For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Muhammad_Irfan1's avatar
Muhammad_Irfan1
Icon for Cirrus rankCirrus
Mar 19, 2015

Two LTM working in active/passive. Getting weird log on passive LTM

I am using only 2 vlans, 171 external and 169 internal. Vlan group is configured for these both vlans. Its been a year recently i am getting these logs on passive LTM continuously. Mar 19 02:16...
StephanManthey's avatar
StephanManthey
Icon for Nacreous rankNacreous
Mar 20, 2015

Hi Muhammad,

 

F5 is using two vendor MAC ranges (legacy products on 00:01:d7 and current product generation on 00:23:e9).

 

Replacing the 2nd bit to be send, i.e. by changing the MAC address to start with "02" (with ethernet the least significant bit will be send first) as with 02:23:e9 indicates as self administered MAC address. VLAN group configurations are automatically using this type of MAC addresses.

 

The shown MAC address is an address hold on the active BIG-IP and learned by the Cisco switch.

 

Personally I´ve never been a fan of using VLAN groups as they are hard to troubleshoot, not used often in the field and it´s easy to run in loop issues.

 

If you do not notice high throughput spikes simultaneously to the log messages I won´t be concerned and would assume they are caused by G-ARPs or ARP replies sent by the active unit.

 

I just noticed your other post on this subject 4 month ago and recommend to open a support case.

 

Thanks, Stephan