F5 Agent Configuration File¶
The F5 Agent Configuration File – /etc/neutron/services/f5/f5-openstack-agent.ini
– tells the F5 Agent for OpenStack Neutron about the network architecture and how/where the BIG-IP device(s) fit in.
The configuration parameters tell the agent:
- where to find your BIG-IP device(s), and
- how the BIG-IP system is already set up.
The latter impacts how the F5 agent configures BIG-IP objects in response to Neutron API calls.
Important
Use the appropriate F5 agent configuration parameters for your network architecture and existing BIG-IP configurations.
The F5 agent has two (2) modes of operation: Global routed mode, L2-adjacent mode. The mode you should use depends on how your BIG-IP device(s) connects to the network.
- Global routed mode – use if the BIG-IP device(s) connects directly to the OpenStack provider network.
- L2-adjacent mode – use if your BIG-IP device(s) or Virtual Edition (VE) instance(s) connects to the provider network via VLANs and/or VXLAN/GRE tunnels.
See also
Unsure which mode to use? See F5 Agent modes for more information.
F5 Agent configuration parameters¶
Each section below corresponds to a section of the F5 Agent Configuration File.
DEFAULT SETTINGS¶
Parameter | Type | Description | Allowed Values | Recommended Value |
---|---|---|---|---|
debug | boolean | Sets the log level to DEBUG. | True, False | True |
periodic_interval | integer | Sets the number of seconds between the agent’s attempts to sync its state with Neutron | Any number of seconds, expressed as an integer | Default=10 |
service_resync_interval | integer | Sets the frequency at which the agent discards its service cache and syncs with the Neutron LBaaS service. | Any number of seconds, expressed as an integer | Default=500 |
ENVIRONMENT SETTINGS¶
Parameter | Type | Description | Allowed Values | Recommended Value |
---|---|---|---|---|
environment_prefix | string | Sets the default prefix applied to all BIG-IP LTM objects in the tenant partition. | Any string beginning with an alpha character. | Default=Project |
STATIC AGENT CONFIGURATION SETTINGS¶
Parameter | Type | Description | Allowed Values | Recommended Value |
---|---|---|---|---|
static_agent_configuration_data | key-value pair | Defines static agent identification data sent to the Neutron LBaaS plugin; used to identify F5 agent for custom pool-to-agent scheduling. | single key-value pair –OR– comma-separated list of key-value pairs | N/A |
DEVICE SETTINGS¶
Parameter | Type | Description | Allowed Values | Recommended Value |
---|---|---|---|---|
f5_ha_type | string | Defines the BIG-IP device high availability (HA) mode. |
|
Default=standalone |
L2 SEGMENTATION MODE SETTINGS¶
Parameter | Type | Description | Allowed Values | Recommended Value |
---|---|---|---|---|
f5_external_physical_mappings | string | Binds VLANs to BIG-IP interfaces ; tells the agent about the interface’s VLAN tagging settings | string in the format “physical_network:interface_name:tagged” The agent will use the “default” mapping if you don’t define mappings for specific VLANs. Example: “ext_net:1.1:True” – maps the external physical network named “ext_net” to BIG-IP interface 1.1; tells the agent that 1.1 is a tagged interface. Tagged interfaces accept traffic from multiple VLANs. Untagged interfaces accept traffic from a single VLAN. |
Default= default:1.1:True |
vlan_binding_driver | string | Software hook allowing VLAN-interface-port mapping | The vlan_binding_driver allows you to bind and prune VLAN ids to specific ports. A vlan_binding_driver class must:
|
N/A |
interface_port_static_mappings | JSON dictionary | Enabled by vlan_binding_driver; maps BIG-IP devices and interfaces to specific ports | JSON dictionaries mapping BIG-IP devices and interfaces to ports. Follows the format “{“device_name”:{“interface_id”:”port_id”}” |
N/A |
f5_vtep_folder | string | The BIG-IP partition containing the desired VTEP . | N/A | /Common |
f5_vtep_selfip_name | string | The name of the BIG-IP self IP to use as the VTEP. | N/A | vtep |
advertised_tunnel_types | string | The type of tunnel to use. The agent advertises its ability
to terminate this tunnel type
via the oslo This setting must be the same on all OpenStack nodes (controller, compute, and network). |
vxlan, gre | vxlan |
f5_populate_static_arp | boolean | Controls BIG-IP Address Resolution Protocol (ARP) settings. | TRUE: the agent adds static entries for the IP and MAC addresses in the Neutron LBaaS service definition to the BIG-IP system ARP cache. FALSE: the agent discovers BIG-IP pool members via flooding. |
TRUE |
l2_population | boolean | Sets agent registration policy for Neutron Modular Layer 2 (ml2) messages | TRUE: the agent registers for ml2 population messages; these allow the agent to update the VTEP forwarding table when pool members migrate from one compute node to another. FALSE: the agent does not receive ml2 population messages and does not update VTEP table entries for migrated pool members. |
TRUE |
f5_network_segment_physical_network | string | The network segment the agent should watch. | String; must be the name of the network segment you want the agent to watch for dynamically-created VLANs. Used in conjunction with software-defined networking (SDN). Comment out this setting if you are not using hierarchical port binding. [1] |
N/A |
f5_network_segment_polling_interval | integer | The frequency at which the agent should poll for disconnected LBaaS listeners. [1] | integer; in seconds Comment out this setting if you are not using hierarchical port binding. |
10 |
