For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

jeff_08_151741's avatar
jeff_08_151741
Icon for Nimbostratus rankNimbostratus
Oct 13, 2015

11.4.1 - Receive 404s on iControlREST Request

Hello,

I'm attempting to use the iControlREST api (running v11.4.1), but always receive a 404 with the following error:

{"ctextode":404,"message":"http://localhost:8100/mgmt/tm","restOperationId":1917,"errorStack":["com.f5.rest.common.RestWorkerUriNotFoundException: http://localhost:8100/mgmt/tm","at com.f5.rest.common.RestServer.trySendInProcess(RestServer.java:126)","at com.f5.rest.common.RestRequestReceiver.dispatchToService(RestRequestReceiver.java:93)","at com.f5.rest.common.RestRequestReceiver.processNext(RestRequestReceiver.java:57)","at com.f5.rest.common.RestHelper$2.run(RestHelper.java:1480)","at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(Unknown Source)","at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)","at java.lang.Thread.run(Unknown Source)\n"]}

I initially followed these two articles (1 & 2) to start the icrd service to enable iControlREST. However, starting this service does not seem to have fixed the 404 that I'm receiving. I've tried digging for some deeper answers, but most of the responses indicate that this occurs when the icrd service is not enabled or running - but it is currently active for me.

Any ideas what else I should check for this issue?

Thanks.

EDIT

In addition to the issues below, I seem to have been either hitting endpoints that no longer exist or are not supported in my version (11.4.1) - I've since hit other endpoints (/mgmt/tm/sys, /mgmt/tm/ltm) and received a response without changing any other aspects of my request.

devops
iControl
iControlREST
TMSH

4 Replies

  • nathe's avatar
    nathe
    Icon for Cirrocumulus rankCirrocumulus
    Oct 13, 2015
    Jeff, should you really be connecting to port 8100?
  • jeff_08_151741's avatar
    jeff_08_151741
    Icon for Nimbostratus rankNimbostratus
    Oct 14, 2015
    Nathan, I'm providing the management IP/hostname as I read from this article (https://devcentral.f5.com/s/articles/introducing-a-restful-interface-for-icontrol) without specifying a port. The error returned however suggests that I'm pinging localhost on port 8100, which is not the IP/hostname I'm specifying in the API request. The URL I'm testing looks like: https://[my-management-hostname].com/mgmt/tm
  • jeff_08_151741's avatar
    jeff_08_151741
    Icon for Nimbostratus rankNimbostratus
    Oct 14, 2015
    One other thing I wanted to mention is that I can ping a URL with no credentials supplied, say https://[my-management-hostname]com/mgmt/tm/module and receive a response stating the credentials I've supplied are invalid. If I include my credentials and make the same request again, I get the 404 response shown above in my opening post. The URL is definitely available as I receive a 401 response the first time I ping the URL without credentials. Any idea what would cause a 401 when I don't supply my credentials (as expected), but a 404 when I do?
  • anujl_5566's avatar
    anujl_5566
    Icon for Nimbostratus rankNimbostratus
    Oct 16, 2015

    ICRD in version 11.4.1 requires these steps to come up

     

    bigstart add --default icrd ln -s /etc/bigstart/scripts/icrd /service/icrd/run bigstart start icrd

     

    And the reason why you get 401 is because 11.4.1 icrd does not work with AD auth. At least that is what is happening with us. The admin user works fine. Obviously this is not good for enterprise use case.

     

    I have a F5 ticket open to see what they recommend..