For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Mark_Cloutier's avatar
Mark_Cloutier
Icon for Nimbostratus rankNimbostratus
Sep 26, 2018

Issue with NTP, odd tcpdump behavior

I have two new HA pairs of i5800s running version 13.1.1 and ntp isn't working. I know I may have firewall rules that have yet to be implemented, or not implemented properly, but in troubleshooting ...
application delivery
BIG-IP
Leonardo_Souza's avatar
Leonardo_Souza
Icon for Cirrocumulus rankCirrocumulus
Sep 26, 2018

There is a major hardware difference between a 4000 and i5800, as 2000/4000 don't have a switchboard.

 

https://support.f5.com/csp/article/K14686

 

However, I don't think is the problem you are seen.

 

Do you have route domains?

 

Can you take the tcpdump with -s0 and nnn?

 

Here are some helpful links:

 

https://support.f5.com/csp/article/K411 https://support.f5.com/csp/article/K13637 https://support.f5.com/csp/article/K6546

 

Latest versions of Wireshark have the F5 plugin integrated, you just need to enable. Save the capture to a file and open with the Wireshark.

 

https://devcentral.f5.com/d/wireshark-plugin

 

"Comment made 5 months ago by Jason Cohen F5 As of Wireshark 2.6 (rel. 4/24/2018) the f5ethtrailer is included as a built-in dissector. Wireshark 2.6.0 incorporated the 1.11b version of the dissector.

 

https://www.wireshark.org/news/20180424.html

 

It is disabled by default. To enable it, from the menu select "Anyalyze" : "Enabled Protocols...". Then search for f5ethtrailer and enable the dissector."