Archive for devcentral

DevCentral’s Featured Member for November – Nathan Britton

Posted in security, f5, big-ip, devcentral, featured member by psilva on November 1st, 2017

nathan.jpgNathan Britton works as a Principal Security Consultant in the UK for a security solutions provider called NTT Security, part of the NTT Group. They work with customers to design and implement security solutions and his team specializes in application delivery and security in particular. His specific role is focused on solution design and technical governance. Nathan is a BIG-IP ASM SME, a DevCentral MVP and our Featured Member for November!

DevCentral: You are a very active contributor in the DevCentral community. What keeps you involved?

Nathan: Hands down it’s the best community forum I’ve ever participated in and, over the years, I’ve taken a lot from it. As such, I like to ensure that, time and my knowledge permitting, I give back to the community whenever I can. Also, there are always new things to learn, so being active on DevCentral makes sure I see what other community members are doing to solve other peoples’ issues and I keep on top of new features of the products.

DC: Tell us a little about the areas of BIG-IP expertise you have.

NB: My main background has been BIG-IP LTM and ASM. I was a customer of F5 for around 5 years where we had a number of BIG-IPs load balancing internal applications, and also a pair of ASMs protecting our internet facing web applications. I still recall the day I joined the team and was asked to look after the BIG-IP that had been a little bit neglected and not knowing my F5 from my BIG-IP and what was an application delivery controller anyway! Fortunately, some free F5 University training and some lurking on DevCentral soon got me on track.

DC: You are an Engineer at NTT Security. Can you describe your typical workday and how you manage a work/life balance?


NB:
As a consultant there is no typical working day. One day I could be onsite at a customer workshop going through a solution design on the whiteboard, the next day could be working on proposals which we hope will turn into a new customer engagement and other days I could be assisting colleagues with technical governance on one of their projects. Part of the enjoyment of being a consultant, rather than an end user, is the exposure to varied work on a day by day basis.

DC: You have a number of F5 Certifications including Technology Specialist (LTM) certifications. Why are these important to you and how have they helped with your career?

NB: As a consultant working for an F5 partner it is vital for us to have certified members of the team, in fact NTT Security attained the highest partner status in F5’s Guardian Professional Services program. On a personal note I think the certifications have been vital in ensuring I have a breadth of knowledge as you never know what feature or module a customer may choose to implement. To that end, the self-study and lab work needed to achieve the certification has been invaluable. I’ve also helped design questions for the 401 exam so, as you can see, I’m very invested in the certification process. I think Ken and his team, especially Heidi, have done a great job.

DC: Describe one of your biggest BIG-IP challenges and how DevCentral helped in that situation.

NB: My first challenge was the fact that I did not know anything about F5 or BIG-IP when I first got my hands on them. DevCentral, with its 101 series back in the day was a great starting point, and for that I need to thank the likes of Jason, Colin and Joe. Since then the security sessions with Josh and now John are invaluable and useful to my everyday work. Since being more comfortable with the technology DC has helped enormously when presented with very specific use cases to solve by customers, especially if iRules are required, there’s always a codeshare item that can be used as a basis for a custom solution. It saves a lot of time and head scratching.

DC: Lastly, if you weren’t an IT admin – what would be your dream job? Or better, when you were a kid – what did you want to be when you grew up?

NB: Growing up I was fascinated by true crime books and TV shows. So if I had my time again I would definitely be a lawyer, a barrister perhaps…although I’m not sure how the wig would look on me!

Thanks Nathan! Check out all of Nathan's DevCentral contributions, connect with him on Twitter and visit NTT Security or follow on Twitter.

 




Prevent a Spoof of an X-Forwarded-For Request with BIG-IP

Posted in security, f5, big-ip, application security, http, compliance, scams, devcentral, infrastructure by psilva on October 24th, 2017

Last week, we looked at how to do Selective Compression on BIG-IP with a local traffic policy so this week let’s try something security related using the same procedures.

You can associate a BIG-IP local traffic policy to prevent a spoof of an x-forwarded-for request. This is where bad actors might attempt to thwart security by falsifying the IP address in a header, and pass it through the BIG-IP system.

Pre-reqs:

  • We’re using BIG-IP v12 and,
  • We already have a Virtual Server configured to manage HTTP traffic with an HTTP profile assigned to it.

