BIG-IP Virtual Edition and Microsoft Azure: Setup. Version 12.0

BIG-IP Virtual Edition and Microsoft Azure: Setup Version 12.0

Table of Contents Table of Contents Getting Started with BIG-IP Virtual Edition on Azure...5 Sample topology for BIG-IP VE on Azure... 5 Steps to deploy BIG-IP VE...5 Azure instances for BIG-IP VE...6 Deploying BIG-IP Virtual Edition in Azure...7 Deploying BIG-IP VE in Azure Resource Manager...7 Deploying BIG-IP VE in Azure Classic...8 Creating a public key for authentication... 9 Accessing the user interface... 10 Setting the admin password... 10 Changing the user interface port...10 Increasing BIG-IP VE Availability in Azure... 13 About increasing BIG-IP VE availability in Azure... 13 Enabling config sync for BIG-IP VE in Azure... 14 Legal Notices... 15 Legal notices...15 3

Table of Contents 4

Getting Started with BIG-IP Virtual Edition on Azure Sample topology for BIG-IP VE on Azure The following diagram shows a simple deployment of a BIG-IP VE virtual appliance in Microsoft Azure. Follow the steps in this guide to create this deployment. In this deployment, you can use the BIG-IP VE virtual appliance to process traffic in all of the ways an on-premise BIG-IP appliance processes traffic; for example, you can use it as a load balancer, to edit packets before they're sent to application servers, as a firewall, and so on. As shown in the diagram, all access to the BIG-IP VE appliance is through the same IP address. Because of this, the BIG-IP VE high availability feature does not work in Azure. (You cannot create an activestandby pair.) If you have two or more applications that need access to the same port, you have several options, including: BIG-IP VE supports Server Name Indicator (SNI), which allows a single virtual IP to host multiple domains. For more information, see https://support.f5.com/kb/en-us/solutions/ public/13000/400/sol13452.html. If you are using Windows/IIS web sites, add a DNS record for each domain name and have them both point to the same IP address. The browser sends the URL in the host header field of the request and the correct web site is served. Use BIG-IP irules to make pool decisions based on header content. Steps to deploy BIG-IP VE To deploy the BIG-IP Virtual Edition (VE) system on Azure, use the following checklist.

Getting Started with BIG-IP Virtual Edition on Azure Step Details More information 1 Choose the F5 license that meet your needs. 2 Choose the Azure instance that meets your needs. 3 Deploy a BIG-IP VE virtual appliance. 4 Change the port assigned to the BIG-IP VE user interface. See https://f5.com/products/how-to-buy/ simplified-licensing for licensing information. Supported instances are listed in Azure instances for BIG-IP VE. You can find a F5 BIG-IP VE image in the Azure Marketplace and create a virtual appliance from it. If you are using the Classic deployment model, the process will be different than the Resource Manager deployment model. By default, the BIG-IP user interface uses port 443 for management. If you want to use 443 for other traffic, change the BIG-IP VE user interface port to something else (8443 or 10443, for example). Azure instances for BIG-IP VE Choose the Microsoft Azure instance based on the F5 license you need. For more information about F5 licenses, see https://f5.com/products/how-to-buy/simplified-licensing. The following Azure instances are supported for this release of BIG-IP VE. Azure instance Good Better Best A1 Standard D11 v2 A4 Standard X X A6 Standard X X X X A7 Standard X X X Note: The minimum storage required for BIG-IP VE running all modules is 139GB. If you want to use Application Acceleration Manager (AAM ), you need an additional 20GB of storage that is dedicated to AAM only. For more information, see Disk Management for Datastore in the AskF5 Knowledge Base (http://support.f5.com). 6

Deploying BIG-IP Virtual Edition in Azure Deploying BIG-IP VE in Azure Resource Manager Follow these steps to deploy BIG-IP VE in the Azure Resource Manager deployment model. For Azure Classic instructions, see Deploying BIG-IP VE in Azure Classic. 1. Log in to the Microsoft Azure Portal at https://portal.azure.com. 2. On the Start pane, select Marketplace. 3. In the Filter field, type F5 and press Enter. 4. From the list of options, select the F5 image of your choice. 5. From the Select a deployment model list, select Resource Manager and click Create. 6. On the Basics page: Setting Name User name Authenticat ion type Subscriptio n Resource group Location Details A name for the virtual appliance. A name for the person who will log in. You can't change or access this field later. SSH keys are more secure than passwords. For information about getting public keys, see Create a public key for authentication. Accept the default or click the right arrow to change it. A resource group is a logical container of related resources. Accept the default or click the right arrow to change it. Accept the default or click the right arrow to change it. 7. On the Size page, choose the instance size that meets your needs, and click Select. For a list of instances supported for each F5 license, see Azure instances for BIG-IP VE. 8. On the Settings page: Section Setting Details Storage Disk type Choose Standard. Premium (SSD) is not supported. Storage Storage account Select existing or create new. Network Network Select existing or create new. Monitoring Diagnostics Select Disabled. Diagnostics are not supported in this release of BIG-IP VE. Availability Availability set Select existing or create new. 9. On the Summary page, click OK.

