HA Connection lost after change Management IP address

It is expected to lose the HA setup after changing the management IP on a device that is part of HA. More importantly how was the management IP changed, I would do it in the following order: I hope this helps.

Reassign new mgmt. IP or change mgmt. IP to F5 that is in HA pair or environment

1. Create UCS file and download them to your PC from both units
2. Put the F5 in question in standby mode
3. Force it offline and KEEP it OFFLINE till you finish this process
4. Break the HA between those Units by resetting the trust on both units (they will read “standalone”)
5. Make sure that unit in question is and stays in “OFFLINE” state
6. Re-assign the new mgmt. IP and make sure you have access to it with the new IP
7. Make sure that unit in question is still and stays in “OFFLINE” state
8. Rebuild the HA with the new mgmt. IP from the active unit
9. Add the units/hostnames in the sync-failover group
10. Sync the units from the active “self” and check the “override config” check box
11. if successful they should be in sync
12. test the sync feature by creating a test http monitor on the active and sync it over
13. if that replicates it on the offline F5 it is working and you can delete the test monitor and sync
14. now you can release the unit in question from “OFFLINE” state
15. if you need to re-assign new IP on the active unit as well, perform failover so the initial active becomes standby and repeat the process above starting from step 3

FYI about trouble I got today

If you have configuration on traffic-group about "Auto failback" . you can't just re-add peer list because BIG-IP can't delete the old peer somehow.

Problem solved with delete auto failback before change MGMT IP.

Thank you very much

Did I have to reset device trust ? Or just add peer list with the new MGMT IP is enough (It will update automatically) ?

i understand you do not need to reset (i.e. add device again and it will update the existing device).

And If I have to reset device trust and create a new sync-failover group. what option I have to choose between retain authority and create a new certificate in device trust menu?

it is just whether you want to keep ca certificate (dtca.crt) or create a new one. if there are only 2 devices, either should be fine.

Last two question.

Did I have to reset device trust ? Or just add peer list with the new MGMT IP is enough (It will update automatically) ?

And If I have to reset device trust and create a new sync-failover group. what option I have to choose between retain authority and create a new certificate in device trust menu?

Thank you very much

but this have error log repeatly. "bigip-ve06 notice sod[5511]: 010c0062:5: Config digest module error: Traffic group device not found.."

it is benign which could be fixed in 12.0.

ID474149 Take care of non-self device mgmt IP address change in SOD

but this have error log repeatly. "bigip-ve06 notice sod[5511]: 010c0062:5: Config digest module error: Traffic group device not found.."

it is benign which could be fixed in 12.0.

ID474149 Take care of non-self device mgmt IP address change in SOD

After test via release offline method. It's seem work fine.

but this have error log repeatly. "bigip-ve06 notice sod[5511]: 010c0062:5: Config digest module error: Traffic group device not found.."

Is this some known issue or else?

So it's seem I must offline one box >> change mgmt >> reset all config in device management (reset device tust) and re-config a new >> release offline and failover to finish the job.

I will test in a lab and tell a result soon.

@Jie

Thank you very much. I will look into it.

@ nitass

We use 4200 v. 11.4.1 HF5 with Active/Active mode and not use hardwire failover. If we use hardwire failover (by using patch cable. not crossover cable). Is this Active/Active state will work fine like Active/Standby?

changing mgmt ip affects active/standby status because mgmt ip is embedded in failover packet as identifier.

besides forcing offline, hardware serial failover is another option (to prevent service interruption when changing mgmt ip) but platform must not be viprion and contains only two devices in group.