Let’s log into a BIG-IP

xf1.jpg

The first thing we’ll need to do is create a draft policy. On the main menu select Local Traffic>Policies>Policy List and then the Create or + button.

xf2.jpg

This takes us to the create policy config screen. Type a unique Policy Name like PreventSpoofOfXFF and optionally, add a description. Leave the Strategy at the default of Execute First matching rule. Click Create Policy.

xf3.jpg

We’re then directed to the draft policy’s General Properties page and here we can create the rules for the policy. In the Rules area, click Create.

xf4.jpg

We’ll give the rule a unique name like, StopSpoof and the first condition we need to configure is to match all HTTP traffic with the matching strategy. This means we can use the default setting of All Traffic. Then we’ll tell the policy what to do when the All Traffic condition matches. The new action is to Replace the http header named X-forwarded-for with the value of tcl:[IP::client_addr] (to return the client IP address of the connection) at the request time. Click Save.

xf5.jpg

Also, save the draft.

xf6.jpg

And then select the box next to the draft policy and click Publish.

xf7.jpg

We can now associate the published policy with a virtual server that we’re using to manage http traffic. On the main menu click Local Traffic>Virtual Servers>Virtual Server List and click the name of the virtual server you’d like to associate for the policy.

xf8.jpg

On the menu bar click Resources and next to Policies click Manage.

xf9.jpg

Move PreventSpoofOfXFF to the Enabled list and click Finished.

xf9a.jpg

Now, the virtual server with the PreventSpoofOfXFF local traffic policy will prevent any HTTP traffic that attempts to spoof an x-forwarded-for request.

Congrats! You’ve easily added additional security to your local traffic policy! You can also watch the full video demo thanks to our TechPubs team.

ps




Lightboard Lessons: What are Bots?

Posted in security, f5, big-ip, silva, basics, devcentral, botnet, risk by psilva on October 18th, 2017

In this Lightboard Lesson, I light up some #basics about internet bots and botnets. Humans account for less than 50% of internet traffic and the rest is spread between the good bots and bad ones.

 

Watch Now:



Selective Compression on BIG-IP

Posted in f5, big-ip, optimization, application delivery, compression, management, devcentral by psilva on October 17th, 2017

BIG-IP provides Local Traffic Policies that simplify the way in which you can manage traffic associated with a virtual server.

You can associate a BIG-IP local traffic policy to support selective compression for types of content that can benefit from compression, like HTML, XML, and CSS stylesheets. These file types can realize performance improvements, especially across slow connections, by compressing them. You can easily configure your BIG-IP system to use a simple Local Traffic Policy that selectively compresses these file types. In order to use a policy, you will want to create and configure a draft policy, publish that policy, and then associate the policy with a virtual server in BIG-IP v12.

Alright, let’s log into a BIG-IP

c1.jpg

The first thing you’ll need to do is create a draft policy. On the main menu select Local Traffic>Policies>Policy List and then the Create or + button.

c2.jpg

This takes us to the create policy config screen. We’ll name the policy SelectiveCompression, add a description like ‘This policy compresses file types,’ and we’ll leave the Strategy as the default of Execute First matching rule. This is so the policy uses the first rule that matches the request. Click Create Policy which saves the policy to the policies list.

c3.jpg

When saved, the Rules search field appears but has no rules. Click Create under Rules.

c4.jpg

This brings us to the Rules General Properties area of the policy. We’ll give this rule a name (CompressFiles) and then the first settings we need to configure are the conditions that need to match the request. Click the + button to associate file types.

c5.jpg

We know that the files for compression are comprised of specific file types associated with a content type HTTP Header. We choose HTTP Header and select Content-Type in the Named field. Select ‘begins with’ next and type ‘text/’ for the condition and compress at the ‘response’ time. We’ll add another condition to manage CPU usage effectively. So we click CPU Usage from the list with a duration of 1 minute with a conditional operator of ‘less than or equal to’ 5 as the usage level at response time.

c6.jpg

Next under Do the following, click the create + button to create a new action when those conditions are met. Here, we’ll enable compression at the response time. Click Save.

c7.jpg

Now the draft policy screen appears with the General Properties and a list of rules. Here we want to click Save Draft.

c8.jpg

Now we need to publish the draft policy and associate it with a virtual server. Select the policy and click Publish.

c9a.jpg

Next, on the main menu click Local Traffic>Virtual Servers>Virtual Server List and click the name of the virtual server you’d like to associate for the policy.

c9a.jpg

On the menu bar click Resources and for Policies click Manage.

c9b.jpg

Move SelectiveCompression to the Enabled list and click Finished.

c9c.jpg

The SelectiveCompression policy is now listed in the policies list which is now associated with the chosen virtual server. The virtual server with the SelectiveCompression Local Traffic Policy will compress the file types you specified.

c9d.jpg

Congrats! You’ve now added a local traffic policy for selective compression! You can also watch the full video demo thanks to our TechPubs team.

ps




Legacy Application SSO with BIG-IP and Okta

Posted in security, f5, big-ip, silva, authentication, kerberos, devcentral, saml, access by psilva on October 10th, 2017

IT organizations have a simple goal: make it easy for workers to access all their work applications from any device. But that simple goal becomes complicated when new apps and old, legacy applications do not authenticate in the same way.

Today we’ll take you through BIG-IP APM’s integration with Okta, a cloud-based identity-as-a-service provider.

