For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

William_Bell_97's avatar
William_Bell_97
Icon for Nimbostratus rankNimbostratus
Dec 07, 2007

Disable VS when Assosiated Pool is down

I was wondering if there was any way to "disable" (BLACK COLOR) a VS when its member pool is marked down by a monitor. When the VS stays "enabled" but is marked down by monitors, it is still responding to the tcp handshake, but if you administratively disable the VS it does not. I really hope that someone out there has an idea, cause i have been racking my brain for hours.

 

 

William

 

 

Edit: Apparently I can't spell associated, after hours of starting at the BIP Gui.
application delivery
dev
devops
iRules

3 Replies

  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Dec 07, 2007
    Once you add a TCP profile to a virtual server, BIG-IP will answer SYNs with a SYN ACK regardless of the state of its resources. If you wanted to disable a virtual server if the pool is down, you'd need to use iControl. Check the iControl forum for more info on that.

    Else, if you want to reset the established TCP connection, you could use a rule like this:

    
 this event is triggered when a TCP handshake is complete with the client
when CLIENT_ACCEPTED {
    check if there are no active members in the default pool of the virtual server
   if {[active_members [LB::server pool]] < 1}{
       send a TCP reset to the client
      reject
   }
}

    Aaron
  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Dec 07, 2007
    That's an interesting solution. Considering the number of posts requesting the same functionality lately, you might get some traction if you make a feature request through F5 support. It could be an option on the TCP profile to drop or reset SYNs when the vip has no available resource.

     

     

    Aaron
  • William_Bell_97's avatar
    William_Bell_97
    Icon for Nimbostratus rankNimbostratus
    Dec 07, 2007
    Aaron,

     

     

    I have an open support case right now, so they are investigating things. I also asked them to check and see if there was an open CR, and if so to add our company to the list. If there is not a Feature Request CR open for this issue, the engineer says that he will submit one. If any one has more ideas I am up for trying new things.

     

     

    William