F5 for Application Delivery Networking A Blueprint for Successful Application Use Environment

1
F5 for Application Delivery NetworkingA
Blueprint for Successful Application Use
Environment
Presented by Timo Hirvonen F5 Networks
2
It is all about applications and the user
experience in the end
3
(No Transcript)
4
(No Transcript)
5
(No Transcript)
6
(No Transcript)
7
(No Transcript)
8
(No Transcript)
9
Why Application Deployments Fail?
10
Application Delivery Issues are Mounting
Partners
Web Applications
Grid / Utility Computing
Web Services (SOAP/XML)
PDAs
Thin Client
Thick Client
Java
Smart Phones
VoIP
.NET
Remote workers
Suppliers
Organizations are constrained by limited staff,
resources and infrastructure
Application types are increasing exponentially
Number of applications in enterprise portfolios
is growing
Legacy applications need to be extended and
leveraged
Need for Application Delivery Networking Is
Becoming Critical
11
IT Challenge Part I

• Centralization vs. Globalization
• End-User Performance
• Need Business Focus
• Application Delivery vs. Packet Delivery
• Application Fluency
• Flexibility to Adapt to Technology Changes

12
IT Challenge Part II

• Applications and networks behave independently
• Many network functions require high degrees of
  manual intervention
• Distributed architectures and web services
  increase complexity
• Historically, applications and protocols for
  communicating with network devices inflexible at
  best

13
F5s Application Ready Network
Slow responses
Bloated data
Security risks
Many servers
Application Attacks
XML, SOAP, ActiveX, JS
Office workers telecommuters
Network Administrator
Application Developer
14
F5s Application Ready Network
Fast responses
Smaller data
Stops Attacks
Fewer servers
Office workers telecommuters
Network Administrator
Application Developer
15
What do analysts think?
16
From Server Load Balancing to Application
Delivery

• While the market emerged from load-balancing
  solutions to improve the availability and
  reliability of Web sites, we are now a long way
  from the days where load balancing and Secure
  Sockets Layer (SSL) termination for basic HTML
  traffic are viable by themselves.
• Browser-based applications are often a major
  impetus to invest in these technologies, but many
  enterprise applications that look browser-based
  actually employ thick clients that run within the
  browser, and that don't run over HTTP(S) or have
  the ability to bypass standard browser
  capabilities like compression.
• The emergence of Ajax and other rich client
  interfaces further complicates the environment.
  As a result, there is a need for solutions with
  broader payload parsing, and inspection and
  optimization techniques, including
  client-resident software.

17
Application Delivery Controllers

• Application delivery controllers (ADCs) reside in
  the data center, typically in front of frontline
  Web servers.
• They are deployed asymmetrically (only at the
  data center end) and are designed to improve the
  availability, performance and security of Web- or
  Internet Protocol-based applications.
• ADCs enhance the performance of Web-based and
  related applications for end users by providing a
  suite of services at the network and application
  layers. These services can include
• Layer 4 through Layer 7 redirection and load
  balancing and failover.
• Transmission Control Protocol (TCP) connection
  multiplexing.
• Server offload (for example, SSL termination
  and TCP connection management).
• Data compression.
• Network-address translation.
• Network-level security functions, distributed
  denial-of-service protection and server cloaking.
• Selective compression.
• Caching.
• Content transformation and rewrite.
• Application firewall.
• Transaction assurance. Rules and programmatic
  interfaces.
• HTML (and other application protocol)
  optimizations "pre-fetching" or selective
  encoding.
• Virtualization.

18
Advanced Platform Application Delivery
Controllers

• A more advanced class of ADCs (Advanced Platform
  ADCs AP ADCs) operate on a per transaction
  basis and achieve application fluency. These
  devices become actively involved in the delivery
  of the application and provide sophisticated
  capabilities, including
• Application layer proxy, which is often
  bidirectional and stateful.
• Content transformation.
• Selective compression.
• Selective caching of dynamic content.
• HTML or other application protocol
  optimizations.
• Web application firewall.
• XML validation and transformation.
• Rules and programmatic interfaces.

