Upload
braulio-dominick
View
230
Download
8
Tags:
Embed Size (px)
Citation preview
© F5 Networks, Inc.
1
F5 User’s Group September 13th 2011
Agenda
TMOS version 11 New features and overview Demo vCMP Demo and discuss iApps
User discussion – iRules
Survey and suggestions for next meeting
Bowling and/or game play
V11 - Revolution
© F5 Networks, Inc.
3
Analytics – URL Load Times
© F5 Networks, Inc.
4
Analytics – TPS per URL
© F5 Networks, Inc.
5
Analytics – Request Throughput per URL
© F5 Networks, Inc.
6
Analytics – Response Throughput per URL
© F5 Networks, Inc.
7
Statistics and Reporting Per Virtual Server CPU Stats and Profile Stats
* Improved Visibility for Each Virtual Service
© F5 Networks, Inc.
8
Statistics and ReportingPer Process CPU & Memory Stats – Dashboard Customization
* Improved Diagnostics
© F5 Networks, Inc.
9
Real-time Transaction logs
Client
Open Application Logging Engine
High Speed Logging Engine (HSL)
• GUI - Request Logging Profile
• Unmatched performance - Up to 200,000 HSL (TCP/UDP) messages per second with minimal impact to cpu usage
• Support compliance requirements
• W3C standard web log format support
© F5 Networks, Inc.
10
F5 ScaleN ArchitectureUltimate Scalability and Reliability
Scale Up
Scale Out
Virtualization (vCMP)
Clustered Multiprocessing (CMP) & SuperVIP
TMOS
The flexibility to scale up, virtualize, and scale out on-demand
© F5 Networks, Inc.
11
Typical Failover – Limited Control
• Typical ADC runs Active-Standby
• Can only fail entire ADC
• Failover events disrupt all services
© F5 Networks, Inc.
12
ScaleN : Device Service ClustersDynamic Service Based Failover
• Fail-over targeted application workloads
• Avoid application service disruptions
• Move applications needing extra power
© F5 Networks, Inc.
13
• Active-active-activeN Scale
• Blade fails on BIG-IP 1
• Add new blade to BIG-IP 3
• Blade replaced on BIG-IP 1
• Any type of BIG-IP device
ScaleN: Device Service ClustersElastic Scale Driving Efficiency
© F5 Networks, Inc.
14
Akamai
TMOS – TCP, HTTP, & iRule Enhancements
Ability to create TCP/UDP out of
band connections via iRules
TCP Connection Queuing
TCP Options inspection &
transformation with iRules
Separate caching &
compression profiles from
HTTP
HTML ParsingiRules
*Bigpipe is no longer supported in v11
© F5 Networks, Inc.
15
• Operates at TCP level; HTTP not required• Currently only engages when conn limit hit• Specify queue length limit, time limit, or both• Queues operate per-tmm (no state sharing)
• Length limit divided by tmm count• FIFO guarantees only per-tmm
• Queued at the pool level for non-persistent connections• Queued at the pool member level for persistent connections
• If conn limit is overridden by persistence, that conn is not queued
• When a pool member becomes available, it checks the head of its queue, and of the pool’s queue, and services the flow that got there first.
TCP Connection queuing
© F5 Networks, Inc.
16
New Product and Platform Support
• New 6900S (Turbo SSL), 11000 (48 GB Memory, 4xSSD’s (4x 300GB), 16 Gbps HW Comp.), and 11000/11050F (FIPS) platforms (October announcement)
• WOM standalone product and platforms (1600, 3600, 3900, 6900, 8900,11000)
• Modules: Add-on Module support VE and 1600 (ASM, WA, APM, GTM, WOM)
• Modules: Triplet support on 3600 and higher (Any combination excluding LC)
• VE Production (LTM, APM, ASM, WOM,GTM) *WA coming next release
• New VE Lab editions that include all products
3900/3600 8900/8950/8950S6900 and 6900S1600 11000 and 11050
October announcement
© F5 Networks, Inc.
