Forum Discussion

Dave_Pisarek's avatar
Dave_Pisarek
Icon for Cirrus rankCirrus
Apr 07, 2020

ASM sync group and LTM sync group

All,

I have configured a HA pair where I have one device group for sync/failover and then a sync only for ASM. I configured ASM to use the asm sync only group as auto and left the sync/failover group to manual which will be used for LTM changes. When I create a new ASM policy it does sync over automatically as expected by the device goes into a changes pending status for the sync/failover group, I made no changes to LTM or anything outside of ASM, so why would this go into changes pending? To get the HA pairs back in sync I need to sync the sync/failover group. Is this an expected behavior when ASm has it's own sync only group?

ASM Advanced WAF
LTM
security

2 Replies

  • Ivan_Chernenkii's avatar
    Ivan_Chernenkii
    Icon for Employee rankEmployee
    Apr 08, 2020

    Hello Dave,

    As I see, this is expected behavior, but I agree that such behavior is not very good.

    Sync/failover group goes into changes pending state, because in case of creation ASM policy we also create "ASM policy" entity in LTM to operate with it together with LTM entities (VS, L7 Policy and etc.)

    This shouldn't happen if you create some entity in ASM policy (e.g. new parameter).

    Thanks, Ivan

  • Samir's avatar
    Samir
    Icon for MVP rankMVP
    Apr 08, 2020

    Agree with @Ivan. This is known bahavior of ASM device. ASM policy learn few parameters based on the policy setting (Automatic n manual mode).

    I will not suggest auto sync config for ASM​. It many consume extra memory.

    ​

    Thanks​