BIG-IP LTM : how to load new bigip_base.conf and bigip.conf by bigpipe command

Here’s an explanation of how to load new bigip_base.conf and bigip.conf.

Version: 10.2.3 Build: 123.0 BaseBuild: 112.0 Edition: Hotfix HF1

In my case , I sometimes edit bigip_base.conf and bigip_base.conf by text editor , vi or something ,  and then load those configuration files.

1. back up current configuration files

[root@bigip01:Active] config # cp bigip.conf /var/tmp/ [root@bigip01:Active] config # cp bigip_base.conf /var/tmp/

2. upload new bigip_base.conf and bigip.conf you want to load on your LTM device

[root@bigip01:Active] config # ls /root/ bigip_base.conf  bigip.conf

I uploaded new configuration files under /root directory via SSH

3. copy new configuration files under /config directory

[root@bigip01:Active] config # cp /root/bigip.conf /config/ cp: overwrite `/config/bigip.conf'? y [root@bigip01:Active] config # cp /root/bigip_base.conf /config/ cp: overwrite `/config/bigip_base.conf'? y

4. verify configuration syntax 

[root@bigip01:Active] config # b verify load /config/bigip_base.conf Reading configuration from /config/low_profile_base.conf. Reading configuration from /defaults/config_base.conf. Reading configuration from /config/bigip_sys.conf. Reading configuration from /config/bigip_base.conf. Validating the configuration ... [root@bigip01:Active] config # [root@bigip01:Active] config # b verify load /config/bigip.conf Reading configuration from /config/low_profile_base.conf. Reading configuration from /defaults/config_base.conf. Reading configuration from /config/bigip_sys.conf. Reading configuration from /config/bigip_base.conf. Reading configuration from /usr/share/monitors/base_monitors.conf. Reading configuration from /config/profile_base.conf. Reading configuration from /config/daemon.conf. Reading configuration from /config/bigip.conf. Reading configuration from /config/bigip_local.conf. Validating the configuration ... [root@bigip01:Active] config #

5. check whether new configuration files are loaded

[root@bigip01:Active] config # b base list [root@bigip01:Active] config # b list

6. load new bigip_base.conf and bigip.conf

[root@bigip01:Active] config # b base load /config/bigip_base.conf Reading configuration from /config/low_profile_base.conf. Reading configuration from /defaults/config_base.conf. Reading configuration from /config/bigip_sys.conf. Reading configuration from /config/bigip_base.conf. Loading the configuration ... [root@bigip01:Active] config # [root@bigip01:Active] config # b load /config/bigip.conf Reading configuration from /config/low_profile_base.conf. Reading configuration from /defaults/config_base.conf. Reading configuration from /config/bigip_sys.conf. Reading configuration from /config/bigip_base.conf. Reading configuration from /usr/share/monitors/base_monitors.conf. Reading configuration from /config/profile_base.conf. Reading configuration from /config/daemon.conf. Reading configuration from /config/bigip.conf. Reading configuration from /config/bigip_local.conf. Loading the configuration ... [root@bigip01:Active] config #

7. save

[root@bigip01:Active] config # b save all /config/bigip_base.conf was renamed to /config/bigip_base.conf.bak (102 lines). /config/bigip_sys.conf was renamed to /config/bigip_sys.conf.bak (33 lines). /config/bigip.conf was renamed to /config/bigip.conf.bak (166 lines). /config/bigip_local.conf was renamed to /config/bigip_local.conf.bak (1 lines).

BIG-IP 10.1 : How to send LTM’s local logs to remote syslog servers

Here’s an explanation of how to send LTM’s local logs to remote syslog servers.

LTM devices are using syslog-ng daemon , however I’m not familiar with syslog-ng ….

[root@ltm1:Active] config # chkconfig --list | grep syslog syslog-ng       0:off   1:off   2:on    3:on    4:on    5:on    6:off

To configure syslog settings , I need to use bigpipe command.

[root@ltm1:Active] config # head -5 /etc/syslog-ng/syslog-ng.conf # # THIS IS AN AUTO-GENERATED FILE -- DO NOT EDIT!!! # # Use the bigpipe shell utility to make changes to the system configuration. # For more information, see bigpipe syslog help.

I want to send logs related to TMOS ( LTM ) to remote servers.

What kind of facilities should I send ?

