Forum Discussion

Johnde's avatar
Johnde
Icon for Cirrus rankCirrus
Feb 19, 2020
Solved

Need recommendation on Active-Active F5 setup

Hello Experts,   I need few recommendations/inputs from you. Currently i am managing two F5 HA clusters in active-standby mode. Now we have one requirement of deploying one HA cluster at one of o...
application delivery
BIG-IP
F5 HA
LTM
security
  • Mayur_Sutare's avatar
    Mayur_Sutare
    Feb 19, 2020

    Hi John,

     

    It absolutely depend on your requirement and the platform capacity. Just one quick question. do you have hardware or VM series platforms?

     

    Now if you really want to deploy cluster in active-active mode. Below are some deployment related inputs from my end -

     

    1. As you have mentioned you have two subnets to be taken behind F5 i.e. LAN and DMZ. You can configured to take load on LAN on F5-A and DMZ load on other F5.
    2. This can be configured using traffic groups. There is one traffic group by default. You can create new traffic group.
    3. e.g. in traffic group 1, F5-1 will be active and other will be standby and for traffic group 2, F5-2 will be active and other will be standby.
    4. Also there will be failovers like if F5-1 goes down, F5-2 will take traffic on DMZ as well as LAN and vice-a-versa.
    5. You can even configure separate partitions for LAN and DMZ to keep separate configuration and easy to manage. Also have separate route domains. e.g. for LAN 1 and DMZ 2.

     

    This way you can plan your configuration. Actually i have tested exactly same deployment in my LAB setup Let ms know if you have any queries on this.

     

    Mayur

Mayur_Sutare's avatar
Mayur_Sutare
Icon for MVP rankMVP
Feb 19, 2020

I would recommend below few points for management perspective -

 

  1. Take access of F5 using either LAN or DMZ floating interface IP. e.g take access using LAN floating interface.
  2. So you will get login to F5-1 by default as F5-1 is acting as ACTIVE for LAN.
  3. Then you can make configuration changes.
  4. If you are doing changes related to DMZ, in that case you need to sync configuration at that point only as you are making changes on F5-1 and F5-2 is acting as ACTIVE for DMZ. In such case, you can keep sync configuration to 'auto' and avoid manual sync everytime to sync DMZ related changes. But thats upto you how you want to keep it.
  5. If F5-1 is down, in that case you will get login to F5-2 using LAN floating as it will act as ACTIVE for LAN as well as DMZ at that moment.

This way, you can manage your F5s efficiently.

 

Hope it helps you!

 

Mayur