F5BigContextSecure¶

Overview¶

The F5BigContextSecure Custom Resource (CR) configures the Traffic Management Microkernel (TMM) to perform as an application layer gateway (ALG) for low-latency 5G workloads. The F5BigContextSecure CR provides granular connection management using the following F5 protocol profiles: TCP, UDP and FastL4, and is an integral part of the DNS44, DNS46, and DNS64 implementations.

This document guides you through understanding, configuring and installing a simple F5BigContextSecure CR.

Service¶

The table below describes the CR service parameters.

Parameter	Description
`name`	Selects the Service object name for the internal applications (Pods), and creates a round-robin load balancing pool using the Service Endpoints.
`port`	Selects the Service object port value.

CR parameters¶

The tables below describe the F5BigContextSecure CR parameters.

metadata¶

Parameter	Description
`name`	The name of the secure context.
`namespace`	Specifies the Kubernetes namespace in which the secure context will be installed.

spec¶

Destination and source addresses¶

Parameter	Type	Default	Description
`destinationAddress`	string	`""`	The IPv4 address for the secure context to listen on. Accepts a single address (e.g., `10.10.10.50`) or CIDR notation (e.g., `10.10.10.0/24`). Cannot be set when `selfipAsDest` is true.
`ipv6destinationAddress`	string	`""`	The IPv6 address for the secure context to listen on. Accepts a single address (e.g., `2002::1`) or CIDR notation (e.g., `2002::200:200:200:0/112`). Cannot be set when `selfipAsDest` is true.
`destinationPort`	integer	—	The service port for the secure context. Valid range: 0–65535. A value of 0 matches all ports.
`sourceAddress`	string	`""`	The IPv4 source address filter. Accepts a single address or CIDR notation.
`ipv6sourceAddress`	string	`""`	The IPv6 source address filter. Accepts a single address or CIDR notation.
`selfipAsDest`	boolean	`false`	When enabled, uses self IP addresses from the `vlans.vlanList` as destination addresses. When true, do not set `destinationAddress` or `ipv6destinationAddress`. This value cannot be changed after creation.
`routeAdvertisement`	boolean	`true`	When enabled, advertises the route for the `destinationAddress` to neighboring routers.

Protocol and profile¶

Parameter	Type	Default	Description
`ipProtocol`	string	`any`	The IP protocol for the secure context. Valid values: tcp, udp, or any.
`profile`	string	—	The profile type. Valid values: fastL4, tcp, udp, or ipother. Must be compatible with `ipProtocol` (see Profile and protocol compatibility).
`loadBalancingMethod`	string	`round-robin`	The load balancing algorithm for pool members. Valid values: round-robin, ratio-least-connections, weighted-round-robin, or ratio-session.

Protocol profile settings¶

Parameter	Type	Description
`fastL4Settings.profileName`	string	The name of an F5BigFastl4Setting CR (soft reference). Maximum 255 characters.
`tcpSettings.clientSide`	string	The name of a client-side F5BigTcpSetting CR (soft reference). Maximum 255 characters.
`tcpSettings.serverSide`	string	The name of a server-side F5BigTcpSetting CR (soft reference). Maximum 255 characters.
`udpSettings.clientSide`	string	The name of a client-side F5BigUdpSetting CR (soft reference). Maximum 255 characters.
`udpSettings.serverSide`	string	The name of a server-side F5BigUdpSetting CR (soft reference). Maximum 255 characters.
`httpSettings.clientSide`	string	The name of a client-side HTTP profile CR (soft reference). Maximum 255 characters.

IP Other settings¶

Parameter	Type	Description
`ipother.client.idleTimeout`	integer	The number of seconds a client-side connection can remain idle before deletion. Valid range: 0–4294967295.
`ipother.server.idleTimeout`	integer	The number of seconds a server-side connection can remain idle before deletion. Valid range: 0–4294967295.

SNAT¶

Parameter	Type	Default	Description
`snat.type`	string	`none`	The source address translation type. Valid values: none, snat, or automap.
`snat.pool`	string	`""`	The name of an F5BigCneSnatpool CR. Required when `snat.type` is snat. Cannot be used when `snat.type` is none or automap.

Security policies¶

Parameter	Type	Default	Description
`natPolicy`	string	`""`	The name of an F5BigNatPolicy CR. When set, pool members and SNAT pool cannot be configured. Maximum 255 characters.
`firewallEnforcedPolicy`	string	`""`	The name of an F5BigFwPolicy CR for stateful-flow filtering. Maximum 255 characters.
`ipIntelligencePolicy`	string	`""`	The name of an IP intelligence policy CR. Maximum 255 characters.
`protocolInspectionProfile`	string	`""`	The name of an F5BigIpsPolicy CR for packet inspection. Maximum 255 characters. You cannot use `ipProtocol: any` when a protocol inspection profile is configured. Set `ipProtocol` to tcp or udp.
`webSecurityProfile`	string	`""`	The name of an F5WebSecurityProfile CR (soft reference). Maximum 255 characters.
`ddosProfile`	string	`""`	The name of a DDoS profile CR. Applied after the global DDoS policy. Maximum 255 characters.
`scrubbedTrafficLimit`	integer	`4294967295`	The expected output traffic (in Mbps) after scrubbing incoming attack traffic when DoS protection is enabled in asymmetric mode. This limit is not strictly enforced; output traffic may exceed this value. Valid range: 10–4294967295.

Policy enforcement and classification¶

Parameter	Type	Default	Description
`peProfile`	string	`""`	The name of a policy enforcement profile. Requires a compatible `profile` and `ipProtocol` combination. Maximum 255 characters.
`dpiProfile`	string	`""`	The name of a deep packet inspection (DPI) classification profile. When set, the system classifies traffic sent to this secure context. Requires a compatible `profile` and `ipProtocol` combination. Maximum 255 characters.
`radiusSubscriberAwareProfile`	string	`""`	The name of a RADIUS subscriber-aware profile (soft reference). Maximum 255 characters.
`diameterEndpoint`	string	`""`	The name of a Diameter endpoint (soft reference). Maximum 255 characters.

Persistence, logging, iRules, and VRF¶

Parameter	Type	Default	Description
`persistenceProfile`	string	`""`	The name of a persistence profile for Distributed Application Gateway (DAG) use cases. Maximum 255 characters. Note: If this field is set but no persistence profile is configured, traffic is load balanced according to the applied algorithm (default: round-robin) without persistence.
`logProfile`	string	`""`	The name of an F5BigLogProfile CR. Maximum 255 characters.
`iRules`	array	`[]`	A list of iRules CR names to attach to the secure context.
`vrf`	string	`""`	The name of a VRF CR. Maximum 255 characters. This value cannot be changed after creation. Delete and recreate the CR to change the VRF.

VLANs¶

Parameter	Type	Default	Description
`vlans.vlanList`	array	`[]`	A list of F5BigNetVlan CR names that accept traffic on the secure context. When `selfipAsDest` is true, exactly one VLAN must be listed.
`vlans.disableListedVlans`	boolean	`true`	When true (default), the system accepts traffic on all VLANs except those listed in `vlanList`. When false, the system accepts traffic only on the VLANs listed in `vlanList`.

Pool¶

Parameter	Type	Default	Description
`pool.minActiveMembers`	integer	`0`	The minimum number of members that must be available in one priority group. Valid range: 0–65535.
`pool.members[].address`	string	—	The IPv4 or IPv6 address of the pool member.
`pool.members[].port`	integer	`0`	The service port of the pool member. A value of 0 matches all ports. Valid range: 0–65535. When set to 0, a TCP monitor cannot be configured.
`pool.members[].priorityGroup`	integer	`0`	The priority group for the pool member. Valid range: 0–8.

Monitors¶

Parameter	Type	Default	Description
`monitors.icmp[].interval`	integer	`5`	The monitor check frequency, in seconds.
`monitors.icmp[].timeout`	integer	`16`	The time, in seconds, in which the target must respond.
`monitors.icmp[].serversslProfileName`	string	`_mon_ssl`	The server-side SSL profile the monitor uses to probe the target.
`monitors.tcp[].interval`	integer	`5`	The monitor check frequency, in seconds.
`monitors.tcp[].timeout`	integer	`16`	The time, in seconds, in which the target must respond.
`monitors.tcp[].serversslProfileName`	string	`_mon_ssl`	The server-side SSL profile the monitor uses to probe the target.

Profile and protocol compatibility¶

`ipProtocol`	Allowed `profile` values
`tcp`	fastL4 or tcp
`udp`	fastL4 or udp
`any`	fastL4 or ipother

Note: The persistenceProfile field is applicable only if the F5BigContextSecure CR is used for DAG. If the PersistenceProfile field has been set, but there is no persistence profile configured, then, the traffic will be load balanced towards the product installation TMMs according to the applied load balancing algorithm (default is round robin) and there will be no persistence.

