E-Rate Discounts for F5 Solutions

F5’s industry-leading technologies are now eligible for E-Rate discounts!

What is E-Rate?

E-Rate is a government funded program that’s been around since the late 90’s and aims to get Internet access into schools & libraries who otherwise might not be able to afford it. In order for these entities to take advantage of the subsidies, they must choose products that qualify under the Eligible Services List – published each year by the FCC. ESL classifies approved products and services under two categories:

• Category 1 – Data Transmission Services and/or Internet Access
• Category 2 – Internal connections (IC) & managed internal broadband services (MIBS) – Covers on premise equipment bought or leased required for IC & MIBS – things like Firewalls, Access Points, Routers, Switches, Wiring  – and the services to install and maintain them.

The tough part is, the school or library is tasked with figuring out exactly what % of the product and or services are covered under the guidelines. If they get it wrong, their funding can be denied, so most technology vendors (such as F5) work with E-Rate consultants to help them determine the exact discount % that each product / SKU is eligible for. The consultant then provides that information with detailed justification to USAC.org and publicly makes the information available to potential schools and libraries looking to procure their products. This makes it easy for schools & libraries to purchase a vendor’s products under E-Rate, as they can depend on the published percentages when submitting their E-Rate application.

E-Rate Discounts Are Now Available for  F5 Products

There’s good news for K-12s considering an upgrade in network infrastructure…

F5 has hopped on the E-Rate school bus, and published approved discount information on their products!

In short, the F5 Local Traffic Manager (LTM) qualifies under Category 2 as an approved firewall – but you’re getting much more out of the LTM than your typical firewall!

This is great news for applicants of the E-Rate program, as F5 is the best-of-the-best when it comes to application delivery and security – two things that are critical for providing broadband services! Now schools, libraries, and other non-traditional facilities that qualify for E-Rate can get on the F5 platform for up to 90% off!

F5 has published eligibility of their products on the E-Rate Provider Services website. We’ve summarized the main F5 product categories that have eligibility in the table below. Click on a product category in the left column to access the appendix which has the full list of products within each category. Those lists contain links (also in the left-most column) to erateproviderservices.com with specific pricing information.

Understanding The Power of  F5 LTM

Popular LTM features that K-12 schools & libraries can benefit from:

Firewall Capabilities — F5 LTM is the only port-based firewall that literally configures itself. That’s because it’s a default deny device, in order for it to allow any traffic through you have to configure it to do so. There are only so many entrance points with the LTM – interfaces, management port, NAT & SNATs and virtual IPs (a.k.a. VIPs) – so what’s allowed in and allowed out is very clear. VIPs, you’ll learn, are the core of how LTM works. You build VIPs, and the configuration elements inside the VIPs make up the rules and policies around the traffic you’re protecting and load balancing. You can read more about how the F5 LTM is a firewall, including other modules in our article, F5 Firewall: Understanding all firewalls of the BIG-IP platform.

Inbound Load Balancing — Provide high availability to your applications and services! Just about any type of communication can be load balanced… web applications (like Blackboard), authentication servers, DNS servers, databases, SIP, etc. It doesn’t stop at IP, it even supports protocols like Anycast! The options you have with LTM for deeming availability (i.e. “monitors”) are endless and VERY intelligent. You can programmatically test for real content and application functions to deem if that app is up (e.g. performing a user log-in, verifying a web page paints with certain content) the sky is the limit around monitoring. Similarly, the way you load balance traffic is dynamic as well. If you’d like to read more about all the options you have to load balance traffic with the LTM, check out our post on the various F5 load balancing methods.

Outbound Load Balancing — Do you have multiple ISP circuits? With the LTM you can provide high availability using multiple gateways or gateway pools. You can even write rules to send specific users through one circuit vs. another. For example, we have K-12 customers who have two circuits; one is used for critical production traffic, and they send all their outbound web surfing through the other. All of this is possible with just the base F5 BIG-IP LTM. Taking it one step further, you can even seamlessly failover traffic for either circuit in case one of them were to go dark on you – pretty slick eh?

DOS & DDOS Protection — Out of the gate, the LTM can protect your applications against a plethora of DoS & DDoS attacks. Common attacks include: SYN floods, ICMP floods, peer-to-peer attacks, IP fragmentation attacks, Slowloris, UDP floods, Ping of death attacks (Ping floods), land, teardrop, data attacks, nuke, SIP, and Sub 7.

