Finding serial no

BigIP 10.x version

Serial no. format f5-xxxx-xxxx

Command line
Login into console (advanced shell)
tmsh show sys hardware | grep -i chassis

Output will look like:
Chassis Serial f5-xxxx-xxxx

(or)
b platform | grep -i serial

Output will look like:
Chassis   serial f5-xxxx-xxxx


GUI
System -> Configuration -> Chassis Serial Number

iRule to route traffic to different pools

1. Set the virtual server to ipaddress:any


2. Associate iRule
when CLIENT_ACCEPTED { if {[TCP::local_port] equals 5000} { pool mypool1} elseif {[TCP::local_port] equals 5001} { pool mypool2}}

Configuring syslog

1) SSH into F5 management IP as admin with advanced shell

2) Execute the commands
2a) #bigpipe syslog remote server {my-syslog-server1 {host syslog-server-ip-address} my-syslog-server1 {host syslog-server-ip-address}}

Examples:
#bigpipe syslog remote server {mysolarwinds {host 10.101.102.103}}
#bigpipe syslog remote server {mysplunk {host 10.101.102.104} my-arcsight {host 10.101.102.105}}

2b) #bigpipe save

3) Restart syslog-ng utility
#bigstart restart syslog-ng

4) Verify

#b syslog remote server show

Implementing ProxyPass iRule in LTM

Scenario
You want to proxypass www.customersite.com to www.internalsite.com without replacing browser URL.

Solution

1) Download the proxypass iRule from the following links based on your BigIp version.

BigIp 10: http://devcentral.f5.com/wiki/iRules.ProxyPassV10.ashx

BigIp 9: http://devcentral.f5.com/wiki/iRules.ProxyPass.ashx

2) Add the iRule to the iRules section

3) Note down the pool names for customersite and internalsite websites

Assume the following names

Virtual Server: customersite-vs

Pools: customersite-pool and internalsite-pool exist in LTM

4) Create a Data Group Navigate to iRules -> Data group

Name: ProxyPasscustomersite-vs 

Please note the name should follow the convention above where customersite-vs should match the virtual server name.

Type: String 

BigIP 10

Name: /customerdir1 

Value: /internaldir1 internalsite-pool

When you add an entry, it will be of the format

/customerdir1 := /internaldir1 internalsite-pool

BigIP 9

String: /customerdir1 Value: /internaldir1 internalsite-pool

You can add more directory mappings as desired.

You can also map the above Value to direct URL mapping in case you do not want to map to a pool.

/customerdir1 := my-new-internal-site.com/internaldir1

5) Associate the iRule to customersite-vs virtual server.

6) Test the URL www.customersite.com/customerdir1. The webpages get loaded from www.internalsite.com/internaldir1 without replacing the browser URL.

Proxypass in F5 is similar to Apache ProxyPass functionality.

F5 BigIP LTM commands

1) SSH into LTM, update /config/bigip.conf with desired changes.
Load the file:
bigpipe load
bigpipe save

2) Create qkview from command line

qkview -c -s 0 -f /shared/tmp/`/bin/hostname`_qkview_`date +%Y%d%m%H%M`.tgz

-c refers to config and -s 0 refers to largest size


3) Miscellaneous commands

vim tmm
/usr/libexec/bigpipe daol
cd partitions/INT
tmsh
tmsh load sys config
tmsh save sys config
tail /var/log/ltm --lines=50
touch /service/mcpd/forceload
curl --user C1148904:emendez@rccl.com --upload-file C1148904-1.cap

F5 BigIP LTM iRules

1) To redirect http requests to https
-------------------------------------------------------------------------

when HTTP_REQUEST {

HTTP::redirect https://[HTTP::host][HTTP::uri]

}

-------------------------------------------------------------------------

Please check Redirect Rewrite to Matching in HTTP Profile used

Associate the iRule with Virtual Server Profile

2) To modify cookie domain for JSESSIONID.

