Lab 3: Modify BIG-IP settings, Sync, & Perform Validation

In Lab 3, we will modify port lockdown settings, and validate BIG-IP configuration synchronization.

Lab Tasks:

• Task 1: Modify Self IP Port Lockdown

• Task 2: Verify an Active / Standby "In Sync" State

Task 1: Modify Self IP Port Lockdown

In Task 1, we will modify our "Allow None" Self IP port lockdown behavior; we will define a Custom Port Lockdown configuration on the respective Self IPs.

For optimal security, F5 recommends that you use the port lockdown feature to allow only the protocols or services required for a self IP address.

• For our HA VLAN, we will select "Allow Default"

• For our Data VLANs (internal & external), we will "Allow Custom", allowing UDP protocol on port 1026.

There are port lockdown exceptions to be aware of. Please review Knowledge Article K17333 for further details.

In Lab 1, when we created our Local Self IPs, we chose to select the "Allow None" port lockdown behavior. As a result of this, the BIG-IP is preventing DSC communication between BIG-IPs. In this Task, we will modify our port lockdown configuration, which will allow DSC communication between BIG-IPs.

On each BIG-IP:

1. Navigate to: Network > Self IPs

2. Click the VLAN 30 Self IP hyperlink

   

3. Under the Port Lockdown drop-down, change the value to "Allow Default," then click the Update button

   

   Question:	Are the devices Active / Standby? Why or why not?
   Answer:	No, still Active / Active - Failover via unicast Self IPs & port lockdown

4. On both BIG-IPs, modify both the Internal & External Self IP Port Lockdown settings

   • Change from "Allow None" to "Allow Custom"

     From the Port Lockdown drop-down, select "Allow Custom." Click the radio button for UDP. Click the radio button for Port. In the Port field, enter 1026. Click Add.

     

     You should see "1026" listed in the UDP Custom List section. Click Update.

     

   • Repeat this step on the External VLAN

5. On BIG-IP-A, modify the Floating Self IPs per the previous steps:

   • Floating VLAN 30 = Allow Default, then Click Update:

     

   • Floating VLAN 10 & 20 = Allow Custom, UDP port 1026, then Click Update:

     • VLAN 10:

       

     • VLAN 20:

       

   Question:	Are the devices Active / Standby? Why or why not?
   Answer:	Yes, they are now Active / Standby for Failover
   Log Example:	Apr 28 12:34:47 bigipB.f5demo.com info sod[7297]: 010c0085:6: First failover status message received from device bigipA.f5demo.com (10.1.1.5) (unicast: -> 10.1.20.242).Apr 28 12:34:47 bigipB.f5demo.com warning sod[7297]: 010c0084:4: Failover status message received after 3977.100 second gap, from device bigipA.f5demo.com (10.1.1.5) (unicast: -> 10.1.20.242).

6. Bonus Question: How do you know what "ports" are allowed in the "default" port-lockdown list?

   GUI	Navigate to: Help, expand Port Lockdown, and review
   CLI	tmsh list net self-allow one-line	net self-allow { defaults { igmp:any ospf:any pim:any tcp:domain tcp:f5-iquery tcp:https tcp:snmp tcp:ssh udp:520 udp:cap udp:domain udp:f5-iquery udp:snmp } }

Task 2: Verify an Active / Standby "In Sync" State

In Task 2, we will perform a BIG-IP device synchronization. This will validate our HA DSC configuration.

1. On each BIG-IP, review the current state.

   • BIG-IP-A:

     

   • BIG-IP-B:

     

2. If your BIG-IPs are in a state other than the above, please review the previous steps to ensure correct configuration.

Lab Summary

In this lab, you modified BIG-IP Self IP port lockdown configuration settings. After completion of these lab tasks, you should have an Active/Standby High-Availability (HA) BIG-IP configuration, with Local Traffic Manager (LTM) objects, that are synchronized between the BIG-IPs. These configuration objects will assist with the following labs.

This completes Lab 3.