For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

dragonflymr's avatar
dragonflymr
Icon for Cirrostratus rankCirrostratus
Oct 13, 2015

iCall to disable VIP and self IP

Hi,   I am pretty sure that it can be done with iCall (probably using this article as a base) but maybe there is simpler method that I failed to recall.   Scenario:   Standalone BIG-IP Aro...
availability
design
iCall
iControlREST
TMOS
steigman1978_87's avatar
steigman1978_87
Icon for Nimbostratus rankNimbostratus
Oct 16, 2015

Hi Piotr, i´ve done only little things with iCall and yes, there is no dependence on log messages.

 

With regards to your question: "seems that there is no way to disable just self IP". What about to shift the self ip´s into a "pseudo" VLAN in case gateway/upstream device is not responding?

 

Disabling the VIP can be achieved by issuing the following command: “modify ltm virtual-address x.x.x.x enabled no”

 

With regards to the pools: As far as I understood the gateway/upstream pools will be only configured to check a status of some services i.e. gateway reachable (yes/no) – upstream reachable (yes/no). If any of the monitor is replying with a “no” -> “down” some kind of action should follow. Action A = Disable VIP (no ping or ARP reply) -> “tmsh modify ltm virtual-address x.x.x.x enabled no” Action B = Disable external self IP and internal self IP (simultaneously) -> Shift self ip´s into a pseudo - non productive vlan –> “tmsh modify net self x.x.x.x vlan 123”

 

Would that make sense? Not sure if I understood it right :-)

 

Best regards, Patrick