I working on a new solution for the client. Client will be connected with two MPLS circuits to primary data center (A), and another two MPLS circuits to stand by data center (B). I would like to failover to B only if it's necessary (big outage in A or maintenance). There will be layer2 between A and B (for different VLANs, like SQL replication, application, LTM network etc.). All LTM appliances will be virtual. I have two questions please: Could I have a cluster with 4 LTMs (2 in each location), and in case of ESX/VM/storage/etc. failure, the virtual IPs will be moved to B LTMs? (all traffic will go over layer 2 circuit between two location. I had a quick conversation with someone from f5, he mentioned that it's not a good idea to create one environment from two different locations. Do you know what is the downside or potential problems? Is there a better way to design it? The most important factor here is that the environment will be highly available (99.97% or more) Thanks for your input!
Shurik
Nov 27, 2020 Place Technical Forum
1.5KViews
0likes
2Comments
AS3 declaration
In all the example declarations I've seen so far, it lists the virtual server name as serviceMain and if I deviate from that by giving it my own virtual server name like testme123.example.com-80 it complains about not using serviceMain. How can we supply a different VS name on an AS3 declaration? Here is the error message. I used a Python get request to send the declaration. I'm using a Simple HTTP AS3 declaration. ('Status Code:', 422, '\n', u'{"code":422,"errors":["/Sample_01/A1: should have required property \'serviceMain\'"],"declarationFullId":"","message":"declaration is invalid"}')
Solved
Anthony_Pineda
Feb 26, 2020 Place Technical Forum
1.5KViews
0likes
2Comments
Using an asynchronous task | Creating UCS File
Hi, I am trying the following REST URL to create a task to generate a UCS File: Method: Post URI: mgmt/tm/task/sys/ucs/ Body: {"command": "save","name": "UCS01" } So, I get back: { "_taskId": 1563464422689504, "_taskState": "STARTED", "_taskTimeInStateMs": 0, "_taskResultLink": "https://localhost/mgmt/tm/task/sys/ucs/1563464422689504/result?ver=12.1.3.4", "selfLink": "https://localhost/mgmt/tm/task/sys/ucs/1563464422689504?ver=12.1.3.4" } Now, when I do check the status: Method: Get URI: /mgmt/tm/task/sys/ucs/1563464422689504 I gel back: { "selfLink": "https://localhost/mgmt/tm/task/sys/ucs/1563464422689504?ver=12.1.3.4", "_taskId": 1563464422689504, "_taskState": "COMPLETED", "_taskTimeInStateMs": 5000, "_taskResultLink": "https://localhost/mgmt/tm/task/sys/ucs/1563464422689504/result?ver=12.1.3.4" } When I go to /var/local/ucs, I don't see the UCS created. ** Maybe I am missing something. Please advise ** ----------- If I don't use the "task" option, then it will worked. But I would like to use the task option to take advantage of asynchronous tasks ---- Thank you
Solved
Julio_Navarro
Jul 18, 2019 Place Technical Forum
1.4KViews
0likes
6Comments
(usefull) config export to csv for partitions
Hello, I wrote a shell script to export the most important config to a csv file. This was inspired from some other posts. The script runs on bash from a LB. For the CSV import to excel, you need to change the column B(named as VIP) to TEXT and enable word-wrap to the hole chart. The script collects field by field from running system. If you have a lot of configuration it can be need some time to finish. You can start with SCRIPTNAME PARTITION > EXPORTcsv direct from bash not tmsh. I hope it helps somebody, Cheers NetSnoopy
NetSnoopy
Apr 04, 2019 Place Technical Forum
1.3KViews
2likes
4Comments