19
Application delivery vendor map 2007
The market for products to improve the delivery
of application software over networks remains
dynamic and innovative. Vendors focused on
solving enterprises' most pressing application
problems have become the top players.
20
A year ago - Dec 2005
(From "Magic Quadrant for Web-Enabled Application
Delivery, 2005," 20 December 2005)
21
F5 Networks according to Gartner

• Strengths
• Offers the most feature-rich AP ADC, combined
  with excellent performance and
• programmability via iRules and a broad product
  line.
• Strong focus on applications, including
  long-term relationships with major application
  vendors, including Microsoft, Oracle and SAP.
• Strong balance sheet and cohesive management
  team with a solid track record for delivering the
  right products at the right time.
• Strong underlying platform allows easy
  extensibility to add features.
• Support of an increasingly loyal and large
  group of active developers tuning their
  applications environments specifically with F5
  infrastructure.
• Cautions
• The Big-IP product is so feature-rich it can be
  intimidating to some customers.
• Lacks a product for the emerging SMB market.

22
The Quiet Networking Revolution
Significant Business Value Around Architecting,
Implementing, and Managing the ADN
Application Networking (L4-L7)
Traditional Networking (L2-L3)
23
F5s Application Ready Network
Fast responses
Smaller data
Stops Attacks
Fewer servers
Office workers telecommuters
Network Administrator
Application Developer
24
From Application Delivery to Application Ready
Network

• F5's Application Ready Network is a holistic
  application network architecture and
  infrastructure designed, optimized, tested,
  verified and documented specifically for
  Enterprise Applications from companies such as
  Microsoft, Oracle and SAP.

F5 Technology Center
25
F5 Application Ready Network solutions- best
practises on application delivery
SharePoint 2007 Exchange 2007 Office
Communications Server
MySAP ERP(w/ Netweaver) SAP Portal
PeopleSoft 10g App Server EBS 12 Siebel 8
26
Application Deployment Guides
27
F5 ARN Examples
28
Basic App Architecture
29
(No Transcript)
30
F5 and Microsoft joint tested recommended
solutions on

• IIS Internet Information Services
• LCS Live Communications Server
• Exchange Server
• SharePoint Server
• HMC Hosted Messaging and Collaboration
• WTS Windows Terminal Server
• Microsoft Dynamics
• BizTalk Server
• MOM Microsoft Operations
• Manager
• Application Center
• ISA Internet Security
• Acceleration Server
• NLB Network Load Balancer ?MS recommends to use
  F5 instead
• NAP Network Access Protection
• ...more to come

31
F5 and Microsoft

• Application Architect Benefits
• Up to 5x performance increase
• 33 faster deployment cycles
• Up to 25 savings on security costs
• Common, repeatable design saving 50 in
  operational costs

• Network Architect Benefits
• Up to 70 reduction in access control costs
• 99.999 availability
• Automated failover for WAN/LAN saving 20 in
  operational costs
• Up to 70 reduction in bandwidth

32
Exchange 2007
Exchange 2007 volume adoption will begin in
earnest in 2008 with the installed base reaching
40 in 2010 (0.7 probability). A breakdown, by
version, of the current installed base (which
comprises approximately 150 million commercial
users) is estimated to be version 5.5 20,
version 2000 40 and version 2003 40).
Architecture. Organizations must re-examine
topologies for further centralization, as well as
for the new server roles. Exchange 2007 will have
five official server roles (client access, edge
transport, unified messaging, hub transport, and
mailbox) and one unofficial role (administrative
console). Integration with WSS, PBXs, and OCS as
well as disaster recovery options will also
require the attention of architects. -Gartner,
Exchange 2007, October 2006
33
(No Transcript)
34
Exchange 2007 Solutions

