Deep Dive on F5 BIG-IQ, BIG-IP and Cisco.pdf
- 1. Deep Dive on F5 BIG-IQ, BIG-IP and Cisco ACI for Applications Deployment Payal Singh, Solution Engineer, F5 Networks February, 2016
- 2. © F5 Networks, Inc 2 Abstract Learn how F5 BIG-IP and BIG-IQ integrate with Cisco Application Centric Infrastructure (ACI) to deploy applications with agility and consistency. Understand F5 integrations models with Cisco ACI, learn the details of F5 device package and take a look at the latest offerings in F5 ACI solution. Learn how F5 BIG-IQ and iApps enhance L4-L7 services in ACI for a true application centric approach that leverage higher functionality including additional F5 modules.
- 3. © F5 Networks, Inc 3 Agenda • ACI L4 –L7 Service Insertion Overview • F5 and Cisco ACI integration Models • Device Package 2.0 Update • F5 Static Device Package • F5 dynamic Device Package • F5 ACI Design / Deployment Use Case and implementation
- 4. © F5 Networks, Inc 4 F5 and Cisco ACI Joint Solution Benefits ACI Fabric Programmability (iRules / iApps / iControl) Data Plane Control Plane Management Plane F5 Synthesis Fabric Virtual Edition Appliance Chassis F5 DEVICE PACKAGE FOR APIC • Preserves richness of F5 Synthesis offering. Ease of integration due to rich programmability • Existing F5 Physical and Virtual appliances, topologies integrate seamlessly with Cisco ACI • Maintains operational best practices & offers faster provisioning of workflows • Automated L4-L7 application service insertion • Accelerated application deployments with scalable L4-L7 services • Application agility & significant reduction in operating costs
- 5. © F5 Networks, Inc 5 Understand F5 Components BIG-IP is the name of the platform produced by F5, provide Application Delivery Controller (ADC) functionality. F5 BIG-IP offers virtual, appliance or chassis form factor LTM is the Local Traffic Manager, it is a licensed software module run inside a F5 BIG-IP. LTM handles server load balancing function. In the 1st release, F5 integrated LTM into ACI Virtual Server is the traffic management object on the BIG-IP system that represented by an IP address and a port. VIP = Virtual IP + Port Virtual Edition Appliance Chassis BIG-IP LTM Local Load Balancing
- 6. © F5 Networks, Inc 6 Understand F5 Components iApps is a user-customized framework for deploying applications, providing a flexible way to automate tasks and templatize functionality on F5 gear. iApp can be F5 verified or customer defined. iApp is based on APL (Application Presentation Language) iRules is a highly customized, TCL-based scripting language that allows programmatic access to traffic on the wire. You can apply an iRules to an existing virtual server to inspect / analyze / modify / route / manipulate the traffic BIG-IQ is an intelligent framework for managing application services BIG-IQ Cloud injects application specific layer 4–7 intelligence into Cisco ACI. BIG-IQ Cloud generates a catalog of iApps used by all of your BIG-IP devices and makes that catalog available in your orchestration solution iApps iRules BIG-IQ Cloud iApps lifecycle management Cloud connectors
- 7. ACI L4 –L7 Service Insertion Overview
- 8. © F5 Networks, Inc 8 Service Insertion Ext Users EPG EXT Web Server EPG WEB Application Construct Node inst inst … firewall inst inst … ADC: Virtual Server graph …. start end stage 1 ….. stage N Concrete Device Concrete Device Logical Device Cluster Provide Consume • Web Farm provide services to External Users; • Policy Contract defines relationship between Web Farm and Users • Users assign to EPG EXT • Web Farm assign to EPG WEB • Service Graph Insertion at the Policy Contract Subject level • Service Graph contains Function Nodes • Virtual Server is a Function Node • F5 BIG-IPs are Concrete Devices belong to a Logical Device Cluster that enables ADC as a function Node within a Service Graph
