BIG-IP Global Traffic Manager : Implementations. Version 11.0

(1)

BIG-IP

®

Global Traffic Manager

™

:

Implementations

(2)

(3)

Chapter 1: Upgrading BIG-IP GTM to Version 11...13

Converting a statistics collection server to a Prober pool automatically...14

Chapter 2: Delegating DNS Traffic to Wide IPs...15

Overview: Delegating DNS traffic to wide IPs...16

About listeners...17

Task summary...17

Creating a delegated zone on a local DNS server...17

Creating a self IP address using the IP address of the legacy DNS server...17

Designating GTM as the primary server for the zone...18

Creating a listener to handle traffic for wide IPs...18

Implementation results...19

Chapter 3: Replacing a DNS Server with BIG-IP GTM...21

Overview: Replacing a DNS server with BIG-IP GTM...22

Task summary...23

Configuring the legacy DNS server to allow zone file transfers...23

Acquiring zone files from the legacy DNS server...23

Creating a self IP address using the IP address of the legacy DNS server...24

Designating GTM as the primary server for the zone...24

Creating listeners to identify DNS traffic...24

Chapter 4: Sending Traffic Through BIG-IP GTM...27

Overview: Configuring GTM to pass traffic to an existing DNS server...28

About Router mode...29

About Bridge mode...29

Task summary...29

Placing GTM on your network to forward traffic...29

Creating a listener to forward traffic to a DNS server on a different network segment.29 Creating a listener to forward traffic to a DNS server on the same network segment..30

3 Table of Contents

(4)

Chapter 5:

Load Balancing Non-Wide IP DNS Traffic to a Pool of DNS Servers...31

Overview: Load balancing non-wide IP traffic to a pool of DNS servers...32

Task summary...32

Creating a pool of local DNS servers...32

Creating a listener that alerts GTM to DNS queries for a pool of DNS servers...32

Chapter 6:

Load Balancing DNS Traffic Between IPv-6 Only and IPv-4 Only Clouds...35

Overview: Load balancing IPv6-only connection requests to IPv4-only servers...36

Task summary...36

Creating a custom DNS profile ...36

Assigning a DNS profile to a virtual server...37

Chapter 7: Configuring GTM on a Network with One Route Domain...39

Overview: How do I deploy BIG-IP GTM on a network with one route domain?...40

Task summary...40

Creating VLANs for a route domain on BIG-IP LTM...41

Creating a route domain on BIG-IP LTM...41

Creating a self IP address for a route domain on BIG-IP LTM...42

Defining a server for a route domain on BIG-IP GTM...42

Chapter 8: Configuring GTM on a Network with Multiple Route Domains...45

Overview: How do I deploy BIG-IP GTM on a network with multiple route domains?...46

Task summary...47

Creating VLANs for a route domain on BIG-IP LTM...48

Creating a route domain on BIG-IP LTM...48

Creating a self IP address for a route domain on BIG-IP LTM...49

Disabling auto-discovery at the global-level on BIG-IP GTM...49

Defining a server for a route domain on BIG-IP GTM...49

Chapter 9: Securing Your DNS Infrastructure...51

Overview: Securing your DNS infrastructure...52

How do I prepare for a manual rollover of a DNSSEC key?...52

(5)

