Wednesday, July 19, 2017

Lightboard Lessons: Attack Mitigation with F5 Silverline

In this Lightboard Lesson, I describe how F5 Silverline Cloud-based Platform can help mitigate DDoS and other application attacks both on-prem and in the cloud with the Hybrid Signaling iApp. Learn how both on-premises and the cloud can work together to create a composite defense against attacks.



ps

Tuesday, July 11, 2017

BIG-IP VE on Google Cloud Platform

Hot off Cloud Month, let’s look at how to deploy BIG-IP Virtual Edition on the Google CloudPlatform.

This is a simple single-NIC, single IP deployment, which means that both management traffic and data traffic are going through the same NIC and are accessible with the same IP address.


Before you can create this deployment, you need a license from F5. You can also get a trial license here. Also, we're using BIG-IP VE version 13.0.0 HF2 EHF3 for this example.

Alright, let’s get started.

Open the console, go to Cloud Launcher and search for F5.

Pick the version you want.

Now click Launch on Compute Engine.

I’m going to change the name so the VM is easier to find… For everything else, I’ll leave the defaults.

And then down under firewall, if these ports aren’t already open on your network, you can open 22, which you need so you can use SSH to connect to the instance, and 8443, so you can use the BIG-IP Configuration utility—the web tool that you use to manage the BIG-IP.

Now click Deploy. It takes just a few minutes to deploy.

And Deployed.

When you’re done, you can connect straight from the Google console. This screen cap shows SSH but if you use the browser window, you need to change the Linux username to admin in order to connect.

Once done, you'll get that command line.

If you choose the gcloud command line option and then run in the gcloud shell, you need to put admin@ in front of the instance name in order to connect.


We like using putty so first we need to go get the external IP address of the instance. So I look at the instance and copy the external IP.

Then we go into Metadata > SSH keys to confirm that the keys are there. (Added earlier), Whichever keys you want to use to connect, you should put them here.

BIG-IP VE grabs these keys every minute or so, so any of the non-expired keys in this list can access the instance. If you remove keys from this list, they’ll be removed from BIG-IP and will no longer have access. You do have the option to edit the VM instance and block project-wide keys if you’d like.

Because my keys are already in this list I can open Putty now, and then specify my keys in order to connect.


The reason that we're using ssh to connect is that you need to set an admin password that’s used to connect to the BIG-IP Config utility.

So I’m going to set the admin password here… (and again, you can do these same steps, no matter how you connect to the instance)

tmsh Command is: modify auth modify auth password admin
And then: save sys config to save the change.

Now we can connect and log in to the BIG-IP Config utility by using https, the external IP and port 8443. Now type admin and the password we just set.

Then we can proceed with licensing and provisioning BIG-IP VE.

A few other notes:
  • If you’re used to creating a self IP and VLAN, you don’t need to do that. In this single NIC deployment, those things are taken care of for you.
  • If you want to start sending traffic, just set up your pool and virtual server the way you normally would. Just make sure if your app is using port 443, for example, that you add that firewall rule to your network or your instance.
  • And finally, you most likely want to make your external IP address one that is static, and you can do that in the UI by choosing Networking, then External IP addresses, then Type).
  • If you need any help, here's the Google Cloud Platform/BIG-IP VE Setup Guide and/or watch the full video.

ps

Wednesday, July 5, 2017

DevCentral’s Featured Member for July – Vosko Networking’s Niels van Sluis

For almost two years Niels van Sluis has worked as a Security Engineer for Vosko Networking. Vosko's security team focuses on supporting security solutions from various vendors like F5, Check Point, Cisco and RSA. Niels focuses is on F5 BIG-IP and Check Point. He started his professional career about 20 years ago in the ISP industry as an Unix Administrator, and switched to the public healthcare sector around 2001. In more recent years, he’s moved more towards working on network security and design. Apparently, having a Unix background helps a lot when working with modern security devices, since most of them are running on some flavor of Unix. When not working or spending time on DevCentral, he likes to travel, visit historic places and enjoy nature. And Niels is DevCentral’s Featured Member for July!