- 9. © F5 Networks, Inc 9 Goals of APIC Service Insertion and Automation Configure and Manage VLAN allocation for service insertion Configure the network to redirect traffic through service device Configure network and service function parameters on service device
- 10. © F5 Networks, Inc 10 APIC requires a Device Package to communicate with service devices. A Device Package is a zip file containing two parts: Device Specification (xml): The configuration of the APIC is represented as an object model consisting of a large number of Managed Objects (MOs). These Managed objects represent BIG-IP functions that can be configured and parameters needed to achieve those functions DeviceScript (py): The integration between the APIC and a Device is performed by a DeviceScript, which maps APIC events function calls defined in Device Script Device Script APIC Configuration through UI or North Bound APIs Device Package (uploaded to APIC) BIG-IP Physical or VE EPG level L4-L7 config Service Graph Function Node level L4-L7 config Python iControl / SouthBound API Device Specification ACI Service Automation through F5 Device Package
- 11. F5 and Cisco ACI Integration Models
- 12. © F5 Networks, Inc 12 F5 and Cisco ACI Integration Models ACI Fabric BIG-IP EPG mode – NOT using service graph OPTION A1 Virtual Edition Appliance Chassis BIG-IP Service Insertion using F5 Static device package OPTION B BIG-IQ Cloud Service Insertion using F5 Dynamic device package OPTION C Unmanaged mode – USING service graph OPTION A2 BIG-IP connects to ACI, NOT managed by APIC
- 13. © F5 Networks, Inc 13 Option A1 and Option A2 EPG/Unmanaged Mode (Option A1 and A2) •Define connectivity to ACI Fabric •No Service Insertion •No device package •BIG-IP device is not provisioned/managed through APIC EPG Mode (Option A1) Unmanaged Mode (Option A2) No service graph representation • Manual binding of VLAN’s, binding contracts to EPG’s Service graph representation • Automatic binding of VLAN’s and contracts Manual configuration to steer traffic • One Application tier -> Chain of L4-L7 service devices -> To another application tier Automatically steer traffic • One application tier -> Chain of L4-L7 service devices -> To another application tier DIFFERENCES
- 14. © F5 Networks, Inc 14 Differences - Option B and Option C Option B Option C F5 Static device package • Obtained from http://downloads.f5.com • Fixed set of BIG-IP parameters configurable • Does not support adding more feature functionality on BIG-IP than present in basic load balancing device package F5 Dynamic device package • Obtained from the BIG-IQ • Dynamic set of BIG-IP parameters configurable • Through the iApp there is support to add as many features to the BIG-IP as the iApp can support Not based on iApp templates Based on iApp templates LTM module support LTM/ASM/AFM/APM modules can be supported Option B F5 Static Device Package Option C F5 Dynamic Device Package
- 15. © F5 Networks, Inc 15 Integration Models with ACI (Option B and Option C) ACI Fabric Virtual Edition Appliance Chassis Dynamic Device Package Static Device Package F5 Static Device Package Deployment Model F5 Dynamic Device Package Deployment Model 1 2 4a Integration with APIC (Option C) • Upload iApp template to BIG-IP • BIG-IP expose iApps to BIG-IQ during device discovery by BIG-IQ • BIG-IQ create custom device package based on catalogs created • Admin import BIG-IQ device package to APIC • APIC sends iApp config to BIG-IQ -> BIG-IP • APIC sends Device config to BIG-IP Integration with APIC (Option B) • Obtain device package from downloads.f5.com • Admin import device package to APIC • APIC sends config to BIG-IP directly 3 3 2 4b 1 F5 Synthesis Fabric Static Device Package F5 Configuration {'state': 1, 'transaction': 0, 'ackedState': 0, 'value': {(5, 'DestinationNetmask', 'Netmask1'): {'state': 1, 'transaction': 0, 'ackedState': 0, 'value': '255.255.255.255'}, (5, 'DestinationPort', 'port1'): {'state': 1, 'transaction': 0, 'ackedState': 0, 'value': '80' Dynamic Device Package F5 iApps Config {'state': 1, 'transaction': 0, 'ackedState': 0, 'value': {(5, 'DestinationNetmask', 'Netmask1'): {'state': 1, 'transaction': 0, 'ackedState': 0, 'value': '255.255.255.255'}, (5, 'DestinationPort', 'port1'): {'state': 1, 'transaction': 0, 'ackedState': 0, 'value': '80' F5 Device Config {'state': 1, 'transaction': 0, 'ackedState': 0, 'value': {(5, 'DestinationNetmask', 'Netmask1'): {'state': 1, 'transaction': 0, 'ackedState': 0, 'value': '255.255.255.255'}, (5, 'DestinationPort', 'port1'): {'state': 1, 'transaction': 0, 'ackedState': 0, 'value': '80'
- 16. © F5 Networks, Inc 16 Version compatibility - F5 Static Device Package (Option B) Version 1.2 Version 2.0 BIG-IP Software Versions 11.6.0 11.5.3 HF2 and 11.6.0 HF6 APIC Release Version 1.2 Version 2.0 Version 2.0(*) 1.1(1o), 1.1(2h) NA NA 1.1(3f) 1.1(4e) 1.2(1i) 1.2(2*) - Q1CY16 Q1CY16 EA– Chassis Manager Q1CY16 GA– Chassis Manager Validation based on customer needs
- 17. © F5 Networks, Inc 17 Version 2.0 Software Versions BIG-IP - 11.5.3 HF2 and 11.6.0 HF6 BIG-IQ - 1.0 APIC Release Version 2.0 Version 2.0(*) 1.1(3f) 1.1(4e) 1.2(1i) 1.2(2*) - Q1CY16 Q1CY16 EA– Chassis and Device Manager Q1CY16 GA– Chassis and Device Manager Version compatibility - F5 Dynamic Device Package (Option C) Validation based on customer needs
- 18. Device Package 2.0 – Common Features Option B and Option C
- 19. © F5 Networks, Inc 19 Common Functionality (Option B and Option C) Operational • Supports any BIG-IP physical and virtual form factor running • Does not require any new module installation on the BIG-IP • BIG-IP is licensed and OOB management configured prior to APIC integration • Supports BIG-IP Active / Standby High Availability model per APIC logical device cluste Features • Chassis Manager - vCMP (Virtualized Clustered Multiprocessing) HA – Q1CY16 • Pre-requisite: vCMP guests already deployed • Allow user to specify unique vCMP host for each vCMP guest • vCMP guests - Active / Standby • Supports Dynamic endpoint attach and detach notifications • True multi- tenancy • Tenant + VRF on ACI => Partition + Route Domain on BIG-IP • Service Graph on ACI => Virtual Server on the BIG-IP
- 20. F5 Static Device Package Option B
- 21. © F5 Networks, Inc 21 F5 Static DP 2.0 – Option B Functions • Virtual Server Layer 4 Server Load balancing Layer 4 SLB with SSL offload Layer 7 Server Load balancing Layer 7 SLB with SSL offload Parameters under Virtual Server • Configuring Tenant Self IP addresses • Configuring Tenant static routes • Monitors • Server Pools • HTTP Profiles • FastL4 Profiles • HTTP Redirect • Reference iRules • Address Translation (None / SNAT / Automap) • Reference Persistence Profiles BIG-IP Device Package can be obtained from downloads.f5.com Device Package version 1.2 + Bug Fixes
- 22. F5 Dynamic Device Package Option C
- 23. © F5 Networks, Inc 23 F5 Dynamic DP 2.0 – Option C • Device Package dynamically generated by BIG-IQ • Device Manager - BIG-IQ HA – Q1CY16 • Pre-requisite: BIG-IQ already in HA (Active/Active) • Allow user to specify 2 BIG-IQ through APIC • Support BIG-IQ validated workflows using iApps
- 24. BIG-IP ACI Design and Deployment
- 25. © F5 Networks, Inc 25 Cisco ACI Architecture BIG-IP Physical 1 ARM and 2-ARM + HA Active Standby External / Internal External / Internal Physical 1-ARM topology + HA pair Active Standby External Physical 2-ARM topology + HA pair Internal External Internal BIG-IP connects to any Leaf in ACI topology independent of Leaf location PLATFORM INDEPENDENT – ANY HW MODEL AND VIRTUAL EDITION CAN BE USED WITH THE ACI FABRIC
- 26. Design / Deployment EPG Mode - Option A1
- 27. © F5 Networks, Inc 27 BIG-IP Attached as an EPG – Design Allow full F5 BIG-IP features; BIG-IP HA through ACI fabric; Utilize existing F5 management model BIG-IP attach to the ACI fabric as an EPG, all BIG-IP configurations will be done through BIG-IP MGMT L4-L7 (F5) Requirements Proposed Solution BIG-IP in 1 ARM or 2 ARM; SNAT or NONE; BIG-IP GW to Firewall; HA failover group Design Considerations WEB BD FW-to- Internet BD F5 BD Web EPG (Provider) F5 EPG (Consumer/Provider) ACI Fabric L3 out EPG (Consumer) Contract Contract F5 BIG-IP Web EPG F5 EPG L3 out EPG Internet Web Servers Client F5 BIG-IP GOAL - Phases approach, where phase 1 move network elements to ACI policy model; L4-L7 elements remain to be controlled by existing operation framework