Deploying BIG-IP Virtual Edition in Azure 10. On the Buy page, click OK to approve the purchase and initiate the deployment. The following resources are created: A BIG-IP VE virtual appliance with one network interface. A VLAN named internal. A self IP address named self_1nic. Note: Only one VLAN is supported in Azure and it was created during deployment, so when you access the BIG-IP user interface, you do not need to use the Setup wizard to configure networking. Deploying BIG-IP VE in Azure Classic Follow these steps to deploy BIG-IP VE in the Azure Classic deployment model. Even though you are using Classic resources, you perform these steps in the new Resource Manager portal. For Azure Resource Manager instructions, see Deploy BIG-IP VE in Azure Resource Manager. 1. Log in to the Microsoft Azure Portal at https://portal.azure.com. 2. On the Start pane, select Marketplace. 3. In the Filter field, type F5 and press Enter. 4. From the list of options, select the F5 image of your choice. 5. From the Select a deployment model list, select Classic and then click Create. 6. On the Create VM page: Setting Host Name User name Authentication type Pricing Tier Details A name for the virtual appliance. A name for the person who will log in. You can't change or access this field later. SSH keys are more secure than passwords. For information on getting public keys, see Create a public key for authentication. For a list of instances supported for each F5 license, see Azure instances for BIG-IP VE. 7. For Pricing Tier, leave the default or choose the instance size that meets your needs and click Select. For a list of instances supported for each F5 license, see Azure instances for BIG-IP VE. 8. For Optional Configuration, note the following details. Setting Details Availability set All instances in an availability set must have the same subnets. BIG-IP high availability is currently not supported in Azure, so you should configure the BIG-IP to reboot if a daemon fails. For details, see the BIG- IP System: Essentials guide on AskF5.com. 8

BIG-IP Virtual Edition and Microsoft Azure: Setup Setting Network Storage Details Select the Classic virtual network of your choice. If you accept the default, a new virtual network is created under the Resource Manager deployment model. Select existing Classic storage or create new Classic storage. Endpoints Create an endpoint for port 443. This allows you to access the BIG-IP user interface. Create additional endpoints for any other ports that need external access. For example, port 80 if the BIG-IP VE will process HTTP traffic. If you choose SSH and do not specify a public port, the system provides a port number for you. Once a port number is assigned, it can't be re-used until you remove or reconfigure that endpoint. 9. For Resource Group, either accept the default or click the right arrow (>) to change it. A resource group is a logical container of related resources. Important: If you choose an existing resource group, you will be choosing from a list of Azure Classic Cloud Services. If you create a new group, you are creating a new resource group. 10. Confirm that the subscription and location are correct, and agree to the legal terms. 11. Click Create. The following resources are created: A BIG-IP VE virtual appliance with one network interface. A VLAN named internal. A self IP address named self_1nic. Note: Only one VLAN is supported in Azure and it was created during deployment, so when you access the BIG-IP user interface, you do not need to use the Setup wizard to configure networking. Creating a public key for authentication To use public key authentication, you need an SSH public key. For more information, see https:// azure.microsoft.com/en-us/documentation/articles/virtual-machines-linux-usessh-key. For Linux and Mac OS X operating systems, use the ssh-keygen command-line utility to produce a key pair (which includes a.pub file). Then, convert that public key using the command: sshkeygen -e -f<path-to-dot-pub-file>. For Windows operating systems, use the PuTTYGen utility to create a public key pair. 9