DevCentral: Tell us a little about the areas of BIG-IP expertise you have.
Niles: My first encounter with BIG-IP was during my previous job. A colleague had been working with BIG-IP before and introduced it as a replacement for the KEMP load balancer that was currently in use. So, I had to attend the ‘Administering and Configure BIG-IP’ course. It was then – when I learned about iRules – I saw the full potential of this nifty device. But during my days there I didn’t do much with the BIG-IP as in terms to administration. I would only touch the box, if my colleague was on leave. This however changed when I started working for Vosko Networking. Within about a year’s time I’ve gone through the BIG-IP certification program, spend a lot of time on DevCentral and got my hands dirty in the field. The BIG-IP areas I’m most experienced in are LTM and APM. The most fun part for me are iRules (LX).
DC: You are a Security System Engineer at Vosko Networking BV. Can you describe your typical workday?
NS: My typical workday depends whether I’m working on a project or not. When working on projects I often visit customers throughout the country to help them deploy new equipment or configure new services. Recently I’ve migrated quite a few Cisco ACE and Microsoft Forefront TMG deployments to the F5 BIG-IP platform. Other times I help customers upgrading their BIG-IPs or setting up more advanced APM configurations including SAML and SSO. When I’m not working on projects I work on support cases or trying out new stuff in our lab.
DC: You have a number of F5 Certifications including most of the Technology Specialist (LTM, GTM, APM, ASM) certifications. Why are these important to you and how have they helped with your career?
NS: First of all, they are required for Vosko Networking to participate in the F5 Support Partner program. But more important to myself is that the F5 certification program helps to get deeper knowledge in to how the various BIG-IP modules work, how they relate (interact) to each other and what part the BIG-IP plays in modern network infrastructures. The certification program is also very practical; you can directly apply what you have been learning. It helped me to get more comfortable and confident in my day to day job.
DC: Describe one of your biggest BIG-IP challenges and how did DevCentral helped in that situation.
NS: In my experience, there are BIG-IP challenges every day. I think this is the result of the BIG-IP being some kind of network-magic-box, that can do about everything. With most other security devices, one is limited to the functionality and settings the box is shipped with. But with BIG-IP, you can really be creative and think outside the box. If the required functionality is missing, you can build it yourself with iRules. And customers know this. I often go out to customers with a specific need, but when starting out it isn’t always clear if this is something the BIG-IP can do by default. In these situations, access to the DevCentral community is crucial. Even though BIG-IP isn’t an open source project, it’s amazing to see how members share their time, code and knowledge to help each other. For example, some code that really helped me out are Yann Desmarest’s APM Full Step Up Authentication and Stanislas Piron’s APM SharePoint authentication. Besides code, I think the Lightboard Lessons are awesome; very helpful!
DC: Lastly, if you weren’t an IT admin – what would be your dream job? Or better, when you were a kid – what did you want to be when you grew up?
I think I wanted to be an electrician when I was young, but I’m pretty sure that isn’t my dream job. As long as I’m able to learn new things and have new challenges, I’m happy how things are. I think I’m useless for any other job that doesn’t require a keyboard. Thanks for the privilege for being a featured member and thanks for the Lightboard Lessons as well. I really enjoy them.

Thanks Niels! Check out all of Niels' DevCentral contributions, connect with him on LinkedIn and follow Vosko@vosko.

Friday, June 30, 2017

DevCentral Cloud Month Wrap

Is it the end of June already? At least it ended on a Friday and we can close out DevCentral’s Cloud Month followed by the weekend! First, huge thanks to our Cloud Month authors: Suzanne, Hitesh, Greg, Marty and Lori. Each delivered an informative series (23 articles in all!) from their area of expertise and the DevCentral team appreciates their involvement. We hope you enjoyed the content as much as we enjoyed putting it together.

