I am looking for some help on F5 sync’ing options. I have opened an F5 support ticket with the below opening notes. However I thought I would reach out to the this forum as well. I wonder if this is even possible? ---F5 opening case notes--- I have some questions about config syncing on the F5s that I would like to discuss. We currently have 2 F5s in an active/standby failover config in our Minneapolis (MSP) location and we also have 2 F5s in the same setup in our Madison (MSN) location. The MSP location is production location and the MSN is our DR location. I would like to take the config that we have on our MSP location and sync it to the MSN F5s. However I don’t want the MSP and the MSN devices to be a failover group. I believe this is possible but I wanted to discuss this with F5 support. We already have the active/standby sync-failover group created in MSP and in MSN so that we have device redundancy in each location. What I believe we need to do now is to add all 4 devices to the trust list and then create a sync-only group and this will allow us to manually sync our config from MSP to MSN. ---End F5 opening case notes--- I have found some links that sort of show this as being possible. https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/tmos-redundant-systems-config-11-1-0/5.html https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/bigip-device-service-clustering-11-2-1/6.html In addition to the above info I have create a diagram of what I am looking to do. It is below.

Forgot to mention I am running 11.4.1 HF7.

Hi Aaron, the "sync-only" feature is not designed to synchronize LTM configuration changes. That´s why from my perspective your setup will not work as you expect it to. I´m not aware of a built-in method to synchronize configuration between units not part of the same "sync-failover" group. What kind of configuration changes you want to replicate? Will both sites use the same addressing schema for virtual IPs, floating self IPs, SNATs and NATs? Will they use the same VLAN names? If yes, how about using the iControl REST API (supported since TMOS v11.4) to apply config changes and just send duplicated commands to the two independent "sync-failover" device groups? Thanks, Stephan

Can't you configure the Sync-Failover group to only automatically fail to a specified list of devices?

Hi Aaron, the initial post an my response seem to be gone. So sorry for repeating myself partially. "Sync-only" will not allow to synchronize LTM configurations. To synchronize an LTM config all units need to belong to the same "sync-failover" device-group. A traffic-grpup containing the virtual failover objects can be active on a single device in the device-group only. So if you want both sites to be active (running the local devices in active/standby) it would be necessary to use a "sync-failover" device group of four devices with two traffic-groups. A virtual address can be assigned to a single traffic-group only. The only workaround would be using routing domains. Overlapping IPs are permitted. But it adds complexity and each service still has to be configured twice (in each routing domain). That´s why I would consider to use i.e. the new REST based iControl API to modify two independent "sync-failover" device-groups simultaneously. Thanks, Stephan

Hi Aaron, we have the exact same challange... We have a DR-site with same IP addresses, vlan etc. So the config should be exactly the same. We took the approach first to make a backup of the F5 cluster on our primary site and install it on the DR site F5. But that came with alot of other problems, one example is that the mgmt-port is not the same because we need to manage the devices out-of-band and that failed first with routing and interface setup not matching 100%. Also there was a bug that we ran into: https://support.f5.com/kb/en-us/solutions/public/15000/800/sol15835.html So that approach did not seem to work for us. So now we are looking into other options, but we are stuck. I would be very interested in using the API to sync the config, between the sites. But we cannot create a new application to make changes to both the enviroments as we are very dependent on the GUI today because we have other people than ourselves in the network-team working in the BigIPs. So it would be nice with some function that could take all the config changes done and push them to the other F5 cluser on the DR site. But im not that familiar with the API yet so im not sure if that would even work? An idea is just to export all Nodes, Pools, VIPs etc. and diff them to the other cluster then add the missing ones. BUT then the question becomes could you do this through the API with for example certificates, persistence policys, http profiles etc. it becomes quite complex when you need a full config sync. This should not be that hard really? But it seems like the BigIP product is not built for HA in multiple datacenters if you dont want to make the changes done in one F5 cluster then add it to the other manually. I red about sync-only groups but it will not suit our current production enviroment as we already use multiple partitions and folders. As i understand it you will need a seperate folder for the sync-only objects? So that is not possible im afraid. We continue to search for a solution for this, but in the meantime its just old fasion manual work. :)

F5 sync options | DevCentral

16 Replies

Aaron_33366
Nimbostratus
Feb 13, 2015
Forgot to mention I am running 11.4.1 HF7.
StephanManthey
MVP
Feb 13, 2015
Hi Aaron,

the "sync-only" feature is not designed to synchronize LTM configuration changes.

That´s why from my perspective your setup will not work as you expect it to.

I´m not aware of a built-in method to synchronize configuration between units not part of the same "sync-failover" group.

What kind of configuration changes you want to replicate?

Will both sites use the same addressing schema for virtual IPs, floating self IPs, SNATs and NATs?

Will they use the same VLAN names?

If yes, how about using the iControl REST API (supported since TMOS v11.4) to apply config changes and just send duplicated commands to the two independent "sync-failover" device groups?

Thanks, Stephan
Walter_Kacynski
Cirrostratus
Feb 13, 2015
Can't you configure the Sync-Failover group to only automatically fail to a specified list of devices?
StephanManthey
MVP
Feb 14, 2015
Hi Aaron,

the initial post an my response seem to be gone. So sorry for repeating myself partially.

"Sync-only" will not allow to synchronize LTM configurations.