SSL / TLS Offloading — SSL certificates are a pain to manage when you have a lot of different servers, not to mention the security risks they present if improperly managed. What’s even more difficult is managing all of the particular SSL settings from server to server like CIPHER strings. Wouldn’t it be great if you could manage all your public (or private) certificates for your applications in one place, AND apply things like CIPHER strings on a global basis applied to a set or subset of servers? You can do all of that with the LTM and SSL profiles applied to VIPs! Additionally, public certs are expensive, but when you’re load balancing servers with the LTM you only need to apply one public cert to the VIP (so the servers it is load balancing don’t need the actual cert that cost $$). Since F5 is a full proxy, you can completely offload SSL (i.e. leave the backend servers HTTP) which means you can forgo SSL configuration on those servers (or simply apply internal certs to them). You can do all of that because the F5 is secure, and users connecting to the VIP will never see the real server (and the certs it has or doesn’t have).

Application Acceleration — BIG-IP has many different ways it can accelerate traffic, and one of the most commonly used is called OneConnect. OneConnect allows you to reuse established server-side TCP connections to servers in pools behind the BIG-IP when sending HTTP traffic. This severely cuts down on the established connections to your server, reducing overhead and extending server life. You can read more about this in our recent post: Understanding OneConnect.

Network Address Translation — LTM is a network address translation powerhouse, one-to-one, one-to-many, inbound, outbound, etc. You name it, you can translate it! F5 even has something called “SNAT” for Secure Network Address Translation or Source Network Address Translation. You can read more about this in our SNAT overview article.

iRules — The ultimate traffic band-aid! iRules enable the augmentation of client-side and server-side traffic in any way you can dream it up – building intelligent logic around your traffic. Need to send all video traffic for an app to the video server? No problem, iRules can do that. What about redirecting for a particular URL? Yep! Maybe you need to insert some headers for HTTP traffic? You can even dive into the data portion of traffic if you had to! There is so much you can do with iRules, we could write a novel on it… just know that iRules allow you to take full advantage of the full proxy that F5 offers with the ability to augment client-side and server-side traffic.

iControl — F5 has a complete RESTful API that you can interface for programmability & automation of the F5 BIG-IP platform. iControl provides full pragmatic control over configuration & management of the BIG-IP platform. Any platform capable of integrating via SOAP can use iControl. Build custom monitoring and management apps, integrate into your process or change management software like ServiceNow – just about anything you can imagine can be done via F5’s BIG-IP API called iControl.

Analytics & Visibility — When you buy the LTM module you get the Application & Visibility Reporting (AVR) module included. AVR gives you deep insight into the performance of your web apps, TCP traffic, DNS Traffic, including system performance of the BIG-IP like CPU and memory.

Consolidating Your Network on  F5’s BIG-IP Platform

An overview of the additional functionalities that K-12s can add to BIG-IP:

F5 is the best choice for your E-Rate dollars because of the various options for consolidation and flexibility! Schools and libraries have limited budgets and resources, so the more you can consolidate on one platform the more you save in managing them! The BIG-IP application delivery platform is unlike any other product because it provides the ability to perform so many different network & security functions under one device.

The big secret with F5 BIG-IP is that it’s the best in the business at SSL/TLS Certificate & Key hosting, making it easy to manage certificate renewal and modify CIPHER strings across many different applications.

You see, once you host the Certificate & Key for a web application on your LTM, you’re able to perform other functions around security and authentication. This is because most web traffic is encrypted (i.e. HTTPS).

Oftentimes, the organizations that want to perform different functions around security and authentication for HTTPS applications will have multiple network devices that host certificates and keys. This creates a situation with multiple points of failure, multiple technologies to learn, more $$ to spend, and more devices to maintain. Not with the F5 BIG-IP! Since LTM is the best application delivery platform for managing SSL, performing things like Single-Sign-On, SSL VPN, and web security becomes a lot less laborious when consolidated on this single platform.

Below you’ll find a list of F5 BIG-IP features & capabilities, and the corresponding module they are provided under. These are your opportunities to consolidate functionality and save on the F5 BIG-IP platform:

Single-Sign-On (SSO) — via Access Policy Manager (APM) APM provides a whole slew of authentication integration options. Replace your Citrix Storefront or Okta with F5’s webtop, and it can front VDI applications like Vmware View or Citrix VDI – offloading the auth for them. Using a webtop via APM you can host web applications based on the users access rights and only display the apps they need – limiting the login to a single time. For example a contractor may only have access to the ERP application she’s working on, along with an expense app like concur expense app – only those apps will show on their webtop – while a teacher may have access to iGradePlus, and Gmail, or Office365. A student, on the other hand, would only see the apps they have access to, like Blackboard or Moodle. These apps can be hosted on-prem, or they can be SAML apps, it doesn’t matter – all can be hosted on the APM webtop.

