For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Koalan's avatar
Koalan
Icon for Cirrus rankCirrus
Jan 30, 2020
Solved

Pool down even Node is up

Hi,

 

I don't know if this how F5 behaves, but we have a pool have a health monitor of gateway_icmp and pool members are using port 443:

 

ltm pool FEMA_WFO_POOL {

  description FEMA_WFO_POOL_HTTPS

  members {

    USDEN-WFMFEMA3:https {

      address 170.65.231.131

      monitor FEMA_https 

      session monitor-enabled

      state down

    }

    USDEN-WFMFEMA4:https {

      address 170.65.231.132

      monitor FEMA_https 

      session monitor-enabled

      state down

    }

    USDEN-WFMFEMA5:https {

      address 170.65.231.133

      monitor FEMA_https 

      session monitor-enabled

      state down

    }

  }

  monitor gateway_icmp 

}

 

As you can see it uses gateway_icmp but the port is 443. Port 443 is down on the servers as per my telnet test. But I don't know why it is being marked down by the monitor, it is not a tcp monitor but gateway_icmp (which i believe it doesnt care of the port - only ping)

 

 

Here is the nodes (gateway_icmp) healtcheck too:

 

ltm node USDEN-WFMFEMA3 {

  address 170.65.231.131

  description USDEN-WFMFEMA3

  session monitor-enabled

  state up

}

 

ltm node USDEN-WFMFEMA4 {

  address 170.65.231.132

  description USDEN-WFMFEMA4

  session monitor-enabled

  state up

}

 

ltm node USDEN-WFMFEMA5 {

  address 170.65.231.133

  description USDEN-WFMFEMA5

  session monitor-enabled

  state up

 

It is up. So what's happening here? or what should i change? Is this a bug?

 

I already tried removing the gateway_icmp then adding it again, but same status.

 

  • Also to add to what Claudio said, why would put 2 monitor. May be it was there before and you have missed to notice. You are going with pool member specific monitor, which means the pool monitor would be over-riden by the pool member specific monitors.

     

    Please correct your infra.

5 Replies

  • Hello,

     

    You have a gateway_icmp to monitor to pool members, but, there is a specific monitor on each member that sounds to me a HTTPS port monitor.

    Isn't the "FEMA_https" a 443 port monitor, that you've checked is really closed on server?

     

    Regards.

    • jaikumar_f5's avatar
      jaikumar_f5
      Icon for Noctilucent rankNoctilucent

      Also to add to what Claudio said, why would put 2 monitor. May be it was there before and you have missed to notice. You are going with pool member specific monitor, which means the pool monitor would be over-riden by the pool member specific monitors.

       

      Please correct your infra.

      • Koalan's avatar
        Koalan
        Icon for Cirrus rankCirrus

        oh i didnt see that FEMA_HTTPS, i will check it. Thanks!