For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

dragonflymr's avatar
dragonflymr
Icon for Cirrostratus rankCirrostratus
Oct 13, 2015

iCall to disable VIP and self IP

Hi,   I am pretty sure that it can be done with iCall (probably using this article as a base) but maybe there is simpler method that I failed to recall.   Scenario:   Standalone BIG-IP Aro...
availability
design
iCall
iControlREST
TMOS
steigman1978_87's avatar
steigman1978_87
Icon for Nimbostratus rankNimbostratus
Oct 16, 2015

Hi Piotr,

 

very good question. There is maybe a solution for disabling the VIP, but the combination VIP/Self IP is the challange I fear.

 

What bout the following:

 

  • Create two new pools a: Pool "gateway" - containing the gateway and a specific monitor b: Pool " upstream" - containg the upstream devices and a specific monitor.

The health check will mark those pool as available until one are all combination will fail. As soon there will be a status change of a pool (member) or node (if monitoring is selected) a messages will be generated in /var/log/ltm i.e. "notice mcpd[xyz]: 123456:7: Pool /Common/xxxx member /Common/xxxx:80 monitor status up."

 

Rather using iCall you have the abillity to execute a tmsh command by modifying the "user_alert.conf" file. Example:

 

alert local_pool_http_x_y_Z_enabled "Pool /Common/xxxx member (.*?) monitor status down." { exec command="tmsh modify net interface x.y disable" }

 

Its may woth to test it and see if it s working. But make sure that the monitoring traffic is using the management route not a route via an interface which gets been disabled based on a VS down message.

 

Cheers and regards, Patrick