For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Ryujin's avatar
Ryujin
Icon for Nimbostratus rankNimbostratus
Sep 03, 2024

F5 Cluster IP addresses

Im trying to find clear documentation that tells me what requirements / restrictions we have on IP addresses that are required to operate a cluster. 

 

My main question is do the various addresses assigned to support the cluster require being in the same subnet. 

 

The design that we are looking at roughly is 

 

4 Velos appliances (2 in each DC). There will be a tenant on each appliance which will be clustered together. Ideally we prefer not to stretch L2 and operate with L3 as much as possible. So i want to confirm if appliances in DC1 can reside on 1 subnet and appliances in DC2 can reside on another subnet.

Each Tenant would essentially be on a stick / one-arm for data. All traffic would come in and leave on the same interface. The F5 does not directly sit in any of the networks where servers reside. I will be using BGP & RHI to inject routes into the rest of the network to ensure traffic finds the correct active F5. 

 

for example

F5a-DC1-Ten1a = VLAN-HA - 172.28.0.1 and VLAN-Routed - 192.168.250.1

F5b-DC1-Ten1b = VLAN-HA - 172.28.0.2 and VLAN-Routed - 192.168.250.2

F5a-DC2-Ten1a = VLAN-HA - 172.29.0.1 and VLAN-Routed - 192.168.251.1

F5a-DC2-Ten1b = VLAN-HA - 172.29.0.2 and VLAN-Routed - 192.168.251.2

 

Sorry if I've not made much sense. 

2 Replies

  • For HA configuration each F5 has to have a self IP from the same subnet as well as the shared floating IP. The only exception to this is the BIG-IP DNS configuration in which each unit is a single unit and they participate in a sync-group for DNS.

    • Ryujin's avatar
      Ryujin
      Icon for Nimbostratus rankNimbostratus

      Thanks Paulius

       

      Would the same be true for a sync-only group? Could I have 2 separate clusters at each DC but then a sync-only group between both clusters even though they reside on different networks?