For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

LD24_184287's avatar
LD24_184287
Icon for Nimbostratus rankNimbostratus
Jan 26, 2015

Intermittent Dropouts for sever behind F5 LTM

Hi Everyone,

 

We are using F5 LTM IOS 11.4. Recently we have moved a server behind F5 for load balancing and we have been monitoring the server using Op-Manager monitoring tool.Monitoring server is pinging the Real IP of the server. The issue is post migration of this server to F5 we can see some intermittent dropouts on Monitoring system. The error message says "Device not responding: Probably down or busy" and after couple of alert is cleared by itself. I have checked the server and I don't see any error messages in the logs.

 

This has only been started after moving this server to F5 it was all good before. This is windows server 2008 machine and i have many more servers on the same OS on F5 and all working great.

 

The flow of packet from monitoring server to the windows servers is,

 

monitoring server to Firewall to F5 to windows server.

 

Also I don't see any blocks on the firewall.

 

Any help will be highly appreciated.

 

Thanks, LD

 

application delivery
availability
LTM
microsoft

2 Replies

  • NikhilB's avatar
    NikhilB
    Icon for Employee rankEmployee
    Jan 27, 2015

    Do you have a specific route using the management IP as the source interface or is it leaving a TMM interface? Have you taken a tcpdump to see packets leaving and returning from/to the Big-ip?

     

  • StephanManthey's avatar
    StephanManthey
    Icon for Nacreous rankNacreous
    Jan 27, 2015

    Hi LD24,

    as NikhilB already recommended, a TCPDUMP may help to find out the issue: 

    tcpdump -nnni 0.0:nnnp -s 0 -w /shared/monitoring.cap host

    It will trace all client- and serverside traffic initiated by your operations manager tool and perhaps it might make sense to add another filter (i.e. 'and host ) depending on the way you forward the monitoring traffic.

    The tcpdump syntax above is adding the so called "F5 Ethernet Trailer" data (the "nnn"-flag in the interface definition) to your raw dump file /shared/monitoring.cap and contains as well the related traffic on "peer" side (triggered by the "p"-flag in the interface definition).

    Description of and required WireShark plugin to decode the trailer data can be found here on DevCentral.

    Thanks, Stephan