|
| 1 | +# Deploying the BIG-IP VE from the Azure Marketplace - Autoscale BIG-IP LTM - VM Scale Set |
| 2 | + |
| 3 | +[](https://f5cloudsolutions.herokuapp.com) |
| 4 | +[](https://github.com/f5networks/f5-azure-arm-templates/releases) |
| 5 | +[](https://github.com/f5networks/f5-azure-arm-templates/issues) |
| 6 | + |
| 7 | +**Contents** |
| 8 | + - [Introduction](#introduction) |
| 9 | + - [Prerequisites](#prerequisites-and-configuration-notes) |
| 10 | + - [Getting Help](#help) |
| 11 | + - [Launching the Solution Template](#launching-the-solution-template) |
| 12 | + - [Configuration Example](#configuration-example) |
| 13 | + - [Post Deployment Configuration](#post-deployment-configuration) |
| 14 | + - [Service Discovery](#service-discovery) |
| 15 | + - [Service Principal Authentication](#service-principal-authentication) |
| 16 | + |
| 17 | +## Introduction |
| 18 | + |
| 19 | +This Azure Marketplace solution uses a solution template to launch the deployment of F5 BIG-IP LTM (Local Traffic Manager) Virtual Edition (VE) instances in a Microsoft Azure VM Scale Set that is configured for autoscaling. Traffic flows from the Azure load balancer to the BIG-IP VE (cluster) and then to the application servers. The BIG-IP VE(s) are configured in single-NIC mode. As traffic increases or decreases, the number of BIG-IP VE instances automatically increases or decreases accordingly. Scaling thresholds are currently based on *network out* throughput. This solution is for BIG-IP LTM only, and can be deployed into a new or existing networking stack. |
| 20 | + |
| 21 | +## Prerequisites and configuration notes |
| 22 | + - **Important**: When you configure the admin password for the BIG-IP VE in the template, you cannot use the character **#**. Additionally, there are a number of other special characters that you should avoid using for F5 product user accounts. See https://support.f5.com/csp/article/K2873 for details. |
| 23 | + - This template supports [Service Discovery](#service-discovery). |
| 24 | + - This template requires service principal. See the [Service Principal Setup section](#service-principal-authentication) for details. |
| 25 | + - This template has some optional post-deployment configuration. See the [Post-Deployment Configuration section](#post-deployment-configuration) for details. |
| 26 | + - For this solution, only Azure instances that include premium storage are supported. |
| 27 | + |
| 28 | + |
| 29 | +## Supported BIG-IP versions |
| 30 | +The following is a map that shows the available options for the template parameter **bigIpVersion** as it corresponds to the BIG-IP version itself. Only the latest version of BIG-IP VE is posted in the Azure Marketplace. For older versions, see downloads.f5.com. |
| 31 | + |
| 32 | +| Azure BIG-IP Image Version | BIG-IP Version | |
| 33 | +| --- | --- | |
| 34 | +| 13.0.021 | 13.0.0 HF2 Build 2.10.1671 | |
| 35 | +| 12.1.24 | 12.1.2 HF1 Build 1.34.271 | |
| 36 | + |
| 37 | + |
| 38 | +## Supported instance types and hypervisors |
| 39 | + - This solution supports the following Azure instance types: Standard_DS2, Standard_DS3, Standard_DS4, Standard_DS11, Standard_DS12, Standard_DS13, Standard_DS14, Standard_DS2_v2, Standard_DS3_v2, Standard_DS4_v2, Standard_DS5_v2, Standard_DS11_v2, Standard_DS12_v2, Standard_DS13_v2, Standard_DS14_v2, Standard_DS15_v2, Standard_F2S, Standard_F4S, Standard_F8S. |
| 40 | + |
| 41 | + - For a list versions of the BIG-IP Virtual Edition (VE) and F5 licenses that are supported on specific hypervisors and Microsoft Azure, see https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/ve-supported-hypervisor-matrix.html. |
| 42 | + |
| 43 | +### Help |
| 44 | +Because this solution has been created and fully tested by F5 Networks, it is fully supported by F5. This means you can get assistance if necessary from [F5 Technical Support](https://support.f5.com/csp/article/K40701984). |
| 45 | + |
| 46 | +We encourage you to use our [Slack channel](https://f5cloudsolutions.herokuapp.com) for discussion and assistance on F5 ARM templates. This channel is typically monitored Monday-Friday 9-5 PST by F5 employees who will offer best-effort support. |
| 47 | + |
| 48 | + |
| 49 | + |
| 50 | +## Launching the Solution Template |
| 51 | +This Readme file describes launching the auto scale BIG-IP WAF solution template from the Azure Marketplace. From the Azure Marketplace, click the Add (+) button and then search for **F5 autoscale**. From the search results, click **F5 BIG-IP VE LTM AutoScale Solution** and then click the **Create** button. |
| 52 | + |
| 53 | + |
| 54 | +### Solution Template Fields |
| 55 | +The following table lists the information gathered by the solution template. Note that fields in the template with an asterisk are required. Some fields are validated as you type; if you see a red exclamation point, click it to get information on how to correct your entry. |
