Transcript BIG-IP v9 - Arrow ECS

1
F5
Application
Traffic
Management
Radovan Gibala
Field Systems Engineer
[email protected]
+420 731 137 223
2007
2
Business
Continuity HA
Disaster
Recovery
App
Security
& Data
Integrity
• AAA
• Data
Protection
• Transaction
Validation
• WAN Virtualization
• File Virtualization
• DC to DC
Acceleration
• Virtualized VPN
Access
People
People
User
Experience
& App
Performance
• Asymmetric &
Symmetric
Acceleration
• Server Offload
• Load Balancing
Apps
Apps Data
• Virtualized App &
Infrastructure
• Server & App Offload
• Load Balancing
Managing
Scale &
Consolidatio
n
Data
•
•
•
•
• Remote, WLAN & LAN
Central Policy Enforcement
• End-Point Security
• Encryption
• AAA
Unified
Security
Enforcement
& Access
Control
Virtualization
Migration
Tiering
Load
Balancing
Storage
Growth
3
Application Delivery
Network
BIG-IP LTM
• ASM
FirePass
App
Security
& Data
Integrity
• AAA
• Data
Protection
• Transaction
Validation
Business
Continuity HA
Disaster
Recovery
BIG-IP LTM • GTM •
LC • WA
FirePass • ARX •
WJ
• WAN Virtualization
• File Virtualization
• DC to DC
Acceleration
• Virtualized VPN
Access
User
Experience
& App
Performance
• Asymmetric &
Symmetric
Acceleration
• Server Offload
• Load Balancing
People
BIG-IP LTM • GTM •
WA ARX • WJ
Apps Data
Managing
Scale &
Consolidatio
n
• Virtualized App &
Infrastructure
• Server & App
Offload
• Remote, WLAN & LAN
• Load Balancing
Central Policy
Enforcement
• End-Point Security
• Encryption
• AAA
•
•
•
•
Virtualization
Migration
Tiering
Load
Balancing
BIG-IP LTM • GTM •
LC • WA
FirePass • ARX • WJ
Unified
Security
Enforcement
& Access
Control
FirePass
BIG-IP LTM • GTM
Storage
Growth
ARX
BIG-IP
GTM
4
How To Achieve the Requirements ?
Multiple Point Solutions
Application
More
Bandwidth
Network Administrator
Add More
Infrastructure?
Application Developer
Hire an Army of
Developers?
5
The Result: A Growing Network Problem
Users
Mobile Phone
Network Point Solutions
DoS Protection
Rate Shaping
SSL
Acceleration
PDA
Laptop
Desktop
Co-location
Applications
CRMCRM
Server Load
Balancer
Content
Acceleration
Application
Firewall
Connection
Optimisation
Traffic
Compression
SFA
ERP
ERP
ERP
CRM
SFA
Customised
Application
SFA
6
F5’s Integrated Solution
Users
The F5 Solution
Applications
Application Delivery Network
CRM
Mobile Phone
Database
Siebel
BEA
PDA
Legacy
.NET
SAP
Laptop
PeopleSoft
IBM
ERP
Desktop
Co-location
TMOS
SFA
Custom
7
A New Level of Intelligence
Legacy Approach
Packet
Based
React to a Single Communication, One Direction
Flow
Based
TM/OS
React to a Real Time, Two-Way Conversation
Translate Between Parties
8
Deliver Application Exactly as
Intended
Manage Entire Application Flows:
•
•
•
Independent Connection Control
Supporting All IP Applications
High Performance Framework
•
•
BI-Directional, Full Payload
Inspection
Session Level Control
Universal Inspection Engine (UIE)
TM/OS
Fast Application Proxy
