Forum Discussion

cdomansky's avatar
cdomansky
Icon for Nimbostratus rankNimbostratus
Feb 29, 2016

Device Trust Issues

I am quite new to BIG-IP infrastructure and am running into an issue with Device Trusts. I have 2 BIG-IP devices running 11.6 on either side of a WAN. Both devices can ping each other currently. I am working on setting up Device Trusts and am running into an issue where after adding the Remote Device Credentials, my local device does not register the remote device, and in turn, there is no entry made in the Peer Authority Devices list. Any thoughts on what could be causing this problem would be much appreciated.

 

AAM
BIG-IP
devops

6 Replies

Sort By
  • arpydays's avatar
    arpydays
    Icon for Nimbostratus rankNimbostratus
    Feb 29, 2016
    are you using the mgt address when entering the peer device?
  • cdomansky's avatar
    cdomansky
    Icon for Nimbostratus rankNimbostratus
    Feb 29, 2016
    I am using the Self IP address, the same one used to log on remotely via Web or SSH.
  • nathe's avatar
    nathe
    Icon for Cirrocumulus rankCirrocumulus
    Feb 29, 2016
    Think arpydays is on the right track here. Can you confirm you're using the same IP address as the output of the following cmd "tmsh list sys management-ip"
  • cdomansky's avatar
    cdomansky
    Icon for Nimbostratus rankNimbostratus
    Feb 29, 2016
    Just to give a little backstory on what I am trying to get working here, I have linked an f5 article here. https://support.f5.com/kb/en-us/products/big-ip-aam/manuals/product/aam-network-configuration-11-6-0/1.htmlunique_1770456894 I can confirm that I am not using the management ip address when entering the peer device. My problem is that the management ports have not been setup at this point (they are not being used). The devices are currently communicating through only the 1 VLAN connection (1.1). Is there a way to setup a device trust without using the management ports? From my understanding, the management ports were really just there in case you lose network connectivity and needed to manage the device locally. But I could be wrong.
  • Brad_Parker's avatar
    Brad_Parker
    Icon for Cirrus rankCirrus
    Feb 29, 2016

    Under Device Management >> Devices >> (local device name) >> Device Connectivity, have you configured your failover network to use the interface you are trying use? Also, you say you are going over a WAN, correct? Do your two devices have management address defined that could be in the same L2 network? That could make them think they share a L2 domain and won't try to route to exchange certs. Also, make sure you don't have a gateway defined on your management network if you don't want to use it. Lastly, to complete the device trust you will need both 22, 443, and 4353 open between the two. Lastly, have you changed you httpd SSL settings at all?

     

  • Hannes_Rapp's avatar
    Hannes_Rapp
    Icon for Nimbostratus rankNimbostratus
    Feb 29, 2016

    You will need an IP address on your management port, even if you do not intend to use it. You can get away without one if you have a standalone appliance, but not when going for HA cluster. You can configure one by typing in command 

    config
    in BASH shell via Serial or SSH connection. This will set up an IP address on your eth0 interface. Eth0 is what you generally use for remote device management (HTTPS/GUI and SSH) instead of a SelfIP.

    There's another type of mgmt-interface which is called AOM - that is only available on some physical appliances. Setting up one is optional, but still recommended since it can help you connect to BigIP via SSH when the device itself is powered off. AOM system of BigIP has similarities to the ILO system of HP servers, or iDrac of Dell servers.

    In regards to your issue, although you can establish Peer Trust via a non-mgmt interface, not having an IP on your mgmt port could be the cause of the problem you're observing. As you establish Peer Trust, bigip1 tries to gain information about bigip2 mgmt IP address.

    If you're still stuck after configuring your mgmt port, check out recommendations others have posted. Also check out the 

    /var/log/ltm
    file, it's a gold mine of troubleshooting hints 🙂

    Regards,