The primary use case for this scenario is providing the user authentication through Okta and then Okta providing BIG-IP APM a SAML assertion so that BIG-IP can perform legacy SSO using either Kerberos Constrained Delegation (KCD) or Header Authentication. BIG-IP is the Service Provider (SP) in this SAML transaction.

As we log on to a BIG-IP, you’ll see that we have two policies/application examples.

ok1.jpg

Let’s click on the Edit button under Access Policy for app1-saml-sp-okta. This takes us to the Visual Policy Editor (VPE) for the first application. As the chart flows, BIG-IP is consuming the SAML authentication, then storing the SSO credentials and doing a Variable Assign so we know who the user is.

ok2.jpg

The next entry, app3-saml-sp-okta, looks very similar.

ok3.jpg

One of the things that is different however is for Header Authentication, we’re using a Per Request Policy. You can view/configure this by going to Access Policy>Per Request Policy.

ok45.jpg

We click Edit (under Access Policy) and here via the flow, the user enters and on every request, we’re going to remove the Okta header name, which is arbitrary and doesn’t need to be that value – could be any value you choose. But we want to make sure that no one is able to pad that header into a request. So, we’ll remove it and insert the variables BIG-IP receives from Okta. This way the application can consume it and we know who that user is.

ok67.jpg

So, what does it look like.

First, we’ll log into Okta and in the portal, we see two applications – the Header Auth and Kerberos Auth.

ok89.jpg

We’ll test the Header authentication first and see that we’re logged into App1 using Header authentication. Tuser@f5demo.com was the account we logged into with Okta and we see the application has been single-signed into using that credential.

ok9a.jpg

Now let’s hit that Kerberos auth application. Here again, we’ve been SSO’d into the application. You may notice that the user looks a bit different here as F5DEMO user since this time we used Kerberos Constrained Delegation. So, we’ve obtained a Kerberos ticket from the domain controller for F5DEMO as the user to use. So the username can look a little different but it’s mainly about formatting.

ok9b.jpg

BIG-IP is able to consume that SAML assertion from Okta and then use SSO capabilities via Header or Kerberos for legacy applications. Watch Cody Green’s excellent demo of this integration.




Lightboard Lessons: Connecting Cars with BIG-IP

Posted in f5, big-ip, availability, cloud computing, silva, video, lightboard, control, devcentral, mqtt, connected cars by psilva on October 4th, 2017

I light up how BIG-IP and Solace work together in a MQTT connected car infrastructure.

 

 

 

Watch Now:



DevCentral’s Featured Member for October – Jad Tabbara

Posted in security, f5, big-ip, devcentral, featured member by psilva on October 3rd, 2017

Technical Articles | F5 DevCentral

 




Add a Data Collection Device to your BIG-IQ Cluster

Posted in f5, big-ip, silva, application delivery, management, devcentral, big-iq by psilva on September 26th, 2017

big-iq-200-5000.pngGathering and analyzing data helps organizations make intelligent decisions about their IT infrastructure. You may need a data collection device (DCD) to collect BIG-IP data so you can manage that device with BIG-IQ. BIG-IQ is a platform that manages your devices and the services they deliver. Let’s look at how to discover and add a data collection device in BIG-IQ v5.2. You can add a new data collection device to your BIG-IQ cluster so that you can start managing it using the BIG-IP device data.

In addition to Event and Alert Log data, you can view and manage statistical data for your devices. From licensing to policies, traffic to security, you’ll see it all from a single pane of glass.

But you need a DCD to do that.

So, we start by logging in to a BIG-IQ.

iq1.jpg

Then, under the System tab, go to BIG-IQ Data Collection and under that, click BIG-IQ Data Collection Devices.

iq2.jpg

The current DCD screen shows no devices in this cluster. To add a DCD, click Add.

iq3.jpg

This brings us to the DCD Properties screen. For Management Address field, we add the management IP address of the BIG-IP/DCD we want to manage. We’ll then add the Admin username and password for the device. For Data Collection IP Address, we put the transport address which is usually the internal Self-IP address of the DCD and click Add.

iq4.jpg

The process can take a little while as the BIG-IQ authenticates with the BIG-IQ DCD and adds it to the BIG-IQ configuration. But once complete, you can see the devices has been added successfully.

iq6.jpg

Now you’ll notice that the DCD has been added but there are no Services at this point. To add Services, click Add Services.

iq7.jpg

In this instance, we’re managing a BIG-IP with multiple services including Access Policies so we’re going to activate the Access services. The listener address already has the management address of the DCD populated so we’ll simply click Activate. Once activated, you can see that it is Active.

iq89.jpg

When we go back to the Data Collection Devices page, we can see that the Access Services have been added and the activation worked.

iq9a.jpg

Congrats! You’ve added a Data Collection Device! You can also watch a video demo of How to Add a data collection device to your BIG-IQ cluster.

ps




Lightboard Lessons: What is HTTP?

