Forum Discussion
Shahrzad_84598
Nimbostratus
NimbostratusLTM Floating IP`s mac address has gone mad!
Hi there! We have 2 BIG-IP LTM version 9.3.0, I know it
s old :)
These two have a floating ip between them(HA) and this ip is set on web servers as their default gateway, and it was working fine for a long time, but this week both web servers reported ip conflict and they couldn't ping the floating ip and when we get "arp -a" on web servers they return a wrong mac-address for the floating ip(the mac-address is the address which belongs to BIG-IP
Brad_Parker_139Nacreous
Are you positive you ASA didn't go rouge and get put into the network? I'm not sure how the BIGIP would advertise itself as owning a MAC address for you ASA.
Shahrzad_84598Hi Brad, thanks for your reply. 1- How can I recognize if it is ASA which is gone rogue? 2- Is it possible that a virus on Web Servers cause this? I`m going to capture traffic and see if another device(like ASA) is sending gratuitous arp ...
Brad_ParkerCirrus
Are you positive you ASA didn't go rouge and get put into the network? I'm not sure how the BIGIP would advertise itself as owning a MAC address for you ASA.
- Shahrzad_84598Hi Brad, thanks for your reply. 1- How can I recognize if it is ASA which is gone rogue? 2- Is it possible that a virus on Web Servers cause this? I`m going to capture traffic and see if another device(like ASA) is sending gratuitous arp ...
Stan_Ward_01_13Not sure about the MAC address, but if this started with an IP address conflict for the floating IP, it sounds like the pair went "split brained" (active-active). So each F5 thinks that the other has gone south and that it needs to be active. But the GUI and the command line of each box would be reporting its status as "Active". If so, the cause would be loss of the HA Ethernet connection or the failover serial cable between the two boxes.
- Shahrzad_84598Hi Stan, Thanks for the reply, I have no log related to the floating ip conflict in LTM log files, so I don`t think that`s the case, also active-standby thing is ok. I could`t find the cause of two things: 1- Servers IP conflict (I worked around it by configuring the windows registry and turning off the gratuitous arp ) 2- Why LTM floating IP does not reply to servers on the same subnet.(Not solved, I`m going to set mac masquerade to see what happens)
Mahmoud_Eldeeb_Cirrostratus
Hi shahrzad,
make sure that non of it team assign the same ip address to any other device. actually it happens sometimes
- Mahmoud_Eldeeb_
there is one more possibility over here, does any engineer doing a kind of pen test over the network or uses man-in-the-middle attack it might cause the same, man-in-the-middle machine can respond instead of ltm-vip address to the end user
Hi,
did you check the MAC masquerading settings on your BIG-IPs? In TMOS v9/v10 you will find it in the VLAN settings. (v11 has it in the traffic-group configuration.) Perhaps somebody has entered the routers MAC address and you are facing a duplicated MAC address issue? You can run a tcpdump including the layer 2 information to check for ARPs in you network:tcpdump -nnni -e -c 100 'arp and host 'The sample above limits the output to 100 packets "
" showing both ARP requests and responses related to your floating self IP and displays the ethernet header information "-c 100
". Now you can clear your servers ARP cache and force a new address resolution and watch what is happening. Thanks, Stephan-e- Ant_4079
Check to see if a NAT was added to the ASA. Certain NAT configurations on the ASA platform will do Proxy ARP. I have seen this issue previously, and luckily we employ change management and were able to identify the issue quickly. I wish the same for you. Regards, Ant
