Legacy Load Balancer Migration: Cisco ACE 4710 to F5 BIG-IP LTM iRules

“Cisco EOL’d the ACE 4710 appliance, leaving enterprise banking clients with static SSL ciphers and unmaintainable XML probes.”

The Setup

In April 2016 at Wipro, we led an emergency infrastructure modernization initiative for a global banking client. The core datacenter relied on 12 redundant pairs of Cisco ACE 4710 appliances handling traffic for 150+ web applications.

With Cisco officially ending support for ACE 4710 hardware, we were tasked with migrating all application VIPs, SSL offload certificates, and custom health probes to F5 BIG-IP LTM (Local Traffic Manager) running BIG-IP v12.1.

The Mess

Cisco ACE configuration syntax (CLI parameter maps and server farms) did not translate directly into F5 BIG-IP TMOS objects.

An automated translation script failed silently on complex HTTP header manipulation rules. During the pilot cutover of a core online banking portal, traffic froze:

[CRITICAL] 2016-04-12 02:14:05 IST - F5 BIG-IP LTM Log (/var/log/ltm)
err tmm[10214]: 01220001:3: TCL error: /Common/irule_ace_header_rewrite <HTTP_REQUEST> - can't read "client_ip": no such variable
    while executing
"HTTP::header insert X-Forwarded-For $client_ip"
BIG-IP LTM Status: 100% of HTTPS POST requests to /api/v1/transfer timing out.
Client Impact: Core banking session cookies dropped, 400 Bad Request returned.

The ACE appliance had been injecting X-Forwarded-For headers implicitly, whereas F5 required explicit iRules or HTTP profile settings. The manual cutover stalled 30 minutes into a 2-hour maintenance window.

The Solution

I built a standardized F5 TMOS migration framework featuring custom TCL iRules to replace legacy ACE parameter maps while upgrading SSL cipher security:

1. Standardized HTTP Profile: Enabled native Insert X-Forwarded-For and SSL Offload within F5 HTTP profiles, bypassing fragile TCL variable assignments.
2. Production-Tested iRule Engine: Written robust TCL iRules handling URI path rewriting and client IP persistence with fallback pool routing.
3. Automated TMOS Config Generator: Scripted Python parser converting Cisco ACE running configs into F5 tmsh CLI command batches.

# /Common/irule_enterprise_uri_routing - F5 BIG-IP LTM iRule
when HTTP_REQUEST {
    # Extract URI path and normalize lowercase
    set uri_path [string tolower [HTTP::uri]]

    if { $uri_path starts_with "/api/v1/auth" } {
        pool pool_auth_backend_v4
        persist source_addr 1800
    } elseif { $uri_path starts_with "/api/v1/payment" } {
        pool pool_payment_backend_v4
    } else {
        pool pool_default_web_v4
    }
}

when HTTP_RESPONSE {
    # Enforce HTTP Strict Transport Security (HSTS)
    HTTP::header insert Strict-Transport-Security "max-age=31536000; includeSubDomains"
}

# tmsh Batch Command Executed on F5 BIG-IP LTM
tmsh create lt pool pool_auth_backend_v4 members add { 10.100.20.10:8080 10.100.20.11:8080 } monitor http
tmsh create lt virtual vip_online_banking_443 destination 192.168.50.100:443 pool pool_auth_backend_v4 profiles add { http clientssl serverssl } rules { irule_enterprise_uri_routing }

The Results

Migrating 150+ application contexts to F5 BIG-IP LTM eliminated EOL hardware risk:

• Migration Throughput: Successfully migrated 150+ application VIPs across 12 maintenance windows.
• Latency Reduction: SSL handshake latency dropped from 45ms (ACE 4710) to 4ms (F5 Hardware Crypto ASIC).
• Security Stance: Achieved A+ Qualys SSL ratings across 100% of migrated public VIPs.

Key Takeaway

Do not rely on naive syntax translators when migrating legacy hardware load balancers. Standardize HTTP profiles natively in F5 TMOS and reserve TCL iRules strictly for custom application traffic routing logic.

Architecture and decisions: mine. Debugging sessions at odd hours: mine. AI assistance: structure, syntax, first draft. — Sachin