- 28. Design / Deployment Unmanaged Mode - Option A2
- 29. © F5 Networks, Inc 29 Unmanaged Mode • Provides service graph representation with Unmanaged and Managed modes mixed • Few devices managed by APIC, few devices NOT managed by APIC • BIG-IP attached as an EPG - but now being able to represent this mode within a service graph EPG FW F5 ADC EPG MANAGED MODE DEVICE PACKAGE UNMANAGED MODE NO DEVICE PACKAGE Service Graph Contract • Service Chaining (traffic redirection) through ACI • Device configuration through APIC (Policy based configuration) Service Chaining (traffic redirection) through ACI
- 30. © F5 Networks, Inc 30 EPG Mode (2 Contracts ) Unmanaged Mode (1 Contract ) EPG CONTRACT EPG Service Graph EPG C1 EPG C2 EPG vs Unmanaged mode – Implementation
- 31. Design / Deployment Service Insertion using Static Device Package - Option B
- 32. © F5 Networks, Inc 32 ACI Service Insertion using Option B– Design BIG-IP ACI Service Insertion using ADC One-Arm mode or Two-ARM mode L4-L7 (F5) Requirements Proposed Solution One-Arm - BIG-IP EPG BD same as Provider EPG BD, SNAT Pool or Automap Two-Arm - SNAT None, server default GW to BIG-IP Design Considerations WEB BD FW-to- Internet BD Web EPG (Provider) ACI Fabric L3 out EPG (Consumer) F5 BIG-IP Web EPG L3 out EPG Internet Web Servers Client F5 BIG-IP Contract with Service Insertion Logical Device Cluster One ARM - VIP and servers on the same subnet Two ARM - Server need to see client real IP
- 33. Design / Deployment Service Insertion using Dynamic Device Package - Option C
- 34. © F5 Networks, Inc 34 ACI Service Insertion using Option C : Deploy iApps through BIG-IQ Goal Leverage BIG-IQ to bring iApps into ACI intelligently Active Standby External / Internal External / Internal
- 35. © F5 Networks, Inc 35 ACI Service Insertion using Option C– Design TCP Profiles, Source Port Change, Multiple iRules, SNAT Pool, client / server same subnet, VIP separate subnet Device package generated by BIG-IQ leverage custom made iApps L4-L7 (F5) Requirements Proposed Solution BIG-IP in 1-Arm vs BIG-IP in 2-Arm (Same considerations as Option B integration) Design Considerations Default BD F5 BD App EPG (Provider) ACI Fabric F5 BIG-IP App EPG Web Servers F5 BIG-IP Contract with Service Insertion Logical Device Cluster Default BD Client EPG (Consumer) Client EPG
- 36. © F5 Networks, Inc 36 Revisit iApps Benefits • User-customizable • Easy editing of configurations and cleanup • Configuration encapsulation • Strictness protects against accidental changes to the configuration • Operational tasks and health status for App objects displayed on App-specific component view • Copy/Import/Export capability • Community support for DevCentral hosted templates • iApps is the BIG-IP® system framework for deploying services-based, template-driven configurations on BIG-IP systems • Deployment process of an iApps Template which bundles all of the configuration options for a particular application together
- 37. © F5 Networks, Inc 37 Revisit iApps iApps present on BIG-IP Provide values to the iApps that includes all the virtual server requirements Virtual Server Address : Port Pool member : Port Save iApp – Configuration pushed to BIG-IP
- 38. © F5 Networks, Inc 38 ACI Service Insertion using Option C - Integration Workflow Upload iApps template to BIG-IP Discover BIG-IP • Using BIG-IQ Device, discover the seeded BIG-IP to expose iApps to BIG-IQ Associate Connector • Using BIG-IQ connector , assign the APIC connector to the BIG-IP device
- 39. © F5 Networks, Inc 39 ACI Service Insertion using Option C - Integration Workflow Download customized device package • User can download a device package based on the BIG-IQ catalog selection Make an application catalog template • Through BIG-IQ Catalog, create a New Template that utilize iApps on BIG-IP. User can decide which parameters are exposed to APIC; as well as set default values