Seen from /etc/syslog-ng/syslog-ng.conf , it seems that LTM related logs are stored in /var/log/ltm. And facility is ,,, local0 ??

syslog-ng.conf

# local0.*                                      /var/log/ltm filter f_local0 {   facility(local0); }; filter f_no_audit {   not match("AUDIT"); }; destination d_ltm {   file("/var/log/ltm" create_dirs(yes)); }; log {   source(s_syslog_pipe);   filter(f_local0);   filter(f_no_audit);   destination(d_ltm); };

Let’s make a include file for syslog-ng and then change configuration with bigpipe command.

LTM ---- remote syslog daemon ( Scientific Linux 6 )

LTM self IP : 10.0.0.1

syslog : 10.0.0.10

make the include file.

[root@ltm1:Active] config # vi /var/tmp/syslog-remote.conf syslog include " destination d_syslog_server {    udp(\"10.0.0.10\" port (514)); }; log {    source(s_syslog_pipe);    filter(f_local0) ;    filter(f_no_audit);    destination(d_syslog_server); }; “

check the current syslog configuration.

[root@ltm1:Active] config # b syslog show SYSLOG [root@ltm1:Active] config # b syslog list syslog {} [root@ltm1:Active] config # b syslog include show SYSLOG - Include Data: list [root@ltm1:Active] config # b syslog remote server show SYSLOG - Remote Server: none

For more details , please check an output of “b syslog help”

import the include file using bpsh command ( bigpipe shell )

[root@ltm1:Active] config # bpsh < /var/tmp/syslog-remote.conf

check the configuration.

[root@ltm1:Active] config # b syslog remote server show SYSLOG - Remote Server: none [root@ltm1:Active] config # b syslog include show SYSLOG - Include Data: destination d_syslog_server {    udp("10.0.0.10" port (514)); }; log {    source(s_syslog_pipe);    filter(f_local0);    filter(f_no_audit);    destination(d_syslog_server); };

send log messages with logger command.

[root@ltm1:Active] config # logger -s -p local0.warning "local0 warning" root: local0 warning [root@ltm1:Active] config # logger -s -p local4.warning "local4 warning" root: local4 warning

cap data on the syslog server

[root@sl6-1 ~]# tshark -i eth0 port 514 Capturing on eth0  0.000000     10.0.0.1 -> 10.0.0.10    Syslog LOCAL0.WARNING: Jan 19 02:43:33 local/ltm1 warning root: test local0 warning\n

LTM sent syslog messages which facility is local0 to the syslog server and did not send syslog messages which facility is local4.

save configuration

[root@ltm1:Active] config # egrep -i syslog *.conf [root@ltm1:Active] config # b save all [root@ltm1:Active] config # egrep -i syslog *.conf bigip_sys.conf:syslog { bigip_sys.conf:destination d_syslog_server { bigip_sys.conf:    source(s_syslog_pipe); bigip_sys.conf:    destination(d_syslog_server); [root@ltm1:Active] config # cat bigip_sys.conf syslog {   include " destination d_syslog_server {    udp(\"10.0.0.10\" port (514)); }; log {    source(s_syslog_pipe);    filter(f_local0);    filter(f_no_audit);    destination(d_syslog_server); }; "

.

Configure IPv4 ( client – LTM ) –IPv6 ( LTM – servers ) translation

Here’s an explanation of how to set up IPv4 – IPv6 translator on BIG-IP LTM.

Clients access to the IPv4 VIP with IPv4 and LTM accesses to the IPv6 servers with LTM’s self  IP (IPv6)

Client : 10.0.0.10  | vSwitch  |  | VIP : 10.0.0.120  |serlf IP: 10.0.0.1 LTM  ----------------------------  |self IP: 1.2 : 2000:aaaa:0:a:0:0:0:1  | vSwitch  | Apache Server1 , Apache Server2

Server1 : 2000:aaaa:0:a:0:0:0:2

Server2 : 2000:aaaa:0:a:0:0:0:3

Create a virtual server for Ipv4 – IPv6 translation

Local Traffic -> Virtual Servers -> Create

Specify an IPv4 as VIP

Specify IPv6 pool

Access to the IPv4 VIP from IPv4 client

a capture data between client and LTM ( IPv4 )

