For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

EricTTEC's avatar
EricTTEC
Icon for Nimbostratus rankNimbostratus
Mar 10, 2020

Remote Syslog Server Setup

I have two F5 in HA configuration. When I add a remote server, and include a local ip, it gets added to the F5 showing the local ip. However, if I login to the sister F5, I see the entry for the remote server, but do not see the local ip that I specified. I need help understanding the correct way to setup the remote server in a HA setup.

application delivery
BIG-IP
LTM

2 Replies

  • Mayur_Sutare's avatar
    Mayur_Sutare
    Icon for MVP rankMVP
    Mar 11, 2020

    First, configuring local IP is optional.

    second, Are you using self IP of BigIP as Self IP or floating IP ?

    NOTE - For BIG-IP systems in a high availability , the non-floating self IP address is recommended if using a Traffic Management Microkernel (TMM) based IP address.

     

     

  • EricTTEC's avatar
    EricTTEC
    Icon for Nimbostratus rankNimbostratus
    Mar 13, 2020

    In my case I need to pass the management ip of the F5 to the syslog server. As an example of what is happening:

     

    If I make this entry on F5-1:

     

    Remote IP: 206.1.1.1

    Remote Port: 514

    Local IP: 172.1.1.1

     

    This is what I end up with in the Remote Server List:

     

    F5-1:

    206.1.1.1 514 172.1.1.1

     

    F5-2:

    206.1.1.1 514

     

    If I then go to F5-2 and make this entry:

     

    Remote IP: 206.1.1.1

    Remote Port: 514

    Local IP: 172.2.2.2

     

    This is what I end up with in the Remote Server List:

     

    F5-1:

    206.1.1.1 514 172.1.1.1

    206.1.1.1 514

     

    F5-2:

    206.1.1.1 514

    206.1.1.1 514 172.2.2.2

     

    The end result is that I get duplicate events sent from each F5, one with a source IP of one of the F5 interfaces, and one with the specified Local IP.