For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Zen_Y's avatar
Zen_Y
Icon for Cirrus rankCirrus
Oct 29, 2024

What will be happen to live and existing connections when failover HA BIG IP active-standby

Good morning I have a little question, when we create HA configuration with active-standby mode, with Mac Masquerade configuration. What will be happen to live and existing connections? They will be...
application delivery
Zen_Y's avatar
Zen_Y
Icon for Cirrus rankCirrus
Oct 30, 2024

Hi akonu 

This is interesting, I have read several articles about mirroring connections, but in the implementation in reality, I have not implemented this. Is there any information about the impact of this implementation? such as increasing cpu, memory, network load or even certain bugs that must be avoided on both active and standby devices?

And when we do not implement a mirroring connection, will the existing connection time out before it finds a new active device?

Paulius's avatar
Paulius
Icon for MVP rankMVP
Oct 30, 2024

This is dependent on how the application handles a no response. I would say from a TCP perspective, the connection would time out, it would inform the user of the connection loss and you would have to refresh the connection or resend the request.

  • Zen_Y's avatar
    Zen_Y
    Icon for Cirrus rankCirrus
    Nov 03, 2024

    doesn't a timeout event occur when a network device doesn't find the appropriate IP and MAC address to send data? while when we do a failover with the same IP vs, IP data, and MAC address recognized by the server side and client side, will they also fail to find a new device without going through the timeout process?

    when failover, I once tried to do a ping test, I don't know if this will be relevant to real traffic or not, but there was no timeout status. Doesn't this mean that the network device can receive a new IP and MAC on a previously inactive device, and immediately flow traffic there?

    • Paulius's avatar
      Paulius
      Icon for MVP rankMVP
      Nov 03, 2024

      ICMP traffic is not an active flow that requires an established connection such as TCP. Would this failover be a manual failover or a failover due to a device fault? If this is a manual failover you probably wouldn't notice any drops if any, if the device has a fault then you would most definitely notice the failover because the device in good health would have to run through the entire failover timeout before failing over. If your business can afford some testing I would schedule failover testing during low traffic period and run through different failures to see what happens. You should test continuous ICMP as well as copying data to and from something being load balanced. I would do the following tests.

      1. Issue a manual failover from unit 0 to unit 1 and then back after 10 minutes.
      2. Reboot the active unit, wait for it to come back up completely, reboot the new active unit and wait the same amount of time.
      3. On the active unit unplug an interface but not the management interface. Repeat this for each interface less the management interface on each unit after you wait for 5 minutes after plugging the interface back in.


      For number 3 you would bounce back and forth between the units. As an example, if you had 2 interfaces plugged in less the management interface you would do the following assuming Unit 0 is the active unit.

      1. Unit 0 unplug interface 1.
      2. Wait 5 minutes then Unit 1 unplug interface 1.
      3. Wait 5 minutes then Unit 0 unplug interface 2.
      4. Wait 5 minutes then Unit 1 unplug interface 2.


      Make sure you clearly record each step of connectivity testing so you know exactly how the device will behave. You should test each unique application such as email load balancing, http, ftp, and so on. You do not have to test multiple of each unless they have something that makes then drastically different.