And with that, that’s a wrap for DevCentral Cloud Month. You can check out the original day-by-day calendar and below is each of the series if you missed anything. Thanks for coming by and we’ll see you in the community.

AWS - Suzanne & Thomas
Cloud/Automated Systems – Hitesh
Azure – Greg
Google Cloud – Marty
F5 Friday #Flashback – Lori
Cloud Month Lightboard Lesson Videos – Jason
#DCCloud17 X-Tra!

ps

Sunday, June 25, 2017

DevCentral Cloud Month - Week Five

What’s this week about?

This is the final week of DevCentral’s Cloud Month so let’s close out strong. Throughout the month Suzanne, Hitesh, Greg, Marty and Lori have taken us on an interesting journey to share their unique cloud expertise. Last week we covered areas like high availability, scalability, responsibility, inter-connectivity and exploring the philosophy behind cloud deployment models. We also got a nifty Lightboard Lesson covering BIG-IP in the private cloud.

This week’s focus is on maintaining, managing and operating your cloud deployments. If you missed any of the previous articles, you can catch up with our Cloud Month calendar and we’ll wrap up DevCentral's Cloud Month on Friday.


Thanks for taking the journey with us and hope it was educational, informative and entertaining!

ps

Related:

Sunday, June 18, 2017

DevCentral Cloud Month - Week Four

What’s this week about?


Ready for another week of Cloud Month on DevCentral? Suzanne, Hitesh, Greg, Marty and Lori are ready! Last week we looked at services, security, automation, migration, Ansible and other areas to focus on once you get your cloud running. We also had a cool Lightboard Lesson explaining BIG-IP in the public cloud. This week we go deeper into areas like high availability, scalability, responsibility, inter-connectivity and exploring the philosophy behind cloud deployment models.

Now that we’re half-way through Cloud Month, I thought it’d be fun to share a little bit about our authors.

Suzanne Selhorn is a Sr. Technical Writer with our TechPubs team. Our Technical Communications team are responsible for many of the deployment guides you use and are also the creators of some of the awesome step-by-step technical videos featured on DevCentral’s YouTube channel. She and Thomas Stanley crafted the AWS series.

Hitesh Patel is a Sr. Solution Architect covering Cloud/DevOps. He’s one of the smartest cloud cookies we got and works with F5 customers to get a handle on their cloud deployments. He also loves karaoke.

Greg Coward is a Solution Architect on our Business Development team. The BizDev team works with our many technology partners building out joint solutions. Greg covers Microsoft and how BIG-IP plays in Azure among other solutions.

Marty Scholes is an Applications Architect with our Solutions Marketing team. Traditionally, he writes whitepapers, technical articles and helps the Marketing team understand the technical nuances of various solutions and this month he went deep into GoogleCloud deployments.

Finally, someone you probably are already familiar due to her extensive writing and expertise, F5’s Principal Technical Evangelist Lori MacVittie. User 38 on DevCentral, she is a subject matter expert on emerging technologies and how F5 fits with the internet craze these days. I’ve been fortunate to have known & worked with Lori since her early days at F5 when we were both trailblazing Technical Marketing Managers.

The DevCentral team truly appreciates their contributions to Cloud Month and encourages you to connect with them.


ps

Sunday, June 11, 2017

DevCentral Cloud Month - Week Three

We hope you’re enjoying DevCentral’s Month thus far and Suzanne, Hitesh, Greg, Marty and Lori ready to go again this week. Last week we got you deployed in AWS and Kubernetes, learned the basics of Azure, got knee-deep in Cloud/Automated architectures and celebrated SOA’s survival. Now that your cloud is installed and running, this week we look at things like security, migration, services, automation and the challenges of data management.

