F5 BIG-IP Virtual Edition LTM in Microsoft Azure marketplace deployment

This blog is a how-to guide for the quick deployment of the F5 Networks BIG-IP Virtual Edition (VE) Local Traffic Manager (LTM) in Azure infrastructure as a service (IaaS). This deployment will provision a virtual machine scale set with 3 instances spread across 3 availability zones for High Availability as part of an organizations BCDR plan.

Permissions:

The recommended permissions for this deployment is the contributor role.

Deployment Plan:

Deployment Steps:

Step 1 - New Resource Group

Provision your resource group container for your F5 BIG-IP related resources.

$ResourceGroupName= "allen-F5-BIG-IP-test"
$location = "uaenorth"
New-AzResourceGroup `
-Name $ResourceGroupName `
-Location $location `
-Tag @{CustomerName="Customer01";  AutoShutdownSchedule="None";  Environment="sandbox";}

Step 2 -   Enablement of the Marketplace product

Verification:

The following output will show accepted = true

Step 3 - Provision a Log Analytics Workspace

Create or identify an existing log analytics workspace that will be used for your F5 BIG-IP resources scale set diagnostics,

#variables
$ResourceGroupName= "allen-F5-BIG-IP-test"
$WorkspaceName = "f5bigiplog01"
$Location = "uaenorth"
#script
New-AzOperationalInsightsWorkspace `
-Location $Location `
-Name $WorkspaceName `
-Sku pergb2018 `
-ResourceGroupName $ResourceGroupName

Step 4 - Provision a storage account

Create or identify an existing storage account that will be provisioned for storage of the F5 BIG-IP instance boot diagnostics.

$ResourceGroupName = "allen-F5-BIG-IP-test"
$location = 'uaenorth'
$sku = 'standard_LRS'
$kind = 'StorageV2'
$staccname= 'f5bigipstoracc01' 

New-AzStorageAccount -ResourceGroupName $ResourceGroupName `
  -Name $staccname `
  -Location $location `
  -SkuName $sku `
  -Kind $kind ` 

Step 5  - Provision Big IP from Marketplace

In your Azure Portal > Marketplace > select the F5 BIG-IP Virtual Edition > select your Plan throughput limit size > click on Create

Step 6  - Post deployment steps

6.1 Network configuration

By default, private and public IPs issued to Azure virtual machines are dynamic, so these can change when a VM restarts.

To avoid connectivity issues, change the BIG-IP management IP to static.

Select the virtual machine >  Networking > select the network interface > IP configurations > select the nic > change the allocation to static > Save

Step 7 - Network Security Group

You need to update the NSG attached to the virtual machine scale set instances by using the powershell script below,

#you only need update these 2 variables and then run the script
$nsgname = "basicNsgopswat-vnet-nic01"
$ResourceGroupName = "f5opswat_group"

#deployment:
$AzNSG = Get-AzNetworkSecurityGroup `
-Name $nsgname `
-ResourceGroupName $ResourceGroupName `

$Variables1 = @{
'Name' = 'F5-Management-Port'
'NetworkSecurityGroup' = $AzNSG
'Protocol' = '*'
'Direction' = 'Inbound'
'Priority' = 200
'SourceAddressPrefix' = '*'
'SourcePortRange' = '*'
'DestinationAddressPrefix' = '*'
'DestinationPortRange' = 8443
'Access' = 'Allow'
}
Add-AzNetworkSecurityRuleConfig @Variables1 | Set-AzNetworkSecurityGroup 
#complete

Verification

Step 8  - Verification

Having enabled the port 8443 using the powershell above, you can now access the BIG-IP VE LTM using your browser

I hope this helped you to quickly and easily deploy your F5 Networks BIG-IP LTM load balancers in Azure.

My next article will look at the configuration of ICAP and how to integrate with vendors like OPSWAT ICAP server.

–End–