BIG-IP

Gain visibility Into Your BIG-IP delivered Web Applications With Symphoniq

Joe Pruitt — Wed, 08 Oct 2008 20:21:43 GMT

Webinar Details

Date: Thursday Oct 16th, 2008
Time: 9AM PST, 12PM EST
Duration: 45 minutes

Featured Speakers:

Peter Murray
Technical Marketing Manager
F5 Networks

Hon Wong
CEO
Symphoniq

IT departments purchase F5’s BIG-IP Application Delivery Controllers (ADCs) to increase their Web Application performance. Because of the complexity of the applications being accelerated, finding an optimal ADC configuration requires visibility into the impact the appliance has on both the end user and the network.

Symphoniq has created a Web Application performance monitoring solution based on our TRUE (The Real User Experience) technology. An industry first, the solution integrates tightly with F5’s powerful iRules and iControl platform to provide an out of the box ADC and real user monitoring solution for all of your BIG-IP HTTP applications.

Register now for this webinar, and hear Peter and Hon discuss how F5 and Symphoniq can help you gain visibility into your ADC infrastructure, and improve your end users’ Web Application experience.

In this webinar you will discover:

How F5 acceleration technology can help address performance issues associated with complex Web architectures.
How collecting ADC and end user browser metrics provides the data required to optimize application delivery.
How using your existing ADC hardware can give you a cost effective platform for monitoring HTTP applications.

I've worked with Hon and the gang over at Symphoniq with the iControl integration for a while now and they've got some great technologies that you really should take a look at if you are in the world of web applications and would like to get a closer look at how the applications are performing and how you can optimize them. Believe me, it'll be the best way you can spend your 45 minutes next Thursday morning. So, on the 16th, grab yourself a cup of coffee and join in, you won't regret it.

For more information, check out www.f5.com and www.symphoniq.com.

-Joe

Technorati Tags: F5, DevCentral, BIG-IP, Symphonq, TRUE, ADC, Joe Pruitt

The Networking ABC's - Z is for Zone

Joe Pruitt — Wed, 03 Sep 2008 17:57:42 GMT

Today's word in the Networking ABC's starts with the letter Z. This entry will round out the 26 entries in the Networking ABC's series so I wanted to make sure I got a good one for Z. When one thinks about computer networking, switches and routers come to mind. But what makes the whole internet thing work resolves around resolving user friendly domain names into network addresses. Products such as F5's Global Traffic Manager do all the hard work so your users can get to your site regardless of the geographic location. The information where these domain entries are stored are called Zones and that just so happens to be my pick for today.

"Z" is for Zone

Zone

Pronounced: Zohn

A DNS zone is a portion of the global Domain Name System (DNS) namespace for which administrative responsibility has been delegated.

The most tangible expression of a DNS zone are the database elements that are used to technically administer a zone in a DNS management software system. Traditionally, each zone was stored in a separate database file, the Zone file, containing specification for host addressing, name aliasing, electronic mail routing, backup server systems, geographic location, administrative contacts, and many other pieces of information (cf. List of DNS record types), with an extensible design that has scaled well with the growth of the Internet.

Technorati Tags: F5, DevCentral, Networking ABCs, ABCs, DNS, Zone, Joe Pruitt

The First VIPRION Review

Joe Pruitt — Wed, 03 Sep 2008 17:11:18 GMT

This just came across the wire: The UK based website ITPRO just published the first public review of F5's VIPRION On-Demand Application Delivery Controller. Let's see how it fared:

Rating: 5 out of 6 stars

Price: £83000

"Targeting enterprises and service providers, the Viprion offers a range of features suited to those looking for levels of resilience, scalability and performance that standard appliance based solutions can’t deliver."

"A unique feature of the Viprion is its ability to present a single virtual server with massive resources behind it as it can use all blades. As new blades are added they are incorporated into the cluster, enabling a single application to scale easily with demand."

"Installation was simple as the Viprion not only clustered the blades for us but also presented a single virtual IP address for management."

"During its stay in the lab the Viprion impressed us mightily with its huge range of features. The automatic blade clustering feature also makes upgrades extremely simple and the well designed web interface makes light work of configuration and management."

Verdict: The Viprion sets new standards for enterprise level application delivery, with seriously good resilience, scalability and performance. Load balancing features don’t get any better either and yet during testing we found it remarkably easy to deploy and manage.

