tcpdump command for multiple source hosts and destination hosts
The request that has been given me is to find any SOAP traffic from 2 sets of pools. Pool 1 172.17.30.100 172.17.30.101 172.17.30.102 Pool 2 172.17.31.200 172.17.31.201 172.17.31.202 cany anyone help me with a tcpdump command that will give me all 80 and 443 traffic from pool 1 to pool 2 bidirectionaly?11KViews0likes1Commentcheck chassis fan and power supply status?
Hi In v. 9-10 How to check status is "b platform" right? but in v. 11.x Do you have a command to check chassis fan and power supply status? I tried " tmsh show sys hardware" but didn't find anything about chassis fan and power supply status thank you3.4KViews0likes2CommentsTCP Profile > Zero Window Timeout
Another one for you all. The TCP Profile Zero Window Timeout setting description states "If the Zero Window Timeout timer elapses, the BIG-IP system terminates the connection." Does this mean a RST is sent or will this depend on the 'Reset on Timeout' setting?2.8KViews0likes23Comments"Configuration problem" when setting up a trial LTM VM
I have downloaded the 90 day trial version of LTM VE and am having trouble configuring it. I have installed it on an ESXi server and run 'config' to set up a static IP address for the management interface. However this is not persistent - if I reboot the VM the IP address gets forgotten and I have to re-enter it. Next I managed to log into the UI and install the trial license. However the UI then displays this message when logging in: This BIG-IP system has encountered a configuration problem that may prevent the Configuration utility from functioning properly. To prevent adverse effects on the system, F5 Networks recommends that you restrict your use of the Configuration utility to critical tasks only until the problem is resolved. Beware that attempting to modify your configuration in this state with the Configuration utility may cause your configuration to be overwritten. and when I have logged in I get this across the top of the page: The configuration has not yet loaded. If this message persists, it may indicate a configuration problem. and most UI options just show the message "An error has occurred while trying to process your request." So what have I done wrong, and how do I fix it? Edit: Config files requested by emi: /config/bigip.conf: [root@localhost:Offline:Standalone] config cat /config/bigip.conf apm resource remote-desktop citrix-client-bundle /Common/default-citrix-client-bundle { } apm sso saml-sp-connector /Common/saml_office365 { assertion-consumer-uri https://login.microsoftonline.com/login.srf description "Predefined SP connector object for Office 365" entity-id urn:federation:MicrosoftOnline } ltm default-node-monitor { rule none } ltm classification signature-version { version-number 0 } net ipsec ike-daemon /Common/ikedaemon { } wom endpoint-discovery { } /config/bigip_base.conf: [root@localhost:Offline:Standalone] config cat /config/bigip_base.conf cm cert /Common/dtca-bundle.crt { cache-path /config/filestore/files_d/Common_d/trust_certificate_d/:Common:dtca-bundle.crt_26609_1 checksum SHA1:1220:e4fe95d5e7d778cfa0b5fae3aae90196e97e2ccd revision 1 } cm cert /Common/dtca.crt { cache-path /config/filestore/files_d/Common_d/trust_certificate_d/:Common:dtca.crt_26603_1 checksum SHA1:1220:e4fe95d5e7d778cfa0b5fae3aae90196e97e2ccd revision 1 } cm cert /Common/dtdi.crt { cache-path /config/filestore/files_d/Common_d/trust_certificate_d/:Common:dtdi.crt_26612_1 checksum SHA1:1172:75c02118a7daba3e3b84b6d4414063953b92ed1b revision 1 } cm device /Common/bigip1 { base-mac 0:50:56:96:4d:6c build 39.0 cert /Common/dtdi.crt chassis-id 4216b78b-1ce8-729f-88f19ffa5a46 edition "VE Trial 11.3.0-HF1 (based on BIGIP 11.3.0HF6)" hostname bigip1 key /Common/dtdi.key management-ip 192.168.1.245 marketing-name "BIG-IP Virtual Edition" platform-id Z99 product BIG-IP self-device true time-zone PDT version 11.3.0 } cm device-group /Common/device_trust_group { auto-sync enabled devices { /Common/bigip1 { } } hidden true network-failover disabled } cm device-group /Common/gtm { devices { /Common/bigip1 { } } hidden true network-failover disabled } cm key /Common/dtca.key { cache-path /config/filestore/files_d/Common_d/trust_certificate_key_d/:Common:dtca.key_26606_1 checksum SHA1:1675:e5fe1aeae877dceabf0788f00716d9a20fcfb6e2 revision 1 } cm key /Common/dtdi.key { cache-path /config/filestore/files_d/Common_d/trust_certificate_key_d/:Common:dtdi.key_26615_1 checksum SHA1:1679:2ed0adc0939945269c13060d99da4d2916558f6d revision 1 } cm traffic-group /Common/traffic-group-1 { unit-id 1 } cm traffic-group /Common/traffic-group-local-only { } cm trust-domain /Common/Root { ca-cert /Common/dtca.crt ca-cert-bundle /Common/dtca-bundle.crt ca-devices { /Common/bigip1 } ca-key /Common/dtca.key status standalone trust-group /Common/device_trust_group } net interface 1.1 { media-fixed 10000T-FD } net interface 1.2 { media-fixed 10000T-FD } net interface 1.3 { media-fixed 10000T-FD } net route-domain /Common/0 { description "Default Route Domain" id 0 } net self-allow { defaults { ospf:any tcp:161 tcp:22 tcp:4353 tcp:443 tcp:53 udp:1026 udp:161 udp:4353 udp:520 udp:53 } } net stp /Common/cist { } security firewall port-list /Common/_sys_self_allow_tcp_defaults { ports { 22 { } 53 { } 161 { } 443 { } 1028 { } 4353 { } } } security firewall port-list /Common/_sys_self_allow_udp_defaults { ports { 53 { } 161 { } 520 { } 1026 { } 4353 { } } } security firewall rule-list /Common/_sys_self_allow_all { rules { _sys_allow_all { action accept } } } security firewall rule-list /Common/_sys_self_allow_defaults { rules { _sys_allow_tcp_defaults { action accept destination { port-lists { /Common/_sys_self_allow_tcp_defaults } } ip-protocol tcp } _sys_allow_udp_defaults { action accept destination { port-lists { /Common/_sys_self_allow_udp_defaults } ip-protocol ospf } } } security firewall rule-list /Common/_sys_self_allow_management { rules { _sys_allow_ssh { action accept destination { ports { 22 { } } } ip-protocol tcp } _sys_allow_web { action accept destination { ports { 443 { } } } ip-protocol tcp } } } sys feature-module cgnat { disabled } sys folder / { device-group none inherited-devicegroup false inherited-traffic-group false traffic-group /Common/traffic-group-1 } sys folder /Common { device-group none inherited-devicegroup true inherited-traffic-group true traffic-group /Common/traffic-group-1 } sys management-dhcp /Common/sys-mgmt-dhcp-config { request-options { subnet-mask broadcast-address routers domain-name domain-name-servers host-name ntp-servers } } sys management-ip 192.168.1.245/24 { dhcp-enabled true } sys provision afm { } sys provision apm { } sys provision asm { } sys provision avr { } sys provision gtm { } sys provision lc { } sys provision ltm { level nominal } sys provision pem { } sys provision psm { } sys provision wam { } sys provision wom { } sys provision woml { }Solved1.8KViews0likes13CommentsRadius Load Balancing
We use Radius authentication for our corporate wireless users. I'm looking at load balancing our radius servers for our wireless controllers. We had an issue recently where one of the radius servers went down, all clients connected on that wireless controller to that radius server, lost their authentication. Hence, about 400 people dropped off the network. The server was physically up, but the service was hung. The controllers have both IP addresses of the Radius servers in their configuration. But have no way of knowing if the service is up or not. Only if the server was completely down. My idea is to use the BigiP, use one VIP the controllers point to, and do the health checks. That way the controllers can send to one IP, and the BigIP manages the traffic. Does anyone have experience with load balancing radius. I have already created a VIP, a UDP profile specifying the Datagram LB option. I also created a health monitor which checks radius the port. I would really like to build a good health monitor to actually check authentication and make sure the radius server is online. Any input is appreciated... Thanks....1.6KViews0likes6CommentsDNS Query - reply from unexpected source
Hi Guys, I'm new to F5, and something annoy me i can't find why it happen. My topology: Network (Public IP - Pretend its 100.100.100.0/24) --> Switch Stack --> LAG --> Viprion LTM --> Cisco CRS --> WWW I have Viprion 4800 and for now i just wanna allow traffic to go outside, here are my questions : 1. I've added virtual-server with 0.0.0.0/0.0.0.0 as Forwarding (IP) to allow the LAN to have connectivity. but unless i open virtual server back inside (100.100.100.0/255.255.255.0) i have no connectivity. Isn't it statefull ? 2. After i open the rule I talked about in (1). i have this message when i try simple resolving from server behind the F5. [ip@qa-env ~]$ host google.com 8.8.4.4 ;; reply from unexpected source: 8.8.4.425965, expected 8.8.4.453 tcpdump show this 22:45:39.033309 IP 100.100.100.40.39945 > 8.8.4.4.53: 8917+ A? google.com. (27) 22:45:39.033315 IP 100.100.100.40.39945 > 8.8.4.4.53: 8917+ A? google.com. (27) 22:45:39.123868 IP 8.8.4.4.53 > 100.100.100.40.39945: 8917 1/0/0 A 173.194.41.69 (43) 22:45:39.123884 IP 8.8.4.4.25965 > 100.100.100.40.39945: UDP, length 43 So the packets goes all good until the return packet back to the F5 and then he alter the port! What am i missing ? *remember, i have public ip on the server. i just changed it to 100.100.100.40 for the example. my Virtuals ltm virtual MNG_ALLOW_ALL_OUT { description "Management Rule - Allow All Traffic Outside" destination 0.0.0.0:any ip-forward mask any profiles { fastL4 { } } translate-address disabled translate-port disabled vlans { DNS_LAN LDAP_LAN RADIUS_LAN } vlans-enabled } ltm virtual MNG_QA_ENV_IN { description "Management Rule - Allow Radius traffic in" destination 100.100.100.0:any ip-forward mask 255.255.255.0 profiles { fastL4 { } } translate-address disabled translate-port disabled vlans { CRS1.WAN CRS2.WAN } vlans-enabled }1.4KViews0likes29Comments