topic Re: Connect F5 Load balancer to ACI fabric without integrating (Just need to provide network connectivity) in Application Networking

Connect F5 Load balancer to ACI fabric without integrating (Just need to provide network connectivity)

Thushan Pramod — Fri, 01 Mar 2019 17:33:31 GMT

I need to attach F5 load balancer to ACI fabric without integrating, Customer need to attach it as access ports. Can I use the same procedure which we use for BM server attachment to ACI fabric via access ports.? Please assist me.

Re: Connect F5 Load balancer to ACI fabric without integrating (Just need to provide network connectivity)

Rick1776 — Mon, 22 Jan 2018 21:18:53 GMT

Correct, if you aren't going to use the device package you would install it the same as a BM and or connecting a Switch with the Physical and external domains.

This is a pretty great configuration
guide.https://www.cisco.com/c/dam/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/aci-f5-deployment-guide-iworkflow.pdf

Re: Connect F5 Load balancer to ACI fabric without integrating (Just need to provide network connectivity)

Thushan Pramod — Sat, 03 Feb 2018 12:17:43 GMT

Hi Rick1776,
It was really helpful and thanks a lot for the information provided.

Re: Connect F5 Load balancer to ACI fabric without integrating (Just need to provide network connectivity)

Rick1776 — Sat, 03 Feb 2018 18:23:06 GMT

No problem have a great day.

Re: Connect F5 Load balancer to ACI fabric without integrating (Just need to provide network connectivity)

alfafa973 — Tue, 03 Sep 2019 10:40:51 GMT

Good morning,

How can I download the guide you mentioned? I t doesn't seem to be available anymore on the Cisco public website.

https://www.cisco.com/c/dam/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/aci-f5-deployment-guide-iworkflow.pdf

Thank you.

Re: Connect F5 Load balancer to ACI fabric without integrating (Just need to provide network connectivity)

Thushan Pramod — Tue, 03 Sep 2019 11:55:31 GMT

Here is the file you requested.

Re: Connect F5 Load balancer to ACI fabric without integrating (Just need to provide network connectivity)

alfafa973 — Tue, 03 Sep 2019 14:19:30 GMT

Thank you very much.

Re: Connect F5 Load balancer to ACI fabric without integrating (Just need to provide network connectivity)

alfafa973 — Tue, 03 Sep 2019 14:58:55 GMT

Good afternoon,

One more question if you don't mind me asking:

In my case, I can't use unmanaged/managed service graph because I need to have the VIP in a different subnet (the self-ip subnet not the same as VIP/Pool subnet).

I use as well the GTM to check whick LTM is actually available.

Therefore, I have to use EPG mode (At least, it is my understanding). Is there a deployment guide related to EPG mode? I did my configuration and I found a way to advertise the VIP (subnet under the EPG as per screenshot below but every VIP has to be advertise individually, only /32 are allowed). Is there a different way of doing this configuration in EPG mode?

Kind regards.

Re: Connect F5 Load balancer to ACI fabric without integrating (Just need to provide network connectivity)

Thushan Pramod — Tue, 03 Sep 2019 15:31:13 GMT

Are you providing only the networking for F5 through ACI?, Then you have to go as BM server on-boarding to ACI fabric. I have not got your concern clearly. If you need to advertise the subnets can do it in BD level easily as well.

Re: Connect F5 Load balancer to ACI fabric without integrating (Just need to provide network connectivity)

alfafa973 — Tue, 03 Sep 2019 16:13:22 GMT

Hi Thushan,

If I advertise the VIP subnet under the BD (BD with two subnets, one for the self-ip and one for the VIP). It does work fine in term of routing advertisement.

However, the LTM will not respond to any ARP request sent to the VIP subnet unless the traffic is routed to it.

For example, if my self-IP subnet is 192.168.1.0/24 and my VIP is 10.10.10.0/24, I can have a BD with these two subnets. they are advertised fine.

But, if a client let say 172.16.16.1 try to access a group of servers from the VIP 10.10.10.1, the traffic goes up to the BD but the LTM will not respond to the arp asking for the mac-address of 10.10.10.1.

Therefore, it doesn't work. I cannot reach the virtual servers (VIP subnet) just by advertising the VIP subnet from the BD.

I have to route the traffic to the LTM. To expect the LTM to deal with the traffic, I need to route to the VIP through the self-ip hence the screenshot I sent.

However, with this form of static routing, I can only advertise /32 not a /24 ( if i have 15 VIP, I need to do it 15 times) so I was wondering if there was another option to achieve the same result.

Please let me know if it does make more sense now. I'm conscious my first message was surely not clear enough.

Thank you.