For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

patrickdaj_7040's avatar
patrickdaj_7040
Icon for Nimbostratus rankNimbostratus
Nov 07, 2012

GTM Probes in multi-site DMZ environment

Is it possible to get each GTM to send its own probes and not delegate to other big3d processes running on other devices?

 

In the past we have used GSLB probes from the DMZ in Datacenter A to validate that the entire path (routing,firewall rules, and server) were available (see below).

 

DCA DCB

 

GTMA -> Internet -> FWB -> LTMB -> VIPB:80

 

So essentially you would end up doing the same thing from GTMB but it would be much simpler.

 

DCB

 

GTMB -> LTMB -> VIPB:80

 

We have discovered firewall and routing issues in the past by utilizing this dual probe approach. Seems like the GTM doesn't support this since it delegates probes to a device in the same DC as the VIP being probed.

 

Is that true or is there some way to accomplish this?

 

The goal would be to utilize iquery or the bigip monitor for each LTM but also to have a port 80 check from each GTM to each VIP. Thus allowing a VIP to be up for GTMA and not GTMB due to the difference in the path.

 

config
design

5 Replies

  • JRahm's avatar
    JRahm
    Icon for Admin rankAdmin
    Nov 08, 2012
    absolutely, you can set up prober pools in v11+ that allows you to control what devices are probed by what pool. You can restrict that to just the GTM if you like.
  • dan_19334's avatar
    dan_19334
    Icon for Nimbostratus rankNimbostratus
    Mar 11, 2013
    We have found that Prober Pools do not work on Bigip objects they only work for Generic Hosts. We have tested this on v11.2 and while it will let you assign a prober pool to a Bigip devices it has no affect and all GTMs will still probe the LTM. If you assign a prober pool to a Generic Host this functionality works but then you lose the auto discovery and benefits iquery.

     

     

    Has anyone else experienced this?

     

     

  • Josh_41258's avatar
    Josh_41258
    Icon for Nimbostratus rankNimbostratus
    Mar 14, 2013
    You can also do this in v10, if I am understanding you correctly.

     

     

    Under Global Traffic -> Data Centers -> Servers, take a look at the "Statistics Collection Server" The default value for this is "Auto Select," which will use any device in the sync-group to "probe" devices. However, you can manually specify the device here that you want to be used for probes.

     

     

    Josh
  • Sec-Enabled_658's avatar
    Sec-Enabled_658
    Icon for Cirrostratus rankCirrostratus
    Mar 14, 2013
    Josh,

     

     

    I'm running a 10.2.4 box and I do not see the "Statistics collection server" under Global Traffic -> Data Centers -> Servers

     

    Can you tell what the path is for that? Also, I think what Dan is saying is that the functionality exists to delegate for non-bigip objects, but doesnt really exists for bigip objects (ex. LTM) because you cant use the auto-discovery feature.