To synchronize an LTM config all units need to belong to the same "sync-failover" device-group.

A traffic-grpup containing the virtual failover objects can be active on a single device in the device-group only.

So if you want both sites to be active (running the local devices in active/standby) it would be necessary to use a "sync-failover" device group of four devices with two traffic-groups.

A virtual address can be assigned to a single traffic-group only.

The only workaround would be using routing domains. Overlapping IPs are permitted.

But it adds complexity and each service still has to be configured twice (in each routing domain).

That´s why I would consider to use i.e. the new REST based iControl API to modify two independent "sync-failover" device-groups simultaneously.

Thanks, Stephan
Mattias_Anderss
Nimbostratus
Feb 16, 2015
Hi Aaron,

we have the exact same challange... We have a DR-site with same IP addresses, vlan etc. So the config should be exactly the same. We took the approach first to make a backup of the F5 cluster on our primary site and install it on the DR site F5. But that came with alot of other problems, one example is that the mgmt-port is not the same because we need to manage the devices out-of-band and that failed first with routing and interface setup not matching 100%. Also there was a bug that we ran into: https://support.f5.com/kb/en-us/solutions/public/15000/800/sol15835.html

So that approach did not seem to work for us. So now we are looking into other options, but we are stuck. I would be very interested in using the API to sync the config, between the sites. But we cannot create a new application to make changes to both the enviroments as we are very dependent on the GUI today because we have other people than ourselves in the network-team working in the BigIPs. So it would be nice with some function that could take all the config changes done and push them to the other F5 cluser on the DR site. But im not that familiar with the API yet so im not sure if that would even work? An idea is just to export all Nodes, Pools, VIPs etc. and diff them to the other cluster then add the missing ones. BUT then the question becomes could you do this through the API with for example certificates, persistence policys, http profiles etc. it becomes quite complex when you need a full config sync.

This should not be that hard really? But it seems like the BigIP product is not built for HA in multiple datacenters if you dont want to make the changes done in one F5 cluster then add it to the other manually. I red about sync-only groups but it will not suit our current production enviroment as we already use multiple partitions and folders. As i understand it you will need a seperate folder for the sync-only objects? So that is not possible im afraid.

We continue to search for a solution for this, but in the meantime its just old fasion manual work. :)
Manuel_A_Sosa_1
Nimbostratus
Mar 25, 2016
Hello Aaron,

We have the same problem, we have a production site in Miami, and our DR in Brasil. I have tried to setting up the trust domain with more than 2 units, but every time that we add the third we lost the trust relation between the first two. Did you get the solution to this problem? Please, what must we do? Thanks
- StephanManthey
  MVP
  Mar 27, 2016
  Hi Manuel, do you try to setup a sync-failover device-group containing three units? To establish device trust I would recommend to force two units into offline state. Remove the machines from the existing sync-failover device-group (repeat on each machine if required) and delete the sync-failover device-group. Now reset the device trust on all machines. Next step will be to use the active machine to add both offline machines as peers. Now all three units should show up in each machine´s device list. On the active unit create a new device-group of type sync-failover with network failover enabled. Add all machines to the new device-group. This will be synced to all machines and you can release them from forced offline. Time for the initial sync now. Thanks, Stephan
- Manuel_A_Sosa_1
  Nimbostratus
  Mar 28, 2016
  Hi Stephan, We are trying to setup a sync-failover of four members, two in Miami that is the production environment, and two en Brasil that is the DR site. I have the same problem than Aaron, we can sync the two devices in both sites, but when we tried two create a trust domain of four devices we ran into problem. We have a sync network in both sites that is routed on MPLS, is not a connectivity problem. Once we add the third device to the trust domain, we lost the relation that we already have with the second member. Thanks
JoshBecigneul
MVP
Mar 28, 2016
The F5 iControl REST API has a newer iteration of a module for the Python language, with its documentation available here. http://f5-sdk.readthedocs.org/en/latest/index.html

The F5 SDK (and its predecessors) should be able to do a majority of the heavy lifting for you, instead of manipulating the REST API by hand. Unless of course you're interested in that sort of thing.

Another great tool that might help make it easier to sync up changes to a secondary set of F5s is the Application Integration Services iApp. It provides a fairly consistent interface to deploying a service. You can operate it via the WebUI and the REST API. It is not F5 supported, however. https://github.com/0xHiteshPatel/appsvcs_integration_iapp
Kevhed_173990
Nimbostratus
Oct 19, 2016
Aaron...how did you finally end up syncing your configs across the DC's? I have almost exactly the same challenge and would be curious to hear what solution you ended up using. Thanks
- Georgi__Joe__St
  Altostratus
  Jan 27, 2017
  me too :), looks like common requirement without solution :(.
Kevhed
Nimbostratus
Oct 19, 2016
Aaron...how did you finally end up syncing your configs across the DC's? I have almost exactly the same challenge and would be curious to hear what solution you ended up using. Thanks
- Georgi__Joe__St
  Altostratus
  Jan 27, 2017
  me too :), looks like common requirement without solution :(.
Kevhed
Nimbostratus
Apr 12, 2017
It seems like there are a lot of engineers out there with this same issue (like me) and I'm curious what Aaron (or any of you) implemented that is working. I'm currently doing manual changes on both Prod and DR but that can't be the final solution...too much overhead and room for error.