So there you have it. If you have been maxing out your 8800's and have been feeling the need for an upgrade, then this review might help you tip the scale. The one thing that they didn't mention in the review is that iControl, the remote management/automation API is available on that product as well so all your scripts you've developed for managing your v9.x devices will work with the new platform as well.

Make sure you check out the full review at the ITPRO website.

-Joe

Technorati Tags: F5, DevCentral, VIPRION, iRules, iControl, Product Review, Joe Pruitt

Stop Those XSS Cookie Bandits iRule Style

Joe Pruitt — Fri, 29 Aug 2008 22:18:07 GMT

In a recent post, CodingHorror blogged about a story of one of his friends attempts at writing his own HTML sanitizer for his website.

I won't bother repeating the details but it all boils down to the fact that his friend noticed users were logged into his website as him and hacking away with admin access. How did this happen? It turned out to be a Cross Site Scripting attack (XSS) that found it's way around his HTML sanitizing routines. A user posted some content that included mangled JavaScript that made an external reference including all history and cookies of the current users session to an alternate machine.

CodingHorror recommended adding the HttpOnly attribute to Set-Cookie response headers to help protect these cookies from being able to make their way out to remote machines. Per his blog post:

HttpOnly restricts all access to document.cookie in IE7, Firefox 3, and Opera 9.5 (unsure about Safari)
HttpOnly removes cookie information from the response headers in XMLHttpObject.getAllResponseHeaders() in IE7. It should do the same thing in Firefox, but it doesn't, because there's a bug.
XMLHttpObjects may only be submitted to the domain they originated from, so there is no cross-domain posting of the cookies.

Whenever I hear about modifications made to backend servers, alarms start going off in my head and I get to thinking about how this can be accomplished on the network transparently. Well, if you happen to have a BIG-IP, then it's quite easy. A simple iRule can be constructed that will check all the response cookies and if they do not already have the HttpOnly attribute, then add it. I went one step further and added a check for the "Secure" attribute and added that one in as well for good measure.

when HTTP_RESPONSE {
  foreach cookie [HTTP::cookie names]
  {
    set value [HTTP::cookie value $cookie];
    if { "" != $value }
    {
      set testvalue [string tolower $value]
      set valuelen [string length $value]
      #log local0. "Cookie found: $cookie = $value";
      switch -glob $testvalue {
        "*;secure*" -
        "*; secure*" { }
        default { set value "$value; Secure"; }
      }
      switch -glob $testvalue {
        "*;httponly*" -
        "*; httponly*" { }
        default { set value "$value; HttpOnly"; }
      }
      if { [string length $value] > $valuelen} {
        #log local0. "Replacing cookie $cookie with $value"
        HTTP::cookie value $cookie "${value}"
      }
    }
  }
}

If you are only concerned with the Secure attribute, then you can always use the "HTTP::cookie secure" command but as far as I can tell it won't include the HttpOnly attribute.

So, if you determine that HttpOnly cookies are the way you want to go, you could manually configure these on all of your applications on your backend servers. Or... you could configure it in one place on the network. I think I prefer the second option.

-Joe

Technorati Tags: F5, DevCentral, XSS, Cookie, HttpOnly, CodingHorror, Joe Pruitt

Crack open the books, it's iRule time

Joe Pruitt — Fri, 29 Aug 2008 17:10:17 GMT

Hot off the presses!

I just received an email from Beth, our Director of World Wide Customer Education, that starting now registration is open for a brand spanking new "Configuring BIG-IP V9.x With iRules" course offered by F5 Global Training - WOOHOO!

This three-day course gives networking professionals an understanding of how to configure a BIG-IP v9 system with iRules. The course builds on the foundation of the BIG-IP Local Traffic Manager (LTM) Essentials course, demonstrating how to logically plan and write iRules to help monitor and manage common tasks involved with processing traffic on the BIG-IP. Course Labs consist of writing, applying and evaluating the effect of iRules on LTM traffic. This hands-on course includes lectures, labs, and discussions.

So if you find yourself in need of a little more assistance in iRule Elements, Syntax and Troubleshooting, iRule Optimization, iRule Security, Expressions and Operators, Variables and Loops, Data Classes, Persistence and Server Data, and Statistics, then this course is for you! The full class description can be found here. The upcoming schedule in the US is Oct 14-16 in Seattle, Nov 10-12 in NYC, and Dec 2-5 in Seattle. Oh, and if you are in the UK, never fear... You can climb aboard and catch a class Sept 17-19, Nov 11-19, or Dec 10-12 in Chertsey, UK.

Congrats to the entire Global Training team on getting this course out!