| 56 | + |
| 57 | +| Section | Field | Description | |
| 58 | +| --- | --- | --- | |
| 59 | +| **Basics** | Subscription | Ensure the proper subscription is selected. | |
| 60 | +| | Resource Group | You can select an existing Azure Resource Group, or have the solution create a new one. If you select a new group, type a name in the field. | |
| 61 | +| | Location | Select the Azure location in which you want to deploy this solution. | |
| 62 | +| **Infrastructure Settings** | Deployment Name | A unique name for this implementation. | |
| 63 | +| | BIG-IP Version | Choose whether you want to use BIG-IP v13 or v12.1.2 | |
| 64 | +| | BIG-IP Image Name | Because this solution uses ASM, Best is the only option. | |
| 65 | +| | Minimum Number of BIG-IP VEs | The minimum (and default) number of BIG-IP VEs that are deployed into the VM Scale Set. We recommend at least 2. | |
| 66 | +| | Licensed Bandwidth | The amount of licensed bandwidth (Mbps) you want to allocate for each WAF. | |
| 67 | +| | F5 LTM Username | LTM administrative username for the Azure virtual machine(s). | |
| 68 | +| | F5 LTM Password | LTM administrative password for the Azure virtual machine(s). | |
| 69 | +| | Confirm Password | Retype the password. | |
| 70 | +| | Virtual Machine Size | The size of the Azure virtual machine you want to provision for each cluster node. | |
| 71 | +| | Use Managed disks | You can enable managed disks to have Azure automatically manage the availability of disks to provide data redundancy and fault tolerance, without creating and managing storage accounts on your own. | |
| 72 | +| | Public IP Address | The public IP address to communicate with the Azure Virtual Machine Scale Set from outside the virtual network. | |
| 73 | +| | Domain Name Label | The label used to construct the DNS record of the Azure Public IP. This record must be unique within the Azure region. | |
| 74 | +| | Virtual Network | Create a new virtual network, or select an existing network from the same Azure region as the deployment resource group. | |
| 75 | +| | Subnets | If you are creating a new virtual network, configure the name and address space for the new subnet. If you select an existing virtual network, specify an existing subnet in that network. Only subnets meeting the minimum requirements for this solution are displayed. | |
| 76 | +| | Restricted source network or address | This field restricts management access to a specific network or address. Enter an IP address or address range in CIDR notation, or asterisk for all sources. | |
| 77 | +| | NTP Server | You can use the default NTP server the BIG-IP uses, or replace the default NTP server as applicable. | |
| 78 | +| | Time Zone | You can use the default timezone (UTC) or change it as applicable. This should be in the format of the Olson timezone string from /usr/share/zoneinfo, such as UTC, US/Central or Europe/London. | |
| 79 | +| **Autoscale Settings** | VM Scale Set Maximum Count | The maximum number of BIG-IP VEs that can be deployed into the VM Scale Set (2-8). | |
| 80 | +| | VM Scale Set Scale Out Throughput | The percentage of *Network Out* throughput that triggers a Scale Out event. This is factored as a percentage of the F5 PAYG image bandwidth (Mbps) size you chose). | |
| 81 | +| | VM Scale Set Scale In Throughput | The percentage of *Network Out* throughput that triggers a Scale In event. This is factored as a percentage of the F5 PAYG image bandwidth (Mbps) size you chose). | |
| 82 | +| | VM Scale Set Time Window | The time window required to trigger a scale event (in and out). This is used to determine the amount of time needed for a threshold to be breached, as well as to prevent excessive scaling events (flapping). | |
| 83 | +| | Tenant ID | Your Azure service principal application tenant ID. | |
| 84 | +| | Client ID | Your Azure service principal application client ID. | |
| 85 | +| | Secret | Your Azure service principal application secret. | |
| 86 | +| | Email for Scale Event Notifications | If you would like email notifications on scale events you can specify an email address. Note: You can specify multiple emails by separating them with a semi-colon such as 'email@domain.com;email2@domain.com'. | |
| 87 | + |
| 88 | + |
| 89 | +## Configuration Example |
| 90 | + |
| 91 | +The following is an example configuration diagram for this solution deployment. In this scenario, all access to the BIG-IP VE appliance is through an Azure Load Balancer. The Azure Load Balancer processes both management and data plane traffic into the BIG-IP VEs, which then distribute the traffic to web/application servers according to normal F5 patterns. |
| 92 | + |
| 93 | + |
| 94 | + |
| 95 | +## Post-Deployment Configuration |