• User Experience and Application Performance
• Eliminating SPAM with MSM, thus preventing the
  clogging of bandwidth and freeing up capacity on
  the Edge Transport Servers
• Offloading SSL, Compression and Caching from the
  Exchange Servers
• For example, with OWA, clients must download 160
  objects from the Client Access Servers (CAS) when
  they first log on
• With F5, only six of those first request are
  delivered by the CAS, allowing those servers to
  spend more processing power on mail delivery
• Pre-defined Acceleration policy with config sets
  specifically for Exchange or OWA
• Isolating client connections from the server
  connections, thus ensuring communication speed is
  not limited by the client
• Effective attachment handling over the WAN
• Business Continuity and Disaster Recovery
• F5 provides reliable, real-time availability of
  globally dispersed Edge Transport servers. If one
  DC goes down, F5 reroutes to the next best DC.
  When back up
• Cluster Continuous Replication (CCR), new in
  Exchange 2007, provides geo-distributed
  high-availability for mailbox servers F5 can
  ensure rapid replication to reduce or eliminate
  potential data loss in the event of a failure,
  improve end-user experience during the failover
  period, and greatly decrease time-to-recovery,
  all the while reducing bits-in-the-wire
• Secure Remote Access F5 allows you to create a
  custom application tunnel for accessing OWA or
  Outlook
• Multiple ISPs

35
Exchange 2007 Solutions

• Application Security
• MSM
• CCR is in the clear F5 encrypts
• End-point Security with remote users accessing
  Outlook or OWA
• Cache Clean Up
• Unified Security Enforcement and Access Control
• Pre-logon checks and Protected Configurations
  provide the ability to grant users full acces to
  Exchange using Office Outlook (after satisfying
  all security policy requirements)
• while users who meet only some of the criteria
  are restricted to OWA
• F5 can also partition the network into various
  segments to protect and monitor access from one
  segment to another (e.g., using IP addresses,
  VLANs, MAC addresses, etc)
• F5 provides simplified policy and group
  management, and provides central reporting and
  auditing, qhich reduces the overall cost of
  management.

36
SharePoint 2007 Market Size and Need
80 million licenses sold with over 10,000
customers. Examples of enterprise-wide
deployments like Accenture, Honeywell, and
DelMonte are now commonplace. - Kurt DelBene,
Corporate Vice President, Office Business
Systems Platform, October 2006
Architecture. We anticipate a redefinition of
the way communication, collaboration
infrastructure, and business applications are
designed and deployed. - Gartner, Key Issues
for Enterprise Contact Centers, 2007
37
(No Transcript)
38
SharePoint 2007 Solutions

• User Experience and Application Performance
• Offloading SSL, Compression and Caching from the
  SharePoint Servers increasing server capacity by
  more than 25.
• Pre-defined Acceleration policy with
  configuration sets specifically for SharePoint
• Isolating client connections from the server
  connections, thus ensuring communication speed is
  not limited by the client.
• Business Continuity and Disaster Recovery
• F5 provides reliable, real-time availability of
  globally dispersed SharePoint servers. If one DC
  goes down, F5 reroutes to the next best DC. When
  back up
• Secure Remote Access F5 allows you to create a
  custom application tunnel for accessing
  SharePoint.
• Multiple ISPs

39
SharePoint 2007 Solutions

• Application Security
• Positive security model, permitting only valid
  and authorized application transactions, while
  automatically protecting critical web
  applications from HTTP and HTTPS-based threats
  such as Google hacking, cross-site scripting, and
  parameter tampering.
• TMOS and iRules enable full bidirectional session
  and payload inspection.
• End-point Security with remote users accessing
  SharePoint servers Secure Virtual Workspace,
  pre-login endpoint security checks, and endpoint
  trust management.
• Centralize application security, eliminating need
  for multiple, redundant application security
  devices.
• Unified Security Enforcement and Access Control
• Access control and enforcement is especially
  critical for SharePoint, as it is a collaboration
  tool and repository for shared documents.
• Enable administrators to grant certain users,
  i.e. business partners using equipment not
  maintained by the company, access to SharePoint
  and other extranet applications and sites.
• F5 can partition the network into various
  segments to protect and monitor access from one
  segment to another (e.g., using IP addresses,
  VLANs, MAC addresses, etc)
• F5 provides simplified policy and group
  management, and provides central reporting and
  auditing, which reduces the overall cost of
  management.

