Eric Mitchell Channel SE, Southeast, Mid-Atlantic and Federal US

Transcription

1 Eric Mitchell Channel SE, Southeast, Mid-Atlantic and Federal US

2

3 B A

4 Based on 11.4 Multiple Choice Not Adaptive 80 questions in 90 minutes No command line engines View whole exhibit before you close them Manage Your Time

5

6

7 Objective 1.01 Given a connectivity-troubleshooting situation, consider the packet and virtual server processing order Explain how a packet is processed once it arrives at device (connection table, packet filters, etc.) 1. Existing connection in connection table

8 Objective 1.01 Given a connectivity-troubleshooting situation, consider the packet and virtual server processing order Explain how a packet is processed once it arrives at device (connection table, packet filters, etc.) 1. Existing connection in connection table 2. AFM/Packet filter rule 3. Virtual server 4. SNAT 5. NAT 6. Self-IP 7. Drop

9 Objective 1.01 Given a connectivity-troubleshooting situation, consider the packet and virtual server processing order Explain how a virtual server processes a request (most specific to least specific)? Order Destination Service port 1 <host address> <port> 2 <host address> * 3 <network address> <port> 4 <network address> * 5 * <port> 6 * * Order Destination Source Service port 1 <host address> <host address> <port> 2 <host address> <host address> * 3 <host address> <network address> <port> 4 <host address> <network address> * 5 <host address> * <port> 6 <host address> * * 7 <network address> <host address> <port> 8 <network address> <host address> * 9 <network address> <network address> <port> 10 <network address> <network address> * 11 <network address> * <port> 12 <network address> * * 13 * <host address> <port> 14 * <host address> * 15 * <network address> <port> 16 * <network address> * 17 * * <port> 18 * * *

10 Objective 1.01 Given a connectivity-troubleshooting situation, consider the packet and virtual server processing order Given a specific connectivity issue, isolate where the problem might be according to the processing order 1. Specific IP address port with IP source of / :80 2. Specific IP address and specific port with IP source of / :80 3. Specific IP address and all ports with IP source of / :* 4. Specific IP address and all ports with IP source of / :* 5. Network IP address and specific port with IP source of / :443 netmask Network IP address and all ports with IP source of / :* netmask All networks and specific port with IP source of / :80 netmask All networks and all ports with IP source of / :* netmask Connect to: Source IP : : : : :

11 Objective 1.02 Identify the reason a virtual server is not working as expected Determine the state of a virtual server (offline, enabled, etc.)?

12 Objective 1.02 Identify the reason a virtual server is not working as expected Determine the state of a virtual server (offline, enabled, etc.)?

13 Objective 1.02 Identify the reason a virtual server is not working as expected Determine the state of a virtual server (offline, enabled, etc.)?

14 Objective 1.02 Identify the reason a virtual server is not working as expected Determine if a virtual server is configured for the proper listening port Determine if a virtual server is configured with the proper IP address configuration

15 Objective 1.02 Identify the reason a virtual server is not working as expected Determine if a virtual server is configured for the proper listening port Determine if a virtual server is configured with the proper IP address configuration

16 Identify the reason a virtual server is not working as expected Determine if the virtual server is configured with the appropriate profiles

17 Identify the reason a virtual server is not working as expected Determine if the virtual server is configured with the appropriate profiles

18 Identify the reason a virtual server is not working as expected Determine if the pool configuration has an effect on virtual server state? Determine which tools to use in order to diagnose the issue? Virtual Server stats Pool/Pool member stats Logs Connection table Routing table Connectivity from LTM to pool member- ping/telnet/curl Packet captures

19 Identify the reason a virtual server is not working as expected

20 Identify the reason a virtual server is not working as expected

21 Identify the reason a virtual server is not working as expected root@(bigip245)(tmos)# show sys conn? Properties: "{" Optional delimiter age Specifies the age, in seconds, of a connection cs-client-addr Specifies the clientside remote address of the active connections cs-client-port Specifies the clientside remote port of the active connections cs-server-addr Specifies the clientside local address of the active connections cs-server-port Specifies the clientside local port of the active connections protocol Specifies the protocol used for specified connections (for example: tcp, udp) ss-client-addr Specifies the serverside local address of the active connections ss-client-port Specifies the serverside local port of the active connections ss-server-addr Specifies the serverside remote address of the active connections ss-server-port Specifies the serverside remote port of the active connections type Specifies the connnection type used for specified connections (for example: any, mirror, self)

22 Identify the reason a virtual server is not working as expected root@(bigip245)(cfg-sync Standalone)(Active)(/Common)(tmos)# show sys connection protocol tcp Sys::Connections : :80 any6.any any6.any tcp 1 (tmm: 0) none : : : :80 tcp 0 (tmm: 0) none : : : :80 tcp 0 (tmm: 0) none : : : :80 tcp 0 (tmm: 0) none : :80 any6.any any6.any tcp 2 (tmm: 0) none : : : :80 tcp 0 (tmm: 0) none : : : :80 tcp 0 (tmm: 1) none : : : :80 tcp 0 (tmm: 1) none : :80 any6.any any6.any tcp 2 (tmm: 1) none : : : :80 tcp 0 (tmm: 1) none : : : :80 tcp 0 (tmm: 1) none : :80 any6.any any6.any tcp 1 (tmm: 1) none : : : :80 tcp 0 (tmm: 1) none : :80 any6.any any6.any tcp 1 (tmm: 1) none

23 Identify the reason a virtual server is not working as expected root@(bigip245)(cfg-sync Standalone)(Active)(/Common)(tmos)# show sys connection detail : : : : TMM 0 Type any Acceleration none Protocol tcp Idle Time 0 Idle Timeout 300 Unit ID 1 Lasthop Virtual Path :80 Conn Id 0 /Common/client_vlan 00:50:56:c0:00:02 ClientSide ServerSide Client Addr : :56562 Server Addr : :80 Bits In 1.9K 704 Bits Out K Packets In 3 2 Packets Out 2 3

24 Identify the reason a virtual server is not working as expected Curl Curl [root@bigip249] config # curl -i HTTP/ OK Date: Wed, 06 Aug :05:13 GMT Server: Apache/ (Ubuntu) X-Powered-By: PHP/ ubuntu2.2 Vary: Accept-Encoding Content-Length: 3819 Connection: close Content-Type: text/html <html> <head> <TITLE>Using virtual server and pool member (Node #1)</TITLE> <meta http-equiv="content-type" content="text/html; charset=us-ascii" /> <script language="javascript"> </script>

25 Identify the reason a virtual server is not working as expected tcpdump tcpdump -w - writes output to a file tcpdump -i - to listen on a specific interface or vlan tcpdump -n don t do DNS lookup, -nn - don t do DNS lookup or port lookup. tcpdump -s0 - capture whole packet Tcpdump X output in ASCII/Hex Best Practice Listen on VLAN vs interface Filter down as much as possible Write to file if device is busy or lots of data to capture More on TCPDUMP in Objective 3.01

26 Identify the reason a virtual server is not working as expected Explain the difference between the virtual servers status definitions Unavailable Disabled The pool member(s) connection limit has been reached Unavailable Enabled The pool member(s) connection limit has been reached Unknown Enabled The children pool member(s) either don't have service checking enabled, or service check results are not available yet Unknown Disabled The children pool member(s) either don't have service checking enabled, or service check results are not available yet Offline Disabled The children pool member(s) are down Available Enabled The virtual server is available Offline Enabled The children pool member(s) are down Available Disabled The virtual server is available

27 Identify the reason a pool member has been marked down by health monitors Discuss the effects of health monitors on the status of pool members/nodes

28 Identify the reason a pool member has been marked down by health monitors Discuss the effects of health monitors on the status of pool members/nodes

