Sync-failover group doesn't sync properly
Hello, I need some help with essential Active/Standby setup where I can't make two nodes to sync data. This is the problem I end up with: "did not receive last sync successfully" VLANs are configured like this: vlan tag tagged interface Client 11 1.1 HA 13 1.3 Server 12 1.2 Self IPs and routes are following [root@bigip1:Active:Standalone] config # ip route default via 192.168.159.2 dev mgmt metric 4096 10.11.11.0/24 dev Client proto kernel scope link src 10.11.11.111 10.12.12.0/24 dev Server proto kernel scope link src 10.12.12.121 10.13.13.0/24 dev HA proto kernel scope link src 10.13.13.131 127.1.1.0/24 dev tmm proto kernel scope link src 127.1.1.254 127.7.0.0/16 via 127.1.1.253 dev tmm 127.20.0.0/16 dev tmm_bp proto kernel scope link src 127.20.0.254 192.168.159.0/24 dev mgmt proto kernel scope link src 192.168.159.129 [root@bigip2:Active:Standalone] config # ip route default via 192.168.159.2 dev mgmt metric 4096 10.11.11.0/24 dev Client proto kernel scope link src 10.11.11.112 10.12.12.0/24 dev Server proto kernel scope link src 10.12.12.122 10.13.13.0/24 dev HA proto kernel scope link src 10.13.13.132 127.1.1.0/24 dev tmm proto kernel scope link src 127.1.1.254 127.7.0.0/16 via 127.1.1.253 dev tmm 127.20.0.0/16 dev tmm_bp proto kernel scope link src 127.20.0.254 192.168.159.0/24 dev mgmt proto kernel scope link src 192.168.159.130 Floating IPs on both devices are set to: - Client: 10.11.11.110 - Server: 10.12.12.120 Both devices have certificates, time is in sync via NTP, have the same version 17.1.0.2 Build 0.0.2 (provisioned from the same OVA) and license. Conif sync is set to: HA self IPs Failover networks is: HA + Management Mirroring: HA + Server BigIP1 is Online, BigIP2 is Forced Offline before I start building cluster. Hosts are connected via VmWare Workstation Lan Segments, thus no filtering is applied. I double check I can see packets in "tcpdump -nn -i" for any of the interfaces Client/Server/HA when for example trying to establish the SSH connection from the other host to the respective IP of the interface that is being watched. Then I add device trust. Soon both devices are shown as "In sync" in the device_trust_group. Then create a sync-failover group of two devices with Automatic Incremental Sync with Max sync size =10240. After this, the sync statuses are following: - device_trust_group = In Sync - Sync-Failover-Group = Awaiting Initial Sync If I run "tcpdump -nn -i any tcp" I mostly see packets on HA network for ports 1029 and 4343 If I run "tcpdump -nn -i any udp" I mostly see packets on HA network for port 1026 tmm log Sep 1 22:39:29 bigip1.sq.cloud notice mcpd[7261]: 01071436:5: CMI listener established at 10.13.13.131 port 6699 Sep 1 22:39:29 bigip1.sq.cloud err mcpd[7261]: 0107142f:3: Can't connect to CMI peer 10.13.13.132, TMM outbound listener not yet created Sep 1 22:39:29 bigip1.sq.cloud err mcpd[7261]: 0107142f:3: Can't connect to CMI peer 10.13.13.132, TMM outbound listener not yet created Sep 1 22:39:32 bigip1.sq.cloud notice mcpd[7261]: 01071451:5: Received CMI hello from /Common/bigip2.sq.cloud Sep 1 22:39:34 bigip1.sq.cloud notice mcpd[7261]: 01071432:5: CMI peer connection established to 10.13.13.132 port 6699 after 0 retries Sep 1 22:44:48 bigip1.sq.cloud notice mcpd[7261]: 01071038:5: Master Key updated by user %cmi-mcpd-peer-10.13.13.132 Sep 1 22:52:33 bigip1.sq.cloud notice mcpd[7261]: 01071451:5: Received CMI hello from /Common/bigip2.sq.cloud Sep 1 22:57:33 bigip1.sq.cloud notice mcpd[7261]: 01071451:5: Received CMI hello from /Common/bigip2.sq.cloud Sep 1 23:01:09 bigip1.sq.cloud notice mcpd[7261]: 01070430:5: end_transaction message timeout on connection 0xedc5a0c8 (user %cmi-mcpd-peer-10.13.13.132) Sep 1 23:01:09 bigip1.sq.cloud notice mcpd[7261]: 01070418:5: connection 0xedc5a0c8 (user %cmi-mcpd-peer-10.13.13.132) was closed with active requests Sep 1 23:01:09 bigip1.sq.cloud notice mcpd[7261]: 0107143c:5: Connection to CMI peer 10.13.13.132 has been removed Sep 1 23:01:09 bigip1.sq.cloud notice mcpd[7261]: 01071432:5: CMI peer connection established to 10.13.13.132 port 6699 after 0 retries Sep 1 23:06:11 bigip1.sq.cloud notice mcpd[7261]: 01070430:5: end_transaction message timeout on connection 0xedc5a0c8 (user %cmi-mcpd-peer-10.13.13.132) Sep 1 23:06:11 bigip1.sq.cloud notice mcpd[7261]: 01070418:5: connection 0xedc5a0c8 (user %cmi-mcpd-peer-10.13.13.132) was closed with active requests Sep 1 23:06:11 bigip1.sq.cloud notice mcpd[7261]: 0107143c:5: Connection to CMI peer 10.13.13.132 has been removed Sep 1 23:06:11 bigip1.sq.cloud notice mcpd[7261]: 01071432:5: CMI peer connection established to 10.13.13.132 port 6699 after 0 retries Lastly I push the configuration from the device that is in the online state to the Sync-Failover-Group. Then the sync status is like shown on the screenshot at the beginning of this message. Suggested sync actions (push A or B to group) do not help. Looked through:K63243467,K13946 Appreciate any suggestions that can resolve or properly push/pull the config. Thank you!
