F5 BIG-IP v13.0
Piotr Borkowski Veracomp SA
Introducing F5 BIG-IP v13.0
Delivers feature upgrades for:
• TMOS/Local Traffic Manger (LTM)
• DNS - formerly Global Traffic Manager (GTM)
• Advanced Firewall Manager (AFM)
• Application Security Manager (ASM)
• Access Policy Manager (APM)
• …
BIG-IP v13.0 TMOS/LTM
BIG-IP v13.0 TMOS/LTM
• TMOS/LTM • New Built-in TCP Profiles (f5-tcp-wan, f5-tcp-lan, f5tcp-mobile, f5-tcp-
progressive)
• TCP Nagle Auto mode
• TCP Auto Buffer Tuning
• Diameter High Availability
• SIP and Diameter Connection Auto-Initialization
• Diameter Election Process Support (RFC 6773)
• Diameter In-Band Monitor
BIG-IP v13.0 TMOS/LTM
• TMOS/LTM • ECDH and ECDSA for external crypto offload
• FIPS key management using tmsh
• Global VLAN based SYN flood protection
• Upgrade status dialog in the GUI now reports status of long-running upgrade processes
• Cipher Rules and Cipher Groups configuration
• HTTP/2 replaces SPDY
• BIG-IP VE, single NIC for cloud environment
Single NIC for all cloud environments
Profile TCP, Auto Proxy Buffer, Receive Window and Send Buffer
Auto Receive Window Specifies, when enabled, that the system uses the network measurements to set the optimal receive window size. Auto Send Buffer Specifies, when enabled, that the system uses the network measurements to set the optimal send buffer size. Auto Proxy Buffer Specifies the proxy buffer level, in bytes, at which the receive window is closed.
Profile TCP, Enhanced Loss Recovery
v12.1.2 v13.0.0
Profile ClientSSL Cipher Group
System Traffic Certificate Management (moved from file management menu)
Device Group Overview
HA Group
v12.1.2
v13.0.0
Virtual Server, SPDY profile removed
v12.1.2 v13.0.0
Profile Netflow
Support Snapshot (Qkview) and upload to ihealth
Boot status more details
BIG-IP v13.0 DNS
BIG-IP v13.0 DNS
• DNS (GTM) • Multiple probe setting for pool members
• Support for adding BIG-IP LTM systems in a device group with more than two members
• Allow more returned records in a GSLB query response (increased from 16 to 500)
Pool List, Availability requirement, Require
Device Cluster support
v12.1.2 v13.0.0
BIG-IP v13.0 AFM
BIG-IP v13.0 AFM
• AFM • Packet testing
• Auto thresholding for DoS
• DoS Enhancements
• Dynamic DoS vectors
DOS Dashboard
DoS Protection, Device Configuration, Network
DoS Protection, Device Configuration, Network
Network Behavioral DDoS
Packet Tracer
BIG-IP v13.0 ASM
BIG-IP v13.0 ASM
• ASM • Layered Policies
• Proactive Bot Defense Logging and Reporting Enhancements
• Client Reputation Use in Policy Builder
• Compact Mode Learning Optimization
• ASM Policy Setting Usability Improvements
• JSON Support and Granularity Improvements
• Classification of Request Content for URLs
• Fingerprinting Improvements
BIG-IP v13.0 ASM
• ASM • Overlapping Staging for Updated Signatures
• Single Page (URL) Application Protection via Enabling JavaScript-Based Challenges with AJAX Applications
• Automatic Server Technology Detection
• AVR DoS Visibility and Scheduled Reports
• ASM Proxy Log GUI Improvement
• Advanced Exception Handling
• Policy Enhancements
BIG-IP v13.0 ASM
• ASM • BADoS Unified Server Health Check Mechanism Based on L7 Analysis
• BADoS DDoS Mitigation Based on Behavior Analysis and Integration with Whitelist
• BADoS Logging and Reporting Improvement
• BADoS Automatic Generation of Aack Request Signatures
• ASM DoS Add Automatic Threshold Tuning to ASM DoS Protection
• ASM DoS Heavy URL Improvements
BIG-IP v13.0 ASM
• ASM • Overlapping Staging for Updated Signatures
• Single Page (URL) Application Protection via Enabling JavaScript-Based Challenges with AJAX Applications
• Automatic Server Technology Detection
• AVR DoS Visibility and Scheduled Reports
• ASM Proxy Log GUI Improvement
• Advanced Exception Handling
• Policy Enhancements
ASM GUI Policy redesign v12.1.2
v13.0.0
ASM Traffic Learning Page redesign
ASM Layered Policy
• Parent policy is a virtual policy and can’t be assigned to VS.
