Forum Discussion

nickLa248's avatar
nickLa248
Icon for Nimbostratus rankNimbostratus
May 20, 2025

Big-IP sending Health Check to not-used Node-IP

Hello everyone,

 

my customer recently noticed while checking traffic on his firewall that healt checks are send from the Big-IPs internal self-ip to an IP that fits into the address range of the nodes in use on the f5. 

 

This node ip is not known to the customer, and by searching the node table or looking in /var/log/ltm we were unable to find this ip-address. So either this node was used a while ago and the node object was deleted or the Big-IP send tries talking to this ip via 443 for some other reason.

Pings & curls send from the Big-IP fail.

 

Has anyone noticed something like this before? Or is there another way to see where health checks are sent?

 

Thanks and regards

bigip ve
bug
monitor
node
pool

9 Replies

  • WillRobbins's avatar
    WillRobbins
    Icon for Nimbostratus rankNimbostratus
    May 20, 2025

    Have you checked iRules Or Traffic Polices ? Sometimes a node could be part of an iRule or Traffic Policy. 

    • nickLa248's avatar
      nickLa248
      Icon for Nimbostratus rankNimbostratus
      May 22, 2025

      thanks, sounded like a good idea, but i just checked all iRules & Traffic Policies but i couldnt find anything in regards to this ip

  • MubaiwaCharles26's avatar
    MubaiwaCharles26
    Icon for Nimbostratus rankNimbostratus
    May 21, 2025

    The node in question could have been created in a different partition on your client's BIG-IP device. Does the device have other partitions, other than the default "common" partition. 

    • nickLa248's avatar
      nickLa248
      Icon for Nimbostratus rankNimbostratus
      May 22, 2025

      no, we are only using the common partition on these devices. 

    • nickLa248's avatar
      nickLa248
      Icon for Nimbostratus rankNimbostratus
      May 28, 2025

      im not sure what it would help me. the customer provided me the logs from the firewall showing the traffic from the self ip to this node, which would fit it beeing a health check.

      is there a way to view logs of monitors? Or self ip logs?

      i know of the /var/logs/monitors but this is empty

      • MubaiwaCharles26's avatar
        MubaiwaCharles26
        Icon for Nimbostratus rankNimbostratus
        May 28, 2025

        A packet capture will prove concretely if the connections being logged on the firewall and being attributed to being sourced from the F5 are indeed coming the current f5 device or another old f5 device still on the network and sending health check probes to the node ip address in question.