Cloud Docs Home > F5 Public Cloud Integrations Index

Amazon Web Services: Single NIC BIG-IP VE

Complete these tasks to deploy BIG-IP VE in a single NIC configuration in the AWS environment.

This is a specific example, which you can use to test a single NIC deployment. When done, you should be able to send traffic to your application servers through BIG-IP VE.

Step Task Description
1 Choose an F5 license Choose an F5 license. You can get a trial license if you need one.
2 Create a VPC with one subnet

Use the AWS VPC wizard to create a VPC with a single subnet.

  • Subnet: 10.0.0.0/24
3 Deploy a BIG-IP VE instance

From the AWS Marketplace, choose an F5 BIG-IP VE image (with hourly/annual license if you plan to use Auto Scaling). When you deploy the instance, choose the VPC you created earlier.

  • Interface: eth0
  • Primary Private IP: 10.0.0.200
4 Create an Elastic IP address

Create an Elastic IP address and associate it with the BIG-IP VE instance. You will use this IP address to access the BIG-IP Configuration utility and to access your application servers (by way of the virtual server).

  • Elastic IP: 52.x.y.x
5 Set an admin password for BIG-IP VE

Before you can license and provision BIG-IP VE, use SSH and your key pair to connect to the instance and set a strong password.

  • In tmsh, type modify auth password admin
6 License BIG-IP VE

Use the admin account to log in to the BIG-IP Configuration utility (https://<ElasticIP:8443>). If you have trouble accessing the Configuration utility, check the AWS security groups to ensure that they allow the appropriate traffic.

Note: In BIG-IP VE 12.0.0 and prior, the port is 443 instead.

7 Provision BIG-IP VE Enable the modules you need.
8 Change the Config utility port BIG-IP VE 12.0.0 only. Change the Config utility from port 443 to 8443. After BIG-IP VE 12.1.0, it is on port 8443 by default.
9 Create a VLAN and self IP Prior to BIG-IP VE 12.0.0, you must create a VLAN and self IP address. After 12.0.0, BIG-IP VE creates these automatically.
10 Create a pool and add members to it

Create a pool that contains your application servers.

  • Pool name: web_pool
11 Create a virtual server

Create a virtual server, which provides a destination for your inbound web traffic and points to the pool of web servers.

  • Virtual IP address: 10.0.0.200, service port: 443

Sample single-NIC configuration

The following diagram shows a basic single NIC deployment of BIG-IP VE in an Amazon Virtual Private Cloud (VPC). Traffic is flowing through BIG-IP VE to application servers. The BIG-IP virtual server is listening for traffic destined for port 443. Port 8443 is for management traffic.

Complete the tasks in this guide to create this deployment.

Note: Alternately, you can use CloudFormation templates to create this deployment. For more information about CloudFormation templates provided by F5, go to https://github.com/F5Networks.

../_images/diagram_singlenic.png

In this configuration, all access to the BIG-IP VE appliance is through the same IP address and virtual network interface (vNIC). This single NIC deployment has the following benefits:

  • BIG-IP VE creates networking objects (vNIC 1.0, an internal VLAN, and an internal self IP address).
  • In BIG-IP VE 12.1.0 and later, BIG-IP VE sets the Configuration utility port to 8443 (instead of 443).
  • If you want to pass traffic to BIG-IP VE from an AWS load balancer as part of Auto Scaling, this is the setup you need.
  • If you do not need a separate management network, this configuration is less complex than other configurations.

Follow the steps in this guide, or if you’d prefer, watch a video of the deploy:

Create a VPC with one subnet

A BIG-IP VE instance must be in an Amazon virtual private cloud (VPC). You can use a wizard to create a basic VPC.

  1. In the AWS Management Console, from the Services menu at the top of the screen, select VPC.
  2. Click Start VPC Wizard -> VPC with a Single Public Subnet, and then click Select.
  3. For the CIDR block, use 10.0.0.0/24.
  4. In the VPC name field, type a name.
  5. Retain all other default settings and click Create VPC.
  6. Click OK to view the list of VPCs.

