Forum Discussion

ChotaUdhav_3655's avatar
ChotaUdhav_3655
Icon for Nimbostratus rankNimbostratus
Jul 10, 2018

HA Pair is Active / Active and In Sync

I have two BIGIP-LTM which I have built for my HA Lab, but the problem is both of them are in "Active" and "In Sync".

 

I have verified:

 

  1. The device group is "sync-failover"

     

  2. The device trust has been formed - they are peers

     

  3. Both of them are in SYNC

     

The device-group are:

 

  1. Ansible-Device-Group
  2. device_trust_group
  3. gtm
  • Device Groups on BIGIP1

    root@(BIGIP1)(cfg-sync In Sync)(Active)(/Common)(tmos) list cm device-group 
    cm device-group Ansible-Device-Group {
        devices {
            BIGIP1.lab.local { }
            BIGIP2.lab.local { }
        }
        type sync-failover
    }
    cm device-group device_trust_group {
        auto-sync enabled
        devices {
            BIGIP1.lab.local { }
            BIGIP2.lab.local { }
        }
    }
    cm device-group gtm {
        devices {
            BIGIP1.lab.local { }
        }
    }
    

    
    Device Groups on BIGIP1
    
    root@(BIGIP2)(cfg-sync In Sync)(Active)(/Common)(tmos) list cm device-group 
    cm device-group Ansible-Device-Group {
        devices {
            BIGIP1.lab.local { }
            BIGIP2.lab.local { }
        }
        type sync-failover
    }
    cm device-group device_trust_group {
        auto-sync enabled
        devices {
            BIGIP1.lab.local { }
            BIGIP2.lab.local { }
        }
    }
    cm device-group gtm {
        devices {
            BIGIP2.lab.local { }
        }
    }
    
  • Do you have more than one traffic-group on the devices? Can you paste the output of 'show cm traffic-group all-properties'?

     

    What happens when you you try to force one of the devices into standby?

     

  • Hello tatmotiv,

    Thank you for taking the initiative for helping.

    Here is the output you asked,

    BIGIP1

    CM::Traffic-Group       
    Name                      Device            Status   Next    Load  Next Active  HA Group  Times Became  Last Became
                                                         Active        Load                   Active        Active
    ----------------------------------------------------------------------------------------------------------------------------
    traffic-group-1           BIGIP1.lab.local  active   false   1     -            -         22            2018-Jul-10 10:59:24
    traffic-group-1           BIGIP2.lab.local  offline  false   -     -            -         0             -
    traffic-group-local-only  -                 -        -       -     -            -         -             -
    
    

    BIGIP2

    ----------------------------------------------------------------------------------------------------------------------------
    CM::Traffic-Group       
    Name                      Device            Status   Next    Load  Next Active  HA Group  Times Became  Last Became
                                                         Active        Load                   Active        Active
    ----------------------------------------------------------------------------------------------------------------------------
    traffic-group-1           BIGIP1.lab.local  offline  false   -     -            -         0             -
    traffic-group-1           BIGIP2.lab.local  active   false   1     -            -         8             2018-Jul-10 10:46:14
    traffic-group-local-only  -                 -        -       -     -            -         -             -
    
    
    
  • Have you configured the Failover address and config sync address on each device?

     

    Make sure they are configured and can communicated between the F5 devices ok.

     

  • Looks like it is either the devices don’t trust each other or they cannot communicate the configured Failover VLAN and IP addresses.

     

    You can test connection from the command line, under Bash SSH from bigip1 to the failover address configured on bigip2. If this work both ways connection should be good. If not double check network configuration and the SelfIP port security config is set to Allow All.

     

    Once happy with connection setup the trust again, on bigip1 go to Device Management > Device Trust, and then Peer List.

     

    Click Add and use the failover IP address of bigip2 and admin username and password.

     

    You may find you need to remove bigip2 from the Device Group and delete it as a trusted peer before doing this.

     

    Let us know if that works or not.

     

  • Hi,

     

    First of check the communication channels for trust and failover, so connect in SSH then try to ping HA selfIP (don't forget to set you self IP for HA to allow all for service).

     

    Then you have to define which interface should be used for the sync, failover an moirrorin part on each device:

     

    on each device you have to go to : Device Management ›› Devices ›› devicename - then set ConfigSync, failover Network, Mirroring - for failover network setting you can add management also.

     

    Keep me update