40
Live Communications Server Office
Communications Server 2007

• Microsofts platform for Unified Communication
• Presence Know who is available and how to
  contact them.
• Instant Messaging (supports MSN, AOL, Yahoo!, and
  extensible with SIMPLE)
• Real Time Collaboration
• Voice (VoIP, SIP)
• Exchange Attach campaign
• MS rep incentives, promotional pricing,
  marketing/advertising.
• Goal for FY07 Attach LCS to 30 of all Exchange
  licenses sold.
• F5 benefits to LCS deployment
• Scalability
• High availability
• Connection optimization (TCP Express)
• MS acknowledges NLB not sufficient for high
  availability need HW load balancer.
• LCS product group relationship
• Microsoft selected F5 as sole vendor to present
  at Early Adopter Airlift.
• LCS development lab currently has over 500K of
  F5 equipment.
• SIP monitor F5s current health monitoring
  capability is far beyond any other load balancer
  on the market.

41
Live Communications Server Office
Communications Server 2007
42
Microsoft F5

• GISV Managed Partner
• MTC Alliance Partner
• VSIP Premier Partner
• MPSC Sponsor Partner
• Microsoft Interop Vendor Alliance
• http//interopvendoralliance.org/demos/Lab1/demo.s
  wf
• Secure IT Alliance

43
ControlPoint Project Overview
Unequivocally Establish F5s Leadership by
Providing Visibility into the Application
Delivery Network

• Stand-alone F5 appliance
• Built on Microsoft Operations Manager 2007
• Visibility into app delivery network
• Provide F5 device insights
• Available end of CY 2007
• Customer Advisory Board

44
F5 Application Ready Network

• F5 has shipped 50000 BIG-IP appliances to 10000
  end customers
• 1/3 to, telco, isp, hosting
• 2/3 to corporate, government, ..
• 50 of previous to MS based application
  environments

45
Digging Deeper into F5 for Oracle
46
Oracle Maximum Availability Architecture (MAA)
47
Application Server 9iAS,10g

• No Single Point of failure
• All Applications and Web Caches are now
  Virtualized on a single point
• SSL terminated on the BIG-IP
• 20,000 new SID per second
• 6 Gb of Bulk encryption
• 500K user connections available
• FIPS 140/2 fully supported
• All Application process are monitored for
  failures

48
E-business Suite 11i

• No Single Point of failure
• All Applications are now Virtualized on a single
  point
• All Identity Management Servers are now
  Virtualized on a single point
• Single IP address and single point of management
• All Application process are monitored for
  failures
• All Identity Management services are monitored
  for failures

49
F5 BIG-IP w/ Oracle Identity Management
Oracle Identity Management Suite
Third Party
High Availability
Authentication
LDAP RADIUS Win NT/2K
OID OVD
OCSP
Web Portals Web Hosts Web-mail

• SSL
• PKI
• Auth.
• Pack Inspection
• Rate
• Shaping
• Proxy

External Users
SSL Encryption
Portal Access
Security Performance High Availability
Policy Engine (iRules)
Apps. Access
Custom Legacy Applications
Network Access
Corporate Network
Administrative Console
Internal Users
F5s BIG-IP (Application Traffic Management
Access Control)

• Secures Network, Application and Portal Access
• Advanced Authentication Integration with OIM
  SSO
• Increased Compliance and Audit Controls

50
Oracle Enterprise Mngr. BIG-IP plug-in Solution

• Monitors and logs all statistics and
  configurations
• Resource planning and root cause analysis

51
Joint SOA Reference Architecture

• Reference Architecture, Blueprint, Component Maps

52
F5 for Oracle SOA Strategy

• Optimization of inter-service communication
• Load balancing and HA services (scaling)
• Content based routing
• SSL offload
• Security
• Intelligent caching
• Acceleration of data services
• Service virtualization
• Integration with the wider Oracle SOA ecosystem

53
F5s Solution Coverage for Oracle

• Oracle Application Solutions
• Siebel (CRM, Analytics, )
• Peoplesoft (HRMS, ERP )
• 11i e-Business Suite (EBS- Financials, CRM, ERP
  )
• JD Edwards EnterpriseOne (Supply Chain,)-Coming
  Soon!
• Oracle Infrastructure Technology Solutions
• Identity Management (OID, OAM, RAS, SSO)
• Oracle Fusion Middleware (OFM)
• 9i 10g Application Servers
• Oracle Portal
• Oracle Collaboration Server (OCS)
• Oracle Communications and Mobility Server (OCMS)
• Oracle Enterprise Manager HA Plug-in (OEM)
• Oracle DB- health monitors, Grid Control, GTM