Deploy a BIG-IP VE instance

To create an EC2 instance of BIG-IP VE in AWS, you deploy a BIG-IP VE image from the Amazon Web Services (AWS) Marketplace.

  1. Go to the AWS Marketplace.

  2. In the Search AWS Marketplace field, type F5 BIG-IP and then click GO.

  3. Click the version you want to deploy and then click Continue.

    Important: If you are going to use Auto Scaling with BIG-IP VEs, choose an hourly/annual image.

  4. By the region where you created your VPC, click Launch with EC2 Console.

  5. Choose the instance type based on the information in the Amazon EC2 instances for BIG-IP VE topic in this guide.

  6. Click Next: Configure Instance Details.

  7. From the Network list, select your VPC. The Subnet field is automatically populated.

  8. In the Network interfaces area, in the Primary IP field, type 10.0.0.200.

    ../_images/single_deploy1.png

  9. Click Next: Add Storage and then Next: Tag Instance.

  10. In the Value field, type a name for the instance and click Next: Configure Security Group. For security groups, SSH traffic is through port 22 by default. Add these additional rules.

    ../_images/single_deploy2.png

    You can make these rules more secure by listing ranges of IP addresses as the source that will have access to BIG-IP VE.

  11. Click Review and Launch.

  12. Confirm the settings and click Launch.

  13. Select your key pair, accept the acknowledgment, and click Launch Instances.

  14. Click View Instances to view the new instance.

When the status in the Status Checks column changes from Initializing to 2/2 checks passed, the instance is ready.

Important: If you chose an hourly instance, you must associate an AWS Elastic IP address with the instance while it is launching, so that the instance can register the license with F5. If the instance does not have internet access when it first boots, you must reboot the instance so it can connect to F5 for licensing.

Create an Elastic IP address

A BIG-IP VE instance must be in an Amazon virtual private cloud (VPC). You can use a wizard to create a basic VPC.

You use the BIG-IP Configuration utility to configure the BIG-IP VE instance. To access the Configuration utility from the Internet, you use an Elastic IP (EIP) address associated with the BIG-IP VE instance. You will use this same EIP to access your application servers. Hourly instances of BIG-IP VE also use the EIP for internet access so they can get a license from F5.

Note: EIPs are accessible to the Internet. Because of this, later you will set a strong password for the BIG-IP VE admin account, which you use to log in to the Configuration utility.

  1. From the Services menu at the top of the AWS Management Console, select EC2.

  2. In the Navigation pane, under NETWORK & SECURITY, select Elastic IPs.

  3. Click Allocate New Address.

  4. From the EIP used in list, select VPC.

    ../_images/elasticip1.png

  5. Click Yes, Allocate and then click Close.

  6. Right-click the newly created EIP and select Associate Address from the popup menu screen.

  7. Select the BIG-IP VE instance and the management subnet’s private IP address, 10.0.0.200.

    ../_images/elasticip2.png

  8. Click Associate.

Set the admin password for BIG-IP VE

The first time you boot BIG-IP VE, you must connect to the instance and create a strong admin password. You will use the admin account and password to access the BIG-IP Configuration utility.

This management interface may be accessible to the Internet, so ensure the password is secure.

This example shows how to use PuTTy to connect, but you can use any SSH utility.

  1. Open PuTTy and in the Host Name (or IP address) field, enter the external IP address.

    ../_images/admin_password1.png

  2. In the Category pane on the left, click Connection -> SSH -> Auth.

  3. In the Private key file for authentication field, choose your .ppk file.

    ../_images/admin_password2.png

  4. Click Open.

  5. If a host key warning appears, click OK.

    The terminal screen displays: login as:.

  6. Type admin and press Enter.

    You are now at the tmsh command prompt.

