F5 LTM VE – Configuring iRules

iRules are perhaps one of the coolest features of the F5 devices. They allow you to write rules that can manipulate the load load balancing decision. The rules can evaluate variables that the F5 can detect. In this entry, we are going to examine the user-agent string which is part of the HTTP header. Based on the use-agent field, we can determine what type of browser the client is connecting with. Looking at this information can also help us determine what kind of device the client is connection from.

First off, I wanted to add another pool to my LTM. Rather than spin up new VMs for this purposes I told apache on each WebHost instance to listen on port 81 and direct requests incoming on that port to a different folder. So I added this to my httpd.conf on each WebHost…

Listen 81

ServerName localhost
DocumentRoot /var/www/html/81

Then I put a modified copy of my index.html file in the 81 folder on each WebHost. Then I created a new pool that looked like…

Now that that’s done we can write our iRule. iRules are pretty easy to understand just by looking at them but on the other hand, rather picky about syntax, spacing, etc. So lets take a look at the iRule we are going to use in this test. I wanted to create a iRule that would send requests coming from a iPhone to the new HTTP_MOBILE_POOL (the port 81 group we just created) and send the rest to the default HTTP_POOL. So I came up with…

So as I said earlier, this is pretty easy to read. If I detect “iPhone” in the user-agent filed, I’ll send the request to the mobile pool. If I don’t, send it to the regular HTTP pool.

Now that we wrote the rule we have to apply it to the virtual server. Open your virtual server and click on the ‘Resources’ tab. Since this iRule is setting the pool for us and we have a ‘else’ statement, I’m going to set the default pool to none. Then set the iRule accordingly…

That’s it, give it a test! From out desktop we see the normal page…

And from the iPhone we see…

Not very inventive of me but you get the point.

So as you can see iRules are very powerful. I hope to write some more soon and post them up as templates and examples but for now I just wanted to let you see how powerful they can be.

iRules Editor – much easier…

So I’m quickly falling in love with F5 and iRules, but writing them was sort of a pain. I wasn’t good at catching typos and syntax errors on the fly and pasting the code into the LTM, saving it, and it kicking back some cryptic error message about your typos was a little maddening. So I thought I’d do some googling and check out what I found…

The F5 iRule Editor! (Click here for site)

How awesome is this! Once installed the app connects to your LTM in one easy step…

After connecting to the LTM it loads all your current iRules for editing and allows you to create new ones through it editor and upload them to the LTM. I literally just installed the app, but my favorite part at this moment is the fact that the editor is what I call ‘command context aware’. Check this out..

All I Did was type ‘HTTP::’ and the context menu came up with all of the options I can use on the HTTP object. Awesome!

Well I’m sure there will be more to come on this as I explore but I thought I’d share right away. More to come soon!

F5 LTM VE–Setting up basic load balancing (CLI!)

So since I’m such a huge CLI guy I thought that I’d go back through my previous F5 LTM VE posts and do it all through the CLI. To be honest, Im brushing up on the topic so that I can someday sit the F5 exams. Not sure when that will be but I’m hoping soon. So, I deployed the OVA template into VMWare again and I’m going to do the full setup again. Not as much explanation this time but I’ll walk through it.

Management IP
Boot the VM up, log in with default credentials, launch the config wizard, setup your management IP.

License
Fire up a SSH connection to the management IP you configured. At the command prompt enter the following command…

get_dossier –b

This will kick out the dossier file. Copy the dossier, browse over to activate.f5.com, select the activation method you are looking for, and enter your dossier. After accepting the terms you should get a license file kicked back to you that looks something like this…

Copy the entire text contents of the text box and head back to your SSH session. Edit the contents of /config/bigip.license with vi…

vi /config/bigip.license

Its a new file so go into insert mode and past the contents. Write the file and then issue the following command to restart the BigIp processes

bigstart restart

You should notice that your prompt changed from ‘NO LICENSE’ to ‘INOPERATIVE’ after the restart. That’s a good sign.