17
BIG-IP Advanced Acceleration Overview
Adaptive Protection for Web 2.0 Applications
© F5 Networks, Inc.
18
Easily Secure JSON PayloadsBIG-IP Application Security Manager
Example: www.stockfacts.com
• Protect from JSON threats
• Render unique blocking message for AJAX widgets
• User informs admin with support ID for resolution
Display a Blocking Message in AJAX Widget
© F5 Networks, Inc.
19
F5 Innovative Protection for Web 2.0 Apps
• Secure all applications
• Automatically share policies between devices
• Quickly deploy BIG-IP ASM VE in private clouds
Internet
Private Cloud Apps
Data Center
Web 2.0 Apps
Hacker
Clients
BIG-IP ApplicationSecurity Manager
BIG-IP ApplicationSecurity Manager
© F5 Networks, Inc.
20
Customer Website
Protection from Vulnerabilities Enhanced Integration: BIG-IP ASM and WhiteHat Sentinel
WhiteHat Sentinel• Finds a vulnerability• Virtual-patching with
one-click on BIG-IP ASM
BIG-IP Application Security Manager
• Verify, assess, resolve and retest in one UI• Automatic or manual creation of policies• Discovery and remediation in minutes
• Vulnerability checking, detection and remediation
• Complete website protection
© F5 Networks, Inc.
21
• Policy Tuning• Pen tests• Performance Tests
• Final Policy Tuning• Pen Tests
• Incorporate vulnerability assessment into the SDLC
• Use business logic to address known vulnerabilities
• Allow resources to create value
ASM and the Software Development Lifecycle
• WAF “offload” features:• Cookies • Brute Force• DDOS• Web Scraping• SSL, Caching,
Compression
© F5 Networks, Inc.
22
BIG-IP Advanced Acceleration Overview
Advanced Dynamic Services for Unified Access Control
© F5 Networks, Inc.
23
F5 Unified Access and ControlFlexible and Dynamic ADC Services – BIG-IP v11
BIG-IP Edge Gateway+Access Policy Manager
+WebAccelerator+WAN Optimization Manager
Headquarters and Remote Offices
CorporateWAN
IPsec: Optimized Site-to-Site Tunnels
Internet
BIG-IP System Virtual Editions
BIG-IP Edge Gateway
Data Center
BIG-IP GlobalTraffic Manager
BIG-IP LocalTraffic Manager
+Access Policy Manager
Mobile and Remote Users
Public/PrivateCloud
Optimized Applications to BIG-IP Edge Client
© F5 Networks, Inc.
24
Authentication All in One and Fast SSO F5 BIG-IP Access Policy Manager
Dramatically reduce infrastructure costs; increase productivity
= BIG-IP v11
© F5 Networks, Inc.
25
New Detailed ReportingBIG-IP APM
Custom, Built-in and Saved reports
Exported and usedon other devices
e.g How many XP users are still on my network?
e.g. Who accessed app. or network and when?
e.g. Where are users accessing from (geolocation)?
© F5 Networks, Inc.
26
BIG-IP Advanced Acceleration Overview
Scalable, Adaptive and Secure DNS infrastructure
© F5 Networks, Inc.
27
Scalable GSLB PerformanceStep 1: Multicore (CMP) BIG-IP GTM v11
• Enable users to access apps during spikes
• Scale with GTM query performance utilizing hardware– CMP enabled utilizing full set of processing cores
– Up to 6 million QPS on VIPRION
– Each CPU Core ~ high performance DNS server = 130k+ qps
• Integrates GTM in TMM for exponential performance
125k QPS
600k QPS
1.5Mil QPS
3Mil QPS
6Mil QPS2Mil
QPS
Preliminary estimates: (may exceed)
© F5 Networks, Inc.
