F5 is upgrading its customer support chat feature on My.F5.com. Chat support will be unavailable from 6am-10am PST on 1/20/26. Refer to K000159584 for details.

Forum Discussion

Venkatesh_786's avatar
Venkatesh_786
Icon for Altostratus rankAltostratus
Jun 15, 2020

Do attack signatures, bot signature & server technology set synchronizes in HA pair

Dear Team,   Can anyone help me to obtain clarification on my below queries.   We are migrating our asm from f5 big-ip s4000 to i4600 series. so as per our plan of action we will be disconne...
application delivery
ASM Advanced WAF
BIG-IP
Venkatesh_786's avatar
Venkatesh_786
Icon for Altostratus rankAltostratus
Jun 25, 2020

Dear Ivan,

 

Thanks for the reply.

 

For your update we have performed the migration activity from s4000 platform to new i4600 platform a couple of days before following below steps:

 

>We forced offline one standby device in an existing HA pair of s4000 Platform. Performed device trust reset to break the existing HA.

 

>Disconnected all network interface cables and connected it to one of the new platforms (i4600), which was also in forced offline state to prevent it from going active in the middle of the activity.

 

>Rebuild HA by adding a new i4600 platform to s4000's device trust and device groups. Performed Config-sync from s4000 to i4600 platform (we decided to fail-over the traffic to i4600 once config-sync is successfully).

 

Sync Issue Encountered:-

 

Sync error on <hostname_of_i4600>: Load failedfrom /Comman/<hostname_of_s4000> 01b9000f:3: This platform doesn't support DoS hardware capability, which is needed to disable this sys db variable.

 

Recommendation from Support Team:-

 

We got an update from a support Team that there is some compatibility issue as the DoS sys db variable is set to "false" in s4000 and the same is set to "true" in i4600. To perform Config-sync, we should change the DoS sys db variable value to "true" in s4000 as we cannot change it to "false" in i4600.

 

Also, Support Team committed the change might cause increase in cpu usage on s4000 platform and till the recommendation arrived we have already crossed the downtime limit and we did not know till what extent the high cpu usage will impact or occur so we decided to roll-back the activity and rescheduled it once we get a proper resolution.

 

i just thought to share you the history. can you provide some clarifications on my below point if possible for you..??

 

  1. what is the functionality difference between DoS sys db variable value set to "true" and DoS sys db variable value set to "false"....??
  2. As the sync-fail-over-group status was showing "Sync failed". so in this case, it is clear that sync will fail but just wanted to confirm will fail-over works in this state..??

 

Thanks & Regards,

Venkatesh Mudiraj