Client
Side
Server
Side
9
The Most Intelligent and Adaptable Solution
iRules
Programmable Network Language
Programmable
Application
Network
GUI-Based Application Profiles
Repeatable Policies
Unified Application Infrastructure Services
Targeted and
Adaptable
Functions
Security
Optimisation
Delivery
New Service
Universal Inspection Engine (UIE)
Complete Visibility
and Control of
Application Flows
TM/OS
Fast Application Proxy
Client
Side
Compression
News Website
TCP Offloading
Load Balancing
Server
Side
10
Traffic Management Operating System
iRules
Rate Shaping / Rate Limiting
Resource Cloaking
Transaction Assurance
Universal Persistence
Caching
Compression
Selective Content Encryption
Advanced Client Authentication
Application Health Monitors
Application Switching
Shared Application Services
TMOS
Operating System
Shared Network Services
TCP Express
Protocol Sanitization
High Performance SSL
DoS and DDoS Protection
VLAN Segmentation
Line Rate L2 Switching
(Mirroring, Trunking, STP, LACP)
IP Packet Filtering
IPv6
Dynamic Routing
Secure Network Address Translation
Port Mapping
Common Management Framework
11
TCP Express
Server
Side
OneConnect
Client
Side
Compression
TCP Proxy
3rd Party
Web Accel
XML
Caching
SSL
TCP Express
Client
Rate Shaping
Microkernel
TrafficShield
Unique TMOS Architecture
iRules
High Performance HW
iControl API
TMOS Traffic Plug-ins
High-Performance Networking Microkernel
Powerful Application Protocol Support
iControl – External Monitoring and Control
iRules – Network Programming Language
Server
12
BIG-IP v9
13
Market Leading Functionality Today
• Comprehensive Load Balancing
• Advanced Application Switching
• Customised Health Monitoring
• Intelligent Network Address Translation
• Advanced Routing
• Intelligent Port Mirroring
Deliver
• SSL Acceleration
• Quality of Service
Optimise
Secure
• DoS and SYN Flood
Protection
• Network Address/Port
Translation
• Application Attack
Filtering
• Certificate
Management
14
First Unified Application Infrastructure
Services
• IPv6 Gateway
New
• Universal Persistence
• Response Error Handling
• Session / Flow Switching
Deliver
New
New
• Connection Pooling
• Intelligent Compression
• L7 Rate Shaping
• Content Spooling/
Buffering
• TCP Optimisation
• Content Transformation
TM/OS
Optimise
Secure
• Resource Cloaking
• Advanced Client
Authentication
• Firewall - Packet Filtering
• Selective Content
Encryption
• Cookie Encryption
• Content Protection
• Protocol Sanitisation
15
Most Intelligent and Adaptable Solution Delivering
Unmatched Services
F5
Load Balancing
Application Switching
Response Error Handling
IPv6 Gateway
Universal Persistence
Compression
Connection Optimisation
Content Spooling
L7 Rate Shaping
Content Transformation
High Performance SSL Encryption
Cookie Encryption
Resource Cloaking
Advanced Client Authentication
DoS and Network Firewall
Content Protection
Protocol Sanitisation

















