Certificate server name issue--wildcard certificate
Hello all, I have one virtual server, and I have a policy behind it that redirects to multiple pools. The problem is that my customer requested a certificate for a few applications and requested it as wildcard.xyz.com. However, the application has two dns records as xyz.com and www.xyz.com. Of course, when I call the page as xyz.com, I get a certificate error (not a secure connection). Here, my policy record is as follows: if the host "xyz.com or www.xyz.com" is owned by the host, redirect the traffic to the xyz-pool. I wrote a redirect irule to overcome this. But it didn't work. The rule is like this: when HTTP_REQUEST { if {[HTTP::host] equals "xyz.com"} { HTTP::redirect "https://www.xyz.com[HTTP::uri]" } } anyone have any ideas or suggestion? Thank you in advance for your answersBIG-IP VE in Red Hat OpenShift Virtualization
Running BIG-IP VE in OpenShift Virtualization allows for VM and modern apps/Kubernetes to convergence, simplifying management and operations. This article covers best practices for running BIG-IP VE in the KubeVirt (KVM) implementation by Red Hat. All the best practice recommendations in this article are aligned with the OpenShift Virtualization Reference Implementation Guide.
Help me understand Load Balancing
Good afternoon everyone, I am hoping someone can help me understand the difference between something that is "failing a healthcheck" in an F5 and something that is "Forced Offline" and how the load balancer would react to both. At my company I notice that if I have a server failing the healthcheck in the load balancer, that load balancer will still send requests to that server experiencing issues. But if I force that server offline manually, then the load balancer respects that the server is down and doesn't send it any requests until we bring it back up manually. Is this the expected behavior from an F5 load balancer? Or does it depend on the version of the device in question or the software? According to the manager that runs this system, they are telling me this is how it is and that the load balancer isn't "smart" enough to know unless we manually force it offline. Does this pass the sniff test or they being misleading? To me this sounds misleading at best. Because what is the point of having an active health check if the load balancer is still going to send requests to servers that fail the health check? I am just trying to educate myself on this and since this is not my area of expertise. I would think a load balancer should be smart enough OOB to handle functionality like this. But I also want to make sure I am not "inventing" functionality that may not be there or is supported through a different license. Any type of info would be appreciated and thank you in advance for anyone who takes the time to read and reply to this post! Respectfully, Brian Jones
Help configuring NAT64 on a BIG-IP LTM
I have been trying to implement NAT64 in our network in order for IPv6 only clients can reach our IPv4 only servers. Ive create an IPv6 VIP and enabled the nat6to4 option and port and address translation are enabled. VIP: ipv6 Pool: IPv4 Snat: Auto map when i do #show sys connection cs-server-address 2a:66:x.x.x.xx client IPaddress VIP ip address floating ip address node 2a:45:33.xxx 2a:66:x.x.x.xx any6 any6 I able to see the client IPv6 address reaching to the VIP. But the F5 is not loadbalancing to the backend server How can i make this to work Any help would be greatly appreciated.
Check how long it takes for a request to switch from a pool member to another if one is not available
Hello there :) I'm trying to find out how long it takes a request to switch from a pool member to another if one is not available. For example : I have a configuration for load balancing that includes a pool with 2 members (A and B) Let's say Server 'A' is unable to handle a request, and so it should be transfered to Server 'B'. Is there any way to check the duration of this switch? How long it takes for the request to be transfered from A to B after A becomes unavailable? Thank you!BIG-IP syslog - send logs with UTC timezone, while APM is in different timezone
Hi, I'm lookign for a way to send out logs to remote syslog server with UTC timestamp. APM is using corporate NTP server that are in GMT +1 time zone and that's how the logs are being send. I tried to edit /sys syslog all-properties and add something like below to have date in ISO format + timezone amended. However as ISODATE is working, time_zone variable is not ( I tried it with "UTC", "GMT, "-01:00", etc) Any other options I could use ? options { proto-template(t_isostamp); }; template t_isostamp { template(\"$ISODATE $HOST $MSGHDR$MSG\\n\"); }; destination d_remote_loghost { tcp(\"x.x.x.x\" port(514) template(t_isostamp) time_zone(UTC)); }; "Is anyone using Certbot for F5 certificate automation? If not, what tool do you use?
Currently, I'm having to manually update certs on our F5 and I'm wondering what other people are using to automate this. We use Sectigo which supports the Certbot F5 plugin, but a fellow tech that tested it said it doesn't work when a vserver has more than one SSL profile assigned. Is anyone using the Certbot tool? If not, what tool are you using? I like to be able to automate this (and be confident it "just works"). Thanks!VIPTest: Rapid Application Testing for F5 Environments
VIPTest is a Python-based tool for efficiently testing multiple URLs in F5 environments, allowing quick assessment of application behavior before and after configuration changes. It supports concurrent processing, handles various URL formats, and provides detailed reports on HTTP responses, TLS versions, and connectivity status, making it useful for migrations and routine maintenance.
