vcmp

95 Topics

Install status audited on boot location where I try to install new software
Hi, I'm trying to install 16.1.3.1 over a Boot Location where 13.1.3.6 was some time ago (I do have 3 boot locations over all). Once the image gets tested it does not install as it should but instead the old software version goes into "Audited" status with not progress whatsoever. This lasts indefinetly (or at least it did not change after several hours today...). I'm upgrading from 16.1.2.2 to 16.1.3.1 I rebooted the box, It went back to normal but once I tried to install new soft again it once more gets stuck in audited. Also - it seems that the device makes a local copy of the image as I'm quite sure I deleted the local copy of 13.1.3.6 from the device before I reattempted the installation. (see screenshot). No entries are appearing in the liveinstall.log and when I do show sys software it does show the audited status: -------------------------------------------------------------------- Sys::Software Status Volume Product Version Build Active Status Allowed Version -------------------------------------------------------------------- HD1.1 BIG-IP 13.1.3.6 0.0.4 no audited yes HD1.2 BIG-IP 14.1.4.4 0.0.4 no complete yes HD1.3 BIG-IP 16.1.2.2 0.0.28 yes complete yes This happens on a VCMP guest. The host is currently running 16.1.3.1 Another attempt at install is not possible unless I reboot the device. Any ideas?
Solved
Bartek
Sep 29, 2022 Place Technical Forum
2.4KViews
0likes
4Comments
VCMP guest deployed, but does not appear under VCMP guest status
I have a pair of 7200s running active/active, with four vcmp guests each that run active/standby between them. I noticed that one of the vcmp guests doesn't show up under "guest status," the same guest on both chassis. Does anyone have any experience troubleshooting something like that? The chassis are running 12.1.3, and the "delinquent" vcmp guest is running 11.5.4 HF1. The other guests are currently running 12.1.2 HF2 and 13.0.0 HF3. I intend to upgrade all guests to their current rev's latest maintenance release. The 11.5.4 one I'll upgrade to 11.5.5 (rather than 12.x) due to an older app running behind it (long story...). Thanks!
Fallout1984
Jan 29, 2018 Place Technical Forum
1.7KViews
0likes
5Comments
vCMP Guests - Traffic Group shows "Initializing / Not Synced"
Folks, I have two vCMP guests on a Viprion blade that were on 11.3 HF5 with no issues but as of a few minutes ago are now on 11.3 HF9. The configs have synced across peers - I have pretty green indicators in the top left hand side of the GUI. But when I navigate to Device Management -> Traffic Groups, the "Next Active Device" field says, Initializing / Not Synced." What can I do to correct this? What is the issue that has caused this to happen? Thanks, Timothy
Solved
Timothy_92333
Jul 07, 2014 Place Technical Forum
1.6KViews
0likes
15Comments
BIG-IP :: vCMP Host & Local Images :: Not Showing Host Images on Guest
It looks like after v12, the ability to have Host and Local images went away? On v13 now -- it appears that my vCMP guests can only see Local image sources and not the host images... whereas prior to upgrade, they could see both. In the GUI under System -> Software Management -> Image List. I only see Local images. Via CLI, my guest /shared/images is empty, but they are present in that path on the host. Is there a way to get this back? According to the documentation, "BIG-IP® software images that are stored and managed on the vCMP® host are available for vCMP guests to install. The vCMP host presents a list of those images within each guest for guest administrators to use as needed.... All ISO images that the host administrator has imported into the host's /shared/images folder automatically appear on each guest as available for installation." ... but that does not seem to be the case for me. word@(das-guest)(cfg-sync In Sync)(Standby)(/Common)(tmos) list sys software image word@(das-guest)(cfg-sync In Sync)(Standby)(/Common)(tmos) word@(das-guest)(cfg-sync In Sync)(Standby)(/Common)(tmos) list sys software block-device-image word@(das-guest)(cfg-sync In Sync)(Standby)(/Common)(tmos) word@(das-host)(cfg-sync Standalone)(Active)(/Common)(tmos) list sys software image sys software image BIGIP-13.1.1.2-0.0.4.iso { -- trimmed -- version 13.1.1.2 } sys software image BIGIP-14.1.0-0.0.116.iso { -- trimmed -- version 14.1.0 } word@(das-host)(cfg-sync Standalone)(Active)(/Common)(tmos) It changed when I went from 12 to 13. Thanks in advance.
Ryan_34424
Jan 02, 2019 Place Technical Forum
1.3KViews
0likes
9Comments
How is choosen the master or primary slot of the cluster?
