Forum Discussion

Scot_Kreienkamp's avatar
Scot_Kreienkamp
Icon for Nimbostratus rankNimbostratus
Sep 08, 2025
Solved

Terraform LTM provider - ICMP disabled on resulting VIPs

Hello,

 

I recently started using the terraform provider to create my VIPs.  It works great!  It makes my life much easier and faster to create the non-prod environments and migrate those configs to prod.  I've encountered one strange thing I'm struggling with though.  I'm unable to ping the LTM VIPs. 

 

The VIPs work perfectly other than we are unable to ICMP ping them.  I hand-created a basic VIP in the same partition, on the same VLAN/Network, and I can ping it, so it's not a routing or firewall problem.  There's no module other than LTM running on this F5, so there's no firewall policies or anything like that in play.  Just an  standard LTM VIP with HTTP and client-SSL profiles.  Nothing I create with terraform is pingable though.  There are no policies or irules in use.  On the virtual address list ICMP Echo is set to always, ARP is enabled, state is enabled.

Has anyone else encountered this?  I searched the forums and didn't find anything notable, and I haven't been able to find a solution yet.  Even comparing the config files from the F5 hasn't produced anything notable.  I'm sure it's something small that I'm missing. 

LTM VIP configuration (sanitized) is inline below.  Thanks!


ltm virtual /partition/app1PD-CLL-HTTPS {
    description "server1, Terraform - Servicing the CLL"
    destination /partition/10.1.212.244:443
    ip-protocol tcp
    mask 255.255.255.255
    persist {
        /partition/Cookie-app1CLL {
            default yes
        }
    }
    pool /partition/app1PD-CLL
    profiles {
        /partition/partition-HTTP-Weblogic-Proxy { }
        /partition/OC-255.255.255.255 { }
        /partition/server1 {
            context clientside
        }
        /Common/tcp { }
    }
    serverssl-use-sni disabled
    source 0.0.0.0/0
    source-address-translation {
        pool /partition/10.1.212.244
        type snat
    }
    translate-address enabled
    translate-port enabled
}



2 Replies