F5详细配置手册

F5命令行配置配置手册

bigstart Restarts the SNMP agent bigsnmpd. bigtop Displays real-time statistics.Config Configures the IP address, network mask, and gateway on the management (MGMT) port.Use this command at the BIG-IP system prompt prior to licensing the the BIG-IP system, and do not confuse it with the bigpipe config command or the BIG-IP Configuration utility.halt Shuts down the BIG-IP software application.hostname Displays the name you have given to the BIG-IP system.printdb Prints the values of one or more entries in the bigdbTM database. reboot Reboots the BIG-IP system.ssh and scp Access command line interfaces on other SSH-enabled devices, and copy files to or from a BIG-IP system.自定义Bigpipe shell名称bp> shell prompt <string>bp> shell prompt BIG-IP>系统Shell名称将变成:BIG-IP>此特性避开此限制,在Linux命令前加”!”.BIG-IP>!ls //查看目录BIG-IP>!ifconfig //查看接口配置•Routes•Self IP addresses•Packet Filters•Trunks (802.3ad Link Aggregation)•Spanning Tree Protocol (STP)•VLANs and VLAN groups•ARP配置Packet Filtering命令: bigpipe packet filter你可以定义一个包过滤规则来提供访问控制,速率shaping,审计. 配置路由命令:route (<route key list> | all | inet | inet6)F5的Show Tech[root@XXXX:Standby] config # qkviewGetting systemwide backup configuration files.Getting AOM information.Getting last 175 lines of log files.Getting last 175 lines of gzipped log files.Getting md5 sum information.Getting core file list.Getting Public Certificate information.Getting tmctl information.completed... 6 of 161 checks produced no dataDiagnostic information has been saved in file /var/tmp/-tech.out Please send this file to **************.bigtop - display real-time statistics-bytes display counts in bytes (vs bits)-pkts display counts in packets (vs bits)-reqs display counts in requests (vs connections)-vips <n> number of virtual servers to print-nodes <n> number of nodes to print-once print once and exit-delay <n> number of seconds between samples (default 4)-scroll disable full-screen mode-nosort disable sorting-conn sort by connection count (vs byte count)-delta sort by count since last sample (vs total)-n print IP address and services in numeric format-vname display virtual servers by name (vs IP address)-help, -h print this message日志文件系统1. Access the BIG-IP system prompt.2. Stop the BIG-IP system or put the system into a safe condition such as standby mode using the bigstart stop command.3. Type the following command:resize-logFSThis command prompts you for the desired file size in gigabytes.4. At the prompt, type an integer.The minimum allowed value is 1, and the maximum allowed value is 10.A prompt appears that allows you to confirm the specified file size.5. Type Y.A message appears, notifying you of the need for the BIG-IP system to perform a reboot, followed by a prompt, which allows you to permit the reboot operation. Note: Prior to rebooting, the BIG-IP system verifies that the integer you typed in step 3 is within the allowed range, and checks to ensure that enough disk space exists for the specified size.6. Type Y.A confirmation prompt appears.7. Type Y.The system displays messages indicating that the reboot operation is about to occur.8. Wait for the reboot operation to finish.When the system becomes available again, the newly-specified disk space for the log file will be in effect.WARNINGDo not delete the files: /shared/.LoopbackLogFS and /shared/LogFS_README, because this action deletes all of your log files.启用/禁用虚拟服务或虚拟地To enable or disable a virtual server, use the appropriate command syntax:bp> virtual <virtual addr>:<virtual port> enable | disableTo enable or disable a virtual address, use the appropriate command syntax:bp> virtual address <virtual addr> enable | disable从服务中移出单个的NodeYou can remove an individual node from service, or return an individual node to service from the bigpipe shell command line.To remove an individual node from service, use the following command:bp> node <node addr>:<node port> downTo return an individual node to service, use this command:bp> node <node addr>:<node port> up查看修改F5系统配置文件器来编辑或者查看这些文件,当你没有条件使用浏览器时,有时候修改配置文件很有必要.这就需要F5的无浏览器配置模式和命令行配置模式Important:在你编辑完bigip.conf or bigip_base.conf 重启MCPD service之前, 你必须运行bigpipe load 确保MCPD service 使用的是当前的配置数据alert.conf Stores definitions of SNMP traps (system default alerts).user_alert.conf Stores definitions of SNMP traps (user-defined alerts)./config/bigip.conf Stores all configuration objects for managing local application traffic, such as virtual servers, load balancing pools, profiles, and SNATs.Note that after you edit bigip.conf, and before you restart the MCPD service, you must run the bigpipe load command./config/bigip_base.conf Stores BIG-IP self IP addresses and VLAN and interface configurations. Note that after you edit bigip_base.conf, and before you restart the MCPD service, you must run the bigpipe load command./config/bigip.license Stores authorization information for the BIG-IP system./etc/bigconf.conf Stores the user preferences for the Configuration utility./config/bigconfig/openssl.conf Holds the configuration information for how the SSL library interacts with browsers, and how key information is generated./config/user.db Holds various configuration information. This file is known as the bigdb database. /config/bigconfig/httpd.conf Holds configuration information for the web server./config/bigconfig/users The web server password file. Contains the user names and passwords of the people permitted to access whatever is provided by the webserver./etc/hosts Stores the hosts table for the BIG-IP system./etc/hosts.allow Stores the IP addresses of workstations that are allowed to make administrative shell connections to the BIG-IP system./etc/hosts.deny Stores the IP addresses of workstations that are not allowed to make administrative shell connections to the BIG-IP system./etc/rateclass.conf Stores rate class definitions./etc/ipfwrate.conf Stores IP filter settings for filters that also use rate classes. /etc/snmpd.conf Stores SNMP configuration settings./etc/snmptrap.conf Stores SNMP trap configuration settings./config/ssh Contains the SSH configuration and key files./etc/sshd_config This is the configuration file for the secure shell server (SSH). It contains all the access information for people trying to get into the system by using SSH./config/routes Contains static route information.[root@ISAG-2:Standby] config # find_keysISAG-2 koradsatn. omtitra eodISAG-2 junl trig Cmi nevl5scnsdt md.6koradsatn. omtitra eodFound license key JTPBO-CHRSX-DGBIO-HOAHJ-MOZJEVALicense file location is: /sda.1/config/bigip.licenseFound license key JTPBO-CHRSX-DGBIO-HOAHJ-MOZJEVAUnmounting unneeded partitions... ISAG-2 junl trig Cmi nevl5scnsn Cmi nevl5scnsree aamd.<>junl trig Cmi nevl5scns<6>EXT3-fs: mounted filesystem with ordered data mode.ISAG-2 junl trig Cmi nevl5scns<6>kjournald starting. Commit interval 5 secondscompleteAbove information can be found in /tmp/keys.outManaging Local Application Traffic•Setting up load balancing•Controlling HTTP traffic•Implementing HTTP and TCP optimization profiles•Authenticating application traffic•Implementing persistence•Enhancing the performance of the BIG-IP system•Managing health and performance monitors•Implementing iRules设置VirtualServer负载均衡1. Decide what types of traffic you want the BIG-IP system to manage, as well as whether you want to implement session persistence, connection persistence, and remote authentication.2. For each decision in step 1, decide whether you want to use the corresponding default profile that the BIG-IP system provides, or whether you want to create a custom profile.3. Access the bigpipe shell.4. If you want to create custom profiles, use the profile command, specifying the appropriate type of profile as an argument. If you do not want to create custom profiles, skip this step.5. Create one or more load balancing pools, using the pool command.6. Create a virtual server, using the virtual command, and assign to it any profiles and pools that you created. If you are using default profiles, some of those profiles might already be assigned to the virtual server by default.配置克隆Pool克隆Pool设计是用于入侵检测,你可以针对一个VS设置一个克隆Pool,这个克隆的VS接收世的流量和普通Pool一样,你就可以复制流量到入侵检测系统中.1. Access the bigpipe shell.2. Use the virtual command, to create or modify a virtual server, specifying a value for the clone pool argument.配置最后一跳Pool默认,BIG-IP系统自动启用最后一跳特性是,如果你想禁用这个特性.