Application Security Manager (ASM)

Access Policy Manager (APM)

1.Policy-Based Control
2.SSL VPN
3.Authentication
4.Single Sign-on
Global Traffic Manager (GTM)
BIG-IP Full-Proxy Architecture
1.Encrypt->unencrypt
2.compressed->uncompressed
3.ipv6->ipv4
TMOS Operating System from F5
From LCD you can:
1.Clear Alarms
2.Reload device
3.Config Management Network
GUI Utility
1.Self-IP
2.Management IP
3.TMOS shell (tmsh)
Setup BIG-IP
Default IP Address 192.168.1.245/24 because hexadecimal of F5 is 245
Activate BIG-IP
Licence https://activate.f5.com
Steps:
1.Generate dossier
2.send dosssier to F5 license server
3.Generate licence
4.Bring license back to BIG-IP
5.Finish licensing process on BIG-IP

6.Process of Licensing can be Automatic or Manual

Provisioning Levels
1.Nominal (recommended) - Allocate only whats needed to enable module
functions. Allocate additional as needed during operation
2.Minimum - Allocate only whats needed to enable module functions. No
additional resources
3.Dedicated - Take everything, One module only
Installing a Device Certificate
Used for administrative tasks and inter-system communications
BIG-IP self-signed certificate (default)
Import CA-signed certificate (optional)
Store ceriticate on /config/httpd/conf/ssl.crt/server.crt
Root account, no GUI access (only CLI) and is not possible enable it
Admin account, no CLI access but is possible enable it
This both accounts can not be disabe
(ON CLI)
username: root
password: default
(ON GUI)
username: admin
password: admin
Use the command config to setup the management network
tmsh list sys management-ip
(tmos)# save /sys ucs train1_base.ucs
Store on /var/local/ucs
The UCS file has:
ALL BIG-IP specific config files

Porduct licences
user accounts/passwords
DNS zone files & ZoneRunner config
SSL certificates and keys
Rolling archives, config before apply a new config
cs_backup.ucs
cs_backup_rotate.ucs
Allow check issues,defects,best practises
https://ihealth.f5.com
Necessary to generate QKView File
BIG-IP Part 2 Application Delivery
Virtual Server (VIP)
http_pool pool of servers
A Full-Proxy Architecture
Separate client and server connections
CLIENT SYN->SYN_ACK->ACK VIRTUAL SERVER
CLIENT HTTP_GET
SYN->SYN_ACK->ACK and HTTP_GET (to the real server)
HTTP_RESPONSE (from real server to the client)
Load Balacing Methods
Homogeneous pool
Non-Homogeneous pool - diferent servers with diferent capacity
Methods:
Static:predefined distribution pattern
Dynamic:Observes run-time environment
adjust distribution pattern "on the fly"

Round Robin default load balancing

Still exists load balacing even status of pool is unknown
Statistics-Module Statistics-Local Traffic-Pools/Virtual servers
Source NAT Translation (SNAT)
You can use Auto MAP, this use the Floating Self-IP of the interface
The SNAT is configured in virtual server settings
Methods of Health Monitoring
Address/Service example ICMP,TCP echo
Content Check Monitor example HTTP,HTTPS
Application Check Monitor example FTP
Path Check Monitor example Gateway ICMP
Constructing HTTP Monitoring
Application Specific
is possible use regular expressions
Behaviours with Profiles
Profile Parent-Child Relationship and Inheritance Default Profile
Parent->Child Inherit but is possible customize or create a custom profile
Profile Dependencies
All VS have a Layer 4 profile (default is TCP)
Some profiles depend on others but some profiles are muttualy exclusive
Client SSL Profile
Server SSL Profile
System->File Management->SSL Certificate List

****LTM Part 1 High Availability and Traffic Processing****

Device Service Clustering (DSC)
Device trust based on mutually authentication (digital certificates)
sync failover
sync only - do not processing failover data
Device trust - Devices that trust one another
Device group - multiple devices that trust each other and can synchronize config
data with and fail over to one another
On version 11.x a device group can have until 8 BIG-IP
Traffic Froups and ConfigSync
Traffic group - related config object that proccess particular application traffic
ConfigSync - the process of synchronization config data (virtual
servers,pools,monitors, profiles,....) between devices in a device group
The HA uses the Self-IP and not the Floating Self-IP
Use NTP, and a valid certificate to establish HA correctly
Load Balancing Methods
Static:
Round Robin (default)
Ratio
Dynamic:
Least Connections
Weighted Least Connections
Fastest
Observed
Predictive
Dynamic Ratio
Least Sessions

