Forum Discussion
Muffe_183891
Nimbostratus
NimbostratusUpgrade F5 BIG-IP from 11.5 to 11.6
Hi,
We got a security notice from AWS that our current F5 version 11.5 has a known security risk and they recommend us to update the version.
So we did and created a new instance and uploa...
Alex__Applebaum
Employee
EmployeeThis is probably too late for Muffe but for those perusing later, the proper way to upgrade a BIG-IP in AWS is:
Via GUI:
https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/bigip-ve-setup-amazon-ec2-11-6-0.pdf?sr=43766835 or whatever manual reflects your version.
Ex. Simply type "2" for new boot volume name (= will create "HD1.2")
Via CLI:
1) Upload images (hotfixes and required base isos/images) to /shared/images (via SCP) 2) Create New Boot Volume and Install ISOs onto it
ex. Before
root@(ip-10-0-0-5)(cfg-sync Disconnected)(Active)(/Common)(tmos) show sys software
Sys::Software Status
Volume Product Version Build Active Status
HD1.1 BIG-IP 11.5.1 3.0.131 yes complete
Install cmd: root@(ip-10-0-0-5)(cfg-sync Disconnected)(Active)(/Common)(tmos) install sys software image BIGIP-11.6.0.0.0.401.iso create-volume volume HD1.2 reboot
"reboot" optional if you want to reboot immediately after install (vs. staged for later). or if want to boot hotfix all in one command (lays down base image + hotfix simultaneously)
"install sys software hotfix Hotfix-BIGIP-11.6.0.3.0.412-HF3.iso create-volume volume HD1.2 reboot"
See Progress:
root@(ip-10-0-0-5)(cfg-sync Disconnected)(Active)(/Common)(tmos) show sys software
Sys::Software Status
Volume Product Version Build Active Status
HD1.1 BIG-IP 11.5.1 3.0.131 yes complete HD1.2 BIG-IP 11.6.0 0.0.401 no installing 6.000 pct
Will reboot immediately after this:
root@(ip-10-0-0-5)(cfg-sync Disconnected)(Active)(/Common)(tmos) show sys software
Sys::Software Status
Volume Product Version Build Active Status
HD1.1 BIG-IP 11.5.1 3.0.131 yes complete HD1.2 BIG-IP 11.6.0 0.0.401 no complete
After reboot:
[root@ip-10-0-0-5:Standby:Standalone] config tmsh show sys software
Sys::Software Status
Volume Product Version Build Active Status
HD1.1 BIG-IP 11.5.1 3.0.131 no complete HD1.2 BIG-IP 11.6.0 0.0.401 yes complete == Active Volume now
Note: default user changed from root to admin in 11.6.0 so make sure you updated your admin password from the default.
This should work for both BYOL and Subscription license versions.
If you created a new AMI, that gets trickier so would avoid if at all possible. The new subscription image will be licensed already. When you migrate the config (UCS) you have to use the "no-license" option to avoid overriding the existing working license.
root@(ip-10-0-0-5)(cfg-sync Changes Pending)(Active)(/Common)(tmos) load sys ucs config.ucs Options: no-license no-platform-check passphrase reset-trust
Besides all the usual procedures of changing the hostname (so UCS loads), probably changing the network settings (to match the new IPs AWS assigned, etc.). At that point, so much has changed or there's a lot of remapping on the AWS end, it might be worth the SCF (Single Config File) and trying to work with that (cutting out parts you need).
Obviously configs are more transient/dynamic in cloud world and we are working on more elegant ways to address this but long story short, would try to preserve the existing AMI if possible.
- danielpenna_196Hi Alex, is there any support document/solution article that reflects this process you have written down ? The only official article I have ( apart from your linked one ) is https://support.f5.com/kb/en-us/solutions/public/15000/100/sol15161.html which basically tells you to replace the AMI.
- Alex__ApplebaumHi Daniel, Sorry. To clarify, the procedure I posted was really just to clarify "upgrading" as the title says upgrade from one "software" version to another (for which you should really do an in place upgrade). The official manual I referred to outlined the procedure from the GUI and IMHO didn't really give the clearest picture of what was involved (what to type, creating a second volume, etc.) and could be easily missed. The solution you reference still stands is more focused on "replacing" or "migrating" should you need to (image is corrupt, need to change image size, m3large to m3xlarge). The physical device analogue being more an RMA or "platform" upgrade. With the disposable chaos monkey nature of cloud, we were seeing the two types of "upgrades" (software vs. device) getting conflated and wanted to make sure everyone remembered the good ol "software" upgrade (i.e. you don't have to throw every image away for every change :-). We see the type of config mobility referenced in solution 15161 is obviously getting more and more critical so we're working on facilitating that process as well. Thanks - Alex
- danielpenna_196Thanks Alex, should have given you more context on my query. I am in the process of upgrading our AWS 11.6.0 HF1 boxes to HF3 over the next few days and was looking for an official solution article. I referenced the sol 15161 as the only official documentation I found around upgrades/updates in AWS land :).
- Alex__ApplebaumYeah, we just have the procedure documented in the manual. Ideally the software upgrade should just be the simple procedures outlined in there. ex. Pg. 23. of "https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/bigip-ve-setup-amazon-ec2-11-6-0.pdf?sr=43766835" After you download and import the software installation image, you can initiate the installation operation. There are three boot locations on which you can install images on the BIG-IP system. The process for installing a hotfix or a base version is essentially the same. 1. On the Main tab of the navigation pane, click System > Software Management. The Software Management Image List screen opens. 2. In the Available Images area, select the software image you want to install and click Install. The Install Software Image popup screen opens. 3. Select the disk you want to install the image on, and then type or select a volume name, and click Install. The upgrade process installs the software on the inactive disk location that you specify. This process usually takes between three and ten minutes. Tip: If there is a problem during installation, you can use log messages to troubleshoot a solution. The system stores the installation log file as /var/log/liveinstall.log. The software image is installed. When the installation operation is complete, you can safely reboot the newly installed volume or partition I have created a bug to say if doing it through the GUI, we need to give an example as you just need to type "2" vs. "HD1.2" like you do with the CLI as that was a little confusing. As AWS images normally only come with one volume and I mostly work in the CLI, I just wanted to make that method a little more clear in case that helped to describe what was happening/required. The "create-volume" is listed here: https://devcentral.f5.com/wiki/TMSH.BigpipeMappings.ashx If you're an old user, they changed creating a volume a little bit as described here: https://support.f5.com/kb/en-us/solutions/public/13000/500/sol13563.html So technically, you should just be able to upload 11.6.0 base image + HF3 to /shared/images and create then install another them to another volume. I tested going from 11.6.0 to 11.6.0 HFX with a subscription license and it worked fine for me as well. Know you all are busy but if you or Angelo have a second, if you could send me a little more detail of the exact symptoms you had to a.applebaum@f5.com, I can take that to our test team (ex. what method did you use (GUI, CLI), did the installer fail right away, did it upgrade but you were locked out, etc. ) that would be super helpful.