Learning ADC and Big-IP Basics

0:00All right, we're gonna start off by talking about proxies for a couple of minutes. Now, if you're not familiar with a proxy, think of it like this. See, you got this big office building in here, and you're down here, and you're gonna walk into the office building, because you want to visit somebody up here on the third floor, eighth floor, whatever it is. So you go in, and you run into a receptionist desk where you've got a receptionist who's sitting here, and the receptionist welcomes you and goes ahead and signs you in, checks your credentials, gives you a visitor's badge, and then you're allowed to go on up and visit your acquaintance up here.

0:40Well, think of the receptionist here as a proxy. A proxy is a go-between, so when we're talking about networking and network services, if you're over here on your laptop, and you're trying to access this network over here, well, oftentimes you may need to go through some sort of proxy in order to get to that network. And proxies provide us lots of different services, and we're gonna talk about those as we go on. So this is the general idea of a proxy.

1:11Now, there's two primary types of proxies when it comes to web proxies, and the first one is a forward proxy. And this is when you have a user over here, who's out there browsing the web, and when they're doing so, they're actually sending their data out through a forwarding proxy. This is a proxy that's gonna forward your data for you out to your final destination. And your final destination could be this server out through the internet, so maybe you're going over to this web server.

1:44But the idea is you're forwarding your data through a proxy, and this proxy could be on your local network, or it could be a proxy in the cloud as well, doesn't matter, either way. But that proxy's gonna provide some services for your data that's headed to its final destination over here. Now, generally when we use this, it's for web filtering purposes, and that is a security service that we provide to our users so that we can make sure they're visiting safe websites. So what would happen with this proxy over here is when you go to it, it's going to check your URL and figure out where you're going.

2:21And then it's gonna check this URL against a list of known malicious websites, and it's gonna prevent you from going to malicious websites, or it could also have categories of web content, such as gambling, sports, and other non-business related web content. And maybe certain categories are blocked by your organization, so you can't go out there and waste time on the web. But, either way, this is an example of forward proxy. And oftentimes this is used with web security filtering services.

2:55And I want you to think of a forward proxy over here as a proxy that is providing services to the local user. And that local user is our local computer over here where we were out browsing the web, okay? So that's providing services to a local user. Now we're gonna take a look at a reverse proxy, that's what's next here. And a reverse proxy provides services to the destination, if you're thinking of it as a source over here and a destination over here.

3:28So we had our forward proxy providing services to our local user, and our reverse proxy providing services to our destination, okay? So let's talk about some of these services that happen at the destination. So obviously here, if this is your user who may be using a forward proxy, or may not, as their information gets over here to their destination, they hit our BIG-IP, and it's acting as a reverse proxy. And what it's doing is, it's providing services to that data as it goes through our BIG-IP.

4:04Now, those services, there could be many. One could be load balancing, so maybe it sends traffic to one of our pool members in our virtual server, and that would be a simple load balancing service. And that would be a service that a reverse proxy provides, but it can provide many other services as well, such as authentication, security checks, and traffic manipulation. Of course, as well as load balancing and many other services as well. And, guess what? The BIG-IP over here, can actually run services as both a forward proxy and a reverse proxy.

4:42Pretty interesting. So now that we've got proxies under our belt, we're 100% set on a forward proxy and a reverse proxy, let's go ahead and in the next note, we're gonna start talking about application delivery controllers and some of their features.

0:00All right, so we're starting off talking about Application Delivery Controllers or ADCs. Now what is an ADC? Well, let's dissect this here. Well, it is an application focused appliance or service, and what it does is it delivers data to it, and it controls that data. So in the last nugget we talked about forward and reverse proxies, and we saw that in a reverse proxy when I had a user over here was sending data to a destination that reverse proxy over here, which was our BIG-IP, can manipulate traffic and it can control that traffic and then deliver it to a destination or a series of destinations, maybe if it's doing load balancing, which is very commonly performed with the BIG-IP.

