How to Configure F5 BIG IP Load Balancer?

Configuring an F5 BIG-IP load balancer involves creating nodes, health monitors, pools, and virtual servers, then applying SSL profiles, SNAT, and persistence to suit your application’s needs. By clustering BIG-IP systems and leveraging iApps or AS3, you can automate deployments and ensure continuous service availability.

1. BIG-IP LTM Concepts at a Glance

Before diving into the UI, it helps to understand the core LTM building blocks:

• Node: Represents a backend resource by IP (or FQDN) where your application runs. Nodes can be created explicitly or auto-generated when adding pool members.
• Health Monitor: Periodically probes nodes to verify application availability. Monitors can use ICMP, TCP, HTTP, HTTPS, or custom send/receive strings. If a node fails a monitor probe, LTM automatically stops sending it traffic.
• Pool: A logical grouping of nodes (or IP:port pairs). Traffic to a pool’s virtual server is distributed among healthy pool members according to your chosen load-balancing algorithm (round-robin, least connections, etc.).
• Virtual Server (VIP): The client-facing IP:port where BIG-IP listens. It’s the entry point for application traffic, directing requests to the associated pool (or forwarding them in “performance” (L4) mode).

2. Prerequisites & Environment Preparation

To follow along, you’ll need:

• A BIG-IP system (hardware appliance, virtual edition, or cloud image) running TMOS 13.x or later.
• Administrative access to the Configuration Utility (the web UI).
• IP addresses for your backend web/application servers.
• Optional: SSL certificates if you plan to terminate or offload TLS on BIG-IP.

3. Step-by-Step Configuration in the BIG-IP UI

3.1. Create Backend Nodes

1. Navigate: Local Traffic → Nodes → Node List.
2. Click Create.
3. Enter:
   • Name: A friendly label (e.g., web-node-1).
   • Address/FQDN: The server’s IP or hostname.
4. Save (click Finished).

Repeat for each application server.

3.2. Define Health Monitors

1. Navigate: Local Traffic → Monitors.
2. Click Create.
3. Configure:
   • Name: e.g., http-200-monitor.
   • Type: Select HTTP or HTTPS.
   • Send String:

GET /health HTTP/1.1\r\nHost: your-vip.example.com\r\nConnection: Close\r\n\r\n

• Receive String: HTTP/1.1 200
• Save.

When configured, this monitor will mark any node that fails to return a 200 OK as down, ensuring traffic is never sent to unhealthy servers.

3.3. Assemble Your Load-Balancing Pool

1. Navigate: Local Traffic → Pools → Pool List.
2. Click Create.
3. Specify:
   • Name: e.g., web-app-pool.
   • Health Monitor: Select the monitor you created (http-200-monitor).
4. Add Members:
   • In New Members, click Node List.
   • Select your nodes (web-node-1, web-node-2, etc.).
   • Specify each node’s service port (e.g., 80 for HTTP or 443 for HTTPS).
   • Click Add.
5. Save (click Finished).

Your pool now automatically balances traffic among all nodes in the group, skipping any that fail health checks.

3.4. Create the Virtual Server (VIP)

1. Navigate: Local Traffic → Virtual Servers → Virtual Server List.
2. Click Create.
3. General Properties:
   • Name: web-vip.
   • Type: Choose Standard for L7 (HTTP/HTTPS) or Performance (Layer 4) for raw TCP/UDP forwarding.
   • Source Address: 0.0.0.0/0 (accept from any client).
   • Destination Address/Mask: The VIP IP (e.g., 203.0.113.10).
   • Service Port: 80 (HTTP) or 443 (HTTPS).
4. Configuration:
   • Default Pool: Select web-app-pool.
   • Source Address Translation: Choose Auto Map to avoid backend routing issues.
5. Save (click Finished).

Clients now connect to 203.0.113.10:80, and BIG-IP distributes those requests to pool members.

4. Enabling SSL Offload & Profiles

To terminate TLS on BIG-IP and relieve backend servers of crypto work:

1. Import your certificate and key: Local Traffic → SSL Certificates → Import.
2. Create a Client SSL Profile: Local Traffic → Profiles → SSL → Client → Create.
   • Bind your certificate/key.
3. (Optional) Create a Server SSL Profile if you want BIG-IP to initiate SSL/TLS to your backends (for end-to-end encryption).
4. Apply these profiles on your VIP: Edit web-vip → SSL Profile (Client) → select your Client SSL profile; SSL Profile (Server) → select your Server SSL profile.

BIG-IP will now decrypt incoming traffic, apply L7 policies, and optionally re-encrypt to the pool members.

5. SNAT, Persistence, & Advanced Settings

5.1. Source NAT (SNAT)

When backend servers do not have a route back to clients (common in private subnets), enable SNAT:

• On your VIP configuration page, set Source Address Translation → Auto Map, or choose a specific SNAT pool.

BIG-IP replaces the client IP with its own when forwarding requests, ensuring return traffic flows through the BIG-IP.

5.2. Persistence (Session Stickiness)

For applications requiring clients to hit the same server (e.g., shopping carts), configure persistence:

1. Navigate: Local Traffic → Profiles → Persistence → Create.
2. Choose type (cookie, source address, etc.) and set parameters (cookie name, timeout).
3. Apply on the VIP: Edit web-vip → Persistence Profile (Default) → select your persistence profile.

BIG-IP uses this profile to bind client sessions to specific pool members for the duration of the persistence record.

6. High-Availability & Clustering

For production environments, you’ll want two (or more) BIG-IP systems in an Active-Standby or Active-Active cluster. Key steps:

1. Synchronize Configuration: Navigate to Device Management → Device Groups and add both units to a group; enable config sync.
2. Floating IPs: Assign a floating self-IP (shared between units) for management and heartbeat.
3. Failover Settings: Under Device → High Availability → General, enable HA monitor, define network and mirroring ports.

When the active unit fails, the standby takes over seamlessly—VIPs, pool states, and statistics replicate automatically.

7. Automating with iApps & APIs

For large-scale or dynamic environments, consider:

• iApp Templates: Prebuilt application-centric workflows (e.g., for Microsoft Exchange, Oracle) that automate pool, profile, and VIP creation.
• AS3 (Application Services 3 Extension): Declarative JSON-based API for ingesting full service definitions into BIG-IP, ideal for DevOps pipelines.
• iControl REST: Script configuration, monitoring, and orchestration via RESTful calls—integrating BIG-IP into CI/CD and automation frameworks.

These tools let you codify your load-balancing architectures for repeatable, version-controlled deployments.

8. Validation & Troubleshooting

After configuration:

• Verify pool member status: Local Traffic → Pools → click your pool; healthy members appear green.
• Test VIP reachability: curl -I http://203.0.113.10/health and confirm a 200 OK.
• Monitor traffic stats: Statistics → Module Statistics → Local Traffic → Virtual Servers.
• Capture packets on BIG-IP with tcpdump on the management CLI:

tcpdump -nni 0.0 tcp and host 203.0.113.10

Please follow and like us: