how to deploy F5 BIG-IP 4200 V HA Pair for Web Application

We have deployed Virtuals with both the one-armed and the inline mode. How you do it is based off your specifics.

You need to retain the original IP address of the clients, if your web servers can examine the X-Forwarded-For or XFF identifier in the header, then doing an in-line will work well. You can offload the SSL to the F5 and still use all load balancing methods.

If you cannot look at the X-forwarded-for method, you can still use the in-line, but would need to have routes to the F5 for return public traffic. ( server default routes would point to the F5, any RFC-1918 routes would point to another gateway in our environment ).

The One Arm method works well for many things, but will remove your ability to offload the SSL and limit the load balancing choices ( no cookies.. someone correct me if I'm wrong here ). Typically each web server will need a loopback of the public IP to accept the One Armed traffic.

The Inline method does not require you to use different subnets. We do an inline method for many instances with all IPs in the same RFC-1918 subnet. We just have the firewall forward traffic for the public IP address of the load balanced web traffic to the failover RFC-1918 IP address of our LTM pair.

Hope this helps.

Jason

As per my knowledge X-forwarded-for method only work for HTTP & SMTP traffic. It won't work for HTTPS traffic. As you said we can use same IP subnets on both interfaces (external & internal) of BIG-IP if we are deploying in Inline-Routed Mode. What is the pros & cons of using BIG-IP with same IP subnets or different ?

Sorry but you are wrong Jason :) - most designs (exceptions are layer two only and nPath) do not limit your ability to offload SSL or the choice of load balancing or persistence methods available.

Loopbacks are not required for One Arm mode, only for nPath. A single device cannot have multiple interfaces in the same IP subnet (but a single interface can have multiple IPs in the same subnet).

There are quite a few variations where One Arm and Routed mode are concerned. Apologies Tabish but I don't have time to describe them here. I'd suggest you read the TMOS Implementations guide from support.f5.com for more detail.

Now I am confused whether I can use same IP subnet on both interfaces (External & Internal) of single device or not. External interface pointing to client side & internal interface point to node (servers) side.

Pls help me.

You cannot have internal and external VLANs and associated IP addresses in the same IP subnet. In One Arm mode client and server side traffic would enter and leave using the same, single interface.

Are you sure we can't have both (internal & external) interfaces of single unit in the same subnet ? Sorry the reason I am asking this because tomorrow I have to start implementation & Jason statement that (The Inline method does not require you to use different subnets. We do an inline method for many instances with all IPs in the same RFC-1918 subnet) made me confused.

I'm sure Jason will confirm or clarify that he was referring to a single VLAN implementation with a fixed IP on each of a HA pair and a floating IP for HA.

I'm just going to double-check on my VE that you can't assign IPs in the subnet to two different VLANs, just to be 100% sure but I'm 99% sure it'll throw an error. Standby...

Customer wants to see the original source IP of the client on the Web Servers. Web servers are HTTPS based. As I know I can not go for One-Arm mode design because in One-Arm client source IP will change. In inline-routed mode (two arm) if we can not use same subnet on both interfaces then we have to change either web servers IP's or DMZ interface IP because currently server are using DMZ interface IP as a default gateway. Pls advise

OK, here's the error I got when trying;

01070354:3: Self IP 10.12.11.4 / 255.255.255.0: This network is defined on two vlans (/Common/internal and /Common/external)

I think if you changed the default gateway for those specific web servers to be the F5 (and made the F5's gateway the fw) then it would work without the need for SNAT, using just a single VLAN on the F5.

Inbound: FW --> F5 VS --> Server
Outbound: Server --> F5 --> FW

If you manage the servers through the same interface and don't want that to pass through the F5, just configure some static routes pointing directly to the f/w.