Forum Discussion
NimbostratusBig-IP sending Health Check to not-used Node-IP
Hello everyone,
my customer recently noticed while checking traffic on his firewall that healt checks are send from the Big-IPs internal self-ip to an IP that fits into the address range of the nodes in use on the f5.
This node ip is not known to the customer, and by searching the node table or looking in /var/log/ltm we were unable to find this ip-address. So either this node was used a while ago and the node object was deleted or the Big-IP send tries talking to this ip via 443 for some other reason.
Pings & curls send from the Big-IP fail.
Has anyone noticed something like this before? Or is there another way to see where health checks are sent?
Thanks and regards
9 Replies
MubaiwaCharles26How many partitions are on the customer's BIG-IP device?
nickLa248only the common partition
- Mayur_Sutare
MVP
Did you tried to take packet captures?
- nickLa248
im not sure what it would help me. the customer provided me the logs from the firewall showing the traffic from the self ip to this node, which would fit it beeing a health check.
is there a way to view logs of monitors? Or self ip logs?
i know of the /var/logs/monitors but this is empty
- MubaiwaCharles26
A packet capture will prove concretely if the connections being logged on the firewall and being attributed to being sourced from the F5 are indeed coming the current f5 device or another old f5 device still on the network and sending health check probes to the node ip address in question.
- MubaiwaCharles26
The node in question could have been created in a different partition on your client's BIG-IP device. Does the device have other partitions, other than the default "common" partition.
- nickLa248
no, we are only using the common partition on these devices.
WillRobbinsHave you checked iRules Or Traffic Polices ? Sometimes a node could be part of an iRule or Traffic Policy.
- nickLa248
thanks, sounded like a good idea, but i just checked all iRules & Traffic Policies but i couldnt find anything in regards to this ip
