Forum Discussion

Raphael_Arenas_'s avatar
Raphael_Arenas_
Icon for Nimbostratus rankNimbostratus
Jan 20, 2011

Can´t connect active element

Hi Masters,

 

 

 

I have a long time problem that is driving me crazy.

 

 

 

We have 2 LTM 3400 working in active/standby mode. There are 2 vlans, one for the internal network and the second vlan to the external network.

 

 

 

Well, the problem is that I can´t connect directly to my active element. If I ssh to the active IP I receive a timeout message, I must to connect to the standby element first and start the ssh connection to the active element.

 

 

 

The problem doesn´t affects just the ssh connection, but all kinds of connections that I try to the active element, and the most critical is that I can´t get the SNMP traps from it.

 

 

 

We investigated all the Firewall Rules and logs, but no usefull information was found.

 

 

 

Another issue that make-me believe that the error isn´t in the firewall is that, if a failover occurs the scenario keeps, for example:

 

 

 

The IP of active element is: 10.23.129.252 and the IP of standby element is 10.23.129.253.

 

 

 

In this case, I can access the 10.23.129.253 without problems, OK.

 

 

 

If I try the access on 10.23.129.252 I receive timeout error.

 

 

 

But, if a failover occurs I got the same issue: I will got the access to 10.23.129.253 (now, standby) and won´t be possible access directly the 10.23.129.252 (now, the active element).

 

 

 

The structure of my solution is simple, I don´t have many Irules or Virtual Servers, but I have sure that no one of that is denying this access.

 

 

 

Somebody has faced this before? Please help me!

 

 

 

Thanks in advance and sorry my bad english.

 

 

 

Regards,

 

 

 

Raphael Arenas

 

  • Have you checked your port lockdown configuration? That would be the first place I would look.

     

     

    -Matt
  • Yes, I checked. The port lockdown configuration is setup to "Allow All" in both elements.

     

     

    Thanks!

     

  • I'd bounce this off of support. I've never seen a message saying I need to connect to a different unit before.