0:47This is application delivery controller in it's finest. So basically it is an appliance that provides services. It allows you to manipulate traffic as it flows through it. So it's going to provide us with, again, lots of services. Let's talk about some of those services. Well, some of those services are content redirection, just like we saw here with our load balancing services, it's redirecting that web traffic to a final destination down here, but it can also forward to other destinations.

1:19Maybe all of these hosts are down and not functioning. So when users come, do we just give 'em a 404 error message saying we can't reach the site, or do we redirect them to another site, maybe a website saying, "Hey, we're having technical difficulties, please check back later." You know, something like that, content redirection. We can also use server health monitoring. So in our example with load balancing, let me see if I can remove some of these scribbles here. There we go, we got our servers back.

1:51So how does the BIG-IP know if these three pool members down here are alive or not? Well, that's a good question. And the answer is server health monitoring. We can set up different types of health monitors, where the BIG-IP will monitor these hosts down here and see if they're up or down, if their services are running, if the web content is correct on it. It can do all those things through server health monitoring. It can provide network address translation or NAT services, so that as data flows through the BIG-IP device here, well, we can actually change the IP addresses as they're going through the device and provide NAT-ing services.

2:31Next up, SSL offloading. Now, if our servers down here are running HTTPS and have certificates and such, well guess what? Every time a session is established, they're gonna be performing some encryption services and that takes up resources. Wouldn't it be great if we could move the encryption services to the BIG-IP up here and let it handle it, so that as the data moves down here to the members that are answering those calls for service, they don't have to worry about encryption.

3:03So that takes away that job from them, so it, they're not using resources to perform that functionality, SSL offloading. We can perform IP traffic optimization, which helps ensure that our network traffic is taking the optimal path and is getting there as efficiently as possible. And lastly, I'm gonna put up here, Web Application Firewall or WAF. And a Web Application Firewall is a firewall in the sense that it can block traffic, but it's not worried so much about IP addresses and port numbers, it doesn't work at layers three and four.

3:42What it's doing, it's working at Layer 7. It's looking for web protocols, things like HTTP GET and HTTP PUT and different HTTP commands, the protocols being used. It can actually form rules around these types of commands in order to protect our web applications and prevent common attacks. So those are many of the services that an ADC or application delivery controller provide. And of course, our BIG-IP is an application delivery controller.

4:15So in the next nugget, we're going to move on to the BIG-IP itself and look at some of its modularized software because it actually has modules that we can enable in it. It's not just one big box with everything turned on, we have lots of tools within our appliance that we can turn on if we want to use them, or we can leave them turned off`, so they're not using up resources. So I will see you there shortly.

0:00In the last nugget, we stated that the Big-IP was an application delivery controller, and absolutely it surely is. Now, when it comes to our Big-IP, let's talk about a couple of things. Number one, it comes in hardware and virtual appliances. So you can go out and buy a hardware appliance and put it in your rack or put it in a rack at the data center. Or you can run virtual instances or VEs, or virtual editions, of the Big-IP in your environment, which is what we've done in our lab setup.

0:33Now the thing is, we've talked about several of the services that the application delivery controllers provide, like SSL offloading, natting, server health monitoring, traffic optimization, WAF, our web application firewall, lots of those things. Well, yes, those are within our Big-IP. Now, the way this works though is generally, we're starting off with our local traffic manager, or LTM, and then we add on various other services through modules that we can enable within the Big-IP.

1:05And that leads us to our next point that the Big-IP runs modularized software, which simply means it runs software as various modules. So let's talk about some of these modules real quick. We're gonna list these out. We have our local traffic manager, or LTM, and that's what we've been working in so far where we manage our local traffic. We have Big-IP DNS. And as you can imagine, that deals with DNS and improving DNS functionality and protecting against DNS attacks.

1:36Then we have our application security module, or ASM. And the application security module runs a web application firewall that allows us to create firewall rules based on the web application and the HTTP commands being used. Next up is our access policy manager, or APM, and that manages access to our applications. It's kind of a centralized identity and access control service for accessing our applications on-premise and in the cloud.

