Configuring HA on Azure F5 LTM 'Good'...

Hi Alastair,

Not sure if you've had any luck so far, but the only method of utilizing an HA pair of F5s in Azure so far is to use the Azure LBs to select the F5 device for the connection.

If the F5s are receiving connections directly from the perimeter this is easy as all you need is a "Public" LB configured. Both F5s share the same public IP (that of the Azure LB) but have different virtual server/self/mgmt. IPs. This basically creates a true Active/Active scenario where either F5 can receive the traffic. The Azure LB does have a client sticky feature (not dissimilar to F5s source address persistence) so one user can persist through one F5 for a given period.

If you are NAT'ing through another perimeter security device through to the F5s in Azure, then you would need to look into creating an internal Azure LB to carry out the same as above. I'm testing this at the moment so will let you know on the success of this once known.

(NOTE: I have heard rumours that full HA may be available in Azure eventually)

Hello Artiom,

When following you guide in github and issueing this connand

Code
modify cm trust-domain root ca-devices add { 192.168.x.y } name bigip02 username user password pass

I get this error:

Unexpected Error: "Timed out while waiting for the device to respond"

In /var/log/ltm I see:

Any reason why?

Noam.

The current TMOS version in Azure Marketplace should be v13.0.

Please check the GitHub repository again - I updated the commands about a week ago.

Hi, Thank you for your reply

How do I check the TMOS version?

When I run this command in BIGIP in Azure:

Code
show sys version

I get this output:

Code
Sys::Version
Main Package
  Product     BIG-IP
  Version     12.1.0
  Build       1.0.1447
  Edition     Hotfix HF1
  Date        Wed Jun  8 13:41:59 PDT 2016

Hotfix List
ID590345-1    ID582374-1  ID581834-5  ID592354    ID591908-2  ID585905-1
ID569121-1    ID569467-5  ID591894-2  ID547053-1  ID594302-1  ID583631-2
ID554713-2    ID592854-1  ID576478    ID588399-1  ID592682-1  ID590795-1
ID590779      ID544477    ID591918-2  ID588140    ID591039    ID590428-1
ID591806-8    ID587791-1  ID590601-2  ID592699-3  ID565137    ID531979-6
ID590993      ID592363    ID591881-1  ID582629-1

When checking again in the github I see that I need to issue this command:

Code
tmsh modify /cm trust-domain add-device { device-ip 192.168.x.y device-name BIGIP02 username USER password PASS }

And the result is:

Code
Syntax Error: "device-ip" unknown property

Any idea?

Regards,