-------------------------------------------------------------------------

when HTTP_RESPONSE {

   if {[HTTP::cookie count] > 0 } {
      foreach aCookie [HTTP::cookie names] {
         log local0. "Cookie name: $aCookie"
         if { $aCookie == "JSESSIONID" } {
            HTTP::cookie domain $aCookie yourwiderdomain.com
         }
      }
   }
}
-------------------------------------------------------------------------

This iRule will help to issue the same JSESSIONID when switching between different subdomains.

In JBOSS by default, you will get two different JSession IDs when you make requests to www.domain.com and secure.domain.com. If you examine the JSESSIONID cookie, you will see the domain name is set to complete www.domain.com and secure.domain.com respectively.

To avoid this issue and get a single JSESSIONID , create an iRule as above and set the cookie domain at wider level, ex: domain.com. Associate the iRule to virtual server in the resources section. Hit the URLs again, the domain name in JSESSIONID will be set to domain.com. 

3) Issue 301 redirect and resolve to desired URI
-------------------------------------------------------------------------
when HTTP_REQUEST {
if { not ([HTTP::host] starts_with "www") }
{
   HTTP::respond 301 Location "http://www.[HTTP::host]/urigoeshere"
}
elseif { [HTTP::uri] equals "/" }{
   HTTP::respond 301 Location "http://[HTTP::host]/urigoeshere"
}
}

Another flavor with or condition

when HTTP_REQUEST {
   if { not ([HTTP::host] starts_with "www"
         or [HTTP::host] starts_with "somename"
       )
     }{
           HTTP::respond 301 Location "http://www.[HTTP::host]/web/cs?a=5"
   }
   elseif { [HTTP::uri] equals "/" }{
     HTTP::respond 301 Location "http://[HTTP::host]/web/cs?a=5"
   }
 }

-------------------------------------------------------------------------
This iRule will avoid multiple redirects.

4) Insert X-Forwarded-Proto

-------------------------------------------------------------------------

iRule for port 80

when HTTP_REQUEST {

   HTTP::header remove X-Forwarded-Proto

   HTTP::header insert X-Forwarded-Proto http

}

iRule for port 443

when HTTP_REQUEST {

   HTTP::header remove X-Forwarded-Proto

   HTTP::header insert X-Forwarded-Proto https

}

-------------------------------------------------------------------------

This iRule is useful to identify the client protocol is either http or https. This iRule helps the when the SSL gets decrypted in load balancer or web server and backed requests are sent to application server as http. If the application uses http servlet isSecure method, setting the iRule on port 443 will return isSecure as true. Please note the XForwardProto filter will also have to be applied on application server to get the correct value for isSecure or getScheme.

4) Logging 

-------------------------------------------------------------------------

log local0. "value1= $somevariable and value2= $somevariableothervariable "

log local0. " IP: [IP::client_addr] "

log local0. " uri= [HTTP::uri] path= [HTTP::path] query= [HTTP::query] 

-------------------------------------------------------------------------

The log command can be inserted to iRule to provide useful debug information.

Recommended LTM Configuration for Apache

1) Login into LTM

2) Create monitor: Local Traffic -> Monitors -> create apache-http-monitor

Type: http

Import Settings: http

Interval: 30 seconds

Timeout: 91 seconds
Send String: GET /ltmreply.html 

Finish

Note:

a) Recommended calculation for Timeout based on Interval value => (1:3)+1 => (30 * 3 + 1 = 90 secs

b) Send String is optional. The default is GET /. If you want to modify as above, create a page called ltmreply.html with simple content like 'web server alive' and place it in the document root folder in web server.

3) Create Pool

Local Traffic - Virtual Servers -> Pools -> Create

Name: your choice

Health Monitor: apache-http-monitor (created as above)

Slow Ramp Time: 30 secs

Finish

4) Create Pool Members

Local Traffic - Virtual Servers -> Pools -> Members

Specify web server IP address and port as 9080.