Hostname
tmsh modify sys global-settings hostname LTM2.interubernet.local

Create VLANs
tmsh create net vlan external interfaces add {1.2}
tmsh create net vlan internal interfaces add {1.1}

Create Self IPS
tmsh create net self 10.20.20.40/24 vlan external
tmsh create net self 192.168.1.40/24 vlan internal

Create HTTP_POOL Pool
tmsh create ltm pool HTTP_POOL load-balancing-mode round-robin members add {192.168.1.41:80 192.168.1.42:80 192.168.1.43:80}

Create HTTP_TEST Virtual Server
tmsh create ltm virtual HTTP_TEST destination 10.20.20.40:80 profiles add {tcp http} pool HTTP_POOL snat automap

Save the config
tmsh save sys config

And that’s it! You should be able to hit 10.20.20.40 and see round robin traffic between the three web servers.

F5 LTM VE – Load balancing methods

So now that we are getting comfortable with the LTM, we should discuss the various types of load balancing methods. The LTM provides for lots of different types as shown below…

F5 breaks them into two groups, static and dynamic. Let’s go through them one at a time and discuss each.

Round Robin (Static)
Its the default load balancing type. Everything we’ve seen up to this point has been round robin. It provides an even distribution between all available pool members.

Ratio (Static)
Ratio mode allows you to define a ratio for each server. This is a good mode to use when servers have varying degrees of processing power. A ratio of…
WebHost1 – 3
WebHost2 – 1
WebHost3 – 1
Would result in the host being directed to WebHost1, WebHost1, WebHost1, Webhost2, WebHost3, Webhost1, Webhost1, Webhost1, Webhost2, etc.

Least Connections (Dynamic)
This mode distributes connections between web servers based on the current connection count between the F5 and the web server. Its not possible for the F5 to know of any other connections coming from other hosts so it only uses its own connection table to determine where to send the next request. So let’s test this one out to see what happens. I’m going to open a http request to one of the web servers. To do this, I’m actually going to download a large file from both of them to keep the sessions open long enough to test. With the file being downloaded we can see that we have a open connection to Webhost1…

Any future requests will take this into account. Browsing to that VIP will point us to the remaining two web servers. Try hitting the VIP and see what happens…

As you can see, we aren’t getting any requests going to Webhost1 at this point.

Fastest
Fastest distributes connections based on the server response time. This would be useful in a situation where previous requests may put varying degrees of a load on a server, hence slowing down future requests.

Least Sessions
Much like least connections but based on the session (F5 calls a persistence record that’s valid a session) count. The member with the least amount of sessions will get the next connection.

Weighted Least Connections
In order to use this method each member must have a defined (not 0) connection limit. The LTM then calculates the member capacity by as a ratio of current connections to the connection limit. The server with the smallest percentage of used capacity gets the next session.

Observed
This is sort of an odd one. The system assigns ratios to the members dynamically. The LTM checks the connection count on each member every second. The average is calculated and members with less than average connection counts get assigned a ratio of 3 and the those with a greater than average connection count get assigned a ratio of 2.

Predictive
Same as observed but uses 4 rather than 3 for less then average and 1 rather then 2 for greater than average.

Dynamic Ratio
A much more complex method of load balancing where particular brands of servers can be configured with special monitors and the load balancing method is based on various calculations of these metrics.

So that’s all of them. I tried to show examples of some but couldn’t show all of them in a lab setup. Next up is persistence. I might talk about profiles before that, not sure yet.

ClusterXL shows Active Attention / Interface Active Check Error

http://www.fir3net.com/Firewalls/Checkpoint/clusterxl-shows-active-attention-interface-active-check.html

Checkpoint FW SPLAT Cluster XL Troubleshooting (NGX Versions)

In this blog, let us see a Step by Step approach that you would take to troubleshoot a Cluster XL problem in Checkpoint.