2:12And then lastly, we have advanced firewall manager, or AFM. And this provides more of a traditional network-based firewall protection, does protection against denial of service and DDoS attacks. It provides reporting for our security events, and it uses threat intelligence. It's pretty cool. So think of that as your standardized firewall. Now let's go ahead and jump into each of these individually and talk a little bit more about them, starting with our local traffic manager.

2:44And of course we're gonna associate this with load balancing services, our NAT services, SSL offloading, traffic optimization, and lastly, SYN flood protection. And we are already running our local traffic manager module. That's what we started off with in our image. And it provides us all of these various services, which is pretty handy. We also have our Big-IP DNS, and this is previously known as GTM.

3:15Now the thing with this, what it does, is it improves DNS performance, protects against DDoS attacks, and it protects against DNS attacks, and it provides some advanced traffic routing. So we're gonna talk about that. It's pretty interesting. So our advanced traffic routing. So when we're routing traffic, we're trying to alter its destination, and we're trying to send it somewhere in particular. We can actually base that, if we're using Big-IP DNS module, we can base that on a few things like the location of the user, the application that's being used, which is pretty interesting, so we can make decisions based on that.

3:57And it also provides us with a global server load balancing service, and that's known as GSLB, which provides us a type of control over our global network traffic. So we're not only load balancing and controlling traffic within our local area network or local network, we're doing it for all of our services around the world. So that's our Big-IP DNS. Next is our application security module, or ASM.

4:29And of course this is our web application firewall, or WAF. And the thing about this WAF here, it is actually PCI compliant, which is handy if you're dealing with PCI regulatory concerns. So this of course protects against many different types of web attacks, and it actually allows us to do some dynamic application security testing of our own application. So if I'm running my Big-IP here, and I have my member servers down here in a pool or something, what I can do is run security testing against the applications running on these, looking for known vulnerabilities so that I can identify them quickly and get them patched.

5:12That's right, get them fixed. So that is a pretty cool tool, that dynamic application security testing. It also provides API protection, so if you're using APIs as part of your services. And lastly, DDoS protection, or distributed denial of service protection, all of those things are provided by our application security module. All right, next up is our application policy manager. Now our application policy manager, what it does, it's centralized identity and access control.

5:46So think of it as your centralized identity system that you're gonna use to provide access control services to all of your applications. It doesn't matter if those applications are on-premise or out there in the cloud somewhere. Either way, you're gonna be able to provide your centralized identity and access through the APM. So this means that if you're running the APM, you got your Big-IP down here, that all your users out there, when they're trying to access your applications, you're gonna point them to the Big-IP for the centralized identity services.

6:21And once they're authenticated, they'll be then redirected to wherever those services are. And it's much easier to centralize all of your identity management as opposed to having it be distributed. And when it's doing this, it's providing some advanced authentication services. So we'll say advanced auth services is what it's using and providing us with so some examples of that is it's gonna allow us to use federations between different authentication services.

6:55It supports LDAP, our lightweight directory access protocol. It supports active directory, which is your Windows authentication. It also supports RADIUS, RSA secure ID, and open API. All of these different types of authentications are supported. And the other thing is it provides, this is really cool, SSL VPN remote access. So that's what our APM provides us with, all of those services.

7:29All right, the last one here, our Advanced Firewall Manager. Now this provides a proxy firewall service. So this is basically a traditional firewall service provided by the Big-IP. And here, we're focusing on layers two through four. So here, we can filter based on MAC address, IP address, port number, all of these things. So the way this works is when someone is over here trying to connect to our servers back here, we got that, we got our Big-IP here.