Deploying BIG-IP Virtual Edition in Azure Accessing the user interface The BIG-IP user interface is a web page you use to configure the BIG-IP VE virtual appliance. By default, this page is accessible through port 443. After you deploy BIG-IP VE: 1. If you used a key pair when you deployed BIG-IP VE, you must use SSH to connect to BIG-IP VE and set the Admin password. 2. You must log in to the BIG-IP VE management user interface, and license and provision the system. 3. After you have logged in at least one time, for the Resource Manager deployment model: Use tmsh to change the user interface port. Note: For the Classic deployment model, when you deployed BIG-IP VE, you added an endpoint for port 443 in Azure. If you change the port in the BIG-IP system, you must also change the endpoint in Azure. Setting the admin password If you use a key pair (rather than a password) to authenticate access to the Azure instance, you must set an administrator password for the BIG-IP user interface. 1. Use a secure shell terminal (SSH) to access the instance; use either the private key or user name for authentication (depending on what you specified when you created the instance). 2. Ensure you are at the tmsh prompt. If you logged in as Admin, the bash prompt is displayed by default. 3. Create a password for the Admin user for the instance. modify auth user <username> password <user-password> 4. Save the changes to the system configuration. save sys config 5. End the SSH session. Changing the user interface port Before completing these steps, the BIG-IP VE virtual appliance must be licensed and provisioned. The BIG-IP user interface uses port 443 by default. Change the user interface port to 8443 so you can access the user interface (https://<your-public-ip-address>:8443) and use 443 for other traffic. Note: These steps are required for the Resource Manager deployment model only. 1. Use a secure shell terminal (SSH) to access the instance; use either the private key or user name for authentication (depending on what you specified when you created the instance).you cannot use the root login. 2. Type tmsh to ensure you are accessing the tmsh prompt. If you logged in as Admin, the bash prompt is displayed by default. 3. Move the port from port 443 to 8443. modify sys httpd ssl-port 8443 4. Add 8443 to the default self allow port list (required for single NIC deployment). modify net self-allow defaults add { tcp:8443 } 5. Now that the user interface is no longer using port 443, remove the reference to it. 10

BIG-IP Virtual Edition and Microsoft Azure: Setup modify net self-allow defaults delete { tcp:443 } 6. Save the changes to the system configuration. save sys config 7. End the SSH session. 11

Deploying BIG-IP Virtual Edition in Azure 12

Increasing BIG-IP VE Availability in Azure About increasing BIG-IP VE availability in Azure The following diagram shows a basic deployment of two BIG-IP VE virtual appliances in a Microsoft Azure availability set. The two BIG-IP VEs are synchronizing their configurations to one another; they are not communicating for the purpose of failover. The BIG-IP VE high availability feature does not work in Azure, and you cannot create an active-standby pair. This deployment has the following benefits: The two BIG-IP VEs are on different hardware, because they are in an Azure availability set, and as such, both servers should not be down at the same time. Changes on one BIG-IP VE are propagated to the other, because config sync is enabled. If one BIG-IP VE fails, the other BIG-IP VE continues to process traffic, though packets on the failed system are lost. Both BIG-IP VEs have Active status and are available to process traffic. More traffic can be processed; if each BIG-IP VE has 1Gbps of throughput, then together they have 2Gbps.

Increasing BIG-IP VE Availability in Azure Enabling config sync for BIG-IP VE in Azure Enable config sync communication between BIG-IP Virtual Edition (VE) virtual appliances when you want to automatically or manually synchronize configuration information between appliances. 1. Determine the static private IP address in the Azure virtual network. To find this address, in the Azure portal, select the virtual machine, and click Properties. 2. Disable functionality that enforces single NIC setup. tmsh modify sys db provision.1nicautoconfig value disable 3. Confirm that the value was set correctly by typing tmsh list sys db provision. 1nicautoconfig. The following text is returned: value "disable". 4. Ensure that both BIG-IP VEs are running the same version of BIG-IP VE system software. (In BIG- IP VE, go to System > Software Management.) 5. On each BIG-IP VE, specify the Azure static private IP address as the self IP address for config sync. tmsh modify cm device <bigipx> configsync-ip <self-ip> 6. Establish device trust: On one BIG-IP VE, enter the management IP address of the other BIG-IP VE, along with the username and password. tmsh modify cm trust-domain root ca-devices add { <peer-mgmt-ip> } name <bigipx> user <user> password <password> 7. Create a sync-failover device group with network failover disabled. tmsh create cm device-group <device-group> devices add { <all-device-namesseparated-by-space> } type sync-failover auto-sync enabled network-failover disabled 8. Sync one BIG-IP VE to the other. tmsh run cm config-sync to-group <device-group> 14

