Create a BIG-IP HA Pair in Azure
Use an Azure ARM template to create a high availability (active-standby) pair of BIG-IP Virtual Edition instances in Microsoft Azure. When one BIG-IP VE goes standby, the other becomes active, the virtual server address is reassigned from one external NIC to another. Today, let’s walk through how to create a high availability pair of BIG-IP VE instances in Microsoft Azure. When we’re done, we’ll have an active-standby pair of BIG-IP VEs. To start, go to the F5 Networks Github repository. Click F5-azure-arm-templates. Then go to Supported>failover. You have several options at this point. You can chose which templates to use based on your needs, failing over via API calls, via upstream load balancers, and NIC counts. Read each readme to determine your desired deployment strategy. When you already have your subnets and existing IP addresses defined but to see how it works, let’s deploy a new stack. Click new stack and scroll down to the Deploy button. If you have a trial or production license from F5, you can use the BYOL or BIG-IQ as license server options but in this case we’re going to choose the PAYG option. Click Deploy and the template opens in the Azure portal. Now we simply fill out the fields. We’ll create a new Resource Group and set a password for the BIG-IP VEs. When you get to the questions: The DNS label is used as part of the URL. Instance Name is just the name of the VM in Azure. Instance Type determines how much memory and CPU you’ll have. Image Name determines how many BIG-IP modules you can run (and you can choose the latest BIG-IP version). Licensed Bandwidth determines the maximum throughput of the traffic going through BIG-IP. Select the Number of External IP addresses (we’ll start with one but can add more later). For instance, if you plan on running more than one application behind the BIG-IP, then you’ll need the appropriate external IP addresses. Vnet Address Prefix is for the address ranges of you subnets (we’ll leave at default). The next 3 fields (Tenant ID, Client ID, Service Principal Secret) have to do with security. Rather than using your own credentials to modify resources in Azure, you can create an Active Directory application and assign permissions to it. The last two fields also go together. Managed Routes let you route traffic from other external networks through the BIG-IPs. The Route Table Tag means that anytime this tag is found in the route table, routes that have this destination are updated so that the next hop is the IP address of the active BIG-IP VE. This is useful if you want all outbound traffic to go through the BIG-IP or if you want to send traffic from a bunch of different Vnets through the BIG-IP. We’ll leave the rest as default but the Restricted Src Address is good way to put IP addresses on my network – the ones that are allowed to connect to the BIG-IP. We’ll agree to the terms and click Purchase. We’re redirected to the Dashboard with the Deployment in Progress indicator. This takes about 15 minutes. Once finished we’ll go check all the resources in the Resource Group. Let’s find out where the virtual server address is located since this is associated with one of the external NICs, which have ‘ext’ in the name. Click the one you want. Then click IP Configuration under Settings. When you look at the IP Configuration for these NICs, whenever the NIC has two IP addresses that’s the NIC for the active BIG-IP. The Primary IP address is the BIG-IP Self IP and the Secondary IP is the virtual server address. If we look at the other external NIC we’ll see that it only has one Self IP and that’s the Primary and it doesn’t have the Secondary virtual server address. The virtual server address is assigned to the active BIG-IP. When we force the active BIG-IP to standby, the virtual server address is reassigned from one NIC to the other. To see this, we’ll log into the BIG-IPs and on the active BIG-IP, we’ll click Force to Standby and the other BIG-IP becomes Active. When we go back to Azure, we can see that the virtual server IP is no longer associated with the external NIC. And if we wait a few minutes, we’ll see that the address is now associated with the other NIC. So basically how BIG-IP HA works in the Azure cloud is by reassigning the virtual server address from one BIG-IP to another. Thanks to our TechPubs group and check out the demo video. psGet Started with BIG-IP and BIG-IQ Virtual Edition (VE) Trial