29 Identify the reason a pool member has been marked down by health monitors Determine the state and availability of the pool member/node in question show ltm pool p80_pool members {all} Ltm::Pool: p80_pool Status Availability : available State : enabled Reason : The pool is available Monitor : custom_http_monitor and /Common/custom_tcp_monitor Minimum Active Members : 0 Current Active Members : 3 Total Requests : 0 Current Sessions : 0 Traffic ServerSide Bits In 0 Bits Out 0 Packets In 0 Connection Queue Pool Pool and members Number of connections queued now 0 0 Number of connections serviced 0 0 Queue head entry age (ms) 0 0 Maximum queue entry age ever (ms) 0 0 Maximum queue entry age recently (ms) 0 0 Average queue entry age (ms) Ltm::Pool Member: : Status Availability : available State : enabled Reason : Pool member is available Monitor : custom_http_monitorand /Common/custom_tcp_monitor (pool monitor) Monitor Status : up Session Status : enabled Pool Name : p80_pool

30 Identify the reason a pool member has been marked down by health monitors Verify the pool member/node Ratio configuration?

31 Identify the reason a pool member has been marked down by health monitors Verify the pool member/node Ratio configuration? Verify the pool member/node connection configuration and count

32 Objective 1.04 Identify a pool member not in the active priority group What is a priority group Server Pools Running WWW1 and WWW2 Activation < 4 PG 100 PG 100 PG 100 PG 100 PG 100 PG 90 PG 80 PG 70 PG 25 PG 1 A A A A A A A web1_pool Servers web2_pool Servers

33 Objective 1.04 Identify a pool member not in the active priority group

34 Identify a pool member not in the active priority group Explain the concept of persistence?

35 Identify a pool member not in the active priority group Explain the concept of persistence? Verify the type of persistence profile assigned to the virtual server in question Validate the expected persistence behavior? Differentiate between fallback and primary persistence?

36 Identify a pool member not in the active priority group Use the appropriate tool to troubleshoot persistence

37 Objective 1.05 Identify traffic diverted due to persistence record

38 Objective 1.06 Identify the current configured state of the pool member Identify the current configured state of the pool member

39 Objective 1.07 Identify a persistence issue What is the behavior? Is persistence already configured? Does it need to be? What type will solve the application issue more effectively?

40

41 Perform an End User Diagnostic per F5 documentation and collect the output Reboot an F5 platform into the EUD 1. Attach a USB CDROM drive containing the bootable system CD. As the system boots up, the EUD starts. 2. Attach a USB mass storage device drive with the EUD boot image loaded. As the system boots up, the EUD starts. 3. While the system is booting, select the End User Diagnostics option from the boot menu. To determine EUD Version eud_info

42 Perform an End User Diagnostic per F5 documentation and collect the output Reboot an F5 platform into the EUD The EUD menu options for most F5 Networks systems When you start the EUD, the following menu displays: 1 System Report 2 Sensor Report 3 SFP/XFP Report 4 LED Test 5 V 18 Run all Tests (Non User Intervention, Uses Normal Ram Test) 19 * Run all Tests (User Intervention Required, Uses Quick Ram Test) 20 * Display Test Report Log 21 * Quit EUD and Reboot the System Select a Menu item # -

43 Perform an End User Diagnostic per F5 documentation and collect the output Download output from the unit an EUD was run on Interpret the output from an EUD and determine if the test passed or failed Text file named eud.log in the /shared/log/ directory on the host file system. Completed test with 0 errors.

44 Objective 2.02 Interpret the LCD Warning Messages Locate the LCD on an F5 Platform

45 Objective 2.02 Interpret the LCD Warning Messages Locate the LCD on an F5 Platform Correlate the LCD message to message in the corresponding log file Identify which tasks the buttons on the LCD perform Configure the management port using the LCD: 1. On the LCD, press the X button LCD Warning: Critical: 9d Blocking Dos Attack 2. Arrow to System and press the button 3. Arrow to Management and press the Local Traffic Log: sweeper_update: aggressive button mode activated / pages 4. Set the Mgmt IP, Mgmt Mask, and Mgmt Gateway options 5. When finished, arrow to Commit and press the button

46 Identify a possible hardware issue within the log files Indicate which logs would contain debugging information LTM - /var/log/ltm local0 EM - /var/log/em local1 GTM - /var/log/gtm local2 ASM - /var/log/asm local3 icontrol - /var/log/ltm local4 Packet Filter - /var/log/pktfilter local5 HTTPD Errors - /var/log/httpd/httpd_errors local6 Boot Process - /var/log/boot.log local7 Beginning in BIG-IP , you can also use the platform_check command to collect the SMART test data from the drive. The disk portion of the command output indicates a Pass or Fail status for the drive and logs detailed information to the /var/log/platform_check file

47 Identify a possible hardware issue within the log files Indicate which logs would contain debugging information Given a log file, determine the nature of a hardware issue Given a possible issue, determine which log file entries to review System events - messages are based on Linux events, and are not specific to the BIG-IP system. Packet filter events messages that result from the implementation of packet filters and packet-filter rules. Local traffic events - messages pertain specifically to the local traffic management system. Audit events - are those that the BIG-IP system logs as a result of changes to the BIG-IP system configuration. Logging audit events is optional.

48 Force an active unit to standby under the appropriate circumstances A S

49 Understand the relationship between interfaces, trunks, VLANs and their status/statistics Cisco vs F5 Port Channel Trunking Trunking VLAN Tagging

50 Objective 2.05 Understand the relationship between interfaces, trunks, VLANs and their status/statistics

51

52 Recognize when a packet capture is needed within the context of a performance issue Tcpdump command reference (partial) &&! Alternate notations

53 Recognize when a packet capture is needed within the context of a performance issue BIG-IP is a full proxy. Two tcpdumps (one on each side of the proxy) are often needed. Can by done be open two SSH sessions, or running the dumps in background (&) When a tcpdump is required, always make it as specific a possible Limit it to the appropriate interfaces/vlans and hosts/ports system# tcpdump i external exs 0 host and port 80 system# tcpdump i (1.1, f5_trunk1, external, 0.0) exs 0 w /var/tmp/dump.cap & system# tcpdump i (1.1, f5_trunk1, internal, 0.0) exs 0 w /var/tmp/dump2.cap & system# fg ctl+c system# fg ctl+c SOL4714: Performing a packet trace and providing the results to F5 Technical Support

54 Perform a packet capture within the context of a performance issue Tcpdump command reference (partial)

55 Perform a packet capture within the context of a performance issue Tcpdump command reference (partial) &&! Alternate notations

56 Perform a packet capture within the context of a performance issue Determine an appropriate location to take the capture Determine the appropriate time to take capture Determine an appropriate tool to use Ensure the packet capture tool has the capacity to capture (driver/tap) Narrow the scope/context of information being gathered Given a scenario, determine whether a packet capture is appropriate

57 Objective 3.02 Use BIG-IP tools in order to identify potential performance issues Differentiate between performance issue types (i.e. Latency, Congestion, broken content) Latency describes the time delay experienced while a data packet moves from one point to another, usually caused by physical distance and high round-trip times. Latency can also be introduced by compute-intensive processing such as SSL handshaking, bulk encryption/decryption, and TCP session management. Network congestion occurs a node or network is processing so much data that its level of service deteriorates. Broken content is information that can not be accessed on the server due to many different issues such as path changes, application changes, etc..

58 Objective 3.02 Use BIG-IP tools in order to identify potential performance issues Differentiate between performance issue types (i.e. Latency, Congestion, broken content) Establish the frequency of a given issue (random, continuous, isolated, intermittent, repetitive intervals)

59 Objective 3.02 Use BIG-IP tools in order to identify potential performance issues Explain how to get performance statistics in addition to the those shown in the dashboard (Overview - Performance) You can review System performance on: Memory Used System CPU Usage Active Connections Total New Connections Throughput(bits) Throughput(packets) TMM Client-side Throughput TMM Server-side Throughput HTTP Requests RAM Cache Utilization SSL Transactions And more.

