For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

patonbike's avatar
patonbike
Icon for Cirrus rankCirrus
Oct 02, 2020

Adding a virtual to physical HA pair for ConfigSync

I have 2 physical devices, let's say bigip01 and bigip02. They are in an HA pair with ConfigSync, a traffic group etc. Running version 13.1.3.4.   I am trying to add a 3rd, virtual device called bi...
patonbike's avatar
patonbike
Icon for Cirrus rankCirrus
Oct 02, 2020

Thanks - the problem I have is that that when I go to add bigip03 to bigip01 as a new trusted device, bigip03 does not also get bigip02 as a trusted device. The actions are:

 

Device trust -> device trust members -> add device. This appears to work, but the result is that:

 

01 has 02 and 03 as trusted devices

02 has 01 and 03 as trusted devices.

03 only has 01 as a trusted device, so it will not sync with 02.

 

They can all reach one another on the network.

 

If I try to sync bigip01 device_trust_group to the group (Awaiting intial sync), it fails.

 

Logs in 03 read:

Disconnecting from CMI device /Common/bigip02.mydomain.com, the device is not in a trust domain.

 

How do I add 02 as a trusted device on 03? I have already made the mistake of trying to manually add bigip02 to bigip03 as a trusted device, and it caused an outage. What happened is 02 and 03 formed a pair, and 02 went "active" while 01 was also active! Perhaps if I forced both (02 and 03) offline, I could work it out by modifying the device groups, I am not sure.

 

Do I need to manually add trust certificate for 03->02 ?