iRules

The First VIPRION Review

Joe Pruitt — Wed, 03 Sep 2008 17:11:18 GMT

This just came across the wire: The UK based website ITPRO just published the first public review of F5's VIPRION On-Demand Application Delivery Controller. Let's see how it fared:

Rating: 5 out of 6 stars

Price: £83000

"Targeting enterprises and service providers, the Viprion offers a range of features suited to those looking for levels of resilience, scalability and performance that standard appliance based solutions can’t deliver."

"A unique feature of the Viprion is its ability to present a single virtual server with massive resources behind it as it can use all blades. As new blades are added they are incorporated into the cluster, enabling a single application to scale easily with demand."

"Installation was simple as the Viprion not only clustered the blades for us but also presented a single virtual IP address for management."

"During its stay in the lab the Viprion impressed us mightily with its huge range of features. The automatic blade clustering feature also makes upgrades extremely simple and the well designed web interface makes light work of configuration and management."

Verdict: The Viprion sets new standards for enterprise level application delivery, with seriously good resilience, scalability and performance. Load balancing features don’t get any better either and yet during testing we found it remarkably easy to deploy and manage.

So there you have it. If you have been maxing out your 8800's and have been feeling the need for an upgrade, then this review might help you tip the scale. The one thing that they didn't mention in the review is that iControl, the remote management/automation API is available on that product as well so all your scripts you've developed for managing your v9.x devices will work with the new platform as well.

Make sure you check out the full review at the ITPRO website.

-Joe

Technorati Tags: F5, DevCentral, VIPRION, iRules, iControl, Product Review, Joe Pruitt

Stop Those XSS Cookie Bandits iRule Style

Joe Pruitt — Fri, 29 Aug 2008 22:18:07 GMT

In a recent post, CodingHorror blogged about a story of one of his friends attempts at writing his own HTML sanitizer for his website.

I won't bother repeating the details but it all boils down to the fact that his friend noticed users were logged into his website as him and hacking away with admin access. How did this happen? It turned out to be a Cross Site Scripting attack (XSS) that found it's way around his HTML sanitizing routines. A user posted some content that included mangled JavaScript that made an external reference including all history and cookies of the current users session to an alternate machine.

CodingHorror recommended adding the HttpOnly attribute to Set-Cookie response headers to help protect these cookies from being able to make their way out to remote machines. Per his blog post:

HttpOnly restricts all access to document.cookie in IE7, Firefox 3, and Opera 9.5 (unsure about Safari)
HttpOnly removes cookie information from the response headers in XMLHttpObject.getAllResponseHeaders() in IE7. It should do the same thing in Firefox, but it doesn't, because there's a bug.
XMLHttpObjects may only be submitted to the domain they originated from, so there is no cross-domain posting of the cookies.

Whenever I hear about modifications made to backend servers, alarms start going off in my head and I get to thinking about how this can be accomplished on the network transparently. Well, if you happen to have a BIG-IP, then it's quite easy. A simple iRule can be constructed that will check all the response cookies and if they do not already have the HttpOnly attribute, then add it. I went one step further and added a check for the "Secure" attribute and added that one in as well for good measure.

when HTTP_RESPONSE {
  foreach cookie [HTTP::cookie names]
  {
    set value [HTTP::cookie value $cookie];
    if { "" != $value }
    {
      set testvalue [string tolower $value]
      set valuelen [string length $value]
      #log local0. "Cookie found: $cookie = $value";
      switch -glob $testvalue {
        "*;secure*" -
        "*; secure*" { }
        default { set value "$value; Secure"; }
      }
      switch -glob $testvalue {
        "*;httponly*" -
        "*; httponly*" { }
        default { set value "$value; HttpOnly"; }
      }
      if { [string length $value] > $valuelen} {
        #log local0. "Replacing cookie $cookie with $value"
        HTTP::cookie value $cookie "${value}"
      }
    }
  }
}

If you are only concerned with the Secure attribute, then you can always use the "HTTP::cookie secure" command but as far as I can tell it won't include the HttpOnly attribute.

So, if you determine that HttpOnly cookies are the way you want to go, you could manually configure these on all of your applications on your backend servers. Or... you could configure it in one place on the network. I think I prefer the second option.

