For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

janlaw_195243's avatar
janlaw_195243
Icon for Nimbostratus rankNimbostratus
Jul 31, 2015

Question about Route domain

Hi All,

 

I am new to f5. I need to clarify some questions. My f5 big ltm 4000s, version 11.6 are in HA mode(active and standby) and it have Route domain.

 

1) does route domain affect the ntp sync?

 

2) does route domain affect the sending of the f5 tcp syslog to remote servers.

 

i am using this command but is not sending anything:

 

tmsh modify sys syslog include "destination remote_server {tcp(\"IP_SYSLOG\" port (514));};filter f_alllogs {level (debug...emerg);};log {source(local);filter(f_alllogs);destination(remote_server);};"

 

So i change it to HSL but it does not send to multiple remote servers.

 

3) does route domain affect the snmp trap(port 162)

 

It does not send out any information to snmp servers.

 

Thanks!!!

 

application delivery
availability
BIG-IP Access Policy Manager (APM)
LTM
performance
security
TMSH

1 Reply

  • kunjan's avatar
    kunjan
    Icon for Nimbostratus rankNimbostratus
    Jul 31, 2015

    It won't affect. If you verify using tcpdump inside route domain that doesn't work. Need do it from default RD

        https://support.f5.com/kb/en-us/solutions/public/6000/500/sol6546.html

    Running tcpdump in a route domain

    Recommendations

    When using tcpdump to capture traffic in a non-default route domain, F5 recommends that you run the tcpdump command from the default route domain (route domain 0), and specify interface 0.0.
    Note: Specifying interface 0.0 when running tcpdump captures traffic traversing all configured VLANs on the BIG-IP system.

    For example, the following command captures traffic from all VLANs in all route domains when invoked from the default route domain:

    tcpdump -ni 0.0

Limitations

The tcpdump utility does not capture traffic when run from a non-default route domain. For example, if you use the rdsh utility to change the shell to a non-default route domain and run the tcpdump command, no traffic will be captured. To capture traffic, use the following command to change back to the default route domain:
rdsh 0

You can then run the tcpdump -ni 0.0 command to capture all route domain traffic