For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Derek_21893's avatar
Derek_21893
Icon for Nimbostratus rankNimbostratus
Aug 06, 2009

Discovery of failover peer using iControl

Hi,     I'd like to be able to discover a failover peer for an active-active or active-standby pair of LTMs using iControl. From what I can tell there is no good way to do this currently. ...
dev
devops
iControl
hoolio's avatar
hoolio
Icon for Cirrostratus rankCirrostratus
Apr 13, 2010
Would that get the failover or peer management IP address? If so, I think Derek explained why this isn't necessarily usable:

 

 

 

Well, I've already been down that road, and it may work under certain circumstances, but will not work under all circumstances. get_peer_address will give you the address of the config_sync peer, whatever that is configured to be. Many folks will use a separate VLAN for this, which is not routable, and is only for configuration synchronization between two LTMs in an HA pair, thus you could not connect via iControl to the IP address you receive from get_peer_address. Additionally, there is nothing stopping people from configuring the same config sync IP address for every HA pair they have, e.g. 192.168.0.1 and 192.168.0.2, if they use an isolated VLAN so that they are not routable. There's no real reason you couldn't do this (and I've seen it done). So in this scenario, you could end up with two different individual LTMs with the exact same failover IP address, and no real way to tell which one is the right config sync peer.

 

 

 

Aaron