Monday, Suzanne will help you secure your new AWS application with a F5 WAF; Tuesday, Hitesh will explore the Services Model for cloud architectures; Wednesday, Greg gets into Deployment Scenarios for BIG-IP in Azure; if you thought 24 minutes was quick, on Thursday Marty shows how to deploy an app into Kubernetes even faster; and Lori and her infinite cloud wisdom, wonders if the technical and data integration challenges from 10 years ago (100 in technology years) still exist for #Flashback Friday.

Great content so far and if you need to catch up or see what's coming, check out our Cloud Month Calendar.


ps

Monday, June 5, 2017

DevCentral Cloud Month - Week Two

What's this week about?

You got a mini taste of DevCentral’s Cloud Month last week and week two we really dig in. This week we’re looking at Build and Deployment considerations for the Cloud. The first step in successfully deploying in a cloud infrastructure. Starting today, Suzanne and team show us how to deploy an application in AWS; On Wednesday, Greg, harking the Hitchhiker’s Guide, explains Azure’s Architectural Considerations; Marty uncovers Kubernetes concepts and how to deploy an application in Kubernetes this Thursday; on #Flashback Friday, Lori takes us down memory lane wondering if SOA is still super. Filling my typical Tuesday spot, Hitesh reveals some foundational building blocks of F5’s cloud/automated architectures.
These will help get you off the ground and your head in the clouds, preferably Cloud Nine.
Enjoy!
ps
Related:

Thursday, June 1, 2017

Cloud Month on F5 DevCentral

#DCCloud17

The term ‘Cloud’ as in Cloud Computing has been around for a while. Some insist Western Union invented the phrase in the 1960s; others point to a 1994 AT&T ad for the PersonaLink Services; and still others argue it was Amazon in 2006 or Google a few years later. And Gartner had Cloud Computing at the top of their Hype Cycle in 2009.

No matter the birth year, Cloud Computing has become an integral part of an organization’s infrastructure and is not going away anytime soon. A 2017 SolarWinds IT Trends report says 95% of businesses have migrated critical applications to the cloud and F5's SOAD report notes that 20% of organizations will have over half their applications in the cloud this year. It is so critical that we’ve decided to dedicate the entire month of June to the Cloud.

We’ve planned a cool cloud encounter for you this month. We’re lucky to have many of F5’s Cloud experts offering their 'how-to' expertise with multiple 4-part series. The idea is to take you through a typical F5 deployment for various cloud vendors throughout the month. Mondays, we got Suzanne Selhorn & Thomas Stanley covering AWS; Wednesdays, Greg Coward will show how to deploy in Azure; Thursdays, Marty Scholes walks us through Google Cloud deployments including Kubernetes.

But wait, there’s more!

On Tuesdays, Hitesh Patel is doing a series on the F5 Cloud/Automation Architectures and how F5 plays in the Service Model, Deployment Model and Operational Model - no matter the cloud and on F5 Friday #Flashback starting tomorrow, we’re excited to have Lori MacVittie revisit some 2008 #F5Friday cloud articles to see if anything has changed a decade later. Hint: It has…mostly. In addition, I’ll offer my weekly take on the tasks & highlights that week.

Below is the calendar for DevCentral's Cloud Month and we’ll be lighting up the links as they get published so bookmark this page and visit daily! Incidentally, I wrote my first Cloud tagged article on DevCentral back in 2009. And if you missed it, Cloud Computing won the 2017 Preakness. Cloudy Skies Ahead!

