iRule after upgrading 9.1.X to 9.3.x

You'll need to test. If you don't have a test environment, upgrade the standby unit in your HA pair and failover to it. If there are problems, just fail back. If not, upgrade the other one. If you don't have an HA environment, I'd suggest upgrading to one of the boot slots not currently used in production so you can switchboot back to the current version if you experience problems.

citizen_elah , Thank you for your advise.

 

I don't have a test environment, the 2 BIG-IP systems ( HA pair) are in a production environment.

 

So I will have to do the upgrade on live.

 

 

But I have another question, a more general about upgrading HA pair from 9.1.X to 9.3.x.

 

 

This is how I want to proceed ;

 

 

1. Upgrade the standby unit and failover to it.

 

(9.1.2 --> 9.3.1 + HF1 ).

 

2.upgraded unit becomes Active unit.

 

 

so after the above actions, i have the below setting :

 

active unit ( version 9.3.1 + HF1) and standy unit ( version 9.1.2 ).

 

 

I plan to keep the above configuration for about 1 week, then if there are problems, I failover to standy unit which is still version 9.1.2.

 

 

HA configuration(active-standby) with 2 differents versions of BIG-IP will work fine ??

 

Active ( 9.3.1 ) and Standby ( 9.1.2) HA is possible ??

 

 

thank you.

 

 

Sako.

 

 

 

 

 

I usually do the same concerning upgrade processes (upgrade standby and failover to it). My upgrades, however, have never been split across major versions. I imagine you will be fine to do this with stateless traffic as the boxes should function fine as an HA pair layer3 and down on different versions. My concern would be whether a 9.3 and a 9.1 pair would exchange state and persistence information correctly, and whether or not a config sync would work.

 

 

Perhaps some of the consultants have a better answer here?

You will not be able to sync configs and stateful failover may or may not work. I would not run in this configuration for any longer than needed to validate that the 9.3 box works as required.

 

 

Denny

Hi,

 

 

We have very similair situation. Soon i'll upgrade 9.1.3 -> 9.3.1.

 

One thing you have to remember, that mirroring should be disabled between HA boxes.

 

p.s. What's changed in 9.3.1 HF1? I see only 9.3.1 release on f5.com.

 

Hotfixes are only available by opening a support case for issues that the hotfix specifically addresses.

 

 

Denny

it's weird, that during 1 week since final release there's already a HF for 9.3.1.

 

but any way thanks for info,

according to my support vendor(in Tokyo, Japan), after upgrading to version 9.3.1, you still need to apply HF1 if you are using SSL session ID persistence.

 

it's reported that SSL session ID persistence breaks on LTM 9.3.x. unless you install the hot fix.

 

 

Futhermore,even upgrading to v9.3.1 + HF1, the LTM might still have problems or know issues with Network Failover in HA configuration that is in a Active-Standby configuration, failover takes about 40 seconds , so if your HA pair is in an environment where 40 seconds is untolerable,don't setup Network Failover.

 

 

Sako.

hi,

 

I'm upgrading HA pair 9.1.2 to 9.3.0 this week.

 

i have one concern.

 

I will upgrade standby system and failover to it.

 

during fail-over, will the [FORCE TO STANDBY] on active do the failover ? will it work ?

 

 

That is i will do [FORCE TO STANDBY] on active system(9.1.2) and failover to newly upgraded standby[9.3.0].

 

the HA pair is hardwire-synchronized.

 

 

will FORCE TO STANDBY work between 2 different majour versions ? ( 9.1.2 and 9.3.0 ) ???

 

 

thank you.

hi all,

 

This is to let u know that i have found answers to my question by working in a lab case.

 

 

the question was :

 

will FORCE TO STANDBY work between 2 different majour versions ? ( 9.1.2 and 9.3.0 ) ???

 

 

The answer is yes.

 

after upgrading standby system(9.1->9.3),I did [force to standby] from active system( which was 9.1.2), and it worked fine.

 

 

however configsync between different major versions doesn't work.

 

 

Thanks,

 

 

Sakolan