F5OS download backup via API
Hi there, I need to create and download F5OS backup via API. I checked the documentation I could find, but even I use content-type header as described (first time I see 2 Content-type headers at the HTTP header, but OK) but I keep getting this: 415 (Unsupported media type) <errors xmlns="urn:ietf:params:xml:ns:yang:ietf-restconf"> <error> <error-type>application</error-type> <error-tag>malformed-message</error-tag> <error-message>Unsupported media type: multipart/form-data; boundary=--------------------------821439130941430490548847 ; Should be one of: application/yang-data+json, application/yang-data+xml.</error-message> </error> </errors> Looke like Content-type: multipart/form-data is not supported even though the documentation guides me to use it. Anyone knows what to do with this? ThanksUploading SKCS 12 File to F5 Device
I have been stuck on trying to upload an SKCS 12 file to an F5 device. A regular cert works and other files have worked as well but I constantly get an issue "Chunk byte count 7611 in Content-Range header different from received buffer length 11616" despite me having the correct Content-Range calculation. I am currently on python and am posting to /mgmt/shared/file-transfer/uploads/{file_name} I would appreciate the help greatly, thank youInstalling a PKCS 12 File onto an F5 Device
I have been able to upload my pfx file to the devices downloads and such and checked using /mgmt/tm/util/bash. I have been trying to install it on the F5 device using: { "command": "install", "name": f"{appname}.geico.com", "from-local-file": f"/var/config/rest/downloads/{cert_file_name}" } But I receive the error, Error uploading certificate: {"code":400,"message":"Key management library returned bad status: -7, error:0D07207B:asn1 encoding routines:ASN1_get_object:header too long","errorStack":[],"apiError":26214401} What can I change to correctly install?
FQDN resolve in non default domain name.
Hi, Anyone can help to modify this irule using more than one DNS server (If this DNS server 8.8.8.8 down, it will pick up other the DNS server 9.9.9.9). Thanks for your help, i appreciate it. when HTTP_REQUEST { set ips [RESOLV::lookup @8.8.8.8 "FQDN.amazonaws.com"] log local0. "example.com is currently at IP $ips, forwarding to node: [lindex $ips 0]%1 - The clients up address [IP::client_addr]" node [lindex $ips 0]%1 443 }Keep encoding when request is handled by irule
I have custom irule to check data in payload. I noticed issue when non-latin characters are detected, for example Japan characters. In this case seems that byte array is not read correctly (2 bytes vs 4 bytes) what just corrupt/change payload. I am almost sure that I hit follow: https://my.f5.com/manage/s/article/K22406348. There is mentioned option to use binary scan but does not work for me. In generally I do not add anything to payload or modify it. I just compare some properties and block request if it match condition. How I can keep origin payload as it is?
about persist hash [HTTP::query]
hi everyone I want to use http::query based session hold because my source address is a snat address distinguished by a different http::query. I hope this will be supported!!! Use the following irules : ################################################### when HTTP_REQUEST { log local0. "http_path [HTTP::path]" log local0. "http_query [HTTP::query]" set query [HTTP::query] persist hash "query" } OneConnect profile Persistence hash Is that okay?
Cannot see floating MAC address outside of ESXi
Hello, I am currently configuring two F5 BIG-IP LTM VM load balancers that are in high availability mode. The self IP addresses of both VMs are visible outside of ESXi hosts, but the frontend floating IP is not visible. This floating IP address is configured to be in the same VLAN as self IP just traffic-group-1 is applied. Looking at the ARP on the device that is the next hop for both F5s, there is no MAC address for the frontend floating IP address. Also, I cannot see this MAC address on the switch where the ESXi is connected. Looking at the packet capture on the active F5, I can see that an ARP request was made for a floating IP and that the F5 responded, however this did not go outside the ESXi host at all. Any ideas, is there anything specific on the ESXi host that needs to be configured? Thanks in advance!
curl: (56) SSL read: errno -5961
Hello All, We have an application VIP on F5. User is trying to access the application VIP on F5 using HTTPS from a linux system and the SSL handshake between the application on linux system and the F5 VIP is not working. we tried using curl to figure where the session is getting droped and we are finding the below error: SSL read: errno -5961 Closing connection 0 curl: (56) SSL read: errno -5961 Could you please help me know what could be the possible cause of the issue and anything I can do on the Big-IP side to fix the issue? The certificate is installed properly on the linux system and the certificate chain is also correct. The team that manages the F5 part tells us that the network interface it points to on the server side does not have any mismatch on the MTU side which is set to 1500 as well as on the server side. What could be another cause for the problem? Thanks a lot in advance for your help. Regards