Welcome to the BIG-IP and BIG-IQ trials page! This will be your jumping off point for setting up a trial version of BIG-IP VE or BIG-IQ VE in your environment. As you can see below, everything you’ll need is included and organized by operating environment — namely by public/private cloud or virtualization platform. To get started with your trial, use the following software and documentation which can be found in the links below. Upon requesting a trial, you should have received an email containing your license keys. Please bear in mind that it can take up to 30 minutes to receive your licenses. Don't have a trial license?Get one here. Or if you're ready to buy, contact us. Looking for other Resourceslike tools, compatibility matrix... BIG-IP VE and BIG-IQ VE When you sign up for the BIG-IP and BIG-IQ VE trial, you receive a set of license keys. Each key will correspond to a component listed below: BIG-IQ Centralized Management (CM) — Manages the lifecycle of BIG-IP instances including analytics, licenses, configurations, and auto-scaling policies BIG-IQ Data Collection Device (DCD) — Aggregates logs and analytics of traffic and BIG-IP instances to be used by BIG-IQ BIG-IP Local Traffic Manager (LTM), Access (APM), Advanced WAF (ASM), Network Firewall (AFM), DNS — Keep your apps up and running with BIG-IP application delivery controllers. BIG-IP Local Traffic Manager (LTM) and BIG-IP DNS handle your application traffic and secure your infrastructure. You’ll get built-in security, traffic management, and performance application services, whether your applications live in a private data center or in the cloud. Select the hypervisor or environment where you want to run VE: AWS CFT for single NIC deployment CFT for three NIC deployment BIG-IP VE images in the AWS Marketplace BIG-IQ VE images in the AWS Marketplace BIG-IP AWS documentation BIG-IP video: Single NIC deploy in AWS BIG-IQ AWS documentation Setting up and Configuring a BIG-IQ Centralized Management Solution BIG-IQ Centralized Management Trial Quick Start Azure Azure Resource Manager (ARM) template for single NIC deployment Azure ARM template for threeNIC deployment BIG-IP VE images in the Azure Marketplace BIG-IQ VE images in the Azure Marketplace BIG-IQ Centralized Management Trial Quick Start BIG-IP VE Azure documentation Video: BIG-IP VE Single NIC deploy in Azure BIG-IQ VE Azure documentation Setting up and Configuring a BIG-IQ Centralized Management Solution VMware/KVM/Openstack Download BIG-IP VE image Download BIG-IQ VE image BIG-IP VE Setup BIG-IQ VE Setup Setting up and Configuring a BIG-IQ Centralized Management Solution Google Cloud Google Deployment Manager template for single NIC deployment Google Deployment Manager template for threeNIC deployment BIG-IP VE images in Google Cloud Google Cloud Platform documentation Video:Single NIC deploy inGoogle Other Resources AskF5 Github community(f5devcentral,f5networks) Tools toautomate your deployment BIG-IQ Onboarding Tool F5 Declarative Onboarding F5 Application Services 3 Extension Other Tools: F5 SDK (Python) F5 Application Services Templates (FAST) F5 Cloud Failover F5 Telemetry Streaming Find out which hypervisor versions are supported with each release of VE. BIG-IP Compatibility Matrix BIG-IQ Compatibility Matrix Do you haveany comments orquestions? Ask here
Securing your applications with F5 Virtual Editions in Microsoft Azure
In Nov 2015, F5 announced the availability of F5 BIG-IP virtual editions in Microsoft Azure Cloud. What this meant to our enterprise customers is the ability to create advanced networking and security policies in azure. More importantly, our customers were able to achieve consistency in services across their on-premises and Azure environments. When we talk about security, incorporating a network firewall is critical. Typical network firewall functions are facilitated by attaching L2 interfaces to separate security zones. This would mean setting up a dedicated virtual NIC interface (VNIC) for each VLAN on a virtual machine. In Azure the number of VNICs supported differ by compute instance type. Larger instances have higher VNIC interfaces but also incur a higher cost. However there is another way to segment zones in azure through the use of UDR (user defined routing). In a nutshell, UDR provides a means for enterprises to design, and secure, the Azure networking infrastructure. For further information on UDR, please refer to the link below. https://azure.microsoft.com/en-us/documentation/articles/virtual-networks-udr-overview/ Using UDR along with the F5 Advanced Firewall Manager (AFM) service, you can implement advanced firewall protection for both N-S and E-W data traffic. Here are a few key capabilities of F5 AFM: · Policy based access control to and from address/port pairs; · Network firewall rules and logging at a global context level, or at a virtual server level; · Stateful and full proxy architecture: a flow from the client is passed to the backend only if it is deemed secure; · IP Intelligence, Global and virtual server based Denial of Service (DOS) attack protection that can be configured for thresholds on multiple network parameters; and · Programmability through iRules offering dynamic packet filtering capability. To get you started with using UDR and F5 AFM, here is an example scenario. We have an F5 ADC to manage traffic to the backend tiers. We have two backend tiers (database tier and Application tier). Our goal is to stop traffic from database tier connecting to Application tier while allowing data to flow in the opposite direction. The network topology is illustrated below Here are the steps required to implement this scenario. Step1: Create UDR Step2: Enable IP forwarding in Azure Step3: Create IP forwarding Virtual Server in BIGIP Step4: Create AFM Policy in BIG-IP Step1: Create UDR There are different ways to create UDR: 1. PowerShell 2. Azure CLI 3. Template While creating UDR, you must provide the next hop address which is the IP address of your BIG-IP. The example below shows an UDR created for Application tier Subnet. Here, the address prefix is 10.2.2.0/24 which is the destination CIDR (of the database tier). The next hop address is 10.2.0.4 which is the private IP address of the BIG-IP. This route is associated to the subnet WebAppSubnet with address range of 10.2.1.0/24. With this, packets from any WebApp subnet destined for any database subnet will be routed through the BIG-IP. Prerequisites: Create a Virtual Network in new Resource Group in Azure. When you do this a default subnet will be automatically created. Create two additional subnets for the WebApp and Database tier in your Virtual Network. Create UDR for WebAppSubnet: 1. Create route ‘RouteToDatabase’ – directs traffic destined for database subnet to BIGIP. $route = New-AzureRmRouteConfig -Name RouteToDatabase ` -AddressPrefix 10.2.2.0/24 -NextHopType VirtualAppliance ` -NextHopIpAddress 10.2.0.4 2. Create route table in the region deployed (in this example –westus region used). $routeTable = New-AzureRmRouteTable -ResourceGroupName Group2 -Location westus ` -Name UDR1 -Route $route 3. Create a variable vnet that contains name of your virtual network where this subnet is. $vnet = Get-AzureRmVirtualNetwork -ResourceGroupName Group2 -Name Group2-vnet 4. Associate the route table WebAppSubnet. Set-AzureRmVirtualNetworkSubnetConfig -VirtualNetwork $vnet -Name WebAppSubnet `-AddressPrefix 10.2.1.0/24 -RouteTable $routeTable 5. Save configurations in Azure. Set-AzureRmVirtualNetwork -VirtualNetwork $vnet Once created, the table looks like the following . Create a similar UDR for database tier. Once done, the table looks like the following. Step 2: Enable IP Forwarding on NIC associated with BIG-IP: 1. $bigipnic = Get-AzureRmNetworkInterface -ResourceGroupName Group2 -Name bigip1234 (bigip1234 is the network interface created for BIG-IP.) 2. Enable IP Forwarding. $bigipnic.EnableIPForwarding = 1 3. Save NIC configurations. Set-AzureRmNetworkInterface -NetworkInterface $bigipnic Step 3: Create IP Forwarding Virtual Server in BIG-IP To enable IP forwarding in BIG-IP, you need to create IP Forwarding Virtual Server. To Create IP Forwarding Virtual Server, Log in to configuration Utility. 1. Local Traffic > Virtual Server 2. Click ‘Create’ to create Virtual Server and fill the required details. For additional information on creating forwarding virtuals, refer to this solution article. Step4: Create AFM Policy in BIG-IP To create AFM policies you must have AFM provisioned in your BIGIP. Browse to Security > Options > Network Firewall > Active Rule – click ‘Add’ to create new policy. Here you need to select ‘Virtual Server’ as a context as shown below. As mentioned above, this example illustrates a scenario to block traffic from database tier to web tier. The policy below shows the policy settings. With this step, we have accomplished the example scenario!. Contributors to this blog post : Apoorva Sahasrabudhe, Greg Coward
