For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Moe_Jartin's avatar
Moe_Jartin
Icon for Cirrus rankCirrus
Mar 12, 2014

That looks like some Cisco switches running STP. That 00:0c:cc:cc:cd is the L2 multicast address for spanning tree and the 00:19:30:4a:f0:6d is definitely a Cisco MAC. I would ignore those. Not part of the problem.

 

Can you ping both the client IP address and the server IP address in question from the BIG IP device? Just want to make sure you have connectivity to hosts before going any farther.

 

Also, is there a route for the server subnet on the upstream router pointing to the F5 external floating IP address?

 

Joe

 

Tabish_Mirza_12's avatar
Tabish_Mirza_12
Icon for Nimbostratus rankNimbostratus
Mar 12, 2014
One more thing I just want to tell you when I do tcpdump on route-domain 1 with the interface number or vlan ID. I do not see any packet but when I do tcpdump on default route domain with the interface number . I can see packets. Below is the output. Route Domain 1 [root@CIODCGDNF5LTM01:Active:In Sync] config rdsh 1 [root@CIODCGDNF5LTM01:Active:In Sync] config tcpdump -i External-VIP tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on External-VIP, link-type EN10MB (Ethernet), capture size 96 bytes ^C 0 packets captured 0 packets received by filter 0 packets dropped by kernel [root@CIODCGDNF5LTM01:Active:In Sync] config tcpdump -i 1.3 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on 1.3, link-type EN10MB (Ethernet), capture size 96 bytes ^C 0 packets captured 0 packets received by filter 0 packets dropped by kernel