Forum Discussion

Thong_196816's avatar
Thong_196816
Icon for Nimbostratus rankNimbostratus
Aug 06, 2015

set threshold for f5 / monitoring

hi,

 

1.) can cpu or memory threshold set for f5 for.e.g, cpu or memory more than 98% will receive alert instead use third party software

 

2.) any command to monitor or check the local traffic flow from virtual address -> pool -> destination pool member web server ? sometimes, need to know if the traffic access to the virtual address had directed the destination node member (webserver).

 

3.) read thru some article about f5 hardening security access, can anyone share the standard f5 hardening template which will be used to apply f5 with steps?

 

much appreciated and thank you. :)

 

APM
application delivery
LTM
monitor
security

1 Reply

Sort By
  • Ravi_K__Malhotr's avatar
    Ravi_K__Malhotr
    Icon for Nimbostratus rankNimbostratus
    Aug 07, 2015

    please try these. Answer 1. For system resources threshold configuration, you can use "Analytics" feature, easy configuration in Configuration Utility.

     

    Answer 2. For capturing the connections, use this command set [ show sys connection virtual-server-object ]. if you do ? after [ show sys connection ? ], you can see other options too, like capturing all traffic from specific source ip address as well. Alternately you can use Dashboard over Configuration Utility. CU --Main Tab -- Statistics -- Dashboard -- on top under View Tab, select "Local Traffic Manager". And then under LTM Statistics, you can choose either a virtual server, pool, pool members.

     

    Answer 3.

     

    3.1 make sure that SSH access is restricted to allowed subnet. 3.2 Also, make sure that access to Configuration Utility is also restricted as per the allowed subnet 3.3 make sure that port-lockdown feature is also configured as per the needs for the Self-IPs. you can pick "Default Allowed", or you can also choose specific ports as per the needs. 3.4 make sure that you have changed default passwords for root and admin user accounts. 3.5 make sure that you have identical NTP settings over the cluster. 3.6 something real simple and basic, but make sure that you have Banner configured for both SSH and GUI login. 3.7 configure idle timeout for automatic logout and also for dashboard viewing 3.8 Make sure that you have a third party Monitoring Server, Monitoring F5 BigIP appliances via SNMP and getting all valuable data like number of interfaces, CPU, Memory, Number of Connections, Hard Disk Usage, TMM Memory Usage statistics, Fan, power supply etc.... you can also use "Analytics" as well. 3.9 Health Monitor your application servers on their production tcp/udp ports instead of simple icmp health monitoring. 3.10 for cluster environment -- "Link down time on Failover" default value is set to 0.0 which means upon network link failure, or link down, F5 pairs will not failover. change this default settings to either like 0.5 up to 0.10. 3.11 Never use original profiles, always make a copy of the profile that you want to use, either it be protocol profile, service profile, or other profile. 3.12 something performance specific -- Make sure that you have understood and gathered all requirements before load balancing any application. i mean do not use persistence profiles where they are not needed.

     

    I can write many more, but the above are simple and basics. cover your ground. --Ravi K. Malhotra--