60 Objective 3.02 Use BIG-IP tools in order to identify potential performance issues Explain how to get performance statistics in addition to the those shown in the dashboard (Overview - Performance) You can use tmsh: show /sys performance all-stats

61 Objective 3.02 Use BIG-IP tools in order to identify potential performance issues Explain how to get performance statistics in addition to the those shown in the dashboard (Overview - Performance) From the Linux prompt: top bigtop

62

63 Verify remote connectivity to the box in order to determine the cause of a management connectivity issue Isolate potential causes of basic network connectivity issues, given scenarios related to: client configuration, client network access, device network access, network topologies Apply connectivity troubleshooting tools (i.e. ping, traceroute, http/https availability, remote shell access, network based console access) in the appropriate situation

64 Verify remote connectivity to the box in order to determine the cause of a management connectivity issue You can check the management port settings through the GUI

65 Check and interpret port lockdown settings and packet filters in order to determine the cause of a management connectivity issue Given a scenario, review port lockdown settings on the Self-IP to determine the cause of the issue Describe appropriate use cases for the use of port lockdown

66 Check and interpret port lockdown settings and packet filters in order to determine the cause of a management connectivity issue Allow Default ports ospf:any tcp:domain (53) tcp:f5-iquery (4353) tcp:https (443) tcp:snmp (161) tcp:ssh (22) udp:520 udp:cap ( for network failover) udp:domain (53) udp:f5-iquery (4353) udp:snmp (161) Mirroring and network failover use TCP port is not included in the default list but is secretly allow with the BIG-IP failover partner

67 Check and interpret port lockdown settings and packet filters in order to determine the cause of a management connectivity issue Describe appropriate use cases for the use of port lockdown

68

69 Objective 4.02 Check and interpret port lockdown settings and packet filters in order to determine the cause of a management connectivity issue Determine whether a filter is enabled Interpret a packet filter rule list in a given situation

70 Objective 4.02 Check and interpret port lockdown settings and packet filters in order to determine the cause of a management connectivity issue Determine whether a filter is enabled Interpret a packet filter rule list in a given situation

71 Objective 4.02 Check and interpret port lockdown settings and packet filters in order to determine the cause of a management connectivity issue Determine whether a filter is enabled Interpret a packet filter rule list in a given situation

72 Given the use of a remote authentication server, verify proper DNS and NTP settings in order to diagnose a connectivity issue Given a suspected DNS issue, use appropriate tools to verify proper settings

73 Given the use of a remote authentication server, verify proper DNS and NTP settings in order to diagnose a connectivity issue Given a suspected DNS issue, use appropriate tools to verify proper settings Given a suspected DNS issue, use appropriate tools to verify DNS response nslookup example: nslookup Server: Address: #53 Non-authoritative answer: Name: Address: Dig Example: ; <<>> DiG <<>> ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

74

75 Identify the appropriate supporting components and severity levels for an F5 support ticket Identify the necessary components for all support cases (Qkview uploaded to ihealth/ or attached to case, serial number of device, problem description, other supporting data) Identify severity levels and the associated response times SEVERITY 1-1-hour response SEVERITY 2-1-hour response SEVERITY 3-4-business hour response SEVERITY 4-24-hour response

76 Given an issue, determine the appropriate severity according to F5 guidelines Case Severity Condition Support Response Time Severity 1 Site Down 1 Hour Severity 2 Site at Risk 1 Hour Severity 3 Performance Impaired Performance Degraded 4 Business Hours Description All network traffic has ceased, causing a critical impact to your business. Primary unit has failed resulting; Site is at risk of going down. Network traffic is extremely slow; significant impact to your business. Network traffic is partially functional; some applications to be un-reachable. Severity 4 General Assistance Next Business Day Questions regarding configurations "how to". Troubleshooting non-critical issue. Request for functionality that is not part the current product feature set.

77 Field Name Contact F5 Serial # F5 Product F5 Version Business Impact Description Instructions to replicate Remote Access Information Data Required The technical contact for this case Cell (Mobile) phone or Desk phone Required to obtain assistance Platform i.e., 2000, 4000, 5250, Viprion, VE, etc Version (and any hot fixes already applied) The criticality of this issue on your business Provide as complete a problem statement as possible: What has happened? Are there error messages? What are they? When did the issue happen, where did it happen? What changes have occurred in the configuration? What changes have occurred in the network? Is the issue happening on other F5 appliances? If you are able to replicate, please provide step-by-step instructions Is it possible to access this unit directly? Is it possible to access this unit via a WebEX session? Opening a Support Case

78

79

80 Provide quantitative and relevant information appropriate for a given issue Distinguish between qualitative/quantitative statements in order to assemble an accurate problem description Distinguish between relevant/irrelevant information in order to assemble an accurate problem description Quantitative observations are observations that can be precisely measured. (i.e. There is taking an additional 20 seconds per connection over the connection times this morning.) Qualitative observations have more to do with characteristics of what is being observed. (i.e. It seems to be taking longer to connect than it did this morning.)

