For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Jayendra_7586's avatar
Jayendra_7586
Icon for Nimbostratus rankNimbostratus
Jun 16, 2016

Node 139.148.1.18 got disabled ( Forced Offline ) 1 month back on LTM device F5-A/F5-B but still we see LTM is sending traffic to this server.

Kindly provide the solution to fix this issue.

 

LTM version 9.4.5

Below is the details:

 

Node disabled on both Active and standby device

 

[F5-A:Active] ~ b node 139.148.1.18 list node 139.148.1.18 { down session disable } [F5-A:Active] ~

 

[F5-B:Standby] ~ b node 139.148.1.18 list node 139.148.1.18 { down session disable } [F5-B:Standby] ~

 

Connection sessions checked today on 13th June [F5-A:Active] ~ b conn all | grep 139.148.1.10:3393 10.73.4.101:52869 <-> 139.148.1.10:3393 <-> 139.148.1.18:3393 tcp 10.73.4.101:52879 <-> 139.148.1.10:3393 <-> 139.148.1.18:3393 tcp 10.73.4.101:52915 <-> 139.148.1.10:3393 <-> 139.148.1.18:3393 tcp [F5-A:Active] ~

 

Different status of pool member in LTM pools [F5-A:Active] ~ b virtual show | grep 139.148.1.18 +-> POOL MEMBER P_BBSECURE_3442_P/139.148.1.18:3442 active,unchecked +-> POOL MEMBER P_Plug-gw-SOCKS_1080_P/139.148.1.18:socks active,unchecked +-> POOL MEMBER P_INT3S_11180_P/139.148.1.18:11180 active,unchecked +-> POOL MEMBER P_Tkfweb-Custom_15119_P/139.148.1.18:15119 active,unchecked +-> POOL MEMBER P_Tkfweb-Custom_15120_P/139.148.1.18:15120 active,unchecked +-> POOL MEMBER P_BIZPORTAL-BCP_3675_P/139.148.1.18:3675 inactive,addr down +-> POOL MEMBER P_BIZPORTAL-BCP_3676_P/139.148.1.18:3676 inactive,addr down +-> POOL MEMBER P_BIZPORTAL-BCP_3677_P/139.148.1.18:3677 inactive,addr down +-> POOL MEMBER P_BIZPORTAL-BCP_3678_P/139.148.1.18:3678 inactive,addr down

 

Status of pool member not matching on Active and standby device.

 

[F5-A:Active] ~ b virtual V_139.148.1.10_3697_P_PORTFOLIO-ANALYSIS1 show | grep -i member +-> POOL P_PORTFOLIO-ANALYSIS1_3697_P LB METHOD member observed MIN/CUR ACTIVE MEMBERS 0/0 +-> POOL MEMBER P_PORTFOLIO-ANALYSIS1_3697_P/139.148.1.18:3697 inactive,addr down [F5-A:Active] ~

 

[F5-B:Standby] ~ b virtual V_139.148.1.10_3697_P_PORTFOLIO-ANALYSIS1 show | grep -i member +-> POOL P_PORTFOLIO-ANALYSIS1_3697_P LB METHOD member observed MIN/CUR ACTIVE MEMBERS 0/0 +-> POOL MEMBER P_PORTFOLIO-ANALYSIS1_3697_P/139.148.1.18:3697 active,unchecked [F5-B:Standby] ~

 

[F5-B:Standby] ~ b config sync show CONFIG SYNC STATUS -- Status 0 - Synchronized Last change (Self) 2016-05-28 12:25:13 Last change (Peer) 2016-05-28 12:25:16 Last Configsync 2016-05-28 12:25:16 [F5-B:Standby] ~

 

application delivery
BIG-IP
LTM

1 Reply

  • Vijay_E's avatar
    Vijay_E
    Icon for Cirrus rankCirrus
    Jun 16, 2016
    1. You are running a really old code version. Consider upgrading.
    2. There is a chance that connections can still be sent to the same pool member even when it is disabled based on persistence.
    3. Are you saying that it is showing "up" in active and "down" in standby F5 ? If so, I would check to make sure the monitoring is good and make sure that the server is allowing access from the self IP configured on both F5 devices.

    Also, see these 2 links: https://support.f5.com/kb/en-us/solutions/public/12000/900/sol12920.html

     

    https://support.f5.com/kb/en-us/solutions/public/13000/300/sol13310.html