Task summary...52

Creating DNSSEC key-signing keys...53

Creating DNSSEC zone-signing keys...53

Creating DNSSEC zones...54

Validating that a zone is correctly signed ...55

Specifying which GTM creates new generations of DNSSEC keys...55

Chapter 10: Configuring DNS Express on BIG-IP Systems...57

Overview: How do I configure a BIG-IP system to mitigate DDoS attacks?...58

What is DNS Express?...58

Task summary...58

Creating a DNS Express TSIG key...58

Creating a DNS Express zone...58

Configuring the legacy DNS server to allow zone file transfers...59

Creating a DNS Express profile ...59

Assigning a DNS Express profile to a virtual server...60

Assigning a DNS Express profile to a listener...60

Viewing information about DNS Express zones...60

Chapter 11: Configuring IP Anycast (Route Health Injection)...63

Overview: Configuring IP Anycast (Route Health Injection)...64

Task summary...64

Enabling the ZebOS dynamic routing protocol...64

Creating a custom DNS profile...64

Configuring a listener for route advertisement...65

Verifying advertisement of the route to a listener...66

Chapter 12: Configuring BIG-IP GTM VIPRION Systems...67

Overview: Configuring BIG-IP GTM VIPRION systems...68

Configuring dependency for virtual server status...68

Chapter 13:

Ensuring Correct Synchronization When Adding GTM to a Network...69

Overview: Ensuring correct synchronization when adding GTM to a network...70

What is configuration synchronization?...70

About NTP Servers and Synchronization...70

About adding an additional BIG-IP GTM to your network...70

Task summary...71

(6)

Defining an NTP server on the existing GTM...71

Enabling synchronization on the existing GTM...71

Creating a data center on the existing GTM...71

Defining a server ...72

Running the gtm_add script on the new GTM...73

Chapter 14: Integrating BIG-IP GTM with Other BIG-IP Systems...75

Overview: Integrating GTM with older BIG-IP systems on my network...76

About the iQuery protocol and the big3d agent...76

Task summary...76

Defining a data center...77

Defining BIG-IP GTM...77

Defining the existing BIG-IP systems...78

Running the big3d_install script...79

Chapter 15: Setting Up a BIG-IP GTM Redundant System Configuration...81

Overview: Configuring a BIG-IP GTM redundant system...82

Task summary...82

Defining an NTP server...82

Creating listeners to identify DNS traffic...82

Defining a data center...83

Defining a server ...83

Enabling global traffic configuration synchronization...84

Running the gtm_add script ...85

Chapter 16:

Authenticating with SSL Certificates Signed by a Third Party...87

Overview: Authenticating with SSL certificates signed by a third party...88

SSL Authentication...88

Configuring Level 1 SSL authentication...88

Importing the device certificate...88

Importing the root certificate for the gtmd agent...89

Importing the root certificate for the big3d agent...89

Verifying the certificate exchange...89

Implementation Results...90

Configuring certificate chain SSL authentication...90

Creating a certificate chain file ...90

Importing the device certificate from the last CA server in the chain...90

Importing a certificate chain file for the gtmd agent...91

(7)

Importing a certificate chain for the big3d agent...91

Verifying the certificate chain exchange...91

Chapter 17: Monitoring Third-Party Servers with SNMP...93

Overview: SNMP monitoring of third-party servers...94

Task summary...94

Creating an SNMP monitor...94

Defining a third-party host server that is running SNMP...94

Chapter 18:

Configuring Device-Specific Probing and Statistics Collection...97

Overview: Configuring device-specific probing and statistics collection...98

About Prober pools...98

About Prober pool status...99

About Prober pool statistics...99

Task summary...100

Creating a Prober pool...100

Assigning a Prober pool to a data center...100

Assigning a Prober pool to a server...101

Viewing Prober pool statistics and status...101

Which Prober pool member marked my resource down?...101

Chapter 19: Diagnosing Network Connection Issues...103

Diagnosing network connection issues...104

Viewing information about connections between BIG-IP GTM and other BIG-IP systems ...104

iQuery statistics descriptions...104

(8)

(9)

Legal Notices

Publication Date

This document was published on August 17, 2011. Publication Number

MAN-0356-00 Copyright

F5 Networks, Inc. (F5) believes the information it furnishes to be accurate and reliable. However, F5 assumes no responsibility for the use of this information, nor any infringement of patents or other rights of third parties which may result from its use. No license is granted by implication or otherwise under any patent, copyright, or other intellectual property right of F5 except as specifically described by applicable user licenses. F5 reserves the right to change specifications at any time without notice.

