For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

mplaksin_293271's avatar
mplaksin_293271
Icon for Nimbostratus rankNimbostratus
Sep 07, 2018

Without Self IP to cluster

I have a Cluster of two Big-IP. I need to move a network, but, i dont have enought IP address to the put in the self ip of the standby device. I know that in case of have to put the standby device on...
BIG-IP
LTM
security
youssef1's avatar
youssef1
Icon for Cumulonimbus rankCumulonimbus
Sep 09, 2018

Hi,

If I understand you want to move a network on your HA cluster but you don't have enough IP. In this case you have to pay attention to this details.

First of keep in mind that Self IP don't sync but floating and route are elements that synchronizes.

Second point if you want to sync a rout you have to have a selfip on this network otherwise you will have an error.

Alternative 1 (sync fail)
:

Suppose you will add a new network with vlan-334, so you can't set your network configuration like that:

  • Device1: current-vlan, 
    NewVlan-self-IP-334
    , 
    NewVlan-floating-IP-334
  • Device2: current-vlan

Because you will have an sync problem (as i told you before, floating IP is an element that synchronizes, but witout self IP device 2 will not be able to create a floatingIP and will remount you an error).

Second problem in this architecture, suppose you have a route that use your new vlan, you set it on device 1 when you will try to sync you will have an error on device 2 that specify you that you can't create this route witout selfIP on this vlan...

last point, if you failover on second member nothing will pass through your vlan because he is not informed in the second member.

Alternative 2 (sync work) - best alternative
:

  • Device1: current-vlan, 

    NewVlan-self-IP-334

  • Device2: current-vlan, 

    NewVlan-self-IP-334

This alternative will work but as you know if you failover from device 1 to device 2 you're going to have session breaks (because of no floating IP and source IP will change while if you had a floatingIP you would keep the same IP source...).

Alternative 3 (sync fail if you use route)
:

  • Device1: current-vlan, 
    NewVlan-self-IP-334
  • Device2: current-vlan

in this architecture, suppose you have a route that use your new vlan, you set it on device 1 when you will try to sync you will have an error on device 2 that specify you that you can't create this route witout selfIP on this vlan...

last point, if you failover on second member nothing will pass through your vlan because he is not informed in the second member.

Hope it's clear for you. keep me update.

Regards,