Forum Discussion

Mayank_Shukla's avatar
Mayank_Shukla
Icon for Altostratus rankAltostratus
Sep 24, 2019

bigip_add command behaviour on BIGIP DNS

Hi

 

Recently , i worked on alternate approach for bigip_add command which was to manually export and import each other's

certificate. In one case I had to export/import root and intermediate certificates as well( where device

certificate is not self signed). I never had to restart any process in BIG IP DNS which is against the f5

document recommendation.

 

I need to understand the whole phenomenon behind bigip_add .Why it gives SSL errors ? In what cases

we have to export/import intermediate and root device certificates. Whether bigip_add is self sufficient

to bring in end ,intermediate and root device certificate or some process would be manual ? Also

some more info about device certificates,please.

 

Thanks

Mayank

application delivery
BIG-IP DNS
TMOS
  • Ashfaq1's avatar
    Ashfaq1
    Icon for Nimbostratus rankNimbostratus
    Sep 24, 2019

    Hi,

    Not sure if I can answer your question completely but below is my experience.

    I have used bigip_add to re-add BIG IP devices when we renewed our devices certificate. You can use the following commands to check the status of devices trust.

    iqdump <ip of big ip device>

    For GTM, you can use tmsh show gtm iquery and make sure the trust is available between the devices on respective self -ips.

    This sure will help resolve the trust issues you will find with neighbor devices.