然后自己手工定义一个最后一跳路由器,你可以建立一个最后一跳pool并且指定其属于某个VS当中.1. Access the bigpipe shell.2. Use the pool command to create a last hop pool that contains the router inside addresses.3. Use the lasthop pool argument with the virtual command to assign the last hop pool to a virtual server.If you have not assigned an SSL profile to the virtual server, use the profile argument with the virtual command to assign the profile to the virtual server.配置SNATs这里有两种基础方法来建议一个SNAT,你可以直接将一个转换地址委派给一个或多个源IP地址,或者你可以配置一个SNAT pool,然后委派这个SNAT pool到某个源IP地址,在较新的版本中,BIG-IP自动从SNAT Pool中选择一个转换地址Note that you can assign these types of mappings from within an iRule.To map a single translation address to an original address1. Access the bigpipe shell.2. Designate an IP address as a translation address, using the snat translation command.3. Map the translation address to one or more original IP addresses, using the snat command or the rule command.To map a SNAT pool to an original address1. Access the bigpipe shell.2. Create a pool of translation addresses (that is, SNAT pool), using the snatpool command.3. Map the SNAT pool to one or more original IP addresses, using either the snat command or the rule command.配置HTTP traffic你可以配置BIG-IP来控制HTTP流量:配置HTTP压缩,HTTP请求重定向,HTTP请求重写,插入和插除HTTP头,启用或者禁用cookie加密和SYN cookie支持,配置HTTP 类Profile, HTTP响应数据组块控制.Configuring HTTP compression配置BIG-IP系统压缩HTTP 服务响应1. Access the bigpipe shell.2. Configure the compression-related settings of an HTTP profile,using the profile http command.3. Assign the HTTP profile to a virtual server, using the virtual command.Redirecting HTTP requests你可以配置HTTP Profile来重定向HTTP请求,并且在这个Profile中定义一个Fallback主机1. Access the bigpipe shell.2. Using the profile http command, create or modify an HTTP profile, specifying a value for the fallback argument. You can specify either a URI or the default fallback host, or you can specify that you want no HTTP redirection.3. Verify that the HTTP profile you created or modified is assigned to a virtual server.Rewriting HTTP redirections你可以配置HTTP Profile来重写HTTP的重定向规则1. Access the bigpipe shell.2. Using the profile http command, create or modify an HTTP profile, specifying a value for the redirect rewrite argument.For example, to create a profile that only rewrites URIs matching the originally requested URI (minus an optional training slash), use the following syntax:profile http myHTTPprofile { redirect rewrite matching }3. Verify that the HTTP profile you created or modified is assigned to a virtual server.Inserting and erasing HTTP headers你可以配置HTTP Profile来插入一个头文件到HTTP请求,或者从HTTP请求中移出一个头文件1. Access the bigpipe shell.2. Using the profile http command, create or modify an HTTP profile, specifying a value for either the header insert, header erase, or insert xforwarded for options.3. Verify that the HTTP or Fast HTTP profile you created or modified is assigned to a virtual server.Enabling or disabling cookie encryption你可以使用Profile http中的两个选项来启用或者禁用cookie加密1. Access the bigpipe shell.2. Using the profile http command, create or modify an HTTP profile, specifying a value for the encrypt cookie and cookie secret options.3. Verify that the HTTP profile you created or modified is assigned to a virtual server.Enabling or disabling SYN cookie support为了管理DOS攻击,你可以在一个Fast L4 Profile中配置SYN Cookie选项启用或者禁用SYN Cookie支持功能◆如果BIG-IP系统包含了Packet Velocity ASIC (PVA)技术,使用profile fastl4命令,定义一个hardware syncookie(enable | disable | default)选项,同样,你可以根据需求设置以下的变量通过db命令.•pva.SynCookies.Full.ConnectionThreshold (default: 500000)•pva.SynCookies.Assist.ConnectionThreshold (default: 500000)•pva.SynCookies.ClientWindow (default: 0)值得注意的是这个hardware syncookie 特性目前只可用于D84和D88平台.在其实平台设备这个特性无效.所以如果你在D84和D88上设置software syncookie 特性,SYN Cookie只通过软件处理◆如果BIG-IP系统不包含Packet Velocity ASIC(PVA)技术,使用profile fastl4 命令,指定为software syncookie (enable | disable | default) option.Configuring the HTTP Class profileBIG-IP系统包含一种Profile叫做HTTP Class Profile,你可以使用你定义的标准来用分类HTTP流量,当你分类流量的时候,你转地流量的原则是根据审查目标流量的头文件或者内容来定.如果BIG-IP系统包含Application Security Manager (ASM)或者WebAcclerator模块,你可以配置系统来先发送HTTP流量到那个模块,然后再发送到最终目标,例如,你可以使用HTTP Class Profile来对Virtual Server下命令,要求它发送流量先经过ASM然后再转发到负载均衡Pool.Unchunking and rechunking HTTP response data如果你想要监控内容你可以取消或者重新对HTTP响应进行组块操作,只需要配置HTTP Profile来启用unchunking功能.1. Access the bigpipe shell.2. Using the profile http command, create or modify an HTTP profile and specify the response argument.3. Make sure that you have assigned the HTTP profile to a virtual server, using the virtual command.你能够设备的保持有以下几种:实施Session保持•Cookie•Destination Address Affinity•Microsoft Remote Desktop Protocol (MSRDP)•Hash•Session Initiation Protocol (SIP)•Source Address Affinity•SSL•Universal具体操作:1. Access the bigpipe shell.2. Create a persistence profile, using the profile command, that corresponds to the type of persistence you want to implement.3. Assign the persistence profile to a virtual server, using the persist and fallback persist arguments with the virtual command.实施连接保持为了实施连接保持,你可以添加一个Keep-Alive头文件到HTTP /1.0头文件里(如果不存在).(默认HTTP/1.1连接包含Keep-Alive支持),你同样可以启用connection pooling特性,它可以保持服务器端的连接打开,重新用来供其它客户端请求所使用.你可以通过修改HTTP或者Fast HTTP Profile文件来启用keep-alive支持和Connection pools.同样可以修改OncConnect Profile来实现.To add Keep-Alive headers into HTTP requests1. Access the bigpipe shell.2. To ensure that HTTP connections stay open, use the profile http command and specify the oneconnect transformations argument. This ensures that the BIG-IP system inserts aConnection:Keep-Alive header into any HTTP /1.0 request that does not already contain one.3. Make sure that you have assigned the HTTP or Fast HTTP profile to a virtual server, using the virtual command.To enable connection pooling1. Access the bigpipe shell.2. Using the profile oneconnect command, configure a profile for connection pooling.3. Assign the profile to a virtual server, using the profile argument with the virtual command.小提示:你同样可以通过配置Fast HTTP Profile来配置连接保持,在BIGPIPE SHEEL中使用fasthttp命令.加强BIG-IP性能BIG-IP系统.设置连接Qos和数据包TOS等级你可以使用bigpipe工具来设置QoS和TOS等级,你不仅可以对所有具有目标负载均衡Pool的流量做,同时你也可以对自定义的流量做,例如:Layer 4 ,TCP 和UDP流量.1. Decide whether you want to set QoS and ToS levels for traffic targeted for an entire pool or for specific types of traffic, or both.•If you want to set the QoS and ToS levels for an entire pool, access the bigpipe shell and use the pool command with one or more of the following arguments: link qos to client, link qos toserver, ip tos to client, and ip tos to server.•If you want to set the QoS and ToS levels for certain types of traffic, access the bigpipe shell and use the profile command to create or modify a Fast L4, TCP, or UDP profile.2. Verify that the pool or the profile that you created or modified is assigned to a virtual server. To do this, use the following syntax:bp> virtual <virtual server name> list设置空闲超时时间(Idle timeout time)或者修改一个Fast L4,Fast HTTP,TCP,或者UDP Profile.1. Create or modify a Fast L4, Fast HTTP, TCP, or UDP profile, by accessing the bigpipe shell and using the profile command.2. Specify the idle timeout argument to set a timeout value.3. Verify that the profile you created or modified is assigned to a virtual server.实施速率整形Virtual Server或者Packet Filter规则中.1. Access the bigpipe shell.2. Create one or more rate classes, using the rate class command.3. Assign the rate classes to a virtual server or a packet filter rule, using either the virtual command or the packet filter command.Implementing iRulesiRule特性强大而灵活,值得注意的是它可以增强BIG-IP系统能力.一个iRule可以引用任意object,它不管这个被引用的object处理哪个分区里.例如;一个iRule属于分区A,但包含指定一个Pool属于分区B的语句.1. Access the bigpipe shell.2. Create an iRule using the rule command. You must include the name of the Tcl script and the script itself as arguments for the command.3. Assign the iRule to a virtual server, using the virtual command in one of the following ways:•To associate multiple iRules with a virtual server, use this syntax:bp> virtual <virtual_server_name> rule <iRule1_name> \ <iRule2_name> ...•To remove the assignment of an iRule from a virtual server, use this syntax:bp> virtual <virtual_server_name> rule none•To remove the iRule assignments from multiple virtual servers, use the following syntax. Note that you can remove the iRule assignments only from virtual servers that reside in the current Write partition or in partition Common.bp> virtual all rule none•To associate an existing iRule with multiple virtual servers, use the following syntax. Note that you can associate an iRule only with virtual servers that reside in the current Write partition or in partition Common. bp> virtual all rule <iRule_name>Important: In this case, the iRule becomes the only iRule that is associated with each virtual server in the current Write partition. Because this command overwrites all previous iRuleassignments, we do not recommend use of this command.。

