BUG Query
Hi All, We have 02 environments (Production and Testing). Both these environment application VIP on hosted on different LB instances. Both these LB have same firmware version (Eg 17.1.0) Recently there was some Auto-HA Failover issue observed with Production LB post which application were non-functional. When checked with F5 support we came to know about a BUG on this version. However we have mitigated the same as per recommendation from F5. Now, the question is ...We have TESTING environment for same application on different LB instances which is having same BUGGY firmware but there we have not encounter any such issue. Needs to brainstorm more about the login behind the same. Rgds ETL
Health Monitor via MGMT (DCDs)
Hello, I use BIGIQ and DCDs (2 DCs deployment) to collect data + WAF Events. I have a pool of my BIG IP DCDs (MGMT subnet) in the BIGIP configured as HCL. I configured an MGMT Route, but the health check goes from the data interface self-IP. Can a static route for TMM routing be configured to this destination or to choose which IP will monitor these DCDs? *It is not possible to create a TMM route with IP GW that is not associated with this Route domain (MGMT subnet) Another question: If I don't have other options. When one of the DCDs pool members is down (for example, time out), does the BIGIP mark this pool member as unavailable and forward the request to the next available pool member, depending on the TCP server profile? Or will the requests fail? Maybe another load-balancing method will be helpful here. Thank you!AS3 Deployments (shared objects)
BIG-IP LTM: 17.1.1 AS3 Plugin: 3.49.0 We are migrating from older hardware to newer r5900 series hardware. In that process we are moving to configuration as code, using AS3. Working through all the hiccups and hurdles, came across a "need", that I was wondering if possible?! Can you have a "global" (or "shared") partition with configurations within that all partitions can reference? I inherited the previous configurations from a colleague, and everything is located within the Common partition, which has kinda worked out nicely, as we can share "objects" (iRules, profiles, etc..) between most configurations. This also has been beneficial when we need to make a global change (certificate chain change, for example) that allowed us to fix all configurations quickly by changing just the one object that was shared. Is this possible across partitions, or is that a hard silo division, and nothing can be shared between them?
Inquiry on F5's Maintenance Mode Feature for Pool Members
Hello F5 Community, I'm looking for a way to smoothly transition specific pool members into maintenance mode without disrupting service. Can anyone share insights or best practices on how to implement this in our network infrastructure? Thanks!
ASM Bot Defense JS and CSP
Our company has issued a requirement for all applications to enable CSP (Content Security Policy). The problem is one of the first applications to enable this has Bot Defense enabled. Part of PBD is to inject a JAVA script inline which causes an issue with the page not loading per the CSP policy. We opened a support case and F5 level II and the ENE say they can't find a way to make these compatible and this is beyond the scope of Support i.e. engage Professional Services. I'm a long-time F5 user and so this was frustrating, to say the least. Part of our CSP is our scripts have a nonce key generated. PBD script is not being delivered from our server (it's directly injected into the response), and it does not contain our nonce key. This means that the CSP will tell the browser to NOT allow the execution of that script thereby breaking the application. Part of the CSP Rules The browser should accept any JS that is delivered as a file from 'self' which means it's delivered from our web server with a relative path The browser should accept any JS that is delivered to the browser with our nonce key (value in the header) All other JS should be ignored by the browser! So, the only question that we really had for F5 is how do we make PBD JS work with a CSP? The CSP is set up in a basic way and is not customized to our application at all. It seems we either need to have this JS delivered by a file (not directly injected) or the F5 will need to pick up our nonce key and add it to that injection. Has anyone come across this and what methods did you employ to resolve it, i.e. iRule or Traffic policy to set the nonce key on the JS, which is not super ideal? Depending on when ASM/PBD fire, something similar to the following: when HTTP_RESPONSE { # Check if the response header contains a CSP if {[HTTP::header exists "Content-Security-Policy"]} { # Get the CSP header value set csp [HTTP::header value "Content-Security-Policy"] # Check if the CSP contains a nonce if {[string first "nonce-" $csp] != -1} { # Get the nonce value set nonce [string range $csp [string first "nonce-" $csp] [string first ";" $csp]] # Check if the response body contains a script tag if {[string first "<script" [HTTP::payload]] != -1} { # Add the nonce to the script tag HTTP::payload replace [string first "<script" [HTTP::payload]] [string first ">" [HTTP::payload]] "<script nonce=\"$nonce\"" } } } }
Problem with connecting using f5 vpn on Ubuntu/Linux; stuck on "Connecting..."
This issue happens only on the machine I'm using, I treid the same account on multiple other machines, on the same network and other networks. The gist of it is that f5vpn gets stuck in the connecting phase and doesn't modify my routes table or hosts file, as it should. The server is started successfully and establishes a connection on port 44444, but that's where it stops. Did anyone face a similar issue? I have the log files (vpn.log, svpn.log, syslog, etc..) if anyone is interested to take a look. I tried creating a support case, but I only had the "NginX" product family displayed. I would really appreciate any help.When F5OS r2800 appliance reboots, interfaces configured at tenant level for VLAN are lost
Hello Everyone, I'm currently facing a weird issue on both r2800 series. A single tenant is configured on both r2800 series and whenever there is a power outage and the system reboots, all the interfaces are detached from the VLANs on the tenant. So we build a script for a workaround to automatically attach the VLAN to its respective interface when the system starts up. Reference: https://my.f5.com/manage/s/article/K11948 #!/bin/bash # Filename: /config/startup_custom_vlancreation_script.sh source /usr/lib/bigstart/bigip-ready-functions wait_bigip_ready # Here you could perform customized command(s) after MCPD is found running when the BIG-IP system starts up. # Customized startup command(s) can be added below this line. tmsh modify /net vlan VLAN-162 interfaces replace-all-with { 1.5 { tagged }} tag 162 tmsh modify /net vlan VLAN-163 interfaces replace-all-with { 1.6 { tagged }} tag 163 tmsh modify /net vlan VLAN-164 interfaces replace-all-with { 1.5 { tagged }} tag 164 tmsh modify /net vlan VLAN-165 interfaces replace-all-with { 1.5 { tagged }} tag 165 tmsh save /sys config # Customized startup command(s) should end above this line. # End of file /config/startup_custom_vlan_creation_script.sh ------ # # NOTE: # This file will be installed in /config/startup and it will # be called by /etc/rc.local. # # - /config/startup is for customer config additions and # will be saved in UCS # # - /etc/rc.local should *not* be used by customers and # can/will be changed by F5 # /config/startup_custom_vlan_creation_script.sh & Then, we tested on one of the r2800 series instances: When the tenant is rebooted, the script works in the startup and attaches the VLAN to its respective interface on the tenant. However, when the F5OS hardware device is rebooted, all the attached VLAN to its interface on the tenant are lost and even the script does not work (I believe F5 OS is different than the old tmsh shell) which might be the reason behind the failure of script when the F5OS hardware reboots. Is there any way to resolve this issues of losing attached VLAN on the interface and has anyone faced such before?BIG-IP Next
Dears, I need to develop BIG-IP next, anyone can guide me, please? I tried to install BIG-IP next and Central Manager inside EVE-eg but it is not found, Can I install it in EVE? I need to start with BIG-IP LTM and ASM, there is a guide for all installation steps and all labs step by step. Thanks
