For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Kalpesh_48932's avatar
Kalpesh_48932
Icon for Nimbostratus rankNimbostratus
Apr 16, 2013

Exchange issues after F5 Failover testing

Hello All,

 

 

I have facing very critical issue at user level, after I perform F5 failover testing on Sunday.

 

 

I have topology like below.

 

 

2 DC = DC1 and DC2

 

each DC have 2 nexus 5548 and F5 6900 is connected to each Nexus switch at both the DC's.

 

 

so F5_1 at DC1 is connected to core1 and core2 and F5_2 at DC2 is connected to core1 and core2.

 

 

now we have layer 3 VLAN configured on Nexus and the IP of that L3 vlan is configured in failover pool on F5 to detect failure of device.

 

during failover testing, I just SHUT L3 vlan on Nexus core1 and Core2 at DC1 and failover happened to F5_2 of DC2, however I did not disconnected physical interfaces of F5_1 connected on core switches of DC1.

 

 

after failover I found some of the application stopped working and errors on HPOV showing no routes to HOST, as I had shutted L3 interface and I am having static routes configured on nexus to reach any VIP go to floating IP of F5 which is of same VLAN of which L3 i made down.

 

Does this can be the cause why i experienced failure. what is the correct method to test failover of F5 in live enviornment. I just wanted to be sure if DC1 goes down everything will work via DC2 as both F5 are in cluster.

 

 

Later I did rollback, but on Monday users started experiencing issue on the exchange. Some sessions was not working, after following steps some sessions started working.

 

 

1. Reboot of desktop/laptop

 

2. IP change of desktop

 

3. Reboot of HUB/CAS servers on both DC's

 

4. : Free-Busy information of users in DC1 is not available for user in DC2 when trying to invite them for a meeting

 

 

Can some one suggest if this issue is related ot persistence? we have configured Source Add aff persistence on F5 for this VIP.

 

 

 

config
design

1 Reply

  • Kalpesh_48932's avatar
    Kalpesh_48932
    Icon for Nimbostratus rankNimbostratus
    Apr 16, 2013

    Here I found the cause of impact.

     

     

    can someone explain me why connection is different from 2 servers of same location (DC2) to connection of VIP at DC1

     

    working server

     

     

    VIRTUAL 10.155.65.45:https <-> NODE 10.155.54.159:https TYPE any 1/0

     

    CLIENTSIDE 10.155.55.143:48278 <-> 10.155.65.45:https

     

    (pkts,bits) in = (107, 119194) out = (65, 15252)

     

    SERVERSIDE 10.155.70.156:48278 <-> 10.155.54.159:https

     

    (pkts,bits) in = (65, 15252) out = (103, 119034)

     

    PROTOCOL tcp UNIT 1 IDLE 60 (3600) LASTHOP INTERCO 54:7f:ee:5f:a9:bc

     

     

    Non-working server

     

     

    VIRTUAL 10.155.65.45:https <-> NODE 10.155.55.146:https TYPE any 1/0

     

    CLIENTSIDE 10.155.55.146:40256 <-> 10.155.65.45:https

     

    (pkts,bits) in = (47788, 60.15M) out = (26866, 3.158M)

     

    SERVERSIDE 10.155.70.157:40256 <-> 10.155.55.146:https

     

    (pkts,bits) in = (24713, 3.072M) out = (43749, 59.99M)

     

    PROTOCOL tcp UNIT 1 IDLE 3 (3600) LASTHOP INTERCO 54:7f:ee:5f:a9:bc