8:03Well, that user connects, the Big-IP terminates that session, then it does an inspection on that incoming traffic, and it compares it to the firewall rules that have been configured and decides on what to do with it. Does it drop the traffic or does it go ahead and forward it on to one of the members' servers based on what services are running? So that's our AFM, our advanced firewall manager and how it provides traditional firewall services, but it provides some additional services as well, such as SSL inspection, which means if your servers back here are running SSL and performing the encryption themselves, and you've got an encrypted session that's going between these two devices, the Big-IP can actually intercept this, decrypt it, and inspect the data inside that encrypted data to provide extra security.

9:03It also provides DDoS protection, which we've seen several of the modules provide DDoS protection. So we should be pretty protected at this point. And then again, it also provides two more things. Intrusion prevention services, which is known as IPS. And that's where it's looking at data that's coming through, it's providing this inspection, and it's looking for malicious data, and it looks for actual what are called signatures, or they're kind of fingerprint of a data.

9:35And it will then drop those, of course, so that they cannot be successful as trying to attack our environment. So that's our IPS. And the last thing it does is it provides reporting on our security related events. And that's very important so we can have some information about what's going on. Now the thing is, when we have these modules, I said you can turn them on, you can turn them off. Well, we do that through our module resource allocation settings. And the thing I want you to understand, there are four options when we go in.

10:07We're gonna go in and do this. You're gonna see this here in the next nugget. So what you're gonna have is four options. You got number one, it's going to be non or disabled, and that means you're not running the service or that module, okay? And number two, and I want you to understand this is when we go into the module resource allocation page, you're gonna see a big old list of all different modules. And there's more than what we just talked about. There are several modules, but the ones we talked about are the primary ones. And then you're gonna have options over here is what to do with them.

10:39Do you wanna turn them on? Do you wanna turn them off? What are your options? And your first option is basically disabled, not running. Your second option is dedicated, and that's where you're dedicating all the resources of your Big-IP to this one module. So at this point, you can only run a single module, and it gets all those resources. So that means you can't run more than one module. So if you're wanting to run multiple modules, it's really not an option. Number three, we have nominal, and this is when you fire up this module, and you can run multiple modules this way, when you fire up that module, it gets a little bit of resources.

11:22And then once it's completely up and running and stabilized, you're going to get additional resources so that it can run properly. And then lastly, number four is minimal. And that's when you turn on the module, it gets little resources, and once it comes up, and it's fully stabilized, it continues to get little resources because we're not gonna provide additional resources. And really, if you're gonna use something like this, I'm thinking you're gonna want to use that module for its reporting services or something.

11:53Something like a firewall module, you wouldn't want to run in minimal because if you're restricting its resources, it's gonna slow everything down going through it. But if you're just running a module for something like reporting, well then you can just run reports as needed, and it doesn't need a whole lot of resources. So those are your four options with your module resource allocation. And as I said in the next nugget, we're gonna go and take a look at how to enable a module. So I will see you there shortly.

0:00Alright, here we are on our big IP and it's time to take a look at our module resource provisioning, 'cause we had talked about our different modules and how we can go in and turn them on. And we have different options there. So how are we gonna do this? Well, here's how we're gonna do it. We are gonna go here, we're gonna go down to our system. We're gonna click on system, and then we're gonna go to resource provisioning, which is right here. And I'm gonna go ahead and click on that. It's gonna load up our resource provisioning page. And this is it here. So if we look at the top, what we have is current resource allocation, up here we've got CPU, disk and memory.

0:35We can see that some of this is being used for management. Other for TMM, which is the Traffic Management micro kernel. So part of the operating system there we see running. Then, down here, if we take a look with this yellow square, we have local traffic manager. And we can see up here at the top, when we look at our CPU, there's a little bit of yellow up here in the top right hand corner. That's because that's the amount of resources being used by our local traffic manager. So that's our LTM.

1:06So, if we go down here, we saw some of the other modules we talked about. There's our application security module, there's our global traffic, it's our DNS. We have our access policy module here, and there's our advanced firewall down here. And as we can see, there are other modules as well. So if I wanted to turn one of these on, let's say I wanted to turn on my application security module, what I would do is come over here and click right there. Because if I unclick, it's none, meaning it's not running.

