This multi-part blog focuses on deploying vRA 8.1 HA, vIDM 3.3.2 HA using an F5 BIG-IP LTM load balancer. The context for the material is to call out pitfalls, direction and resolution to issues with an HA vRA 8.1 deployment. Specifically, these blogs call out additional configuration for vIDM HA scale out with vRA 8.1 HA. This content is broken into four parts:
- Part 1: Pre-work with F5 BIG-IP LTM
- Part 2: vRA HA install
- Part 3: Post vRA and vIDM HA install configurations
- Part 4: vIDM HA scale out
F5 BIG-IP LTM (F5) 11.x, 12.x, 13.x, 14.x, 15.x. Load Balancer. For validation of content, this blog uses version 220.127.116.11.
VMware vRealize Suite Lifecycle Manager (vRSLCM) 8.1.0 Easy Installer / vra-lcm-installer-15996863.iso / Release Date: 2020-04-14 / Build Number: 15996863
- Deploying vRSLCM 8.1, you’ll automated the deployment of VMware Identity Manager (vIDM) 3.3.2 also referred to as VMware Workspace ONE Access and vRealize Automation (vRA) 8.1
DNS FQDN (IP, Forward “A” and Reverse “PTR”) for the following
- 1 x vRSLCM FQDN/IP
- 3 x vRA FQDN/IP
- 1 x vRA F5 VIP FQDN/IP
- 3 x vIDM FQDN/IP
- 1 x vIDM F5 VIP FQDN/IP
- Configuring naming scheme, beware of upper vs. lower case, recommend to use all lowercase to prevent installation issues.
vIDM Delegate IP
- 1 vIDM IP only for “Delegate IP” – this Delegate IP is used with vIDM cluster configuration. It must be a free available IP that is used internally as a database Load-Balancer IP for Proxying to the vIDM Postgress master. ***IMPORTANT*** This is not the same as the one used to load-balance the application.
SSL Certs (with subject alt names)
- 1 x vRSLCM cert with subject alt name
- 1 x vRA cert with subject alt names for vRA nodes
- 1 x vIDM cert with subject alt names for vIDM nodes
- SSL Certs Common name should be the VIP FQDN or Host name FQDN
- While wild cards might be used, its recommended to create the individual certs with Subject Alt Names.
- Subject Alt Names includes FQDN for each node and F5 VIP. For example with vIDM, use F5 VIP FQDN: usvidm00.ilab.int and vIDM nodes: usvidm01.ilab.int, usvidm02.ilab.int, usvidm03.ilab.int
- This four-part posts assume the use of an F5 BIG-IP LTM vs. other load balancers.
- This four-part post assumes the use of vRA embedded vRealize Orchestrator Server.
- This four-part post assumes when referencing to Workspace One Access is the same as Identity Manager.
- This four-part post focuses on standing up vRA 8.1 and vIDM 3.3 HA, post install configuration of vRA 8.1 is deferred to other blog postings in the future.
This four part series is based on documents provided by F5 and VMware. Feel free to review and use these four documents a guide with vRA 8.1, LCM 8.1, vIDM 3.3 and F5 specifically to deploying HA. Note, there are redundant, un-needed and/or un-clarified steps contained in each document (as it relates to vRA/vIDM HA). Its for this reason why these blog posts are important.
- Check out Ch 4, Advanced Configuration for the VMware Identity Manager Appliance
Pre-work with F5 BIG-IP LTM
We will begin with configuration of the F5 Load Balancer. We are configuring for both vRA and vIDM F5 virtual servers (VIP). There are seven steps shown below
- Import vIDM SSL Cert used later with Client SSL Profile
- Configure Custom Persistence Profile for Workspace ONE Access (vIDM)
- Configure Monitors
- Configure F5 Server Pools
- Configure F5 Virtual Servers
- Configure a Client SSL Profile – this relates to vIDM HA configuration
- Configure a HTTP Profile – this relates to vIDM HA configuration
1.) Import vIDM SSL Cert used later with (vIDM) Client SSL Profile
We will want to start by importing vIDM Cert Key and Certificates Chain. We will use the vIDM cert for the F5 ClientSSL Profile later on. Its important to call out the F5 Client SSL profile is specific to vIDM Load Balancer configuration. vRA HA does not require this configuration and recommends pass-through configuration.
- Navigate to System > Certificate Management > Traffic Certificate Management > SSL Certificate List > Import SSL Certificates and Keys.
- Continue to either upload or paste SSL cert to complete the import process.
- Import SSL Certs for vIDM Server (VIP).
2.) Configure Custom Persistence Profile for Workspace ONE Access (vIDM)
- Navigate to Local Traffic > Profiles > Persistence and Click Create.
- Enter a name and select Source Address Affinity from the drop-down menu.
- Enable custom mode.
- Set the Timeout to 36,000 seconds and click Finished
3.) Configure Monitors
- Navigate to Local Traffic > Monitor.
- Click Create and configure the monitor as outlined in this table. Use the default value if nothing is specified.
|Name||Type||Interval||Timeout||Send String||Receive String.||Alias Service Port|
|vRealize Automation||HTTP||3||10||GET /health HTTP/1.0\r\n\r \n||HTTP/1\.(0|1) (200)||8008|
|Workspace ONE Access / Identity Manager||HTTPS||3||10||GET / SAAS/API/1.0/ REST/system/ health/ heartbeat||ok$||443|
For convenience, the send and receive strings are shown below
- vRA Send String:
GET /health HTTP/1.0\r\n\r\n
- vRA Receive String:
- vIDM Send String:
- vIDM Receive String:
4.) Configure F5 Server Pools
- Navigate to Local Traffic > Pools.
- Click Create and configure the pool as outlined in this table. Use the default value if nothing is specified.
|Name||Health Monitors||Load Balancing Method||Node Name||Address||Service Port|
|vRealize Automation||vRealize Automation||Least Connections (member)||VA1 VA2 VA3||IP Address||443|
|Workspace ONE Access / Identity Manager||Workspace ONE Access||Least Connections (member)||VA1 VA2 VA3||IP Address||443|
5.) Configure F5 Virtual Servers
- Navigate to Local Traffic > Virtual Servers.
- Click Create and configure the virtual server as outlined in this table. Use the default value if nothing is specified.
|Name||Type||Destination Address||Service Port||Source Address Translation||Default Pool||Default Persistence Profile|
|vRealize Automation||Performance (Layer 4)||IP Address||443||Auto Map||vRealize Automation||None|
|Workspace ONE Access / Identity Manager||Performance (Layer 4)||IP Address||443||Auto Map||Workspace ONE Access||Workspace ONE Access|
6.) Configure a Client SSL Profile for vIDM
Its important to call out the F5 Client SSL profile is specific to vIDM Load Balancer configuration. vRA HA does not require this configuration and recommends pass-through configuration.
- Navigate to Local Traffic menus go to Profiles > SSL > Client > (+) plus icon to create a new SSL Client Profile
- Configure a new name and select Parent Profile clientssl
- In the Configuration section, click the Custom check box
- Click Add for SSL Certificate to Key Chain
- Add the SSL Certificate to Key Chain popup
- Certificate: Select the certificate with the FQDN that you uploaded to the BIG-IP earlier.
- Key: Select the certificate key that corresponds with the certificate.
- Chain: Select the primary or root CA/certificate chain that corresponds with the certificate.
- Click the Add button to add the certificate key chain to the SSL profile
- Click Finished (not shown)
7.) Configure a HTTP Profile for vIDM
**UPDATE (06/08/20)** – great feedback suggested clarity on this section. Upon creating the HTTP profile for vIDM, you’ll need to assign the HTTP profile to the F5 Virtual Server. (see second screen shot below)
Its important to call out the F5 HTTP profile is specific to vIDM Load Balancer configuration. vRA HA does not require this configuration.
Navigate to Local Traffic > Profiles > Services > HTTP (+) and/or in Services click Create
- Name: Provide a unique name for the instance
- Insert X-Forwarded-For: Click the Custom checkbox and change to Enabled
- Scroll to the bottom and click Finished
** Important ** You must enable X-Forwarded-For headers on your BIG-IP system. Identity Manager identifies the source IP address in the X-Forwarded-For headers. Identity Manager determines which authentication method to provide based on this IP address.
- This screen print below shows selected HTTP Profile in the Virtual Server
In Part 1, we reviewed the pre-work on an F5 BIG-IP LTM Load Balancer to support vRA 8.1 and vIDM HA deployment. Next, in Part 2: we’ll deploy vRA 8.1 (x 3 nodes) and vIDM 3.3 (x 1 node) via vRLCM easy installer.