Forum Discussion

Luca_55898's avatar
Luca_55898
Icon for Nimbostratus rankNimbostratus
Feb 27, 2013

Putting GTM web management behind LTM

Hi,

 

I have a requirment to put two GTMs that are configured in a sync group, behind a LTM for management purposes.

 

The two GTM nodes in the LTM are configured with priority group activation, so we will always to go one unless it is unavailable. We need this because we have an automated API which will needs to talk to a GTM at all times, so this helps us with redundancy.

 

Anyway, my problem is that whenever I try to access the GTM web management page using the virtual server on the LTM the page never loads. Firefox just gives me an 'Unable to connect' error.

 

TCP dumps on the LTM show that the LTM is sending TCP resets back to me.

 

It seems to be a problem with the GTM being on HTTPS, I have tried to use client side and server side certs but no luck. The GTM is just using the standard self signed cert.

 

Normally when a node is doing it's own SSL, I just make the VIP on the LTM to be 'Performanc (layer 4) type but this also isn't working.

 

Any thoughts on how I can make this work?

 

config
design

2 Replies

  • Michael_Yates's avatar
    Michael_Yates
    Icon for Nimbostratus rankNimbostratus
    Feb 27, 2013
    Hi Luca,

     

     

    You not load balance your Management Interfaces since they are totally independent devices and should always be reachable independently. Not to mention that you could end up in a mismatch configuration where you are being load balanced to the Management Interface of the Standby/Offline GTM Management Interface, you should load balance your GTM Listeners. You can use the same process to load balance your GTM Devices as a normal DNS Server.

     

     

    DNS Traffic Management using the BIG-IP Local Traffic Manager

     

     

    Hope this helps.
  • Luca_55898's avatar
    Luca_55898
    Icon for Nimbostratus rankNimbostratus
    Feb 27, 2013

    Yes i'm aware of the issues. The API only modifies things that are replicated by the sync groups. Also, we are using priority groups in the LTM so if all is well the conifg will only ever be done on one GTM.

     

    With this type of setup we won't have issues with config being out of sync. If I need to change something manually, of course I will logon to the appropriate device.

     

     

     

    Anyway - back to my question - I still should be able to get the web logon page to display something though, any ideas why that isn't working?

     

    I just need SSL passthrough, but the layer 4 profile doesn't work

     

    Edit: And what is interesting is that I set this up on another LTM running 10.2 code and it worked. The exact same config on my new LTM running 11.2.1 with th exact same config does't work