Create a Wide-IP in the "Member list" does not appear any virtual server to associate.

Hi Rodrigo,

as NikhilB already pointed out, there needs to be an internal established communication between the LTM and GTM component in your LinkController.

The internal communication happens via the SSL-encrypted iQuery protol which is based on certificate trust.

It is recommended, to create long lasting (3650 days) unit specific device certificates (by default it is set to common name "localhost.localdomain") and to add it to the list of trusted device certificates as well (WebUI: System >> Device Certificates >> Trusted Client Certificates).

Afterwards you run the "

bigip_add

" and "

gtm_add

" scripts versus the local device.

Run "

tail -f /var/log/gtm

" to check for successful iQuery communication.

Thanks, Stephan

Hi NikhilB and Stephan, thank you for your help. I check for the certificate at (WebUI: System >> Device Certificates >> Trusted Client Certificates). There a certificate that lasts until 2024, so I think this is ok. But when I issued the command bigip_add I got the following error:

 

[root@bigip1:Active:Standalone] config bigip_add Retrieving remote and installing local BIG-IP's SSL certs ... Enter root password for if prompted ssh: mkdir -p /config/big3d; if [ -e /config/httpd/conf/ssl.crt/server.crt ]; then cat /config/httpd/conf: Name or service not known ERROR: Can't read remote cert via /usr/bin/ssh.

 

==> Done <==

 

Is there something that I'm missing?

 

Regards,

 

Hi Rodrigo,

both commands will be used versus a local self IP address (not a floating self IP address!).

The self IP needs to be in "PortLockDown = allow-default" state.

Now you run "

bigip_add 

" to internally exchange certificates.

Now you run "

gtm_add 

" to finish the internal GTM related configuration exchange. To validate the iQuery communication you can use "

iqdump 

".

Track the GTM log facility by running "

tail -f /var/log/gtm

" in a second console.

If you are running your LinkController as redundant pair, this needs to be done between both units as well.

That´s why I mentioned the requirement for unit specific device certificates. Using the default "localhost.localdomain" certificate on both machines makes things even more complicated.

I haven´t touched the LinkController for a while. But it was always good practice, to create a "default_gateway_pool" and use it as next hop for default gateway configuration in the network settings. This used to trigger the creation of a "datacenter" object automatically, which is not available from the LinkController´s WebUI.

Thanks, Stephan