Hi, Just wondered if someone could help me. We've set up our F5 LTM pair to load balance outbound internet requests via two bluecoat proxies which are located at 2 diifferent data centres. We're using SNAT as the bluecoat proxies don't have a default route via the F5 LTM. All is working fine its just the monitor I would like to optimize. Currently we are using two monitors for each bluecoat pool member. A icmp ping to check the bluecoat is available and google udp monitor to check the availability of the internet via each data centre. The problem is the google udp monitor isn't sent via the bluecoat box so there could be scenario where the bluecoat responds to ping and the internet monitor is up but for some reason internet access via the bluecoat isn't working. is it possible to force the internet monitor via the bluecoat? How have other people configured the F5 to load balance outbound internet access? Thanks Darren

You could use transparent HTTP monitors. Transparent Specifies whether the monitor operates in transparent mode. A monitor in transparent mode uses a path through the associated pool members or nodes to monitor the aliased destination (that is, it monitors the Alias Address-Alias Service Port combination specified in the monitor). The default is No. Yes: Specifies that the monitor operates in transparent mode. No: Specifies that the monitor does not operate in transparent mode. I've done something similar with default gateway pools. If you want to do an HTTP check for google for instance, you'll type in their address in the "Alias Address" field and port 80 in the "Service port field". Then simply attach that monitor to your pool member/nodes. Since google obviously has multiple IPs, I'd recommend configuring several monitors and requiring at least X be available.

By the way, people typically use "transparent ICMP" monitors in this case if they're monitoring a link. Since you're monitoring a proxy, I just assumed you'd want something more but that's your call. https://support.f5.com/kb/en-us/solutions/public/8000/900/sol8971.html

The last time I set this up I just used several website checks. e.g. news.bbc.co.uk, an external site of our own and a couple of others... Then just set a minimum number of 'Up' monitors and away you go... If you're on a recent version you could use an inline monitor too... H

I'm struggling to get this working. I've created the follwing. My Pool contains two bluecoat proxies using the ip address and port (885). The monitor has a send string of Get http://www.google.co.uk transparent is set to yes Alias address is 173.194.37.104 Alias service port http. The monitor is down. I would have expected to see entries from the bluecoat in the firewall logs for the monitor but nothing is there. I have also added the F5 device to the do not authenticate on bluecoat. Any help much appreciated as I've tried numerous things to get this working. Thanks Darren

What version of LTM are you running? HTTP monitors can be a bit complex. Did you copy and paste that? I just noticed that GET wasn't capitalized and would need to be. :-P

Bluecoat Internet Monitor

18 Replies

Chris_Miller
Altostratus
Jan 13, 2011
Posted By Dazzla on 01/13/2011 09:04 AM

I set up the http monitor without transparent and it was up but I'm not seeing any logs on the firewall or the monitor. From my understanding I would expect to see logs from the F5 to google.

I've then set up transparent with ip address of 193.105.162.85 and port 80. Once I set up transparent the monitor goes down and still not seeing any hits on the firewall from the bluecoat or the f5.

I logged on to the command line utility and and did a telnet to port 80 which was logged in the firewall so I know it dns is functioning and the f5 has route to get there.

First off, Hamish's post about having done this before was spot on...pretty cool.

http://devcentral.f5.com/Forums/tab...fault.aspx

He brought up a great point about the format for monitoring through proxies. Might be worth trying this instead for your monitor. That could very well explain the issues when changing to transparent.

~~GET http://www.google.co.uk/ HTTP/1.0\r\nConnection: Close\r\n\r\n~~
Dazzla_20011
Nimbostratus
Jan 14, 2011
Hi Chris,

Tried your suggestion but still not able to get his working. I will have a read of he documentation and and Hamish's post to see if I can get to the bottom of this.

Many Thanks for your help.
Chris_Miller
Altostratus
Jan 14, 2011
Posted By Dazzla on 01/14/2011 02:32 AM

Hi Chris,

Tried your suggestion but still not able to get his working. I will have a read of he documentation and and Hamish's post to see if I can get to the bottom of this.

Many Thanks for your help.

Bummer. If you can't find anything from Hamish's post, it wouldn't be a terrible idea to check with Bluecoat on what their expected request format looks like for HTTP traffic. F5 Support would certainly help as well. I'm sure they've encountered this before.
Dazzla_20011
Nimbostratus
Jan 14, 2011
I think I may have managed to figure out why this isn't working. The bluecoat boxes are on a different network to the F5 LTM. In transparent mode do the Pools members need to sit inline with F5 devices?
Chris_Miller
Altostratus
Jan 14, 2011
Posted By Dazzla on 01/14/2011 07:43 AM

I think I may have managed to figure out why this isn't working. The bluecoat boxes are on a different network to the F5 LTM. In transparent mode do the Pools members need to sit inline with F5 devices?

From this link, it says it must be "adjacent"

http://support.f5.com/kb/en-us/solu...r=12121378

From the wiki page, it says LTM sends to the pool member via L2

http://devcentral.f5.com/wiki/defau...nitor.html

"When an alternate Destination is specified and the Transparent option is selected, the monitor traffic will be sent to the alternate L3 destination via the pool member's L2 address . Useful for verifying gateways and proxies. (Pool member must be able to forward traffic as expected.)"

Not entirely sure what adjacent means in this case. Not sure whether it has to be on the same network so the L3 info remains intact or what. Might be worth asking F5 support unless someone else chimes in.
Hamish
Cirrocumulus
Jan 14, 2011
adjacent == on same subnet.

The way the transparent monitor works is the F5 sends the packets to the destination defined VIA the poolmember. Acting as a router. Therefore the poolmember needs to be on the same subnet as the F5 (e.g. An F5 VLAN with a selfIP on it) so that the packet can be sent via the poolmember.

H
Dazzla_20011
Nimbostratus
Jan 17, 2011
On another note what sort of persistence profile have you guys created for bluecoat/proxies as now and again my browser asks me to re-authenticate. I presume that will be because the session is terminated after a period of inactivity then the F5 sends the connection via a different bluecoat.
Chris_Miller
Altostratus
Jan 17, 2011
Posted By Dazzla on 01/17/2011 03:21 AM

On another note what sort of persistence profile have you guys created for bluecoat/proxies as now and again my browser asks me to re-authenticate. I presume that will be because the session is terminated after a period of inactivity then the F5 sends the connection via a different bluecoat.

As long as your devices aren't being NATed between the client machine and F5, I'd expect source address persistence would work fine.

Forum Discussion

Bluecoat Internet Monitor

18 Replies

Recent Discussions

What is the meaning is 52% block in WAF

Rundeck ansible F5 errors

rewrite Azure AD response for portal access via web portal

AS3 Monitoring multiple ports selectively

Open Redirection Mitigation

Related Content

Protect an application exposed on Internet with F5 XC WAAP

F5 Distributed Cloud - Regional Edge Health Monitoring Insights

F5 APM VPN Choking Internet Bandwidth

Unbreaking the Internet and Converting Protocols

Health monitor question