Posted in f5, big-ip, application delivery, lightboard, http, devcentral by psilva on September 20th, 2017

In this Lightboard Lesson, I light up some #basics about HTTP. HTTP defines the structure of messages between web components such as browser or command line clients, servers like Apache or Nginx, and proxies like the BIG-IP.

 

 

Watch Now:



DevCentral’s Featured Member for September – Rob Carr

Posted in f5, big-ip, devcentral by psilva on September 11th, 2017

robcarr.jpgRob Carr is a Senior Trainer/Professional Services Consultant with Red Education Pty in Australia, covering the Oceania and Asia markets. He has done training and engagements from New Zealand to Taiwan and points in between. About 60% of his time is running F5 courses, ranging from the from the introductory Admin course through the high-level courses like AFM, ASM or iRules. He enjoys the mix of work, where teaching allows him to be social and PS work lets him delve into the technical nitty-gritty. Rob is also DevCentral's Featured Member for September!

DevCentral: You were an F5er (ProServ Consultant) from 2013-15 and continue to be a very active contributor in the DevCentral community since then. What keeps you involved?

Rob: Long before I did PS Consulting for F5, I worked for F5 in Seattle, first as a Network Support Engineer and then as Software Test Engineer, and I always found DC to be extremely useful. While F5 puts considerable energy into its product documentation and knowledge base articles, there are times when you need an ‘outside’ perspective to really understand what a feature is and how to use it. I always exhort my students to use DC as a resource, and not just for iRules.

I stay active because I use the site to answer my own questions and because I appreciate it when someone knowledgeable contributes a write-up or a really solid comment. I try and give back by commenting when the subject of a question is one in which I have experience.

DC: Tell us a little about the areas of BIG-IP expertise you have.

RC: I’ve been working with BIG-IP since 2005, when there were only two products, BIG-IP and 3DNS (FirePass joined F5 a few months after I did), and those two (well, the current iterations of LTM and DNS) are my strongest products. I’ve also worked with BIG-IP ASM, APM and AFM over my career. Today, I’m most comfortable with BIG-IP ASM and general Application Delivery more generally at this point.

DC: You are a Consultant & Trainer at Red Education. Can you describe your typical workday?

RC: If I’m training then I try to be onsite about an hour before the students. I need the time to setup the room, settle my thoughts and flip through the material we need to cover that day. Generally, training is a nine-to-five experience, although that can be modified by where the training is being done – in some countries, courses start later, then run into the early evening. Regardless of the specific hours, my tasks for the day are pretty much the same: cover the material, answer student questions and redirect where needed, proctor the labs and troubleshoot course and student issues. It’s almost like being on stage for an eight-hour show.

reded.jpgConsulting, on the other hand, is generally quite a bit more solitary. I do most of my work remotely, so once I’ve met with the client and we’ve had our kickoff activities, I’m back in Melbourne working from my home office. It’s not unusual to have a conference call once a day with the customer and technical staff and there is always email communication about the design and documentation tasks.

In the background, there is always communication with the constellation of trainers and consultants that I work with, sharing ideas, running questions past one another or bantering.

DC: You have a number of F5 Certifications including most of the Technology Specialist (LTM, GTM, APM, ASM) certifications. Why are these important to you and how have they helped with your career?

RC: I have all the F5 Certifications at this point, including the 401 Security Solution Expert exam and I suppose I’m a bit proud of that fact. I think F5’s certification exams are pretty good at covering what you need to know to be successful working on F5 systems in the enterprise, certainly more so than some of the other vendor exams.

In Australia, engagements often come with a requirement that you have certification for the product or products, so in that sense having the certifications has been good for my career. More generally, having the certifications has given me more confidence in representing my skills to prospective clients.

DC: Describe one of your biggest BIG-IP challenges and how DevCentral helped in that situation.

RC: Recently, I was on an engagement where the customer was migrating internal architectures for some highly fragmented legacy applications, as part of a PCI compliance project. We needed to replace many mod_proxy implementations and to mitigate application issues that came up during this transition, all on a short timeline. We ended up using multiple iRules with each service, providing routing and forwarding and fixing issues like improperly set cookie attributes. iRules is such a powerful and flexible solution that in the near term, given our timeline, it was the best and fastest way to manage the application issues.

DC: Lastly, if you weren’t an IT admin – what would be your dream job? Or better, when you were a kid – what did you want to be when you grew up?

RC: I’ve always enjoyed gardening and I’m fond of zoos and animal parks, so if I wasn’t working in IT, I think I would like to be a gardener at the zoo.

Thanks Rob! Check out all of Rob's DevCentral contributions, connect with him on LinkedIn and visit Red Education.

 





« Older episodes · Newer episodes »