54
ARN for Oracle Coverage (OOW 2007)

• ARN Technically Full Product Line Solution and
  Best Practice Support from F5 for Oracle
• F5 BIG-IP LTM, GTM, LC, WA, FP and potentially
  ASM, WANJet for
• 10g Application Server / OFM / IdM
• Oracle Portal
• Peoplesoft 9
• E-business Suite 12

55
Direct Benefits

• High Availiability-Redundant Web, Middle Tier and
  Applications
• Reduce the Oracle Portal login times for WAN
  users
• Increase document download times by a factor up
  to 5x
• Reduce Server utilization
• Reduce the number of server-side connections by a
  factor of 20x.

56
Real Collaboration/Real Solutions

• Certified Oracle Partner
• Publishing joint white paper on Oracle MAA, OTN,
  on optimizing the network for Oracle Applications
  and Technology.
• Oracle Enterprise Technology Centers (ETCs)
• Formal Validations and Certifications of F5
  technologies

57
F5 Oracle Joint Customers
58
F5 and Oracle

• BIG-IP ensures maximum availability, enhanced
  performance and security for mission-critical
  Oracle applications.
• In fact, at Oracle we use approximately 90
  BIG-IPs in front of over 5,300 different
  application cluster environments in 4 datacenters
  worldwide.
• Leonid Stavnitser
• Senior Manager Global IT
• Oracle USA, Inc

59
F5 SAP

• SAP is a customer
• FirePass
• BIG-IP LTM
• F5 is a Charter Member of SAPs Network Advisory
  Group
• F5 is a Member of SAPs Virtualization Advisory
  Group
• F5 has Collaborated with SAP to Produce NEW
  Granular Prescriptive Deployment Guidance
  (publicly published in April 07) for
• BIG-IP LTM
• Web Accelerator
• WANjet
• FirePass
• BIG-IP GTM

60
SAP Global Configuration Example
61
Features, Benefits, Results Snapshot

• Common F5 features that add value to SAP
  environments
• Cookie Encryption
• Error trapping
• Load balancing
• High Availability
• LTM Provides TCP Multiplexing, TCP
  optimizations, SSL Offload, another outlet for
  compression and potential Caching
• Benefits
• Significant savings of application server
  processing cycles
• Web Accelerator provides encryption
• WANJet provides significant TCP Optimizations
• WANJet can provide significant Compression gains
  when the data is not encrypted
• Results
• F5 provided better than 30 reduction in CPU
  utilization via the combination of TCP handling,
  compression offload, WA optimizations and SSL
  offload
• Web Accelerator provided improvement for first
  time user requests
• Performance increase of 2X was demonstrated for
  users accessing the applications over low
  bandwidth and high latency links
• Document downloads were much faster with F5
  products integrated into the application
  deployment

62
F5 any IP based applications

• WebLogic, Siebel, WebSphere, you name it....
• Any IP based application will benefit

63
eMatrix access user experienced times -F5
WebAccelerator repeat visit results
From 3 minutes ?21 seconds
64
eMatrix access - transferred bytesF5
WebAccelerator repeat visit results
From 1,3 MB ?140 KB
Non-accelerated total extends out of graph area
65
What are key ARN components?
66
The F5 Application Ready Network Components
International Data Center
Users
Applications
One Platform TMOS
67
Unique TMOS Architecture

• TMOS traffic plugins
• High-performance networking microkernel
• Powerful application protocol support
• iControl External monitoring and control
• iRules Network programming language

