Forum Discussion

Simon_Waters_13's avatar
Simon_Waters_13
Icon for Cirrostratus rankCirrostratus
Jun 24, 2014

F5 APM sync issue

Sync issues seem to be a thorn in my side with APM.

 

High availability pair, have a webtop at the end of an access policy.

 

Failed over this morning due to a problem, and discovered that the "application access" "remote desktops" are not available on this one of the pair (call it backup), failed back (call it live) and they are working.

 

The authentication and webtop work on both, but the icons are not displayed for accessing the applications.

 

Session logs on backup show that the resources were assigned as expected. Indeed everything else was working as expected.

 

Is it reasonable to assume this is a straight APM sync bug. I know there were a whole host of these, but I thought I'd seen the back of them (Currently 11.5.1 2.22.121).

 

application access
BIG-IP Access Policy Manager (APM)
deployment
security
sync

8 Replies

Sort By
  • Simon_Waters_13's avatar
    Simon_Waters_13
    Icon for Cirrostratus rankCirrostratus
    Jun 24, 2014
    For clarity I allocation three resources on this webtop, one is displayed but the two remote desktops are missing. Unfortunately one of the remote desktops is the one the users actually care about.
  • Reaper19's avatar
    Reaper19
    Icon for Nimbostratus rankNimbostratus
    Jun 24, 2014

    We seem to be experiencing something very similar when upgrading from 11.4.1 HF2 or HF4 to 11.5.1 or 11.5.1 HF2. After upgrading on our pre-prod test box we are experiencing similar issues with using RDP, mapping drives, resolving hostnames etc. Seems like a DNS/Routing issue on the BIG-IP appliance. We can ping by IP to most end devices but cannot resolve. I'd like to know if any also has seen this or resolved.

     

    • Simon_Waters_13's avatar
      Simon_Waters_13
      Icon for Cirrostratus rankCirrostratus
      Jun 24, 2014
      Interesting. Our logs show some spurious DNS lookup attempts related to Domain Server outage, but everything in our configuration is deliberately built on IP addresses to deliberately reduce dependencies on third party devices (and it still has issues every time a domain controller dies, working on that one). So I likely wouldn't see those issues in the same way, even if they were present.
  • Reaper19_158382's avatar
    Reaper19_158382
    Icon for Nimbostratus rankNimbostratus
    Jun 24, 2014

    We seem to be experiencing something very similar when upgrading from 11.4.1 HF2 or HF4 to 11.5.1 or 11.5.1 HF2. After upgrading on our pre-prod test box we are experiencing similar issues with using RDP, mapping drives, resolving hostnames etc. Seems like a DNS/Routing issue on the BIG-IP appliance. We can ping by IP to most end devices but cannot resolve. I'd like to know if any also has seen this or resolved.

     

    • Simon_Waters_13's avatar
      Simon_Waters_13
      Icon for Cirrostratus rankCirrostratus
      Jun 24, 2014
      Interesting. Our logs show some spurious DNS lookup attempts related to Domain Server outage, but everything in our configuration is deliberately built on IP addresses to deliberately reduce dependencies on third party devices (and it still has issues every time a domain controller dies, working on that one). So I likely wouldn't see those issues in the same way, even if they were present.
  • Simon_Waters_13's avatar
    Simon_Waters_13
    Icon for Cirrostratus rankCirrostratus
    Jun 24, 2014

    I see HF3 has some mcpd issues fixed, and we need to install it for OpenSSL. So probably a good place to start.

     

  • williamc_154806's avatar
    williamc_154806
    Icon for Nimbostratus rankNimbostratus
    Oct 05, 2014

    we are experiencing the same issue both on the latest 11.6 and 11.5.1 HF4.

     

    Where once a failover happens many icons can go missing -but its inconsistent sometimes icons disappear sometimes they appear fine after a failover.

     

    the manual way to fix it is to apply an access policy update but this is not a fix...it shouldn't happen at all during a failover.

     

    We have setup the HA as recommended:

     

    1) config sync: on dedicated HA vlan (also tried on internal vlan)

     

    2) failover: on dedicated HA vlan

     

    3) mirroring: on dedicated HA vlan

     

    but issue still occurs.

     

    I think a new funtion to automatically apply an access policy update when a failover occurs should be an option...

     

    I have a question open for this; but don't know how to do it:

     

    https://devcentral.f5.com/questions/apply-access-policy-update-automatically-after-a-failover

     

    • Simon_Waters_13's avatar
      Simon_Waters_13
      Icon for Cirrostratus rankCirrostratus
      Oct 06, 2014
      Thanks William. I have ticket open again with F5. Seeing this with the "bash" shell HF on 11.6.0. We have some evidence that sometimes only some users see the reduced menu?! Unfortunately users are remote, and we can't grab their desktops to take a look when it occurs. So failure may be partial or complete. A nominal - textual change - to the policy has always resolved it so far. Does seem to be something to do with fail-over, but we've seen it on both boxes, so presumably it is when failing over to the box on which the policy was no directly applied last time. Or something of that ilk.