F5 V9配置手册

F5 BIG-IP负载均衡器配置指导书目录一、网络结构与IP地址规划本手册以移动WAP/彩信网关为例网络拓扑结构如下图所示：整个数据网络设备，采用两台防火墙、两台BIG-IP 3600负载均衡器、及两台交换机、网络设备都采用主、备设备，以实现设备、链路的冗余备份，以消除单点故障。

这里部署负载均衡器的目的主要是为了增加服务器的数量，以提升系统的处理能力。

但对外仍然是一个IP地址。

相关的IP地址规划如下：注：以上的IP地址规划是测试环境的IP地址设置，需要根据现网环境中的IP地址规划进行修改。

注：建议现场工程师先填写以下规范表：二、配置BIGIP3600负载均衡设备本章将主要描述BIGIP3600负载均衡设备的配置方法及配置内容。

旁路/直连的选择2.1.1路由/直连模式的介绍网络连接的物理结构如下结构：BigipSwitchServer Pool典型的结构–路由/直连Ip 规划说明：图中bigip 为负载均衡交换机，bigip 上面使用公开的ip 地址，bigip 下面同负载均衡的服务器使用不公开的ip 地址。

但对外提供服务则使用公开的ip 。

2.1.2旁路模式的介绍网络连接的物理结构如下结构：BigipBigipSwitchServer Pool典型的结构-旁路Ip 规划说明：图中bigip 为负载均衡交换机，bigip 和负载均衡的服务器均使用公开的ip 地址。

2.1.3 路由/直连模式同旁路模式的比较（1）流量走向不一样；路由/直连模式的流量走向如下：SwitchServer Pool直连结构下正常流量走向234如上图，bigip 同客户端的流量在bigip 的上联接口，bigip 同服务器的流量在下面的接口。

旁路模式的流量走向如下：BigipBigipSwitchServer Pool旁路结构下正常流量走向1234如上图，bigip 无论同客户端还是同服务器的通讯流量均在bigip 的一个接口上。

F5简明配置手册

(3)被选关联标签中，在“Choose Monitor”表格中选择监控名称，点击“>>”按钮添加到“Monitor Rule”监控规格文本框中。监控规则可以为一条或多条。
(4)选择监控规则后，在对应节点的“Associate Current Monitor Rule”复选框中选中。如果欲删除监控关联，则选中对应节点的“Delete Existing Assocation”复选框。
default:~# config
5、F5双机切换监控配置（有F5双机时需要）
(1)在web页面中选择相应的vlan，在arm failsafe选择则可。Timeout为从F5收不到包的时间起，经过多长时间就发生切换。此配置不能同步，需要在F5的主备机上同时配置。每个vlan都可以配置vlan arm failsafe。
(3)按“Done”完成添加SNAT IP地址。
11、F5主备机同步及切换校验
具体在system/Redundant Properties/synchonize Config...
12、业务的校验
F5主备机切换的校验
F5主备机业务运行的校验
其中1~6是基本配置，7~10业务配置，11~12校验
二、F5负载均衡器的维护
(2)时间检查－－如不正确，请到单用户模式下进行修改
f5-portal-1:~# date
Thu May 20 15:05:10 CST 2004
(3)申请license－－现场用的F5都需要自己到F5网站上申请license
3、F5的通用配置
(1)在安全要求允许的情况下，在setup菜单中可以打开telnet及ftp功能，便于以后方便维护
(4)按“Done”完成创建虚拟服务器。

F5负载均衡用户指导手册

以下是F5 BIG-IP用作HTTP负载均衡器的主要功能：①、F5 BIG-IP提供12种灵活的算法将所有流量均衡的分配到各个服务器，而面对用户，只是一台虚拟服务器。

②、F5 BIG-IP可以确认应用程序能否对请求返回对应的数据。

假如F5 BIG-IP后面的某一台服务器发生服务停止、死机等故障，F5会检查出来并将该服务器标识为宕机，从而不将用户的访问请求传送到该台发生故障的服务器上。

这样，只要其它的服务器正常，用户的访问就不会受到影响。

宕机一旦修复，F5 BIG-IP 就会自动查证应用已能对客户请求作出正确响应并恢复向该服务器传送。

③、F5 BIG-IP具有动态Session的会话保持功能。

④、F5 BIG-IP的iRules功能可以做HTTP内容过滤，根据不同的域名、URL，将访问请求传送到不同的服务器。

下面，结合实例，配置F5 BIG-IP LTM v9.x：①、如图，假设域名被解析到F5的外网/公网虚拟IP：61.1.1.3（vs_squid），该虚拟IP下有一个服务器池（pool_squid），该服务器池下包含两台真实的Squid服务器（192.168.1.11和192.168.1.12）。

②、如果Squid缓存未命中，则会请求F5的内网虚拟IP：192.168.1.3（vs_apache），该虚拟IP下有一个默认服务器池（pool_apache_default），该服务器池下包含两台真实的Apache服务器（192.168.1.21和192.168.1.22），当该虚拟IP匹配iRules规则时，则会访问另外一个服务器池（pool_apache_irules），该服务器池下同样包含两台真实的Apache服务器（192.168.1.23和192.168.1.24）。

③、另外，所有真实服务器的默认网关指向F5的自身内网IP，即192.168.1.2。

④、所有的真实服务器通过SNAT IP地址61.1.1.4访问互联网。

F5详细配置⼿册F5 BIG-IP负载均衡器配置指导书⽬录添加“只读”权限的管理员帐号.............................................................................................对某⼀Virtual Server⽤TCPDUMP命令⽆法抓到包如何处理............................................⼀、⽹络结构与IP地址规划本⼿册以移动W AP/彩信⽹关为例⽹络拓扑结构如下图所⽰：整个数据⽹络设备，采⽤两台防⽕墙、两台BIG-IP 3400负载均衡器、及两台交换机、⽹络设备都采⽤主、备设备，以实现设备、链路的冗余备份，以消除单点故障。

这⾥部署负载均衡器的⽬的主要是为了增加服务器的数量，以提升系统的处理能⼒。

但对外仍然是⼀个IP地址。

相关的IP地址规划如下：注：以上的IP地址规划是测试环境的IP地址设置，需要根据现⽹环境中的IP地址规划进⾏修改。

⼆、配置BIGIP3400负载均衡设备本章将主要描述BIGIP3400负载均衡设备的配置⽅法及配置内容。

旁路/直连的选择2.1.1路由/直连模式的介绍⽹络连接的物理结构如下结构：Ip规划说明：图中bigip为负载均衡交换机，bigip上⾯使⽤公开的ip地址，bigip下⾯同负载均衡的服务器使⽤不公开的ip地址。

但对外提供服务则使⽤公开的ip。

2.1.2旁路模式的介绍⽹络连接的物理结构如下结构：Ip规划说明：图中bigip为负载均衡交换机，bigip和负载均衡的服务器均使⽤公开的ip 地址。

2.1.3 路由/直连模式同旁路模式的⽐较（1）流量⾛向不⼀样；路由/直连模式的流量⾛向如下：如上图，bigip同客户端的流量在bigip的上联接⼝，bigip同服务器的流量在下⾯的接⼝。

旁路模式的流量⾛向如下：如上图，bigip⽆论同客户端还是同服务器的通讯流量均在bigip的⼀个接⼝上。

F负载均衡器简明配置手册(A concise configuration manual for the F load balancer)