1:38So I would click in there and I have three options. Dedicated, nominal, and minimal. Let's talk about these. Remember, dedicated means that you can only run one module and all those resources are gonna be dedicated to that one module. Ah, well, if I was to do this, it would mean that I'd have to turn off my LTM module, so I wouldn't wanna do that. Then I have nominal, remember, that's when you first turn on the module, it has a little bit of resources, then it gets up and running, and once it stabilizes, then it's gonna gain additional resources that it needs to run nominally.

2:11Then we have minimum, and that is when it's first turned on, it gets a little bit of resources and that's all it gets for all of its eternity. Just a little bit of resources, the minimum amount necessary. So again, if you're trying to push firewall rules, if you wanna use firewalls, you're probably not gonna want minimum because it's gonna slow things down as far as traffic movement through those firewall services. So those are your options. And you see, as soon as I clicked on that, my ASM now shows up under my memory down here. I've got my management, my TMM, my LTM, and now the ASM.

2:44But if I turn that off, there it goes. It's set to unallocated and it didn't actually turn it on. I'd have to click there, select something like nominal, and go to the bottom and submit. And then it would go ahead and load that module in there. But here, it's just showing you what it would use. And there you go. So I'm gonna go ahead and uncheck that, 'cause I don't wanna run it right now. All right, so that is using our resource provisioning when working with modules in the big IP device.

0:01And now it's time to look at the components or the inner working and system architecture of our BIG-IP. What is under the hood, folks? Well, I'll tell you what's under the hood. Lots of goodies. So let's start off with down here at the bottom. We have Kickstart. Now Kickstart is a Linux OS that's running down here, or really stripped down some basic Linux structure to give us a foundation that will get the box up and running from being turned off, and it will allow it to then boot up and load the TMOS or the Traffic Management Operating System.

0:43And the TMOS is the BIG-IP OS, all right. This is what gives it all of its wonderful functionality. And of course, we know that it uses modular functionality. So up here, we have a bunch of modules. We have our LTM module, for example. We've got the DNS module. We've got our Application Security Module, our ASM, our Application Policy Module, our Application Firewall Module. We've got the modules, and then there's others as well.

1:16So those are the modules. After that, we have something called iRules and we're gonna get more in depth into these, but iRules allow us to create rules for managing traffic flow. Then we have up here our full proxy. And so that's all of our proxy services, our inspection of the data so we can figure out what we're gonna do with it. And then lastly, we have hardware chips for high performance. And those are used for things like SSL offloading and compression services.

1:47So that is what's under the hood. So if you ever wondered what makes it get up and running and how's it laid out, and here you go. This is the system architecture of the BIG-IP.

0:00All right, now it's time to talk about the default settings and management access of the Big-IP device. We're starting with some defaults. So when you first get that device, whether it's a hardware device or a virtual edition software version of it, what are some of the defaults that we need to be aware of? Well, let's start off with default IP addresses. So if you're using a hardware appliance, the default IP address is 192.168.1.245.

0:33Okay, there you go, 245. Now if you're using a virtual appliance, guess what? It's set to DHCP, which means it's gonna go out and grab an IP address from your DHCP server. So those are very different. All right, what about some administrative credentials? So we've got HTTPS logins, so the web GUI, and we've also got SSH logins. So let's talk about this. What are login credentials for each of these? Well, when it comes to HTTPS here, the default is admin as the username and admin as the password.

1:11There you go. But when it comes to SSH logins, when you're at your command line and when you're in your virtual environment, if you're running a lab like we are, well then we know that when we go to the terminal, so I'm gonna put down here terminal because it also applies with that terminal, and we had to use different credentials and it was root as username and the password is default just like that. And then, of course, the first time you log in, you're gonna be forced to change that password.

1:42So now let's talk about what type of access we have to our new device. So when it comes to management access, we're talking about here, we can actually do this from the internal and external interfaces. And our external VLAN is set to none. Now let's talk about some management of the Big-IP. So when we're talking about management methods for the Big-IP, we really are dealing with a GUI.

