Introduction
This document describes how to configure an F5 Load Balancer running GTM to load balance connections to Umbrella Virtual Appliances.
Overview
This solutions utilizes priority groups and a health check which monitors DNS connectivity to Virtual Appliances and redirects traffic based on Virtual Appliance availability.
More information about F5 Load Balancers can be found here: https://www.f5.com/glossary/load-balancer.
How To
F5 has the notion of priority groups. When setting up a pool, you can make all the Virtual Appliances have a higher priority than your normal local DNS resolvers.
- Assign a Priority group to every member of your Umbrella pool. The VAs must have the same, higher priority number, your backup local resolvers must have a lower priority.
- Create a health check that does a DNS lookup. This step ensures that the DNS server is working and disables one from the pool if it isn’t working.
For this, we are using the “dnsmonitor” external health check available here: https://devcentral.f5.com/codeshare?sid=390.
-
Download the code from the link and save it as a local file, “dnsmonitor”
-
Import “dnsmonitor” under System > File Management > External Monitor Program File List.
- Create a new health check monitor under Local Traffic > Monitors > New Monitor. Here we are doing a DNS A record lookup for a.rootservers.net, which is hopefully always 198.41.0.4. In the arguments we specify what we are looking up, “a.rootservers.net”; what type of record, “A”; what we expect it to be, “198.41.0.4”; and how long it takes, “2” seconds. Feel free to change the lookup address to something that fits your environment or add more health checks if needed
-
Now we add this health check to our pool. Under Local Traffic > Pools > “umbrella (or whichever pool you created in Step 1) > Properties, change the Health Monitor to our new dns-monitor-a.rootservers.net. You can select multiple health monitors as suggested above. You’ll need to go to the advanced tab to select the availability requirement, too. For now, we’ll just keep it basic with a single health monitor.
- Create a Virtual Server AND Port for the F5 to listen on. This is the BigIP or Virtual IP that your clients query. It uses the “umbrella” pool.
Verification
You can verify you are hitting a Virtual Appliance by doing a TXT query for debug.opendns.com.
OSX\Linux - dig txt debug.opendns.com <VIP IP>
Windows - nslookup -type=txt debug.opendns.com <VIP IP>
This outputs information in regards to your Umbrella account. Look for a field called "appliance id". The number after this is unique to each Virtual Appliance. You can verify it is load balancing by running the TXT lookup and copying down the appliance id then disconnect the first VA in the pool and run the command again you get an ID from one of the other VAs in your pool.
Feedback