For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Moe_Jartin's avatar
Moe_Jartin
Icon for Cirrus rankCirrus
Mar 12, 2014

That looks like some Cisco switches running STP. That 00:0c:cc:cc:cd is the L2 multicast address for spanning tree and the 00:19:30:4a:f0:6d is definitely a Cisco MAC. I would ignore those. Not part of the problem.

 

Can you ping both the client IP address and the server IP address in question from the BIG IP device? Just want to make sure you have connectivity to hosts before going any farther.

 

Also, is there a route for the server subnet on the upstream router pointing to the F5 external floating IP address?

 

Joe

 

  • Tabish_Mirza_12's avatar
    Tabish_Mirza_12
    Icon for Nimbostratus rankNimbostratus
    Mar 12, 2014
    Hi Joe, Yes we do have the reverse route configured for the subnet which is running behind BIG-IP 10.11.27.0/24 in route domain 1 on our upstream Cisco Switch 6509 running HSRP. ip route 10.11.27.0 255.255.255.0 10.11.29.251 (10.11.29.251 is the floating IP of BIG-IP external internal means 1.3 in route-domain 1) Yes I can ping both the back-end servers which is 10.11.27.100 & the client IP which is 10.10.94.200 from the BIG-IP from the route domain 1 by the following command. [root@CIODCGDNF5LTM01:Active:In Sync] config rdsh 1 [root@CIODCGDNF5LTM01:Active:In Sync] config ping 10.11.27.100 PING 10.11.27.100 (10.11.27.100) 56(84) bytes of data. 64 bytes from 10.11.27.100: icmp_seq=1 ttl=64 time=3.07 ms 64 bytes from 10.11.27.100: icmp_seq=2 ttl=64 time=0.958 ms 64 bytes from 10.11.27.100: icmp_seq=3 ttl=64 time=0.841 ms ^C --- 10.11.27.100 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2001ms rtt min/avg/max/mdev = 0.841/1.626/3.079/1.028 ms Following is the interface details of route-domain 1 [root@CIODCGDNF5LTM01:Active:In Sync] config rdsh 1 [root@CIODCGDNF5LTM01:Active:In Sync] config ifconfig External-VIP Link encap:Ethernet HWaddr 00:23:E9:68:73:09 inet addr:10.11.29.249 Bcast:10.11.29.255 Mask:255.255.255.0 inet6 addr: fe80::223:e9ff:fe68:7309/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:33796 errors:0 dropped:0 overruns:0 frame:0 TX packets:7060 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:3561469 (3.3 MiB) TX bytes:436990 (426.7 KiB) STG-Web-IN Link encap:Ethernet HWaddr 00:23:E9:68:73:04 inet addr:10.11.27.200 Bcast:10.11.27.255 Mask:255.255.255.0 inet6 addr: fe80::223:e9ff:fe68:7304/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:2133 errors:0 dropped:0 overruns:0 frame:0 TX packets:2 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:142462 (139.1 KiB) TX bytes:180 (180.0 b) lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.255.255.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:6 errors:0 dropped:0 overruns:0 frame:0 TX packets:6 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:504 (504.0 b) TX bytes:504 (504.0 b) tmm0 Link encap:Ethernet HWaddr 00:98:76:54:32:10 inet addr:127.1.1.1 Bcast:127.1.1.255 Mask:255.255.255.0 inet6 addr: fe80::298:76ff:fe54:3210/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b) Thanks Tabish
  • Tabish_Mirza_12's avatar
    Tabish_Mirza_12
    Icon for Nimbostratus rankNimbostratus
    Mar 12, 2014
    One more thing I just want to tell you when I do tcpdump on route-domain 1 with the interface number or vlan ID. I do not see any packet but when I do tcpdump on default route domain with the interface number . I can see packets. Below is the output. Route Domain 1 [root@CIODCGDNF5LTM01:Active:In Sync] config rdsh 1 [root@CIODCGDNF5LTM01:Active:In Sync] config tcpdump -i External-VIP tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on External-VIP, link-type EN10MB (Ethernet), capture size 96 bytes ^C 0 packets captured 0 packets received by filter 0 packets dropped by kernel [root@CIODCGDNF5LTM01:Active:In Sync] config tcpdump -i 1.3 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on 1.3, link-type EN10MB (Ethernet), capture size 96 bytes ^C 0 packets captured 0 packets received by filter 0 packets dropped by kernel