2:16That's our graphical user interface. And that's done via HTTPS into the device. But we also have command line interface, that's our CLI, which is our SSH or terminal if we're working in our VMware environment access. So that means that we have a command line access into this device for management. And there's two different types when we're using it. One is advanced, and that's where we're accessing the underlying Linux to verify configurations.

2:48Okay, and the second one is called the TMSH or Traffic Management Shell. And this is a CLI where we change Big-IP configs. So you'll see they're very different. If you're wanting to check or verify Linux configs for the underlying OS, you want the advanced terminal or advanced shell But if you're wanting to configure Big-IP features from the command line, then you're using your Traffic Management Shell. And lastly, there is one more and it's called iApps.

3:21And you access this through the GUI, through our web interface. And this allows for more of an automated type of service deployment using templates. So you can create templates and then use those to deploy configurations. Just makes it much quicker. So those are the Big-IP default settings and our management access options.

0:00All right, let's go ahead and take a look at how we can access the administrator access within the F5 BIG-IP. Well, the first way we can do this is to go to the management interface or the internal or external interface of a new device and basically log in with your credentials. Now, of course, they default this admin admin, but we've already set this one up so I'm gonna put in the correct credentials. All right, here we go. And so of course, this is how we access the administrator GUI through the web portal.

0:30All right, that's pretty straightforward, right? However, I really wanna take a look at the command line access here. So what we're going to do is go over here to Systems, and I wanna go down to Users. Let's scroll down here to Users. I'm gonna go to User List. It's gonna bring up our user list, and right now there's just an admin account. So if I click on the Admin, the option is, by default, this is set to Disabled. And what I'm looking at is the Terminal Access down here.

1:02It's set to Disabled by default, but you have an option for Advanced Shell or TMSH. And they both provide the same level of access. If you turn on Advanced Shell for the admin account, they automatically have access to TMSH as well and vice versa. So not a big deal there. So we do need to turn this on. So I'm just gonna say Advanced Shell for now. I'm gonna say Update. There we go. I'm going to drag a window in here, this is a terminal. And let's clear the screen here.

1:34Let's go ahead and hit the up arrow. I want to, there we go, ssh to root@192.168.121.11 That's our management interface. So if I do that, then put in my credentials, then hit Enter, there we go, I am at basically a standard config or a Linux config command prompt. And that pound sign means that I'm root, which, actually, that's what I logged in as as root. So I am root. There we go.

2:04So I could run a command like ifconfig and it's gonna show me IP address information for the device. But if I wanted to go into the traffic management shell, the TMSH, then I would type tmsh and go ahead and hit Enter. And there we go. Now that we see tmos and the pound sign, that is an indicator that I am now in the TMOS, the traffic management operating system shell. All right, so that's how you switch back and forth. Now, if you want to exit this, you have to type the command quit.

2:37You can't type exit, it doesn't work 'cause we're within a different shell. So if I do quit, there we go, and I'm back down to my Linux shell. So here, if I wanna quit, I just type exit. There we go. Super, and it closed my connection. So I'm gonna clear the screen here. I'm gonna move this out of the way. And we're gonna look at creating a new account. So let's go back to my user list. And over here on the right, I'm gonna click Create. I'm gonna create a new account and the new account is for Bob. There we go. Let me grab a password here.

3:09I'm gonna put in a password. There we go, there we go. Now, the role. All the roles here, you'll see have the same options for terminal access, whether it's guest operator, application editor, any of these except for the administrator. So if I make Bob an administrator, and for the partition, I leave it all and I click Add, and now Bob is the administrator for all partitions on here. I can go down here and I see my Advanced Shell and my TMSH just like we saw with the other admin account.