Legal Notices Legal notices Publication Date This document was published on April 26, 2016. Publication Number MAN-0553-00 Copyright Copyright 2016, F5 Networks, Inc. All rights reserved. F5 Networks, Inc. (F5) believes the information it furnishes to be accurate and reliable. However, F5 assumes no responsibility for the use of this information, nor any infringement of patents or other rights of third parties which may result from its use. No license is granted by implication or otherwise under any patent, copyright, or other intellectual property right of F5 except as specifically described by applicable user licenses. F5 reserves the right to change specifications at any time without notice. Trademarks AAM, Access Policy Manager, Advanced Client Authentication, Advanced Firewall Manager, Advanced Routing, AFM, APM, Application Acceleration Manager, Application Security Manager, AskF5, ASM, BIG-IP, BIG-IP EDGE GATEWAY, BIG-IQ, Cloud Extender, Cloud Manager, CloudFucious, Clustered Multiprocessing, CMP, COHESION, Data Manager, DDoS Frontline, DDoS SWAT, Defense.Net, defense.net [DESIGN], DevCentral, DevCentral [DESIGN], DNS Express, DSC, DSI, Edge Client, Edge Gateway, Edge Mobile, Edge Mobility, Edge Portal, ELEVATE, EM, ENGAGE, Enterprise Manager, F5, F5 [DESIGN], F5 Agility, F5 Certified [DESIGN], F5 Networks, F5 SalesXchange [DESIGN], F5 Synthesis, f5 Synthesis, F5 Synthesis [DESIGN], F5 TechXchange [DESIGN], Fast Application Proxy, Fast Cache, FCINCO, Global Traffic Manager, GTM, GUARDIAN, iapps, IBR, icall, icontrol, ihealth, Intelligent Browser Referencing, Intelligent Compression, IPv6 Gateway, iquery, irules, irules OnDemand, isession, L7 Rate Shaping, LC, Link Controller, LineRate, LineRate Point, LineRate Precision, LineRate Systems [DESIGN], Local Traffic Manager, LROS, LTM, Message Security Manager, MobileSafe, MSM, OneConnect, Packet Velocity, PEM, Policy Enforcement Manager, Protocol Security Manager, PSM, Ready Defense, Real Traffic Policy Builder, SalesXchange, ScaleN, SDAS (except in Japan), SDC, Signalling Delivery Controller, Solutions for an application world, Software Designed Application Services, Silverline, SSL Acceleration, SSL Everywhere, StrongBox, SuperVIP, SYN Check, SYNTHESIS, TCP Express, TDR, TechXchange, TMOS, TotALL, TDR, TMOS, Traffic Management Operating System, Traffix, Traffix [DESIGN], Transparent Data Reduction, UNITY, VAULT, vcmp, VE F5 [DESIGN], Versafe, Versafe [DESIGN], VIPRION, Virtual Clustered Multiprocessing, WebSafe, and ZoneRunner, are trademarks or service marks of F5 Networks, Inc., in the U.S. and other countries, and may not be used without F5's express written consent. All other product and company names herein may be trademarks of their respective owners. Patents This product may be protected by one or more patents indicated at: https://f5.com/about-us/policies/ patents

Legal Notices Export Regulation Notice This product may include cryptographic software. Under the Export Administration Act, the United States government may consider it a criminal offense to export this product from the United States. 16

Index Index A about steps 5 Azure and deployment prerequisites 9 and initial connection 10 setting up SSH access 10 Azure availability sets 13 Azure Classic deploying BIG-IP VE 8 Azure config sync about 13 Azure instance types 6 Azure Resource Manager deploying BIG-IP VE 7 P port translation mapping 10 S SSH access for Azure 10 V VE hypervisors sample topology 5 B BIG-IP VE availability in Azure using config sync 14 BIG-IP VE deployment overview 5 BIG-IP VE deployment steps 5 BIG-IP VE virtual appliance configuring 10 C checklist 5 D deploying BIG-IP VE on Microsoft Azure 5 deployment prerequisites for Azure 9 I initial connection, Azure 10 instance deploying Azure Classic 8 deploying Azure Resource Manager 7 L log in deploying BIG-IP VE instance in Azure Classic 8 deploying BIG-IP VE instance in Azure Resource Manager 7 M Microsoft Azure and port translation 10 moving the user interface port 10 Microsoft Azure Resource Manager instance creating 7 17

Index 18