Development and General

Managing Traffic (for baggage claim)

Jeff Browning — Wed, 12 Nov 2008 20:54:14 GMT

Sometimes, you see things that you just need to capture on... err... SD memory. While waiting for my bag yesterday at the Las Vegas Airport, Joe Pruitt found himself a nice little Java console app that probably wasn't supposed to be visible. If you've been through the baggage claim here, you've no doubt seen the HUGE banners advertising every new show in town. It's complete sensory overload (hey - it's Vegas, right?) However, this caught Joe's attention. Honestly, I doubt many people even saw it but Joe spun on a dime and started dissecting the database calls and methods scrolling across the screen. Something about "switching to next to claim 6...stopping claim 5", etc.

In you're in Vegas attending the DevConnections event at the Mandalay Bay Convention Center, look for us at booth #625. I'll also be presenting at OpenForce08 this afternoon about the role network infrastructure plays in successfully delivering DNN-based applications.

Technorati Tags: f5, devcentral, devconnections, openforce2008, java, jeff browning

New SAP Solution Forum Unlocks F5 Integration Help

Jeff Browning — Thu, 16 Oct 2008 21:51:50 GMT

If you're running SAP software in your company, there's a good chance you've made a significant investment in making employees more productive. However, I've seen too many companies spend a ton of money on software and then forget that predictably secure application access and reasonable performance are instrumental in users getting value from the solution. It's like spending a bunch of cash on a speedy new PC and then... forgetting that you need power to run it. Or, a car with 600 horsepower and spellbinding looks... with no transmission. At some point, simply getting the app to the users can be a critical factor. (I say "simply" because to most, it is. But, there really are some tricks to doing it well.)

F5's work with SAP is significant because it addresses this need: to enable reliably secure, fast access to powerful applications based on SAP technology. While we invest significant time working closely with partners like SAP to build the most widely applicable solutions, there are bound to be countless other ways people do this. That's where the new Forum comes into play. Rarely are these types of solutions deployed identically. The new forum makes it easy for those of you in the community using SAP to connect with your peers and share best practices and ideas you've implemented.

Take a look, post your questions, answers, or even share what has worked well for you. And, check out what one of F5's experts - Nojan - has to say about it!

Technorati Tags: SAP, F5, Solution, DevCentral, Jeff Browning

Share this post :

Load balancing MS-Active Directory and Kerberos

Jeff Browning — Fri, 12 Sep 2008 19:44:03 GMT

You know what? You never know what you might find in the DevCentral Forums. Some pretty cool stuff happens in the Solutions Forums - a place to focus on doing interesting things with F5 gear from an application perspective (i.e. Microsoft app, Oracle App, etc.).

Here's an interesting one I found recently: load balancing resources protected by MS-AD-Kerberos. Not always two technologies you expect to see together... However, thanks to user "ravi.rajan", there's the solution. The trick is that you don't add the BIG-IP to the AD (you can't). Instead, you create a Microsoft Service Principal Name (SPN) for "the HTTP services mapping to a particular domain user ids." For more, go here.

For details about SPNs if you're not familiar with them, you can learn more from Microsoft TechNet (a team I worked on many, many years ago, BTW) or at MSDN if that's more your speed.

According to "ravi.rajan", it's not just the IIS folks that get to play:

We have kerberos single sign on working for IIS, weblogic, SAP enterprise portal without any issues.

After talking about this with Colin, he made a good point: once you have this backend wired (and simply doing LB to distinct virtuals/URLs for the various services for IIS, webogic, etc.), why not bring the forms out to the front end and consolidate the process. Theoretically, you could use LTM's form-based auth on the front end. LTM can serve up a standard form and then pass auth through the various services on the backend. Here's a nice little sample (Client Auth Using HTML Forms) in the CodeShare to get you started.

