For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

The_Engima_Code's avatar
The_Engima_Code
Icon for Nimbostratus rankNimbostratus
Aug 27, 2015
Solved

Replacing F5 in HA

Hi,   We are running F5 HA (Say Member A and Member B) in Active-Active mode. Member A had a h/w issue and is currently in offline/in sync mode. We are planning to replace Member A over the weeke...
The_Engima_Code's avatar
The_Engima_Code
Icon for Nimbostratus rankNimbostratus
Sep 06, 2015

Hi Tyron,

 

We tried the swap on Wednesday night and it failed. After talking to F5, we realized that the replacement box needs self IP, VLANs,route domains, etc... configuration for all partitions whereas it was only done on the common partition. Doing this manually would've been difficult so we left the config on the replacement box as is. It had basic configuration.

 

Here are the steps I did.

 

  1. Uploaded the UCS file of member-A on the replacement box new-member-A

     

  2. Disabled the switch ports connected all interfaces except for management interfaces. This isolated New-Member-A from Member-B(Active).

     

  3. On Member-B, run f5mku -K and copy the key on New-Member-A run f5mku -r

     

    As we were replacing a box in HA, the key to manage configs and HA is shared between both members. This key is required to restore config.

     

  4. Restore the config of Member-A on New-Member-A. tmsh load /sys ucs no-license

     

  5. This step is optional but I did.Remove HA config from New-Member-A and force it to go offline. Above steps you can perform w/o a change window as you are isolating the replacement box from Active one.

     

  6. Now on Member-B (Active), remove HA config and make it Active/Standalone

     

  7. Enable switch ports(disabled in step 2)for New-Member-A, the box will be in Forced Offline/Standalone mode.

     

  8. Rebuild the trust, configure device groups, etc.. Once the boxes were in in-sync, I did sync device to group with overwrite option on Member-B which was active.

     

  9. Once the config is synced, force New-Member-A to go online.

     

This did the trick for me. I have mentioned the steps that worked for me and the assumption is both F5 members are backed up, network maps, and other screenshots are taken for rollback.

 

I hope this helps. Feel free to ask any questions.