- 40. © F5 Networks, Inc 40 ACI Service Insertion using Option C - Integration Workflow Create a service graph in APIC by using the catalog Upload the device package to APIC • This will make all the customized catalogs created visible in APIC
- 41. © F5 Networks, Inc 41 ACI Service Insertion using Option C - Integration Workflow Virtual Server deployed thru iApps APIC Tenant info pushed to BIG-IQ Pool Members Configure and deploy service graph • Only tenant editable parameter are expose • At this point all the relevant configuration will be pushed to BIG-IQ -> BIG-IP
- 42. © F5 Networks, Inc 42 Use Case – Redirect Request from HTTP to HTTPS Configure customized catalog • Virtual Server address – Tenant editable ‘True’ • Virtual server port – 443 • Client SSL certificates Once deployed - The iApp will create two virtual servers • One listening on port 80 • http profile and redirect iRule("_sys_https_redirect") assigned • One listening on port 443 • http profile, client SSL offload profile, pool assigned • Request to port 80 will be redirected to port 443 Follow workflow to deploy a graph using APIC • Only tenant editable parameters visible in APIC (Virtual Server address and SSL certs – no Port) Virtual Server Address : Port 443 Virtual Server Address : Port 80
- 43. References
- 44. F5 Agility 2015 44 Reference Material For Your Reference i • F5 and Cisco ACI – Design Guide http://www.cisco.com/c/dam/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/white-paper-c11-735490.pdf • F5 and Cisco ACI – Deployment Guide http://www.cisco.com/c/dam/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/guide-c07-736160.pdf • F5 and Cisco ACI: Solution Profile http://www.cisco.com/c/dam/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/guide-c07-736160.pdf • F5 BIG-IP: Workload Migration from Traditional Networks to Cisco ACI: Design Guide http://www.cisco.com/c/dam/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/guide-c07-733816.pdf • Automate Application Deployment with F5 LTM and Cisco ACI: White Paper http://www.cisco.com/c/dam/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/white-paper-c11-732413.pdf • Cisco Validated Design (CVD) on F5 BIG-IP LTM and Nexus 9000: White Paper http://www.cisco.com/c/dam/en/us/td/docs/solutions/Enterprise/Data_Center/VMDC/BIG-IP-LTM/CiscoVMDCwithF5_BIG-IP_LTM_WhitePaper.pdf • Implementing Cisco Nexus 9000 Series NX-OS Mode with F5 Networks’ BIG-IP Local Traffic Manager: White Paper http://www.cisco.com/c/dam/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/solution-overview-c22-732522.pdf • FlexPod Datacenter with Microsoft Exchange 2013, F5 Big-IP and Cisco Application Centric Infrastructure http://www.cisco.com/c/dam/en/us/td/docs/unified_computing/ucs/UCS_CVDs/exchange2013_aci_flexpod_vmware_design.pdf • FlexPod Datacenter with Microsoft SharePoint 2013 and Cisco Application Centric Infrastructure (ACI) http://www.cisco.com/c/dam/en/us/td/docs/unified_computing/ucs/UCS_CVDs/sharepoint2013_aci_flexpod_vmware_deploy.pdf • Secure ACI Data Centers: Deploying Highly Available Services with Cisco and F5 http://www.cisco.com/c/dam/en/us/solutions/collateral/enterprise-networks/secure-data-center-solution/secure-aci-datacenterr.pdf https://f5.com/solutions/technology-alliances/cisco http://www.cisco.com/c/en/us/solutions/data-center-virtualization/application-centric-infrastructure/white-paper-listing.html
- 45. © F5 Networks, Inc 45 DevCentral F5 User Community Over 220,000 Members in 191 Countries and Growing! References • Wikis • API/SDK Documentation Resources • Sample Code • Tech Tips • Forums • Podcasts • Blogs Tools and Frameworks • iRule Editor • iControl SDK • NET, Java, Python, Powershell,
- 46. F5 Agility 2015 46 Key Takeaways
- 47. Cisco Live Berlin 2016 https://f5.com/solutions/technology-alliances/cisco