TCP iApp template

[Joe_Jordan]

Problem this snippet solves:

Use this TCP iApp template to configure high availability and optimization for TCP implementations.

As of 3/29/17, this release is now available on downloads.f5.com in the Release-Candidates folder of the TCP directory.

RC4

RC4 fixes an issue where the iApp would fail if using a non-default Route Domain.

RC3

RC3 contains updates for new BIG-IP AFM IP Intelligence threat categories to support BIG-IP v13.1, and adds support for route domain 0 from non-Common partitions.

RC2

RC2 of the iApp template solves an issue where the iApp deployment fails when a system management route is not present.

RC1

This initial release of the iApp is available on downloads.f5.com in the RELEASE-CANDIDATE directory.

Until the associated deployment guide is available, for detailed information and configuration assistance see the inline help.

How to use this snippet:

1. Extract (unzip) the latest version of the tcp iApp template file.
2. From the BIG-IP system web-based Configuration utility.
3. On the Main tab, expand iApp, and then click Templates.
4. Click the Import button on the right side of the screen.
5. Click a check in the Overwrite Existing Templates box.
6. Click the Browse button, and then browse to the location you saved the iApp file.
7. Click the Upload button. The iApp is now available for use.

Code :

https://downloads.f5.com/esd/index.jsp

[Terabank_271659]

Loaded the template onto a v12.1.1 LTM and got the following error: Error parsing template:can't eval proc: "script::run" connect failed while executing "http::geturl $url -timeout 5 -validate 1" (procedure "is_aws" line 4) invoked from within "is_aws" (procedure "script::run" line 14) invoked from within "script::run" line:1

[mikeshimkus_111]

Hi Terabank, do you get that error when you import the template or when you try to deploy it?

[Terabank_271659]

Hi mikeshimkus, I imported this template without any error, but when I try to create new iApp and try to select template, I get this error: Error parsing template:can't eval proc: "script::run" connect failed while executing "http::geturl $url -timeout 5 -validate 1" (procedure "is_aws" line 4) invoked from within "is_aws" (procedure "script::run" line 14) invoked from within "script::run" line:1

[Vidar_Haugsvær_]

I experience the same error

[mikeshimkus_111]

Do these BIG-IPs have external connectivty?

[Vidar_Haugsvær_]

Yes it does

 

~ curl -i HTTP/1.0 301 Moved Permanently location: https://devcentral.f5.com/ Server: BigIP Connection: Keep-Alive Content-Length: 0

 

[mikeshimkus_111]

We haven't been able to reproduce this issue.

If you can open a case with F5 support and let me know the case number, I will be able to track it.

[Jason_Grimme_15]

same issue here, anyone know the fix?

I'm running 12.0.0 Build 3.0.654 Hotfix HF3

[Jason_Grimme]

same issue here, anyone know the fix?

I'm running 12.0.0 Build 3.0.654 Hotfix HF3

[Jason_Grimme_15]

well I contacted F5, and even though the template is included in the current bundle on their support site, the are kicking the can back over to Devcentral.

If anyone ever found a fix for this I'd apprecaite it

[Jason_Grimme]

well I contacted F5, and even though the template is included in the current bundle on their support site, the are kicking the can back over to Devcentral.

If anyone ever found a fix for this I'd apprecaite it

[mikeshimkus_111]

What's your case number?

[Jason_Grimme]

C2334881, thanks!

[Jason_Grimme_15]

C2334881, thanks!

[mikeshimkus_111]

Jason, what role does the user "jgadmin" have on the BIG-IP?

[Jason_Grimme_15]

jgadmin is the user ID I logon go the BIP-IP. It's an LDAP account from Active Directory

[Jason_Grimme]

jgadmin is the user ID I logon go the BIP-IP. It's an LDAP account from Active Directory

[mikeshimkus_111]

Right, but what role(s) is it assigned on the BIG-IP? I get a similar error message when I try some of the other user roles (like application editor and manager). If you can deploy this using the "admin" account, that would prove something.