Trademarks

3DNS, Access Policy Manager, Acopia, Acopia Networks, Advanced Client Authentication, Advanced Routing, APM, Application Security Manager, ARX, AskF5, ASM, BIG-IP, Cloud Extender, CloudFucious, CMP, Data Manager, DevCentral, DevCentral [DESIGN], DNS Express, DSC, DSI, Edge Client, Edge Gateway, Edge Portal, EM, Enterprise Manager, F5, F5 [DESIGN], F5 Management Pack, F5 Networks, F5 World, Fast Application Proxy, Fast Cache, FirePass, Global Traffic Manager, GTM, IBR, Intelligent Browser Referencing, Intelligent Compression, IPv6 Gateway, iApps, iControl, iHealth, iQuery, iRules, iRules OnDemand, iSession, IT agility. Your way., L7 Rate Shaping, LC, Link Controller, Local Traffic Manager, LTM, Message Security Module, MSM, Netcelera, OneConnect, Packet Velocity, Protocol Security Module, PSM, Real Traffic Policy Builder, ScaleN, SSL Acceleration, StrongBox, SuperVIP, SYN Check, TCP Express, TDR, TMOS, Traffic Management Operating System, TrafficShield, Transparent Data Reduction, VIPRION, vCMP, WA, WAN Optimization Manager, WANJet, WebAccelerator, WOM, and ZoneRunner, are trademarks or service marks of F5 Networks, Inc., in the U.S. and other countries, and may not be used without F5's express written consent.

All other product and company names herein may be trademarks of their respective owners. Patents

This product may be protected by U.S. Patents 6,374,300; 6,473,802; 6,970,733; 7,047,301; 7,707,289. This list is believed to be current as of August 17, 2011.

Export Regulation Notice

This product may include cryptographic software. Under the Export Administration Act, the United States government may consider it a criminal offense to export this product from the United States.

RF Interference Warning

This is a Class A product. In a domestic environment this product may cause radio interference, in which case the user may be required to take adequate measures.

(10)

FCC Compliance

This equipment has been tested and found to comply with the limits for a Class A digital device pursuant to Part 15 of FCC rules. These limits are designed to provide reasonable protection against harmful interference when the equipment is operated in a commercial environment. This unit generates, uses, and can radiate radio frequency energy and, if not installed and used in accordance with the instruction manual, may cause harmful interference to radio communications. Operation of this equipment in a residential area is likely to cause harmful interference, in which case the user, at his own expense, will be required to take whatever measures may be required to correct the interference.

Any modifications to this device, unless expressly approved by the manufacturer, can void the user's authority to operate this equipment under part 15 of the FCC rules.

Canadian Regulatory Compliance

This Class A digital apparatus complies with Canadian ICES-003. Standards Compliance

This product conforms to the IEC, European Union, ANSI/UL and Canadian CSA standards applicable to Information Technology products at the time of manufacture.

(11)

Acknowledgments

This product includes software developed by Gabriel Forté. This product includes software developed by Bill Paul. This product includes software developed by Jonathan Stone. This product includes software developed by Manuel Bouyer. This product includes software developed by Paul Richards.

This product includes software developed by the NetBSD Foundation, Inc. and its contributors. This product includes software developed by the Politecnico di Torino, and its contributors.

This product includes software developed by the Swedish Institute of Computer Science and its contributors. This product includes software developed by the University of California, Berkeley and its contributors. This product includes software developed by the Computer Systems Engineering Group at the Lawrence Berkeley Laboratory.

This product includes software developed by Christopher G. Demetriou for the NetBSD Project. This product includes software developed by Adam Glass.

This product includes software developed by Christian E. Hopps. This product includes software developed by Dean Huxley. This product includes software developed by John Kohl. This product includes software developed by Paul Kranenburg. This product includes software developed by Terrence R. Lambert. This product includes software developed by Philip A. Nelson. This product includes software developed by Herb Peyerl.

