Forum Discussion

cgrieves_14587's avatar
cgrieves_14587
Icon for Nimbostratus rankNimbostratus
Jan 09, 2019
Solved

BIGIP in a network Edge device role

Hi all, I need some assistance if possible. I'm familiar with F5s in a conventional load balancing role inside the corporate network, but we're building a new environment with a pair of 4000-series devices in a configsync pair. I have a DMZ network behind the corporate firewall, bound via LAGs to the 1Gb ports, and a set of internal VLANs bound via LAGs to the 10G ports which will be used for application services, Hypervisor management etc. We'd like to leverage APM to secure all traffic, essentially making them the edge devices for the internal environment.

 

I guess all services are going to be presented via VIPs/Pools/Nodes, but I'm not sure how to set up the basic routes/outgoing traffic rules, default gateways. Has anyone got any guidance or resources on how to configure a BIGIP in this sort of role? I've has a look around but couldn't find anything obvious...

 

Many thanks in advance

 

application delivery
application networking
BIG-IP
  • KevinA_246454's avatar
    KevinA_246454
    Jan 10, 2019

    HI

     

    your diagram explains a few things, the routing on the f5 can fairly simple or a bit complex based on your needs

     

    External Facing VLAN AKA vlanexternal give it an ip subnet this vlan will face your firewalls. the vlan will have a floating ip addresses as well to ensure failover to standby. from a default route perspective I am sure you can default route to the firewall ip if your internet breakout is residing that side. you can then launch your vip's from this vlan either create external facing vip's with a new ip subnet or use the external vlan ip subnet to give yourself vip's

     

    Internal vlan/vlan's will be facing the core switch. you can run one vlan/ipsubnet from your f5 10gig lag then route all internal facing networks towards your core network as a next hop, you might not even require snat because return traffic from internal will flow back to the f5 towards the firewall/internet.

     

    Also in this scenario your f5 will have to do routing because your core network needs to reach the internet via the f5 you will most likely require a ip forward virtual server. Hope this helps you.

     

    you can either use static routing or dynamic depending on your requirements.

     

4 Replies

Sort By
  • KevinA_246454's avatar
    KevinA_246454
    Icon for Cirrostratus rankCirrostratus
    Jan 09, 2019

    can you maybe provide some sort of flow/network diagram on how your deployment would like, find it difficult to make out your design or objective in your question.

     

  • cgrieves's avatar
    cgrieves
    Icon for Nimbostratus rankNimbostratus
    Jan 09, 2019

    I've knocked up the ugly pic below. I've omitted the OOB/management networks.

     

    Essentially we come in from the firewalls (corporate shared services) to two stacked DMZ switches in our "DMZ" with 1Gb aggregated uplinks to the F5s

     

    The F5s are then our edge devices for the hypervisor cluster, with redundant aggregated 10Gb links to a set of stacked fabric switches in our chassis.

     

    The question is simply- are there guides or resources I can use to configure an F5 (without AFM) for the role as an edge device?

     

    Many thanks!

     

     

  • KevinA_246454's avatar
    KevinA_246454
    Icon for Cirrostratus rankCirrostratus
    Jan 10, 2019

    HI

     

    your diagram explains a few things, the routing on the f5 can fairly simple or a bit complex based on your needs

     

    External Facing VLAN AKA vlanexternal give it an ip subnet this vlan will face your firewalls. the vlan will have a floating ip addresses as well to ensure failover to standby. from a default route perspective I am sure you can default route to the firewall ip if your internet breakout is residing that side. you can then launch your vip's from this vlan either create external facing vip's with a new ip subnet or use the external vlan ip subnet to give yourself vip's

     

    Internal vlan/vlan's will be facing the core switch. you can run one vlan/ipsubnet from your f5 10gig lag then route all internal facing networks towards your core network as a next hop, you might not even require snat because return traffic from internal will flow back to the f5 towards the firewall/internet.

     

    Also in this scenario your f5 will have to do routing because your core network needs to reach the internet via the f5 you will most likely require a ip forward virtual server. Hope this helps you.

     

    you can either use static routing or dynamic depending on your requirements.

     

  • Stanislas_Piro2's avatar
    Stanislas_Piro2
    Icon for Cumulonimbus rankCumulonimbus
    Jan 10, 2019

    If you want to enable routing feature between interfaces, you must create

     

    • one floating ip on every network, this ip is used by other devices as gateway on route configuration
    • forwarding ip virtual server(s). Without a virtual server, the bigip won’t route traffic.