68
F5 BIG-IP Platform Sizing
BIG-IP 1500 BIG-IP 3400 BIG-IP 6400 BIG-IP 6800 BIG-IP 8400 BIG-IP 8800
HW Layer 4 Connections/sec NA 110,000 220,000 220,000 270,000 270,000
Layer 7 Connections/sec 22,000 55,000 70,000 100,000 156,000 312,000
Request/sec 43,000 104,000 137,000 186,000 340,000 700,000
Max. throughput 500 Mbps 1 Gbps 2 Gbps 4 Gbps 10 Gbps 10 Gbps 8 Gbps L7
Max. conc. conn. 4 Million 4 Million 8 Million 8 Million 8 Million 8 Million
Max. SSL TPS 2,000 5,000 15,000 20,000 37,000 48,000
Max. SSL Bulk 500 Mbps 1 Gbps 2 Gbps 2 Gbps 3 Gbps 6 Gbps
Max. SSL conc. conn. 100,000 200,000 500,000 500,000 500,000 500,000
Max. compression 100 Mbps 500 Mbps 2 Gbps 2 Gbps 3 Gbps 6 Gbps
Switch backplane 14 Gbps 22 Gbps 44 Gbps 48 Gbps 80 Gbps 80 Gbps
69
DevCentral.F5.com

• Community
• Tools
• Tips
• Collaboration
• iControl -Open Source WS API
• iRules Script Policies

70
STOP Database Tuning!
71
STOP Application Tuning!
72
Tune Road or Application Network!
73
(No Transcript)
74
Company Snapshot

• Leading provider of technology to secure,
  optimise and deliver IP-based applications
• Founded 1996, public 1999, Nasdaq listed (FFIV)
• HQ in Seattle, offices around the globe
• More than 15,000 customers
• Approx. 1,400 employees
• FY2006 revenue 394M
• 40 year-over-year growth
• More than 50,000 systems shipped
• Acquisitions
• uRoam, July 2003
• MagniFire, June 2004
• Swan Labs, September 2005
• Acopia, September 2007 (Announced)

75
Financial Results
International Revenue
Service Revenue
25
45
55
75
Product Revenue
US Revenue
76
Global Operations
Seattle
EMEA
Japan
Americas
APAC
International HQ Regional HQ / Support
Centre Product Development F5 Regional Office
77
F5 in Europe

• 230 employees in EMEA
• Sequential growth
• Increasing country presence
• Strong regional channel
• Large customer base
• Financial
• Media
• Transportation
• Technology
• Telecommunications
• Service providers

78
Centralized Transaction Assurance Proactive
Response Error Handling for Higher Availability
With iRules everything is possible
Centralized Data Protection Rewrite, Remove,
Block and or Log Sensitive Content
A Repeatable, Extensible, Flexible
Architecture See more devcentral.f5.com
Host to URI mapping Faster Access to Data
through Automatic Re-direction
79
iRule example

• Request to http//mysite.domain.com is redirected
  to https//mysite.domain.com/some_java_appwhen
  HTTP_REQUEST if HTTPuri equals "/"
  HTTPredirect "https//HTTPhost/some_java_
  app"

80
iRule example

• Direct requests about products to dedicated pool
• when HTTP_REQUEST
• if httpuri equals "/products/ use
  pool DMZ-products
• else
• use pool DMZ-general

81
iRule example

• Redirect status 404 to a static html error page
  hosted on another webserver that has information
  to give the customer as to why theyre seeing
  this error, and perhaps when to expect things
  back up.
• when HTTP_RESPONSE
• if HTTPstatus eq "404"
  redirect to "http//10.10.10.1/en_US/error.html

82
iRule example

• Changing payload data
• when HTTP_RESPONSE_DATA
• Here you define what you want to find in
  the payload
• set find Old_Data"
• And here's what you'll be replacing it with
• set replace "New_Data
• set payload HTTPpayload
• Run the regsub to make all the
  replacements (add -nocase for case insensitivity)
• if regsub -all find payload replace
  new_response gt 0
• HTTPpayload replace 0 HTTPpayload
  length new_response

83
BIG-IP Software Add-On ModulesQuickly Adapt to
Changing Application Business Challenges
84
BIG-IP Security Add-On Modules
85
BIG-IP WebAccelerator Module NEW
86
BIG-IP Message Security Module
NEW
87
Administrative Domains
High cost of operation
Application Architecture
Network Guy
Operations
Security
View specific application
Grant limited views
Control only defined applications
Grant limited control
Test only defined applications
Grant limited monitoring
88
Virtualisation

• Partitioning for specific apps or business units
• Virtual resources
• Objects, caching, compression, SSL, etc.
• Self-serve model increases responsiveness
• Administrative domains
• Change control and audits