18 Multi-Tier Application Design

This note puts everything together like an LTM architect: given an application, decide the virtual servers, profiles, SNAT, persistence, SSL, load balancing and monitors for each tier. The scenario is the one used in the 301a course.

The scenario

Clients (Internet) → VS-HTTPS1 → HTTPS pool (web tier, 10.10.1.0/24)
                                      │  web servers act as clients
                                      ▼
                     VS-DB1 → Database pool (MS SQL, TCP 1433, 10.10.2.0/24)

• Two virtual servers and two pools. The second tier is VS-to-VS: the web servers are the clients of VS-DB1.
• The servers’ default gateway is another router, not BIG-IP.

What to decide at each tier

• Virtual server type and profiles (performance vs features, protocol, SSL client/server).
• Persistence and SNAT.
• HTTP optimizations: OneConnect, compression, web acceleration.
• Pools: load balancing method, health monitors, PGA.

Decisions made in the course

Item	VS-HTTPS1 (Internet-facing)	VS-DB1 (MS SQL 1433)
VS type	Standard	Standard (Performance L4 / FastL4 + PVA is the half-proxy alternative, since it’s not HTTP)
SNAT	Yes — servers’ gateway is another router	Yes — VS-to-VS traffic
Persistence	Cookie	Source address affinity
Listening VLAN	external only	internal only
Profiles	TCP, HTTP, Client SSL (+ compression / web acceleration as needed)	TCP or FastL4
Monitor	Custom HTTP content monitor	Not in my notes — a TCP 1433 or SQL monitor fits
LB method	Least Connections (member)	Not in my notes — Least Connections fits long DB sessions

• Both virtual servers use persistence.
• Web Acceleration makes sense when the HTTP content is static.
• If the servers had very different capabilities → Observed.

SSL decisions

• Internet-facing → Client SSL; re-encrypt with Server SSL if the server network requires encryption.
• Moving from a 2048-bit to a 4096-bit RSA key → more CPU and fewer licensed TPS (K6475). Consider ECDSA if stronger crypto is required.

A design checklist for any new application

1. Protocol and port? HTTP(S) or not? → Standard + HTTP or Performance L4.
2. Where are clients and servers? → one-arm/two-arm, VLANs the VS listens on.
3. Return path → SNAT (Auto Map or pool size for the expected connections) or BIG-IP as gateway.
4. Need the client IP on the servers? → X-Forwarded-For (HTTP) or no SNAT.
5. Session state → persistence type (cookie for HTTP, source address otherwise).
6. Encryption → offload, re-encrypt, pass-through or Proxy SSL; certificate and chain; SNI.
7. Monitor that proves the service works (content monitor).
8. LB method based on server capacity and connection length.
9. Optimizations → OneConnect, compression, caching, TCP profiles per side.
10. Security → Port Lockdown, connection limits, WAF/APM if licensed.
11. HA → traffic group, mirroring only if sessions are long.

Self-check

Q1 — How many pools does the scenario use?

Respuesta

Two.

Q2 — What VS type was chosen for the HTTPS pool?

Respuesta

Standard.

Q3 — Which virtual servers use persistence?

Respuesta

Both.

Q4 — Which monitor was chosen for the HTTPS pool?

Respuesta

A custom HTTP content monitor.

Q5 — To use HTTP optimizations like OneConnect and compression, which profile is required?

Respuesta

The HTTP profile.

Q6 — OneConnect on an HTTPS application needs which profiles?

Respuesta

HTTP and SSL Profile (Client) (plus TCP and OneConnect).