Hi there, I'd like to know how the cluster master slot is choosen? Is there any rule or algorithm to choose the primary slot on boot? I'm wondering why my Viprion has decided this configuration after booting: On the vCMP host: ----------------------------------------- Sys::Cluster: default ----------------------------------------- Address 192.168.16.32/21 Availability available State enabled Reason Cluster Enabled Primary Slot ID 1 Primary Selection Time 11/27/14 09:03:31 ---------------------------------------------------------------------------------------------------------------------- | Sys::Cluster Members | ID Address Availability State Licensed HA Clusterd Reason ---------------------------------------------------------------------------------------------------------------------- | 1 192.168.16.33 available enabled true active running Run | 2 192.168.16.34 available enabled true active running Run | 3 :: unknown disabled false unknown shutdown Slot powered off or empty, manually disabled | 4 :: unknown disabled false unknown shutdown Slot powered off or empty, manually disabled On the guest: ----------------------------------------- Sys::Cluster: default ----------------------------------------- Address 192.168.16.55/21 Availability available State enabled Reason Cluster Enabled Primary Slot ID 2 Primary Selection Time 11/27/14 09:06:27 ---------------------------------------------------------------------------------- | Sys::Cluster Members | ID Address Availability State Licensed HA Clusterd Reason ---------------------------------------------------------------------------------- | 1 :: available enabled true active running Run | 2 :: available enabled true active running Run | 3 :: unknown enabled false unknown shutdown Slot powered off or empty | 4 :: unknown enabled false unknown shutdown Slot powered off or empty I'd expect to see the guest active on slot 1 too, how is this? It doesn't matter that the slot 1 is the active one for the host and slot 2 for the guest?
Angel_Lopez_116
Dec 01, 2014 Place Technical Forum
1.2KViews
0likes
8Comments
vCMP host and compatible guest version
I have three devices (2 - i7800 and 1 - i10800) with vCMP. I want to know if I can upgrade a guest to version 13 or 14, the host are running a 12.1.3.x version. I already checked the vCMP host and compatible guest version matrix, but it says nothing about 12.1.3.x version
Solved
Enrique_Breceda
Dec 03, 2019 Place Technical Forum
1.1KViews
0likes
1Comment
Right procedure to shutdown a Viprion system with vCMP
Hi there, I got a Viprion with two blades, vCMP and several guests, and I wonder which is the recommended procedure to shutdown the whole system. I don't know if it's enough with a "clsh shutdown -h now" at vCMP level or I should to do that same command in each guest before doing it in the vCMP system. As an alternative to doing a shutdown of each guest, I've read about using tmsh to change the state of all guests to provisioned before doing the shutdown of the vCMP system. Is this the preferred procedure instead of doing a "clsh shutdown" from inside the guest? Would it be differences between doing a shutdown on the guest or deprovisioning it from vCMP on boot time? I guess that if I deprovision a guest before shutting down the vcmp system, when I boot the system, the guest will be in deprovisioned state and I'll have to deploy it again, right? If I do a shutdown in the guest before the shutdown in the vcmp system, on boot time, what would be the guest state? I have to define the shutdown and boot procedures for a maintenance stop on our data center and I don't know which procedure would be the better. Thanks a lot.
Solved
Angel_Lopez_116
Dec 04, 2014 Place Technical Forum
1.1KViews
0likes
7Comments
vCMP guest status is "ModuleNotLicensed::LICENSE INOPERATIVE"
Hello All, One of the vcmp guest's status is "ModuleNotLicensed::LICENSE INOPERATIVE" Other guests are working fine. How to resolve the guest license issue? If the guest's license is propagated by host, why only 1 guest has license issue?