28
Exponential and Efficient DNS Performance Step 2: Implement DNS Express
DNS Express
• High-speed response and DDoS protection with in-memory DNS
• Authoritative DNS serving out of RAM
• Configuration size for tens of millions of records
• Scalable DNS Performance
• Consolidate DNS ServersManage
DNSRecords
NIC
OSAdminAuthRoles
DynamicDNS
DHCP
AnswerDNS
QueryAnswer
DNSQuery
AnswerDNS
Query
AnswerDNS
Query
AnswerDNS
Query
DNS Express in TMOS
DNS Server
© F5 Networks, Inc.
29
Solution: Easily Handle All DNS Requests Step 3: BIG-IP GTM and IP Anycast Integration
• Same IP Address for multiple devices• Geographically separate the DNS request load for all requests• Scale DNS infrastructure up and out per BIG-IP • Revenue and brand are protected
© F5 Networks, Inc.
30
Eases the IPv6 EvolutionDNS 6 4• Combined NAT64 and DNS64 provide automatic translation• Supports pure IPv6 clients accessing both IPv6/IPv4 sites• Critical for mobile devices and any client optimized for pure IPv6• Eases evolution and bridges gap between IPv6/IPv4 DNS
Internet
IPv4 and IPv6 Clients
BIG-IP Local Traffic Manager+Global Traffic Manager
NAT64
Forwarding/ Mapping Virtual
v4 DNSwww.server.com
(A)
v6 DNSwww.server.com(AAAA)
DNS64
© F5 Networks, Inc.
31
Removed Basic/Advanced
listener
Usability EnhancementsRoute Domains, Monitors, & Default Certificates!
Optional manual selection of prober
assignments
iQuery status in in the GUI
GTM
Route Domain 0
Route Domain 1
Route Domain 2
BIG-IP Local Traffic Manager+Global Traffic Manager
BIG-IP
Global Traffic Manager
GTM monitor support of Route
Domains
Default certificate is now 10 yrs!
© F5 Networks, Inc.
32
• Free Customer Web-based Training What’s New in BIG-IP V11
• Additional v11 WBTs modules will be available later
Global Customer Training for V11
© F5 Networks, Inc.
33
vCMP DemoVirtual Clustered Multi-Processing
vCMP = F5’s purpose built hypervisor
Currently available with version 11 on the VIPRION platforms
Today’s demo is on a VIPRION 2400
© F5 Networks, Inc.
34
V11: The iApp Revolution
• Optimizing the network for specific applications takes weeks … and can be frustrating
• F5’s unique application deployment guides helped … now just days
• F5’s new iApp capability reduces process to hours and minutes and it’s portable like virtual machines
• Framework to unify, simplify and control Application Delivery Services
• Application-centric
• Contextual view and advanced analytics
• Rapid and predictable deployment
© F5 Networks, Inc.
35
BIG-IP V10 Managing Objects & ServicesBIG-IP V11 Managing Application Services
© F5 Networks, Inc.
36
BIG-IP V11 Managing Application Services
F5 iAPPs:Managing application services … not network devices or objects.
© F5 Networks, Inc.
37
• IT Network, Security, WAN, and Exchange Team Collaboration
• Application specific questions
© F5 Networks, Inc.
38
Use a single interface to:
• Understand F5 application service dependencies
• Rapidly perform operational tasks
• Quick view of overall application and health status
• View availability status and type for each service object
• Rapidly enable and disable resource pool nodes or servers.
The network from an “Application’s Point of View”
© F5 Networks, Inc.
39
iApp Ecosystem• More than 20 iApp templates come with v11
• F5’s Open iApp Ecosystem is part of DevCentral
• Share iApps within organizations, between partners, and other vendors
© F5 Networks, Inc.
40
User Discussion: iRulesRandy Ferguson – F5 Consultant (Tempe, AZ)
Do you have an iRule you would like to discuss?
Examples:
Select a pool based on the HTTP host header
Sideband Connection – new in v11
LDAP Proxy
Proxy Pass
Additional resources – DevCentral Tutorials
© 2011 F5 Networks, Inc. All rights reserved. F5, F5 Networks, the F5 logo, BIG-IP, ARX, FirePass, iControl, iRules, TMOS, and VIPRION are registered trademarks of F5 Networks, Inc. in the U.S. and in certain other countries