For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Chris_15609's avatar
Chris_15609
Icon for Nimbostratus rankNimbostratus
Jul 19, 2011

LTM ConfigSync Failure

Hey Folks

 

 

So i'm having an issue with a couple of LTM v9.4.7's that i have in our pre-production environment. the active node has been around for ages and has all of our virtual server information etc.. and has been working fine.

 

Our passive node was recently upgraded to v10.2 for testing purposes and i've now gone through the process of downgrading that unit again to bring it in line with the Active.

 

I configured the device to match the active (with obvious exceptions to things like the self-ips) and attempted to sync the 2 devices. What i noticed is that the ConfigSync status shows OK on both devices but the only actual config that populated to the passive node is the SSL Certificate information, nothing else.

 

 

I managed to do some google homework and attempted to run the Bigpip Config Sync Pull and got the following results.

 

 

 

---------------------------------------------------

 

[root@OA-PP-LB2:Standby] config bigpipe config sync pull

 

Configsync Mode: Pull

 

Saving temporary UCS on peer...

 

Downloading UCS from peer...

 

Saving active configuration...

 

Current configuration backed up to /var/local/ucs/cs_backup.ucs.

 

Product : BIG-IP

 

Version : 9.4.7

 

Hostname: UCS : OA-PP-LB1

 

System: OA-PP-LB2

 

Installing shared configuration on host OA-PP-LB2

 

Installing...

 

Installing ASM configuration...

 

Reloading configuration... It may take a few minutes...

 

Reading configuration from /defaults/config_base.conf.

 

Reading configuration from /config/bigip_base.conf.

 

Reading configuration from /config/bigip_sys.conf.

 

Reading configuration from /usr/bin/monitors/builtins/base_monitors.conf.

 

Reading configuration from /config/profile_base.conf.

 

Reading configuration from /config/daemon.conf.

 

Reading configuration from /config/bigip.conf.

 

BIGpipe parsing error (Line 893):

 

012e0021:3: The requested attribute () for 'rule' is invalid.

 

Loading ASM configuration...

 

/tmp/configsync.spec: Error installing package

 

Config install aborted.

 

Error running config sync pull.

 

BIGpipe parsing error:

 

01110001:3: Error running config sync pull [root@OA-PP-LB2:Standby] config

 

---------------------------------------------------

 

 

 

 

 

Not sure where i should be going from here or how to further test - any guidance would be great.
basic
getting started
new to f5

9 Replies

  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Jul 20, 2011
    What's in the bigip.conf on line 893? You can use vi to check this: vi /config/bigip.conf. Then type :893 enter

     

     

    If it's the beginning of an iRule can you post the iRule? Or if it's the middle of an iRule, can you post that line?

     

     

    If you're not able/comfortable posting the iRule code verbatim you could open a case with F5 Support on this.

     

     

    And here's a related solution from AskF5 that may explain the issue:

     

     

    sol7988: The iRule parser may fail to correctly parse and load an iRule when using the bigpipe load command

     

    http://support.f5.com/kb/en-us/solutions/public/7000/900/sol7988.html

     

     

    Aaron
  • Hamish's avatar
    Hamish
    Icon for Cirrocumulus rankCirrocumulus
    Jul 20, 2011
    Ah yes... The dreaded commented '{' character bug... Among others...

     

     

    Any chance on getting these annoyances fixed at some stage? ISTR opening bugs about this way back in v9.0... I know some don't think it's a problem, but it really is when you're caught by them unawares... And not everybody catches them before rebooting their appliance... (Or performing a sync/b load separately).

     

     

    H
  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Jul 20, 2011
    Yeah, these were a pain... most of them have been fixed though:

     

     

    F5 Networks Product Development tracked this issue as CR85806, and it was fixed in BIG-IP versions 9.4.7 and 10.0.0.

     

     

    I still run into it every now and then with horrible regexes or other oddities and try to open cases as I see them.

     

     

    Aaron
  • Hamish's avatar
    Hamish
    Icon for Cirrocumulus rankCirrocumulus
    Jul 20, 2011
    Yeah, I think the unbalanced '{' and '}' in commented lines has survived all the way to 10.2.1...

     

     

    H
  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Jul 20, 2011
    I think that that's expected in TCL:

     

     

    Why can I not place unmatched braces in Tcl comments

     

    http://wiki.tcl.tk/462

     

     

    Aaron
  • Hamish's avatar
    Hamish
    Icon for Cirrocumulus rankCirrocumulus
    Jul 20, 2011
    I've read that explanation 10 times... And still don't follow it... The way I read it, it contradicts itself...
  • Chris_15609's avatar
    Chris_15609
    Icon for Nimbostratus rankNimbostratus
    Jul 20, 2011
    So i found the offending iRule. I deleted it (it was a testing iRule only so not needed) and sync seems to be happy now.

     

    Thanks folks :)
  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Jul 21, 2011
    Posted By Hamish on 07/20/2011 01:23 AM

     

    Yeah, I think the unbalanced '{' and '}' in commented lines has survived all the way to 10.2.1...

     

     

    H

     

    Apparently PD was going to fix this in CR44839 back in '05, but didn't get to it due to the high complexity and low benefit (considering it's a "limitation" from TCL).

     

     

    Aaron

     

  • Hamish's avatar
    Hamish
    Icon for Cirrocumulus rankCirrocumulus
    Jul 22, 2011

     

    It's not so much the fact that it doesn't actually work in TCL... As the fact that most of the problems could be entered in the iRule code from the GUI, and be accepted and saved in the config... And then the config fails to load... Because it needs to be syntactically correct to load, but not 100% correct to be entered...

     

     

    Oops...

     

     

    I THINK most of them are caught nowadays in 10.2.1 (Certainly unbalanced '{' in a comment is at HF1), but whether all of them are, I'm not 100% certain.

     

     

    H