For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Torti's avatar
Torti
Icon for Cirrus rankCirrus
Jan 09, 2018

FQDN ephemeral nodes will not be deleted - pool member still online

Hi,

 

Im playing a little bit with fqdn nodes after upgrade to 12.1.3

 

If I add a fqdn node and add a dns entry a ephemeral node will be added with the ip. so far so good.

 

If I change the DNS entry to another ip entry, the ephemeral node is replaced by a new one with the new ip. Nice again.

 

The problem:

 

If I remove the DNS entry, the ephemeral node still exist.

 

Do I need to create a individual monitor with the DNS entry to mark the node as down, althoug the f5 itself checks the fqdn node in interval?

 

symptom:

 

a pool member is still online, if a system is replaced by another system with the same base configuration.

 

Is there a easy solution for that?

 

Thx

 

6 Replies

  • You don't need a DNS monitor. F5 makes a DNS resolution based on the configuration you setup for that. It should remove, or replace, the node/member if not getting that from the DNS query. The only situation that may cause delay here to remove is if there is a connection open to that member, as I am not sure if deletes and close the connection, or waits to finish or time out.

     

    Have a look in this solution:

     

    https://support.f5.com/csp/article/K47726919

     

  • If I remove the DNS entry, the ephemeral node still exist.

    have you tried to enable monitor logging? is there anything useful in log file (/var/log/monitors/)?

     tmsh modify ltm node  logging enabled
    
    • Torti's avatar
      Torti
      Icon for Cirrus rankCirrus

      by default, we are not monitoring nodes, only pool member.

       

      I will try it with an icmp

       

  • If I remove the DNS entry, the ephemeral node still exist.

    have you tried to enable monitor logging? is there anything useful in log file (/var/log/monitors/)?

     tmsh modify ltm node  logging enabled
    
    • Torti's avatar
      Torti
      Icon for Cirrus rankCirrus

      by default, we are not monitoring nodes, only pool member.

       

      I will try it with an icmp

       

  • by default, we are not monitoring nodes, only pool member.

    i might misremember. i thought i did see /var/log/monitors without health monitor assigned.

    anyway, i did a bit test your scenario here and it seemed okay. i am on 13.1.0.1.

    // has record
    
    [root@ve13a:Active:In Sync] config  tcpdump -nni 0.0 -s0 port 53
    tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
    listening on 0.0, link-type EN10MB (Ethernet), capture size 65535 bytes
    13:06:35.935529 IP 200.200.200.11.52454 > 200.200.200.16.53: 55672+ A? www.acme.local. (32) out slot1/tmm1 lis=
    13:06:35.936526 IP 200.200.200.16.53 > 200.200.200.11.52454: 55672*- 1/1/1 A 200.200.200.200 (81) in slot1/tmm1 lis=
    
    [root@ve13a:Active:In Sync] config  tmsh list ltm node
    ltm node _auto_200.200.200.200 {
        address 200.200.200.200
        ephemeral true
        fqdn {
            interval 60
            name www.acme.local
        }
    }
    ltm node testnode1 {
        fqdn {
            interval 60
            name www.acme.local
        }
        state fqdn-up
    }
    [root@ve13a:Active:In Sync] config  tmsh list ltm pool
    ltm pool testpool1 {
        members {
            _auto_200.200.200.200:80 {
                address 200.200.200.200
                ephemeral true
                fqdn {
                    name www.acme.local
                }
            }
            testnode1:80 {
                fqdn {
                    name www.acme.local
                }
                state fqdn-up
            }
        }
    }
    
    // no record
    
    [root@ve13a:Active:In Sync] config  tcpdump -nni 0.0 -s0 port 53
    tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
    listening on 0.0, link-type EN10MB (Ethernet), capture size 65535 bytes
    13:08:35.940014 IP 200.200.200.11.52454 > 200.200.200.16.53: 22762+ A? www.acme.local. (32) out slot1/tmm1 lis=
    13:08:35.940793 IP 200.200.200.16.53 > 200.200.200.11.52454: 22762 NXDomain*- 0/1/0 (83) in slot1/tmm1 lis=
    
    [root@ve13a:Active:In Sync] config  tmsh list ltm node
    ltm node testnode1 {
        fqdn {
            interval 60
            name www.acme.local
        }
        state fqdn-up-no-addr
    }
    [root@ve13a:Active:In Sync] config  tmsh list ltm pool
    ltm pool testpool1 {
        members {
            testnode1:80 {
                fqdn {
                    name www.acme.local
                }
                state fqdn-up-no-addr
            }
        }
    }