Lab 5: Device Service Clusters (DSC)

By now you have a working HTTP virtual server and pool. Let's take a moment and review what we have learned about the traffic flow through the BIG-IP.

We have a client that is sending HTTP requests to the BIG-IP, which then forwards those requests to the pool members. The pool members respond with HTTP responses, which are sent back to the client through the BIG-IP.

Standard Virtual Server Packet Flow

On a standard virtual server application would follow something similar to the flow below:

  1. An IPv4 or IPv6 virtual server receives the connection request​

  2. The TCP connection between the BIG-IP and the client is set up​

    1. at this point we can adjust how TCP works between the BIG-IP and the client using the client TCP profile and its parameters​

    2. or log or manipulate the connection using iRules​

  3. The virtual server establishes an encrypted session between the BIG-IP and the client.​

    1. Again we can manipulate the SSL setup via iRules​

  4. The decrypted data hits the HTTP profile and the HTTP information is parsed and processed according to the profile parameters, and iRules could be applied​

  5. And so on, until we make the load balancing decision in TMOS​

  6. Manipulate the HTTP stream as required​

  7. Re-encrypt the stream if desired ​

  8. At that point we create a new TCP connection based on the server-side TCP profile to the selected server​

  9. And send the connection to the IPv4 or IPv6 pool member​

Now that we have a working virtual server and pool, let's take a look at how we can make our BIG-IP highly available.

In this lab we will be creating a high availability cluster using two BIG-IP devices. We will configure device trust, device groups, and traffic groups to ensure that if one BIG-IP fails, the other can take over and continue to serve traffic.

This lab is designed to help you understand Device and Traffic Groups, as well as the process of building an Active-Standby HA pair. While there is a wizard, we will be configuring this manually.

Base Networking and HA VLAN

You will be creating a high availability cluster using the second BIG-IP (bigip02) in your lab , so let’s prep our current BIG-IP and we will be creating a high availability VLAN.

  1. On bigip01.f5demo.com archive your configuration in case you need to revert.

    1. Go to System >> Archives and create a new archive.

    2. You will be using your third interface (1.3) for Network Failover and ConfigSync. This requires certain ports to be open on the Self IP; TCP port 4353 for ConfigSync and TCP port 1026 for Network Failover and TCP port 6699 for the Master Control Program.

      1. Build a new untagged VLAN ha_vlan on interface 1.3

      2. Add a self-IP name ha_ip and address 10.1.30.245 net mask 255.255.255.0.

        • Under Port Lockdown, select Allow Default, to open

          ports required for HA communications.

        • Optionally you could select: Allow Custom and add TCP

          ports 4353,1026 and 6699

  2. Go to bigip02.f5demo.com and log into GUI with the credentials provided in Documentation section.

    1. bigip02 has already been licensed and provisioned. You will need to set up the base networking.

      Interface

      Untagged VLAN

      IP Name

      Self IP

      Netmask

      1.1

      client_vlan

      client_ip

      10.1.10.246

      255.255.255.0

      1.2

      server_vlan

      server_ip

      10.1.20.246

      255.255.255.0

      1.3

      ha_vlan

      ha_ip

      10.1.30.246

      255.255.255.0

    2. On the ha_vlan ip configure set Port Lockdown to Allow Default

    3. Build the default gateway def_gw in Routes with destination 0.0.0.0, mask 0.0.0.0, gateway ip address 10.1.10.1

    4. What is the status your BIG-IPs? Check the upper left-hand corner next to the F5 ball.

Configure HA

  1. On each BIG-IP, prior to building the Device Trust it is recommended renewing the BIG-IP self-signed certificate with valid information and re-generating the local Device Trust certificate.

    1. Under System >> Certificate Management >> Device Certificate Management select the Renew… button

      1. Common Name: <the Hostname of the BIG-IP in the upper left corner>

      2. Country: United States (or your country of preference)

      3. Lifetime: 3650

      Note

      Lifetime is important, if your cert expires your HA setup will fail.

      1. Select Finished. Your browser will ask to exchange certs with the BIG-IP again, and refresh the page.

    2. Under Device Management >> Device Trust >> Local Domain select Reset Device Trust…

      In the Certificate Signing Authority select Generate New Self-Signed Authority and hit Update.

  2. On each BIG-IP configure the device object failover parameters the BIG-IP will send to other BIG-IPs that want to be a part of a sync-only or sync-failover group.