CR Example¶

apiVersion: k8s.f5net.com/v1
kind: F5BigContextSecure
metadata:
  name: "cnf-context"
  namespace: "cnf-gateway"
spec:
   ipv6destinationAddress: "2002::200:200:200:0/112"
   destinationPort: 0
   iRules: ["cnf-irule"]
   ipProtocol: "tcp"
   profile: "tcp"
   tcpSettings:
     clientSide: "tcp-high-bw-profile"
     serverSide: "tcp-high-bw-profile"
   vlans:
     vlanList:
       - "subscriber-vlan"

CR shortName¶

CR shortNames provide an easy way to view installed CRs, and their configuration parameters. The CR shortName can also be used to delete the CR instance. The F5BigContextSecure CR shortName is secctx.

View CR instance:

oc get secctx -n <namespace>

View CR configuration:

oc get secctx -n <namespace> -o yaml

Application Project¶

The Controller and Service Proxy TMM Pods install to a different Project than the TCP application (Pods). When installing the Controller, set the controller.watchNamespace parameter to the TCP Pod Project(s) in the Helm values file. For example:

Note: The watchNamespace parameter accepts multiple namespaces.

  controller:
    watchNamespace: 
      - "web-apps"
      - "web-apps2"

Dual-Stack environments¶

Service Proxy TMM’s load balancing pool is created by discovering the Kubernetes Service Endpoints in the Project. In IPv4/IPv6 dual-stack environments, to populate the load balancing pool with IPv6 members, set the Service PreferDualStack parameter to IPv6. For example:

kind: Service
metadata:
  name: nginx-web-app
  namespace: web-apps
  labels:
    app: nginx-web-app
spec:
  ipFamilyPolicy: PreferDualStack
  ipFamilies:
  - IPv6
  - IPv4

Important: When enabling preferDualStack, ensure TMM’s internal F5SPKVlan interface configuration includes both IPv4 and IPv6 addresses.

Requirements¶

Ensure you have:

Installed the BIG-IP Controller.
A Linux based workstation.

Installation¶

Secure Context on Controller namespace¶

Use the following steps to obtain the application’s Service object configuration, and configure and install the F5CNFIngressTCP CR.

Switch to the application Project:
```
oc project <project>
```
In this example, the application is in the web-apps Project:
```
oc project web-apps
```

Use the Service object NAME and PORT to configure the CR service.name and service.port parameters:

oc get service 

In this example, the Service object NAME is nginx-web-app and the PORT is 80:

NAME           TYPE       CLUSTER-IP    EXTERNAL-IP   PORT(S) 
nginx-web-app  NodePort   10.99.99.99   <none>        80:30714/TCP

Copy the example CR into a YAML file:

    apiVersion: "ingresstcp.k8s.f5net.com/v1"
  kind: F5CNFIngressTCP
  metadata:
    name: "nginx-web-cr"
    namespace: "web-apps"
  service:
    name: "nginx-web-app"
    port: 80
  spec:
    destinationAddress: "192.168.1.123"
    destinationPort: 80
    ipv6destinationAddress: "2001::100:100"
    idleTimeout: 30
    loadBalancingMethod: "ROUND_ROBIN"
    snat: "SRC_TRANS_AUTOMAP"
    persist:
      mode: "PERSIST_TYPE_SRCADDR"
      timeout: 60
      ipv4PrefixLength: 24
    vlans:
      vlanList:
      - vlan-external
  monitors:
    tcp:
    - interval: 3
      timeout: 10

Install the F5CNFIngressTCP CR:
```
oc apply -f cnf-ingress-tcp.yaml
```

Verify the status of the installed CR:

oc get f5-cnf-ingresstcp -n nginx-apps

In this example, the CR has installed successfully. Installation failures may indicate a missing CR dependency such as a referenced VLAN.

NAME           STATUS    MESSAGE                               
nginx-web-cr   SUCCESS   CR config sent to all grpc endpoints 

Web clients should now be able to connect to the application through the Service Proxy TMM.

Secure Context on Application Namespace¶

Use these steps to install the example F5BigContextSecure CR, and the optional CNFs F5BigTcpSetting CR. Each step offers a brief description of the example CR.

Tip: Open a second shell to view the CNFs Event Logs while installing.