16
Comprehensive Load Balancing
Static
– RoundRobin
– Ratio
Dynamic
–
–
–
–
–
Fastest
LeastConnections
Observed
Predictive
Dynamic Ratio
Priority Groups
17
Feature Overview/BIG-IP
Availability Checking
• Check any back-end process using EAV
• Will work for any IP based application
• Stateful failover between devices
Security
• Firewall-like device to resist most attacks
• All administration is encrypted
• Integrated SSL/FIPS and secure NAT
18
Feature Overview/BIG-IP
SSL and E-Commerce
• Only product with integrated SSL
• Single certificate simplifies administration
• Lowers certificate costs
• Client certificate checking (Authentication)
Layer 7 Functionality
• Can utilize all HTTP header/content or TCP content in
traffic decisions
• Can persist on anything
• HTTP 1.1 keep-alives dramatically improve
performance
19
Feature Overview/BIG-IP
Easy to Implement and Support
• Can be deployed as either Layer 2 or 3 device
• Simple and complete Graphical User
Interface
• Installation services by F5 and/or partner
Flexibility
• BIG-IP works with any server or IP based
service
• iControl enables integration with internal
and/or 3rd party applications
20
Powerful and Simplified Management
“We have to deal with multiple products. The new user interface makes every other
solution in this space look absolutely immature. F5’s solutions are 10 times easier
to manage than Cisco.” - Major US Hosting Provider
21
Profile Based Management
Profile Based
Traffic
Management
Improved vision of
all resources and
traffic
Deliver
Optimize
Secure
22
Ensure Higher Availability - Superior
System Design
Processes Reporting and Control – Granular status, logging and
configurable actions for component-level failures. Capable of
warm restarts and upgrades.
3-way HA Design – Robust Internal system checking and passthrough design.
23
Extensibility - IPv6 Gateway
24
BIG-IP Security Add-On Modules
Application Security Module
SSL Acceleration
Protect applications and data
Protect data over the Internet
Advanced Client
Authentication Module
Protect against unauthorised
access
25
BIG-IP Software Add-On Modules
Quickly Adapt to Changing Application & Business Challenges
Compression Module
Increase performance
Webaccelerator
- Fast Cache Module
Offload servers
Rate Shaping Module
Reserve bandwidth
26
Intelligent HTTP Compression
Most Intelligent and flexible solution to target HTTP
compression where it matters most
URI/content filters – allow/disallow lists
–
Compress only specified file types
–
Based on URI or MIME type
Client-aware compression (patent pending)
–
Based on TCP latency – observe client RTT
–
Based on low bandwidth client connections
Granular L7 based compression
Tunable resource allocation
–
Devote more memory and CPU cycles for high
priority compression jobs
Adaptable Compression
–
Scale back compression based on CPU load
27
Real Time Compression Tool
www.f5demo.com/compression
28
OneConnect ™ – Connection Pooling
Increase server capacity by 30%
–
Aggregates massive number of client requests into fewer server
side connections
Transformations form HTTP 1.0 to 1.1 for Server Connection
Consolidation
Maintains Intelligent load balancing to dedicated content servers
Good Sources:
http://tech.f5.com/home/bigip/solutions/traffic/sol1548.html
http://www.f5.com/solutions/archives/whitepapers/httpbigip.html
29
OneConnect ™ New and Improved
HTTP Request Pooling
b.gif
c.asp
a.gif
20
index.htm
1
b.gif c.asp a.gif index.htm
•
Streamlines single client
request to BIG-IP
•
Enabled by HTTP 1.1
•
Avg. Reduction is 20 to 1 per
Web Page
•
Intelligent load balancing to
dedicated content servers
•
Maintain Server Logging
•
Transformation form HTTP 1.0
to 1.1 for Server Connection
Consolidation
1) OneConnect ™ Content Switching
b.gif c.asp a.gif index.htm
index.htm
HTML server pool
b.gif
GIF server pool
a.gif
c.asp
2) OneConnect ™ HTTP transformations
b.gif
c.asp
a.gif
index.htm
ASP server pool
New
One
b.gif c.asp a.gif index.htm
Many
3) OneConnect ™ Connection Pooling
b.gif c.asp a.gif index.htm
•
Aggregates massive number
of client requests into fewer
server side connections
Server
sales.htm e.gif
d.gif
f.asp
b.gif sales.htm c.asp
e.gif
a.gif
d.gif index.htm f.asp
30
Content Spooling
Problem: TCP Overhead on Servers
– There is overhead for breaking apart…”chunking”
content
– Client and Server negotiate TCP segmentation
– Client forces more segmentation that is good for the
server
– The Servers is burdened with breaking content up
into small pieces for good client consumption
Solution
Spoon feed
clients
Slurp up server
response
Benefit: Increases server capacity up to 15%
31
L7 Rate Shaping
Integrated and Fine Grained Bandwidth Control
Rate Class
Sophisticated Bandwidth Control
– Flexible bandwidth limits
– Full support for bandwidth borrowing
– Traffic queuing (stochastic fair queue,
FIFO ToS priority queue)
Granular Traffic Classification
L2
through L7
– iRules support can initiate a rate class
on any traffic flow variable
Only Multi Direction Control
– Control throughput in any direction
Ceiling Rate
Burst
Base
WAN
Network
Segments
Pool of
Servers
32
Hardware
33
Hardware
Performance
–
–
–
–
–
–
–
High Performance Switching Fabric
Dual Processor
Packet Velocity ASIC (PVA2)
SSL Transactions per Second (TPS)
SSL Bulk Encryption
FIPS Support
HTTP Compression
Independent Secure Management Access
SCCP Microcomputer - Switch Card Control
Processor
34
Hardware cont.
Dual Media CF + HDD
Tri-Speed Ethernet (10/100/1000) + Mini
GBICs
10 Gbps Interfaces
LCD Display
USB Port
Hot Swappable Fan Trays + Power Supplies
 Integrated Solution
35
Hardware Manageability and Performance
Unique IP Application Switches
8800
8400
6800
6400
3400
Simplified Management:
Lights Out Management
Multi-Boot Support
LCD for Simplified Management
Hot-Swappable Parts
Redundant Power / Fans
Port Flexibility
PCI Slots
Independent Secure Management
Powerful:
Packet Velocity ASIC 2
1500
High Performance SSL &
Compression
High Performance Switching Fabric
Dual Processor
*All Models Include 100 TPS SSL Acceleration
36
Up-selling Platforms
1500 to 3400
–
–
–
–
Packet Velocity ASIC
2x performance (Throughput, L4, SSL, etc)
Better multi-function support – more modules
Better management and logging (Compact Flash and Hard
Drive)
3400 to 6400
–
–
–
–
2x Performance and up (throughput, SSL, etc)
Superior multi-function support – more modules
Expandable PCI Slots (future hardware acceleration cards)
Hardware redundancy and extensibility (accessible Compact
Flash, dual power supply and fan tray)
37
Introducing the BIG-IP 1500
The next-generation BIG-IP 1000 and BIG-IP 520
1U Height – New USB Port, LCD Display & Keypad
4 10/100/1000 Copper Ethernet Ports
2 Optional Gigabit Fiber Ports
Hard Drive
1 PCI Add-in Card Slot
Integrated Management Computer (lights-out
management)
38
Introducing the BIG-IP 3400
The next-generation BIG-IP 2400 and BIG-IP 540
The benefits of an ASIC with the flexibility and ease of an appliance
1U Height – New USB Port, LCD Display & Keypad
Packet Velocity ASIC 2
8 10/100/1000 Copper Ethernet Ports
2 Optional Gigabit Fiber Ports
Compact Flash & Hard Drive – Improved Logging
1 PCI Add-in Card Slot
Integrated Management Computer (lights-out
management)
39
Introducing the BIG-IP 6400
The next-generation BIG-IP 5100 and BIG-IP 5110
The most powerful and flexible BIG-IP platform ever
2U Height – New USB Port, LCD Display & Keypad
Dual Processors
Packet Velocity ASIC 2
16 10/100/1000 Copper Ethernet Ports
2 Standard, 2 Optional (Total 4) Gigabit Fiber Ports
Field Accessible Compact Flash & Hard Drive – Improved Logging
3 PCI Add-in Card Slots
Hot Swappable Redundant Power Supplies
Integrated Management Computer (lights-out management)
40
Viprion Overview
Unmatched Performance
– Massive scalability
– Processing architecture common with 8800
Intelligent clustering
– SuperVIP (Virtuals can seamlessly span blades)
– N+M redundancy for all features in cluster
High Availability
– Automatic failover within cluster
– Chassis-to-chassis redundancy
Full Modular Chassis
– 4 blade slots w/1 blade type
– 1 blade type
– Any blade can be chassis master
Common central management console
– Single point of Management
– Same user interface as BIG-IP appliances
41
VIPRION – On Demand ADC
Add application intelligence without adding
management cost
Market-leading performance
Ultimate redundancy
TMOS inside
42
On Demand – Zero
Reconfiguration
Virtual
Machines
Servers
Physical Server
Servers
Automatic addition of power
No need to overprovision
Fixed and predictable OpEx
Virtual
Machines
Physical Server
Servers
43
Virtual Processing Fabric
Clustered Multi Processing (CMP)
Custom Disaggregator ASICs
High Speed Bridge
44
Ultimate Reliability
Client
Multi-Level Redundancy
Blade failure will not cause chassis failure
Redundant and hot swappable components
Always Available
Server
46
iRules
and
iControl
47
iRules – The Next Generation
The network can now apply unlimited
business logic for the application
High performance rules
– Event based iRules provide more control
Only truly programmable rules engine
– Fully programmable - switching, security,
transformation and optimisation functions
Based on industry standard language
– Extended Tools Command Language (TCL)
48
iRules – Full Programming Language
Tc
l
Features
Rapid development
Speed of
use
Breadth of
functionality
Flexible, rapid
evolution

