No traffic on network card in virtual Big-IP
Hi, We have two virtual deployments of F5 version 17.1.2.2 in a VMware environment, Each deployment has 3 network cards: MGMT external (for VSs) internal (for backend pool) Lately we started to experience a very strange behavior, where randomly, the external NIC stops receiving traffic. To resolve the issue we can restart the Big-IP, or disable/enable the NIC on the VMside. When taking pcaps on the BIG-IP there's just nothing coming in, this is why the F5 support told us they can't troubleshoot if there's no traffic, and pointed us to VMware support. We took pcaps and logs on the vmware side and it looks like traffic is not passing from the hypervisor to the VM but the support doesn't see any errors. Because the issue is random we can't simulate it. We tried to correlate the issue with vm migration, or external backups but couldn't pin point anything. We have a large virtual environment it this issue only occurs on two F5 machine (out of 400+ other VMs). I'm not entirely sure, but I think the issue started after upgrading from version 16.1.4.1 to 17.1.2.2. I was wondering if anyone stumbled upon something similar? Thanks
Intermittent Net::ERR_CONNECTION_RESET Error and Incomplete Loading over HTTPS
I have an F5 load balancing setup configured with two servers. My MVC web application, which incorporates Kendo UI, Jquery, and bootstrapping, is hosted on an IIS server with an SSL certificate. However, when accessing the application via HTTPS from outside the server, it often or sometimes results in a 'net::ERR_CONNECTION_RESET' error, with intermittent failures to load javascript and CSS files to the client browser. Strangely, upon reloading the page, the assets load properly, and the page functions as expected. This issue did not occur when the application was accessed via HTTP, where it worked properly without any issues. What could be the reason behind this problem?F5 appliances failing to establish OSPF with attached devices
Hi all, there is a little known 'feature' in the underlying Linux OS that has a hard limit of 20 network statements. If you go beyond 20, the additional networks will not be advertised in OSPF. I hit this limit after migrating services to my Big-IP. It took F5 support a while to find the cause as the feature isn’t widely known within F5 despite been over 10 years old. My workaround was to super-net a number of /24 subnets into /20, /21 statements which brought me back under the limit of 20 networks (conf t network statements in imish). If this isn’t possible you need to change the net.ipv4.igmp_max_memberships configuration & restart the OSPF process sysctl net.ipv4.igmp_max_memberships=25 zebos -r 0 cmd clear ip ospf process show ip ospf neighbor Above I am setting the hard limit to 25 networks & restarting the OSPF process. Note, adding with sysctl should allow the setting to survive a restart/upgrade – omit it & the increase will not survive a reboot. Showing the neighborships will now show expected results for the missing networks (statements 21-25)
ARP requests for 127.2.0.1
Our GTM (BIG-IP 11.4.1 Build 635.0 HF2) is constantly—several times a second—sending out ARP requests out the mgmt interface for the IP address 127.2.0.1 with a source address of 127.2.0.2. For example: 2014-11-26 11:59:44.543142 00:01:d7:d5:2c:01 -> ff:ff:ff:ff:ff:ff ARP Who has 127.2.0.1? Tell 127.2.0.2 2014-11-26 11:59:44.543149 00:01:d7:d5:2c:01 -> ff:ff:ff:ff:ff:ff ARP Who has 127.2.0.1? Tell 127.2.0.2 2014-11-26 11:59:45.543200 00:01:d7:d5:2c:01 -> ff:ff:ff:ff:ff:ff ARP Who has 127.2.0.1? Tell 127.2.0.2 2014-11-26 11:59:45.543205 00:01:d7:d5:2c:01 -> ff:ff:ff:ff:ff:ff ARP Who has 127.2.0.1? Tell 127.2.0.2 2014-11-26 11:59:46.543134 00:01:d7:d5:2c:01 -> ff:ff:ff:ff:ff:ff ARP Who has 127.2.0.1? Tell 127.2.0.2 2014-11-26 11:59:46.543140 00:01:d7:d5:2c:01 -> ff:ff:ff:ff:ff:ff ARP Who has 127.2.0.1? Tell 127.2.0.2 Does anyone know why this is happening or how I can make it stop?