This product includes software developed by Jochen Pohl for the NetBSD Project. This product includes software developed by Chris Provenzano.

This product includes software developed by Theo de Raadt. This product includes software developed by David Muir Sharnoff. This product includes software developed by SigmaSoft, Th. Lockert.

This product includes software developed for the NetBSD Project by Jason R. Thorpe.

This product includes software developed by Jason R. Thorpe for And Communications, http://www.and.com. This product includes software developed for the NetBSD Project by Frank Van der Linden.

This product includes software developed for the NetBSD Project by John M. Vinopal. This product includes software developed by Christos Zoulas.

This product includes software developed by the University of Vermont and State Agricultural College and Garrett A. Wollman.

This product includes software developed by Balazs Scheidler ([email protected]), which is protected under the GNU Public License.

(12)

This product includes software developed by Niels Mueller ([email protected]), which is protected under the GNU Public License.

In the following statement, This software refers to the Mitsumi CD-ROM driver: This software was developed by Holger Veit and Brian Moore for use with 386BSD and similar operating systems. Similar operating systems includes mainly non-profit oriented systems for research and education, including but not restricted to NetBSD, FreeBSD, Mach (by CMU).

This product includes software developed by the Apache Group for use in the Apache HTTP server project (http://www.apache.org/).

This product includes software licensed from Richard H. Porter under the GNU Library General Public License (©_{1998, Red Hat Software), www.gnu.org/copyleft/lgpl.html.}

This product includes the standard version of Perl software licensed under the Perl Artistic License (©_1997, 1998 Tom Christiansen and Nathan Torkington). All rights reserved. You may find the most current standard version of Perl at http://www.perl.com.

This product includes software developed by Jared Minch.

This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit (http://www.openssl.org/).

This product includes cryptographic software written by Eric Young ([email protected]).

This product contains software based on oprofile, which is protected under the GNU Public License. This product includes RRDtool software developed by Tobi Oetiker (http://www.rrdtool.com/index.html) and licensed under the GNU General Public License.

This product contains software licensed from Dr. Brian Gladman under the GNU General Public License (GPL).

This product includes software developed by the Apache Software Foundation (http://www.apache.org/). This product includes Hypersonic SQL.

This product contains software developed by the Regents of the University of California, Sun Microsystems, Inc., Scriptics Corporation, and others.

This product includes software developed by the Internet Software Consortium.

This product includes software developed by Nominum, Inc. (http://www.nominum.com).

This product contains software developed by Broadcom Corporation, which is protected under the GNU Public License.

This product contains software developed by MaxMind LLC, and is protected under the GNU Lesser General Public License, as published by the Free Software Foundation.

This product includes the GeoPoint Database developed by Quova, Inc. and its contributors. Acknowledgments

(13)

Chapter

1

Upgrading BIG-IP GTM to Version 11

Topics:

• Converting a statistics collection server to a Prober pool automatically

(14)

Converting a statistics collection server to a Prober pool automatically

In version 10.2 of BIG-IP®

Global Traffic Manager™

(GTM™

), you could assign a single BIG-IP®

system to probe a server to gather health and performance data. You did this by specifying the IP address of the BIG-IP system (which you chose to perform probes of the server) in the Statistics Collection Server field of the server. In version 11.0, this feature is replaced by the Prober pool feature.

When you upgrade from version 10.2.x to version 11.0, if a single BIG-IP system was assigned to probe a server, BIG-IP GTM converts the single server to a Prober pool with one member, and then assigns the Prober pool to the server to which the Statistics Collection server was originally assigned. The name of the new Prober pool is based on the IP address of the original Statistics Collection server. If the original Statistics Collection server had an IP address of 10.10.2.3, the name of the automatically created Prober pool is

prober_pool_10_10_2_3. Upgrading BIG-IP GTM to Version 11

(15)

Chapter

2

Delegating DNS Traffic to Wide IPs

Topics:

• Overview: Delegating DNS traffic to wide IPs

• Task summary

(16)

Overview: Delegating DNS traffic to wide IPs

BIG-IP®

(GTM™

) load balances incoming wide IP traffic to your network resources. BIG-IP GTM can work in conjunction with an existing DNS server on your network. In this situation, you configure the DNS server to delegate wide IP-related requests to the BIG-IP GTM for name resolution.

