F5 Logo MyF5
Search
  1. MyF5 Home
  2. Knowledge Centers
  3. BIG-IP LTM
  4. BIG-IP TMOS: Implementations
  5. Configuring an EtherIP Tunnel
Manual Chapter : Configuring an EtherIP Tunnel

Applies To:

Show Versions Show Versions

BIG-IP AAM

  • 11.5.10, 11.5.9, 11.5.8, 11.5.7, 11.5.6, 11.5.5, 11.5.4, 11.5.3, 11.5.2, 11.5.1

BIG-IP APM

  • 11.5.10, 11.5.9, 11.5.8, 11.5.7, 11.5.6, 11.5.5, 11.5.4, 11.5.3, 11.5.2, 11.5.1

BIG-IP GTM

  • 11.5.10, 11.5.9, 11.5.8, 11.5.7, 11.5.6, 11.5.5, 11.5.4, 11.5.3, 11.5.2, 11.5.1

BIG-IP Link Controller

  • 11.5.10, 11.5.9, 11.5.8, 11.5.7, 11.5.6, 11.5.5, 11.5.4, 11.5.3, 11.5.2, 11.5.1

BIG-IP Analytics

  • 11.5.10, 11.5.9, 11.5.8, 11.5.7, 11.5.6, 11.5.5, 11.5.4, 11.5.3, 11.5.2, 11.5.1

BIG-IP LTM

  • 11.5.10, 11.5.9, 11.5.8, 11.5.7, 11.5.6, 11.5.5, 11.5.4, 11.5.3, 11.5.2, 11.5.1

BIG-IP AFM

  • 11.5.10, 11.5.9, 11.5.8, 11.5.7, 11.5.6, 11.5.5, 11.5.4, 11.5.3, 11.5.2, 11.5.1

BIG-IP PEM

  • 11.5.10, 11.5.9, 11.5.8, 11.5.7, 11.5.6, 11.5.5, 11.5.4, 11.5.3, 11.5.2, 11.5.1

BIG-IP ASM

  • 11.5.10, 11.5.9, 11.5.8, 11.5.7, 11.5.6, 11.5.5, 11.5.4, 11.5.3, 11.5.2, 11.5.1
Manual Chapter
Table of Contents | << Previous Chapter | Next Chapter >>

Configuring an EtherIP Tunnel

Overview: Preserving BIG-IP connections during live virtual machine migration

In some network configurations, the BIG-IP® system is configured to send application traffic to destination servers that are implemented as VMware® virtual machines (VMs). These VMs can undergo live migration, using VMware vMotion™ and an iSession™ tunnel, across a wide area network (WAN) to a host in another data center.

To preserve any existing connections between the BIG-IP system and a virtual machine while the virtual machine migrates to another data center, you can create an EtherIP tunnel.

An EtherIP tunnel is an object that you create on each of two BIG-IP systems that sit on either side of a WAN. The EtherIP tunnel uses the industry-standard EtherIP protocol to tunnel Ethernet and IEEE 802.3 media access control (MAC) frames across an IP network. The two EtherIP tunnel objects together form a tunnel that logically connects two data centers. When the application traffic that flows between one of the BIG-IP systems and the VM is routed through the EtherIP tunnel, connections are preserved during and after the VM migration.

After you have configured the BIG-IP system to preserve connections to migrating VMs, you can create a Virtual Location monitor for the pool. A Virtual Location monitor ensures that the BIG-IP system sends connections to a local pool member rather than a remote pool one, when some of the pool members have migrated to a remote data center.

Tip: The BIG-IP system that is located on each end of an EtherIP tunnel can be part of a redundant system configuration. Make sure that both units of any redundant system configuration reside on the same side of the tunnel.

Illustration of EtherIP tunneling in a vMotion environment

EtherIP tunneling in a vMotion environment

EtherIP tunneling in a vMotion environment

Task summary

Implement an EtherIP tunneling configuration to prevent the BIG-IP® system from dropping existing connections to migrating virtual machines in a vMotion environment. To set up this configuration, you must verify a few prerequisite tasks, as well as create some configuration objects on the BIG-IP system.

Important: Perform these tasks on the BIG-IP system in both the local data center and the remote data center.

Before you begin configuring EtherIP tunneling, verify that these BIG-IP objects and module exist on the BIG-IP system:

An iSession profile
This profile creates an iSession tunnel to optimize the live migration of virtual machine servers from one data center to another.
A load balancing pool
This pool represents a collection of virtual machines on a host server in the data center.
A standard TCP or UDP virtual server
This virtual server load balances application traffic and optimizes vMotion traffic. This virtual server must reference the iSession profile and the load balancing pool.
The default VLANs
These VLANs are named external and internal.
BIG-IP Global Traffic Manager™
This module directs traffic to the correct BIG-IP® Local Traffic Manager™ virtual server.