Technorati Tags: active directory, microsoft, kerberos, f5, big-ip, devcentral, weblogic, sap enterprise portal, jeff browning

Share this post :

Support, Social Technology, and Trust

Jeff Browning — Thu, 11 Sep 2008 23:35:19 GMT

As Don mentioned earlier this week, we took the plunge and entered Forrester's Groundswell contest. To me, I believe this is the ultimate testament to what you, the community, are doing on DevCentral everyday (check out this page - it's pretty cool). Back when we started this thing, it was simply to help folks learn how to tap into F5's groundbreaking iControl API. After asking users, we learned that folks needed some assistance getting started. Surprise, surprise - understanding terms like WSDL, SOAP, and related things were a bit new to F5's traditional users! With backgrounds in software, where forums have been around a while, we thought this would be a good tool to enable us to assist and support users as they played with this cool technology.

Honestly? Selling management on un-moderated forums was not a slam-dunk. There were (reasonably) concerns that someone might say something nasty. That said, we made a philosophical choice... to trust our users. We wanted them be as involved and invested in this community as F5 is. So - trust matters. Along the way, something interesting happened: the community even started to protect it's own turf!

The same thing happened when we weighed the pros and cons of moving ALL of our technical documentation to a wiki. (what? let ANYONE edit it? seriously...?). Yes - like the forums, there was plenty of debate. Once again, the notions of trust and enablement - all with the desire of supporting users through more free-flowing, 24x7, worldwide contributions - won out. The result? Well - just one example is the over 100 iRule samples posted in the Codeshare today - the vast majority contributed by real users working on solving real challenges everyday.

When looking at this whole contest thing, I'm sure some of the other categories could have applied. But, the "supporting" category is the most obvious choice. However, it's not exactly why most might think... When I step back and look at what everyone is doing in the community, what strikes me most is how - in significant part because of the social media technologies we've embraced - users are supporting each other. Without a free-flowing community, ideas and solutions created in Auckland may have never been seen by users in Munich. Or, a cool iRule trick from someone in London may have never reached someone in Tokyo.

Further, I'll be the first to admit this: there are some protocols or technologies that we'll NEVER know as well as some of you. You're work, day in and day out, with a specific protocol or application server - and specifically it's subtle quirks that come from working with it daily - help you bring a completely different dimension to other users wrestling with a similar problem. Sure - we can research and understand something academically. However, members' tribal, hands-on knowledge makes all of the difference when providing real, useful solutions.

Candidly, there are times when I ask myself this: how do vendors that DON'T enable this free-flow of ideas survive? With the growth of cloud, SOA, virtualization, etc., the technology hairball and the knowledge required cannot be owned by one all-knowing company, right?

I go back to the beginning; it's this notion of trust, free-flowing ideas and dialog, that makes this community all about support. Not just F5 supporting our technology (as it should). But, helping end users help each other to just get more... value... ideas... inspiration... support. All from others working to solve similar problems.

BTW - some serious props go out to F5 leadership for trusting and embracing the community as partners and co-collaborators on this journey. If not for that trust, I don't think we would see the dynamic interaction that happens each day on DevCentral.

So, if you've read this far, thank you for your participation in and involvement with DevCentral. If you feel like it, maybe make a visit to our entry page and make a comment and vote for DevCentral. Also - we've set up a Forum here on DevCentral as well for you to post your comments, thoughts, likes, etc. about DevCentral.

Technorati Tags: forrester, groundswell, devcentral, f5, icontrol, wsdl, social technology, community, protocol, cloud computing, SOA, virtualization, Jeff Browning

New ASM Discussion Forum is Live

Jeff Browning — Tue, 22 Jul 2008 21:12:25 GMT

After many requests, we've just launched a new discussion area for folks that want to talk about the F5 Application Security Module (ASM). This is a new opportunity for the community - existing users or those just curious about ASM - to post questions, share ideas, and generally discuss the possibilities and solutions available with ASM.

To learn more about ASM, you can go here. When you combine ASM with other technologies from folks like our friends at White Hat Security, there are some interesting applications and scenarios that will surely spark some interesting dialog.