  7. Modify the admin password:

    modify auth password admin

    The terminal screen displays the message:

    changing password for admin
    new password:
    
  8. Type the new password and press Enter.

    The terminal screen displays the message:

    confirm password

  9. Re-type the new password and press Enter.

  10. Ensure that the system retains the password change and press Enter.

    save sys config

    The terminal screen displays the message:

    Saving Ethernet mapping...done

License BIG-IP VE

You must enter license information before you can use BIG-IP VE.

  1. Open a web browser and log in to the BIG-IP Configuration utility by using https with the external IP address and port 8443, for example: https://<external-ip-address>:8443. The username is admin and the password is the one you set previously.

  2. On the Setup Utility Welcome page, click Next.

  3. On the General Properties page, click Activate.

  4. In the Base Registration key field, enter the case-sensitive registration key from F5.

    For Activation Method, if you have a production or Eval license, choose Automatic and click Next.

    If you chose Manual, complete these steps:

    1. In the Step 1: Dossier field, copy all of the text and then click Click here to access F5 Licensing Server.

      ../_images/license1.png

      A separate web page opens.

    2. On the new page, click Activate License.

    3. In the Enter your dossier field, paste the text and click Next.

      ../_images/license2.png

    4. Accept the agreement and click Next.

    5. On the Activate F5 Product page, copy the license text in the box. Now go back to the BIG-IP Configuration utility and paste the text into the Step 3: License field.

      ../_images/license3.png

    6. Click Next.

The BIG-IP VE system registers the license and logs you out. When the configuration change is successful, click Continue to provision BIG-IP VE.

Provision BIG-IP VE

You must confirm the modules you want to run before you can begin to work in the BIG-IP Configuration utility.

  1. Open a web browser and log in to the BIG-IP Configuration utility.

  2. On the Resource Provisioning screen, change settings if necessary and click Next.

  3. On the Device Certificates screen, click Next.

  4. On the Platform screen, in the Admin Account field, re-enter the password for the admin account and click Next.

    ../_images/provision1.png

    BIG-IP VE logs you out.

  5. When you log back in, on the Setup Utility -> Network screen, in the Advanced Network Configuration area, click Finished.

    ../_images/provision2.png

Change the Configuration utility port

The BIG-IP Configuration utility uses port 443 by default. Change the port to 8443 so you can use 443 for application traffic.

  1. Use a secure shell terminal (SSH), like PuTTy, to access the instance; use the key pair you specified when you deployed the instance.

  2. Type tmsh to ensure you are accessing the tmsh prompt.

  3. Confirm the SSL port. list sys httpd ssl-port

    The result should be ssl-port 443.

  4. Move the port from 443 to 8443.

    modify sys httpd ssl-port 8443

  5. Confirm the move was successful. list sys httpd ssl-port

    The result should be ssl-port 8443.

  6. Add 8443 to the default self allow port list.

    modify net self-allow defaults add { tcp:8443 }

  7. Now that the Configuration utility is no longer using port 443, remove the reference to it.

    modify net self-allow defaults delete { tcp:443 }

  8. Confirm the changes. list net self-allow defaults

    tcp:pcsync-https is for 8443 and should be in the list. tcp:https is for 443 and should not be in the list.

  9. Save the changes to the system configuration.

    save sys config

  10. End the SSH session.

  11. Open a web browser and go to the BIG-IP Configuration utility by using port 8443, for example: https://<public-ip-address>:8443.

Now create a VLAN and self IP address for the NIC.

Create a pool and add members to it

Traffic goes through BIG-IP VE to a pool. Your application servers should be members of this pool.

  1. Open a web browser and go to the BIG-IP Configuration utility, for example: https://<external-ip-address>:8443.

  2. On the Main tab, click Local Traffic -> Pools.

  3. Click Create.

  4. In the Name field, type web_pool. Names must begin with a letter, be fewer than 63 characters, and can contain only letters, numbers, and the underscore (_) character.

