Simplify & Scale: Hybrid App Delivery with F5 BIG‑IP VE Across Multi‑Cloud and Virtual Environments

Key Concepts

• F5 BIG-IP VE: A virtual edition of F5’s BIG-IP application delivery controller, providing consistent security and performance across diverse environments.
• Multiplatform Support: The ability of F5 BIG-IP VE to operate seamlessly across VMware, OpenShift, Nanix, and public cloud platforms (e.g., Google Cloud).
• Virtual Server: A configuration element within BIG-IP that acts as the front-end for an application, handling incoming traffic.
• Pool: A group of backend servers that a virtual server directs traffic to.
• Web Application Firewall (WAF): A security mechanism that protects web applications from various attacks.
• Request Logging: The process of recording details about incoming requests for security analysis and troubleshooting.
• Automation Toolkit (e.g., Ansible): Tools used to automate the configuration and deployment of infrastructure components.

Infrastructure and Business Challenges

Enterprises frequently deploy applications across a heterogeneous infrastructure consisting of virtualized environments like VMware, Nanix, and OpenShift, alongside public cloud providers for resilience. This distributed architecture introduces complexity in managing application traffic and maintaining consistent security policies, leading to increased operational overhead and potential security risks. The video highlights a common scenario where organizations need to ensure uniform application delivery and security across these diverse platforms.

F5 BIG-IP VE and Multiplatform Support

F5 addresses these challenges with BIG-IP VE, a virtual edition of their application delivery controller. Deploying BIG-IP VE identically across each virtualized environment simplifies application delivery configuration while guaranteeing consistent security and performance. BIG-IP VE can be deployed directly from public cloud provider marketplaces, streamlining the process and integrating product licensing. This approach allows for seamless integration of new application workloads, meeting evolving business needs for security and scalability.

Application Deployment Example

The video demonstrates a practical example involving several applications:

• DVWA (Damn Vulnerable Web App): Deployed in all environments (VMware, Nanix, OpenShift, and cloud). Used for security testing.
• Juice Shop: Initially deployed in VMware and Nanix, now being rolled out to all environments.
• Mutil: Initially deployed in VMware and Nanix, also being rolled out to all environments.

The application owners replicated Juice Shop and Mutil, and the task is to configure BIG-IP in each environment to deliver and secure these applications. An existing, pre-approved Web Application Firewall (WAF) policy is then applied to uniformly secure each application instance.

Configuration Process: Step-by-Step

The configuration process involves the following steps, repeated for each application and environment:

1. Initial Access & Verification: Attempts to access the applications reveal that some pages initially fail to load in certain environments (Nanix, VMware via Firefox, OpenShift via curl).
2. Virtual Server Creation: Accessing the BIG-IP web console for each instance, a new virtual server is created for each application. This virtual server acts as the front-end for the application in that specific location.
3. Pool Configuration: A default pool is configured, connecting the virtual server to the backend application instances running in the respective virtual environment.
4. Security Policy Attachment & Logging: The pre-approved WAF security policy is attached to each virtual server, providing a consistent layer of security. Request logging is enabled for visibility and troubleshooting.

Following these steps, all applications become accessible in all three on-prem locations. The identical nature of this process lends itself to automation using tools like Ansible.

Security Validation and Monitoring

The video demonstrates the effectiveness of the WAF policy by attempting to access an application with a request containing script access – a common attack vector. BIG-IP correctly denies access, showcasing the policy’s functionality. Monitoring access and identifying irregularities is achieved through the BIG-IP console’s security section, specifically by reviewing event logs. The example shows a blocked request being correctly logged.

Public Cloud Deployment

While a full Google Cloud deployment isn’t shown, the video states that the process is similar to on-prem environments and potentially easier due to integrated product licensing when deploying via the cloud provider’s marketplace.

Key Argument & Supporting Evidence

The central argument is that F5 BIG-IP VE provides a consistent and manageable solution for application delivery and security in hybrid and multi-cloud environments. This is supported by:

• Demonstrated Configuration Consistency: The identical configuration process across VMware, Nanix, OpenShift, and the potential for easy replication to public clouds.
• Effective Security: The successful blocking of malicious requests by the WAF policy.
• Centralized Monitoring: The ability to review security events and access logs from a single platform.
• Scalability & Resilience: The ability to deploy across geographically distributed locations.

Notable Quote

“Running F5 big IP on any platform across virtualized environments provides a robust, scalable, and consistent way to secure and manage access to your applications regardless of the reach for internal users as well as outside.” – Narrator

Synthesis/Conclusion

F5 BIG-IP VE offers a compelling solution for organizations struggling with the complexities of managing applications across diverse virtualized and cloud environments. By providing a consistent platform for application delivery, security, and monitoring, BIG-IP VE reduces operational overhead, enhances security posture, and enables faster deployment of new applications. The demonstrated ease of configuration and the potential for automation further solidify its value proposition. Further implementation details and a step-by-step workflow guide are available on the F5 Dev Central website (links provided in the video description).