For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

brianokelly_119's avatar
brianokelly_119
Icon for Nimbostratus rankNimbostratus
Feb 22, 2011

LTM Health Monitor Issue

Hi all, probably the best place to post this. We have a pair of 8900s working in Active/Strandby mode. They are running multiple partitions with separate route domains. The F5 sits in the traffic path with public addressing used for the VIPs and RFC1918 addressing internally. In one partition, we have a web application VIP distributing towards multiple Oracle Web Logic servers. Our problem is at the most basic level, the ICMP node health checks are failing as the source IP address of the health checks is being set to the public address of the F5 but is being routed via the private connected Internal interface. I have never come across this issue before, I assumed the routing table would resolve it. To explain better here are some example values:

 

 

Self IP External: 200.200.200.200

 

Self IP Internal: 192.168.1.254

 

Node IP Addresses to load balance against: 192.168.0.5, 192.168.0.6, 192.168.0.7

 

 

The routing table is:

 

 

192.168.0.0/24 via 192.168.1.1

 

Default Route via 200.200.200.201

 

 

The pings towards 192.168.0.5/6/7 are being sent via 192.168.1.1 but the source IP address is set to 200.200.200.200. I have never seen a mechanism to set the source IP address of health checks. Can anyone think of anything that could be set incorrectly?

 

basic
getting started
new to f5

5 Replies

  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Feb 22, 2011
    Hi Brian,

     

     

    I thought the monitoring connections would follow the TMM routing as well. There isn't a config option for explicitly setting the source address or VLAN for monitor connections. I wonder if the route domain config is affecting this.

     

     

    Are the 192.168.0.0/24 pool members in the default route domain or a custom one? Is the default route for the default route domain?

     

     

    Aaron
  • brianokelly_119's avatar
    brianokelly_119
    Icon for Nimbostratus rankNimbostratus
    Feb 22, 2011
    Hi Aaron,

     

     

    All routes are configured in this partitions route domain. All Self IPs are also. They should all be completely isolated.

     

     

    Bok
  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Feb 22, 2011
    I'm not sure what would cause this? Can you open a case with F5 Support to have them review your configuration? If/when you figure this out, could you reply back here for future reference?

     

     

    Thanks, Aaron
  • Cspillane_18296's avatar
    Cspillane_18296
    Icon for Nimbostratus rankNimbostratus
    Apr 05, 2011
    Hello,

     

     

    did you get a reply to this perchance? Did you encounter the issue in 10.2 code?

     

     

    I've seen this problem once on this code version and I understand it was due to be fixed in the 10.2.1 release.

     

     

    Sorry for the late response :S