| 96 | +If you need to add more applications to this deployment, see https://github.com/F5Networks/f5-azure-arm-templates/tree/master/experimental/reference/scripts. |
| 97 | + |
| 98 | +### Additional Optional Configuration Items |
| 99 | +Here are some post-deployment options that are entirely optional but could be useful based on your needs. |
| 100 | + |
| 101 | +#### BIG-IP Lifecycle Management |
| 102 | +As new BIG-IP versions are released, existing VM scale sets can be upgraded to use those new images. In an existing implementation, we assume you have created different types of BIG-IP configuration objects (such as virtual servers, pools, and monitors), and you want to retain this BIG-IP configuration after an upgrade. This section describes the process of upgrading and retaining the configuration. |
| 103 | + |
| 104 | +When this ARM template was initially deployed, a storage account was created in the same Resource Group as the VM scale set. This account name ends with **data000*** (the name of storage accounts have to be globally unique, so the prefix is a unique string). In this storage account, the template created a container named **backup**. We use this backup container to hold backup [UCS](https://support.f5.com/csp/article/K13132) configuration files. Once the UCS is present in the container, you update the scale set "model" to use the newer BIG-IP version. Once the scale set is updated, you upgrade the BIG-IP VE(s). As a part of this upgrade, the provisioning checks the backup container for a UCS file and if one exists, it uploads the configuration (if more than one exists, it uses the latest). |
| 105 | + |
| 106 | +**To upgrade the BIG-IP VE Image** |
| 107 | + 1. Save a UCS backup file of the current BIG-IP configuration (cluster or standalone) |
| 108 | + - From the CLI command: ```# tmsh save /sys ucs /var/tmp/original.ucs``` |
| 109 | + - From the Configuration utility: **System > Archives > Create** |
| 110 | + 2. Upload the UCS into the **backup** container of the storage account ending in **data000** (it is a Blob container) |
| 111 | + 3. Update the VM Scale Set Model to the new BIG-IP version |
| 112 | + - From PowerShell: Use the PowerShell script in the **scripts** folder in this directory |
| 113 | + - Using the Azure redeploy functionality: From the Resource Group where the ARM template was initially deployed, click the successful deployment and then select to redeploy the template. If necessary, re-select all the same variables, and **only change** the BIG-IP version to the latest. |
| 114 | + 4. Upgrade the Instances |
| 115 | + 1. In Azure, navigate to the VM Scale Set instances pane and verify the *Latest model* does not say **Yes** (it should have a caution sign instead of the word Yes) |
| 116 | + 2. Select either all instances at once or each instance one at a time (starting with instance ID 0 and working up). |
| 117 | + 3. Click the **Upgrade** action button. |
| 118 | + |
| 119 | + |
| 120 | +### Service Discovery |
| 121 | +Once you launch your BIG-IP instance using the solution template, you can use the Service Discovery iApp template on the BIG-IP VE to automatically update pool members based on auto-scaled cloud application hosts. In the iApp template, you enter information about your cloud environment, including the tag key and tag value for the pool members you want to include, and then the BIG-IP VE programmatically discovers (or removes) members using those tags. |
| 122 | + |
| 123 | +#### Tagging |
| 124 | +In Microsoft Azure, you have three options for tagging objects that the Service Discovery iApp uses. Note that you select public or private IP addresses within the iApp. |
| 125 | + - *Tag a VM resource*<br> |
| 126 | +The BIG-IP VE will discover the primary public or private IP addresses for the primary NIC configured for the tagged VM. |
| 127 | + - *Tag a NIC resource*<br> |
| 128 | +The BIG-IP VE will discover the primary public or private IP addresses for the tagged NIC. Use this option if you want to use the secondary NIC of a VM in the pool. |
| 129 | + - *Tag a Virtual Machine Scale Set resource*<br> |
| 130 | +The BIG-IP VE will discover the primary private IP address for the primary NIC configured for each Scale Set instance. Note you must select Private IP addresses in the iApp template if you are tagging a Scale Set. |
| 131 | + |
| 132 | +The iApp first looks for NIC resources with the tags you specify. If it finds NICs with the proper tags, it does not look for VM resources. If it does not find NIC resources, it looks for VM resources with the proper tags. In either case, it then looks for Scale Set resources with the proper tags. |
| 133 | + |
| 134 | +**Important**: Make sure the tags and IP addresses you use are unique. You should not tag multiple Azure nodes with the same key/tag combination if those nodes use the same IP address. |