June 2017

Monday Tuesday Wednesday Thursday Friday
28 29 30 31 ​ 1  ​

Cloud Month Intro & Calendar
2

Flashback Friday: The Many Faces of Cloud

Lori MacVittie
3
4 5

Successfully Deploy Your Application in the AWS Public Cloud

Suzanne Selhorn
6

Cloud/Automated Systems need an Architecture

Hitesh Patel
7

The Hitchhiker’s Guide to BIG-IP in Azure

Greg Coward
8  ​

Deploy an App into Kubernetes in less than 24 Minutes

Marty Scholes
9

F5 Flashback Friday: The Death of SOA Has (Still) Been Greatly Exaggerated

-Lori
10
11 12  ​

Secure Your New AWS Application with an F5 Web Application Firewall

-Suzanne
13  ​

The Service Model for Cloud/Automated Systems Architecture

-Hitesh


DCCloud17 X-tra!
14

The Hitchhiker’s Guide to BIG-IP in Azure – ‘Deployment Scenarios’

-Greg


DCCloud17 X-tra!
15  ​

Deploy an App into Kubernetes Even Faster (Than Last Week)

-Marty
16  ​

F5 Flashback Friday: Cloud and Technical Data Integration Challenges Waning

-Lori
17
18 19

Shed the Responsibility of WAF Management with F5 Cloud Interconnect

-Suzanne
20  ​

The Deployment Model for Cloud/Automated Systems Architecture

-Hitesh
21  ​

The Hitchhiker’s Guide to BIG-IP in Azure – ‘High Availability’

-Greg

DCCloud17 X-tra!

LBL Video: BIG-IP in the Private Cloud 
22  ​

Deploy an App into Kubernetes Using Advanced Application Services

-Marty
23  ​

Flashback Friday: Is Vertical Scalability Still Your Problem?

-Lori
24
25 26  ​

Get Back Speed and Agility of App Development in the Cloud with F5 Application Connector

-Suzanne
27

The Operational Model for Cloud/Automated Systems Architecture

-Hitesh
28

The Hitchhiker’s Guide to BIG-IP in Azure – ‘Life Cycle Management’

-Greg
29

What’s Happening Inside My Kubernetes Cluster?

-Marty
30

Cloud Month Wrap!

Titles subject to change...but not by much.

ps

Tuesday, May 23, 2017

Device Discovery on BIG-IQ 5.1

The first step in using a BIG-IQ to manage BIG-IP devices

BIG-IQ enables administrators to centrally manage BIG-IP infrastructure across the IT landscape. BIG-IQ discovers, tracks, manages, and monitors physical and virtual BIG-IP devices - in the cloud, on premise, or co-located at your preferred datacenter.

Let’s look at how to get BIG-IQ 5.1 to gather the information needed to start managing a BIG-IP device. This gathering process is called Device Discovery.

To get started, the first thing is to logon to the BIG-IQ

Once in, the first thing you do is let the BIG-IQ know about the BIG-IP device that you want to manage. Here, in Device Management>Inventory>BIG-IP Devices, we’ll click Add Device.

Here we’ll need the IP address, user name and password of the device you want to manage. If the device you want to manage is part of a BIG-IP Device Service Cluster (DSC), you’ll probably want to manage that part of its configuration by adding it to a DSC group on the BIG-IQ. After selecting a DSC, tell the BIG-IQ how to handle synchronization when you deploy configuration changes so that when you deploy changes to one device, the other DSC members get the same changes. Best practice is to let BIG-IQ do the sync.

Next click Add at the bottom of the page to start the discovery process.

Once the device recognizes your credentials, it’ll prompt you to choose the services that you want to manage. You always select LTM, even if you only mange other services because the other services depend on LTM. To finish the device discovery task, click Discover.

The BIG-IQ gathers the information it needs for each of the services you requested. This first step takes only a few moments while the BIG-IQ discovers your devices. You are done with discovery once the status update reads, Complete import tasks.

Now, we need to import the service configurations that the BIG-IQ needs before we can start managing that BIG-IP device. Click the link that says, Complete import tasks.

Next, you’ll begin the process of importing the BIG-IP LTM services for this device. Just like the discovery task, you’ll import LTM first.

Click Import.

This could take a little time depending on how many LTM objects are defined on this BIG-IP device. When the import finishes, BIG-IQ will display the date and time of when the operation was completed.

Now, we repeat the process for the second service provisioned on this device.