# tshark -r zzz.pcap | head -5 Running as user "root" and group "root". This could be dangerous.  1   0.000000    10.0.0.10 -> 10.0.0.120   TCP 57658 > http [SYN] Seq=0 Win=14600 Len=0 MSS=1460 TSV=123145 TSER=0 WS=6  2   0.001120   10.0.0.120 -> 10.0.0.10    TCP http > 57658 [SYN, ACK] Seq=0 Ack=1 Win=4380 Len=0 MSS=1460 TSV=4137570965 TSER=123145  3   0.001140    10.0.0.10 -> 10.0.0.120   TCP 57658 > http [ACK] Seq=1 Ack=1 Win=14600 Len=0 TSV=123146 TSER=4137570965  4   0.001210    10.0.0.10 -> 10.0.0.120   HTTP GET / HTTP/1.1

a cap data between LTM and server

34   2.600178 2000:aaaa:0:a::1 -> 2000:aaaa:0:a::3 HTTP GET /zzz HTTP/1.1 35   2.600198 2000:aaaa:0:a::3 -> 2000:aaaa:0:a::1 TCP http > 57669 [ACK] Seq=1 Ack=498 W in=6432 Len=0 TSV=260594613 TSER=4137747486 36   2.600586 2000:aaaa:0:a::3 -> 2000:aaaa:0:a::1 HTTP HTTP/1.1 404 Not Found  (text/htm l) 37   2.600651 2000:aaaa:0:a::3 -> 2000:aaaa:0:a::1 TCP http > 57669 [FIN, ACK] Seq=478 Ac k=498 Win=6432 Len=0 TSV=260594614 TSER=4137747486

session persistence method is cookie insert mode.

Let’s check whether LTM insert cookie into HTTP headers or not

# tshark -r zzz.pcap -V | grep -i cookie | head -3    Cookie: lbcookie=vi2000aaaa0000000a0000000000000003.20480\r\n    Cookie: lbcookie=vi2000aaaa0000000a0000000000000003.20480\r\n    Cookie: lbcookie=vi2000aaaa0000000a0000000000000003.20480\r\n

LTM inserted cookie into HTTP header.

Insert Clients original IP into HTTP header

When the LTM accesses to IPv6 servers , LTM use its self IP ( IPv6 ) not clients IP ( IPv4 ).

So Apache can’t determine whether clients come from.

So inserting original client IP into HTTP header is very useful when you face problems or something.

Local Traffic -> Profiles -> Services -> HTTP -

create the profile ( http_client_IP )

check “Custom” button

enable “Insert X-Forward-For”

Local Traffic -> Virtual Servers -> Virtual Server List -> http-v4-v6

Choose “http_client_IP” as HTTP Profile and then click “Update”

cap data

Source: 2000:aaaa:0:a::1 (2000:aaaa:0:a::1) <- LTM self IP    Destination: 2000:aaaa:0:a::3 (2000:aaaa:0:a::3) <- the server’s IP Hypertext Transfer Protocol    GET /zzz HTTP/1.1\r\n        [Expert Info (Chat/Sequence): GET /zzz HTTP/1.1\r\n]            [Message: GET /zzz HTTP/1.1\r\n]            [Severity level: Chat]            [Group: Sequence]        Request Method: GET        Request URI: /zzz        Request Version: HTTP/1.1    Host: 10.0.0.120\r\n    User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.24) Gecko/20111108 Red Ha t/3.6.24-3.el6_1 Firefox/3.6.24\r\n    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n    Accept-Language: en-us,en;q=0.5\r\n    Accept-Encoding: gzip,deflate\r\n    Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\r\n    Keep-Alive: 115\r\n    Connection: keep-alive\r\n    Cookie: lbcookie=vi2000aaaa0000000a0000000000000003.20480\r\n    Cache-Control: max-age=0\r\n    X-Forwarded-For: 10.0.0.10\r\n <- Client real IP    \r\n

Configure IPv6 ( client – LTM ) -IPv4 ( LTM – servers ) translation

Here’s an explanation of how to set up IPv6 – IPv4 translator on LTM devices.

Clients access to the IPv6 VIP (2000:aaaa:0:1::81 ) with IPv6 and the LTM device accesses to the IPv4 servers with LTM’s self IP ( IPv4 )

Client : 2000:aaaa:0:1:::100  | vSwitch  |  | VIP : 2000:aaaa:0:1::81  |serlf IP: 1.1 : 2000:aaaa:0:1::1/64 LTM  ----------------------------  |self IP: 1.2 : 192.168.0.1  | vSwitch  | Apache Server1 , Apache Server2