F5负载均衡器简明配置手册（A concise configuration manual forthe F5 load balancer）F5 load balancer brief configuration manualLoad balancers are commonly known as four - layer switches or seven - layer switches. The four layer switch mainly analyzes the IP layer and the TCP/UDP layer, and realizes the four layer traffic load balance. In addition to supporting the four layer load balancing, the seven layer switch also analyzes the application layer information, such as HTTP protocol, URI or Cookie information.I. F5 configuration steps:1, F5 network planning(1) network topology (specific to the distribution and connection of network device physical ports, the distribution and connection of server network card)(2) the allocation of IP addresses (specifically to the allocation of network devices and IP addresses of server NICs)(3) F5, VIP, member pool, node, load balancing algorithm and policy retention method2, F5 configuration before preparation(1) version checkingF5-portal-1:~# B versionKernel:BIG-IP Kernel 4.5PTF-07 Build18(2) time check - if not correct, please change in single user modeF5-portal-1:~# dateThu May 20 15:05:10 CST 2004(3) for the License site with the F5 yourself to the F5 website for licenseGeneral configuration for 3 and F5(1) in the case of security requirements, in the setup menu, you can open the telnet and FTP functions to facilitate future maintenance(2) configure the VLAN unique_mac option. This option is to make sure that the MAC addresses of different F5 on VLAN are different. By default, the MAC addresses of each of the F5's VLAN are the same. It is recommended to select this option when configured. You can use the command ifconfig - A to testSpecifically, system/Advanced, Properties/vlan, unique_mac(3) configure the SNAT any_ip option, which allows you toconvert Ping data streams to ensure that the machine within the network has snat. Ping is a third - tier packet, and by default, F5 does not convert Ping packets, that is, internal VLAN hosts cannot Ping external VLAN machines. (Note: telnet can also be used to verify.)Specifically, system/Advanced, Properties/snat, any_ip4, F5 initialization configurationIt is recommended that you initialize the F5 at the initial time with the command line (sometimes with the Web page initialization problem). Log on to the command line, and run the config or setup command to initialize the configuration. The initial run will prompt some license information.Default:~# config5, F5 double machine handover monitoring configuration (with F5 dual machine required)(1) select the corresponding VLAN in the web page, and select the failsafe in the arm. Timeout how long will it take to switch from the time the packet is not received from F5?. This configuration cannot be synchronized. It will need to be configured on the F5 host and standby machine simultaneously. Each VLAN can configure VLAN arm failsafe.Specific under Network(2) select system in the web page, and select the gatewayfailsafe in the redundant properties. Router is the address that needs to be monitored. This configuration cannot be synchronized. It will need to be configured on the F5 host and standby machine simultaneously. Only one gateway failsafe can be configured on a F5Specifically in system/redundant properties/gateway failsafe6, F5, MAC, masquerade configurationMac Masquerading is the MAC address of F5 Shared IP Address (Floating). F5, if this item is not configured, the MAC address of the shared IP Address is the same as the MAC address of the VLAN self IP Address of each F5.The general server is based on shared IP Address gateway, in two sets of F5 configuration of Mac Masquerade (the same MAC address), when the F5 is switched on, the server shared IP address MAC the same, ensure service without interruptionSpecific under Network7, F5's pool configuration(1) in the navigation panel of the configuration tool Web page, select the "Pools" tab in "Pools" and click the "ADD" button to add the server pool (Pool).(2) select the load balancing policy in the "Load Balancing Method" table in the Robin Properties (Pool), usually using the default policy: "Round,""(3) in the "Resouces" in the form of "Member Address" text box to enter the IP address input port service members, in the "Service" text box, click the "add to" Current Members "of the current membership list.(4) add all group members and click Done to complete the configuration.(5) select a particular pool in the "Pool Name" column in "Pools", and then select the "Persistence" tab in the pool property page.(6) select the session hold type in the "Persistence Type" table. Click the "Apply" application configuration.8, F5's virtual server configuration(1) in the navigation panel of the configuration tool Web page, select the "Virtual Servers" tab in "Virtual Servers", and click the "ADD" button to add the virtual server.(2) in the "Add Virtual Server" window "Address" text box, enter the virtual server IP address and port number, enter the service or choose an existing service name in the drop-down box in the Service text box, click "Next" to perform the next step.(3) click the "Next" on the "Configure Basic Properties" page of the "Add Virtual Server" window, and then proceed to the next step. In the "Select Physical Resources" window of the "Add Virtual Server" window, click the radio button "Pool", andselect the load balancing pool corresponding to the virtual server in the drop down box.(4) create a virtual server by pressing Done.9, F5 configuration of monitor(1) in the navigation panel of the configuration tool Web page, select the "Monitors" tab in "Monitor", and click the "ADD" button to add the monitor(2) select relevant association types, such as "Node Associations" tag, "Node Address Associations" label, and "Service Associations" label, as required.(3) in the selected Association tag, select the monitor name in the "Choose Monitor" table, click the ">" button, add to the "Monitor Rule" monitor specification text box. Monitoring rules can be one or more.(4) after selecting the monitoring rules, select the "Associate Current Monitor Rule" check box in the corresponding node. If you want to delete the monitor Association, select the "Delete Existing Assocation" check box for the corresponding node.(5) click on "Apply" to monitor the Association10, F5's SNAT configuration(1) in the navigation panel of the configuration tool Web page, select the "SNATs" tab in "NATs", and click the "ADD" buttonto add the SNAT address.(2) in the "Add SNAT" window "Translation Address" and "IP" text box, enter the SNAT address of the IP, and in the "Origin List" and "Origin Address" text box input node IP address or in the "Origin VLAN" in the drop-down box to choose the VLAN name, click the "add" Current "List list.(3) complete the SNAT IP address by pressing "Done".11 、 F5 main standby machine synchronization and switching checkSpecifically in system/Redundant Properties/synchonize Config...12, business verificationVerification of switch between main and standby machines in F5Verification of operation of F5 main and standby machinesAmong them, 1~6 is the basic configuration, 7~10 business configuration, 11~12 checksumTwo, F5 load balancer maintenance1, F5 node and application inspectionCheck node and application status by "System - > Network Map" pageGreen: node or virtual server is "UP""Red: node or virtual server status is "Down""Gray: nodes or virtual servers are disabled2, log check(1) day logs: check system, log, BIGIP, log and monitor logs from web to see if there is any exception in the log log.(2) log within 7 daysSystem log file - /var/log/messages message, system messageBIG-IP log file - /var/log/bigip"External", BIG-IP, eventsMonitor log file - /var/log/bigd"Internal", BIG-IP, Events3DNS log file - /var/log/3dns3DNS InformationOpen with gzcat, more, and VI commands3, F5 flow check(1) the basic maintenance of the business is mainly on the F5 to see whether the distribution of F5 to each node of connect is balanced or not, and there should be no magnitude difference(2) there should be no obvious magnitude difference in view of total and current entries in the connection item through the WEB->pool-> pool statistics(3) F5 qkview commandExecute qkview, and when the execution is complete, save the output information in the file "/var/tmp/-tech.out" for advanced technical support(4) F5 tcpdump commandTCPDUMP is a commonly used message analysis tool in Unix systems, and TCPDUMP is often used for fault location, such as session hold failure and SNAT communication problemsTcpdump [-adeflnNOpqRStvxX] [-c, count] [-F, file][-i, interface] [-m, module] [-r, file][-s, snaplen] [-T, type] [-w, file][-E, algo:secret] [expression]。

F5详细配置手册

F5 BIG-IP负载均衡器配置指导书目录一、网络结构与 IP 地址规划 ....................................错误 ! 不决义书签。

二、配置 BIGIP3400 负载均衡设备 ...............................错误 ! 不决义书签。

旁路 / 直连的选择 ..........................................错误 ! 不决义书签。

路由 / 直连模式的介绍..................................错误 ! 不决义书签。

旁路模式的介绍 .......................................错误 ! 不决义书签。

路由 / 直连模式同旁路模式的比较.......................错误 ! 不决义书签。

设置负载均衡器管理网口地址...............................错误 ! 不决义书签。

登录 BIGIP 的 WEB管理界面 .................................错误 ! 不决义书签。

激活 License .............................................错误 ! 不决义书签。

初始化设置 ...............................................错误 ! 不决义书签。

1 上的平台 (Platform)通用属性设置 . ....................错误 ! 不决义书签。

更正系统时间 .........................................错误 ! 不决义书签。

设置缺省管理权限策略.................................错误 ! 不决义书签。

重新启动 bigip .......................................错误 ! 不决义书签。

F5 LTM配置手册

第 10 页
5. 双机配置 1) 确认主、备 F5 运行在双机模式，点击 System－>Platform 进行查看修改。主 F5：
备 F5：
2) High Availability 配置冗余模式：点击 System－>High Availability，如下图：
第 11 页
Network Mirroring 配置，主 F5：
的配置文件，根据需要选择），选择 Restore，即可进行恢复。
3) 配置文件上传、下载同样在 System－>Archives 中，选择 Upload 即可上传配置文件，上传配置文
件可用于后续的恢复。若要下载配置文件，点击相应的配置文件，即可进行 Download 操作。
第 17 页
技术交流仅供参考
二、网络拓扑
典型的 LTM 部署架构如下： 1. 串行部署：
如下图所示，负载均衡串联在应用服务器网段和核心交换机所在网段之间，两个网段被 F5 分割为两个互不相连的子网。
防火墙
F5 负载均衡器冗余系统
核心交换机
Ethernet
应用服务器
第1页
2. 旁路部署：如下图所示，负载均衡旁路接入网络，不需要对现有网络架构进行调整。物
3) 可以Copy Dossier文本或下载文件，登录到F5的激活页面： https:///license/dossier.jsp 将复制的Dossier文本粘贴进去，或上传文本文件，选择Next，获取到License 激活文件，将激活代码复制到F5的界面，从而激活设备。
第4页ห้องสมุดไป่ตู้
3. 系统基础配置点击 System－>Platform，配置管理地址、主机名、时区等；

F5简易配置手册

F5负载均衡器简明配置手册负载均衡器通常称为四层交换机或七层交换机。

四层交换机主要分析IP层及TCP/UDP层，实现四层流量负载均衡。

七层交换机除了支持四层负载均衡以外，还有分析应用层的信息，如HTTP协议URI或Cookie信息。

一、F5配置步骤：1、F5组网规划(1)组网拓朴图（具体到网络设备物理端口的分配和连接，服务器网卡的分配与连接）(2)IP地址的分配（具体到网络设备和服务器网卡的IP 地址的分配）(3)F5上业务的VIP、成员池、节点、负载均衡算法、策略保持方法的确定2、F5配置前的准备工作(1)版本检查f5-portal-1:~# b version Kernel:BIG-IP Kernel 4.5PTF-07 Build18 (2)时间检查－－如不正确，请到单用户模式下进行修改f5-portal-1:~# dateThu May 20 15:05:10 CST 2004 (3)申请license－－现场用的F5都需要自己到F5网站上申请license3、F5 的通用配置(1)在安全要求允许的情况下，在setup菜单中可以打开telnet及ftp功能，便于以后方便维护(2)配置vlan unique_mac选项，此选项是保证F5上不同的vlan 的MAC 地址不一样。

