F5BigContextSecure

Overview

The F5BigContextSecure Custom Resource (CR) configures the Traffic Management Microkernel (TMM) to perform as an application layer gateway (ALG) for low-latency 5G workloads. The F5BigContextSecure CR provides granular connection management using the following F5 protocol profiles: TCP, UDP and FastL4, and is an integral part of the DNS44, DNS46, and DNS64 implementations.

This document guides you through understanding, configuring and installing a simple F5BigContextSecure CR.

Service

The table below describes the CR service parameters.

Parameter Description
name Selects the Service object name for the internal applications (Pods), and creates a round-robin load balancing pool using the Service Endpoints.
port Selects the Service object port value.

CR parameters

The tables below describe the F5BigContextSecure CR parameters.

metadata

Parameter Description
name The name of the secure context.
namespace Specifies the Kubernetes namespace in which the secure context will be installed.

spec

Destination and source addresses

Parameter Type Default Description
destinationAddress string "" The IPv4 address for the secure context to listen on. Accepts a single address (e.g., 10.10.10.50) or CIDR notation (e.g., 10.10.10.0/24). Cannot be set when selfipAsDest is true.
ipv6destinationAddress string "" The IPv6 address for the secure context to listen on. Accepts a single address (e.g., 2002::1) or CIDR notation (e.g., 2002::200:200:200:0/112). Cannot be set when selfipAsDest is true.
destinationPort integer — The service port for the secure context. Valid range: 0–65535. A value of 0 matches all ports.
sourceAddress string "" The IPv4 source address filter. Accepts a single address or CIDR notation.
ipv6sourceAddress string "" The IPv6 source address filter. Accepts a single address or CIDR notation.
selfipAsDest boolean false When enabled, uses self IP addresses from the vlans.vlanList as destination addresses. When true, do not set destinationAddress or ipv6destinationAddress. This value cannot be changed after creation.
routeAdvertisement boolean true When enabled, advertises the route for the destinationAddress to neighboring routers.

Protocol and profile

Parameter Type Default Description
ipProtocol string any The IP protocol for the secure context. Valid values: tcp, udp, or any.
profile string — The profile type. Valid values: fastL4, tcp, udp, or ipother. Must be compatible with ipProtocol (see Profile and protocol compatibility).
loadBalancingMethod string round-robin The load balancing algorithm for pool members. Valid values: round-robin, ratio-least-connections, weighted-round-robin, or ratio-session.

Protocol profile settings

Parameter Type Description
fastL4Settings.profileName string The name of an F5BigFastl4Setting CR (soft reference). Maximum 255 characters.
tcpSettings.clientSide string The name of a client-side F5BigTcpSetting CR (soft reference). Maximum 255 characters.
tcpSettings.serverSide string The name of a server-side F5BigTcpSetting CR (soft reference). Maximum 255 characters.
udpSettings.clientSide string The name of a client-side F5BigUdpSetting CR (soft reference). Maximum 255 characters.
udpSettings.serverSide string The name of a server-side F5BigUdpSetting CR (soft reference). Maximum 255 characters.
httpSettings.clientSide string The name of a client-side HTTP profile CR (soft reference). Maximum 255 characters.

IP Other settings

Parameter Type Description
ipother.client.idleTimeout integer The number of seconds a client-side connection can remain idle before deletion. Valid range: 0–4294967295.
ipother.server.idleTimeout integer The number of seconds a server-side connection can remain idle before deletion. Valid range: 0–4294967295.

SNAT

Parameter Type Default Description
snat.type string none The source address translation type. Valid values: none, snat, or automap.
snat.pool string "" The name of an F5BigCneSnatpool CR. Required when snat.type is snat. Cannot be used when snat.type is none or automap.

Security policies

Parameter Type Default Description
natPolicy string "" The name of an F5BigNatPolicy CR. When set, pool members and SNAT pool cannot be configured. Maximum 255 characters.
firewallEnforcedPolicy string "" The name of an F5BigFwPolicy CR for stateful-flow filtering. Maximum 255 characters.
ipIntelligencePolicy string "" The name of an IP intelligence policy CR. Maximum 255 characters.
protocolInspectionProfile string "" The name of an F5BigIpsPolicy CR for packet inspection. Maximum 255 characters. You cannot use ipProtocol: any when a protocol inspection profile is configured. Set ipProtocol to tcp or udp.
webSecurityProfile string "" The name of an F5WebSecurityProfile CR (soft reference). Maximum 255 characters.
ddosProfile string "" The name of a DDoS profile CR. Applied after the global DDoS policy. Maximum 255 characters.
scrubbedTrafficLimit integer 4294967295 The expected output traffic (in Mbps) after scrubbing incoming attack traffic when DoS protection is enabled in asymmetric mode. This limit is not strictly enforced; output traffic may exceed this value. Valid range: 10–4294967295.

