F5 Three-NIC BIG-IP VE in Alibaba Cloud

Version notice:
This content applies to BIG-IP VE 14.1.0.1 and later

The following diagram shows a basic three-NIC deployment of BIG-IP VE in an Alibaba Virtual Private Cloud (VPC).

Complete the tasks in this guide to create this deployment.

Note
Your IP addresses will not match the diagram exactly.

Image for post
Image for post

This deployment shows three subnets:

• An external, public subnet, where you’ll create a virtual server to accept Internet traffic.
• An internal, private subnet, where your application servers live.
• A management subnet, where you can access the BIG-IP Configuration utility; you use the Configuration utility to configure BIG-IP VE.

Traffic flows from clients through BIG-IP VE to application servers.

You create all IP addresses and network interfaces in Alibaba. Then in BIG-IP VE, you create corresponding objects for the same IP addresses, represented by the shaded boxes in the diagram.

Prepare

You must also edit security rules, which determine access to BIG-IP VE and related resources, and create or upload an SSH key pair, which you’ll use to connect to the BIG-IP VE instance.

Create a VPC and management subnet
Add an external and internal VSwitch to the VPC
Edit security rules for the VPC
Create or add an SSH key pair

Create a VPC and management subnet

1. In the Alibaba Console, from the left menu, click Virtual Private Cloud.

2. On the top toolbar, select the region you want.

3. Click Create VPC.

4. Complete the fields. For more information, see Manage a VPC.

FieldValueNameA descriptive name.IPv4 CIDR Block10.0.0.0/8VSwitch NameManagementZoneThe same zone you chose when you created the VPC.

5. Click OK.

6. On the success screen, click Complete.

The VPC is displayed in the list.

Add an external and internal VSwitch to the VPC

All subnets must be in the same zone, so before you proceed, ensure you know which zone you created the VPC’s first VSwitch in.

To create the external subnet:

1. In the list of VPCs, in the row for your VPC, in the Actions column, click Manage.

2. In the Network Resources area, click the number next to VSwitch.

3. Click Create VSwitch.

4. Complete the fields.

FieldValueVPCThe VPC you just created.NameExternalAvailability ZoneThe same zone you chose when you created the VPC.CIDR block10.0.1.0/24

5. Click OK.

To create the internal subnet:

1. Click Create VSwitch.

2. Complete the fields.

FieldValueVPCThe VPC you just created.NameInternalAvailability ZoneThe same zone you chose when you created the VPC.CIDR block10.0.2.0/24

3. Click OK.

You should now have three VSwitches: management, external, and internal.

Edit security rules for the VPC

To create a security group for the management subnet:

1. In the list of VPCs, in the row for your VPC, in the Actions column, click Manage.

2. In the Network Resources section, next to Security Group, click the 0.

3. In the top right, click Create Security Group.

4. Complete the fields.

FieldValueTemplateCustomizeSecurity Group NameA name you choose, for example, ManagementTraffic.Network TypeVPCVPCThe VPC you created earlier.

5. Click OK.

6. On the Notes dialog, click Create Rules Now.

7. In the top right, click Add Security Group Rule.

8. Complete the fields to allow SSH access to BIG-IP VE.

FieldValueRule DirectionIngressActionAllowProtocol TypeSSH (22)Port Range22/22Priority1Authorization TypeIPv4 CIDR BlockAuthorization ObjectsIP address or range on your network; these IP addresses can access the VPC.

9. Click OK.

10. Repeat steps 7–9 and complete the fields to allow access to the BIG-IP Configuration utility web interface:

FieldValueRule DirectionIngressActionAllowProtocol TypeHTTPS (443)Port Range443/443Priority1Authorization TypeIPv4 CIDR BlockAuthorization ObjectsIP address or range on your network; these IP addresses can access the VPC.

11. Click OK.

The rules are displayed in the list.

To create a security group for the external (virtual server) subnet:

1. In the left pane, click Virtual Private Cloud.

2. In the list of VPCs, in the row for your VPC, in the Actions column, click Manage.

3. In the Network Resources section, next to Security Group, click the 1.

4. In the top right, click Create Security Group.

5. Complete the fields.

FieldValueTemplateCustomizeSecurity Group NameA name you choose, for example, ExternalTraffic.Network TypeVPCVPCThe VPC you created earlier.

6. Click OK.

7. On the Notes dialog, click Create Rules Now.

8. In the top right, click Add Security Group Rule.

9. Complete the fields to allow internet access to the BIG-IP VE virtual server.

FieldValueRule DirectionIngressActionAllowProtocol TypeHTTPS (443) or HTTP (80), depending on your needs.Port Range443/443 or 80/80Priority1Authorization TypeIPv4 CIDR BlockAuthorization ObjectsIP address or range on your network; these IP addresses can access the VPC.

10. Click OK.

To create a security group for the internal subnet:

1. In the left pane, click Virtual Private Cloud.

2. In the list of VPCs, in the row for your VPC, in the Actions column, click Manage.

3. In the Network Resources section, next to Security Group, click the 1.

4. In the top right, click Create Security Group.

5. Complete the fields.

FieldValueTemplateCustomizeSecurity Group NameA name you choose, for example, InternalTraffic.Network TypeVPCVPCThe VPC you created earlier.

6. Click OK.

7. On the Notes dialog, click Create Rules Now.

8. In the top right, click Add Security Group Rule.

9. Complete the fields to allow internet access to the BIG-IP VE virtual server.

FieldValueRule DirectionIngressActionAllowProtocol TypeYour choice, depending on access needed for your application servers.Port RangeYour choice, depending on access needed for your application servers.Priority1Authorization TypeIPv4 CIDR BlockAuthorization ObjectsIP address or range on your network; these IP addresses can access the VPC.

10. Click OK.

Create or add an SSH key pair

1. In the Alibaba Console, from the left menu, click Elastic Compute Service.

2. On the left menu, under Networks and Security, click SSH Key Pair.

3. In the top right, click Create SSH Key Pair.

4. Type and name and either create or import a key pair.

5. Click OK.

The key pair name is displayed in the list. You will use this key later, to connect to the BIG-IP VE instance.

Deploy

Deploy a BIG-IP VE instance
Change the security group associated with the external ENI
Create an internal elastic network interface (ENI)
Create an Elastic IP address for the virtual server
Bind the EIP to the external ENI

Deploy a BIG-IP VE instance

1. In the Alibaba Console, from the left menu, click Elastic Compute Service.

2. On the left menu, click Instances.

3. In the top right, click Create Instance.

4. Complete the fields.

FieldValueBilling Methodo Subscription — You pay monthly for the instance.
o Pay-As-You-Go — You pay based on time. If you are going to choose a BIG-IP VE PAYG image, you should choose this method.
o Preemptible Instance is not supported.

For more information, see Billing method comparison.RegionSelect the zone where you created your VSwitches.Instance TypeChoose at least 2 vCPU and 4 GB memory. For each vCPU, add at least 2 GB of memory.
Also, ensure the instance type you choose has the number of available Elastic Network Interfaces (ENIs) you need. In this example, you need three.Image Click Marketplace Image and search for F5.
If you plan to use BYOL (Bring Your Own License), learn more about F5 licensing. You can get a trial license if you need one.
If you expect to upgrade BIG-IP VE in the future, choose an image with 2 boot locations. If you do not need room to upgrade (if you intend to create a new instance when a new version of BIG-IP VE is released), choose an image with 1 boot location.StorageAccept the default or change it.
For LTM, set the System Disk value to the minimum available size.

5. Click Next: Networking.

6. Complete the fields.

FieldValueNetworkThe VPC you created earlier and the Management VSwitch you created.Network Billing MethodSelect Assign public IP.
This IP address is for initial management access to BIG-IP VE and you can remove it later.
If you have a jump host on the same VSwitch then you do not need this IP address.Security Group Select the ManagementTraffic group.Elastic Network InterfaceEth0 is displayed by default.
Add an additional ENI for eth1 and associate it with the External VSwitch.
Note: This ENI is associated with the same security group as eth0. You will change this in a later task.

7. Click Next: System Configurations.

8. Complete the fields.

FieldValueKey Pair The key pair you created or imported earlier.
Important: A key pair is the only type of logon credentials you can use to connect to BIG-IP VE for the first time. The other settings (Inherit Password From Image, Password, and Set Later) do not work.Instance NameA name you choose.HostImportant: This setting has no effect on BIG-IP VE.

9. Click Next: Grouping.

10. Click Add Tag. You may want to add a tag key named Name and a tag value with the name of your instance.

11. Click Next: Preview.

12. Optional. If you chose Pay-As-You-Go for the billing method, choose the duration you want.

13. Select the check box to accept the terms of service and click Create Order.

14. On the page that shows billing, click Pay.

Return to the console and click Elastic Compute Service -> Instances. The instance is displayed in the list.

Wait approximately five minutes for the instance to be ready.

Change the security group associated with the external ENI

You must associate the second NIC with a security group meant for external traffic.

1. In the Alibaba Console, from the left menu, click Elastic Compute Service.

2. On the left menu, under Networks and Security, click ENI.

3. For the secondary NIC meant for external traffic, in the Actions column, click Modify.

4. For Security Group, select the ExternalTraffic group and remove the ManagementTraffic group.

5. Click OK.

The list refreshes.

Create an internal elastic network interface (ENI)

1. In the Alibaba Console, from the left menu, click Elastic Compute Service.

2. On the left menu, under Networks and Security, click ENI.

3. Click Create ENI.

4. Complete the fields.

FieldValueNetwork Interface NameInternalENIVPCYour VPC.VSwitchInternalPrimary Private IP10.0.2.200Security GroupInternalTraffic

The ENI is displayed in the list. Now attach it to the BIG-IP VE instance.

1. In the list, for your ENI, in the Actions column, click Bind to Instance.
2. Select the instance and click OK.

Note
You must now reboot the BIG-IP VE so that it can register the new NIC. To do this, in the Instances list, in the Actions column, click
More -> Instance Status -> Restart. For Restart Mode, click Restart and OK.

Create an Elastic IP address for the virtual server

In this task, you create the EIP. In the next task you will associate the EIP with the external elastic network interface (ENI).

1. In the Alibaba Console, from the left menu, click Virtual Private Cloud.

2. In the left menu, click Elastic IP Addresses.

3. Click Create EIP.

4. Select your region and other details and click Buy Now.

5. Agree to the terms of service and click Activate.

Return to the console.

Bind the EIP to the external ENI

Your virtual server address is the primary private IP address associated with the external ENI. The EIP is the public address of the virtual server.

1. Return to the list of elastic IP addresses and find the IP address you just created.

2. In the Actions column for the EIP, click Bind.

3. Complete the fields.

FieldValueInstance TypeSecondary ENIModeNat ModeSecondary ENIThe ID of your external ENI.

4. Click OK.

The EIP is now associated with the external ENI.

Configure

Set the admin password
License BIG-IP VE
Provision BIG-IP VE
Create internal and external VLANs
Create an internal self IP address
Create a pool and add members to it
Create a virtual server

Set the admin password for BIG-IP VE

This management interface may be accessible to the Internet, so ensure the password is secure.

1. Connect to BIG-IP VE.

o At the command prompt, navigate to the folder where you saved your ssh key and type: ssh -i <private_key_file.pem> admin@<bigip_public_ip_address>

o If you prefer, you can open PuTTy and in the Host Name (or IP address) field, enter the external IP address, for example:

Image for post
Image for post

In the Category pane on the left, click Connection -> SSH -> Auth.

In the Private key file for authentication field, choose your .ppk file.

Image for post
Image for post

Click Open.

If a host key warning appears, click OK.

The terminal screen displays: login as:.

Type admin and press Enter.

2. To change to the tmsh prompt, type:

tmsh

3. Modify the admin password:

modify auth password admin

The terminal screen displays the message:

changing password for admin
new password:

4. Type the new password and press Enter.

The terminal screen displays the message:

confirm password

5. Re-type the new password and press Enter.

6. Ensure that the system retains the password change and press Enter.

save sys config

The terminal screen displays the message:

Saving Ethernet mapping...done

License BIG-IP VE

1. Open a web browser and log in to the BIG-IP Configuration utility by using https with the external IP address, for example: https://<external-ip-address>. The username is adminand the password is the one you set previously.

2. On the Setup Utility Welcome page, click Next.

3. On the General Properties page, click Activate.

4. In the Base Registration key field, enter the case-sensitive registration key from F5.

For Activation Method, if you have a production or Eval license, choose Automatic and click Next.

• If you chose Manual, complete these steps:

In the Step 1: Dossier field, copy all of the text and then click Click here to access F5 Licensing Server.

Image for post
Image for post

A separate web page opens.

• On the new page, click Activate License.

• In the Enter your dossier field, paste the text and click Next.

Image for post
Image for post

• Accept the agreement and click Next.

• On the Activate F5 Product page, copy the license text in the box. Now go back to the BIG-IP Configuration utility and paste the text into the Step 3: License field.

Image for post
Image for post

• Click Next.

The BIG-IP VE system registers the license and logs you out. When the configuration change is successful, click Continue to provision BIG-IP VE.

Provision BIG-IP VE

1. Open a web browser and log in to the BIG-IP Configuration utility.

2. On the Resource Provisioning screen, change settings if necessary and click Next.

3. On the Device Certificates screen, click Next.

4. On the Platform screen, in the Admin Account field, re-enter the password for the admin account and click Next.

Image for post
Image for post

BIG-IP VE logs you out.

5. When you log back in, on the Setup Utility -> Network screen, in the Advanced Network Configuration area, click Finished.

Image for post
Image for post

Create internal and external VLANs

1. In the BIG-IP VE Configuration utility, on the Setup Utility Network page, under Advanced Network Configuration, click Finished.

2. On the Main tab, click Network -> VLANs.

3. Click Create and populate the appropriate fields for the external VLAN.

FieldValueNameexternalInterface1.1TaggingUntagged

4. In the Resources section, click Add.

5. Click Finished.

6. Now click Create again and populate the appropriate fields for the internal VLAN.

FieldValueNameinternalInterface1.2TaggingUntagged

7. In the Resources section, click Add.

8. Click Finished.

The screen refreshes, and the two new VLANs are in the list.

Create internal and external self IP addresses

Then in BIG-IP VE, create an internal self IP address.

1. In the BIG-IP VE Configuration utility, on the Main tab, click Network -> Self IPs.

2. Click Create and complete the fields for the external self IP address.

FieldValueNameExternalSelfIPIP Address10.0.1.200Netmask255.255.255.0VLAN/TunnelexternalPort LockdownAllow All

3. Click Repeat and populate the appropriate fields for the internal self IP address.

FieldValueNameInternalSelfIPIP Address10.0.2.200Netmask255.255.255.0VLAN/TunnelinternalPort LockdownAllow All

4. Click Finished.

The screen refreshes, and the two new self IP addresses are in the list.

Create a pool and add members to it

1. Open a web browser and go to the BIG-IP Configuration utility.

2. On the Main tab, click Local Traffic -> Pools.

3. Click Create.

4. In the Name field, type web_pool. Names must begin with a letter, be fewer than 63 characters, and can contain only letters, numbers, and the underscore (_) character.

5. For Health Monitors, move https from the Available to the Active list.

6. Choose the load balancing method or retain the default setting.

7. In the New Members section, in the Address field, type the IP address of the application server.

8. In the Service Port field, type a service port, for example, 443.

9. Click Add.

The list now contains the member.

10. Add additional pool members as needed and click Finished.

Create a virtual server

1. In the BIG-IP Configuration utility, on the Main tab, click Local Traffic -> Virtual Servers.

2. Click Create and populate the following fields.

FieldValueNameA unique name.Destination Address/MaskA wildcard (0.0.0.0) or the private IP address on the external network.Service Port443HTTP ProfilehttpSSL Profile (Client)clientsslSSL Profile (Server)serversslSource Address TranslationAuto MapDefault Poolweb_pool

Note: These settings are for demonstration only. For details about securing a web application with SSL, see the product documentation at askf5.com.

3. Click Finished.

Traffic to the BIG-IP VE external IP address will now go to the pool members. To test in a browser, type: https://<elastic-IP-address>.

Troubleshooting

Virtual servers

You cannot currently create more than one virtual server in Alibaba Cloud. You can use a wildcard virtual server (0.0.0.0) or the external private IP address.

Elastic Network Interfaces and security groups

If you have trouble connecting to your application server, check the security groups associated with each ENI.

Zones

Instance types

The instance type must also be I/O optimized.

See Also
BIG-IP VE in Alibaba Cloud

Reference:https://www.alibabacloud.com/blog/f5-three-nic-big-ip-ve-in-alibaba-cloud_594486?spm=a2c41.12584248.0.0

Written by

Follow me to keep abreast with the latest technology news, industry insights, and developer trends.

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store