Forum Discussion
NimbostratusI need help in completing this configuration
Hi my company bought a service contract with f5 the code is F5-SVC-BIG-PRE-L1-3, im trying to configure two BIG IP LTM devices but it seems after i have done all the configurations i cannot ping any of the self ip addresses or the virtual servers. My setup is like this CiscoASA G0/1 & G0/2 (192.168.15.5) ! ! --------------------------------------- ! ! ! (floating 192.168.15.1) ! bigip1 (ext-vlan192.168.15.2) bigip2 (ext-vlan192.168.15.3) ! ! ! (floating 10.10.168.1) ! bigip1 (int-vlan10.10.168.2) bigip2 (int-vlan10.10.168.3) ! ! ----------------------------------------
! ! Cisco switch ! ! HP-SERVER1 (10.10.168.13)---------------HP-SERVER2 (10.10.168.14)
Cisco ASA G0/1 & G0/2 bundled interfaces with IP Address 192.168.15.5. After configuring all the basic configs i cannot get my servers to ping any of my self IPs or even the Cisco ASA. I have also uploaded my qkview on ihealth case_number_C1431792_support_file(1).tar.
If you can help me please you can email me on kudakwashet@compulink.co.zw you can include the steps to configuring the device to basic connectivity even to get my data centre up my situation is critical, i have configured the rest of the network equipment im now only left with the BIG IPs. I have gone through a lot of the documentation found online but the staff is very confusing.
Regards
Kudakwashe Tayo
36 Replies
kudakwashet_154Yes i was running pings to IP address 10.10.168.2 which is the internal interface on the BIG IP i was working on, and yes interfaces 1.2 and 1.3 are my production interfaces.
Here is the output for vlans you requested
login as: root
Using keyboard-interactive authentication.
Password:
Last login: Tue May 20 13:40:20 2014 from 10.10.168.14
[root@imm:Active:In Sync] config tmsh list net vlan
net vlan HA {
if-index 1072 interfaces { 1.1 { tagged } } tag 4092}
net vlan external {
if-index 1056 interfaces { 1.3 { } } tag 4093}
net vlan internal {
if-index 1040 interfaces { 1.2 { } } tag 4094}
[root@imm:Active:In Sync] config
and on the Cisco switch i have vlans 10,20 and 50. The 10.10.168.0 network is in vlan 50 on the Cisco switch.
Cory_50405Noctilucent
The tags on the LTM and the Cisco switch need to match. Change the tags on the BIG-IP to match that of your Cisco switch or vice versa.
- kudakwashet_154
This is the configuration now still i cannot ping, i have tried to change the interface states on the Cisco switch from trunk to access and even made vlan 50 the native vlan still no luck.
login as: root
Using keyboard-interactive authentication.
Password:
Last login: Tue May 20 13:56:15 2014 from 10.10.168.14
[root@imm:Active:In Sync] config tmsl list net vlan
-bash: tmsl: command not found
[root@imm:Active:In Sync] config tmsh list net vlan
net vlan HA {
if-index 1072 interfaces { 1.1 { tagged } } tag 4092}
net vlan external {
if-index 1056 interfaces { 1.3 { tagged } } tag 1}
net vlan internal {
if-index 1040 interfaces { 1.2 { tagged } } tag 50}
[root@imm:Active:In Sync] config
- Cory_50405
I would suggest that you turn the interfaces on Cisco switch into access ports. The vlans that you use (10, 20, and 50) should correspond to the interfaces on the LTM that they connect to.
For example, if the vlan 10 access port on the switch connects to interface 1.2 on your LTM, then assign tag 10 to the vlan which is assigned to LTM interface 1.2, and change it from tagged to untagged. Do this with all of your LTM interfaces.
Since you have an individual switch port for each LTM interface, these should be access/untagged (Cisco/LTM) interfaces.
- kudakwashet_154
Now im able to ping 10.10.168.3 which is the internal interface for the standby BIG IP but i cannot ping 10.10.168.2 the active BIG IP internal interface. i had to change port lockdown to allow all from allow default that when i was able to ping.
I have conpared the configurations it seems averything is the same on both devices
- Cory_50405
Have you ensured that all LTM (active and standby) vlans are untagged with the proper vlan tag, and all Cisco switch ports connecting to both active and standby LTMs are access ports in the proper vlans?
Port lockdown 'allow default' should be configured on each of your self IPs.
- kudakwashet_154
All vlans are untagged with the proper vlan tag on both the LTMs and all ports are access on cisco switch and the vlan tag on all devices for this network is vlan 50
- Cory_50405
Now that you have some communications working, try doing a tcpdump on your active LTM for its internal self IP (10.10.168.2). Try pinging the servers and the standby LTM. Also ping from the servers to the LTM self IPs. Exactly which communications aren't working?
- Cory_50405
Yeah, from those captures I'm not seeing your active LTM respond to ARP requests for .2. That indicates there's a layer 2 (or 1) problem. Possibly things aren't cabled as you expect.
- kudakwashet_154
i have checked the cabling is okay
- Cory_50405
If you're completely sure the cabling is connected properly, then it has to be a configuration issue on your active LTM, the Cisco switch ports that it connects to, or both. ARP requests for .2 (your active LTM self IP) aren't being answered, and when .2 is sending ARP requests for server IP addresses, it gets no responses.
