Enhance L7 Policy Capabilites with Enhanced Service Definitions¶

How ESDs Work¶

An ESD is a set of tags and values that define custom settings for BIG-IP objects. Typically, an ESD applies one or more profiles, policies, or iRules to a BIG-IP virtual server. The F5 agent reads all ESD JSON files located in /etc/neutron/services/f5/esd/ on startup.

The F5 agent applies ESDs to BIG-IP virtual servers using LBaaSv2 L7 policy operations. When you create an LBaaSv2 L7 policy object (neutron lbaas-l7policy-create), the agent checks the policy name against the names of all available ESDs. If it finds a match, the agent applies the ESD to the BIG-IP virtual server associated with the policy. If the agent doesn’t find a matching ESD, it creates a standard L7 policy. Essentially, the F5 agent supersedes the standard LBaaSv2 behavior, translating neutron lbaas-l7policy-create mypolicy into “apply the mypolicy ESD to the BIG-IP”.

You can define multiple ESDs, each of contains a set of predefined tags and values, in a single JSON file. The agent validates each tag and discards any that are invalid. ESDs remain fixed in agent memory until an agent is restarted. When you apply multiple L7 policies, each subsequent ESD overwrites the virtual server settings defined by previous ESDs. For this reason, we recommend that you define all settings you want to apply for a specific application in a single ESD. If you define multiple ESDs, each should apply to one (1) specific application.

Deleting an L7 policy that matches an ESD removes all ESD settings from the virtual server, returning the virtual server to its original state.

Agent Process¶

During startup, the F5 LBaaSv2 agent reads all JSON files in /etc/neutron/services/f5/esd/ and evaluates the ESD as follows:

1. The JSON is valid (the agent ignores all invalid JSON files).

2. The supported tag definitions are formatted correctly:

   1. Use a single string, or a comma-delimited list using standard JSON list notation ([]) . [1]
   2. The tag value (profile, policy, or iRule) must exist in the /Common partition.
   3. All of the desired profiles, policies, and/or iRules must be configured on your BIG-IP before you deploy the ESD.

Supported Tags¶

Use the tags in the table below to define the policies you want the F5 agent to apply to the BIG-IP.

Example

{
  "<ESD name>": {
    "<tag_name>": "<tag value>",
    "<tag_name>": "<tag value>",
    …
  },
  …
}

Add iRules¶

Use the lbaas_irule tag to add any desired iRules to any BIG-IP virtual server associated with an LBaaSv2 load balancer.

For example, if you want to re-write certificate values into request headers:

1. Create the desired iRule(s) in the /Common partition on the BIG-IP.
2. Define the lbaas_irule tag with a JSON list.

Example:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

{
  "esd_demo_1": {
    \\ define a single iRule
    "lbaas_irule": ["header_rewrite"]
  },
  "esd_demo_2": {
    \\ define two (2) iRules
    "lbaas_irule": [
      "header_rewrite",
      "remove_response_header"
    ]
  }
}

Add LTM Policies¶

Use the lbaas_policy tag to assign a BIG-IP LTM policy to a virtual server associated with an LBaaSv2 load balancer.

1. Create the policy in the /Common partition on the BIG-IP.
2. Define the lbaas_policy tag with a JSON list.

Example:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

{
  \\ define a single policy
  "esd_demo_1": {
    "lbaas_policy": ["custom_policy1"]
  },
  \\ define two (2) policies
  "esd_demo_2": {
    "lbaas_policy ": [
    "custom_policy1",
    "custom_policy2"
    ]
  }
}

Add Server-side SSL Termination¶

Use the lbaas_sssl_profile tag to add BIG-IP server-side SSL termination to a virtual server associated with an LBaaSv2 load balancer.

Example:

"lbaas_sssl_profile": "serverssl"

Customize Client-side SSL Termination¶

Use the lbaas_cssl_profile tag tag to add a BIG-IP SSL profile to a virtual server associated with an LBaaSv2 load balancer.

1. Create a client SSL profile in the /Common partition on the BIG-IP.
2. Create an LBaaSv2 HTTPS listener.
3. Create an L7 policy object using the lbaas_cssl_profile tag.

Example:

"lbaas_cssl_profile": "clientssl"

Customize Session Persistence¶

Use the lbaas_persist and lbaas_fallback_persist tags to configure a BIG-IP session persistence profile on a virtual server associated with an LBaaSv2 load balancer.

Example:

1
2

"lbaas_persist": "hash",
"lbaas_fallback_persist": "source_addr"

Use TCP Profiles¶

Use the lbaas_ctcp tag to define a BIG-IP TCP profile for a virtual server associated with an LBaaSv2 load balancer. BIG-IP TCP profiles, which determine how a server processes TCP traffic, can fine-tune TCP performance for specific applications.

• lbaas_ctcp – Use this tag for client profiles.
• lbaas_stcp – Use this tag for server profiles.

For example:

If your load balancer fronts an application used for mobile clients, you can use the tcp_mobile_optimized BIG-IP client SSL profile to optimize TCP processing.

"lbaas_ctcp": "tcp_mobile_optimized"

Of course, that profile may not be optimal for traffic between your BIG-IP and the pool member servers. You can specify different profiles for client-side and server-side traffic.

For esd_demo_1 in the example below, we define a single TCP profile (“tcp”) for both client- and server-side traffic. For esd_demo_2, we assign separate TCP policies for client- and server-side traffic (tcp_mobile_optimized and tcp_lan_optimized, respectively).

1
2
3
4
5
6
7
8
9

{
  "esd_demo_1": {
  "lbaas_ctcp": "tcp"
  },
  "esd_demo_2": {
    "lbaas_ctcp": "tcp_mobile_optimized",
    "lbaas_stcp": "tcp_lan_optimized"
  }
}