Forum Discussion

dips123_222482's avatar
dips123_222482
Icon for Nimbostratus rankNimbostratus
Sep 17, 2015

F5 Healthcheck

Hi gurus

 

I am new to F5 and wanted to ask a few questions about the following scenario that I have:

 

I need an application sitting in the corporate network to access a service on port 443 out in the internet. The users are in the user zone and to go out to the internet they need to go through the DMZ. However there is no direct path between where the users are and the DMZ. So the users need to hop on to a jump box to go to the server in the DMZ and then out to the internet. The jumpbox and the server has been configured to run a proxy listening on a particular port. The user to the first jumpbox is going through a F5. It will be ideal if I can do an end to end healthcheck for the entirety of the path. My questions are:

 

  • Can I do a healthcheck on port 443 for the end to end path, i.e the first jumpbox and the server in DMZ and the service out in the internet? I believe it requires a complex iRule. Is that true?
  • Can I do a TCP Half open check from the F5 all the way down the chain?
  • If I do a port 80 healthcheck and the service on the internet is listening on port 80, i.e I am just doing a check on the availability of the path and not on the service, shall we need complicated send and receive strings, or is it standard out of the box config?
  • Any other suggestions as to how this can be done?

As I said, I am new to F5 and any help will be greatly appreciated.

 

Regards, Dips

 

application delivery
BIG-IP DNS
design
LTM
management

1 Reply

Sort By
  • boneyard's avatar
    boneyard
    Icon for MVP rankMVP
    Sep 17, 2015

    a picture equals a thousand words, it would help if you draw the components and the path to clarify what you want.

     

    in principle if the F5 is at the start of the path a health monitor can follow the path if the traffic is send through the hops without any need for interaction. as mentioned your exact situation isn't quite clear to me, but a health monitor in general isn't going to login to a jump host for example. also a proxy server might cause issue, due to authentication requirements for example.

     

    if you require complicated strings depends on your needs. if you are fine with port 80 listening then just a tcp monitor is enough. if you want to be sure a http server is listening then a http monitor is enough. if you want to be sure a specific virtual host is active or a specific response should be returned then you need to configure send and / or receive strings. but all that depends on what you want. and personally i would start simple and see if that is already not enough.