Figure 1: Traffic flow when DNS server delegates traffic to BIG-IP GTM

This implementation focuses on the fictional company SiteRequest, which recently purchased BIG-IP GTM to help load balance traffic across two of its web-based applications: store.siterequest.com and

checkout.siterequest.com. These applications are delegated zones of www.siterequest.com, which an existing DNS server manages. They have already configured BIG-IP GTM with two wide IPs,

store.wip.siterequest.com and checkout.wip.siterequest.com, which correspond to these two web applications.

(17)

About listeners

Listeners control how BIG-IP®

GTM™

handles network traffic. A listener is a specialized virtual server that is assigned a specific IP address. A wildcard listener is a special listener that is assigned an IP address of

0.0.0.0 and DNS query port (port 53). When traffic is sent to the IP address of a listener, BIG-IP GTM either handles the traffic locally or sends the traffic to the appropriate resource.

Task summary

Perform these tasks to delegate DNS traffic to wide IPs.

Creating a delegated zone on a local DNS server

Creating a self IP address using the IP address of the legacy DNS server Designating GTM as the primary server for the zone

Creating a listener to handle traffic for wide IPs

Creating a delegated zone on a local DNS server

If you are unfamiliar with how to modify the files on DNS servers, review the fifth edition of DNS and BIND, available from O’Reilly Media.

Determine which DNS servers will delegate wide IP-related requests to BIG-IP®GTM™. In order for BIG-IP GTM to manage the web applications of store.siterequest.com and

checkout.siterequest.com, you must create a delegated zone on the existing DNS server. Perform the following steps on the selected DNS servers.

1. Create an address record (A record) that defines the domain name and IP address of BIG-IP GTM. 2. Create a nameserver record (NS record) that defines the delegated zone for which BIG-IP GTM is

responsible.

3. Create canonical name records (CNAME records) for each web application, which forwards requests to store.siterequest.com and checkout.siterequest.com to the wide IP addresses of

store.wip.siterequest.com and checkout.wip.siterequest.com, respectively. A delegated zone exists on each DNS server on which you performed this procedure.

Creating a self IP address using the IP address of the legacy DNS server

Create a self IP address on BIG-IP®GTM™ using the IP address of the legacy DNS server. 1. On the Main tab, click Network > Self IPs.

2. Click Create.

The New Self IP screen opens.

3. In the IP Address field, type the IP address of the legacy DNS server. The system accepts IP addresses in both the IPv4 and IPv6 formats. 4. In the Netmask field, type the network mask for the specified IP address. 5. Click Finished.

17 BIG-IP®_{Global Traffic Manager}™_{: Implementations}

(18)

The screen refreshes, and displays the new self IP address in the list.

Designating GTM as the primary server for the zone

Ensure that you have created a self IP address on BIG-IP®GTM™ using the IP address of the legacy DNS server.

Add the new self IP address to the BIG-IP GTM server object. Then modify the DNS server based on your network configuration.

1. Log on to BIG-IP GTM.

2. On the Main tab, click Global Traffic > Servers. The Server List screen opens.

3. Click the name of the BIG-IP GTM system that you want to modify. The server settings and values display.

4. In the Address List area, add the new self IP address. 5. Click Update.

6. Do one of the following based on your network configuration:

• Modify the IP address of the legacy DNS server so that it becomes a secondary DNS server to BIG-IP GTM. Ensure that the IP address of the DNS server does not conflict with the self IP address that you added to the BIG-IP GTM server object.

