F5 BIG IP on IBM Cloud Solution Architecture

Size: px

Start display at page:

Download "F5 BIG IP on IBM Cloud Solution Architecture"

Cora Gilbert
5 years ago
Views:

1 F5 BIG IP on IBM Cloud Solution Architecture Date: Copyright IBM Corporation 2018 Page 1 of 11

2 Table of Contents 1 Introduction About F5 BIG IP Virtual Edition Background Key Benefits Design Overview F5 BIG IP Virtual Edition Deployment... 6 Virtual machine configuration... 7 Network configuration... 8 VMware DRS... 9 Caveats... 9 Appendix A License Requirements Appendix B Reference List of Figures Figure 1 VMware Cloud Foundation on IBM Cloud... 4 Figure 2 F5 BIG IP on IBM Cloud High Level Components... 6 Figure 3 Overview of a BIG IP virtual edition networking configuration... 7 List of Tables Table 1 F5 BIG IP sizing model... 7 Table 2 F5 BIG IP virtual machine summary... 7 Copyright IBM Corporation 2018 Page 2 of 11

3 Summary of Changes This section records the history of significant changes to this document. Only the most significant changes are described here. Version Date Author Description of Change Jack Benney Frank Chodacki Daniel De Araujo Bob Kellenberger Simon Kofkin Hansen Scott Moonen Dan Mullen Jim Robbins Initial Release Copyright IBM Corporation 2018 Page 3 of 11

4 1 Introduction 1.1 About F5 BIG IP Virtual Edition The purpose of this document is to define and describe the F5 BIG IP architecture for the vcenter Server and VMware Cloud Foundation offerings deployed in the IBM Cloud. Specifically, it will detail the components of the solution and high level configuration of each component in the design. This solution is considered to be an additional component and extension of both the vcenter Server solution offering and the VMware Cloud Foundation solution offering on IBM Cloud. As a result, this document will not cover the existing configuration of the foundation solutions on IBM Cloud. Therefore, it is highly recommended to review and understand the VMware on IBM Cloud solution architecture located on the IBM Architecture Center before reading this document. 1.2 Background Figure 1 VMware Cloud Foundation on IBM Cloud IBM Cloud clients who make use of physical network traffic management and load optimization appliances for their on premises environments may be interested in an equivalent virtualized solution for their VMware environments in the IBM Cloud. IBM Cloud offers F5 BIG IP Virtual Edition, which includes the F5 Local Traffic Manager (LTM) feature set. The F5 LTM provides both static and dynamic load balancing along with application layer proxies that prioritize traffic. All capability is deployed in a redundant configuration to prevent single point of failure in the network layer. Copyright IBM Corporation 2018 Page 4 of 11

5 1.3 Key Benefits Several licensing options are available for F5 BIG IP Virtual Edition on IBM Cloud. The Good licensing tier offers the following capabilities: Local Traffic Manager (LTM) for L4 L7 load balancing and traffic management The Better licensing tier adds the following BIG IP capabilities: DNS Advanced Firewall Manager (AFM) for advanced firewall services Application Acceleration Manager (AAM) for application performance optimization The Best licensing tier adds the following BIG IP capabilities: Application Security Manager (ASM), for L7 security Access Policy Manager (APM), for simplified application access including SSO and MFA Copyright IBM Corporation 2018 Page 5 of 11

2 Design 2.1 Overview The F5 BIG IP Virtual Edition solution complements the IBM Cloud for VMware Solutions offerings by providing application availability, access control, and security services.

6 2 Design 2.1 Overview The F5 BIG IP Virtual Edition solution complements the IBM Cloud for VMware Solutions offerings by providing application availability, access control, and security services. These services are provided by one or more pairs of F5 BIG IP Virtual Edition virtual machines deployed to your VMware on IBM Cloud cluster. Figure 2 F5 BIG IP on IBM Cloud High Level Components 2.2 F5 BIG IP Virtual Edition Deployment BIG IP Local Traffic Manager (LTM) does not replace NSX but rather complements and enhances the existing NSX architecture. BIG IP can be installed into either VMware Cloud Foundation (VCF) or vcenter Server (VCS) instances on IBM Cloud. In both scenarios, BIG IP VE will be deployed with two virtual network interfaces (vnic) in the client s data plane. However, LTM can manage all NSX aware network segments if the proper routing has been configured. An additional vnic is configured in the management plane and a fourth and final vnic is configured in the control plane for high availability. Figure 3 shows an overview of one possible instantiation of this architecture. Copyright IBM Corporation 2018 Page 6 of 11

Figure 3 Overview of a BIG IP virtual edition networking configuration In this figure, the Internal and External network segments represent public and private segments in the client s data plane.

7 Figure 3 Overview of a BIG IP virtual edition networking configuration In this figure, the Internal and External network segments represent public and private segments in the client s data plane. This instance has been configured to use a logical switch (VXLAN) for both of the BIG IP data interfaces. Virtual machine configuration The F5 BIG IP offering is deployed as a pair of virtual machines within your primary vsphere cluster to enable a high availability configuration. The configuration of the appliances follows a small, medium or large template, and depends on the chosen licensing model and licensed bandwidth. Table 1 shows the template used for each license option and throughput: Throughput Good Configuration Better Configuration Best Configuration 1 Gbps Small Medium Large 3 Gbps Large Large Large Table 1 F5 BIG IP sizing model Depending on the template, the appliances are deployed with the configuration shown in Table 2: Attribute Small Template Medium Template Large Template CPU 2 vcpu 4 vcpu 8 vcpu RAM 4 GB 8 GB 16 GB High availability Disk usage Disk backing Two appliances deployed to enable high availability Two disks totaling 149 GB on the cluster s management datastore: 20 GB 129 GB Management datastore: vsan or IBM Cloud Endurance, as applicable Table 2 F5 BIG IP virtual machine summary Copyright IBM Corporation 2018 Page 7 of 11

8 Although two virtual machines are deployed, BIG IP clustering is not preconfigured by the IBM Cloud automation. This is because aspects of the clustering configuration, such as TLS certificates, are not known at the time of deployment. After the F5 BIG IP machines have been deployed, you must login to them and configure certificates, interfaces and addresses, and clustering. See more details in the developerworks recipe, Working with F5 Networks BIG IP in IBM Cloud for VMware. Network configuration The BIG IP virtual machines are deployed with four network interfaces, configured as follows: BIG IP Interface Configuration 1.0 [Management] Attached to Private A VLAN using SDDC-DPortGroup-Mgmt, with IP addresses assigned by IBM Cloud automation from management subnet 1.1 [Internal] If instance is VCS and sample Workload logical switch is present, attached to that. Otherwise, if instance is VCF or if sample Workload switch is absent, attached to a dynamically created port group on Private A VLAN using SDDC- Dswitch-Private. In all cases, IP addresses unassigned and link initially inactive 1.2 [External] Attached to Public VLAN using SDDC-DPortGroup-External, but IP addresses unassigned and link initially inactive 1.3 [HA] Attached to a new logical switch based on the name given to the F5 BIG IP service instance at the time of deployment; e.g., ltm1-bigipha Management Interface The BIG IP management interface is preconfigured and ready to access immediately after deployment. You should not re assign or re configure the management interface. A firewall rule and source NAT rule are created on the management NSX Edge Services Gateway (ESG) to allow the device to connect to the public network using http and https only. This is to allow license management and it is not recommended to change these rules as it could lead to the license being deactivated. Data Network Interfaces There are two vnics defined for the BIG IP data plane. These correspond to the BIG IP Internal and External interfaces. Depending on your network topology design, the external, or north-south interface might be connected to any of the following networks: Public network o Direct connection to public network o Indirect connection protected by NSX Edge Services Gateway (ESG) o Indirect connection protected by FortiGate security appliance using routing o Indirect connection protected by FortiGate virtual appliance IBM Cloud private network NSX logical switch (VXLAN) The external interface is initially attached to the external port group and switch, but may be reconfigured after deployment. The internal interface is intended for connection to your VMware workload. Depending on your network topology design it might be connected to any of the following networks: Connection to IBM Cloud private network Connection to NSX logical switch (VXLAN) Copyright IBM Corporation 2018 Page 8 of 11

9 The internal interface is initially attached to either the sample Workload logical switch (if the instance is VCS and the sample switch is present), or else a dynamically created port group on the IBM Cloud private network. In any case, you may reconfigure it after deployment according to your requirements. Since the appliance traffic management networks are not initially configured, both the external and internal interfaces are left inactive and no IP address is assigned. If you plan to use either the IBM Cloud public VLAN or private VLAN for either interface, you must order your own subnets from the IBM Cloud portal for use with the BIG IP virtual appliances. High Availability Interface The high availability interface is pre configured on a dedicated logical switch (VXLAN). You should not re assign or re configure the HA interface, or reuse the logical switch for any other purpose. Note that BIG IP allows for standalone deployments, but IBM Cloud does not support this configuration. VMware DRS and reservations Because it provides time sensitive networking services, BIG IP should be configured to ensure that it has adequate resources. The IBM Cloud automation configures a reservation to ensure that the virtual appliances receive their full allotment of CPU and memory. In order to assure high availability, the IBM Cloud automation creates a DRS anti affinity rule to restrict the two BIG IP virtual machines from running on the same host. Caveats It is not possible to change the licensing tier or licensed throughput of your BIG IP deployment once it has been deployed. In order to achieve this, you must deploy a new instance of F5 BIG IP, migrate your configuration to the new instance, and delete the original instance. F5 BIG IP limits the appliance throughput based on your chosen maximum bandwidth. Because network performance is affected by many factors, not all configurations and topologies may be able to achieve your chosen maximum bandwidth. Copyright IBM Corporation 2018 Page 9 of 11

10 Appendix A License Requirements This architecture requires BIG IP licensing from F5. IBM Cloud automation provisions the F5 BIG IP license based on your chosen license tier and throughput. Your IBM Cloud monthly bill will reflect your order and ongoing usage of F5 BIG-IP Virtual Edition. The BIG IP virtual machines require outbound connectivity to F5 licensing servers to activate and maintain their license. This connectivity is preconfigured as described in section and should not be re configured. Copyright IBM Corporation 2018 Page 10 of 11

11 Appendix B Reference Additional information about IBM Cloud and F5 BIG IP on IBM Cloud can be found at the following sites: IBM Cloud Architecture Center for Virtualization: Working with F5 Networks BIG IP in IBM Cloud for VMware: F5 introduction to irules: Copyright IBM Corporation 2018 Page 11 of 11

Veeam Backup & Replication on IBM Cloud Solution Architecture

Veeam Backup & Replication on IBM Cloud Solution Architecture Date: 2018 07 20 Copyright IBM Corporation 2018 Page 1 of 12 Table of Contents 1 Introduction... 4 1.1 About Veeam Backup & Replication...