Learning ADC and Big-IP Basics

0:00<v Instructor>All right, we're gonna start off</v>

0:02by talking about proxies for a couple of minutes.

0:05Now, if you're not familiar with a proxy,

0:07think of it like this.

0:08See, you got this big office building in here,

0:11and you're down here,

0:12and you're gonna walk into the office building,

0:14because you want to visit somebody up here

0:17on the third floor, eighth floor, whatever it is.

0:21So you go in,

0:22and you run into a receptionist desk

0:25where you've got a receptionist who's sitting here,

0:28and the receptionist welcomes you

0:30and goes ahead and signs you in, checks your credentials,

0:33gives you a visitor's badge,

0:34and then you're allowed to go on up

0:37and visit your acquaintance up here.

0:40Well, think of the receptionist here as a proxy.

0:45A proxy is a go-between,

0:48so when we're talking about networking and network services,

0:52if you're over here on your laptop,

0:54and you're trying to access this network over here,

0:57well, oftentimes you may need to go through

0:59some sort of proxy in order to get to that network.

1:03And proxies provide us lots of different services,

1:06and we're gonna talk about those as we go on.

1:08So this is the general idea of a proxy.

1:11Now, there's two primary types of proxies

1:14when it comes to web proxies,

1:16and the first one is a forward proxy.

1:19And this is when you have a user over here,

1:23who's out there browsing the web,

1:25and when they're doing so,

1:27they're actually sending their data out

1:29through a forwarding proxy.

1:31This is a proxy that's gonna forward your data for you

1:34out to your final destination.

1:37And your final destination

1:38could be this server out through the internet,

1:41so maybe you're going over to this web server.

1:44But the idea is you're forwarding your data through a proxy,

1:47and this proxy could be on your local network,

1:49or it could be a proxy in the cloud as well,

1:52doesn't matter, either way.

1:55But that proxy's gonna provide some services for your data

1:58that's headed to its final destination over here.

2:02Now, generally when we use this,

2:03it's for web filtering purposes,

2:06and that is a security service that we provide to our users

2:09so that we can make sure they're visiting safe websites.

2:12So what would happen with this proxy over here

2:14is when you go to it,

2:16it's going to check your URL

2:18and figure out where you're going.

2:21And then it's gonna check this URL

2:23against a list of known malicious websites,

2:25and it's gonna prevent you from going to malicious websites,

2:28or it could also have categories of web content,

2:32such as gambling, sports,

2:36and other non-business related web content.

2:40And maybe certain categories

2:41are blocked by your organization,

2:43so you can't go out there and waste time on the web.

2:46But, either way, this is an example of forward proxy.

2:49And oftentimes this is used

2:52with web security filtering services.

2:55And I want you to think of a forward proxy over here

2:57as a proxy that is providing services to the local user.

3:04And that local user is our local computer over here

3:07where we were out browsing the web, okay?

3:10So that's providing services to a local user.

3:13Now we're gonna take a look at a reverse proxy,

3:16that's what's next here.

3:17And a reverse proxy provides services

3:20to the destination,

3:23if you're thinking of it as a source over here

3:26and a destination over here.

3:28So we had our forward proxy providing services

3:32to our local user,

3:34and our reverse proxy providing services

3:36to our destination, okay?

3:39So let's talk about some of these services

3:40that happen at the destination.

3:42So obviously here, if this is your user

3:45who may be using a forward proxy, or may not,

3:48as their information gets over here

3:51to their destination,

3:52they hit our BIG-IP,

3:55and it's acting as a reverse proxy.

3:57And what it's doing is,

3:58it's providing services to that data

4:01as it goes through our BIG-IP.

4:04Now, those services, there could be many.

4:06One could be load balancing,

4:08so maybe it sends traffic

4:09to one of our pool members in our virtual server,

4:13and that would be a simple load balancing service.

4:16And that would be a service that a reverse proxy provides,

4:19but it can provide many other services as well,

4:22such as authentication, security checks,

4:27and traffic manipulation.

4:29Of course, as well as load balancing

4:30and many other services as well.

4:32And, guess what?

4:33The BIG-IP over here,

4:35can actually run services as both a forward proxy

4:39and a reverse proxy.

4:42Pretty interesting.

4:43So now that we've got proxies under our belt,

4:45we're 100% set on a forward proxy and a reverse proxy,

4:49let's go ahead and in the next note,

4:51we're gonna start talking

4:52about application delivery controllers

4:55and some of their features.

0:00<v Instructor>All right, so we're starting off talking</v>

0:02about Application Delivery Controllers or ADCs.

0:05Now what is an ADC?

0:07Well, let's dissect this here.

0:09Well, it is an application focused appliance or service,

0:14and what it does is it delivers data to it,

0:17and it controls that data.

0:20So in the last nugget we talked about forward

0:22and reverse proxies, and we saw that in a reverse proxy

0:25when I had a user over here

0:27was sending data to a destination

0:29that reverse proxy over here, which was our BIG-IP,

0:32can manipulate traffic and it can control that traffic

0:36and then deliver it to a destination

0:38or a series of destinations,

0:40maybe if it's doing load balancing,

0:43which is very commonly performed with the BIG-IP.

0:47This is application delivery controller in it's finest.

0:51So basically it is an appliance that provides services.

0:55It allows you to manipulate traffic as it flows through it.

0:59So it's going to provide us with, again, lots of services.

1:02Let's talk about some of those services.

1:04Well, some of those services are content redirection,

1:07just like we saw here with our load balancing services,

1:11it's redirecting that web traffic

1:13to a final destination down here,

1:16but it can also forward to other destinations.

1:19Maybe all of these hosts are down and not functioning.

1:23So when users come,

1:24do we just give 'em a 404 error message

1:27saying we can't reach the site,

1:28or do we redirect them to another site,

1:31maybe a website saying,

1:33"Hey, we're having technical difficulties,

1:35please check back later."

1:36You know, something like that, content redirection.

1:39We can also use server health monitoring.

1:43So in our example with load balancing,

1:45let me see if I can remove some of these scribbles here.

1:48There we go, we got our servers back.

1:51So how does the BIG-IP know

1:54if these three pool members down here are alive or not?

1:59Well, that's a good question.

2:00And the answer is server health monitoring.

2:03We can set up different types of health monitors,

2:05where the BIG-IP will monitor these hosts down here

2:08and see if they're up or down,

2:10if their services are running,

2:11if the web content is correct on it.

2:13It can do all those things through server health monitoring.

2:16It can provide network address translation or NAT services,

2:20so that as data flows through the BIG-IP device here,

2:24well, we can actually change the IP addresses

2:28as they're going through the device

2:29and provide NAT-ing services.

2:31Next up, SSL offloading.

2:34Now, if our servers down here are running HTTPS

2:37and have certificates and such, well guess what?

2:40Every time a session is established,

2:42they're gonna be performing some encryption services

2:45and that takes up resources.

2:47Wouldn't it be great

2:47if we could move the encryption services

2:51to the BIG-IP up here and let it handle it,

2:54so that as the data moves down here

2:56to the members that are answering those calls for service,

3:01they don't have to worry about encryption.

3:03So that takes away that job from them,

3:06so it, they're not using resources

3:09to perform that functionality, SSL offloading.

3:12We can perform IP traffic optimization,

3:16which helps ensure that our network traffic

3:18is taking the optimal path

3:21and is getting there as efficiently as possible.

3:25And lastly,

3:26I'm gonna put up here, Web Application Firewall or WAF.

3:30And a Web Application Firewall is a firewall in the sense

3:33that it can block traffic,

3:35but it's not worried so much about IP addresses

3:38and port numbers, it doesn't work at layers three and four.

3:42What it's doing, it's working at Layer 7.

3:45It's looking for web protocols, things like HTTP GET

3:50and HTTP PUT and different HTTP commands,

3:54the protocols being used.

3:56It can actually form rules around these types

4:00of commands in order to protect our web applications

4:04and prevent common attacks.

4:06So those are many of the services that an ADC

4:09or application delivery controller provide.

4:11And of course, our BIG-IP

4:12is an application delivery controller.

4:15So in the next nugget, we're going to move on

4:18to the BIG-IP itself

4:20and look at some of its modularized software

4:24because it actually has modules that we can enable in it.

4:28It's not just one big box with everything turned on,

4:30we have lots of tools within our appliance

4:34that we can turn on if we want to use them,

4:37or we can leave them turned off`,

4:38so they're not using up resources.

4:41So I will see you there shortly.

0:00<v ->In the last nugget, we stated</v>

0:02that the Big-IP was an application delivery controller,

0:06and absolutely it surely is.

0:08Now, when it comes to our Big-IP,

0:11let's talk about a couple of things.

0:13Number one, it comes in hardware and virtual appliances.

0:19So you can go out and buy a hardware appliance

0:21and put it in your rack

0:21or put it in a rack at the data center.

0:23Or you can run virtual instances or VEs,

0:27or virtual editions, of the Big-IP in your environment,

0:31which is what we've done in our lab setup.

0:33Now the thing is, we've talked about several of the services

0:35that the application delivery controllers provide,

0:38like SSL offloading, natting, server health monitoring,

0:41traffic optimization, WAF, our web application firewall,

0:44lots of those things.

0:46Well, yes, those are within our Big-IP.

0:50Now, the way this works though is generally,

0:53we're starting off with our local traffic manager, or LTM,

0:57and then we add on various other services through modules

1:02that we can enable within the Big-IP.

1:05And that leads us to our next point that the Big-IP

1:09runs modularized software,

1:12which simply means it runs software as various modules.

1:15So let's talk about some of these modules real quick.

1:17We're gonna list these out.

1:19We have our local traffic manager,

1:21or LTM, and that's what we've been working in so far

1:25where we manage our local traffic.

1:26We have Big-IP DNS.

1:29And as you can imagine, that deals with DNS

1:32and improving DNS functionality

1:34and protecting against DNS attacks.

1:36Then we have our application security module,

1:40or ASM.

1:42And the application security module

1:44runs a web application firewall that allows us

1:47to create firewall rules based on the web application

1:52and the HTTP commands being used.

1:56Next up is our access policy manager,

2:00or APM,

2:01and that manages access to our applications.

2:04It's kind of a centralized identity

2:06and access control service

2:08for accessing our applications on-premise and in the cloud.

2:12And then lastly, we have advanced firewall manager, or AFM.

2:17And this provides more of a traditional

2:20network-based firewall protection,

2:22does protection against denial of service and DDoS attacks.

2:26It provides reporting for our security events,

2:30and it uses threat intelligence. It's pretty cool.

2:32So think of that as your standardized firewall.

2:36Now let's go ahead and jump into each of these individually

2:39and talk a little bit more about them,

2:41starting with our local traffic manager.

2:44And of course we're gonna associate this

2:46with load balancing services, our NAT services,

2:51SSL offloading, traffic optimization,

2:54and lastly, SYN flood protection.

2:59And we are already running our local traffic manager module.

3:02That's what we started off with in our image.

3:05And it provides us all of these various services,

3:08which is pretty handy.

3:10We also have our Big-IP DNS,

3:12and this is previously known as GTM.

3:15Now the thing with this, what it does,

3:17is it improves DNS performance,

3:20protects against DDoS attacks,

3:24and it protects against DNS attacks,

3:27and it provides some advanced traffic routing.

3:29So we're gonna talk about that.

3:31It's pretty interesting.

3:32So our advanced traffic routing.

3:34So when we're routing traffic,

3:36we're trying to alter its destination,

3:39and we're trying to send it somewhere in particular.

3:41We can actually base that, if we're using Big-IP DNS module,

3:45we can base that on a few things

3:47like the location of the user,

3:50the application that's being used,

3:53which is pretty interesting,

3:55so we can make decisions based on that.

3:57And it also provides us

3:58with a global server

4:02load balancing service,

4:04and that's known as GSLB,

4:08which provides us a type of control

4:11over our global network traffic.

4:14So we're not only load balancing

4:16and controlling traffic within

4:17our local area network or local network,

4:20we're doing it for all of our services around the world.

4:23So that's our Big-IP DNS.

4:26Next is our application security module, or ASM.

4:29And of course this is our web application firewall,

4:34or WAF.

4:36And the thing about this WAF here,

4:38it is actually PCI compliant,

4:41which is handy if you're dealing

4:42with PCI regulatory concerns.

4:45So this of course protects against

4:47many different types of web attacks,

4:49and it actually allows us to do some dynamic

4:52application security testing of our own application.

4:56So if I'm running my Big-IP here,

4:59and I have my member servers down here

5:01in a pool or something,

5:03what I can do is run

5:04security testing against the applications running on these,

5:07looking for known vulnerabilities

5:09so that I can identify them quickly and get them patched.

5:12That's right, get them fixed.

5:13So that is a pretty cool tool,

5:16that dynamic application security testing.

5:19It also provides API protection,

5:21so if you're using APIs as part of your services.

5:27And lastly, DDoS protection,

5:29or distributed denial of service protection,

5:33all of those things are provided

5:34by our application security module.

5:37All right, next up is our application policy manager.

5:40Now our application policy manager, what it does,

5:42it's centralized identity and access control.

5:46So think of it as your centralized identity system

5:49that you're gonna use to provide access control services

5:52to all of your applications.

5:54It doesn't matter if those applications are on-premise

5:58or out there in the cloud somewhere.

6:01Either way, you're gonna be able

6:02to provide your centralized identity

6:05and access through the APM.

6:07So this means that if you're running the APM,

6:10you got your Big-IP down here,

6:13that all your users out there,

6:15when they're trying to access your applications,

6:16you're gonna point them to the Big-IP

6:19for the centralized identity services.

6:21And once they're authenticated, they'll be then redirected

6:25to wherever those services are.

6:27And it's much easier to centralize all

6:29of your identity management

6:31as opposed to having it be distributed.

6:34And when it's doing this,

6:35it's providing some advanced authentication services.

6:39So we'll say advanced auth services is what it's using

6:45and providing us with

6:46so some examples of that

6:48is it's gonna allow us to use

6:51federations between different authentication services.

6:55It supports LDAP, our lightweight directory access protocol.

7:00It supports active directory,

7:03which is your Windows authentication.

7:05It also supports RADIUS,

7:07RSA secure ID,

7:10and open

7:12API.

7:14All of these different types

7:15of authentications are supported.

7:17And the other thing is it provides,

7:19this is really cool,

7:21SSL VPN remote access.

7:24So that's what our APM provides us with,

7:26all of those services.

7:29All right, the last one here, our Advanced Firewall Manager.

7:33Now this provides a proxy firewall service.

7:36So this is basically a traditional firewall service

7:40provided by the Big-IP.

7:42And here, we're focusing on layers

7:46two through four.

7:47So here, we can filter based on MAC address, IP address,

7:51port number, all of these things.

7:55So the way this works is when someone is over here trying

7:57to connect to our servers back here,

8:00we got that, we got our Big-IP here.

8:03Well, that user connects,

8:04the Big-IP terminates that session,

8:07then it does an inspection on that incoming traffic,

8:12and it compares it to the firewall rules

8:14that have been configured and decides on what to do with it.

8:17Does it drop the traffic or does it go ahead

8:19and forward it on to one of the members' servers

8:23based on what services are running?

8:24So that's our AFM,

8:27our advanced firewall manager

8:31and how it provides traditional firewall services,

8:34but it provides some additional services as well,

8:37such as SSL inspection,

8:41which means if your servers back here are running SSL

8:46and performing the encryption themselves,

8:48and you've got an encrypted session that's going

8:51between these two devices,

8:53the Big-IP can actually intercept this, decrypt it,

8:58and inspect the data inside that encrypted data

9:01to provide extra security.

9:03It also provides DDoS protection,

9:06which we've seen several of the

9:09modules provide DDoS protection.

9:11So we should be pretty protected at this point.

9:15And then again, it also provides two more things.

9:18Intrusion prevention services,

9:22which is known as IPS.

9:24And that's where it's looking at data that's coming through,

9:27it's providing this inspection,

9:28and it's looking for malicious data,

9:31and it looks for actual what are called signatures,

9:33or they're kind of fingerprint of a data.

9:35And it will then drop those, of course, so that they cannot

9:39be successful as trying to attack our environment.

9:42So that's our IPS.

9:44And the last thing it does is it provides reporting

9:48on our security related events.

9:50And that's very important

9:51so we can have some information about what's going on.

9:54Now the thing is, when we have these modules,

9:56I said you can turn them on,

9:57you can turn them off.

9:59Well, we do that through

10:00our module resource allocation settings.

10:03And the thing I want you to understand,

10:05there are four options when we go in.

10:07We're gonna go in and do this.

10:08You're gonna see this here in the next nugget.

10:11So what you're gonna have is four options.

10:13You got number one,

10:14it's going to be non or disabled,

10:17and that means you're not running

10:18the service or that module, okay?

10:21And number two, and I want you to understand

10:24this is when we go into the

10:25module resource allocation page,

10:27you're gonna see a big old list of all different modules.

10:31And there's more than what we just talked about.

10:33There are several modules,

10:34but the ones we talked about are the primary ones.

10:37And then you're gonna have options

10:38over here is what to do with them.

10:39Do you wanna turn them on?

10:40Do you wanna turn them off?

10:41What are your options?

10:42And your first option is basically disabled,

10:45not running.

10:45Your second option is dedicated,

10:48and that's where you're dedicating all the resources

10:51of your Big-IP to this one module.

10:55So at this point, you can only run a single module,

11:00and it gets all those resources.

11:03So that means you can't run more than one module.

11:04So if you're wanting to run multiple modules,

11:07it's really not an option.

11:08Number three, we have nominal,

11:12and this is when you fire up this module,

11:14and you can run multiple modules this way,

11:16when you fire up that module,

11:18it gets a little bit of resources.

11:22And then once it's completely up

11:24and running and stabilized,

11:26you're going to get additional resources

11:28so that it can run properly.

11:30And then lastly, number four is minimal.

11:33And that's when you turn on the module,

11:36it gets little resources,

11:38and once it comes up, and it's fully stabilized,

11:40it continues to get little resources

11:43because we're not gonna provide additional resources.

11:46And really, if you're gonna use something like this,

11:48I'm thinking you're gonna want to use that module

11:51for its reporting services or something.

11:53Something like a firewall module,

11:55you wouldn't want to run in minimal

11:57because if you're restricting its resources,

11:59it's gonna slow everything down going through it.

12:02But if you're just running a module

12:03for something like reporting,

12:05well then you can just run reports as needed,

12:07and it doesn't need a whole lot of resources.

12:10So those are your four options

12:13with your module resource allocation.

12:15And as I said in the next nugget,

12:16we're gonna go and take a look at how to enable a module.

12:20So I will see you there shortly.

0:00<v ->Alright, here we are on our big IP</v>

0:02and it's time to take a look at our module

0:04resource provisioning,

0:05'cause we had talked about our different modules

0:08and how we can go in and turn them on.

0:09And we have different options there.

0:11So how are we gonna do this?

0:12Well, here's how we're gonna do it.

0:14We are gonna go here, we're gonna go down to our system.

0:17We're gonna click on system,

0:18and then we're gonna go to resource provisioning,

0:21which is right here.

0:23And I'm gonna go ahead and click on that.

0:24It's gonna load up our resource provisioning page.

0:27And this is it here.

0:28So if we look at the top,

0:30what we have is current resource allocation,

0:33up here we've got CPU, disk and memory.

0:35We can see that some of this is being used for management.

0:38Other for TMM,

0:41which is the Traffic Management micro kernel.

0:44So part of the operating system there we see running.

0:47Then, down here, if we take a look with this yellow square,

0:51we have local traffic manager.

0:54And we can see up here at the top, when we look at our CPU,

0:57there's a little bit of yellow up

0:58here in the top right hand corner.

0:59That's because that's the amount of resources being used

1:02by our local traffic manager.

1:05So that's our LTM.

1:06So, if we go down here, we saw some

1:08of the other modules we talked about.

1:10There's our application security module,

1:14there's our global traffic, it's our DNS.

1:17We have our access policy module here,

1:21and there's our advanced firewall down here.

1:24And as we can see, there are other modules as well.

1:27So if I wanted to turn one of these on, let's say I wanted

1:29to turn on my application security module,

1:32what I would do is come over here and click right there.

1:35Because if I unclick, it's none, meaning it's not running.

1:38So I would click in there and I have three options.

1:40Dedicated, nominal, and minimal.

1:42Let's talk about these.

1:43Remember, dedicated means that you can only run one module

1:48and all those resources are gonna be dedicated to

1:50that one module.

1:52Ah, well, if I was to do this, it would mean that I'd have

1:56to turn off my LTM module, so I wouldn't wanna do that.

1:59Then I have nominal, remember,

2:00that's when you first turn on the module,

2:02it has a little bit of resources, then it gets up

2:04and running, and once it stabilizes,

2:06then it's gonna gain additional resources that it needs

2:09to run nominally.

2:11Then we have minimum, and that is when it's first turned on,

2:14it gets a little bit of resources

2:15and that's all it gets for all of its eternity.

2:19Just a little bit of resources,

2:20the minimum amount necessary.

2:22So again, if you're trying to push firewall rules,

2:24if you wanna use firewalls, you're probably not gonna want

2:26minimum because it's gonna slow things down as far

2:30as traffic movement through those firewall services.

2:32So those are your options.

2:34And you see, as soon as I clicked on that,

2:36my ASM now shows up under my memory down here.

2:39I've got my management, my TMM, my LTM, and now the ASM.

2:44But if I turn that off, there it goes.

2:47It's set to unallocated and it didn't actually turn it on.

2:50I'd have to click there, select something like nominal,

2:52and go to the bottom and submit.

2:54And then it would go ahead and load that module in there.

2:58But here, it's just showing you what it would use.

3:01And there you go.

3:02So I'm gonna go ahead and uncheck that,

3:04'cause I don't wanna run it right now.

3:06All right, so that is using our resource provisioning when

3:09working with modules in the big IP device.

0:01<v Instructor>And now it's time to look at the components</v>

0:03or the inner working and system architecture of our BIG-IP.

0:08What is under the hood, folks?

0:11Well, I'll tell you what's under the hood. Lots of goodies.

0:13So let's start off with down here at the bottom.

0:16We have Kickstart.

0:18Now Kickstart is a Linux OS that's running down here,

0:23or really stripped down some basic Linux structure

0:28to give us a foundation

0:29that will get the box up and running from being turned off,

0:34and it will allow it to then boot up and load the TMOS

0:39or the Traffic Management Operating System.

0:43And the TMOS is the BIG-IP OS, all right.

0:47This is what gives it all of its wonderful functionality.

0:50And of course, we know that it uses modular functionality.

0:55So up here, we have a bunch of modules.

0:57We have our LTM module, for example.

1:00We've got the DNS module.

1:02We've got our Application Security Module, our ASM,

1:06our Application Policy Module,

1:10our Application Firewall Module.

1:12We've got the modules, and then there's others as well.

1:16So those are the modules.

1:18After that, we have something called iRules

1:22and we're gonna get more in depth into these,

1:24but iRules allow us to create rules

1:26for managing traffic flow.

1:28Then we have up here our full proxy.

1:31And so that's all of our proxy services,

1:33our inspection of the data

1:35so we can figure out what we're gonna do with it.

1:37And then lastly, we have hardware chips

1:39for high performance.

1:41And those are used for things like SSL offloading

1:44and compression services.

1:47So that is what's under the hood.

1:50So if you ever wondered what makes it get up and running

1:53and how's it laid out, and here you go.

1:55This is the system architecture of the BIG-IP.

0:00<v Instructor>All right, now it's time to talk</v>

0:02about the default settings

0:04and management access of the Big-IP device.

0:07We're starting with some defaults.

0:08So when you first get that device,

0:10whether it's a hardware device

0:12or a virtual edition software version of it,

0:16what are some of the defaults that we need to be aware of?

0:19Well, let's start off with default IP addresses.

0:22So if you're using a hardware appliance,

0:24the default IP address is 192.168.1.245.

0:33Okay, there you go, 245.

0:36Now if you're using a virtual appliance, guess what?

0:39It's set to DHCP, which means it's gonna go out

0:44and grab an IP address from your DHCP server.

0:46So those are very different.

0:49All right, what about some administrative credentials?

0:53So we've got HTTPS logins, so the web GUI,

0:56and we've also got SSH logins.

0:59So let's talk about this.

1:00What are login credentials for each of these?

1:02Well, when it comes to HTTPS here,

1:05the default is admin as the username

1:08and admin as the password.

1:11There you go.

1:12But when it comes to SSH logins,

1:14when you're at your command line

1:16and when you're in your virtual environment,

1:18if you're running a lab like we are,

1:21well then we know that when we go to the terminal,

1:25so I'm gonna put down here terminal

1:26because it also applies with that terminal,

1:30and we had to use different credentials

1:31and it was root as username

1:34and the password is default just like that.

1:37And then, of course, the first time you log in,

1:39you're gonna be forced to change that password.

1:42So now let's talk about what type of access we have

1:46to our new device.

1:48So when it comes to management access,

1:50we're talking about here, we can actually do this

1:53from the internal and external interfaces.

1:59And our external VLAN is set to none.

2:04Now let's talk about some management of the Big-IP.

2:08So when we're talking about management methods

2:11for the Big-IP, we really are dealing with a GUI.

2:16That's our graphical user interface.

2:18And that's done via HTTPS into the device.

2:22But we also have command line interface, that's our CLI,

2:26which is our SSH

2:28or terminal if we're working

2:31in our VMware environment access.

2:33So that means that we have a command line access

2:36into this device for management.

2:38And there's two different types when we're using it.

2:40One is advanced,

2:43and that's where we're accessing the underlying Linux

2:46to verify configurations.

2:48Okay, and the second one is called the TMSH

2:51or Traffic Management Shell.

2:54And this is a CLI where we change Big-IP configs.

2:59So you'll see they're very different.

3:01If you're wanting to check or verify Linux configs

3:04for the underlying OS,

3:06you want the advanced terminal or advanced shell

3:09But if you're wanting to configure Big-IP features

3:12from the command line,

3:14then you're using your Traffic Management Shell.

3:17And lastly, there is one more and it's called iApps.

3:21And you access this through the GUI,

3:24through our web interface.

3:25And this allows for more of an automated type

3:28of service deployment using templates.

3:32So you can create templates

3:34and then use those to deploy configurations.

3:36Just makes it much quicker.

3:39So those are the Big-IP default settings

3:42and our management access options.

0:00<v Instructor>All right, let's go ahead</v>

0:01and take a look at how we can access

0:03the administrator access within the F5 BIG-IP.

0:06Well, the first way we can do this

0:08is to go to the management interface

0:10or the internal or external interface of a new device

0:13and basically log in with your credentials.

0:15Now, of course, they default this admin admin,

0:17but we've already set this one up

0:19so I'm gonna put in the correct credentials.

0:22All right, here we go.

0:23And so of course,

0:24this is how we access the administrator GUI

0:27through the web portal.

0:30All right, that's pretty straightforward, right?

0:32However, I really wanna take a look

0:35at the command line access here.

0:37So what we're going to do is go over here to Systems,

0:43and I wanna go down to Users.

0:45Let's scroll down here to Users.

0:48I'm gonna go to User List.

0:50It's gonna bring up our user list,

0:51and right now there's just an admin account.

0:53So if I click on the Admin, the option is,

0:57by default, this is set to Disabled.

0:59And what I'm looking at is the Terminal Access down here.

1:02It's set to Disabled by default,

1:03but you have an option for Advanced Shell or TMSH.

1:08And they both provide the same level of access.

1:12If you turn on Advanced Shell for the admin account,

1:15they automatically have access to TMSH as well

1:18and vice versa.

1:19So not a big deal there.

1:21So we do need to turn this on.

1:22So I'm just gonna say Advanced Shell for now.

1:25I'm gonna say Update.

1:26There we go.

1:28I'm going to drag a window in here, this is a terminal.

1:31And let's clear the screen here.

1:34Let's go ahead and hit the up arrow.

1:35I want to, there we go,

1:37ssh to root@192.168.121.11

1:41That's our management interface.

1:42So if I do that, then put in my credentials,

1:48then hit Enter, there we go,

1:51I am at basically a standard config

1:54or a Linux config command prompt.

1:57And that pound sign means that I'm root,

1:59which, actually, that's what I logged in as as root.

2:02So I am root.

2:04There we go.

2:04So I could run a command like ifconfig

2:06and it's gonna show me IP address information

2:09for the device.

2:11But if I wanted to go

2:12into the traffic management shell, the TMSH,

2:15then I would type tmsh and go ahead and hit Enter.

2:19And there we go.

2:21Now that we see tmos and the pound sign,

2:24that is an indicator that I am now in the TMOS,

2:28the traffic management operating system shell.

2:31All right, so that's how you switch back and forth.

2:33Now, if you want to exit this,

2:35you have to type the command quit.

2:37You can't type exit, it doesn't work

2:39'cause we're within a different shell.

2:41So if I do quit, there we go,

2:43and I'm back down to my Linux shell.

2:45So here, if I wanna quit, I just type exit.

2:48There we go.

2:49Super, and it closed my connection.

2:50So I'm gonna clear the screen here.

2:52I'm gonna move this out of the way.

2:54And we're gonna look at creating a new account.

2:55So let's go back to my user list.

2:59And over here on the right, I'm gonna click Create.

3:00I'm gonna create a new account

3:02and the new account is for Bob.

3:04There we go.

3:05Let me grab a password here.

3:09I'm gonna put in a password.

3:12There we go, there we go.

3:13Now, the role.

3:15All the roles here,

3:16you'll see have the same options for terminal access,

3:21whether it's guest operator, application editor,

3:23any of these except for the administrator.

3:25So if I make Bob an administrator,

3:27and for the partition, I leave it all and I click Add,

3:31and now Bob is the administrator for all partitions on here.

3:35I can go down here and I see my Advanced Shell and my TMSH

3:38just like we saw with the other admin account.

3:40However, I'm gonna get rid of this.

3:42I'm gonna highlight it and delete it.

3:44I'm gonna change that role to, let's just say operator.

3:47For all partitions,

3:48there's a common partition and that's by default,

3:50when you set up the BIG-IP, it creates one partition,

3:53and everything goes on there.

3:54So all your application objects and everything

3:55is just relying or residing on that,

3:59it's just residing on that one partition.

4:00So we're just gonna stick with the common or just say all.

4:03There we go.

4:04Add, there we go, perfect.

4:06Now, you'll see my terminal access options.

4:08I only have TMSH

4:09just because only administrator accounts

4:11can get that advanced shell access.

4:13So if I set this to TMSH for Bob

4:16and I go ahead and say Finished,

4:18and it's creating that user account, there we go.

4:20So now I'm gonna bring this back up

4:23and I'm going to hit the up arrow a couple times.

4:27Let's go to Bob.

4:28There we go.

4:29So I'm SSHing bob@192.168.121.11,

4:32which again, management interface of the BIG-IP.

4:35Hit Enter.

4:36There we go, I put in a password, Enter,

4:38and it's gonna have me change my password.

4:41So I put in my current one.

4:42Here we go.

4:44There we go.

4:45And let's see what happens.

4:47There we go.

4:48It drops me directly into the traffic management OS,

4:50the TMOS shell.

4:52It didn't send me into the Linux shell

4:54like it did when I was the administrator.

4:56So there you go, that's how you can tell the difference

4:58between your advanced shell in the Linux

5:01and your TMOS shell within the BIG-IP.

5:04And again, if I wanna quit this, I can't simply type exit

5:08'cause hey, that doesn't work.

5:09You gotta use the word quit.

5:11So if I do quit, there we go.

5:12We close that session.

5:13So that's how we can access the management interface

5:17of the BIG-IP.

5:18That was our HTTP GUI interface,

5:21and then our advanced shell for our Linux access,

5:24and our TMOS shelf for our BIG-IP

5:27terminal configuration access.

0:00<v Instructor>Now let's talk about some Big-IP</v>

0:02functions and features.

0:04And let's start off with taking a look

0:06at how the big F5 works as an ADC proxy.

0:11This is our application delivery controller.

0:13So the way this works, you've got your user over here,

0:16and we've talked about this before,

0:18but we're gonna get a good review here

0:20because it's very important to understand this.

0:23So the user wants to connect to the server over here.

0:26So when they go out, they're going to the URL of the server

0:30and via DNS that gets translated to an IP address,

0:35and then the network traffic goes over

0:37and begins its journey to its destination.

0:41And that's where it's introduced to the Big-IP

0:45because that DNS is actually gonna resolve the IP address

0:48that resides on our Big-IP.

0:51And then the Big-IP is going to get to do some things

0:54to that network traffic before sending it onto the server

0:58if it's allowed to do so.

1:01So let's talk about that.

1:02Well, it's gonna do some inspection of the traffic.

1:05It's gonna make sure it's not malicious

1:07if we have security rules set up for it.

1:09It's also gonna figure out where it needs to be routed to.

1:12It's going to do any type of modifications of the traffic,

1:17such as Network Address Translation that may be required.

1:21It's also gonna provide some decryption

1:24if we have SSL offloading enabled.

1:27It can also provide some uncompression services

1:31so that if you're using some type of compression

1:34in the network communications,

1:36it can do that uncompression before forwarding it on.

1:39So what we see here is it's gonna go through

1:41and it's gonna provide these types of services.

1:44And then if it decides that the traffic should be forwarded

1:48to a member server,

1:50well then it's gonna go ahead and do that for us.

1:53So this is how the Big-IP works as a proxy.

1:56And I wanna make a very big point.

1:58Down here at the bottom, I want you to read that:

1:59"Big-IP blocks all traffic by default."

2:04This is known as an implicit deny.

2:07So if you don't configure the Big-IP to do anything

2:09and you put it out there with an IP address,

2:11it's gonna block everything.

2:12Nothing is getting through it

2:14because we don't have any rules put in place

2:16as to what to allow through it.

2:18So it's very important you remember

2:19that Big-IP blocks all traffic by default.

2:23So let's take a look

2:24at some of the additional features of the Big-IP.

2:27We've talked about one of these.

2:28We've talked about iRules earlier on.

2:31So let's go ahead and talk about some of these,

2:32which the first one is iRules.

2:35And this is a tool for scripting the automation

2:39of the Big-IP capabilities.

2:42Then we have iControl,

2:44and this is actually an API

2:47that allows for integration with third party apps.

2:52So if you're needing to integrate

2:53with a third party application or service

2:55or something with your Big-IP, look at using iControl.

2:59Then we have iApps, which is next,

3:02and this is a customizable framework

3:07for deploying applications and it uses templates.

3:12So you can go ahead and create a template

3:14based on a specific app you wanna deploy.

3:15Maybe you deploy several of them

3:17that are very close to each other as far as likeness.

3:21So you can create a template

3:22and go ahead and use that to help deploy them out.

3:25And then lastly, iHealth,

3:27and this is a system health diagnostic tool.

3:31So those are some of the additional features of the Big-IP.

3:35You got your iRule, iControl, iApps, and iHealth.

3:39And lastly, we're gonna wrap up here with Big-IQ.

3:43Now this is not Big-IP, this is Big-IQ.

3:47Now this is pretty cool.

3:48This is used for centralized management of Big-IP devices,

3:53and it can actually manage up to 200 Big-IP devices

3:56per Big-IQ deployment.

4:00So there you go, it'll manage up to 200 Big-IP devices.

4:04So that way, you can centrally manage them,

4:06which of course makes it wonderful

4:08when you're trying to do upgrades for your Big-IPs.

4:12Instead of doing them one by one,

4:14you can actually do that through your Big-IP

4:16and you can roll it out to groups or all of them at once.

4:20It also monitors SSL certificates

4:23because as you can imagine,

4:25if you've got multiple virtual servers

4:27and apps running on multiple Big-IPs,

4:30you may have hundreds of certificates out there

4:33that you're trying to manage.

4:34Well, guess what? Big-IQ can help you with that process.

4:38And then lastly, it integrates with iHealth.

4:41And remember, iHealth was a system diagnostics tool

4:44that ran on our Big-IPs.

4:47So that way, when we have our Big-IQ up here

4:50and it's watching all of our Big-IPs out here

4:54that we have running, and it's helping us to manage them,

4:56it's gonna pull in that health information

4:58so that we can see it on dashboards and reports and such.

5:00We can kinda figure out what's going on,

5:02especially if we're having problems.

5:04So that is your Big-IQ

5:05and that wraps up our Big-IP functions and features.

0:00<v Speaker>All right, so you have been tasked with</v>

0:02setting up or enabling the advanced firewall module

0:06within the big IP, and you need to make sure you're not

0:08restricting the resources to it.

0:10So let's jump in and see how this is done.

0:13So we're going to log in, admin, put in our password,

0:15There we go.

0:17And it's gonna log us in here.

0:18And what we're gonna do is once this loads up, we're

0:20gonna go down to system on the left, and we're going to

0:23go down to resource provisioning.

0:26And this is where all of our resource provisioning

0:29happens and of course this is where all of

0:30our modules are. And if we want to enable one of these

0:34modules, then what we wanna do is we want to first,

0:37find it, and here's our advanced firewall module.

0:40Want to go under the provisioning column, you're going to

0:44want to check that box there.

0:46Now you've got some options here.

0:49Dedicated, nominal and minimum.

0:52And if you think back to the video we covered this in,

0:55dedicated was where the system allocated all CPU

0:58memory and disc resources to a single module.

1:00But that caused other modules to be disabled.

1:03So we definitely don't want to do that.

1:04Now we have nominal, and that's where the module is first

1:08enabled. Feeling a little bit of resources, but then

1:10it's given the additional resources once it gets fired

1:13up and running so that it has enough resources to do

1:15what it needs to do.

1:17And the minimum is where we're restricting resources,

1:19so we know we can't use dedicated in this instance because

1:22we're also running the LTM. So we need to do nominal

1:25and that's what the default is.

1:27So there we go and we've already got a license so we

1:30can just scroll down here and say submit.

1:33And it says here that it's, uh, reprovisioning may

1:36start daemons which is services or reboot the system

1:39which causes lost connections, are you sure you want

1:41to proceed?

1:42So of course we would want to do this during a scheduled

1:44downtime. But yeah let's go ahead and do it.

1:47So we'll click OK.

1:48And if you look up here you'll see this just changed

1:51actually.

1:51This just had TMM and LTM, but now we see AFM up here

1:56under memory, and it's actually doing something now.

1:59Ah we see it's loading, it's receiving config data from

2:01the device, and it's showing that the configuration

2:03has changed, and it's going to want to go ahead and

2:07do an update here to make sure that everything is

2:10functioning.

2:11So we're going to give that a couple minutes to do that,

2:14I'll be right back.

2:15Okay it has finished.

2:16And it went through and did a couple things.

2:18And it says that device connection has been restored,

2:21so we can just click continue now.

2:23All right, super, I'm just going to go ahead and refresh

2:25this up here.

2:27There we go.

2:28So it can refresh the page we know we're looking

2:29at the most recent information.

2:32And, now if you look over on the left we now have a security

2:36tab that was not here before.

2:40So if I click on that, we now have protocol security,

2:43network firewall, network address translation,

2:47different firewall zones, packet filters, DDOS,

2:50or DOS protection that is.

2:52And event logs and all this stuff.

2:53And this wasn't here before.

2:55But it is now.

2:56So if we go back to our system, go back to our

2:59resource provisioning, and we should then see that

3:02once it comes up.

3:03There it is, it's our AFM, we still have it checked.

3:05It's showing nominal and up here at the top under our

3:08memory we show add our disc actually, and our CPU

3:12we show that AFM is actually running and using some of

3:15our resources. Plus we have our security object or

3:19menu over here on the left that we can then work

3:21with that advanced firewall.

3:23So cool!

3:24Hope you're able to get that knocked out and figure

3:27it out, if not hey, now you know how.

3:29That wraps up this nugget, I hope it's been

3:32informative for you.

3:33And I'd like to thank you for viewing.