iControl REST Token Limits and VE Lab Edition
We are currently working to implement an Ansible-based solution for configuring for our BIG-IP LTM/APM environments and have hit a stumbling block. We have a playbook that we're executing to create all the LTM objects in the environment, but when we run it against our staging environment (running on VE Lab Edition VMs) and have a significant number of objects to create, we eventually get the following error from one of the tasks: fatal: [bigip_host]: FAILED! => {"changed": false, "msg": "Unable to connect to bigip_host on port 443. The reported error was \"400 Unexpected Error: Bad Request for uri: https://bigip_host:443/mgmt/shared/authn/login\nText: u'{\"code\":400,\"message\":\"user admin_user_used_by_ansible has reached maximum active login tokens\",\"originalRequestBody\":\"{\\\\\"username\\\\\":\\\\\"admin_user_used_by_ansible\\\\\",\\\\\"loginProviderName\\\\\":\\\\\"tmos\\\\\",\\\\\"generation\\\\\":0,\\\\\"lastUpdateMicros\\\\\":0}\",\"referer\":\"10.209.19.47\",\"restOperationId\":7307267,\"kind\":\":resterrorresponse\"}'\"."} We'd found a GitHub Issue that referenced a similar issue, but it was closed and indicated that this shouldn't be an issue with the version of Ansible (2.7.5) we're running. An important point that this issue brought to light is that when the Ansible modules are making calls against the API, they are getting new login tokens for each task. Out of curiosity, we tried running the same playbook against the hardware BIG-IP appliances that will be our new production environment, and we've yet to run into this issue, even running the playbook several times in quick succession. So it seems like the VE Lab Edition has a limit on how many API login tokens a user can have that isn't present for non-Lab licensed instances. We're hoping to get some feedback on a few points: Are we right about the Lab Edition having a limit? If there is a limit on the Lab Edition, what is it? Does anyone have thoughts for how we might be able to work around this limit? Some searching brought me to this previous question, which talks about adjusting the timeout on tokens, but from the standpoint of wanting them to be longer-lived, and when using the iControl API directly, rather than via a tool like Ansible. Maybe if we could adjust that default timeout to something smaller? Otherwise it seems like we'd have to either look into building our own custom fork of the Ansible modules, or seriously reconsider how we're going to approach this.
Big-IP VE Lab License Not Working With v10.2
Actually two questions, both dealing with the installation of the Virtual Lab VE license. 1) I have one license running successfully on a VM. I want to move the license to a new VM. Do I need to contact support for this or is there a way to do it without deactivation/reactivation? 2) I bought a second license, to configure HA. I have yet to install/activate it. I currently need to test upgrading from 10.2 to 11.5. I downloaded the 10.2 VM (.OVA) from F5, but I get an error that my license cannot be installed on that version. What gives? Shouldn't my license be valid for any version? Thanks!