3:40However, I'm gonna get rid of this. I'm gonna highlight it and delete it. I'm gonna change that role to, let's just say operator. For all partitions, there's a common partition and that's by default, when you set up the BIG-IP, it creates one partition, and everything goes on there. So all your application objects and everything is just relying or residing on that, it's just residing on that one partition. So we're just gonna stick with the common or just say all. There we go. Add, there we go, perfect. Now, you'll see my terminal access options. I only have TMSH just because only administrator accounts can get that advanced shell access.

4:13So if I set this to TMSH for Bob and I go ahead and say Finished, and it's creating that user account, there we go. So now I'm gonna bring this back up and I'm going to hit the up arrow a couple times. Let's go to Bob. There we go. So I'm SSHing bob@192.168.121.11, which again, management interface of the BIG-IP. Hit Enter. There we go, I put in a password, Enter, and it's gonna have me change my password. So I put in my current one. Here we go.

4:44There we go. And let's see what happens. There we go. It drops me directly into the traffic management OS, the TMOS shell. It didn't send me into the Linux shell like it did when I was the administrator. So there you go, that's how you can tell the difference between your advanced shell in the Linux and your TMOS shell within the BIG-IP. And again, if I wanna quit this, I can't simply type exit 'cause hey, that doesn't work. You gotta use the word quit. So if I do quit, there we go. We close that session. So that's how we can access the management interface of the BIG-IP.

5:18That was our HTTP GUI interface, and then our advanced shell for our Linux access, and our TMOS shelf for our BIG-IP terminal configuration access.

0:00Now let's talk about some Big-IP functions and features. And let's start off with taking a look at how the big F5 works as an ADC proxy. This is our application delivery controller. So the way this works, you've got your user over here, and we've talked about this before, but we're gonna get a good review here because it's very important to understand this. So the user wants to connect to the server over here. So when they go out, they're going to the URL of the server and via DNS that gets translated to an IP address, and then the network traffic goes over and begins its journey to its destination.

0:41And that's where it's introduced to the Big-IP because that DNS is actually gonna resolve the IP address that resides on our Big-IP. And then the Big-IP is going to get to do some things to that network traffic before sending it onto the server if it's allowed to do so. So let's talk about that. Well, it's gonna do some inspection of the traffic. It's gonna make sure it's not malicious if we have security rules set up for it. It's also gonna figure out where it needs to be routed to.

1:12It's going to do any type of modifications of the traffic, such as Network Address Translation that may be required. It's also gonna provide some decryption if we have SSL offloading enabled. It can also provide some uncompression services so that if you're using some type of compression in the network communications, it can do that uncompression before forwarding it on. So what we see here is it's gonna go through and it's gonna provide these types of services.

1:44And then if it decides that the traffic should be forwarded to a member server, well then it's gonna go ahead and do that for us. So this is how the Big-IP works as a proxy. And I wanna make a very big point. Down here at the bottom, I want you to read that: "Big-IP blocks all traffic by default." This is known as an implicit deny. So if you don't configure the Big-IP to do anything and you put it out there with an IP address, it's gonna block everything. Nothing is getting through it because we don't have any rules put in place as to what to allow through it.

2:18So it's very important you remember that Big-IP blocks all traffic by default. So let's take a look at some of the additional features of the Big-IP. We've talked about one of these. We've talked about iRules earlier on. So let's go ahead and talk about some of these, which the first one is iRules. And this is a tool for scripting the automation of the Big-IP capabilities. Then we have iControl, and this is actually an API that allows for integration with third party apps.

2:52So if you're needing to integrate with a third party application or service or something with your Big-IP, look at using iControl. Then we have iApps, which is next, and this is a customizable framework for deploying applications and it uses templates. So you can go ahead and create a template based on a specific app you wanna deploy. Maybe you deploy several of them that are very close to each other as far as likeness. So you can create a template and go ahead and use that to help deploy them out.

3:25And then lastly, iHealth, and this is a system health diagnostic tool. So those are some of the additional features of the Big-IP. You got your iRule, iControl, iApps, and iHealth. And lastly, we're gonna wrap up here with Big-IQ. Now this is not Big-IP, this is Big-IQ. Now this is pretty cool. This is used for centralized management of Big-IP devices, and it can actually manage up to 200 Big-IP devices per Big-IQ deployment.

