I have an existing LTM VE 11.0.0 appliance deployed on ESXi 4.1.0. I have added an additional NIC to the VM; however, it is not appearing under Network -> Interfaces under the Web Administrative Console. I was hoping that it was possible to hot-add an additional NIC to the appliance since VMware supports that. Is that not possible or is there something I need to do to get the Web Administrative Console to pickup the additional interface?

Sorry no such luck on the hot add. If you add interfaces as VMXNET3 they may show up on reboot, to be sure you have to delete /var/db/mcpdb.bin before the reboot. Adding interfaces is not supported though, as they tend to get re-ordered by vSphere randomly, though in a lab you can figure things out OK, in production its much better to just run VLAN trunking with the original interfaces instead.

How would I go about configuring VLAN trunking? Assume for purposes of discussion that I have 4 different VLANs that I will need to create VIPs on. What I would like to be able to do is create a trunk with the three interfaces and then just tag the traffic with the appropriate VLAN ID so that our switches will handle the traffic appropriately. Adding an additional layer of complexity, let me explain how our network is configured. The Virtual Host where the Big IP VM resides has multiple physical NICs. These physical NICs are connected to two physical Cisco switches and configured into a single Port Channel (the switches are connected with a stacking cable). On the VM Host, we have configured a Distributed Switch (dvSwitch) with multiple Port Groups (dvPortGroup). Each of the Port Groups corresponds to a VLAN configured with the appropriate VLAN ID so that network traffic coming out of the Virtual Host is tagged appropriately and the switch then handles the rest. Where I'm confused is that since each of the three virtual NICs assigned to the Big IP VM is configured for a specific port group, and I have more port groups (with appropriate VLAN ID) than I have virtual NICs, how do I configure the Big IP appliance?

Sure, you just need to change the VLAN within the vSphere interfaces to be 4095 (which means to vSphere - pass VLAN tags directly through to the VM), then create the VLANs you need within the VE - the names don't have to be consistent with the environment outside the VE but the VLAN numbers/tags must be, and associate those VLANs with the 2 VE interfaces as you require.

Hmm, the only problem there is that vSphere doesn't allow you to specify a VLAN ID higher than 4094. I haven't tried creating a VLAN Trunk and then specifying the range of VLAN IDs I'll be using. I'll play around with that and see how that works. When I create the VLANs on the Big IP appliance, I'm confused what is meant by "tagged, available, and untagged" in reference to the interfaces. If I'm going to create a VLAN (let's call it VLAN11) and tag it with "11" as the number, do I then put all three interfaces in the "tagged" column?

Simon is correct. In vSphere the 4095 tag should be used when creating a virtual machine port group. I wrote this up a while back: http://devcentral.f5.com/Tutorials/TechTips/tabid/63/articleType/ArticleView/articleId/1082331/Whaddya-Mean-LTM-VE-Only-Has-Two-Interfaces.aspx

Adding Additional NIC to LTM VE

simon_hamilton-
Cirrus
Nov 30, 2011
It's a terminology issue.

In F5 land a trunk is an LACP aggregation group, these don't work in VE, so unconfigure any 'trunks' you have built in VE.

Within the VE you just have to add the VLAN's to the tagged interfaces and you should be in business.
Dwimmerlaik_254
Nimbostratus
Nov 30, 2011
OK, that doesn't work either. If I attempt to create a VLAN, assign it a VLAN ID and then add all three interfaces to the "tagged" column, it tells me that only one interface can be assigned to a VLAN.

I'm starting to think that the VE version can't support trunking at all, no matter how you set it up. That's disappointing because if the interface that the VLAN is assigned to goes down for any reason, there's no failover.

Of course, on the other side, because it's only a virtual NIC and that virtual NIC is actually routed over multiple physical NICs, perhaps it really isn't as big of a problem.
simon_hamilton-
Cirrus
Nov 30, 2011
Yes that's how it's supposed to be. As you point out the physical redundancy is taken care of by the host, that's why there's no need/point to running LACP inside the VM.

So if you just tag everything on one interface you are alright?
Dwimmerlaik_254
Nimbostratus
Nov 30, 2011
Yep, I'm able to create multiple tagged VLANs and assign them to a single interface. If I'd thought about this more, I would have realized that I was trying to accomplish redundancy on top of redundancy. Once I stopped and thought about it, I realized that it was pointless.

Thanks for your help, it's MUCH appreciated!
Dwimmerlaik_254
Nimbostratus
Dec 01, 2011
Just thought I'd post a quick follow-up. Everything is working great. I did run into a bit of an oddity that I can't quite figure out that I thought I'd mention. I configured all three interfaces on the Big-IP VE appliance (not the management NIC) identically. I put them all in the same Distributed Port group.

This is where it gets odd. If I configure the VLAN on the Big-IP VE appliance to use interface 1.1 "tagged", it doesn't work. If I configure the same VLAN on the Big-IP appliance to use interface 1.2 "tagged", it doesn't work. If I configured the same VLAN on the Big-IP appliance to use interface 1.3 "tagged", it works just fine.

So, the question remains, with all three interfaces configured identically, why is interface 1.3 the only one that works?
brywood_115192
Historic F5 Account
Nov 26, 2013
This may help:

SOL14684: Error Message: 01070734:3: Configuration error: vmw-compat: vlan member type must be an interface https://support.f5.com/kb/en-us/solutions/public/14000/600/sol14684.html

Forum Discussion

Adding Additional NIC to LTM VE

Recent Discussions

F5 looses the token for the first call

iRule - Url rewrite and header replace and pool selection not working

Switch ssl profile based on weak cipher detection via IRULE

full-proxy HTTP2

Decode ObjectSID from Base64-encode string

Related Content

ASM custom response page add additional information

Multiple AD Authentication

Removing Additional Settings Added After Migration

adding pool members in cli

Yubikey Authentication Modes and Azure AD integration via the APM

ABOUT DEVCENTRAL

RESOURCES

SUPPORT

PARTNERS