Task List

Creating a VLAN

VLANs represent a collection of hosts that can share network resources, regardless of their physical location on the network. You create a VLAN to associate physical interfaces with that VLAN.
  1. On the Main tab, click Network > VLANs .
    The VLAN List screen opens.
  2. Click Create.
    The New VLAN screen opens.
  3. In the Name field, type a unique name for the VLAN.
  4. In the Tag field, type a numeric tag, from 1-4094, for the VLAN, or leave the field blank if you want the BIG-IP system to automatically assign a VLAN tag.
    The VLAN tag identifies the traffic from hosts in the associated VLAN.
  5. For the Interfaces setting, from the Available list, click an interface number or trunk name and add the selected interface or trunk to the Untagged list. Repeat this step as necessary.
  6. If you want the system to verify that the return route to an initial packet is the same VLAN from which the packet originated, select the Source Check check box.
  7. In the MTU field, retain the default number of bytes (1500).
  8. From the Configuration list, select Advanced.
  9. If you want to base redundant-system failover on VLAN-related events, select the Fail-safe box.
  10. From the Auto Last Hop list, select a value.
  11. From the CMP Hash list, select a value.
  12. To enable the DAG Round Robin setting, select the check box.
  13. Click Finished.
    The screen refreshes, and displays the new VLAN from the list.

Creating an EtherIP profile

An EtherIP profile is a required component of an EtherIP tunnel in a vMotion™ environment. An EtherIP profile manages application traffic that traverses an EtherIP tunnel, for the purpose of preserving connections when a virtual machine is migrating to another data center. You must perform this task using the Traffic Management shell (tmsh), a command-line utility.
  1. On the BIG-IP®system, start a console session.
  2. Type a user name and password, and press Enter.
  3. At the command prompt, type tmsh, and press Enter.
    This opens the Traffic Management shell (tmsh).
  4. At the tmsh prompt, type net tunnel, and press Enter.
  5. Type create etherip etherip_profile_name, and press Enter.
    This command creates an EtherIP profile, assigning all of the default values.
  6. Type save / sys config, and press Enter.
  7. To close the Traffic Management shell (tmsh), type quit, and press Enter.
You now have an EtherIP profile that you can specify when you create an EtherIP tunnel object.

Creating an EtherIP tunnel object

Before you perform this task, you must know the self IP address of the instance of the VLAN that exists, or will exist, on the BIG-IP® system in the other data center.
The purpose of an EtherIP tunnel that contains an EtherIP type of profile is to enable the BIG-IP system to preserve any current connections to a server that is migrating to another data center by way of vMotion™. You must perform this task using the Traffic Management shell (tmsh), a command-line utility.
  1. On the BIG-IP system, start a console session.
  2. Type a user name and password, and press Enter.
  3. At the command prompt, type tmsh and press Enter.
    This opens the Traffic Management shell (tmsh).
  4. Type net tunnels, and press Enter.
  5. Type the following command, and then press Enter:
    Note that the self IP addresses that you specify are those that you create for the VLAN on both the local and the remote BIG-IP system.
    create tunnel tunnel_name profile etherip local-address local_self_ip_address remote-address remote_self_ip_address
  6. Type save / sys config, and press Enter.
  7. To close the Traffic Management shell (tmsh), type quit, and press Enter.
The BIG-IP system configuration now includes a tunnel object.

Creating a VLAN group

VLAN groups consolidate Layer 2 traffic from two or more separate VLANs.
  1. On the Main tab, click Network > VLANs > VLAN Groups .
    The VLAN Groups list screen opens.
  2. Click Create.
    The New VLAN Group screen opens.
  3. In the General Properties area, in the VLAN Group field, type a unique name for the VLAN group.
  4. For the VLANs setting, move the VLANs that you want to include in the group from the Available list to the Members list.
  5. From the Transparency Mode list, select a transparency mode, or retain the default setting, Transparent.
    The transparency mode determines the level of exposure of remote MAC addresses within the VLAN group traffic.
    Mode Purpose
    Transparent The MAC addresses of remote systems are exposed in Layer 2 traffic forwarding.
    Translucent Similar to Transparent mode, except the locally-unique bit is set in the MAC addresses of remote systems.
    Opaque The system uses proxy ARP with Layer 3 forwarding, so the MAC addresses of remote systems are not exposed.
  6. Select the Bridge All Traffic check box if you want the VLAN group to forward all frames, including non-IP traffic.
    The default setting is disabled (not selected).
  7. Leave the Bridge in Standby check box selected if you want the VLAN group to forward frames even when the system is the standby unit of a redundant system.
  8. Click Finished.

Creating a self IP address for a VLAN

Before you create a self IP address, ensure that you have created at least one VLAN or VLAN group.
A self IP address enables the BIG-IP® system and other devices on the network to route application traffic through the associated VLAN or VLAN group.
  1. On the Main tab, click Network > Self IPs .
  2. Click Create.
    The New Self IP screen opens.
  3. In the Name field, type a unique name for the self IP address.
  4. In the IP Address field, type an IPv4 or IPv6 address.
    This IP address should represent the address space of the VLAN that you specify with the VLAN/Tunnel setting.
  5. In the Netmask field, type the full network mask for the specified IP address.

    For example, you can type ffff:ffff:ffff:ffff:0000:0000:0000:0000 or ffff:ffff:ffff:ffff::.