Policy enforcement and classification

Parameter Type Default Description
peProfile string "" The name of a policy enforcement profile. Requires a compatible profile and ipProtocol combination. Maximum 255 characters.
dpiProfile string "" The name of a deep packet inspection (DPI) classification profile. When set, the system classifies traffic sent to this secure context. Requires a compatible profile and ipProtocol combination. Maximum 255 characters.
radiusSubscriberAwareProfile string "" The name of a RADIUS subscriber-aware profile (soft reference). Maximum 255 characters.
diameterEndpoint string "" The name of a Diameter endpoint (soft reference). Maximum 255 characters.

Persistence, logging, iRules, and VRF

Parameter Type Default Description
persistenceProfile string "" The name of a persistence profile for Distributed Application Gateway (DAG) use cases. Maximum 255 characters. Note: If this field is set but no persistence profile is configured, traffic is load balanced according to the applied algorithm (default: round-robin) without persistence.
logProfile string "" The name of an F5BigLogProfile CR. Maximum 255 characters.
iRules array [] A list of iRules CR names to attach to the secure context.
vrf string "" The name of a VRF CR. Maximum 255 characters. This value cannot be changed after creation. Delete and recreate the CR to change the VRF.

VLANs

Parameter Type Default Description
vlans.vlanList array [] A list of F5BigNetVlan CR names that accept traffic on the secure context. When selfipAsDest is true, exactly one VLAN must be listed.
vlans.disableListedVlans boolean true When true (default), the system accepts traffic on all VLANs except those listed in vlanList. When false, the system accepts traffic only on the VLANs listed in vlanList.

Pool

Parameter Type Default Description
pool.minActiveMembers integer 0 The minimum number of members that must be available in one priority group. Valid range: 0–65535.
pool.members[].address string — The IPv4 or IPv6 address of the pool member.
pool.members[].port integer 0 The service port of the pool member. A value of 0 matches all ports. Valid range: 0–65535. When set to 0, a TCP monitor cannot be configured.
pool.members[].priorityGroup integer 0 The priority group for the pool member. Valid range: 0–8.

Monitors

Parameter Type Default Description
monitors.icmp[].interval integer 5 The monitor check frequency, in seconds.
monitors.icmp[].timeout integer 16 The time, in seconds, in which the target must respond.
monitors.icmp[].serversslProfileName string _mon_ssl The server-side SSL profile the monitor uses to probe the target.
monitors.tcp[].interval integer 5 The monitor check frequency, in seconds.
monitors.tcp[].timeout integer 16 The time, in seconds, in which the target must respond.
monitors.tcp[].serversslProfileName string _mon_ssl The server-side SSL profile the monitor uses to probe the target.

Profile and protocol compatibility

ipProtocol Allowed profile values
tcp fastL4 or tcp
udp fastL4 or udp
any fastL4 or ipother

Note: The persistenceProfile field is applicable only if the F5BigContextSecure CR is used for DAG. If the PersistenceProfile field has been set, but there is no persistence profile configured, then, the traffic will be load balanced towards the product installation TMMs according to the applied load balancing algorithm (default is round robin) and there will be no persistence.

CR Example

apiVersion: k8s.f5net.com/v1
kind: F5BigContextSecure
metadata:
  name: "cnf-context"
  namespace: "cnf-gateway"
spec:
   ipv6destinationAddress: "2002::200:200:200:0/112"
   destinationPort: 0
   iRules: ["cnf-irule"]
   ipProtocol: "tcp"
   profile: "tcp"
   tcpSettings:
     clientSide: "tcp-high-bw-profile"
     serverSide: "tcp-high-bw-profile"
   vlans:
     vlanList:
       - "subscriber-vlan"

CR shortName

CR shortNames provide an easy way to view installed CRs, and their configuration parameters. The CR shortName can also be used to delete the CR instance. The F5BigContextSecure CR shortName is secctx.

View CR instance:

kubectl get secctx -n <namespace>

View CR configuration:

kubectl get secctx -n <namespace> -o yaml

Requirements

Ensure you have:

Installation

Use these steps to install the example F5BigContextSecure CR, and the optional CNFs F5BigTcpSetting CR. Each step offers a brief description of the example CR.

Tip: Open a second shell to view the CNFs Event Logs while installing.

  1. Optional: The example F5BigTcpSetting CR increases a number of packets buffers to increase performance. Copy and paste the example into a YAML file:

    Note: The F5BigTcpSetting CR will be referenced by the F5BigContextSecure CR.

    apiVersion: "k8s.f5net.com/v1"
kind: F5BigTcpSetting
metadata:
  name: "tcp-high-bw-profile"
  namespace: "cnf-gateway"
spec:
  sendBufferSize: 150000
  receiveWindowSize: 70000
  proxyBufferHigh: 20000
  proxyBufferLow: 5000
  idleTimeout: 150
  resetOnTimeout: false

  2. Install the F5BigTcpSetting CR:

    kubectl apply -f cnf-tcp-high-bw-cr.yaml

    In this example, the BIG-IP Controller logs indicate the F5BigTcpSetting CRs were added/updated:

    I0202 12:00:00.12347   1 event.go:282 Event(v1.ObjectReference{Kind:"F5TcpSetting",
TcpSetting cnf-gateway/tcp-high-bw-profile was added/updated

  3. The example F5BigContextSecure CR listens for connections destined to IP addresses in the 2002::200:200:200:0/112 subnet, and only on the subscriber-vlan interface. The CR also references the F5BigTcpsettings profile. Copy and paste the example into a YAML file:

    apiVersion: k8s.f5net.com/v1
kind: F5BigContextSecure
metadata:
  name: "cnf-context"
  namespace: "cnf-gateway"
spec:
   ipv6destinationAddress: "2002::200:200:200:0/112"
   destinationPort: 0
   iRules: ["cnf-irule"]
   ipProtocol: "tcp"
   profile: "tcp"
   tcpSettings:
     clientSide: "tcp-high-bw-profile"
     serverSide: "tcp-high-bw-profile"
   vlans:
     vlanList:
       - "subscriber-vlan"

  4. Optional: An example CR to attach the Inspection protocol to F5BigDnsApp CR. Copy and paste the following example CR to an YAML file:

       apiVersion: "k8s.f5net.com/v1"
   kind: F5BigContextSecure
   metadata:
     name: secure-context
   spec:
    protocolInspectionProfile: "protocolinspection"

    Note: The Inspection protocol can be attached to either a F5BigContextSecure or F5BigDnsApp CR. You can ignore this step if you have already added Inspection protocol to F5BigDnsApp CR. You cannot use ipProtocol:any when a protocolInspectionProfile is configured. Set ipProtocol to either tcp or udp to utilize IPS-related functionality.

  5. Install the F5BigContextSecure CR:

    kubectl apply -f f5-cnf-context.yaml

    In this example, the BIG-IP Controller logs indicate the F5BigContextSecure CR was added/updated:

    I0202 12:00:00:12350    1 event.go:282] Event(v1.ObjectReference{Kind:"F5SecureContext", 
SecureContext cnf-gateway/cnf-context was added/updated

  6. Continue to the Additional CRs and ContextSecure statistics sections.

Additional CRs

The F5BigContextSecure CR can also reference these CNFs CRs:

  • F5BigFwPolicy - Granular network packet filtering using access control lists.

  • F5BigNatPolicy - Carrier-grade NAT (CG-NAT) functionality.

  • F5BigDnsApp - High-performance DNS resolution, caching, and DNS64 translations.

  • F5BigIpsPolicy - DNS packet inspection for protection against malignant network traffic.

  • F5BigCneSnatpool - Provides TMMs with additional IP addresses for source IP address translation.

  • F5BigLogProfile - Capture and send traffic processing events to remote logging servers.

ContextSecure statistics

If the TMM Debug sidecar is enabled (default), use the steps below to verify firewall filtering statics.

  1. Log in to the TMM debug Pod:

    In this example, the TMM debug container is in the cnf-gateway namespace:

    kubectl exec -it deploy/f5-tmm -c debug -n cnf-gateway -- bash

  2. Verify the F5BigContextSecure statistics:

    Clientside connections:

    tmctl -d blade virtual_server_stat -s name,clientside.tot_conns

    name                                       clientside.tot_conns
------------------------------------------ --------------------
cnf-gateway-cnf-context-SecureContext_vs                    8

    Serverside connections:

    tmctl -d blade virtual_server_stat -s name,serverside.tot_conns

    name                                       serverside.tot_conns
------------------------------------------ --------------------
cnf-gateway-cnf-context-SecureContext_vs                    8

Feedback

Provide feedback to improve this document by emailing cnfdocs@f5.com.

Supplemental

  • F5BigCneIrule - CNF supports iRules with Context Secure or any other usecase CRs (example: DNS Virtual Server and F5BigAlgFtp).