Links: Course Overview, Course Table of Contents, Course Schedules, and Class Registration.

-Joe

Technorati Tags: F5, DevCentral, BIG-IP, iRules, Training, Joe Pruitt

Socializing the Network

Joe Pruitt — Fri, 29 Aug 2008 01:07:04 GMT

A while ago I wrote a little app that listened to the BIG-IP for status change notifications and logged them to disk. I showed this to Robert Scoble and the Channel 9 crew when they visited the F5 headquarters and he asked if he could get those results in his RSS reader. I answered that by writing the BigipBlogging sample that I submitted to the DevCentral CodeShare

I'm an early adopter in most web based tools so naturally I was a early member on Twitter. Last year I blogged about an extension to the original program that listened for notification messages and in addition to writing them to disk, the messages could be proxied to my BIG-IP's Twitter acccount. This has the added benefit of giving me access to a free SMS gateway to allow status messages to go to my cell phone - which is GREAT for a demo BTW!

Fast-Forward to earlier this week... I received an email from Lori asking if I'd ever released the source for the application as she thought this was a great time to do it. I could have sworn I did but it seems I kept it all to myself as I could not find heads or tails of it anywhere on DevCentral. I guess since there was no request for it, it slipped by. Lori said when I posted this in May last year, Twitter was for a niche audience, but now it's mainstream.

And who am I to say no to my fellow blogger...

So, here you go. Check out the PerlTwitterProxy sample added to the iControl CodeShare. Usage is pretty simple if you set it up on your BIG-IP. If so, then all you have to customize is the Twitter credentials you'd like to use for message posting.

Oh and Lori, we'll see how many downloads this thing gets and if Twitter has reached mainstream in the networking community.

-Joe

Technorati Tags: F5,DevCentral,BIG-IP,iControl,Twitter,Social Networks,Channel 9,Robert Scoble,Lori Mac Vittie,Joe Pruitt

Symphonic releases TrueView ADC Edition

Joe Pruitt — Fri, 01 Aug 2008 22:13:21 GMT

I found out about this at our partner conference earlier this week and it looks like Symphonic's TrueView ADC Edition has made it's way out into the wild.

From the press sheet:

Symphoniq, in conjunction with F5, has created a unique monitoring solution to leverage your existing Application Deliver Controller (ADC) infrastructure to give you detailed, actionable insight into how the infrastructure is running, from your end user's perspective.
TrueView, ADC Edition takes advantage of Symphoniq's TrueView technology to measure real end-user response times, and leverages F5's iRules and iControl technologies to seamlessly integrate with your infrastructure to provide the information you need to optimize your web application delivery.

With all the benefits of the True Product line, TrueView ADC Edition is built exclusively around F5's BIG-IP. They are using iControl to enable Symphonic transaction monitoring and, in doing so, the BIG-IP is automatically configured to dynamically instrument outgoing web pages or SOA calls.

Key highlights in the TrueView ADC Edition include:

Monitors application performance as experienced by the real users of HTML, AJAX, Flash and Silverlight applications
Collects detailed Web performance parameters (such as response time, parsing time, time to first byte, and error rate) from the real user's perspective at the browser
Allows setting of thresholds to generate alerts on Web performance parameters to support 24/7 operations
Capture and report on F5 BIG-IP device statistics
Correlates F5 BIG-IP device statistics with critical web application parameters to gain unprecedented visibility
Business group oriented approach relates performance issues to business impact
Customizable SQL-based reporting engine supports service level reporting and historical data archival
Monitoring functionality leverages existing F5 BIG-IP appliances using iRules and iControl, no additional third-party appliance required
Seamless migration to the full TrueView suite for end-to-end application performance monitoring and diagnostics

If you are a BIG-IP customer and are looking at ways to eek the most out of your applications and their performance on the network, I'd highly suggest you take a look at Symphonic's new offering.

Who knows, maybe we'll get them on a podcast sometime soon to talk about how they've used iControl and iRules to their, and your, advantage.

-Joe

Technorati Tags: F5, Symphonic, TrueView, ADC, iControl, iRules, Joe Pruitt

Scaling Ruby on Rails to 1 Billion Page Views a Month

Joe Pruitt — Tue, 15 Jul 2008 17:41:57 GMT

A while ago I blogged about how F5 was making mongrels better with a Side of Mayo. I referenced a blog post on Joyent's wonderful Joyeur blog on why Joyent uses F5's BIG-IP for their customers. Well, those krazy kids at Joyent are at it again...