Note: If you are unfamiliar with how to change a DNS server from a primary to a secondary,

refer to the fifth edition of DNS and BIND, available from O’Reilly Media. • Remove the legacy DNS server from your network.

BIG-IP GTM is now the authoritative name server for the zone. The root servers for the zone do not need to be updated, because the IP address of the legacy DNS server was added to BIG-IP GTM.

Creating a listener to handle traffic for wide IPs

You need to create a listener that corresponds to a delegated zone that you create on your existing DNS server. This listener will identify DNS traffic that is destined for BIG-IP®GTM™.

1. On the Main tab, click Global Traffic > Listeners . The Listeners List screen opens.

The new Listeners screen opens.

3. In the Destination field, type the IP address on which BIG-IP GTM listens for network traffic. The destination is a self IP address on BIG-IP GTM.

4. From the VLAN Traffic list, select All VLANs. 5. From the Protocol list, select either UDP or TCP. 6. Click Finished.

(19)

Implementation results

You now have an implementation of BIG-IP®

GTM™

in which a DNS server manages DNS traffic unless a query is for a wide IP configured on BIG-IP GTM. When the DNS server receives queries for

store.siterequest.com or checkout.siterequest.com, it delegates the queries to BIG-IP GTM, which then load balances the traffic to the appropriate wide IPs.

(20)

(21)

Chapter

3

Replacing a DNS Server with BIG-IP GTM

Topics:

• Overview: Replacing a DNS server with BIG-IP GTM

• Task summary

(22)

Overview: Replacing a DNS server with BIG-IP GTM

BIG-IP®

(GTM™

) load balances incoming wide IP traffic to your network resources. BIG-IP GTM can also replace a local DNS server as the authoritative nameserver for wide IPs, zones, and all other DNS-related traffic. You can configure BIG-IP GTM to replace the DNS server that currently manages www.siterequest.com. BIG-IP GTM becomes the authoritative nameserver for

www.siterequest.com and load balances traffic across the web-based applications

store.siterequest.com and checkout.siterequest.com.

Figure 2: Traffic flow when BIG-IP GTM replaces DNS server

About listeners

Listeners control how BIG-IP®GTM™ handles network traffic. A listener is a specialized virtual server that is assigned a specific IP address. A wildcard listener is a special listener that is assigned an IP address of

(23)

Task summary

Perform these tasks to replace a DNS server with BIG-IP GTM.

Configuring the legacy DNS server to allow zone file transfers Acquiring zone files from the legacy DNS server

Creating a self IP address using the IP address of the legacy DNS server Designating GTM as the primary server for the zone

Creating listeners to identify DNS traffic

Configuring the legacy DNS server to allow zone file transfers

If you are unfamiliar with how to modify DNS server files, review the fifth edition of DNS and BIND, available from O’Reilly Media.

To configure the legacy DNS server to allow zone file transfers to BIG-IP®GTM™, add to the DNS server an allow-transfer statement that specifies the IP address of the new BIG-IP GTM system.

You can modify the following allow-transfer statement to use the IP address of your BIG-IP GTM:

allow-transfer { localhost; <IP address of BIG-IP GTM>; };

Acquiring zone files from the legacy DNS server

Ensure that you have configured the legacy DNS server with an allow-transfer statement that authorizes zone transfers to BIG-IP®GTM™.

For BIG-IP GTM to acquire zone files from the legacy DNS server, create a new zone. 1. On the Main tab, click Global Traffic > ZoneRunner > Zone List.

The Zone List screen opens. 2. Click Create.

3. From the View Name list, select the view that you want this zone to be a member of. The default view is external.

4. In the Zone Name field, type a name for the zone file in this format, including the trailing dot:

db.[viewname].[zonename].

For example, db.external.siterequest.com.

5. From the Zone Type list, select Master.

6. From the Records Creation Method list, select Transfer from Server.

7. In the Source Server field, type the IP address of the DNS server (the server from which you want BIG-IP GTM to acquire zone files).

8. Click Finished.

(24)