Failure mechanisms:
Priority Based Memeber Activation
Fallback Host
The ratio 3 receives 3 more requests than a Ratio 1
Ratio (member) and Ratio (node)
Ratio 1
Ratio 2
Ratio 3
Priority-Based Member activation
pool Ratio (member)
Priority group
Priority group activation
Thinking in 3 Priority Groups, with ratio 3 3 1
Specifying the Priority Group Activaiton < 2 means the group with less priority
will be used only if one of the group fails
****Module 3 Directing Traffic with iRules*****
A few events in iRules:
CLIENT_ACCEPTED
SERVER_CONNECTED
SERVER_DATA
iRules Construct
OPerators - == < > starts_with contains ends_with
Functions - findstr getfield substr
Statements - if,switch,log,pool
Commands - HTTP::uri HTTP::header AES::encrypt SIP::call_id
https://devcentral.f5.com/login?returnurl=%2fwiki%2firules.homepage.ashx
https://devcentral.f5.com/d/tag/irules%20editor
iRules Syntax

when CLIENT_ACCEPTED {
if {[[IP::remote_address] starts_with "10."]} {
pool ten_pool
} else {
pool customer_pool
}
}
iRule based on a Header
when HTTP_REQUEST {
switch [string tolower [substr [string trimleft [HTTP::header AcceptLanguage]] 0 2]] {
"fr" { pool http_fr_pool}
"jp" { pool http_jp_pool}
default { pool http_pool}
}
}
To apply a iRule the virtual server requires a HTTP Profile as http, after config the
profile go to resources and applu the irule created before
****Module 4 Accelerating Traffic****
Leveraging OneConnect
Once a client connected the BIG-IP keep a Connection reuse pool to use from the
same client or other clients to connect to the same server with a opened connection
Option under Local Traffic->Profiles:Services:HTTP
Source Mask - determines eligibility for reusing and open/idle connection, the
value 0.0.0.0 means all clients can reuse the same connection. And
255.255.255.255 only the same client is able to reuse the connection opened
Maximum Size - Max conns held in Connection reuse pool, if the maximum is
reached, the BIG-IP system will close a server-side connection after the response is
received

Maximum Age - Max time a conneciton can stay open AND idle
Maximum reuse - maximum number of times a connection can be reused
****Getting Started with BIG-IP Access Policy Manager (APM)****
What is a BIG-IP APM
Remote Access Solution
Network Access - SSL VN
Portal Access - reverse Proxy Web Applications
Applications Access - Single Application Tunnel including Remote Desktop
Policy Enforcement Point
Authentication and Authorization
Endpoint Inspection
Access Control Lists
Dynamic Resource Assignment (per-User or Group Basis)
Single Sign-on (include OAM, Kerberos and SAML)
Policy enforcement on LTM using APM
Profiles required to implement APM: TCP, ClientSSL,HTTP,ServerSSL,Access
Looks like a Flow chart configuring a APM
Config FullWebTop
Config
-----------------------------------------------------------------------------------------HTTP Basics
Status Codes
100 - Informational
200 - Success
300 - Redirection (301 Moved Permanently)

400 - Client Errors (400 Bad requests, 401 Not Authorized, 402 Not found)
500 - Server Errors (500 Internal Server Error, 505 HTTP Version Unsupported)
Response Headers
Server and Content Format Information
Age
ETag
Location
Server
Entity Headers
Content information
Content-Length
Content-Encoding
Content-Type
Last-Modified
Process Examples
Caching
Content Transfer Completion
Caching
Caching Models:
Expiration->Reduces Requests
Validation->Reduces content transfer
Cache Expiration
Reduces Requests
Example:
Expires Tues 13 Feb 2007 13:00:00 GMT
Cache-Control:max-age 3600
Cache Validation
Reduces Content Transfer
304 Not-Modified Status Codes
Example:
Etag and If-None-Match
Last-Modified and If-Modified-Since
When client receives 304 code use the object in local cache

Content Transfer Completion

VIPRION Basics
Failover can be done using unicast or multicast. Can be specified a minimum
number of blades to do a failover
Mirroring can be done in same cluster, clone all session state to other blade. And
between clusters, mirroring sesseion state to a peer
Virtual Clustered MultiProcessing (vCMP) - a cluster of virtual machines running
TMOS is called a vCMP guest
Important VIPRION commands
Bladectl - allow a user remotely perform simple tasks (like reboot a blade, connect
to console ports) in other blades in a VIPRION chassis
clsh - allow a user to execute the command on every active blade, user clsh
command as a prefix to the beginning os another command
tmsh /sys vcmp
tmsh /sys cluster - modify the confi of the primary blade in a cluster, the system
will propagate all changes to the other blades in the cluster (known as cluster
synchronization)
Troubleshooting Basics
End USer Diagnostics (EUD)
Accessed via GRUB
VIPRION Specific tests:Clustering,Hardware problems
Two VIPRION EUD Branches
EUD_V (VIPRION 4000)
EUD_S (VIPRION 2000)
!!!!Warning!!!!

Do no run it in a production Environment

Remove all blades from chassis
Run EUD directly on blade being tested
Out-of-Band Management
Lights-Out Processor (LOP) - VIPRION 2000 Series
Serial Port Redirector (SPR) - VIPRION 4000 Series
invoke LOP/SPR at the console with Esc then Shift + (9