Configuring F5 BIG‑IP for Parallels RAS Secure Gateways

0 users found this article helpful

This article describes how to publish Parallels RAS Secure Gateways (GW) behind F5 BIG‑IP by creating a Virtual Server (VS) with pools that contain your RAS GW as members. Reference documents are provided in 10. Appendix — References

1. Overview

 There are two tested topologies described:

2. Supported components & ports (quick reference)

3. Prerequisites

4. Architecture diagram

Option A — SSL Passthrough (TCP + UDP)

Option B — SSL Bridging (TCP)

5. Option A — SSL Passthrough (TCP + UDP)

5.1 Design decisions

5.2 Step‑by‑step

On BIG-IP instance

  1. Create new Pool

    1.  go to Local Traffic > Pools > Pool list > press Create..

    2. Specify Pool settings as follows:
      Name: frendly name of the pool
      Description: optional description of the pool
      Health monitors: find tcp in Available table and click arrow to move to the left in Active table
      Load Balancing Method: Round Robin
      New members: add by specifying their Name, Address and Service Port and clicking Add button
       
       
    3. Press Finished and check that the Pool is created and has a green Status
       

  2. Create new Virtual Server

    1. go to Local Traffic > Virtual Servers > Virtual Server list > press Create...
       

    2. Specify Virtual Server properties as follows:
      Name: frendly name of the Virtual Server
      Description: optional description of the Virtual Server
      Type: Standard
      Source Address: Host > 0.0.0.0/0
      Destination Address/Mask: Host > BIG-IP address
      Service Port: Port > 443
      Protocol: All protocols
      Source Address Translation: Auto Map
       

    3. On the Resources tab
      Default pool: the pool that was created
      Default Persistent profile: source_addr (Source address session persistence)
       

       

    4. Press Finished and check that the Virtual server is created and has a green Status
       

5.3 Validation

SNAT note: BIG‑IP chooses a translation address from self IPs when Auto Map is used - RAS GWs won't be able to detect Source/Client Public IP.

6. Option B — SSL Bridging (TCP)

6.1 Design decisions

6.2 Step‑by‑step

  1. This configuration will be based on the previous with adding SSL Bridging to it

  2. Import Certificate and key to BIG-IP (import one by one)

    1. go to BIG-IP System > Certificate management > Traffic Certificate Management > SSL Certificate List > press Import...

    2. Import type: Certificate for your Certificate file and Key for your key file 
      Name: friendly name
      Source: upload or paste in text format

    3. Press Import and verify that your Certificate and corresponding Key are available

      Certificate tab
       

      Key tab
       

  3. Create SSL Profiles

    1. go to Local Traffic > Profiles > SSL > Client > press Create...
       
    2. Configure SSL Client profile as follows
      Name: friendly name
      Parent Profile: clientssl
      Configuration: Basic, check the Custom checkbox
      Certificate Key Chain: specify the certificate and key that were just imported
       

      Press Finished once done
       
    3. go to Local Traffic > Profiles > SSL > Server > press Create... and configure SSL Client profile as follows
      Name: friendly name
      Parent Profile: serverssl
      Configuration: Basic, check the Custom checkbox
      Certificate: choose the certificate that was just imported
      Key: choose the key that was just imported
       

      Press Finished once done

  4. Reconfigure Virtual Server

    1. go to the properties of the Virtual server that was created and configure as follows
      Protocol: TCP
      SSL Profile (Client): find SSL client profile that was created in Available table and click arrow to move to the left in Active table
      SSL Profile (Server): select SSL server profile that was created
       


      Press Update once done

6.3 Validation

 

7. Additional Virtual server for User Portal

7.1 Design decisions

7.2 Step‑by‑step

  1. Option B will be used as a baseline. With this setup, the service port for it have to be changed to some custom port, for example 444. Refer to section 5.2 and change Service port to 444
  2. The persistence profile is required, create it as follows:
    1. go to BIG-IP Local Traffic > Profiles > Persistence > press Create...
       
    2. Create a new Virtual server for HTTPS traffic, refer to Refer to section 5.2. 
      Name: friendly name
      Persistence type: cookie
      Cookie method: HTTP Cookie Rewrite
      Cookie name: ASP.NET_SessionId (could be custom, but should be then specified on RAS GW properties > Web)
      Always send cookie: checked
       
    3. press Finished and check that the Persistence profile is created
       
  3. Create a new Virtual server for HTTPS traffic, refer to Refer to section 5.2. 
    1. Create a new Virtual server
      Service port: 443
      Protocol: TCP
      HTTP profile client: http
      SSL Profile (Client): select SSL client profile that was created
      SSL Profile (Server): select SSL server profile that was created
       
    2. On Resources tab:
      Default pool: the Pool that was created
      Default persistence profile: the Persistence profile that was created
      Fallback persistence profile: the Persistence profile that was created
       
  4. On the RAS Console, configure Network Load Balancer Access > Use alternate port to 444  so resource redirection from User portal to Parallels Client will work via separate Virtual server
     

7.3 Validation

8. Validation checklist

9. Troubleshooting

10. Security considerations

11. Appendix — References

Was this article helpful?

Tell us how we can improve it.