在缺省情况下，F5的各个vlan的MAC地址是一样的，建议在配置时，把此项统一选择上。

可用命令ifconfig –a来较验具体是system/Advanced Properties/vlan unique_mac(3)配置snat any_ip选项选项，此选项为了保证内网的机器做了snat后，可以对ping的数据流作转换。

Ping是第三层的数据包，缺省情况下F5是不对ping的数据包作转换，也就是internal vlan的主机无法ping external vlan的机器。

（注意：还可以采用telnet来验证。

）具体是system/Advanced Properties/snat any_ip4、F5 的初始化配置建议在对F5进行初始时都用命令行方式来进行初始化（用Web页面初始化的方式有时会有问题）。

F5负载均衡运维配置手册V10

F5负载均衡运维配置手册安全与终端产品开发部2010年7月14日版本号：V1.0配置更改记录V1.0 2010年7月14日完成增加F5 Node、Pool、VS的配置。

前言本手册包含F5负载均衡WEB界面具体应用及配置操作。

此手册以F5负载均衡V9版本进行制定。

目录第一章：F5负载均衡网络配置第二章:F5负载均衡应用配置第三章：F5负载均衡运维管理第一章：F5负载均衡网络配置(一)F5负载均衡网络配置1.IE浏览器里面输入https://192.168.112.1482.回车后，出现安全警告信息，点击YES。

3.弹出对话框，输入用户名和密码。

4.进入F5_web界面后，点击进入NetWork选项。

通过此选项可以配置F5的缺省路由、自定义路由、划分VLAN、接口地址及对应的端口。

5.点击左侧VALNS后，如图显示：目前有6条vlan，分别为电信2条（CTC、CTC02）、网通2条（CUC、CUC02）、F5双机之间通讯1条（HA）、与NOKIA防火墙直连并接入我司内网（internal）。

点击Create，可以创建新的Vlan并对应相应的端口。

6.点击Routes，进入路由配置界面。

如图显示配置1条缺省路由，3条自定义路由。

如需创建新的路由，可点击右侧Add选项。

7.点击Self ips，进入接口地址和虚地址配置界面。

如需创建新的地址，点击Create选项。

网络配置部分完毕。

第二章:F5负载均衡应用配置(二)F5负载均衡应用配置将内网1台服务器映射为1个外网IP1.点击Nodes旁边或者右侧创建新的Nodes。

2.进入创建界面后，如下配置：○1添加某应用的内网ip地址（Address）○2添加某应用的名称（Name）○3点击Finished完成Nodes的配置。

3.点击Loacl Traffic界面点击Pools，右侧显示为已经建立完成的Pool。

点击Pools旁边或者右侧创建新的Pool。

○1将configuration改为Advanced○2创建名称（Name）○3选择健康检测类型（Health Monitors），根据应用的类型来选择，最基本的可以选择Available下拉框里面的geteway_icmp基于某个应用端口的可以选择对应F5的端口检测模板或者自定义检测端口类型。

F5配置手册

F5配置手册f5networks2021-7-16f5netwotks1-1/42(f5netwotks前言：设备上线配置主要如下几个步骤：第一，实施前的规划第二，环境准备第三，设备上架第四，设备配置本文主要针对两大块展开的撰写，实行前规划和设备布局。

环境准备工作主要只机房环境的准备工作，例如机架、电源、温湿度等等；设备开卖只设备加装导轨并紧固放置在机架上。

1-2/42f5netwotks11.1.1规划准备要点在加装big-ip系统之前，恳请检查如下准备工作工作与否搞好：f5规划设备物理连接规划。

ip地址规划，根据实际须要分割网段和分配ip地址，通常网络设备ip地址为网络中最小ip地址（预设网关采用最小ip地址），往下关系式；主机设备从网络中最轻ip地址往上关系式展开分配。

big-ip双机须要3个外部vlanip，2个分别居多备机的selfip，一个为shareip。

big-ip双机需要3个内部vlanip，2个分别为主备机的selfip，一个为shareip。

每一个交互式服务器ip地址或nat须要一个外部vlanip。

snat态射ip地址可以跟交互式服务器ip地一样。

big-ip内部每个节点需要一个内部vlanip。

确定big-ip主机名，并且确保big-ip双机主机名不一样。

1.1.2vlan分割根据现网组网模式，f5上需要划分3个vlan，如表1-1所示。

双机模式下，vlan的分割须要保持一致。

表1-1vlan划分vlan名称external-vlaninternal-vlanfailover-vlan作用用于连接上端交换机。

用于连接下端的服务器。

主要用于两台bigip之间的配置同步和session同步。

说明?通常情况下在端口数量足够的时候我们用一个单独的端口用于配z和session 同步。

?如果在端口数量不足时，可不使用此vlan而使用internal-vlan来进行配z和session同步。

F5配置手册(内部)

N/A N/A 192.168.1.245
4094 2.1/2. 10.32.2.241 2
Shared IP N/A 10.32.2.243
Failover N/A 1.1 1.1.1.1
N/A
-vlan
2 备节点 Ljxc-36 Mgmt N/A N/A 10.168.47.169 N/A
00-2
需要配置的参数如表 2-1 所示，其他参数保持不变。 14 / 42
参数名
表2-1 系统属性参数如何理解……
如何设置……
F5 Netwotks
Host Name High availability
主机名，用来标识 F5 系统自身。
说明
负载均衡器双机系统的主机名必须不同，否则在双机同步时会产生错误，也可能导致 License 被破坏。
F5 Netwotks
1.1.3 IP 地址划分
每个 VLAN 必须采用不同的 IP 网段。F5 上必须配置的 IP 如表 1-2 所示。
表1-2 IP 地址划分
VLAN
IP
External-vlan self IP
shared IP
Internal-vlan self IP shared IP
Failover-vlan self IP
主要用于两台 BIGIP 之间的配置同步和 Session 同步。
说明通常情况下在端口数量足够的时候我们用一个单独的端口用于配臵和 Session 同步。如果在端口数量不足时，可不使用此 VLAN 而使用 internal-vlan 来进行配臵和 Session 同步。
1-3 / 42
2.1.2 登录负载均衡器管理页面
F5 Netwotks

F5 安装调试配置手册自学指南

F5 BigIP V9 安装傻瓜书F5 NetworksSteven Zheng目录第一部分：设备安装前准备工作 (3)1. 设备及环境 (3)2. 设备连接和预设置 (3)第二部分：安装过程 (17)1. 网络启动BigIP : (18)2. 系统安装 (18)3. 安装License (24)4. 设置setup utility 界面 (29)第三部分：简单的服务器负载均衡设置介绍 (31)第一部分：设备安装前准备工作1. 设备及环境1．BigIP 一台（如果要做HA ，需要两台），本例使用一台BigIP 2400.2．工作站一台并且预安装了：Telnet 管理工具例如SecureCRT；SSH 工具例如F-Secure SSH Client；VMware Workstation (最好高点的版本例如4.5.2)3．各种连接线：网线（RJ45）, Console Cable ,等等4．上网环境：以便申请license 或其他上网需要2. 设备连接和预设置1．将工作站与BigIP 连接好：Console cable 连到BigIP Console 口和工作站COM 口，网线连到BigIP 的管理口MGMT和工作站网卡。

2．设置工作站COM 口设置：如果是SecureCRT 则设置如下：3．设置VMW ARE , 启动一个PXE 服务器作为网络安装服务。

打开vmware:新建一个Virtual Machine : click “new virtual machine “图标然后修改virtual machine Devices :删除USB Controller删除Audio添加Floopy添加CDROM 并指向相应的ISO Image好啦，你已经快完成了。

让我们来启动设置好的VMWARE virtual machine : V9_PXE , 启动时，你也许会看到一下错误：那是因为你没有把virtual machine 的BIOS 里把CDROM放在启动设备的最前面，你可以重启virtual machine 并进行设置按F2 进入virtual machine 的BIOS :修改后重启virtual machine , 进入到下面界面后：回车，选安装“ Server “ , 然后一路回车直到最后完成：Virtual machine （PXE Server ）的默认IP 是10.1.10.199, 这时，你可以把你的工作站网卡地址改成：10.1.10.x 的地址并Ping 看看通不通：C:\Documents and Settings\Administrator>ping 10.1.10.199Pinging 10.1.10.199 with 32 bytes of data:Reply from 10.1.10.199: bytes=32 time=2ms TTL=64Reply from 10.1.10.199: bytes=32 time<1ms TTL=64Reply from 10.1.10.199: bytes=32 time<1ms TTL=64Reply from 10.1.10.199: bytes=32 time<1ms TTL=64记得把防火墙关掉！！！好，你已经大功告成了，现在一切准备就绪。