• Child policy is a Standard security policy, which can be assigned to VS
ASM Layered Policy
ASM Layered Policy
ASM Layered Policy
ASM DoS Reporting redesign
BIG-IP v13.0 APM
BIG-IP v13.0 APM
• APM • Endpoint Check and Network Access for Chrome Browser, Firefox, and
Edge Browser
• OAuth 2.0 Authorization Server, Resource Server and Client
• Ping Identity: PingAccess Policy Enforcement Point
• APM Integration with VMware Horizon Access Portal/Identity Manager
• Launch native RDP client from APM webtop without F5 client component code
BIG-IP v13.0 APM
• APM
• Microsoft Remote Apps published on APM Webtop and in native RDP client
• Step-up Authentication
• Forward Proxy Chaining
• Enhanced iRules support for Subsessions with Per Request Policies (Example: Step-up authentication)
• Google reCAPTCHA V2 Support
• Support for WebSockets for Portal Access
• Enhanced F5 Access Policy Manager Menu Navigation
BIG-IP v13.0 APM
• APM • Additional Troubleshooting and Usability Change
• Support For Exclusion Lists with Edge Client for Windows Always-On VPN Mode (Locked Client Mode)
• Enhanced SSO Configuration Tools and Consistent Logging across all APM services
• ACL Enhancements
• Dynamic RDP
• Launch multiple Horizon View client instances from APM webtops
• Enhanced VDI client selection from APM Webtop
• Enhanced VDI logging
Access Policy menu – reorganized
v12.1.2 v13.0.0
APM VPN browser component download menu
APM RDP, Server type and RDP Client Type
BIG-IP v13.0 AVR
BIG-IP v13.0 AVR
• AVR • Extended information about DoS attack system impact
• Enhanced visibility of HTTP statistics
• Extended support for Scheduled Reports
• Data Exporting Capabilities
Analytics Scheduled reports
BIG-IP 13.0 DDoS Hybrid Defender (DHD)
Simplified configuration
Simplified configuration
Simplified configuration
Simplified configuration
And many more…
• Released Feb 2017 • https://support.f5.com/csp/article/K9412 • https://support.f5.com/kb/en-us/products/big-ip_ltm/releasenotes/related/relnote-supplement-bigip-13-0-0.html • https://support.f5.com/kb/en-us/products/big-ip_ltm/releasenotes/product/relnote-ltm-13-0-0.html • https://support.f5.com/kb/en-us/products/big-ip_ltm/releasenotes/product/relnote-ve-13-0-0.html • https://support.f5.com/kb/en-us/products/big-ip-aam/releasenotes/product/relnote-aam-13-0-0.html • https://support.f5.com/kb/en-us/products/big-ip-afm/releasenotes/product/relnote-afm-13-0-0.html • https://support.f5.com/kb/en-us/products/big-ip_analytics/releasenotes/product/relnote-avr-13-0-0.html • https://support.f5.com/kb/en-us/products/big-ip_apm/releasenotes/product/relnote-apm-13-0-0.html • https://support.f5.com/kb/en-us/products/big-ip_apm/releasenotes/related/relnote-helper-apps-13-0-0.html • https://support.f5.com/kb/en-us/products/big-ip_asm/releasenotes/product/relnote-asm-13-0-0.html • https://support.f5.com/kb/en-us/products/big-ip-dns/releasenotes/product/relnote-dns-lc-13-0-0.html • https://support.f5.com/kb/en-us/products/big-ip-pem/releasenotes/product/relnote-pem-13-0-0.html
Thank you : )
Piotr Borkowski
Top Related