Importing an access device like BIG-IP APM is slightly different. Part of the import task is to identify the Access Group that this device uses to share its configuration. Whether you’re adding to an existing or creating a new access group, when you’re done entering the name of the group, click Add to start the import process. Here again, the time to process depends on how many BIG-IP APM configuration objects are defined on the device.

When the BIG-IP APM services import finishes and the time completed displays, you can simply click Close to complete the task.

You can now see that the device has been added to BIG-IQ.

That’s it! Now you can start managing the BIG-IP LTM and APM object on this device. For this article, we only imported LTM and APM objects but the process is the same for all services you manage.

Thanks to our TechPubs group and watch the video demo here.

ps

Related:

Tuesday, May 16, 2017

Updating an Auto-Scaled BIG-IP VE WAF in AWS

Update servers while continuing to process application traffic.


Recently we've been showing how to deploy BIG-IP (and F5 WAF) in various clouds like Azure and AWS.

Today, we’ll take a look at how to update an AWS auto-scaled BIG-IP VEweb application firewall (WAF) that was initially created by using this F5 github template. This solution implements auto-scaling of BIG-IP Virtual Edition (VE) Web Application Firewall (WAF) systems in Amazon Web Services. The BIG-IP VEs have the Local Traffic Manager (LTM) and Application Security Manager (ASM) modules enabled to provide advanced traffic management and web application security functionality. As traffic increases or decreases, the number of BIG-IP VE WAF instances automatically increases or decreases accordingly.

Prerequisites:


So, let’s assume you used the CFT to create a BIG-IP WAF in front of your application servers…and your business is so successful that you need to be able to process more traffic. You do not need to tear down your deployment and start over – you can make changes to your current deployment while the WAF is still running and protecting your environment.

For this article, a few examples of things you can change include increasing the throughput limit. For instance, When you first configured the WAF, you choose a specific throughput limit for BIG-IP. You can update that. You may also have selected a smaller AWS instance size and now want to choose a larger AWS instance type and add more CPU. Or, you may have set up your auto-scaling group to launch a maximum of two instances and now you want to be able to update the auto-scaling group attributes and add three.

This is all possible so let’s check it out.

The first thing we want to do is connect to one of the BIG-IP VE instances and save the latest configuration. We open putty, login and run the TMSH command (save /sys ucs /var/tmp/original.ucs) to save the UCS config file.

Then we use WinSCP to copy the UCS files to the desktop. You can use whatever application you like and copy the file wherever you like as this is just a temporary location.

Once that’s done, open the AWS Management Console and go to the S3 bucket. This bucket was created when you first deployed the CFT and locate yours.

When you find your file, click it and then click the Backup folder.

Once there, now upload the UCS file into that folder.

The USC is now in the folder.

The last step is to redeploy the CFT and change the selected options. From the main AWS Management Console, click CloudFormation, select your Stack and under Actions, click Update Stack.

Next, you can see the template we originally deployed and to update, click Next.

Scroll down the page to Instance Configuration to change the instance type size.

Right under that is Maximum Throughput to update the throughput limit.

And a little further down under Auto Scaling Configuration is where you can update the max number of instances. When done click Next at the bottom of the page.

It’ll ask you to review and confirm the changes. Click Update.

You can watch the progress and if your current BIG-IP VE instance is actively processing traffic, it will remain active until the new instance is ready.  Give it a little time to ensure the new instance is up and added to the auto scaling group before we terminate the other instance.

When it is done, we’ll confirm a few things.

Go to the EC2 Dashboard and check the running instances. We can see the old instance is terminated and the new instance is now available. You can also check the instance size and within the auto scaling group you can see the new maximum for number of instances.

And we’re deployed.

You can follow this same workflow to update other attributes of your F5 WAF. This allows you to update your servers while continuing to process traffic.

Thanks to our TechPubs group, you can also watch the video demo.

ps

Related: