SSL Orchestrator and Layer 2 Service Integration

Here's some notes based on my recent struggles with getting L2 services to come up after migrating SSLO from iSeries to rSeries... You need to complete the following:

• If using L2 Services with SSLO, deploy the new rSeries Tenant with the appropriate MAC Block Size (aka MAC Pool). You will need 2 MAC addresses for each L2 service, and 1 for each additional VLAN. Each rSeries tenant can be assigned one of the following MAC Block sizes (Small/Medium/Large, 8/16/32)
• IMPORTANT IF YOU HAVE MORE THAN 30 VLANS:
  • Unique MAC Addresses from the MAC Pool are assigned alphabetically how they appear in the Tenant GUI, with VLANs starting a capitalized letter appearing before VLANs starting with a lowercase letter
  • If your L2 SSLO VLANs appear low enough in the alphabetical list, they won't be assigned a unique MAC Address, and the L2 service will not pass the health check, even if you have the Tenant Deployment configured with a Large MAC Block 
  • You can confirm if you're running into this issue by running this command and checking if your SSLO VLANs have a MAC address that's shared with other VLANs: tmsh show net vlan | grep "Interface Name\|Mac Address"
  • If you're running into this issue, you'll need to delete the SSLO config, delete the SSLO VLANs on the Host and Tenants, recreate the SSLO VLANs with different names that will appear at the top of the alphabetical list, then recreate the SSLO config, then run these commands to force the F5 to reassign the MACs from it's MAC Pool:
    • tmsh modify ltm global-settings general share-single-mac global
    • tmsh modify ltm global-settings general share-single-mac unique
• The L2 SSLO VLANs will need to be created on the new rSeries hosts prior to the migration from iSeries.