On this page
This is part 1 of a series on learning F5 BIG-IP Local Traffic Manager on a real data-centre fabric running on SONiC switches. Each part goes with a video on the LevelUP I.T. YouTube channel. Part 1 is the lab itself, explained from zero and proven live, before a single line of F5 configuration. From part 2 on, I license the BIG-IPs and configure them topic by topic, following an F5 Certified Administrator course.
Most F5 labs put a BIG-IP on a flat network, next to two web servers. That's enough to click through the screens, but it hides the questions that matter in production. Where does client traffic really come from? What happens to the reply? How does the rest of the network learn that a virtual server's address exists? So I built the network around the BIG-IP first.
What the lab is
Twenty nodes in containerlab, on one EVE-NG server:
- Fabric: eight Dell Enterprise SONiC 4.6 switches, two spines and three leaf pairs.
- Firewall: a Palo Alto PA-VM 12.1.2, the only path between the users and the applications.
- Load balancers: two F5 BIG-IP VE 17.5.1, completely blank and unlicensed.
- Behind the BIG-IPs: three web servers, a log server for syslog and SNMP traps, and a sorry server.
- Users: three PCs behind a LAN switch, each with a real Firefox in a web desktop.
The whole lab is generated from one Python file, gen.py: every name, address, VLAN and AS number. Everything except the BIG-IPs is configured by script. The BIG-IPs come up with only their management interface reachable, for the web UI and SSH. Licensing and every F5 object is the job of this series. The whole lab is open source, so you can build it yourself: f5-bigip-sonic-evpn-lab on GitHub.
The fabric: spine and leaf
The two spines are the motorway, and the leaves are the local roads where devices plug in. Every leaf connects to both spines, so traffic between any two leaves takes the same short trip: up to a spine, and down to the other leaf. Losing a spine still leaves a path.
The leaves come in pairs, each with one job:
- Service pair (AS 65001): the firewall and the BIG-IPs.
- Server pair (AS 65002): the web servers.
- Border pair (AS 65003): the users' LAN.
The spines share AS 65000. The underlay is eBGP unnumbered, so there are no IP addresses on the inter-switch links. On spine1 that means six neighbours, all established, in both the IPv4 table and the EVPN table:
