F5 BIG-IP Next: Architecture and Migration
Three-tier web architecture
Web > App > DB.
VIP > Frontend (UI/UX) > Backend (application + database).
- >Application logic.
- >Database — MySQL, MariaDB (data).
Challenge: no changes on the fly, bringing the entire frontend down, business impact, 502 maintenance.
Modern architecture
- >Microservices
- >Containerization
BIG-IP Next
- >Classic BIG-IP (traditional) + BIG-IP Next (newer).
- >k3s → lighter Kubernetes (R-series and VE).
- >k8s → heavier Kubernetes (Velos → chassis-based).
- >F5OS.
- >ATSE (Application Traffic Service Engine).
- >5000 series has dedicated data and management planes.
BIG-IP Next:
- >Changed from monolithic architecture to microservices architecture.
- >API-based communication between modules.
- >Decoupled control and data plane.
Automation
- >Declarative — telling BIG-IP the things I want you to do, step by step.
- >Imperative — telling it just the base, and Ansible and Terraform automate the rest.
Central Manager
- >BIG-IP Next Central Manager is the BIG-IQ modern replacement.
- >Onboarding, migration.
- >DCD (Data Collection Devices)? No longer used.
- >Logs: 3M log cap; sending logs in real time is available, other options in the future.
- >HA: a minimum of 3 nodes is required for HA.
- >Central management is free.
- >For hardware SSL acceleration, new models have a dedicated accelerator card; VE lacks this (Intel QAT and SmartNIC have it, so if we buy this we can use it).
- >Hardware and VE version parity.
- >In CM we cannot have unlimited tenants — it depends on resources allocated and modules added.
- >Fast F5 application.
- >iApp works on the defined template, to avoid unnecessary changes for central management.
- >iRule versioning.
Migrations
- >Download UCS.
- >Upload UCS to the migration tool.
- >Deploy the migrated application to BIG-IP Next.
- >Per-application migration.
- >Right now only LTM and ASM are supported by BIG-IP Next.
BIG-IP Next UI
This is real-time latency, but it cannot display interval-based latency as of now, as it is in beta.
Low-touch policy management is used for reducing time from learning to blocking. It is not customizable — ratings 1, 2, 3 (alarm log) and 4, 5 (block log). Around 7k attack signatures form the base of negative security, with no granular control. Yes, it impacts resources. Used where clients do not have a lot of time to move from learning to blocking.
- >False positive suppression engine.
- >Signature tuning.
Journeys tool can help with migration from BigIP to BIG-IP Next, BigIP to BigIP VE, and vice-versa — but we cannot migrate BIG-IQ.
Lab
Which Kubernetes flavour runs on the lighter R-series and VE?