-Joe

Technorati Tags: F5, DevCentral, XSS, Cookie, HttpOnly, CodingHorror, Joe Pruitt

Crack open the books, it's iRule time

Joe Pruitt — Fri, 29 Aug 2008 17:10:17 GMT

Hot off the presses!

I just received an email from Beth, our Director of World Wide Customer Education, that starting now registration is open for a brand spanking new "Configuring BIG-IP V9.x With iRules" course offered by F5 Global Training - WOOHOO!

This three-day course gives networking professionals an understanding of how to configure a BIG-IP v9 system with iRules. The course builds on the foundation of the BIG-IP Local Traffic Manager (LTM) Essentials course, demonstrating how to logically plan and write iRules to help monitor and manage common tasks involved with processing traffic on the BIG-IP. Course Labs consist of writing, applying and evaluating the effect of iRules on LTM traffic. This hands-on course includes lectures, labs, and discussions.

So if you find yourself in need of a little more assistance in iRule Elements, Syntax and Troubleshooting, iRule Optimization, iRule Security, Expressions and Operators, Variables and Loops, Data Classes, Persistence and Server Data, and Statistics, then this course is for you! The full class description can be found here. The upcoming schedule in the US is Oct 14-16 in Seattle, Nov 10-12 in NYC, and Dec 2-5 in Seattle. Oh, and if you are in the UK, never fear... You can climb aboard and catch a class Sept 17-19, Nov 11-19, or Dec 10-12 in Chertsey, UK.

Congrats to the entire Global Training team on getting this course out!

Links: Course Overview, Course Table of Contents, Course Schedules, and Class Registration.

-Joe

Technorati Tags: F5, DevCentral, BIG-IP, iRules, Training, Joe Pruitt

Symphonic releases TrueView ADC Edition

Joe Pruitt — Fri, 01 Aug 2008 22:13:21 GMT

I found out about this at our partner conference earlier this week and it looks like Symphonic's TrueView ADC Edition has made it's way out into the wild.

From the press sheet:

Symphoniq, in conjunction with F5, has created a unique monitoring solution to leverage your existing Application Deliver Controller (ADC) infrastructure to give you detailed, actionable insight into how the infrastructure is running, from your end user's perspective.
TrueView, ADC Edition takes advantage of Symphoniq's TrueView technology to measure real end-user response times, and leverages F5's iRules and iControl technologies to seamlessly integrate with your infrastructure to provide the information you need to optimize your web application delivery.

With all the benefits of the True Product line, TrueView ADC Edition is built exclusively around F5's BIG-IP. They are using iControl to enable Symphonic transaction monitoring and, in doing so, the BIG-IP is automatically configured to dynamically instrument outgoing web pages or SOA calls.

Key highlights in the TrueView ADC Edition include:

Monitors application performance as experienced by the real users of HTML, AJAX, Flash and Silverlight applications
Collects detailed Web performance parameters (such as response time, parsing time, time to first byte, and error rate) from the real user's perspective at the browser
Allows setting of thresholds to generate alerts on Web performance parameters to support 24/7 operations
Capture and report on F5 BIG-IP device statistics
Correlates F5 BIG-IP device statistics with critical web application parameters to gain unprecedented visibility
Business group oriented approach relates performance issues to business impact
Customizable SQL-based reporting engine supports service level reporting and historical data archival
Monitoring functionality leverages existing F5 BIG-IP appliances using iRules and iControl, no additional third-party appliance required
Seamless migration to the full TrueView suite for end-to-end application performance monitoring and diagnostics

If you are a BIG-IP customer and are looking at ways to eek the most out of your applications and their performance on the network, I'd highly suggest you take a look at Symphonic's new offering.

Who knows, maybe we'll get them on a podcast sometime soon to talk about how they've used iControl and iRules to their, and your, advantage.

-Joe

Technorati Tags: F5, Symphonic, TrueView, ADC, iControl, iRules, Joe Pruitt

Scaling Ruby on Rails to 1 Billion Page Views a Month

Joe Pruitt — Tue, 15 Jul 2008 17:41:57 GMT

A while ago I blogged about how F5 was making mongrels better with a Side of Mayo. I referenced a blog post on Joyent's wonderful Joyeur blog on why Joyent uses F5's BIG-IP for their customers. Well, those krazy kids at Joyent are at it again...

In a recent post, Joyent point out how LinkedIn, a customer of theirs, built a Facebook application called BumperSticker using Ruby On Rails. LinkedIn made use of Joyent's Accelerators and our very own BIG-IP to scale Ruby on Rails to some very significant numbers.

13.5 million installations
1.5 million daily active users
20-27 million canvas page views a day

All this is served by

13 web application servers running nginx and mongrel.
8 static asset servers serving over 3,500,000 stickers, soon to migrate to a CDN.
4 MySQL servers in a master/slave configuration using Rick Olson's excellent masochism plugin.

For those video inclined, Joyent has an added bonus: check out the video they put together on the subject.

So, as the Twitter's out there continue to have availability issues and the debate continues as to the scalability of Ruby on Rails, BIG-IP helps show that with a good design and infrastructure planning, big things are possible. Keep up the good work Joyent! Oh, and if you ever want to do a guest spot on the DevCentral Podcast, please let us know. Oh, and if you ever need a guest for your Quad Core podcast, let me know - I'd be glad to sit in!

Technorati Tags: F5, DevCentral, Joyent, Joyeur, LinkedIn, Ruby on Rails, Joe Pruitt

Japanese Marketing - BIG-IP

Joe Pruitt — Tue, 01 Jul 2008 21:21:35 GMT

Here's another post on Japanese Marketing, F5 Style. I've talked about iRules, TMOS, and FirePass and for today I've got our very own BIG-IP. As I mentioned in my previous posts, since I don't speak Japanese, the only way I can interpret this marketing sheet is by the graphics on it. So, again, I'll give you my view on what the message is:

The guy in this photo is not really a guy at all, he's a puppet since there is no bottom half to his body.
The left picture shows him with a blue forehead - not sure what to infer from that.
The puppet has the added "Spock from Star Trek Eyebrow Lift" that was made famous by Leonard Nimoy in the original Star Trek series.
BIG-IP works like 4 stars in a data center with three racks of servers, but it gets a 5th star when you increase the number of racks to twelve. Plus you get an added blue glow out of your data center!
Four points are presented around this 5 star blue glow (you'll notice there are four points on each star!). The first one being BIG-IP and iRules, the second being L3 and ICMP, the 3rd is PVA, and the 4th is HTTP.
If the four points aren't good enough for you, I bet you didn't know there was a built-in matchmaking service available. There is a nifty flowchart guiding you to your ideal product match. I ran through the flowchart and here's where I ended up:

Do you like lots of ports to stick your wires? : Yes - Move to the right
Are you looking for a partner in the with a healthy 2U figure? : Yes - Move to the right.
Do you need 1Gbps? : Yes - Move down.
Are you sure you want a 2U figure? : Yes - Move down.
Do you need 10Gbps? : Yes - Move down.
That leads me to the 8400 as my ideal match.

So, there it is. While BIG-IP didn't have as many unexpected features as FirePass did, it sure did make up for it in sheer muscle. So, I'm an 8400, which one are you?

-Joe

Technorati Tags: F5, DevCentral, iRules, TMOS, FirePass, BIG-IP, Japan, Tokyo, Joe Pruitt

Japanese Marketing - iRules

Joe Pruitt — Tue, 24 Jun 2008 21:17:43 GMT

While Jeff and I were in Tokyo a few weeks back, we spent some time in F5's office and what immediately caught my eye was the lack of human models in their marketing literature. As you can see in the above sheet, artists drawings are used instead of photos of real people. In fact, this isn't just a tech thing because the same can be seen while riding on the subway. I don't know this for a fact, but I would wager a couple of yen on the fact there is one artist in Japan that does all the ad work because they all look very similar in nature (I'm sure that's not the case, but it sure seems like it).

Anyway, since I figured folks on this side of the planet don't often see these types of things, I brought a few pieces home and as I scan them in, I'll post them to the blog.