  5. For Health Monitors, move https from the Available to the Active list.

  6. Choose the load balancing method or retain the default setting.

  7. In the New Members section, in the Address field, type the IP address of the application server.

  8. In the Service Port field, type a service port, for example, 443.

  9. Click Add.

    The list now contains the member.

  10. Add additional pool members as needed and click Finished.

Create a virtual server

A virtual server listens for packets destined for the external IP address. You must create a virtual server that points to the pool you created.

  1. In the BIG-IP Configuration utility, on the Main tab, click Local Traffic -> Virtual Servers.

  2. Click Create and populate the following fields.

    Field Value
    Name A unique name
    Destination Address/Mask BIG-IP VE’s private IP address
    Service Port 443
    HTTP Profile http
    SSL Profile (Client) clientssl
    SSL Profile (Server) serverssl
    Source Address Translation Auto Map
    Default Pool web_pool

    Note: These settings are for demonstration only. For details about securing a web application with SSL, see the product documentation at askf5.com.

  3. Click Finished.

Traffic to the BIG-IP VE external IP address will now go to the pool members. To test in a browser, type: https://<external-IP-address>.

Amazon EC2 instances for BIG-IP VE

When you deploy BIG-IP VE, you have to choose an Amazon instance type. The type you choose depends on how many F5 modules you want to run, how much throughput you need, how many vNICs you need, and how much vCPU and storage you require. You should choose an F5 license and Amazon instance type before deploying BIG-IP VE.

Good Licenses

If you choose a Good image, you can use the following AWS EC2 instance types.

AWS instance vCPUs Memory (GiB) Max # of vNICs
t2.medium* 2 4 3
t2.large* 2 8 3
m3.medium* 1 3.75 2
m3.large 2 7.5 3
m4.large 2 8 2
c3.xlarge 4 7.5 4
c4.xlarge 4 7.5 4

* 25 Mbps and 200 Mbps licenses only.

With a Good license, you can also use any of the instance types recommended for Better or Best, though the license determines the maximum vCPU. For maximum limits for each F5 module, see https://support.f5.com/csp/article/K14810 in the AskF5 Knowledge Base.

Better Licenses

If you choose a Better image, you can use the following AWS EC2 instance types.

AWS instance vCPUs Memory (GiB) Max # of vNICs
t2.medium* 2 4 3
t2.large* 2 8 3
m3.large 2 7.5 3
m4.large 2 8 2
c3.xlarge 4 7.5 4
c4.xlarge 4 7.5 4
m3.xlarge 4 15 4
m4.xlarge 4 16 4
c3.2xlarge 8 15 4
c4.2xlarge 8 15 4

You can also use any of the recommended types for Best, though the license determines the maximum vCPU.

Best Licenses

If you choose a Best image, you can use the following AWS EC2 instance types. You can also use any instance type listed for Better.

Note: The license determines the maximum vCPU.

AWS instance vCPUs Memory (GiB) Max # of vNICs
m3.2xlarge 8 30 4
m4.2xlarge 8 32 4
m4.4xlarge 16 64 8
m4.10xlarge 40 160 8
c3.4xlarge 16 30 8
c3.8xlarge 32 60 8
c4.4xlarge 16 30 8
c4.8xlarge 36 60 8
cc2.8xlarge 32 60.5 8

Performance may vary (based on things like region, instance type, traffic profile, functionality enabled, etc.). You may not need all licensed vCPUs to get the performance you need.

If necessary, you can resize the instance after you deploy. See http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-resize.html for details.

Standalone Modules

For standalone modules, choose an image based on the following information. Supported AWS EC2 instances are the same as listed in the tables above.

Module Image (BYOL Instances) Image (Utility Instances)
DNS Good, Better, or Best Better or Best
AFM Better or Best Better or Best
ASM Best* Best
APM Best* Best

*F5 recommends Best but you can also use Better. However, F5 may not support Better in later versions of BIG-IP VE.