81

82 Review the network map in order to determine the status of objects Explain the status icons of objects on the map Explain what virtual servers, pools, nodes and pool members are

83 Use the dashboard to gauge the current running status of the system Interpret each of the statistic types displayed by the dashboard Given a situation, predict the appropriate dashboard statistics

84 Review log files and identify possible events Given log file snippets, describe an event sequence Given log file snippets, identify critical events

85 Use iapps Analytics to gauge the current running status of application services Explain the purpose of iapps Analytics

86 Describe how to capture application statistics

87 Use iapps Analytics to gauge the current running status of application services Describe how to capture application statistics

88 Use iapps Analytics to gauge the current running status of application services Explain the purpose of iapps Analytics Describe how to capture application statistics Given a current running status, recognize significant statistics

89 Response Code Example

90 Latency per URL Latency per Pool Member

91

92 Create and restore a UCS archive under the appropriate circumstances Discuss scenarios in which restoring a UCS archive is appropriate Discuss the tasks involved in successfully restoring a UCS archive

93 Create and restore a UCS archive under the appropriate circumstances Discuss scenarios in which restoring a UCS archive is appropriate Discuss the tasks involved in successfully restoring a UCS archive tmsh load sys ucs [ucs file name e.g. /var/local/ucs/filename.ucs ] no-license

94 Create and restore a UCS archive under the appropriate circumstances Discuss scenarios in which restoring a UCS archive is appropriate Discuss the tasks involved in successfully restoring a UCS archive Given a scenario, discuss when it is appropriate to create a UCS archive

95 Objective 7.02 Identify which high-level tasks can be automated using BIG-IQ

96 Objective 7.02 Identify which high-level tasks can be automated using BIG-IQ

97 Objective 7.02 Identify which high-level tasks can be automated using BIG-IQ

98 Objective 7.03 Manage software images

99 Objective 7.03 Manage software images

100 Objective 7.03 Manage software images

101 Given an HA pair, describe the appropriate strategy for deploying a new software image Given an HA pair, describe the appropriate strategy for deploying a new software image Describe the potential impact of booting a device into another volume Discuss common issues related to the migration of a device to a new software version # # Licensing Information # Licensed date : License start : License end : Service check date : # # Platform Information # Registration Key : NHQRP-YWHGO-WFQJK-YAZTM-FHJYBFE Licensed version :

102 Given an HA pair, describe the appropriate strategy for deploying a new software image Given an HA pair, describe the appropriate strategy for deploying a new software image Describe the potential impact of booting a device into another volume Discuss common issues related to the migration of a device to a new software version Unit A Active Unit B Standby Active Volume Active Volume

103 Objective 7.05 Understand the processes of licensing, license reactivation, and license modification (add-ons) Understand the processes of licensing, license reactivation, and license modification (add-ons)

104 Objective 7.05

105 Objective 7.05

106 Objective 7.06 Identify which modules are licensed and/or provisioned Identify which modules are licensed and/or provisioned

107 Objective 7.07 Explain how to create a user Explain how to create a user

108 Objective 7.08 Explain how to modify user properties Explain how to modify user properties

109

110 Modify and manage virtual servers Given a proposed virtual server configuration change, outline the scope of the change and for which connections those changes will affect (active connections, new connections, persisted sessions) Given a description of an application, identify the correct virtual server configured for it (HTTP/HTTPS, TCP/UDP, VLANs enabled, route-domain) Given a situation where a virtual server configuration change did not appear to immediately take effect, determine why

111 Modify and manage pools Distinguish between disabling a member and forcing it down Determine use cases for disabling a member Determine use cases for forcing down a member Given a situation where a pool member has been disabled but still appears to be receiving traffic, determine the cause Articulate the characteristics of a pool member that has been disabled or forced offline (Such as for new connections, persisted connections, etc.)

112

113