[Jason_Grimme]

Ah, ok. So the account is a member of an LDAP group, which is setup on the BigIP as a remote group, 'line order' 1000, and assign the role of 'Administrator'

[Jason_Grimme_15]

Ah, ok. So the account is a member of an LDAP group, which is setup on the BigIP as a remote group, 'line order' 1000, and assign the role of 'Administrator'

[mikeshimkus_111]

Is it possible to test with a local user who has the "administrator" role?

[Jason_Grimme]

so yes, sorry, I did logon w/ the local 'admin' user and had the same issue.

should I re-upload the template as that user?

Actually I tried on my dev box, which doesn't have the LDAP remote group defined, so I had to be as the local admin user and had the same result.

[Jason_Grimme_15]

so yes, sorry, I did logon w/ the local 'admin' user and had the same issue.

should I re-upload the template as that user?

Actually I tried on my dev box, which doesn't have the LDAP remote group defined, so I had to be as the local admin user and had the same result.

[mikeshimkus_111]

Can you get a fresh copy of the iApp package from and load the template from the RELEASE_CANDIDATES folder, then try it again?

[Jason_Grimme]

OK, I had downloaded it earlier this week, and it looks to be the same one, but I did go w/ west coast this time, thinking maybe that download local was cooler since they have better weather 🙂

Same results, uploaded and tried to configure as local admin user.

[mikeshimkus_111]

Check with the support engineer for your case. I gave him a custom version of the iApp template without the procedure that is causing the problem.

[Jason_Grimme]

will do, thanks!

[Jason_Grimme]

looks goood!

[dfairles]

Can we all get a copy of that template? The checking for AWS makes it impossible for us to use.

[mikeshimkus_111]

Sure, but would you be willing to upload a qkview to https://ihealth.f5.com (and send me the link in a PM)? Would like to compare configurations since we I have not been able to reproduce this yet.

[Montaser_Omer_1]

Hello Guys

I have the same issue here after I upgraded to 12.1.2, I am not able to use the TCP iApp template, the below error is appearing to me:

Error parsing template:can't eval proc: "script::run" connect failed while executing "http::geturl $url -timeout 5 -validate 1" (procedure "is_aws" line 4) invoked from within "is_aws" (procedure "script::run" line 14) invoked from within "script::run" line:1

Please help

[mikeshimkus_111]

Hi Montaser, please open a ticket with F5 support and reply here with the ticket number so I can track the issue. We have not been able to reproduce the problem, so we will need to see your configuration before we can address it. Mike

[mikeshimkus_111]

Also, can you verify that you have a management route set on your BIG-IP? From tmsh, you can run list sys management-route.

[dfairles]

We are all having this issue because the iapp tries to connect to AWS. Why is it trying to connect to AWS? And not only just to AWS, but a specific AWS?!?

[mikeshimkus_111]

The iApp supports deploying for "HA across availability zones" when run in AWS. It's connecting to the AWS metadata service to verify the environment, not to a real IP address.

[mikeshimkus_111]

Please give the RC2 version of the template a try, and let me know how it goes.

[dfairles]

Thank you! It works now.

[Rajeev_Swain_36]

Hi Mike and Deniel , Please give me RC2 version or link to download

[Joe_Jordan]

Hello Rajeev, You'll find there's now an RC-4 in the zip file on (instructions above). I'll be updating this page shortly. Do you just need the latest, or is there a reason you need RC-2? RC-3 and 4 descriptions are now above.

Joe

[Javier_I_327252]

This template has the variable irules__irules but iRules needs an http profile configured. I could not find a variable to set the http profile directly from the iApp. Is there a way to set that?

[Joe_Jordan]

Hi Javier, If you are attempting to use an iRule with HTTP commands (such as HTTP_REQUEST), you should use the HTTP iApp instead of this TCP iApp. The HTTP iApp ships on the box by default.

Thanks Joe

[Javier_I_327252]

Hi Joe, a configuration I need about TCP iApp is a vip in "other data center or availability zone", I do not see this in http, please correct me if I am wrong, I can start checking that one.