    Click Device Management >> Device and select the local BIG-IP. It will have the self suffix.

    1. On the top bar select ConfigSync.

      1. Use the Self IP address of the HA VLAN for your Local Address.

      2. Hit Update.

    2. On the top bar select Failover Network.

      1. In the Failover Unicast Configuration section select the Add button.

      2. Use the Self IP address the HA VLAN for your Address.

      3. Leave the Port at the default setting of 1026.

      Note

      Multicast is for Viprion Chassis only.

      1. Select Finished.

    3. On the top bar select Mirroring.

      1. Primary Local Mirror Address: use the Self IP address of the HA VLAN.

      2. Secondary Local Mirror Address: None.

      3. Select Update.

  3. On bigip01.f5demo.com build the Device Trust.

    1. Under Device Management >> Device Trust >> Device Trust Members and select Add to add other BIG-IP(s) you will trust.

      1. Device IP Address: <management IP address of the BIG-IP to add>

        Note

        You could use any Self IP if the out-of-band management interface is not configured.

      2. Enter the Administrator Username and Password of the BIG-IP you are trusting.

      3. Select Retrieve Device Information

        1. The certificate information and name from the other BIG-IP should appear

        2. Select Device Certificate Matches

      4. Select Add Device. Now you should see the other BIG-IP in the list of trusted devices.

      Check on the other BIG-IP bigip02 in the Peer and Subordinate Devices list to verify that bigip01 is trusted.

      ../../_images/image661.png

      Is all the information there?

      1. Go to bigip02.f5demo.com and check the Device Management >> Device Trust >> Peer and Subordinate Devices list.

        Do you see the first BIG-IP in the list?

        ../../_images/image672.png

    2. If some information is missing delete the trust and try again.

  4. What are the statuses of your BIG-IPs now?

    1. They should be In Sync. But wait! We haven’t even created a device group! But remember the Device Trust creates a Sync-Only group for the certificates under the covers (device-trust-group) and that should be in sync.

    2. Click on In Sync in the upper right corner or Device Management >> Overview to see the device_trust_group.

  5. On bigip01.f5demo.com create a new Sync-Failover device group

    1. Under Device Management >> Device Groups create a new device group.

      1. Name: my-device-group

      2. Group Type: Sync-Failover

      3. Add the members of the group to the Includes box and select Finished.

      4. Check Device Groups on bigip02 BIG-IP to verify that the new device group is there.

      5. Did you have to create the Device Group on the other BIG-IP?

        • Is the full configuration synchronized yet? (No! Only the Device Group is sync’d)

      6. What is your sync status?

        • It should be Awaiting Initial Sync

      7. Click on the sync status or go to Device Management >> Overview (or click on Awaiting Initial Sync) of the BIG-IP with the good/current configuration.

      8. Click the device with the configuration you want to synchronize. Sync Options should appear.

      9. Push the selected device configuration to the group should be selected by default so click on Sync. It could take up to 30 seconds for synchronization to complete.

        1. What are the statuses of your BIG-IPs? Do you have an active-standby pair?

        2. Are the configurations the same?

  6. Now that you have created your HA environment. HA selections will show up for SNAT addressed (not tied to your base network), persistence profiles and connection mirroring on virtual servers.

    1. Go to your Active BIG-IP.

    2. Go to your persistence profile my-src-persistence and check the Mirror Persistence box and Update

    3. Go to your www_vs virtual server and set the Default Persistence Profile to my-src-persistence.

    4. Your Active BIG-IP is now in Changes Pending state. Click on the status and Sync your changes. Did the changes sync?

    5. On each BIG-IP go to Module Statistics >> Local Traffic and bring up the persistence record statistics.

      1. Log back into the RDP session of your Ubuntu Jumpbox, go to the home page of you www_vs web service

      (http://10.1.10.100). Refresh a few times.

      1. Check the persistence records on each of your BIG-IPs, you

      should see the records are mirrored on each device.

  7. On your Active BIG-IP, go to Device Management >> Traffic Groups. As you can see the default traffic group “traffic-group-1” already exists.

    1. Select traffic-group-1, check out the page information and then select Force to Standby.

    2. What are the statuses of your BIG-IPs? Go to your web page. What is the client IP?

    3. Go to your self-IP addresses. What traffic group are they in? What does it mean?

    4. Archive your work.