BigIP management not accessible via HTTPS & SSH

Answered in this post (Click here).

 

 

Aaron

The hyperlink "(Click here)" does not work for me. I tried typing in the URL it refers to also, no luck.

 

That's odd... it works for me?

 

 

 

http://devcentral.f5.com/Default.aspx?tabid=53&forumid=31&tpage=1&view=topic&postid=26716

 

 

Hello,

 

 

I upgraded by BigIP 3400 LTM from TMOS 9.3.0 to TMOS 9.4.5, two days back. After upgrading the unit to 9.4.5 build, I was able to access the BigIP via HTTPS and SSH, however after restoring the backed up config file (.ucs) I was unable to access the GUI and after few minutes even I could not SSH. The ping responses also failed at the same time!!!

 

 

Strange thing is I can very well access the BigIP from console!!! When I ping the remote PC connected to mgmt. network of BigIP I see the MAC address entry in the ARP cache of eth0 but cannot see any ICMP reply from remote end. Suspecting a problem in remote PC I also tried to connect to the Mgmt port to my laptop with cross cable and appropriate IP address & subnet masks (configured on the laptop), but still unable to login via SSH and HTTPS.

 

 

Surprisingly, the other peer BigIP that was upgraded to 9.4.5 from 9.3.0 is working well. It is very well accessible via console, HTTPS and SSH.

 

 

What could be the probable issue here?

 

 

Appreciate your inputs on this. Thanks in advance.

 

 

Sagar

 

sagar.brit@gmail.com

 

sshah@venturiwireless.com

 

--------------------------------------------------------------------------

 

UCS files are not designed to be cross-version, so I'm actually surprised that the other one works after loading a 9.3.0 config. There's probably something in the config that is failing to load because the syntax changed between 9.3.0 and 9.4.5. You could try manually doing a bigpipe load on the command line and see if you can tell where it fails, and then manually edit the file to remove the offending line.

 

 

The proper way to upgrade (should be documented in the release notes) is to save a current config file as /config.ucs

 

 

 

bigpipe config save /config.ucs

 

 

 

 

and then run the local-install im file. It will then give you the option to roll the previous config forward. Then you don't need to restore a config.

 

 

Hope that helps,

 

Denny

 

--------------------------------------------------------------------------

 

As Denny suggests, ideally you roll forward the existing UCS to the new version during the upgrade. If one unit is working, you could reset the configuration to defaults and then manually configure the basics including the VLAN and self IP used to sync the config. You could then sync the config from the good unit to the bad one. This might be quicker than trying to manually hack the 9.3.0 config files into the expected 9.4.x format.

 

 

Aaron

 

--------------------------------------------------------------------------

 

Hey guys thanks a ton for sending in your responses... My local F5 support partner in India mentioned they've seen similar problems with 9.4.x releases. I rolled over the config and tried reconfiguring the box still it worked for few hours but later on the management access went away. However, following solution seems to be working -

 

 

ip rule add from lookup 245

 

echo "ip rule add from lookup 245" >> /config/startup

 

 

Hope this helps anyone who runs into problems later on in future with mgmt. access using 9.4.x TMOS releases.

 

 

Thanks.

 

Sagar.

 

 

--------------------------------------------------------------------------

 

 

 

 

Aaron