Forum Discussion

rybificus_22774's avatar
rybificus_22774
Icon for Nimbostratus rankNimbostratus
Oct 13, 2015

Upgrading BIGIP-F5 LTM from 10.2.2 to 11.5.3

Good day everyone,

 

My company has had a "hands-off" approach when it comes to maintaining our F5s. They've been working flawlessly for the past couple of years without any issues what-so-ever. However, a recent security audit uncovered some vulnerabilities that we'd like to patch with some of the latest fixes included in version 11.5.3. I've been tasked with performing the upgrade, and I'd like to share my upgrade strategy with the community to see if any experienced admins here can share their thoughts.

 

We currently have a pair of devices operating in an Active/Standby configuration.

 

Upgrade Plan

 

  1. Force current standby device to offline status

     

  2. Reactive License on standby device

     

  3. Perform upgrade by installing 11.5.3 base image to an unused volume.

     

  4. Once the upgrade to 11.5.3 is complete, I plan to install the 11.5.3HF1 hotfix

     

  5. Change the default boot partition to the new volume I selected in step 3.

     

  6. Reboot the standby device

     

  7. Fail-over from the Active device to the standby device and test.

     

  8. If all is well perform the upgrade on the other device.

     

Are there any glaring holes in my plan?

 

I appreciate your thoughts.

 

Thank you

 

application delivery
LTM
software upgrade

5 Replies

Sort By
  • Hannes_Rapp's avatar
    Hannes_Rapp
    Icon for Nimbostratus rankNimbostratus
    Oct 13, 2015

    What modules are you using, is it just LTM? In any case you should go for 11.5.3 HF2, because in HF1 the LTM data-groups are bugged and unmanageable via GUI.

     

  • rybificus_22774's avatar
    rybificus_22774
    Icon for Nimbostratus rankNimbostratus
    Oct 13, 2015

    Hannes -

     

    I'm a little embarrassed to ask this but how do I verify which modules are installed? I believe we're only using LTM but I'd like to be sure.

     

    • Hannes_Rapp's avatar
      Hannes_Rapp
      Icon for Nimbostratus rankNimbostratus
      Oct 13, 2015
      In GUI, go to System -> Resource Provisioning Check for modules that have "nominal", "minimum" or "dedicated" as their provisioning status.
    • Hannes_Rapp's avatar
      Hannes_Rapp
      Icon for Nimbostratus rankNimbostratus
      Oct 13, 2015
      Therefore, your chances for success are not too bad. Give it a try and let me know about your experience. Make sure you take time to investigate /var/log/ltm files to increase your chances of spotting any problems. Here are a couple of issues you may or may not encounter: a) Cluster not synchonizing after the upgrade due to removal of default.crt and default.key files from the clientside SSL default profile. b) Image installation fails because you have HTTP class objects that are depcrecated since 11.4. c) Configuration fails to load after the reboot as the new TMOS no longer counts your configuration as valid, this would be the worst of three scenarios and will require extended troubleshooting and possibly suppression of several conflicting objects.