f5_pending_services_timeout | integer | Maximum amount of time before creation of a pending service errors out. [1] | integer; in seconds Comment out this setting if you are not using hierarchical port binding. |
60 |
Footnotes
[1] | (1, 2, 3) See Hierarchical Port Binding. |
L3 SEGMENTATION MODE SETTINGS¶
Parameter | Type | Description | Allowed Values | Recommended Value |
---|---|---|---|---|
f5_global_routed_mode | boolean | Defines how the BIG-IP devices connect to the network | TRUE: BIG-IP device(s) connect directly to the OpenStack provider network. (L2 routing only) FALSE: BIG-IP devices use VLANs, VXLAN or GRE tunnels to bridge physical/ virtualized network segments. (L2 & L3 routing; “L2-adjacent mode”) |
FALSE |
use_namespaces | boolean | Tells the agent if you’re using BIG-IP route domains | TRUE: you’re using BIG-IP route domains to segment tenant network traffic. FALSE: you’re not using route domains; tenant networks cannot use overlapping subnets. |
TRUE Forced to FALSE if f5_global_routed_mode = TRUE |
max_namespaces_per_tenant | integer | Sets the maximum number of namespaces/route tables the agent can allocate per tenant | Any integer, with the caveat that using more than 1 namespace per tenant is NOT a recommended practice. | 1 |
f5_route_domain_strictness | boolean | Controls the agent’s access to
BIG-IP global routing table
(route domain Requires
|
TRUE: the agent can only access BIG-IP tenant route domains; it cannot consult the global routing table. VIPs and members can only communicate if they are in the same tenant. FALSE: the agent can look for a destination route in the global routing table if it can’t find a match in the tenant route domains. VIPs and members can communicate across tenants. Set to FALSE to ensure the agent has access to external routes on the OpenStack provider network. |
FALSE |
f5_snat_mode | boolean | Tells the agent if it should allocate BIG-IP SNAT pools for tenants | TRUE: the agent manages a SNAT pool for the tenant. When set to TRUE, incoming proxy traffic uses IP addresses from the SNAT pool. Set to TRUE when:
FALSE: the agent doesn’t allocate a SNAT pool for the tenant; source IP addresses for outgoing traffic are not masked; incoming traffic follows the destination server’s default route. When set to FALSE, the BIG-IP device sets up a floating IP as the subnet’s default gateway address and creates a wildcard IP- forwarding virtual server on the member’s network. Neutron floating IPs will not work if the BIG-IP device isn’t used as the Neutron Router. |
TRUE Forced to TRUE if f5_global_routed_mode = TRUE |
f5_snat_addresses_per_subnet | integer | Defines how many IP addresses to allocate in a SNAT pool | Any integer. Set to |
0 |
f5_common_networks | boolean | Controls where the agent creates network objects | TRUE: the agent creates all network objects
in the /Common partition on the
BIG-IP system. |
TRUE |
f5_common_external_networks | boolean | Controls the agent’s access to external (infrastructure-based) routes | TRUE: the agent adds all provider
networks with Set to TRUE if you want the agent to route traffic to IP addresses associated with an external route (for example, an infrastructure router). FALSE: the agent cannot route traffic to
provider networks with |
TRUE |
common_networks | key-value pair | Tells the agent about shared networks already configured on the BIG-IP device | single key-value pair –OR– comma-separated list of key-value pairs Follows the format “neutron_network_uuid:BIG-IP_network_name” |
N/A |
l3_binding_driver | string | Software hook allowing L3_address-port binding | Allows you to bind L3 addresses to specific ports. | f5_openstack_agent. lbaasv2.drivers.bigip. l3_binding. AllowedAddressPairs |
l3_binding_static_mappings | JSON dictionary | Using the l3_binding_driver, maps Neutron subnet ids to L2 ports and devices | JSON-encoded dictionary; follows the format ‘subnet_id’:[(‘port_id’,’BIG-IP_device’) |
N/A |
DEVICE DRIVER/iCONTROL DRIVER SETTINGS¶
Parameter | Type | Description | Allowed Values | Recommended Value |
---|---|---|---|---|
f5_bigip_lbaas_device_driver | string | The iControl device driver | DO NOT CHANGE THIS SETTING. | |
icontrol_hostname | string | The IP address, or DNS-resolvable hostname, of your BIG-IP device(s) and/or vCMP guest(s) | single item or comma-separated list | N/A |
icontrol_vcmp_hostname | string | The IP address of your vCMP host | single IP address | N/A |
icontrol_username | string | The username of an account on the BIG-IP device | The username of an account with permission to create partitions and create/manage Local Traffic and Network objects | N/A |
icontrol_password | string | Password for the BIG-IP user account(encoded if password_ciphe r_mode is True) | See BIG-IP password requirements. | N/A |
CERTIFICATE MANAGER SETTINGS¶
Important
The settings in this section only apply if you are use OpenStack Barbican for authentication. If you aren’t using Barbican, leave this section commented out.
Parameter | Type | Description | Allowed Values | Recommended Value |
---|---|---|---|---|
cert_manager | string | the F5 agent’s BarbicanCertManager | f5_openstack_agent.lbaasv2.drivers.bigip.
barbican_cert.BarbicanCertManager |
None / leave empty |
auth_version | string | OpenStack Keystone auth version | v2, v3 | N/A |
os_auth_url | string | Keystone auth URL | N/A | |
os_username | string | OpenStack username | N/A | |
os_password | string | OpenStack password | N/A | |
os_user_domain_name | string | OpenStack user account domain | N/A | |
os_project_name | string | OpenStack project (tenant) name | N/A | |
os_project_domain_name | string | OpenStack project domain | N/A |