F5命令行配置配置手册

bigstart Restarts the SNMP agent bigsnmpd. bigtop Displays real-time statistics.Config Configures the IP address, network mask, and gateway on the management (MGMT) port.Use this command at the BIG-IP system prompt prior to licensing the the BIG-IP system, and do not confuse it with the bigpipe config command or the BIG-IP Configuration utility.halt Shuts down the BIG-IP software application.hostname Displays the name you have given to the BIG-IP system.printdb Prints the values of one or more entries in the bigdbTM database. reboot Reboots the BIG-IP system.ssh and scp Access command line interfaces on other SSH-enabled devices, and copy files to or from a BIG-IP system.自定义Bigpipe shell名称bp> shell prompt <string>bp> shell prompt BIG-IP>系统Shell名称将变成:BIG-IP>此特性避开此限制,在Linux命令前加”!”.BIG-IP>!ls //查看目录BIG-IP>!ifconfig //查看接口配置•Routes•Self IP addresses•Packet Filters•Trunks (802.3ad Link Aggregation)•Spanning Tree Protocol (STP)•VLANs and VLAN groups•ARP配置Packet Filtering命令: bigpipe packet filter你可以定义一个包过滤规则来提供访问控制,速率shaping,审计. 配置路由命令:route (<route key list> | all | inet | inet6)F5的Show Tech[root@XXXX:Standby] config # qkviewGetting systemwide backup configuration files.Getting AOM information.Getting last 175 lines of log files.Getting last 175 lines of gzipped log files.Getting md5 sum information.Getting core file list.Getting Public Certificate information.Getting tmctl information.completed... 6 of 161 checks produced no dataDiagnostic information has been saved in file /var/tmp/-tech.out Please send this file to **************.bigtop - display real-time statistics-bytes display counts in bytes (vs bits)-pkts display counts in packets (vs bits)-reqs display counts in requests (vs connections)-vips <n> number of virtual servers to print-nodes <n> number of nodes to print-once print once and exit-delay <n> number of seconds between samples (default 4)-scroll disable full-screen mode-nosort disable sorting-conn sort by connection count (vs byte count)-delta sort by count since last sample (vs total)-n print IP address and services in numeric format-vname display virtual servers by name (vs IP address)-help, -h print this message日志文件系统1. Access the BIG-IP system prompt.2. Stop the BIG-IP system or put the system into a safe condition such as standby mode using the bigstart stop command.3. Type the following command:resize-logFSThis command prompts you for the desired file size in gigabytes.4. At the prompt, type an integer.The minimum allowed value is 1, and the maximum allowed value is 10.A prompt appears that allows you to confirm the specified file size.5. Type Y.A message appears, notifying you of the need for the BIG-IP system to perform a reboot, followed by a prompt, which allows you to permit the reboot operation. Note: Prior to rebooting, the BIG-IP system verifies that the integer you typed in step 3 is within the allowed range, and checks to ensure that enough disk space exists for the specified size.6. Type Y.A confirmation prompt appears.7. Type Y.The system displays messages indicating that the reboot operation is about to occur.8. Wait for the reboot operation to finish.When the system becomes available again, the newly-specified disk space for the log file will be in effect.WARNINGDo not delete the files: /shared/.LoopbackLogFS and /shared/LogFS_README, because this action deletes all of your log files.启用/禁用虚拟服务或虚拟地To enable or disable a virtual server, use the appropriate command syntax:bp> virtual <virtual addr>:<virtual port> enable | disableTo enable or disable a virtual address, use the appropriate command syntax:bp> virtual address <virtual addr> enable | disable从服务中移出单个的NodeYou can remove an individual node from service, or return an individual node to service from the bigpipe shell command line.To remove an individual node from service, use the following command:bp> node <node addr>:<node port> downTo return an individual node to service, use this command:bp> node <node addr>:<node port> up查看修改F5系统配置文件器来编辑或者查看这些文件,当你没有条件使用浏览器时,有时候修改配置文件很有必要.这就需要F5的无浏览器配置模式和命令行配置模式Important:在你编辑完bigip.conf or bigip_base.conf 重启MCPD service之前, 你必须运行bigpipe load 确保MCPD service 使用的是当前的配置数据alert.conf Stores definitions of SNMP traps (system default alerts).user_alert.conf Stores definitions of SNMP traps (user-defined alerts)./config/bigip.conf Stores all configuration objects for managing local application traffic, such as virtual servers, load balancing pools, profiles, and SNATs.Note that after you edit bigip.conf, and before you restart the MCPD service, you must run the bigpipe load command./config/bigip_base.conf Stores BIG-IP self IP addresses and VLAN and interface configurations. Note that after you edit bigip_base.conf, and before you restart the MCPD service, you must run the bigpipe load command./config/bigip.license Stores authorization information for the BIG-IP system./etc/bigconf.conf Stores the user preferences for the Configuration utility./config/bigconfig/openssl.conf Holds the configuration information for how the SSL library interacts with browsers, and how key information is generated./config/user.db Holds various configuration information. This file is known as the bigdb database. /config/bigconfig/httpd.conf Holds configuration information for the web server./config/bigconfig/users The web server password file. Contains the user names and passwords of the people permitted to access whatever is provided by the webserver./etc/hosts Stores the hosts table for the BIG-IP system./etc/hosts.allow Stores the IP addresses of workstations that are allowed to make administrative shell connections to the BIG-IP system./etc/hosts.deny Stores the IP addresses of workstations that are not allowed to make administrative shell connections to the BIG-IP system./etc/rateclass.conf Stores rate class definitions./etc/ipfwrate.conf Stores IP filter settings for filters that also use rate classes. /etc/snmpd.conf Stores SNMP configuration settings./etc/snmptrap.conf Stores SNMP trap configuration settings./config/ssh Contains the SSH configuration and key files./etc/sshd_config This is the configuration file for the secure shell server (SSH). It contains all the access information for people trying to get into the system by using SSH./config/routes Contains static route information.[root@ISAG-2:Standby] config # find_keysISAG-2 koradsatn. omtitra eodISAG-2 junl trig Cmi nevl5scnsdt md.6koradsatn. omtitra eodFound license key JTPBO-CHRSX-DGBIO-HOAHJ-MOZJEVALicense file location is: /sda.1/config/bigip.licenseFound license key JTPBO-CHRSX-DGBIO-HOAHJ-MOZJEVAUnmounting unneeded partitions... ISAG-2 junl trig Cmi nevl5scnsn Cmi nevl5scnsree aamd.<>junl trig Cmi nevl5scns<6>EXT3-fs: mounted filesystem with ordered data mode.ISAG-2 junl trig Cmi nevl5scns<6>kjournald starting. Commit interval 5 secondscompleteAbove information can be found in /tmp/keys.outManaging Local Application Traffic•Setting up load balancing•Controlling HTTP traffic•Implementing HTTP and TCP optimization profiles•Authenticating application traffic•Implementing persistence•Enhancing the performance of the BIG-IP system•Managing health and performance monitors•Implementing iRules设置VirtualServer负载均衡1. Decide what types of traffic you want the BIG-IP system to manage, as well as whether you want to implement session persistence, connection persistence, and remote authentication.2. For each decision in step 1, decide whether you want to use the corresponding default profile that the BIG-IP system provides, or whether you want to create a custom profile.3. Access the bigpipe shell.4. If you want to create custom profiles, use the profile command, specifying the appropriate type of profile as an argument. If you do not want to create custom profiles, skip this step.5. Create one or more load balancing pools, using the pool command.6. Create a virtual server, using the virtual command, and assign to it any profiles and pools that you created. If you are using default profiles, some of those profiles might already be assigned to the virtual server by default.配置克隆Pool克隆Pool设计是用于入侵检测,你可以针对一个VS设置一个克隆Pool,这个克隆的VS接收世的流量和普通Pool一样,你就可以复制流量到入侵检测系统中.1. Access the bigpipe shell.2. Use the virtual command, to create or modify a virtual server, specifying a value for the clone pool argument.配置最后一跳Pool默认,BIG-IP系统自动启用最后一跳特性是,如果你想禁用这个特性.然后自己手工定义一个最后一跳路由器,你可以建立一个最后一跳pool并且指定其属于某个VS当中.1. Access the bigpipe shell.2. Use the pool command to create a last hop pool that contains the router inside addresses.3. Use the lasthop pool argument with the virtual command to assign the last hop pool to a virtual server.If you have not assigned an SSL profile to the virtual server, use the profile argument with the virtual command to assign the profile to the virtual server.配置SNATs这里有两种基础方法来建议一个SNAT,你可以直接将一个转换地址委派给一个或多个源IP地址,或者你可以配置一个SNAT pool,然后委派这个SNAT pool到某个源IP地址,在较新的版本中,BIG-IP自动从SNAT Pool中选择一个转换地址Note that you can assign these types of mappings from within an iRule.To map a single translation address to an original address1. Access the bigpipe shell.2. Designate an IP address as a translation address, using the snat translation command.3. Map the translation address to one or more original IP addresses, using the snat command or the rule command.To map a SNAT pool to an original address1. Access the bigpipe shell.2. Create a pool of translation addresses (that is, SNAT pool), using the snatpool command.3. Map the SNAT pool to one or more original IP addresses, using either the snat command or the rule command.配置HTTP traffic你可以配置BIG-IP来控制HTTP流量:配置HTTP压缩,HTTP请求重定向,HTTP请求重写,插入和插除HTTP头,启用或者禁用cookie加密和SYN cookie支持,配置HTTP 类Profile, HTTP响应数据组块控制.Configuring HTTP compression配置BIG-IP系统压缩HTTP 服务响应1. Access the bigpipe shell.2. Configure the compression-related settings of an HTTP profile,using the profile http command.3. Assign the HTTP profile to a virtual server, using the virtual command.Redirecting HTTP requests你可以配置HTTP Profile来重定向HTTP请求,并且在这个Profile中定义一个Fallback主机1. Access the bigpipe shell.2. Using the profile http command, create or modify an HTTP profile, specifying a value for the fallback argument. You can specify either a URI or the default fallback host, or you can specify that you want no HTTP redirection.3. Verify that the HTTP profile you created or modified is assigned to a virtual server.Rewriting HTTP redirections你可以配置HTTP Profile来重写HTTP的重定向规则1. Access the bigpipe shell.2. Using the profile http command, create or modify an HTTP profile, specifying a value for the redirect rewrite argument.For example, to create a profile that only rewrites URIs matching the originally requested URI (minus an optional training slash), use the following syntax:profile http myHTTPprofile { redirect rewrite matching }3. Verify that the HTTP profile you created or modified is assigned to a virtual server.Inserting and erasing HTTP headers你可以配置HTTP Profile来插入一个头文件到HTTP请求,或者从HTTP请求中移出一个头文件1. Access the bigpipe shell.2. Using the profile http command, create or modify an HTTP profile, specifying a value for either the header insert, header erase, or insert xforwarded for options.3. Verify that the HTTP or Fast HTTP profile you created or modified is assigned to a virtual server.Enabling or disabling cookie encryption你可以使用Profile http中的两个选项来启用或者禁用cookie加密1. Access the bigpipe shell.2. Using the profile http command, create or modify an HTTP profile, specifying a value for the encrypt cookie and cookie secret options.3. Verify that the HTTP profile you created or modified is assigned to a virtual server.Enabling or disabling SYN cookie support为了管理DOS攻击,你可以在一个Fast L4 Profile中配置SYN Cookie选项启用或者禁用SYN Cookie支持功能◆如果BIG-IP系统包含了Packet Velocity ASIC (PVA)技术,使用profile fastl4命令,定义一个hardware syncookie(enable | disable | default)选项,同样,你可以根据需求设置以下的变量通过db命令.•pva.SynCookies.Full.ConnectionThreshold (default: 500000)•pva.SynCookies.Assist.ConnectionThreshold (default: 500000)•pva.SynCookies.ClientWindow (default: 0)值得注意的是这个hardware syncookie 特性目前只可用于D84和D88平台.在其实平台设备这个特性无效.所以如果你在D84和D88上设置software syncookie 特性,SYN Cookie只通过软件处理◆如果BIG-IP系统不包含Packet Velocity ASIC(PVA)技术,使用profile fastl4 命令,指定为software syncookie (enable | disable | default) option.Configuring the HTTP Class profileBIG-IP系统包含一种Profile叫做HTTP Class Profile,你可以使用你定义的标准来用分类HTTP流量,当你分类流量的时候,你转地流量的原则是根据审查目标流量的头文件或者内容来定.如果BIG-IP系统包含Application Security Manager (ASM)或者WebAcclerator模块,你可以配置系统来先发送HTTP流量到那个模块,然后再发送到最终目标,例如,你可以使用HTTP Class Profile来对Virtual Server下命令,要求它发送流量先经过ASM然后再转发到负载均衡Pool.Unchunking and rechunking HTTP response data如果你想要监控内容你可以取消或者重新对HTTP响应进行组块操作,只需要配置HTTP Profile来启用unchunking功能.1. Access the bigpipe shell.2. Using the profile http command, create or modify an HTTP profile and specify the response argument.3. Make sure that you have assigned the HTTP profile to a virtual server, using the virtual command.你能够设备的保持有以下几种:实施Session保持•Cookie•Destination Address Affinity•Microsoft Remote Desktop Protocol (MSRDP)•Hash•Session Initiation Protocol (SIP)•Source Address Affinity•SSL•Universal具体操作:1. Access the bigpipe shell.2. Create a persistence profile, using the profile command, that corresponds to the type of persistence you want to implement.3. Assign the persistence profile to a virtual server, using the persist and fallback persist arguments with the virtual command.实施连接保持为了实施连接保持,你可以添加一个Keep-Alive头文件到HTTP /1.0头文件里(如果不存在).(默认HTTP/1.1连接包含Keep-Alive支持),你同样可以启用connection pooling特性,它可以保持服务器端的连接打开,重新用来供其它客户端请求所使用.你可以通过修改HTTP或者Fast HTTP Profile文件来启用keep-alive支持和Connection pools.同样可以修改OncConnect Profile来实现.To add Keep-Alive headers into HTTP requests1. Access the bigpipe shell.2. To ensure that HTTP connections stay open, use the profile http command and specify the oneconnect transformations argument. This ensures that the BIG-IP system inserts aConnection:Keep-Alive header into any HTTP /1.0 request that does not already contain one.3. Make sure that you have assigned the HTTP or Fast HTTP profile to a virtual server, using the virtual command.To enable connection pooling1. Access the bigpipe shell.2. Using the profile oneconnect command, configure a profile for connection pooling.3. Assign the profile to a virtual server, using the profile argument with the virtual command.小提示:你同样可以通过配置Fast HTTP Profile来配置连接保持,在BIGPIPE SHEEL中使用fasthttp命令.加强BIG-IP性能BIG-IP系统.设置连接Qos和数据包TOS等级你可以使用bigpipe工具来设置QoS和TOS等级,你不仅可以对所有具有目标负载均衡Pool的流量做,同时你也可以对自定义的流量做,例如:Layer 4 ,TCP 和UDP流量.1. Decide whether you want to set QoS and ToS levels for traffic targeted for an entire pool or for specific types of traffic, or both.•If you want to set the QoS and ToS levels for an entire pool, access the bigpipe shell and use the pool command with one or more of the following arguments: link qos to client, link qos toserver, ip tos to client, and ip tos to server.•If you want to set the QoS and ToS levels for certain types of traffic, access the bigpipe shell and use the profile command to create or modify a Fast L4, TCP, or UDP profile.2. Verify that the pool or the profile that you created or modified is assigned to a virtual server. To do this, use the following syntax:bp> virtual <virtual server name> list设置空闲超时时间(Idle timeout time)或者修改一个Fast L4,Fast HTTP,TCP,或者UDP Profile.1. Create or modify a Fast L4, Fast HTTP, TCP, or UDP profile, by accessing the bigpipe shell and using the profile command.2. Specify the idle timeout argument to set a timeout value.3. Verify that the profile you created or modified is assigned to a virtual server.实施速率整形Virtual Server或者Packet Filter规则中.1. Access the bigpipe shell.2. Create one or more rate classes, using the rate class command.3. Assign the rate classes to a virtual server or a packet filter rule, using either the virtual command or the packet filter command.Implementing iRulesiRule特性强大而灵活,值得注意的是它可以增强BIG-IP系统能力.一个iRule可以引用任意object,它不管这个被引用的object处理哪个分区里.例如;一个iRule属于分区A,但包含指定一个Pool属于分区B的语句.1. Access the bigpipe shell.2. Create an iRule using the rule command. You must include the name of the Tcl script and the script itself as arguments for the command.3. Assign the iRule to a virtual server, using the virtual command in one of the following ways:•To associate multiple iRules with a virtual server, use this syntax:bp> virtual <virtual_server_name> rule <iRule1_name> \ <iRule2_name> ...•To remove the assignment of an iRule from a virtual server, use this syntax:bp> virtual <virtual_server_name> rule none•To remove the iRule assignments from multiple virtual servers, use the following syntax. Note that you can remove the iRule assignments only from virtual servers that reside in the current Write partition or in partition Common.bp> virtual all rule none•To associate an existing iRule with multiple virtual servers, use the following syntax. Note that you can associate an iRule only with virtual servers that reside in the current Write partition or in partition Common. bp> virtual all rule <iRule_name>Important: In this case, the iRule becomes the only iRule that is associated with each virtual server in the current Write partition. Because this command overwrites all previous iRuleassignments, we do not recommend use of this command.。