You know what I like most about this new Forum? Some of the most enthusiastic supporters were actually our own ASM team. They're already active in the other forums, passionate about this technology, and are excited to discuss ASM with the DevCentral community and you.

So, have at it and enjoy.

Technorati Tags: devcentral, ASM, application security, white hat security, jeff browning

IITD+SA

Jeff Browning — Thu, 29 May 2008 23:49:02 GMT

There was a nice little acronym we used around F5 a few years back (probably more than a few...). However, I was reminded of it today (thanks Annie and Joe!) while walking through the halls. It's simple. And, it's powerful. And, it deserves a "refresh" because there's no hiding from reality: there are more protocols, app flows, user distribution, and complexity challenging IT, not to mention shorter development cycles and performance demands challenging app teams.

The move to TMOS ushered in the opportunity to do this and well. Here's what it means (updated for 2008):

I = Intercept (as in intercept any part of the IP application stream... header, payload, etc.)

I = Inspect (look for cookies, values, variables... anything you want that designates the session)

T = Transform (rewrite to perform proxy functions or other things that fix bugs, simplify design, etc.)

D = Direct (route requests or responses to the best resource, under either LB or persistence, etc.)

Now, in today's world, more applies:

S = Secure (from the endpoint to core, using client checking to encryption and beyond...)

A = Accelerate (making sure that wherever the user is, however unique the application is, or other characteristics that compromise performance - apply intelligently for the best application experience)

Of course, all of these are done to optimize the user experience, server, storage, and application resources so that IT staff and application teams spend on flexible solutions that offer the right fit for today with graceful adaptation and scale as their needs change.

Seems pretty damn prudent and practical to me.

Technorati Tags: ADN, F5, DevCentral, Jeff Browning

Golf ball or bowling ball?

Jeff Browning — Tue, 06 May 2008 19:47:42 GMT

While they're both round, I will probably prepare differently to catch either one if thrown at me. Wouldn't you? I might stand differently. I might even ponder, "do I need one hand or two?" I'll definitely consider what could happen if I fail to catch the ball and how it might bounce or even break something where it lands.

Mindless musings, you say? Maybe. But really? How is this any different from what most network teams deal with? Seriously.

Pretend you're the app guy and I'm the network guy. You know what you're going to throw. You've spent countless hours defining it, building it, making sure it makes the business folks happy, and even (I hope) testing it. You are closer to it - and know more about it - than anyone possibly could (or most would ever care to understand, frankly).

So - why won't you tell me about it? Really. Because I don't understand. It's not hard. It probably won't take much time. It certainly doesn't steal your thunder.

Here's the deal: I'm going to build for a bowling ball - guaranteed. It's safer. But, know this - I won't be as quick and nimble. It'll take two hands. And, the thought of that coming will certainly occupy more of my mind than a golfball might because I don't want to face the risk (and embarrassment not to mention damage) that dropping it might bring. So, I'll be pretty preoccupied. Forget those other things on my task list.

It eat more of IT's budget but be incredibly overbuilt when your golf ball comes my way. And, I won't have the time, budget, or option of help you optimize your app or provide additional security help. I spent it all preparing for a bowling ball (and I'm really quite stressed even about the thought of it.) So, you'll have to write that code. And test it. And update and maintain it. You have plenty of time, right?

It's not a pretty picture. But, it's all together too common. Just heard about it from someone - again - today.

When will IT groups learn that the good from sharing more information far outweighs any fear of bad that comes from sharing it?

Technorati Tags: application delivery, F5, IT management, Jeff Browning, bowling ball, golf ball

Good advice

Jeff Browning — Wed, 30 Apr 2008 17:32:06 GMT

During an interesting conversation yesterday, Jim Metzler made a very clear and insightful comment. There are [or should be] two distinct roles in IT: application development and application delivery. Pure and simple. In challenging times (or any time, really...), this clarity could be a powerful rallying point as well as a basis for collaboration and focus on results. Good advice. His recently released 2008 Handbook of Application Delivery also offers some excellent advice.