Optional: The example F5BigTcpSetting CR increases a number of packets buffers to increase performance. Copy and paste the example into a YAML file:

Note: The F5BigTcpSetting CR will be referenced by the F5BigContextSecure CR.

 apiVersion: k8s.f5net.com/v2
 kind: F5BigContextSecure
 metadata:
     name: sc-udp
 service:
   name: udpsvc
   port: 9300
 spec:
     destinationAddress: "192.168.16.48"
     ipv6destinationAddress: "fdc0:168:16::aa"
     destinationPort: 9090
     ipProtocol: udp

Install the F5BigTcpSetting CR:

oc apply -f cnf-tcp-high-bw-cr.yaml

In this example, the BIG-IP Controller logs indicate the F5BigTcpSetting CRs were added/updated:

I0202 12:00:00.12347   1 event.go:282 Event(v1.ObjectReference{Kind:"F5TcpSetting",
TcpSetting cnf-gateway/tcp-high-bw-profile was added/updated

The example F5BigContextSecure CR listens for connections destined to IP addresses in the 2002::200:200:200:0/112 subnet, and only on the subscriber-vlan interface. The CR also references the F5BigTcpsettings profile. Copy and paste the example into a YAML file:

apiVersion: k8s.f5net.com/v1
kind: F5BigContextSecure
metadata:
  name: "cnf-context"
  namespace: "cnf-gateway"
spec:
   ipv6destinationAddress: "2002::200:200:200:0/112"
   destinationPort: 0
   iRules: ["cnf-irule"]
   ipProtocol: "tcp"
   profile: "tcp"
   tcpSettings:
     clientSide: "tcp-high-bw-profile"
     serverSide: "tcp-high-bw-profile"
   vlans:
     vlanList:
       - "subscriber-vlan"

Optional: An example CR to attach the Inspection protocol to F5BigDnsApp CR. Copy and paste the following example CR to an YAML file:
```
   apiVersion: "k8s.f5net.com/v1"
   kind: F5BigContextSecure
   metadata:
     name: secure-context
   spec:
    protocolInspectionProfile: "protocolinspection"
```
Note: The Inspection protocol can be attached to either a F5BigContextSecure or F5BigDnsApp CR. You can ignore this step if you have already added Inspection protocol to F5BigDnsApp CR. You cannot use ipProtocol:any when a protocolInspectionProfile is configured. Set ipProtocol to either tcp or udp to utilize IPS-related functionality.

Install the F5BigContextSecure CR:

oc apply -f f5-cnf-context.yaml

In this example, the BIG-IP Controller logs indicate the F5BigContextSecure CR was added/updated:

I0202 12:00:00:12350    1 event.go:282] Event(v1.ObjectReference{Kind:"F5SecureContext", 
SecureContext cnf-gateway/cnf-context was added/updated

Continue to the Additional CRs and ContextSecure statistics sections.

Additional CRs¶

The F5BigContextSecure CR can also reference these CNFs CRs:

F5BigFwPolicy - Granular network packet filtering using access control lists.
F5BigNatPolicy - Carrier-grade NAT (CG-NAT) functionality.
F5BigDnsApp - High-performance DNS resolution, caching, and DNS64 translations.
F5BigIpsPolicy - DNS packet inspection for protection against malignant network traffic.
F5BigCneSnatpool - Provides TMMs with additional IP addresses for source IP address translation.
F5BigLogProfile - Capture and send traffic processing events to remote logging servers.

ContextSecure statistics¶

If the TMM Debug sidecar is enabled (default), use the steps below to verify firewall filtering statics.

Log in to the TMM debug Pod:

In this example, the TMM debug container is in the cnf-gateway namespace:
```
oc exec -it deploy/f5-tmm -c debug -n cnf-gateway -- bash
```

Verify the F5BigContextSecure statistics:

Clientside connections:

tmctl -d blade virtual_server_stat -s name,clientside.tot_conns

name                                       clientside.tot_conns
------------------------------------------ --------------------
cnf-gateway-cnf-context-SecureContext_vs                    8

Serverside connections:

tmctl -d blade virtual_server_stat -s name,serverside.tot_conns

name                                       serverside.tot_conns
------------------------------------------ --------------------
cnf-gateway-cnf-context-SecureContext_vs                    8

Feedback

To provide feedback and help improve this document, please email us at cnfdocs@f5.com.

Supplemental

F5BigCneIrule - CNF supports iRules with Context Secure or any other usecase CRs (example: DNS Virtual Server and F5BigAlgFtp).