| 135 | + |
| 136 | +To launch the template: |
| 137 | + 1. From the BIG-IP VE web-based Configuration utility, on the Main tab, click **iApps > Application Services > Create**. |
| 138 | + 2. In the **Name** field, give the template a unique name. |
| 139 | + 3. From the **Template** list, select **f5.service_discovery**. The template opens. |
| 140 | + 4. Complete the template with information from your environment. For assistance, from the Do you want to see inline help? question, select Yes, show inline help. |
| 141 | + 5. When you are done, click the **Finished** button. |
| 142 | + |
| 143 | +### Service Principal Authentication |
| 144 | +This solution requires access to the Azure API to determine how the BIG-IP VEs should be configured. The most efficient and security-conscious way to handle this is to utilize Azure service principal authentication, for all the typical security reasons. The following provides information/links on the options for configuring a service principal within Azure if this is the first time it is needed in a subscription. |
| 145 | + |
| 146 | +_Ensure that however the creation of the service principal occurs to verify it only has minimum required access based on the solutions need(read vs read/write) prior to this template being deployed and used by the solution within the resource group selected(new or existing)._ |
| 147 | + |
| 148 | +**Minimum Required Access:** **Read** access is required, it can be limited to the resource group used by this solution. |
| 149 | + |
| 150 | +The end result should be possession of a client(application) ID, tenant ID and service principal secret that can login to the same subscription this template will be deployed into. Ensuring this is fully functioning prior to deploying this ARM template will save on some troubleshooting post-deployment if the service principal is in fact not fully configured. |
| 151 | + |
| 152 | +#### 1. Azure Portal |
| 153 | + |
| 154 | +Follow the steps outlined in the [Azure Portal documentation](https://azure.microsoft.com/en-us/documentation/articles/resource-group-create-service-principal-portal/) to generate the service principal. |
| 155 | + |
| 156 | +#### 2. Azure CLI |
| 157 | + |
| 158 | +This method can be used with either the [Azure CLI v2.0 (Python)](https://github.com/Azure/azure-cli) or the [Azure Cross-Platform CLI (npm module)](https://github.com/Azure/azure-xplat-cli). |
| 159 | + |
| 160 | +_Using the Python Azure CLI v2.0 - requires just one step_ |
| 161 | +```shell |
| 162 | +$ az ad sp create-for-rbac |
| 163 | +``` |
| 164 | + |
| 165 | +_Using the Node.js cross-platform CLI - requires additional steps for setting up_ |
| 166 | +https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-authenticate-service-principal-cli |
| 167 | + |
| 168 | +#### 3. Azure PowerShell |
| 169 | +Follow the steps outlined in the [Azure Powershell documentation](https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-authenticate-service-principal) to generate the service principal. |
| 170 | + |
| 171 | + |
| 172 | +## Filing Issues |
| 173 | +If you find an issue, we would love to hear about it. |
| 174 | +You have a choice when it comes to filing issues: |
| 175 | + - Use the **Issues** link on the GitHub menu bar in this repository for items such as enhancement or feature requests and non-urgent bug fixes. Tell us as much as you can about what you found and how you found it. |
| 176 | + - Contact F5 Technical support via your typical method for more time sensitive changes and other issues requiring immediate support. |
| 177 | + |
| 178 | + |
| 179 | +## Copyright |
| 180 | + |
| 181 | +Copyright 2014-2017 F5 Networks Inc. |
| 182 | + |
| 183 | + |
| 184 | +## License |
| 185 | + |
| 186 | + |
| 187 | +Apache V2.0 |
| 188 | +~~~~~~~~~~~ |
| 189 | +Licensed under the Apache License, Version 2.0 (the "License"); you may not use |
| 190 | +this file except in compliance with the License. You may obtain a copy of the |
| 191 | +License at |
| 192 | +
|
| 193 | +http://www.apache.org/licenses/LICENSE-2.0 |
| 194 | +
|
| 195 | +Unless required by applicable law or agreed to in writing, software |
| 196 | +distributed under the License is distributed on an "AS IS" BASIS, |
| 197 | +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 198 | +See the License for the specific language governing permissions and limitations |
| 199 | +under the License. |
| 200 | +
|
| 201 | +Contributor License Agreement |
| 202 | +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ |
| 203 | +Individuals or business entities who contribute to this project must have |
| 204 | +completed and submitted the [F5 Contributor License Agreement](http://f5-openstack-docs.readthedocs.io/en/latest/cla_landing.html). |
| 205 | +
|
| 206 | +
|
0 commit comments