Server1(Scientific Linux 6) : 192.168.0.100

Server2 (Scientific Linux 6): 192.168.0.101

Client --- LTM : IPv6 network

LTM --- Server : IPv4 network

create a virtual server which translates to IPv4 from IPv6

create the virtual server called http-v6-v4

Local Traffic -> Virtual Servers -> Create

Specify IPv6 address as VIP

Choose the pool which has IPv4 address.

bigip.conf

virtual http-v6-v4 {   pool http-ipv4   destination 2000:aaaa:0:1::81.http   ip protocol tcp   persist cookie   profiles {      http {}      tcp {}   } }

access to the IPv6 VIP from the client

VIP : 2000:aaaa:0:1::81

The capture data captured on the Client ( IPv6 – IPv6 VIP )

Client : 2000:aaaa:0:1::100

VIP : 2000:aaaa:0:1::81

# tshark -r abc.pcap Running as user "root" and group "root". This could be dangerous.  1   0.000000 2000:aaaa:0:1::100 -> 2000:aaaa:0:1::81 TCP 51413 > http [SYN] Seq=0 Win=14400 Len=0 MSS=1440 TSV=64368313 TSER=0 WS=6  2   0.001143 2000:aaaa:0:1::81 -> 2000:aaaa:0:1::100 TCP http > 51413 [SYN, ACK] Seq=0 Ack=1 Win=4320 Len=0 MSS=1440 TSV=3928527043 TSER=64368313  3   0.001161 2000:aaaa:0:1::100 -> 2000:aaaa:0:1::81 TCP 51413 > http [ACK] Seq=1 Ack=1 Win=14400 Len=0 TSV=64368315 TSER=3928527043  4   0.001245 2000:aaaa:0:1::100 -> 2000:aaaa:0:1::81 HTTP GET / HTTP/1.1  5   0.004450 2000:aaaa:0:1::81 -> 2000:aaaa:0:1::100 HTTP HTTP/1.1 304 Not Modified

The capture date captured on the Server ( IPv4 – IPv4 )

LTM access to the real server with LTM self IP ( 192.168.0.1 )

Source: 192.168.0.1 (192.168.0.1) <- LTM self IP    Destination: 192.168.0.100 (192.168.0.100) <- Real Server IP Transmission Control Protocol, Src Port: 51393 (51393), Dst Port: http (80), Seq Hypertext Transfer Protocol    GET / HTTP/1.1\r\n        [Expert Info (Chat/Sequence): GET / HTTP/1.1\r\n]            [Message: GET / HTTP/1.1\r\n]            [Severity level: Chat]            [Group: Sequence]        Request Method: GET        Request URI: /        Request Version: HTTP/1.1    Host: [2000:aaaa:0:1::81]\r\n    User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.24) Gecko/20111108 Red Hat/3.6.24-3.el6_1 Firefox/3.6.24\r\n    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n    Accept-Language: en-us,en;q=0.5\r\n    Accept-Encoding: gzip,deflate\r\n    Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\r\n    Keep-Alive: 115\r\n    Connection: keep-alive\r\n    Cookie: lbcookie=1677764800.20480.0000\r\n    If-Modified-Since: Mon, 05 Sep 2011 05:53:44 GMT\r\n    If-None-Match: "43e0c-6-4ac2b558203d3"\r\n    Cache-Control: max-age=0\r\n    \r\n

Insert Clients original IP into HTTP header

When the LTM accesses to IPv4 servers , LTM use its self IP ( IPv4 ) not clients IP ( IPv6 ).

So Apache can’t determine whether clients come from.

So inserting original client IP into HTTP header is very useful when you face problems or something.

Local Traffic -> Profiles -> Services -> HTTP -

create the profile ( http_client_IP )

check “Custom” button

enable “Insert X-Forward-For”

Local Traffic -> Virtual Servers -> Virtual Server List -> http-v6-v4

Choose “http_client_IP” as HTTP Profile and then click “Update”

The Capture data captured on the Apache

Internet Protocol, Src: 192.168.0.1 (192.168.0.1), Dst: 192.168.0.100 (192.168.0 .100) Hypertext Transfer Protocol    GET / HTTP/1.1\r\n    Cookie: lbcookie=1677764800.20480.0000\r\n    If-Modified-Since: Mon, 05 Sep 2011 05:53:44 GMT\r\n    If-None-Match: "43e0c-6-4ac2b558203d3"\r\n    Cache-Control: max-age=0\r\n    X-Forwarded-For: 2000:aaaa:0:1::100\r\n　<- client IP    \r\n

192.168.0.1 : LTM self IP

192.168.0.100 : server’s real IP