Making a default route is breaking my management auth

Question

Hello,&nbsp;I have TACACS configured for Configuration Utility/GUI access and it works.&nbsp;My problem is, when i make a default route on the box network &gt; routes:&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; source: 0.0.0.0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; dest: 0.0.0.0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; gateway: (gateway ip of my internal vlan, not same as my management network)&nbsp;This kills my boxes authentication with TACACS on the management side. Shouldn't the F5 reach out to TACACS on its management interface?&nbsp;&nbsp;&nbsp;

frontmanfin · Accepted Answer

Resolved my issue. I made management-routes but that wasn't populating in the kernel route table (route -n from bash)

so i added the routes to my TACACs

route add -net [network] netmask [mask] gw [gateway] metric 4096

and that seems to have worked.

paulius · Answer

FrontmanFin In order to assist you further please provide the routing table for the F5, the output of the following command when in bash, and the destination for the TACACS server/s.
route -n

ceinarf · Answer

Hello,
as specified in https://my.f5.com/manage/s/article/K28172750 if you need to use the management interface to communicate with the remote authentication server outside management subnet, then you must add a static management route that is more specific than any TMM routes to this server.
To add a management route just follow article https://my.f5.com/manage/s/article/K13284&nbsp;

tmsh create /sys management-route &lt;name&gt; network &lt;destination network&gt;/&lt;netmask&gt; gateway &lt;management gateway
tmsh save /sys config

BR

frontmanfin · Answer

interesting (cant copy and paste the config but ill elaborate)

I did make management routes and it didnt work. I compared this to one of the correctly working F5s and im noticing that all the management routes for the working box show up in the routing table in route -rn with the Iface being mgmt.

but in my broken box, thats not to case, the Kernel IP routing table doesn't show the mgmt routes i created at all.

Is there something I need to do to update the Kernel IP routing table?

ceinarf · Answer

FrontmanFin creating and saving a management route via tmsh must create an entry in the netstat -nr routing table.
If this is not going to happen it should be related to a problem in the BIG-IP instance, so&nbsp; I don't think you have solved the "real" problem.
BR

paulius · Answer

FrontmanFin You might consider figuring out why the routes aren't being added to the kernel route table rather than manually adding them. A lot of times OS level changes do not carry over after upgrades and you could encounter an issue when you perform one because of this.

Forum Discussion

Making a default route is breaking my management auth

6 Replies

Recent Discussions

Disk space full - what files, folders are safe to delete?

ASM instance creation

BIG-IP DNS: Check Status Of Multiple Monitors Against Pool Member

Open Redirection Mitigation

F5Access | MacOS Sonoma

Related Content

Delete Management Default Route?

Minimizing Security Complexity: Managing Distributed WAF Policies

Re: Management Certificate

NGINX Management Suite API Connectivity Manager - Modern API driven Applications

iControl REST Authentication Token Management