f5操作手册

f5操作手册
F5操作手册是针对F5设备进行配置和管理的指导手册。

以下是F5操作手
册的主要内容：
1. 设备连接与启动：介绍如何连接F5设备，启动设备并检查设备状态。

2. 登录与认证：介绍如何使用管理账号登录设备，并设置访问权限。

3. 设备管理：介绍如何对F5设备进行基本管理，包括配置管理、账户管理、日志管理等。

4. 应用配置：介绍如何配置F5的应用，包括HTTP代理、TCP代理、SSL
代理等。

5. 安全设置：介绍如何设置F5的安全功能，包括防火墙、访问控制、加密等。

6. 性能监控：介绍如何监控F5设备的性能，包括流量监控、连接数监控、
响应时间监控等。

7. 故障排除：提供常见故障排除方法，帮助用户快速解决问题。

8. 升级与维护：介绍如何对F5设备进行升级和维护，保证设备正常运行。

以上是F5操作手册的主要内容，具体内容可能因设备型号和版本而有所不同。

建议在使用F5设备时仔细阅读操作手册，并按照手册中的步骤进行操作。

F5负载均衡配置文档

F5配置手册2016年12月目录1. 设备登录 (3)1.1图形化界面 (3)1.2命令行界面 (3)2. 基础网络配置 (3)2.1创建vlan (3)2.2创建self ip (4)2.3创建静态路由 (4)3. 应用负载配置 (6)3.1 pool配置 (6)3.2 Virtual Server配置 (7)4. 双机 (8)4.1双机同步配置 (8)4.2主备机状态切换 (9)1.设备登录1.1图形化界面通过网络形式访问F5任一接口地址，或pc机直连F5的MGMT带外管理口，打开浏览器，输入https://192.168.1.245（MGMT地址在设备液晶面板查看）将进入F5的图形管理界面。

该界面适合进行设备的基础以及高级调试，是管理员常用的管理界面。

默认用户名/密码：admin/admin现密码已更改，并交由管理员妥善保管。

1.2命令行界面通过DB9console线直连F5的console口，或通过securecrt等工具以SSH2的形式访问F5任一接口地址，将进入命令行模式。

该界面适合进行底层操作系统的调试以及排错。

默认用户名/密码：root/default现密码已更改，并交由管理员妥善保管。

2.基础网络配置2.1创建vlan进入“Network”-“VLANs”选项，点击“create”创建新vlan，如下图：2.2创建self ip进入“Network”-“self ips”进行F5设备的地址配置，点击“create”新建地址，如下图：填写相应地址和掩码，在vlan处下拉选择之前创建好的vlan，将该地址与vlan绑定，即ip地址与接口做成了对应关系。

在双机部署下，浮动地址的创建需要选择Traffice Group 中的traffice-group-1(floating ip)点击“Finish”完成创建。

2.3创建静态路由F5的静态路由分缺省路由和一般路由两种。

任何情况下，F5部署上线都需要设置缺省路由。

F5详细配置手册

F5 BIG-IP负载均衡器配置指导书目录添加“只读”权限的管理员帐号.............................................................................................对某一Virtual Server用TCPDUMP命令无法抓到包如何处理............................................一、网络结构与IP地址规划本手册以移动W AP/彩信网关为例网络拓扑结构如下图所示：整个数据网络设备，采用两台防火墙、两台BIG-IP 3400负载均衡器、及两台交换机、网络设备都采用主、备设备，以实现设备、链路的冗余备份，以消除单点故障。

这里部署负载均衡器的目的主要是为了增加服务器的数量，以提升系统的处理能力。

但对外仍然是一个IP地址。

相关的IP地址规划如下：注：以上的IP地址规划是测试环境的IP地址设置，需要根据现网环境中的IP地址规划进行修改。

二、配置BIGIP3400负载均衡设备本章将主要描述BIGIP3400负载均衡设备的配置方法及配置内容。

旁路/直连的选择2.1.1路由/直连模式的介绍网络连接的物理结构如下结构：Ip规划说明：图中bigip为负载均衡交换机，bigip上面使用公开的ip地址，bigip下面同负载均衡的服务器使用不公开的ip地址。

但对外提供服务则使用公开的ip。

2.1.2旁路模式的介绍网络连接的物理结构如下结构：Ip规划说明：图中bigip为负载均衡交换机，bigip和负载均衡的服务器均使用公开的ip 地址。

2.1.3 路由/直连模式同旁路模式的比较（1）流量走向不一样；路由/直连模式的流量走向如下：如上图，bigip同客户端的流量在bigip的上联接口，bigip同服务器的流量在下面的接口。

旁路模式的流量走向如下：如上图，bigip无论同客户端还是同服务器的通讯流量均在bigip的一个接口上。

F5负载均衡 BigIP配置手册

F5负载均衡B i g I P配置手册(共16页)-本页仅作为预览文档封面，使用时请删除本页-外网F5配置步骤：一、登录到F5 BIG-IP管理界面：1、初次使用：①、打开F5 BIG-IP电源，用一根网线（直连线和交叉线均可）连接F5 BIG-IP的管理网口和笔记本电脑的网口，将笔记本电脑的IP地址配置为“，子网掩码配置为“”。

②、用浏览器访问F5 BIG-IP的出厂默认管理IP地址③、输入出厂默认用户名：admin，密码：admin④、点击Activate进入F5 BIG-IP License申请与激活页面，激活License。

⑤、修改默认管理密码。

2、以后登录：通过F5 BIG-IP的自身外网IP登录。

①、假设设置的F5自身外网IP为，就可以通过②、还可以通过SSH登录，用户名为root，密码跟Web管理的密码相同。

二、创建两个VLAN：internal和external，分别表示内网和外网。

1、创建VLAN：internal（内网）在“Network→VLANs”页面点击“create”按钮：①、Name栏填写：internal（填一个英文名称）②、Tag栏填写：4093（填一个数字）③、Interfaces栏：将Available列的“”拉到Untagged列。

表示F5 BIG-IP的第一块网卡。

2、创建VLAN：external（外网）在“Network→VLANs”页面点击“create”按钮创建VLAN：①、Name栏填写：external（填一个英文名称）②、Tag栏填写：4094（填一个数字）③、Interfaces栏：将Available列的“”拉到Untagged列。

表示F5 BIG-IP的第二块网卡。

三、创建F5 BIG-IP的自身IP：分别对应internal（内网）和external（外网）。

1、创建自身内网IP：在“Network→Self IPs”页面点击“create”按钮：①、IP Address栏填写：（填内网IP地址）②、Netmask栏填写：（填内网子网掩码）③、VLAN栏选择：internal④、Port Lockdown栏选择：Allow Default（默认值）2、创建自身外网IP：在“Ne twork→Self IPs”页面点击“create”按钮：①、IP Address栏填写：（填外网IP地址）②、Netmask栏填写：（填外网子网掩码）③、VLAN栏选择：external④、Port Lockdown栏选择：Allow Default（默认值）四、创建默认网关路由1、创建默认网关路由在“Network→Routes”页面点击“create”按钮：①、Type栏选择：Default Gateway（默认值）②、Resource栏选择：Use Gateeay...，在其后的输入框填写网关IP地址：（这里假设此IP为外网网关地址）五、创建服务器自定义健康检查1、创建自定义HTTP健康检查：monitor_http在“Local Traffic→Monitors”页面点击“create”按钮：①、Name栏填写：monitor_http（填一个英文名称）②、Type栏选择：HTTP③、Import Settings栏选择：HTTP④、Interval栏填写：5（表示每5秒钟进行一次健康检查）⑤、Timeout栏填写：16（表示健康检查的连接超时时间为16秒）⑥、Send String栏填写：GET /（也可以根据自己的需求发送其他方法的请求，例如HEAD /或者GET /）⑦、Receive String栏填写：（填写对应的返回字符串，默认不填写）六、创建服务器池（pool）1、创建Squid服务器池：pool_dzsq在“Local Traffic→Pools”页面点击“create”按钮：①、Name栏填写：pool_squid（填一个英文名称）②、Health Monitors栏：将第四步创建的自定义HTTP健康检查“monitor_http”由Available列拉到Active列③、Load Balancing Method栏选择：Round Robin（这里选择的负载均衡方式是轮询，也可以选择其他方式）④、New Members栏：先选择New Address，再添加两台Squid服务器的IP地址、、、以及它们的端口80内网F5配置步骤：一、登录到F5 BIG-IP管理界面：1、初次使用：①、打开F5 BIG-IP电源，用一根网线（直连线和交叉线均可）连接F5 BIG-IP的管理网口和笔记本电脑的网口，将笔记本电脑的IP地址配置为“，子网掩码配置为“”。

F5详细配置手册

F5命令行配置配置手册

F5 V9配置手册

F5简明配置手册

F5负载均衡用户指导手册

F5详细配置手册

F负载均衡器简明配置手册(A concise configuration manual for the F load balancer)

F5详细配置手册

F5 LTM配置手册

F5简易配置手册

F5负载均衡运维配置手册V10

F5配置手册

F5配置手册(内部)

F5 安装调试 配置手册 自学指南

F5命令行配置配置手册

f5操作手册

F5负载均衡配置文档

F5详细配置手册

F5负载均衡 BigIP配置手册

F5 安装调试配置手册自学指南