F5BigClassificationprofile

Overview

The F5BigClassificationprofile Custom Resource (CR) provides options to configure dynamic identification and classification of application traffic. The F5BigClassificationprofile is required when the F5BigPePolicy CR is configured to identify application traffic using the classification filter. The F5BigClassificationprofile and F5BigPePolicy CRs are referenced by the F5BigContextSecure CR to accept and process application traffic

CR parameters

metadata

Parameter Description
name The name of the Classification policy. This value is referenced by the F5BigContextSecure CR.
namespace The Kubernetes namespace the Classification policy will install to.

spec

Parameter Description
name Specifies a name for the Classification Profile. This value is not used as a reference by other CRs.
description Specifies descriptive text that identifies the Profile.
enableApplicationDetection Enables application detection: true (default) or false.
enableLogUnclassifiedDomain Enables logging unclassified domains: true or false (default).
enableUrlCategorization Enables URL categorization: true or false (default).
preset.allowReclassification Enables transactional flows: true (default) or false.
preset.enableFlowBundling Enables the correlation of flows or transactions lacking attributes for classification decision to an abstract key with associated classification tokens: true (default) or false.
preset.enableCacheResults Enables caching classification results for the L4 destination. When the same traffic passes through, the result is taken from the cache: true (default) or false.
preset.analyzeDns Enables the classification engine to inspect DNS responses and use the IP addresses returned, to enhance classification results for otherwise-unknown data-plane traffic: true (default) or false. When false, data-plane traffic for which no existing signatures exist gets generic classification.
preset.analyzeSslServerside Enables the classification engine to process SSL Server Side Hello to inspect ALPN (primarily for HTTP2 / SPDY subclassification). If false the DNS traffic gets generic classification: true (default) or false.
logPublisher Specifies the F5BigLogHslpub CR to log classification events using the metadata.name parameter.
enableIruleEvent Enables iRule Events triggered by application in this classification settings: true (default) or false.

CR Example

F5BigClassificationprofile

apiVersion: "k8s.f5net.com/v1"
kind: F5BigClassificationprofile
metadata:
  name: "cnf-class-profile"
  namespace: "cnf-gateway"
spec:
  name: "cnf-class-profile"
  enableApplicationDetection: true
  enableLogUnclassifiedDomain: true
  logPublisher: "cnf-hsl-pub"
  preset:
    enableFlowBundling: true
    analyzeSslServerside: false
    enableCacheResults: true
    analyzeDns: true

CR shortName

CR shortName provide an easy way to view installed CRs, and their configuration parameter. The CR shortName can also be used to delete the CR instance. The F5BigClassificationprofile CR shortName is dpiprof.

View CR instance:

kubectl get dpiprof -n <namespace>

View CR configuration:

kubectl get dpiprof -n <namespace> -o yaml

Requirements

Ensure you have:

Installation

Use these steps to install the example F5BigClassificationprofile CR, and the optional CNFs CRs. Each step offers a brief description of the example CR.

_images/spk_info.png Tip: Open a second shell to view the CNFs Event Logs while installing.

  1. Optional: The example F5BigLogHslpub CR specifies a remote server with IP/port [2002::10:30:2:220]:514, and the udp protocol. Copy and paste the example into a YAML file:

    Note: The F5BigLogHslpub CR will be referenced by the F5BigClassificationprofile.

    apiVersion: k8s.f5net.com/v1
kind: F5BigLogHslpub
metadata:
  name: "cnf-hsl-pub"
  namespace: "cnf-gateway"
spec:
  pool:
  - name: "hsl-pool"
    endpoint:
    - "[2002::10:30:2:220]:514"
  syslog:
  - name: "cnf-syslog"
    format: "rfc5424"
    protocol: "udp"
    pool: "hsl-pool"

  2. Install the F5BigLogHslpub CR:

    kubectl apply -f cnf-hsl-cr.yaml

    In this example, the BIG-IP Controller logs indicate the F5BigLogHslpub CR was added/updated:

    I0202 12:00:00.12347   1 event.go:282 Event(v1.ObjectReference{Kind:"F5Hslpub",
F5Hslpub cnf-gateway/cnf-hsl-pub was added/updated

  3. The example F5BigClassificationprofile enables important parameters such as ApplicationDetection, UrlCategorization, and analyzeDns. Copy the example CR into a YAML file:

    Note: The F5BigClassificationprofile will be referenced by the F5BigContextSecure CR.

    apiVersion: "k8s.f5net.com/v1"
kind: F5BigClassificationprofile
metadata:
  name: "cnf-class-profile"
  namespace: "cnf-gateway"
spec:
  name: "cnf-class-profile"
  enableApplicationDetection: true
  enableUrlCategorization: true
  logPublisher: "cnf-hsl-pub"
  preset:
    enableFlowBundling: true
    analyzeSslServerside: false
    enableCacheResults: true
    analyzeDns: true

  4. Install the F5BigClassificationprofile CR:

    kubectl apply -f cnf-class-profile.yaml

    In this example, the BIG-IP Controller logs indicate the F5BigClassificationprofile CR was added/updated:

    I0624 12:00:00.12347   1 event.go:282] Event(v1.ObjectReference{Kind:"F5ClassificationProfile",
F5ClassificationProfile cnf-gateway/cnf-class-profile was added/updated

  5. Continue to the F5BigPePolicy guide to reference the Classification profile, and begin managing subscriber traffic using policy based classification criteria.

Classification statistics

If the TMM Debug sidecar is enabled (default), use the steps below to verify F5BigClassificationprofile statistics.

  1. Log in to the TMM debug Pod:

    In this example, the TMM debug container is in the cnf-gateway namespace:

    kubectl exec -it deploy/f5-tmm -c debug -n cnf-gateway -- bash

  2. Verify the F5BigClassificationprofile statistics:

    tmctl -d blade gpa_classification_stats -w 200

    result                  count cec flbl srdb custom bytes_in bytes_out pkts_in pkts_out
------                  ----- --- ---- ---- ------ -------- --------- ------- --------
tcp                         0   0    0    0      0        0         0       0        0
udp                         0   0    0    0      0        0         0       0        0
tcp.http.google             2   2    0    0      0      952      1096       9        7
tcp.ssl.goole               1   1    0    0      0      618       152       3        2
tcp.ssl.facebook            4   4    0    0      0    10226    127795     102      126
tcp.http.cnn                4   4    0    0      0     2226      4018      20       20
tcp.ssl.cnn                 2   2    0    0      0    40332   2515790     540     1846
tcp.ssl.yahoo.yahoo_search  1   1    0    0      0      620       152       3        2
tcp.http.bing               1   1    0    0      0      359       152       3        2

Feedback

Provide feedback to improve this document by emailing cnfdocs@f5.com.

Supplemental