SAML — via Access Policy Manager (APM) SAML is the defacto standard in authenticating cloud SaaS applications using some type of central authentication database or directory service. Simply put, this allows you to stop storing your users’ passwords in various cloud apps in favor of one central repository. Why should you care? Well, it’s no secret, a lot of folks use the same password across multiple applications and services. If any one of those services get compromised (and many do – just check the https://haveibeenpwned.com/ free database) hackers can try that username/password in other services to gain access. APM also makes it easy to disable access across multiple cloud services when employees leave or move departments – as you only have to cancel or make changes to one account to remove/change access to all their applications.

Multi-factor — via Access Policy Manager (APM) Even with solutions like SAML and password vaults like LastPass, accounts get compromised. Multi-factor allows you to add a second (or more, if you’d like) layer of protection so that users need to verify it’s truly them using their phone (or another device like a PIN card a.k.a. hardware token). The F5 APM is the best in the business at providing intelligent MFA because you can build fault-tolerant logic around the different forms of authentication fronting your application. For example, let’s say you have DUO as your second form of authentication, but one of the DUO servers go down, you can detect that with the F5 APM and fallback to a text message or email. The APM integrates with all the popular MFA solutions like Google auth (on the free side) and products like DUO or RSA SecureID (on the pay side).

Access & Identity Management (IAM) — via Access Policy Manager (APM) IAM is a general term that encompasses all things related to identity and authentication. The important thing to understand here is that when APM is coupled with the LTM, it becomes an authentication powerhouse, allowing you to manipulate authentication any way you can dream up with the flexibility of concentrating on the client-side & server-side of the BIG-IP proxy independently.

SSL VPN — via Access Policy Manager (APM) Accessing resources securely in remote locations is often done by things like an APM webtop fronting web apps and VDI applications, but sometimes you need access to non-HTTP web apps or admins need access to whole networks. The APM can provide your org with full SSL/TLS VPN capabilities, allowing you to consolidate devices and avoid equipment and software just for VPN access. No need for a Cisco ASA, or watchguard device if you can do it all on your F5 BIG-IP.

Secure Web Gateway Services — via the Secure Web Gateway Module (SWG) SWG ties into the Websense database and allows you to secure outbound web surfing for your students, teachers, and faculty/staff. What’s nice is you can set policies to allow and disallow access to websites based on the sites classification, i.e. social media, adult, etc. You also have the flexibility to have different policies for different types of users, i.e. faculty, students, or contractors – you can even have different policies for different times of the day.

Content Metering — via the Policy Enforcement Manager (PEM) PEM is super interesting for school systems because it can provide a way to charge back entities under you based on subscriber level according to their plan, location, or type of device. Lots of analytics are also available via PEM, and there’s flexibility to base tiered plans on behavior patterns. PEM can very easily create new revenue streams for you, providing a way to charge back and meter services to entities under you.

Web Application Firewall (WAF) — via the Application Security Manager & Advanced WAF module It’s no secret, F5 is the leader in web application firewalls and makes it easy to protect against things like the OWASP Top 10, or stay PCI-DSS compliant. The port-based firewall abilities provided by the LTM are great, but gone are the days of only worrying if rogue ports are open to your applications. With web apps you can think of any input your website accepts as a potential vulnerability, i.e. “open port” — how are you currently firewalling your “open ports” in your web apps? If you don’t have a WAF, you’re not. Using a WAF in the modern day threat landscape is no longer an option, it’s a necessity. Otherwise you will surely become part of the compromised statistics.

DNS — via the DNS module (a.k.a. Global Traffic Manager or GTM module) The DNS/GTM module gives you all the typical name resolution abilities a bind server or Windows DNS would give you, but it also provides the ability to set intelligent name resolution on a per-URL basis between multiple sites or multiple circuits. I like this solution much better for inbound circuit load balancing than BGP because it’s per-URL, not per-subnet (meaning you can failover one app at a time with the GTM vs. every app with BGP). You can read more about the F5 DNS/GTM module in our GTM vs. LTM article.

K-12 Application Integrations

These applications (and more) plug right into the F5 BIG-IP:

All the popular education apps you’ve come to rely on integrate with F5’s E-Rate eligible firewall. F5 makes it easy to make these applications fault tolerant, part of Single-Sign-On (SSO), integrated with SAML, and protected from web threats with their Web Application Firewall.

Summary

I’m so excited that the best technology for delivering fault tolerant applications securely is now an affordable solution for schools and libraries through the E-Rate program! This opens up many doors for E-Rate participants, and makes a once untouchable enterprise-level technology a real option for these institutions.

Contact WorldTech IT for any of the technologies you read about in this article and we’ll be happy to assist you with your E-Rate F5 inquiries. We should also mention that WorldTech IT has a SPIN number, which means our services to install the F5 software & hardware products that you purchase through E-Rate are also eligible for discounts.

Appendix: Product List