Oh, and don't ask me what they mean. The only thing I can tell you about the one above is that it's focused on some guy writing an iRule letter to his BIG-IP and it get's auto-deployed into his network. Anyone care to translate for me?

If you want a larger version, click on the above images and you'll get the full sized scanned images.

Enjoy!

-Joe

Technorati Tags: F5, DevCentral, Tokyo, Japan, Marketing, Cartoons, iRules, Joe Pruitt

The Networking ABC's - T is for TCL

Joe Pruitt — Mon, 05 May 2008 15:58:54 GMT

Today's letter in the Networking ABC's is the letter "T". Other words beginning with "T" that would have worked today are TACACS, TMM, trunk, TCP, throughput, traffic, and ToS. But, being a developer at heart, I opted for the word that I use on an almost daily basis. The word for today is the programming language of iRules: TCL.

"T" is for TCL

TCL

Pronounced: Tik-uhl

Tool Command Language (or TCL) is a scripting language created by John Ousterhout who devised the language "out of frustration with programmers devising their own (poor quality) languages intended to be embedded into applications". TCL quickly gained wide acceptance on it's own and is generally thought to be easy to learn, but powerful in competent hands. TCL is used extensively on embedded systems platforms, both in it's full form and in several other small-footprint versions.

Several features of TCL include: Everything is a command; everything can be dynamically redefined and overridden; All data types can be manipulated as strings, including code; simple execution handling using exception code returned by all command executions; readily extensible via C, C++, Java, and TCL; and platform independent.

SEADUG Meeting 1 Recap

Joe Pruitt — Thu, 24 Apr 2008 19:08:08 GMT

Well we survived it and it was a blast! Thanks to everyone that showed up and I hope you learned a few things and had some fun along the way.

The night started off with socializing over some yummy pizza (which I ate way too much of) and we fit in some foosball and pool while we were waiting for things to kick off.

I presented a iRules slide deck covering some iRule basics and then dug into some optimization techniques and ended up with some troubleshooting tips. Hopefully everyone learned a little something during the talk.

We gave away some pretty nice DevCentral laptop backpacks to the ones who 1) answered correctly, or 2) guessed close enough (you know who you are!) the answers to some questions we threw out. For those that didn't make it, here are the questions

1) What does TCL stand for?

2) How many *::payload commands exist in the iRules command set?

3) What are the two functions of OneConnect?

4) Explain with examples what iControl and iRules are and when and why would you use each technology?

Congrats to the winners! Hope you enjoy your backpacks!

Jeff was rolling the camera so hopefully by next week we'll get a recording of the presentation online. In the mean time, here is the slide deck from the meeting: 20080423-SEADUG-1.pptx

Call for Eastside Hosting

We are always willing to host but if there is anyone on the Eastside (Bellevue, Redmond, Kirkland) that can offer hosting, we'd gladly move it to the eastside. The location will have to accommodate 20-30 folks.

Call for Speakers

While I love talking in front of folks, this is a "User Group" so we'd love to have someone offer up a topic that they would be willing to present at the next and future meetings. So, if you have a great project that you have been working on and would like to share with the community, let me know via the blog or Northwest User Group forum and we'll get you locked in.

Till next time!

-Joe

Technorati Tags: F5, DevCentral, User Groups, SEADUG

The Networking ABC's - I is for iRule

Joe Pruitt — Fri, 11 Apr 2008 17:26:07 GMT

The letter for today in the Networking ABC's is the letter "I". Words that come to mind starting with "I" are ICMP, IPSec, Interface, and the Internet. But since I get to pick the words, I picked my favorite "I" networking word: iRule.

"I" is for iRule

iRule

Prounounced: Ahy-rool

An iRule is a powerful and flexible feature of BIG-IP devices based on F5's exclusive TMOS architecture. iRules provide you with unprecedented control to directly manipulate and manage any IP application traffic. iRules utilizes an easy to learn scripting syntax and enables you to customize how you intercept, inspect, transform, and direct inbound or outbound application traffic.

iRules is an Event Driven scripting language. This means that you'll be writing code based off of specific Events that occur within the context of the connections being passed through the VIP your iRule is applied to.

Technorati Tags: F5, DevCentral, Networking, ABCs, iRules, TMOS