(Assume that web server listens on port 9080)

5) Create HTTP Profile

Local Traffic -> Virtual Servers -> Profiles -> Services -> HTTP -> Create New

Name: apache-http-opt

Parent Profile: http-wan-optimized-compression-caching (If not using WebAccelerator)

Redirect Rewrite: Matching (to support http to https switching)

Leave the rest to default values

Finish

6) Create TCP Profiles

a) Local Traffic -> Virtual Servers -> Profiles -> Protocol -> TCP -> Create New

Name: apache-tcp-lan

Parent Profile: tcp-lan-optimized (if Apache connect to devices on local network - server side TCP connections)

b) Local Traffic -> Virtual Servers -> Profiles -> Protocol -> TCP -> Create New

Name: apache-tcp-wan

Parent Profile: tcp-wan-optimized (if users connect to Apache from remote places - client side TCP connections)

7) Create Persistence Profiles

a) Local Traffic -> Virtual Servers -> Profiles -> Persistence -> Create New

Name: apache-cookie

Type: Cookie

b) Local Traffic -> Virtual Servers -> Profiles -> Persistence -> Create New

Name: apache-source

Type: Source Addresses Affinity

Finish

8) Create OneConnect profile (client requests can utilize existing, server-side connections - recommended to provide significant performance improvements)

Local Traffic -> Virtual Servers -> Profiles -> Other Profiles -> Create New

Name: apache-oneconnect

Type: oneconnect

9) Create Virtual Servers for HTTP traffic

Local Traffic -> Virtual Servers -> Create New

Name: your choice

Destination: Host - Provide, IP address

Service Port: 80 HTTP

Configuration: Advanced:

Type: Standard

Protocol: TCP

Protocol Profile (Client): apache-tcp-wan

Protocol Profile (Server): apache-tcp-lan

OneConnect Profile: apache-oneconnect

HTTP Profile: apache-http-opt

Finish

Navigate to created virtual server -> Resources

Default Pool: Select the pool created above

Default Persistence Profile: apache-cookie

Fallback Persistence Profile: apache-source

10) Import CA Root Certs if different than recognized CA (Your organization can even act as CA for self signed certs)

Local Traffic -> SSL Certificates -> Import ->

Import Type: Certificate

Certificate Name: Create New -> Your choice

Certificate Source : Upload File -> Upload root ca cert for your organization

Local Traffic -> SSL Certificates -> Import ->

Import Type: Certificate

Certificate Name: Create New -> Your choice

Certificate Source : Upload File -> Upload Intermediary ca cert for your organization

10) Create CSR

Local Traffic -> SSL Certificates -> Create

Provide Name, Issuer: Certificate Authority and other details

Download the CSR

Finish

You will see a key record created under SSL certificates

11) Certificate Authorization

Login to the Microsoft Certificate Server

Request a certificate -> Advanced Certificate Request -> Submit a certificate request by using a base-64-encoded CMC or PKCS #10 file, or submit a renewal request by using a base-64-encoded PKCS #7 file.

Certificate Request: Browse & insert the CSR file created above

Certificate Template: Web Server

Attributes: san:dns=www.mydomain.com&dns=secure.mydomain.com

(Attributes parameter is like an alias so one cert can be used for multiple domains)

Submit

Download and save the certificate.

Open the certificate -> Go to Details tab -> Subject Alternative Name

Check for Alias

12) Import SSL certificate into LTM

Local Traffic -> SSL Certificates -> Navigate to the CSR/Key created in the above.

Upload the Cert and Import

13) Create an Client SSL Profile

Local Traffic -> Virtual Servers -> Profiles -> SSL -> Create New

Name: your choice

Certificate: As created or imported above

Key: As created or imported above

Chain: Your company's Chain cert imported above

Trusted CA: Your company's CA cert imported above

Finish

14) Create Virtual Servers for HTTPS traffic

Local Traffic -> Virtual Servers -> Create New

Name: your choice

Destination: Host - Provide, IP address

Service Port: 443 HTTPS

Configuration: Advanced:

Type: Standard

Protocol: TCP

Protocol Profile (Client): apache-tcp-wan

Protocol Profile (Server): apache-tcp-lan

OneConnect Profile: apache-oneconnect

HTTP Profile: apache-http-opt

SSL Profile (Client): Select the clienssl profile created above

Finish

Navigate to created virtual server -> Resources

Default Pool: Select the http pool created above

Default Persistence Profile: apache-cookie

Fallback Persistence Profile: apache-source

Reference: F5 deployment guide: Deploying F5 with Apache Web Servers