For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

JustCooLpOOLe's avatar
JustCooLpOOLe
Icon for Cirrocumulus rankCirrocumulus
Dec 18, 2017

Going from Untagged to Tagged VLANs

Problem:   Our Network team has recently added a new VLAN to our current Network Topology and use those addresses for our Virtual Servers on our LTMs. Our typical configuration is to use trunk tw...
application delivery
LTM
Hannes_Rapp's avatar
Hannes_Rapp
Icon for Nimbostratus rankNimbostratus
Dec 18, 2017

The work you need to do with BigIPs is 15 minutes max. I'm more concerned about possible impact due absence of dot1q interface configuration in servers or VM hypervisor.

  1. Do what S Blakely recommended on Standby unit. Update Standby unit's status to ForcedOffline as a safety measure. This works as insurance against possible unwanted Auto-Sync updates from Standby to Active unit among other things. Unlike self-only IP configuration, FloatingIP configuration is synced in HA clusters. If you or your managers are paranoid, also disable HA configuration auto-sync feature. Assuming ForcedOffline works as intended, IP address conflict with Floating IP being present in two different VLANs is unlikely to cause any harm. The unit you're working on should not consider itself owner of any Floating IPs while in Standby state and ForcedOffline state. That's the case in my experience but I give no guarantees.

  2. Changes implemented, try to ping some of the back-end servers. Using Bash shell of the Standby unit, specify the tagged VLAN as source interface. I.e 

    ping -I VLAN200 172.16.200.15
    . If you want to be extra safe, try to ping all of your backend servers that BigIP uses as nodes in any of its pools.

  3. When you're happy with results, release ForcedOffline state and fail over to that unit. Then repeat configuration changes on the unit which was previously active.

If you run into any problems, lmk. I usually respond in 24 hours if question is clear and relevant.