For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Alfonso_3549's avatar
Alfonso_3549
Icon for Nimbostratus rankNimbostratus
Mar 10, 2009

vserver ALWAYS replies to ping

Hi,

 

 

We're new to F5 and came across this "problem" just now:

 

 

As soon as you configure a vserver in he F5, it's IP address responds to ping no matter what: when the primary pool is down, when both the primary and secondary pools are inactive or when one pool member is disabled and the other is inactive.

 

 

In other words, is this normal? Is there a way to make a vserver respond to a ping ONLY when the primary pool is active (which would be the logical behavior for us).

 

 

Thanks for your input.

 

 

Alfonso
management
monitoring

15 Replies

Show More
  • sojan_86359's avatar
    sojan_86359
    Icon for Nimbostratus rankNimbostratus
    Aug 19, 2011
    Hi,

     

     

    Any of you know if there is any other way to implement that VS don't repond to TCP / ICMP connection when the pool don't have active memebers ?

     

     

    For me the tcping / telnet all works , even if the pools is marked down

     

     

    Highly appreciate your help

     

     

    thanks

     

    Sojan
  • sojan_86359's avatar
    sojan_86359
    Icon for Nimbostratus rankNimbostratus
    Aug 19, 2011

    Hi,

     

     

    Any of you know if there is any other way to implement that VS don't repond to TCP / ICMP connection when the pool don't have active memebers ?

     

     

    For me the tcping / telnet all works , even if the pools is marked down

     

     

    Highly appreciate your help

     

     

    thanks

     

     

     

    Sojan

     

  • JRahm's avatar
    JRahm
    Icon for Admin rankAdmin
    Aug 24, 2011
    For TCP, it should respond with a reset if all the pool members are down (unless you have a last chance redirect configured, in which case the session should handshake, the redirect occur, and then the close). With ICMP, it should always respond, because ICMP is attached to the IP address, whereas a virtual is an IP address and a port. Many virtuals could (and often do) exist on a single IP address, so you wouldn't want ICMP services to fail for the other virtual servers.
  • L4L7_53191's avatar
    L4L7_53191
    Icon for Nimbostratus rankNimbostratus
    Sep 04, 2011
    A common issue with this type of thing is that you've got an HTTP profile bound to that virtual server, but you want it to RST if the pool members are down. If this is the case, the virtual will stand up a socket no matter what, as it's waiting for the HTTP data to come in to start parsing. If the pool members are down it'll send the RST, but only after the HTTP parser on the LTM parses the request.

     

     

    A standard TCP profile should not do this though - it should send a RST if the members are down, as Jason notes above.

     

     

    --Matt