Forum Discussion

jdekren_303800's avatar
jdekren_303800
Icon for Nimbostratus rankNimbostratus
Dec 21, 2016

No sync - F5 cluster (active/passive) 2 nodes

Hi,

 

We meet a problem with F5 BIG-IP 5250v cluster.

 

Actually, we have 2 nodes (active/passive) and a Virtual-IP to access at this cluster. The VIP address redirect all requests to node 1 (active).

 

Recently, a modification has been realized on a passive node (node2), and now, it's impossible to synchronize the node1 to node2.

 

The modification has : (on common partition)

 

  • A local user has been added on node1 and node2 (not use the VIP)
  • This same local user has been deleted on node2 and node1 (not use the VIP)

Error message :

 

  • Status: Sync Failed
  • Summary: A validation error occurred while syncing to a remote device
  • Details:Sync error on node01: Load failed from node02 01070821:3: User Restriction Error: Once configured for specific partition(s), user cannot have [all].
  • Recommended action: Review the error message and determine corrective action on the device

How to resolve this issue ?

 

Thanks for answers.

 

Regards,

 

jdekren

 

application delivery
BIG-IP

4 Replies

Sort By
  • Patrik_Jonsson's avatar
    Patrik_Jonsson
    Icon for MVP rankMVP
    Dec 21, 2016

    Sounds like a configuration issue. Have you tried to delete the user on the other node?

     

    1. Modify/add/delete the user as you want it on node 2
    2. Delete it on node 1
    3. Synchronize config from node 2 to node 1 (force overwrite).

    /Patrik

     

  • Patrik_Jonsson's avatar
    Patrik_Jonsson
    Icon for MVP rankMVP
    Dec 21, 2016

    Then, if you've done a recursive grep and checked that the user does not exist in the peer node AND that the user does not exist in two places on the current node an MCPD reload might do the trick:

    1. Log in to the command line of the peer.
    2. Create a null file in the /service/mcpd directory, with the filename forceload, by typing the following command: 
      touch /service/mcpd/forceload
    3. Reboot the BIG-IP system by typing the following command: 
      reboot

    /Patrik

  • jdekren_303800's avatar
    jdekren_303800
    Icon for Nimbostratus rankNimbostratus
    Dec 22, 2016

    I'm not sure, but I think that it's the latest version. Support information : "Unfortunately the bug has not yet been fix in a newer code release but there is a workaround."

     

    Regards,

     

    jdekren

     

  • Kevin_O__39_Nei's avatar
    Kevin_O__39_Nei
    Icon for Nimbostratus rankNimbostratus
    Jul 20, 2018

    I don't have an answer but I have another question. The workaround is "To resolve this issue, we need to change the authentication method on the active system to "Local" and retry the config sync operation."

     

    If one currently has the auth. method as "Remote - Active Directory" and one changes to "Local", will one lose the "Remote - Active Directory" information, and have to input all the Remote Role Groups again? Or can one change from Remote-AD to Local and back to Remote-AD without losing the configuration. Thanks. --Kevin O'Neil