4:00So there you go, it'll manage up to 200 Big-IP devices. So that way, you can centrally manage them, which of course makes it wonderful when you're trying to do upgrades for your Big-IPs. Instead of doing them one by one, you can actually do that through your Big-IP and you can roll it out to groups or all of them at once. It also monitors SSL certificates because as you can imagine, if you've got multiple virtual servers and apps running on multiple Big-IPs, you may have hundreds of certificates out there that you're trying to manage.

4:34Well, guess what? Big-IQ can help you with that process. And then lastly, it integrates with iHealth. And remember, iHealth was a system diagnostics tool that ran on our Big-IPs. So that way, when we have our Big-IQ up here and it's watching all of our Big-IPs out here that we have running, and it's helping us to manage them, it's gonna pull in that health information so that we can see it on dashboards and reports and such. We can kinda figure out what's going on, especially if we're having problems. So that is your Big-IQ and that wraps up our Big-IP functions and features.

0:00All right, so you have been tasked with setting up or enabling the advanced firewall module within the big IP, and you need to make sure you're not restricting the resources to it. So let's jump in and see how this is done. So we're going to log in, admin, put in our password, There we go. And it's gonna log us in here. And what we're gonna do is once this loads up, we're gonna go down to system on the left, and we're going to go down to resource provisioning. And this is where all of our resource provisioning happens and of course this is where all of our modules are. And if we want to enable one of these modules, then what we wanna do is we want to first, find it, and here's our advanced firewall module.

0:40Want to go under the provisioning column, you're going to want to check that box there. Now you've got some options here. Dedicated, nominal and minimum. And if you think back to the video we covered this in, dedicated was where the system allocated all CPU memory and disc resources to a single module. But that caused other modules to be disabled. So we definitely don't want to do that. Now we have nominal, and that's where the module is first enabled. Feeling a little bit of resources, but then it's given the additional resources once it gets fired up and running so that it has enough resources to do what it needs to do.

1:17And the minimum is where we're restricting resources, so we know we can't use dedicated in this instance because we're also running the LTM. So we need to do nominal and that's what the default is. So there we go and we've already got a license so we can just scroll down here and say submit. And it says here that it's, uh, reprovisioning may start daemons which is services or reboot the system which causes lost connections, are you sure you want to proceed? So of course we would want to do this during a scheduled downtime. But yeah let's go ahead and do it. So we'll click OK.

1:48And if you look up here you'll see this just changed actually. This just had TMM and LTM, but now we see AFM up here under memory, and it's actually doing something now. Ah we see it's loading, it's receiving config data from the device, and it's showing that the configuration has changed, and it's going to want to go ahead and do an update here to make sure that everything is functioning. So we're going to give that a couple minutes to do that, I'll be right back. Okay it has finished. And it went through and did a couple things.

2:18And it says that device connection has been restored, so we can just click continue now. All right, super, I'm just going to go ahead and refresh this up here. There we go. So it can refresh the page we know we're looking at the most recent information. And, now if you look over on the left we now have a security tab that was not here before. So if I click on that, we now have protocol security, network firewall, network address translation, different firewall zones, packet filters, DDOS, or DOS protection that is.

2:52And event logs and all this stuff. And this wasn't here before. But it is now. So if we go back to our system, go back to our resource provisioning, and we should then see that once it comes up. There it is, it's our AFM, we still have it checked. It's showing nominal and up here at the top under our memory we show add our disc actually, and our CPU we show that AFM is actually running and using some of our resources. Plus we have our security object or menu over here on the left that we can then work with that advanced firewall.

3:23So cool! Hope you're able to get that knocked out and figure it out, if not hey, now you know how. That wraps up this nugget, I hope it's been informative for you. And I'd like to thank you for viewing.