Connect upstream applications using the AWS CLI

This guide shows how to use the AWS CLI to let an F5 Application Delivery Service for AWS deployment reach applications in your upstream network. You create an upstream virtual private cloud (VPC) and request a VPC peering connection to your deployment’s VPC. Then you accept the connection in F5 ADS and update routing and security rules so traffic can flow between the two VPCs.

For more background on VPC peering, see the AWS Create a VPC peering connection documentation.

Before you begin

• The AWS CLI installed and configured with credentials that can manage VPC resources in your upstream AWS account.
• An F5 ADS deployment. See Create a new deployment.
• Your deployment’s AWS Account ID, VPC ID, IPv4 CIDR, and IPv6 CIDR (if you plan to use IPv6), found on the deployment’s Details tab.

Caution

Request the peering connection from the same region as your deployment. F5 ADS rejects peering connections from any other region.

Create your upstream VPC

If you already have an upstream VPC that hosts the applications your deployment needs to reach, skip to Request a VPC peering connection and use its VPC ID instead.

CIDR overlap

Your upstream VPC CIDR block must not overlap with the deployment’s VPC CIDRs, or the CIDRs of other peered upstream VPCs. If CIDRs overlap, VPC peering will fail. See Upstream network for more information.

Otherwise, create a new VPC in the same AWS Region as your deployment. Replace <UPSTREAM_VPC_CIDR> with a CIDR block for the VPC and <AWS_REGION> with your deployment’s region:

aws ec2 create-vpc \
    --cidr-block <UPSTREAM_VPC_CIDR> \
    --region <AWS_REGION>

Example output:

{
    "Vpc": {
        "VpcId": "vpc-0123456789abcdef1",
        "CidrBlock": "10.1.0.0/16",
        "State": "pending"
    }
}

Record the VpcId. You’ll need it in the following steps.

Request a VPC peering connection

From your upstream VPC, request a peering connection targeting your deployment VPC. Replace <UPSTREAM_VPC_ID> with your upstream VPC ID, <DEPLOYMENT_VPC_ID> and <DEPLOYMENT_AWS_ACCOUNT_ID> with the values from your deployment Details tab, and <AWS_REGION> with your deployment region:

aws ec2 create-vpc-peering-connection \
    --vpc-id <UPSTREAM_VPC_ID> \
    --peer-vpc-id <DEPLOYMENT_VPC_ID> \
    --peer-owner-id <DEPLOYMENT_AWS_ACCOUNT_ID> \
    --region <AWS_REGION>

Example output:

{
    "VpcPeeringConnection": {
        "VpcPeeringConnectionId": "pcx-0123456789abcdef0",
        "Status": {
            "Code": "initiating-request"
        }
    }
}

Record the VpcPeeringConnectionId. You’ll need it in the following steps.

Accept the peering connection in F5 ADS

1. In the F5 ADS Console, open your deployment’s Details tab and select Edit.
2. Go to Cloud Details > Upstream Network, select + Add Entry, and add the VpcPeeringConnectionId you recorded when you requested the VPC peering connection.
3. Select Save Changes to allow F5 ADS to accept the peering connection request.

Confirm that your AWS VPC peering connection is active by replacing <VPC_PEERING_CONNECTION_ID>:

aws ec2 describe-vpc-peering-connections \
    --vpc-peering-connection-ids <VPC_PEERING_CONNECTION_ID> \
    --region <AWS_REGION> \
    --query "VpcPeeringConnections[0].Status"

Wait until Code shows active before continuing.

Update your route tables

Add a route in your upstream VPC’s route tables so traffic destined for the deployment CIDRs goes through the peering connection. Replace <ROUTE_TABLE_ID> with your upstream route table ID and <DEPLOYMENT_IPV4_CIDR> with the deployment’s IPv4 CIDR:

aws ec2 create-route \
    --route-table-id <ROUTE_TABLE_ID> \
    --destination-cidr-block <DEPLOYMENT_IPV4_CIDR> \
    --vpc-peering-connection-id <VPC_PEERING_CONNECTION_ID> \
    --region <AWS_REGION>

If you’re using IPv6, add a matching route for the deployment’s IPv6 CIDR. Replace <DEPLOYMENT_IPV6_CIDR>:

aws ec2 create-route \
    --route-table-id <ROUTE_TABLE_ID> \
    --destination-ipv6-cidr-block <DEPLOYMENT_IPV6_CIDR> \
    --vpc-peering-connection-id <VPC_PEERING_CONNECTION_ID> \
    --region <AWS_REGION>

Repeat this step for every route table associated with a subnet that needs to reach the deployment.

Update your security group rules

Allow inbound traffic from the deployment CIDRs on the security groups attached to your upstream applications. Replace <SECURITY_GROUP_ID> with the security group protecting your upstream application, and <DEPLOYMENT_IPV4_CIDR> with the deployment’s IPv4 CIDR:

aws ec2 authorize-security-group-ingress \
    --group-id <SECURITY_GROUP_ID> \
    --protocol tcp \
    --port <PORT> \
    --cidr <DEPLOYMENT_IPV4_CIDR> \
    --region <AWS_REGION>

Scope the ingress rule to only the port and protocol your upstream application expects, and only the deployment CIDRs. For example, --cidr 10.1.0.0/24 rather than a broad range like 0.0.0.0/0.

Verify the peering connection

Confirm the peering connection is active and routes are in place, replacing <VPC_PEERING_CONNECTION_ID> and <ROUTE_TABLE_ID>:

aws ec2 describe-vpc-peering-connections \
    --vpc-peering-connection-ids <VPC_PEERING_CONNECTION_ID> \
    --region <AWS_REGION> \
    --query "VpcPeeringConnections[0].{Status:Status.Code,CIDR:AccepterVpcInfo.CidrBlock}"

aws ec2 describe-route-tables \
    --route-table-ids <ROUTE_TABLE_ID> \
    --region <AWS_REGION> \
    --query "RouteTables[0].Routes"

After the connection is active and the routes and security group rules are in place, your deployment can reach your upstream applications. The deployment reaches them at the addresses that your NGINX configuration proxies to.

What’s next

• Set up connectivity
• Monitor your deployment