Great regular
expressions

Easily extensible

Embeddable

Easy GUIs

Internet and Webenabled
Enterprise
usage

Cross platform
Internationalisation
support



Thread safe

Database access

Perl
Visual
Basic





Includes Number Extensions










•
•
•
•
Standard Language
Fast Rule Evaluation
Event Based Rules
Multiple Rules Per Event
**TCL Developers Exchange
49
Integration and Extensibility - iRules
50
The Better Alternative Example
Centralized Availability, Security & Acceleration
Centralized Transaction Assurance: Proactive Response
Error Handling for Higher Availability
rule redirect_error_code {
when HTTP_REQUEST {
set my_uri [HTTP::uri]
}
when HTTP_RESPONSE {
if { [HTTP::status] == 500 } {
HTTP::redirect http://192.168.33.131$my_uri
}
Centralized Data Protection: Rewrite, Remove, Block and or
Log Sensitive Content
rule protect_content {
when HTTP_RESPONSE_DATA {
set payload [HTTP::payload [HTTP::payload
length]]
#
# Find and replace SSN numbers.
#
regsub -all {\d{3}-\d{2}-\d{4}} $payload "xxx-xxxxxx" new_response
#
# Replace only if necessary.
#
A Repeatable, Extensible, Flexible Architecture
Host to URI mapping: Faster Access to Data through Automatic Redirection
when HTTP_REQUEST {
# www.A.com -- domain == A.com, company == A
regexp {\.([\w]+)\.com} [HTTP::host] domain company
If { "" ne $company } {
# look for the second string in the data group
set mapping [findclass $company $::valid_company_mappings " "]
if { "" ne $mapping } {
HTTP::redirect "http://www.my_vs.com/$mapping"
}
}
}
if {$new_response != 0} {
HTTP::payload replace 0 [HTTP::payload
length] $new_response
}
}
51
Introducing iControl v9
Open API (SOAP/XML) allows applications to
automatically interact with the network
Integration with development tools from
Microsoft, BEA, and Oracle
Online community F5 DevCentral
– Developer assistance on F5 DevCentral via
developer forums (http://devcentral.f5.com)
– iRules forum and code examples
52
iControl Eases Application Integration
Leverage the skills and expertise you already have!
Key Components
Benefits
– XML/SOAP interface
– Open, standards based integration
– Downloadable SDK
– Simplified development
– Technology partnerships
– Proven integration
– DevCentral resource centre
and community
– Sample code, documentation,
discussion forums
53
Integration and Extensibility iControl Event API
Create Subscription
Administrator uses the
provided sample
application (or custom
application) to create Event
Subscriptions
Select Event Type
Choose a specific event to
track. Then, create the
Subscription name and
parameters.
Upon Event, message is
distributed via log, email, or
SMS to phone/PDA
Applications can subscribe to 47
different system events
Sample application
(screenshots) provided with SDK
Bulk method support – 100:1
reduction in call, 90% reduction in
bandwidth
54
iControl Application Migration to v9
Paste Code Into Analyser
Developer visits DevCentral,
accesses the Code Analyser,
select language, and report
format
Summary Report
Generated report identifies line
where conflicts exist, defines the
method affected, and enables
direct link to online versions of
4.x & v9 SDKs
Analyser free for use by all F5
DevCentral members
DevCentral Forum available for
posting migration questions
Additional sample and technical
tips will be available
55
DevCentral Technical Community
http://devcentral.f5.com/
Forum for F5 customers
for building iRules and
iControl applications
F5 provides technical
documentation, tips, free
sample downloads, and
a confidential discussion
forum
Monitored by F5
engineers and technical
experts that answer
technical questions
– Design, architecture,
troubleshooting and
general assistance
with iRules and
iControl
56
Link Collection
Overall
Technical
www.f5.com
www.f5.com
ask.f5.com
devcentral.f5.com
F5 University
www.f5university.com/
»
»
Login:
your email
Password: adv5tech
Partner Informaiotn
www.f5.com/partners
www.f5.com/training_services/certification/certFAQ.html
Gartner Report http://mediaproducts.gartner.com/reprints/f5networks/article1/article1.html
Important deployment information is available at
Data Center Virtualization
Application Traffic Management
Application Briefs
Solution Briefs
F5 Compression and Cache Test
F5 iControl Alliance Partners
F5 Technology Alliance Partners
http://www.f5.com/solutions/deployment/
http://www.f5.com/solutions/technology/pdfs/dc_virtualization_wp.pdf
http://www.f5.com/solutions/technology/pdfs/atm_wp.pdf
http://www.f5.com/solutions/applications/
http://www.f5.com/solutions/sb/
http://www.f5demo.com/compression/index.php
http://www.f5.com/solutions/partners/iControl/
http://www.f5.com/solutions/partners/tech/
Let us know if you need any clarification or you have any further questions.
57
Analyst Leadership Position
Challengers
Leaders
Magic Quadrant for Application
Delivery Products, 2007
Ability to Execute
F5 Networks
F5 Strengths
• Offers the most feature-rich AP ADC,
combined with excellent performance
and programmability via iRules and a
broad product line.
Citrix Systems
Cisco Systems
Akamai Technologies
Foundry Networks
Nortel Networks
Juniper
Cresendo
Radware
• Strong balance sheet and cohesive
management team with a solid track
record for delivering the right
products at the right time.
Zeus
• Strong underlying platform allows
easy extensibility to add features.
Coyote Point
NetContinuum
Array Networks
Niche Players
Visionaries
Completeness of Vision
Source: Gartner, January 2007
• Strong focus on applications,
including long-term relationships with
major application vendors, including
Microsoft, Oracle and SAP.
• Support of an increasingly loyal and
large group of active developers
tuning their applications
environments specifically with F5
infrastructure.
58
Thank You