New i2800 to Cisco 93180YC-FX3 Twinax
I've seen older post and I've used these before but cannot get them working now. Does anyone know if you can still use the Cisco Twinax cables (SFP-H10GB-CU3M)? My F5 is showing the following: Net::Interface Name Status Bits Bits Pkts Pkts Drops Errs Media In Out In Out --------------------------------------------------------------- 1.0 up 0 0 0 0 0 0 1000CX-FD 2.0 miss 0 0 0 0 0 0 none 3.0 miss 0 0 0 0 0 0 none 4.0 miss 0 0 0 0 0 0 none 5.0 down 0 0 0 0 0 0 none 6.0 down 0 0 0 0 0 0 none mgmt up 20.2G 6.2G 1.7M 670.7K 0 0 1000T-FD net interface 5.0 { if-index 352 mac-address 14:a9:d0:06:80:88 media-max 10000T-FD module-description "Unsupported Optic detected" mtu 9198 serial JPC23220CWT vendor CISCO-JPC vendor-oui 001897 vendor-partnum P3410UB03000-1 vendor-revision A0
Connection loss Client -> F5 BIGIP LTM
Hi all, I am currently experiencing an issue with an application that is being used on 3 application servers (windows server 2003), loadbalanced behind the F5 BIGIP. Users are sometimes losing connection to the server, which makes the application crash. I have launched a capture for one of these clients and I'm seeing the following when this issue occurs (capture.png): Client: 10.229.237.235, IP of virtual server on BIGIP: 172.20.5.41 From what I can see there is no SYN-ACK being returned from BIGIP. There are also a lot of messages in the log containing TCP Window Full & TCP out of order. When we let the user connect directly to an application server instead of passing through BIGIP, they have no issues. The capture is also very clean in that case, no retransmissions, no duplicate acks or TCP resets.. The TCP protocol being used is Protocol Profile (Client) - TCP LAN Optimized and for Protocol Profile (Server) - TCP WAN Optimized. Does anyone have an idea why BIGIP doesn't send a SYN-ACK in this case? I was thinking maybe an issue with receiving window & send buffers.. Or would I need a capture on the virtual server to further analyze this behaviour? Any help would be greatly appreciated! Thank you Kind regards Ronlab LTM - networks not hitting default gateway
Hi, I have installed a VM version of the F5 LTM. I have connected 3 interfaces on 3 networks form mgt, internal and external networks. The internal network is connected to an existing server vlan and the external is connected to an existing data vlan. I have created a virtual machine and pool members but my main issue is that from the F5 I can ping all assigned self IPs but only the default gateway of the mgt vlan. What I am trying to achieve is I have 2 servers and an F5 actually all on the same lab network. All I need to do is to route traffic into the f5 pointing towards the virtual machine IP and then route to either server based on a health monitor but I think I'm missing something basic. Oh I also have a default gateway pointing to the mgt address. Any info would be greatly received thanks GraemeStrange SNAT IP address behaviour
Hello everyone, Recently we've discovered a weird behaviour on our BIG-IP system. We are currently running version 11.5.1 on an 8950 Active/Passive HA pair. We have detected that a couple of servers, due to misconfiguration, are generating UDP traffic to port 1002 of an SNAT IP address which belongs to a SNAT Pool. Our BIG-IP is bouncing that traffic back to the network simply changing source an destination MAC address on the ethernet header. You can see it on the following screenshots: Is this an expected behaviour? Shouldn't F5 just drop this traffic? As additional info: the VS to which this SNAT Pool belongs is configured for port 80 HTTP. Thank you very much in advance for your answers. Best regards, Carlos