In a recent post, Joyent point out how LinkedIn, a customer of theirs, built a Facebook application called BumperSticker using Ruby On Rails. LinkedIn made use of Joyent's Accelerators and our very own BIG-IP to scale Ruby on Rails to some very significant numbers.

13.5 million installations
1.5 million daily active users
20-27 million canvas page views a day

All this is served by

13 web application servers running nginx and mongrel.
8 static asset servers serving over 3,500,000 stickers, soon to migrate to a CDN.
4 MySQL servers in a master/slave configuration using Rick Olson's excellent masochism plugin.

For those video inclined, Joyent has an added bonus: check out the video they put together on the subject.

So, as the Twitter's out there continue to have availability issues and the debate continues as to the scalability of Ruby on Rails, BIG-IP helps show that with a good design and infrastructure planning, big things are possible. Keep up the good work Joyent! Oh, and if you ever want to do a guest spot on the DevCentral Podcast, please let us know. Oh, and if you ever need a guest for your Quad Core podcast, let me know - I'd be glad to sit in!

Technorati Tags: F5, DevCentral, Joyent, Joyeur, LinkedIn, Ruby on Rails, Joe Pruitt

Japanese Marketing - BIG-IP

Joe Pruitt — Tue, 01 Jul 2008 21:21:35 GMT

Here's another post on Japanese Marketing, F5 Style. I've talked about iRules, TMOS, and FirePass and for today I've got our very own BIG-IP. As I mentioned in my previous posts, since I don't speak Japanese, the only way I can interpret this marketing sheet is by the graphics on it. So, again, I'll give you my view on what the message is:

The guy in this photo is not really a guy at all, he's a puppet since there is no bottom half to his body.
The left picture shows him with a blue forehead - not sure what to infer from that.
The puppet has the added "Spock from Star Trek Eyebrow Lift" that was made famous by Leonard Nimoy in the original Star Trek series.
BIG-IP works like 4 stars in a data center with three racks of servers, but it gets a 5th star when you increase the number of racks to twelve. Plus you get an added blue glow out of your data center!
Four points are presented around this 5 star blue glow (you'll notice there are four points on each star!). The first one being BIG-IP and iRules, the second being L3 and ICMP, the 3rd is PVA, and the 4th is HTTP.
If the four points aren't good enough for you, I bet you didn't know there was a built-in matchmaking service available. There is a nifty flowchart guiding you to your ideal product match. I ran through the flowchart and here's where I ended up:

Do you like lots of ports to stick your wires? : Yes - Move to the right
Are you looking for a partner in the with a healthy 2U figure? : Yes - Move to the right.
Do you need 1Gbps? : Yes - Move down.
Are you sure you want a 2U figure? : Yes - Move down.
Do you need 10Gbps? : Yes - Move down.
That leads me to the 8400 as my ideal match.

So, there it is. While BIG-IP didn't have as many unexpected features as FirePass did, it sure did make up for it in sheer muscle. So, I'm an 8400, which one are you?

-Joe

Technorati Tags: F5, DevCentral, iRules, TMOS, FirePass, BIG-IP, Japan, Tokyo, Joe Pruitt

Japanese Marketing - TMOS

Joe Pruitt — Wed, 25 Jun 2008 16:56:48 GMT

Continuing on from yesterdays post on Japanese Marketing with iRules, today I've got a new one for you. Today's Japanese Marketing sheet is brought to you by TMOS. As I did with the iRules version from yesterday, I'll pass along my interpretation of what's going on with the guy above.

This guy looks very very happy!
The BIG-IP he's looking at seems to be on a shelf and not racked up in a data center so I assume he's looking at the local network appliance store in Akihabara. This was news to me as I wasn't aware we were selling in the retail channel. I wonder if he's paying with cash? Hello sir, that will be 5,000,000 yen please...
The BIG-IP seems to be a 8800 so this guy is expecting some heavy traffic on his network.
He has a name badge with a picture but no name so I'm surprised they gave him the corporate credit card on his first day on the job.
He is happily liberated from the pocket protector for the pen in his pocket.
He is missing his bottom half. How's he going to get his wallet to pay for the 8800?

So, if you want to be as fulfilled with your job as this guy is, head on down to your local network appliance store and pick up your very own 8800. Oh, and tell them Joe sent you - I want my commission B-).\

Stay tuned for tomorrows marketing coverage of FirePass.

-Joe

Technorati Tags: F5, DevCentral, Tokyo, Japan, Marketing, Cartoons, TMOS, Joe Pruitt