  6. From the VLAN/Tunnel list, select the VLAN to associate with this self IP address.
    • On the internal network, select the internal or high availability VLAN that is associated with an internal interface or trunk.
    • On the external network, select the external VLAN that is associated with an external interface or trunk.
  7. From the Port Lockdown list, select Allow Default.
  8. Click Finished.
    The screen refreshes, and displays the new self IP address.
The BIG-IP system can send and receive traffic through the specified VLAN or VLAN group.

Creating a self IP for a VLAN group

Before you create a self IP address, ensure that you have created at least one VLAN or VLAN group.
After you have created the VLAN group, create a self IP address for the VLAN group. The self IP address for the VLAN group provides a route for packets destined for the network. With the BIG-IP® system, the path to an IP network is a VLAN. However, with the VLAN group feature used in this procedure, the path to the IP network 10.0.0.0 is actually through more than one VLAN. As IP routers are designed to have only one physical route to a network, a routing conflict can occur. With a self IP address on the BIG-IP system, you can resolve the routing conflict by associating a self IP address with the VLAN group.
  1. On the Main tab, click Network > Self IPs .
  2. Click Create.
    The New Self IP screen opens.
  3. In the IP Address field, type an IPv4 or IPv6 address.
    This IP address should represent the address space of the VLAN group that you specify with the VLAN/Tunnel setting.
  4. In the Netmask field, type the full network mask for the specified IP address.

    For example, you can type ffff:ffff:ffff:ffff:0000:0000:0000:0000 or ffff:ffff:ffff:ffff::.

  5. From the VLAN/Tunnel list, select the VLAN group with which to associate this self IP address.
  6. From the Port Lockdown list, select Allow Default.
  7. Click Finished.
    The screen refreshes, and displays the new self IP address.
The BIG-IP system can send and receive traffic through the specified VLAN or VLAN group.

Creating a Virtual Location monitor

When the BIG-IP® system is directing application traffic to pool members that are implemented as virtual machines, you should configure a Virtual Location type of monitor on the BIG-IP system. A Virtual Location monitor determines if a pool member is local to the data center or remote, and assigns a priority group to the pool member accordingly. The monitor assigns remote pool members a lower priority than local members, thus ensuring that the BIG-IP directs application requests to local pool members whenever possible.
  1. On the Main tab, click Local Traffic > Monitors .
    The Monitor List screen opens.
  2. Click Create.
    The New Monitor screen opens.
  3. Type my_virtual_location_monitor in the Name field.
  4. From the Type list, select Virtual Location.
  5. From the Configuration list, select Advanced.
  6. Retain the default value (in seconds) of 5 in the Interval field.
  7. Retain the default value of Disabled in the Up Interval list.
  8. Retain the default value (in seconds) of 0 in the Time Until Up field.
  9. Retain the default value (in seconds) of 16 in the Timeout field.
  10. Type the name of the pool that you created prior to configuring EtherIP tunneling in the Pool Name field.
  11. Click Finished.
After configuring the Virtual Location monitor, the BIG-IP system assigns each member of the designated pool a priority group value to ensure that incoming connections are directed to a local pool member whenever possible.
F5 Networks recommends that you verify that BIG-IP® Global Traffic Manager™ (GTM™) has automatically assigned a BIG-IP type of monitor to BIG-IP® Local Traffic Manager™ (LTM®). A BIG-IP type of monitor can use the priority group assigned to each pool member to retrieve a gtm_score value.

Syncing the BIG-IP configuration to the device group

Before you sync the configuration, verify that the devices targeted for config sync are members of a device group and that device trust is established.
This task synchronizes the BIG-IP® configuration data from the local device to the devices in the device group. This synchronization ensures that devices in the device group operate properly. When synchronizing self IP addresses, the BIG-IP system synchronizes floating self IP addresses only.
Important: You perform this task on either of the two devices, but not both.
  1. On the Main tab, click Device Management > Overview .
  2. In the Device Groups area of the screen, in the Name column, select the name of the relevant device group.
    The screen expands to show a summary and details of the sync status of the selected device group, as well as a list of the individual devices within the device group.
  3. In the Devices area of the screen, in the Sync Status column, select the device that shows a sync status of Changes Pending.
  4. In the Sync Options area of the screen, select Sync Device to Group.
  5. Click Sync.
    The BIG-IP system syncs the configuration data of the selected device in the Device area of the screen to the other members of the device group.
Except for non-floating self IP addresses, the entire set of BIG-IP configuration data is replicated on each device in the device group.

Implementation result

After you configure EtherIP tunneling on the BIG-IP system, you must perform the same configuration procedure on the BIG-IP system in the remote data center to fully establish the EtherIP tunnel.

After the tunnel is established, the BIG-IP system preserves any open connections to migrating (or migrated) virtual machine servers.

Table of Contents | << Previous Chapter | Next Chapter >>
Contact Support Contact Support

Have a Question?

Support and Sales >

About F5

Education

F5 Sites

Support Tasks




©2023 F5 Networks, Inc. All rights reserved.


Trademarks Policies Privacy California Privacy Do Not Sell My Personal Information