Forum Discussion

Shahrzad_84598's avatar
Shahrzad_84598
Icon for Nimbostratus rankNimbostratus
Nov 04, 2015

LTM Floating IP`s mac address has gone mad!

Hi there! We have 2 BIG-IP LTM version 9.3.0, I know it

s old :)
These two have a floating ip between them(HA) and this ip is set on web servers as their default gateway, and it was working fine for a long time, but this week both web servers reported ip conflict and they couldn't ping the floating ip and when we get "arp -a" on web servers they return a wrong mac-address for the floating ip(the mac-address is the address which belongs to BIG-IP
s own default gateway which is a cisco ASA), so we changed the web servers default gateway to one of the BIGs self-ip and servers don`t get ip conflict anymore and the "arp -a" returns the BIG-IP mac-address correctly. Is it a known issue on BIG-IP?

application delivery
availability
floating ip
LTM
management
  • Brad_Parker_139's avatar
    Brad_Parker_139
    Icon for Nacreous rankNacreous
    Nov 04, 2015

    Are you positive you ASA didn't go rouge and get put into the network? I'm not sure how the BIGIP would advertise itself as owning a MAC address for you ASA.

     

    • Shahrzad_84598's avatar
      Shahrzad_84598
      Icon for Nimbostratus rankNimbostratus
      Nov 07, 2015
      Hi Brad, thanks for your reply. 1- How can I recognize if it is ASA which is gone rogue? 2- Is it possible that a virus on Web Servers cause this? I`m going to capture traffic and see if another device(like ASA) is sending gratuitous arp ...
  • Brad_Parker's avatar
    Brad_Parker
    Icon for Cirrus rankCirrus
    Nov 04, 2015

    Are you positive you ASA didn't go rouge and get put into the network? I'm not sure how the BIGIP would advertise itself as owning a MAC address for you ASA.

     

    • Shahrzad_84598's avatar
      Shahrzad_84598
      Icon for Nimbostratus rankNimbostratus
      Nov 07, 2015
      Hi Brad, thanks for your reply. 1- How can I recognize if it is ASA which is gone rogue? 2- Is it possible that a virus on Web Servers cause this? I`m going to capture traffic and see if another device(like ASA) is sending gratuitous arp ...
  • Stan_Ward_01_13's avatar
    Stan_Ward_01_13
    Icon for Nimbostratus rankNimbostratus
    Nov 11, 2015

    Not sure about the MAC address, but if this started with an IP address conflict for the floating IP, it sounds like the pair went "split brained" (active-active). So each F5 thinks that the other has gone south and that it needs to be active. But the GUI and the command line of each box would be reporting its status as "Active". If so, the cause would be loss of the HA Ethernet connection or the failover serial cable between the two boxes.

     

    • Shahrzad_84598's avatar
      Shahrzad_84598
      Icon for Nimbostratus rankNimbostratus
      Nov 14, 2015
      Hi Stan, Thanks for the reply, I have no log related to the floating ip conflict in LTM log files, so I don`t think that`s the case, also active-standby thing is ok. I could`t find the cause of two things: 1- Servers IP conflict (I worked around it by configuring the windows registry and turning off the gratuitous arp ) 2- Why LTM floating IP does not reply to servers on the same subnet.(Not solved, I`m going to set mac masquerade to see what happens)
  • Mahmoud_Eldeeb_'s avatar
    Mahmoud_Eldeeb_
    Icon for Cirrostratus rankCirrostratus
    Dec 03, 2015

    Hi shahrzad,

     

    make sure that non of it team assign the same ip address to any other device. actually it happens sometimes

     

  • Mahmoud_Eldeeb_'s avatar
    Mahmoud_Eldeeb_
    Icon for Cirrostratus rankCirrostratus
    Dec 03, 2015

    there is one more possibility over here, does any engineer doing a kind of pen test over the network or uses man-in-the-middle attack it might cause the same, man-in-the-middle machine can respond instead of ltm-vip address to the end user

     

  • StephanManthey's avatar
    StephanManthey
    Icon for MVP rankMVP
    Dec 03, 2015

    Hi,

    did you check the MAC masquerading settings on your BIG-IPs?

    In TMOS v9/v10 you will find it in the VLAN settings. (v11 has it in the traffic-group configuration.)

    Perhaps somebody has entered the routers MAC address and you are facing a duplicated MAC address issue?

    You can run a tcpdump including the layer 2 information to check for ARPs in you network: 

    tcpdump -nnni  -e -c 100 'arp and host '

    The sample above limits the output to 100 packets "

    -c 100
    " showing both ARP requests and responses related to your floating self IP and displays the ethernet header information "
    -e
    ".

    Now you can clear your servers ARP cache and force a new address resolution and watch what is happening.

    Thanks, Stephan
  • Ant_4079's avatar
    Ant_4079
    Icon for Nimbostratus rankNimbostratus
    Dec 15, 2015

    Check to see if a NAT was added to the ASA. Certain NAT configurations on the ASA platform will do Proxy ARP. I have seen this issue previously, and luckily we employ change management and were able to identify the issue quickly. I wish the same for you. Regards, Ant