Forum Discussion
NimbostratusF5 Sync Problem v. 11.4.1
Hi everyone
I've some problem about sync
I can't sync F5 module APM v.11.4.1 HF2 which reside on differrent site
When I add peer apm, Log shown
"Can't connect to CMI peer x.x.x.x, port:6699, Transport endpoint is not connected"
What does it mean ?
ps. Before add peer , we can iquery to each other. but after add peer we can't iquery anymore.
Thank you in advance
25 Replies
Hi!
Have you verified that port 6699 is allowed on the self IPs used for synchronization?
/Patrik
kridsanaCirrocumulus
before add peer , I can telnet port 4353 from local to peer after add peer, I cannot telnet port 4353 from local to peer It's strange- nitass
Employee
port 6699 is used between local mcpd and tmm (i.e. not between unit in ha pair).
sol13946: Troubleshooting ConfigSync and device service clustering issues (11.x) (CMI communication channel)
http://support.f5.com/kb/en-us/solutions/public/13000/900/sol13946.html- kridsanaI don't know how to troubleshooting before add peer , I can telnet port 4353 from local to peer. But after add peer, I cannot telnet port 4353 from local to peer It's strange Sync status is show disconnect because iquery communication can't established . Question is why iquery is working properly but after add peer it's struck. :(
nitass_89166Noctilucent
port 6699 is used between local mcpd and tmm (i.e. not between unit in ha pair).
sol13946: Troubleshooting ConfigSync and device service clustering issues (11.x) (CMI communication channel)
http://support.f5.com/kb/en-us/solutions/public/13000/900/sol13946.html- kridsanaI don't know how to troubleshooting before add peer , I can telnet port 4353 from local to peer. But after add peer, I cannot telnet port 4353 from local to peer It's strange Sync status is show disconnect because iquery communication can't established . Question is why iquery is working properly but after add peer it's struck. :(
- kridsana
Many people affected by this kind issue and still don't know the actual cause
https://devcentral.f5.com/questions/ha-problem-v1120
https://devcentral.f5.com/questions/high-availability-issue-on-bigip-1600-rel-1121-hf1
https://devcentral.f5.com/questions/configsync-issue-with-ltm-112-hf1
- kridsana
After webex session with F5 support today
We still don't know the root cause.
From my point of view,
It's may be a bug because after add F5 peer unit, Local unit can't establish iquery connection to peer unit , (peer unit also can't connect to local unit)
What strange is , we type command "tcpdump -nni Internal tcp port 4353" and try to "telnet peer 4353",... But no traffic show in tcpdump ??? It's mean F5 didn't even try to send packet from this port. But From "tmsh run /cm sniff-updates", we can see daemon want to send packet to peer unit. :(
So sync status still disconnect and we struck :(
Just update to all of you
- nitass
What strange is , we type command "tcpdump -nni Internal tcp port 4353" and try to "telnet peer 4353",... But no traffic show in tcpdump ??? It's mean F5 didn't even try to send packet from this port.
network (e.g. subnet) and route on both units are configured correctly, aren't they?
- kridsanaEverything is correct, Before add peer Everything is fine , we can telnet port 4353 to unit 2 and what is necessary. But after add peer, We can't telnet port 4353 to unit2 anymore (Then BIGIP always in disconnect sync state because it can't establish iquery connection)
- kridsanabut we can telnet port 4353 to other F5 that is not their peer , :( So strange
- nitass_89166
What strange is , we type command "tcpdump -nni Internal tcp port 4353" and try to "telnet peer 4353",... But no traffic show in tcpdump ??? It's mean F5 didn't even try to send packet from this port.
network (e.g. subnet) and route on both units are configured correctly, aren't they?
- kridsanaEverything is correct, Before add peer Everything is fine , we can telnet port 4353 to unit 2 and what is necessary. But after add peer, We can't telnet port 4353 to unit2 anymore (Then BIGIP always in disconnect sync state because it can't establish iquery connection)
- kridsanabut we can telnet port 4353 to other F5 that is not their peer , :( So strange
Have you been running tcpdumps in the firewall/routers on the way to the peer unit? I mean, if you can see the packets leaving the local interface there must be something stopping it on the way. Firewall? IPS? Bad routing configuration?
/Patrik
Tried to reload mcpd? http://support.f5.com/kb/en-us/solutions/public/13000/000/sol13030.html
Try to do a tcpdump between the two interfaces without a port filter?
Can you post your config and a network topology?
/Patrik