[Update: Kiwi Paul was kind enough to remind me that the handbook link above requires a free registration here. Thanks mate!]

Technorati Tags: F5, Devcentral, Jeff Browning, application delivery, development

What's the difference between a CLI and API, really?

Jeff Browning — Tue, 29 Apr 2008 21:58:15 GMT

Here at Interop, I had an interesting conversation on the show floor about integration. We were talking about how another company can remotely invoke change against infrastructure "via the CLI". When I asked why, the reasoning was that it's just how the infrastructure can be integrated - kind of because, "that's what's available". Sadly - that's pretty true in the networking world. To date, there is no API like iControl that offers a comprehensive API with broad tool support and functionality.

So - when writing integration via the CLI, what happens when the hardware versions change? Maybe an upgrade patch? Or, what if some smart engineers add some new features that require existing CLI commands to be deprecated?

How does the integration work after that? In many cases - it doesn't. And, that's the difference between a CLI and API. CLIs are hardwired scripts that work well in the short term but don't evolve as gracefully as true integration. Now - they have their place - no question about it. But, for smart, dynamic integration?

APIs provide a more dynamic, fluid integration and binding between software and infrastructure. To do this, the work on the infrastructure side is not trivial. However, it makes a HUGE difference for the end-user trying to write and maintain integration as the underlying infrastructure evolves.

API = nimble and flexible. CLI = brittle and difficult to manage. Big differences.

Technorati Tags: api, cli, iControl, f5, devcentral, Jeff Browning

Virtualizing VMware?

Jeff Browning — Tue, 29 Apr 2008 21:22:11 GMT

Wow - that sounds kind of bizarre. Like load balancing a load balancer? Or, maybe launching a rocket launcher?

OK - I kid. However, when you think about the ease with which companies can spin up instances of virtual servers, it's pretty easy to understand how a bit of intelligent load balancing could be useful. Useful from not just an optimization perspective but especially a management simplification perspective.

So, that's where Steve Duplessie's recent post comes into play. Honestly, sometimes it takes someone a few steps removed to explain things most eloquently. Here on DevCentral, we can get pretty deep in the technical weeds. So, it's always refreshing to see such a well articulated assessment of things.

Plus, any analyst that gets excited enough about technology to say "killer" is cool by me. Here's the part I thought really cut to the chase:

"VMware can make one physical server look like 98. F5 can apparently make 98 physical servers look like 1. That's killer."

You should take a look. Steve really nails it.

However - there's another aspect of this that is worth mentioning. Spinning up that many virtual servers is cool. But, managing how they are virtualized by F5 BIG-IP (when you're talking about 98 of 'em) can be a bit overwhelming. It's no secret that virtual server sprawl is quickly becoming a hot issue for IT departments.

So, what's an IT pro to do? Type in a huge batch of CLI commands? Surprisingly, some do. It hurts my head to think of it.

There ARE better options though that really begin to show why we invested in the iControl API years ago.

Example 1: what if you could automagically add new virtual servers to your BIG-IP collection of nodes when they start up? Pretty cool. Here's the sample code.
Example 2: to get even more elegant, what if - based upon increases in connections/requests - you could AUTOMATICALLY spawn new virtual servers in VMware? Wicked. Check out the article (with screenshots) here and get the sample code here.

[Updated @ 6:30pm 4/29: Nicolas, our DevCentral/iControl/iRule rockstar in France, wanted me to mention that there's more coming soon on this front... stay tuned - you'll get the details here as soon as we have them! Also - working on updating the sample code... hope to have the right stuff there ASAP. -Jeff]

So, there you have it. Virtualization of VMware. And, integration code, ready-to-go, to help you automate the way they work together. That, to me, is "killer".

(Special shout out to Matt, Mohamed, and Nicolas - some of F5's best and brightest - for making these possible!)

Technorati Tags: vmware, virtualization, f5, big-ip, code samples, Jeff Browning, devcentral