Normally, this problem comes of after a reboot or an Upgrade or as a result on some change in the underlying network. When troubleshooting the CPHA, the following commands are very helpful

• cphaprob state
• cphaprob list
• cphaprob –a if

The status of the CPHA is shown by the first command. First thing that you need to do is verify basic connectivity between the firewall interfaces. Allow the cluster members to ping each other (if not already allowed by the policy) and ping away, you should be able to verify the basic connectivity in this way.

If the connectivity exists, then find out which firewall has the problem, it will normally be the down firewall

Number Unique Address Assigned Load State
1 (local) 10.0.0.1 100% Active
2 10.0.0.2 0% Down

Here as you can see the second firewall is down, you need to first go ahead and just execute ‘cpstop’ and ‘cpstart’ commands on the box. The CPHA should be back up.

Also execute the command ‘cphaprob –a if’ that should give you the interface status and Cluster Xl status.

If this doesn't work, try pushing the policy from the CMA/SC server and then execute cpstop / cpstart commands. If this doesn’t clear out the problem, reboot the box. 90% of the CPHA problems will be resolved in the above given steps, but if still its not resolved then read on.

The above steps were given with the assumption that the CPHA was working and it stopped working suddenly. If this is the first time you are trying to make it happen or some major policy/network changes broke it, then here is what you need to keep in mind.

• CPHA uses multicast, so make sure the switches you have in the path don’t drop multicast traffic, if you are using Cisco gear, then you might want to configure igmp snoop.
• It also uses the port ‘8116’ in UDP, so make sure that the port is open between the devices. (This is crucial if you have played around with the global properties and implied rules.
• RIB uses port 2010 so make sure that is also open between the firewalls.

After checking that your switches, execute the command, ‘cphaprob list’ and make sure both the sides have the same registration and the states of all of them are OK. If the state shows problem, then you should work in the direction of resolving that problem.

Device Name: FIB
Registration number: 4
Timeout: none
Current state: problem
Time since last report: 9.3 sec

Then you can do the snoop using the ‘fw monitor’ command and make sure the communication between the firewalls is happening.

Use the following command

fw monitor –e ‘accept dport=8116;’

1. You will see the source 0.0.0.0 and the destination as the network ID of the network over port 8116.
2. On port 2010 (change the dport to 2010 in above capture), you should see FIB communicating between the firewalls.

You should also check the /var/log/messages for error messages that can help you troubleshoot this further.

And yes, I forgot to mention, in this case, i was seeing that the FIB on one firewall had switched itself off after the upgrade, so went ahead and switched on advanced routing using ‘cpconfig’ command and all went well.

http://3-4-5-6.blogspot.com/2010/04/checkpoint-fw-splat-cluster-xl.html

Backup DataBase

The best practice to take the backup of the existing Eventlog Analyzer (including data, configurations, settings etc.,) is by copying the following folders, after shutting down the EventLog Analyzer.

\mysql
\server\default\indexes
\archive

In case of any crash of EventLog Analyzer which requires fresh installation, you can restore the above folders to the same location and access the data. Ensure that you stop the application while taking this backup.

if MySQL password is set in the old server, you need the following files from the old server to new server during migration or a fresh install due to crash.

1. startDB.bat and configureODBC.vbs located under \bin directory.

2. myodbc3.dll and myodbc3s.dll located under \lib directory.

3. mysql-ds.xml located under \server\default\deploy directory.

Further, we have created the batch files to start/stop EventLog Analyzer Service (Windows Service) during your automatic backup process.

Kindly download the attachment "Automate.zip" and extract and rename them as "stopELAservice.bat" and "startELAservice.bat" respectively under the "\bin" folder.

By using Windows 'Scheduled Tasks', you can schedule 'stopELAservice.bat' to run at the time when your backup application starts and schedule the 'startELAservice.bat' to run when your backup application stops. By this, you can automate the process.

Note: This batch file applies only when the EventLog Analyzer is running as a Windows service (named " ManageEngine EventLog Analyzer ").

Note: We do have options to export the Report Profiles and Alert Profiles from the UI and kindly make sure that you export those profiles as soon as you add any new report profiles or alert profiles, as another alternative.