Issue with 2 parallel F5 clusters
Hello everybody and first of all thank you for taking the time to read my issue! The issue that I have is in regards to a migration We have a productive F5 BigIP cluster (Active/Standby), let's call this "Old F5", which has a lot of Virtual Servers in partitions, with specific pools and monitors for each application/service This device also has 2 Vlans, internal (vlan11) and external (vlan10), and 2 interfaces in an LACP that it's tagged on both Vlans, and it's connected to the same one leg to a Cisco APIC It has 2 Self IP addresses (one for each Vlan): 10.10.10.1-Vlan "external" 10.20.20.1-Vlan "internal" (numbers are just for example) It also has 4 Floating IP address (2 for each Vlan) with 2 traffic groups: 10.10.10.2-Vlan external traffic group 1 10.10.10.3-Vlan external traffic group 2 10.20.20.2-Vlan internal traffic group 1 10.20.20.3-Vlan internal traffic group 2 This device (cluster) has to be replaced by another F5 BigIP cluster (let's call this new F5), this device is an identical copy to the old F5 (the config was took from the old one and imported to the new one), meaning same Vlans, monitors, pools, VServers IP addresses etc At the moment this one has the 2 interfaces disabled and a blackhole default reject route set up in order to not interfere with the old F5 which is the productive one. The ideea is to configure the new F5 device with IP addresses from the same subnet (for example 10.10.10.5), and disable all the Virtual Servers so it doesn't handle traffic (the nodes, monitors, pools stay up on both devices), and have the 2 F5 devices, old and new, running in parallel and then move the Virtual servers one by one by just disabling the VS on the old F5 and enable it on the new F5. At this point we also remove the blackhole route, configure the correct default static route (the same which is on the old F5), and enable the interfaces This sounded and looked good, on the new F5 the nodes, pools are green and the Virtual servers are disabled as expected. On the old productive F5 everything is up and green BUT if I try to reach one of the Virtual servers, either by the Virtual IP address or hostname the attempt just times out without any response (if I try to telnet to the VS on port 443 it connects meaning that the old F5 accepts the traffic) I tried to disable on the new F5 also the nodes but still the same behaviour, the only to get it back to work is to disable the interfaces on the new F5 and add the default reject blackhole route. This is not how I imagined it to work, in my mind I was expecting that the old F5 will work as normal, and the new F5 device will see the nodes and pools up (confirming good communication) but don't handle any traffic regarding the Virtual servers because they are disabled. Does anyone have any idea what is causing this issue, why when both F5 devices are up in parallel, the connection to the Virtual server through the old productive F5 times out while that F5 sees both the pools and Virtual servers as up and running. Thank you in advance!Is there F5 Virtual Wire(vWire) variable support for vCMP or rSeries tenant?
Hey Everyone, Is there F5 Virtual Wire(vWire) variable support for vCMP or rSeries tenant? I am asking this about vCMP iSeries or rSeries 5800 as the vWire is created on the host and allocated to the tenant but for example in Virtual-wire Configuration and Troubleshooting | DevCentral there are system db variables and how are those supported in this case ? Do you configure this from the vCMP quest or Tenant or from the vCMP host or rSeries appliance ?
Credentialed Scanning - F5OS - Rseries
After solving the remote authentication issue previously with F5OS. My next question is related to credentialed scanning on R series appliances running F5OS. The tenable agent logs in via SSH and tries to run commands in the shell to pull system information. This has never been on issues on the iseries appliances and BIG-IP guests as they allow uses directly to the shell upon login. All linux commands run as intended. F5OS is a new beast for me to understand as it dumps you into its own OS. The shell is protected and only root at the local level is allowed access to the linux shell. This is the issue I face with credentialed scanning. Authentication works perfectly fine but the ability to run the proper commands at the appropriate level seems to be locked and it doesn't appear I can grant shell access to remote accounts. Anyone have any experience running authenticated scans on their rseries appliances with f50S?
HA between rSeries tenant and iSeries appliance.
According to F5 documentation, the BIG-IP system supports either homogeneous or heterogeneous hardware platforms within a device group. I want to confirm if anyone has tried to put rSeries tenants and iSeries appliances in the same cluster? Obviously, I understand they will need to be on same version and of course vlans will be same on both. If you have tried this before, what were your challenges and how did you overcome them? I am considering this approach because it makes migration easier and seamless.
r4600 Tenant CPU Assignment
The r4600 has 12 CPUs (by default) available for a max of 2 tenants. My initial thought was to assign 6 CPUs to each but that is not an option. 4, 8, or 12 are the only options. Question: Are these options of 4, 8, or 12 CPUs arbitrary or do they have to do with the Atom chip architecture? It seems like a waste. I can either do 4 CPUs each wasting 4 or do a 4 CPU tenant and an 8 CPU tenant. The only other option would be to purchase the license for the additional 4 CPUs to make each tenant 8 CPU. Regards, MattrSeries Management route
Hi Experts, I have a situation in rSeries where I want to define a management route for a specific IP (outside the OOB network). I'm facing a scenario where this server is outside the OOB network and cannot be reached from rSeries. I can see from the PCAP that rSeries is able to receive the ICMP request, but rSeries is not sending an ICMP reply and only an ARP request, as if it doesn't know how to reach the server IP. The following steps I tried but still fail: Adding the allowed IP address: server network and server IP with all protocols. Adding a route to the Linux kernel. Note that only the IP outside the OOB network is not reachable, and no ACL/FW in between. Thanks.
Issue while migrating config from 4000s to r4600
Hi All, we are trying to migrate config from 4000s to r4600. We have created UCS on 4000s but while loading it on a tenant on r4600, we got an error saying ""load sys partition all platform migrate " - failed -- 010713d0:3: Symmetric Unit key decrypt failure - decrypt failure, configuration loading error: high-config-load-failed". Before loading the UCS from 4000s device to tenant, we copied the master key to the new tenant and verified it as well. The command used to load the UCS : load sys ucs <file name> no-license platform-migrate Didn't see any other error logs in /var/log/ltm. Could someone suggest how to resolve this issue ? Please note we are using a CA device certificate and not self signed certificate for the device. Also the management IP, trunk name and number of trunk ports in the UCS are different from those on the tenant.