yssp
Jul 18, 2022 Place Technical Forum
1KViews
0likes
4Comments
Ansible - Bricking freshly installed vcmp guests with ansible
Hello fellow F5 admins, currently I try to established a workflow, where new vcmp guests are created and configured with a standard basic config (and even building a HA setup). The creation part is working, but here begin the problems: tl;dr Question: What is the proper way to bootstrap a freshly installed vcmp guests (or appliance), when you are forced to change the default passwords on 1st login, without doing it by hand? The only solution I found (link below) will lock me out of the system forever. Long Version: Freshly installed systems enforce a password change for admin user on 1st access. This password change cannot be accomplished with the standard ansible module "bigip_user". If you try, you will get an error telling you, password has expired and it has to be changed. I then found an article about the security password policy and how one is supposed to change the password with ansible (https://techdocs.f5.com/en-us/bigip-14-0-0/big-ip-system-secure-password-policy/secure-password-policy-chapter-title.html) So I gave it a try and the password was changed "a" password, but not the one provided by the playbook variable. Neither GUI nor SSH or REST login will work. I am locked out. Befor you ask: yes the password in ansible-vault style is correct, because it is used to create the guest on the vcmp hosts. Here is my playbook: --- - name: Test vCMP-Guest hosts: vcmp_guests gather_facts: false vars: f5_api_admin_user: admin f5_api_admin_password: !vault | $ANSIBLE_VAULT;1.1;AES256 35613438373864653838386266616364666366363332646635303036343266646664656333643932 6462363934306365636265313038376436353032303330370a656434643837343165316333393932 66616133376433303136366664303563373034353630656531663864323433663166653539303937 3937646663613064390a663631623733376339353735633362633139383635386661376137653434 6237 bigip_provider: server: "{{ ansible_host }}" server_port: 443 user: "{{ f5_api_admin_user }}" password: "{{ f5_api_admin_password }}" validate_certs: false transport: rest tasks: - name: Set admin Password uri: url: "https://{{ ansible_host }}/mgmt/shared/authz/users/admin" method: PATCH body: '{"oldPassword":"admin","password":"{{ f5_api_admin_password }}"}' body_format: json validate_certs: false force_basic_auth: true user: admin password: admin headers: Content-Type: "application/json" register: result delegate_to: localhost - name: Debug ansible.builtin.debug: var: result - name: Try to get system info f5networks.f5_modules.bigip_device_info: gather_subset: - system-info provider: "{{ bigip_provider }}" register: output delegate_to: localhost - name: Debug ansible.builtin.debug: var: output The Output of the the password reset task look fine to me: TASK [Debug] ******************************************************************************************************************************************************************************** task path: ~/guest-playbook.yml:47 ok: [test-guest] => { "result": { "cache_control": "no-store, no-cache, must-revalidate", "changed": false, "connection": "close", "content_length": "330", "content_security_policy": "default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob:; img-src 'self' data: http://127.4.1.1 http://127.4.2.1", "content_type": "application/json; charset=UTF-8", "cookies": {}, "cookies_string": "", "date": "Fri, 29 Sep 2023 11:48:50 GMT", "elapsed": 0, "expires": "-1", "failed": false, "json": { "displayName": "Admin User", "encryptedPassword": "<removed>", "generation": 0, "kind": "shared:authz:users:usersworkerstate", "lastUpdateMicros": 0, "name": "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER", "selfLink": "https://localhost/mgmt/shared/authz/users/********", "shell": "/sbin/nologin" }, "msg": "OK (330 bytes)", "pragma": "no-cache", "redirected": false, "server": "Jetty(9.2.22.v20170606)", "status": 200, "strict_transport_security": "max-age=16070400; includeSubDomains", "url": "https://<removed>/mgmt/shared/authz/users/********", "x_content_type_options": "nosniff", "x_frame_options": "SAMEORIGIN", "x_xss_protection": "1; mode=block" The next task, will already fail with a "unauthorized" message. From now on, I cannot access the system any more, and believe me, I tried a lot. One interesting Thing: When I don't use a ansible-vault encrypted password and instead set the variable directly to the string, login is possible, BUT only to the GUI. I cannot do rest api calls with this password. When I change the admin password again (from within GUI), I can however use rest api again. When I change it back to the original one, api calls will fail. There is one difference I noticed in /var/log/audit in the case, when I set the password as clear-text: User authentication is logged like this and the api request fails: AUDIT - user admin - RAW: httpd(pam_audit): User=admin tty=(unknown) After setting a new password within the GUI oder tmsh and running the same api request, audit messaged changed like this and the request is successfull: [...] AUDIT - user admin - RAW: rest(pam_audit): user=admin(admin)[...] When I now change the password back to the previous one, api request fails again [...]AUDIT - user admin - RAW: httpd(pam_audit): User=admin tty=(unknown)[...] What on earth is going on? How is one supposed to bootstrap a vcmp guest from ground up without manually interaction for setting passwords and stuff? Any usefull advice is thoroughly appreciate. Cheers Ichnafi
Solved
Ichnafi
Sep 29, 2023 Place Technical Forum
1KViews
0likes
3Comments
DSC sync-failover between vCMP guests in different hardware
Hello, I'm preparing a migration and have a question about DSC support for a mixed hardware scenario: 2 VIPRION chassis each chassis has a single B2100 blade each blade has 3 vCMP guests DSC sync-failover is configured between vCMP guests hosted in those blades each blade will be replaced by a B2250, but the configurations won't change I'd like to do this without downtime, but there is a crucial step, when one of the blades has already changed to a B2250 and the other is still a B2100: will vCMP guests based on different hardware be able to join in a DSC sync-failover group? Thanks in advance! Mike
Solved
Mike757
Nov 22, 2021 Place Technical Forum
975Views
0likes
2Comments