Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

I need help getting Virtual Server working on F5--LAB

Posted on 2016-09-21
13
Medium Priority
?
282 Views
Last Modified: 2016-10-04
Please I need help getting Virtual Server working on F5 on my lab.
The lab setup is as follow—From VMware Workstation 12.1
Internal interface (Self IP)--10.2.0.145
External interface (Self IP) –192.168.0.145 (default gateway 192.168.0.1—DSL router)
Nodes (10.2.0.11, 22 and 33)
Virtual server—192.168.0.177
Management (Self IP) address is 10.1.0.145
I can ping to 10.1.0.X and 10.2.0.x addresses, but unable to ping  192.168.0.177 (VS ip address) , not sure what I have been doing wrong.
Ping to -- 10.1.0.145--(Successful)
Ping to --10.2.0.145 (Successful)
Ping to Nodes (10.2.0.11, 22 and 33) -- (Successful)
Ping to 192.168.0.145 (Successful)
Ping to Virtual server—192.168.0.177 (Failed—Destination host Unreachable)
Also attached is some graphic result to give an idea of what is working and what is not working.
Please help.
Ping-results-and-others.pdf
0
Comment
Question by:gbolly1913
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 6
  • 3
  • 3
  • +1
13 Comments
 
LVL 79

Assisted Solution

by:arnold
arnold earned 500 total points
ID: 41810091
You usually can not ping the virtual interface from the F5. Nor from the systems to which the virtual interface forwards.
If you have ping as part of the DSL troubleshooting toolset, you should be able to ping 192.168.0.177 from 192.168.0.1.

Are you able to access the services for which the virtual interface on the F5 is setup from the outside?
For more experienced F5 experts, I think you need to provide greater detail on what the contex is for this question.
0
 
LVL 79

Expert Comment

by:arnold
ID: 41810096
To test, telnet to the ports/services for which the virtual Is interface is setup.
0
 

Author Comment

by:gbolly1913
ID: 41810837
Thank  you sir for looking at this for me.

Just started learning F5 load balancing, I have zero experience.

“You usually can not ping the virtual interface from the F5. Nor from the systems to which the virtual interface forwards”.

This is why expert exchange is a valuable service, because I don’t know that you cannot ping the VS  ip address from F5 itself, and not even from my laptop that is connected to my DSL, thanks you very much for pointing that out to me.

The main purpose of my question is that when I setup up the lab, I was expecting to be able to toggle between each of the three server when I refresh my browser which  I mentioned in my post (10.2.0.11, 22, 33) when I http to virtual server ip address 192.168.0.177 from my laptop browser, which I believe would have simulated real environment.

Note:

When I http directly to the three server from my laptop i.e. http:/10.2.0.11, 22, 33 I was able to see them

“If you have ping as part of the DSL troubleshooting toolset, you should be able to ping 192.168.0.177 from 192.168.0.1”.
I can ping all other addresses from my laptop and F5, as shown in my previous attachment, including 192.168.0.145 as shown below
C:\Users>ping 192.168.0.145

Pinging 192.168.0.145 with 32 bytes of data:
Reply from 192.168.0.145: bytes=32 time=28ms TTL=255
Reply from 192.168.0.145: bytes=32 time=10ms TTL=255
Reply from 192.168.0.145: bytes=32 time=10ms TTL=255
Reply from 192.168.0.145: bytes=32 time=11ms TTL=255

Ping statistics for 192.168.0.145:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 10ms, Maximum = 28ms, Average = 14ms
0
NFR key for Veeam Agent for Linux

Veeam is happy to provide a free NFR license for one year.  It allows for the non‑production use and valid for five workstations and two servers. Veeam Agent for Linux is a simple backup tool for your Linux installations, both on‑premises and in the public cloud.

 

Author Comment

by:gbolly1913
ID: 41810864
[root@BIGIP-Test-1:Active:Standalone] config # telnet 192.168.0.177 http
Trying 192.168.0.177...
telnet: connect to address 192.168.0.177: No route to host
[root@BIGIP-Test-1:Active:Standalone] config #
0
 
LVL 64

Assisted Solution

by:btan
btan earned 500 total points
ID: 41810899
1) Check that arp is enabled on the virtual addresses
2) Check that icmp is enabled on the virtual addresses
https://support.f5.com/kb/en-us/solutions/public/14000/800/sol14822

3) Check that the the virtual servers are enabled on the LTM vlan where you are trying to reach them (virtual servers are enabled on all vlans by default)
4) Check virtual server/address statistics to see if any traffic is reaching them

Another is to configure the profile to your pool member of web server and try if the browser can reach the server thru the VIP.
0
 

Author Comment

by:gbolly1913
ID: 41811119
Thanks btan, i have follow your instruction and tested the VS via both IE and firefox, does not work as shown in the attached.

I can browse to the three server from both IE and firefox, also as shown in the attached.

Thanks for your help.
Browse-to-the-Virtual-server-and-po.docx
0
 
LVL 79

Expert Comment

by:arnold
ID: 41811715
Ok, so you ave the virtual server, the section I think covered in the link attaches the forwarding of the connection info seems to be missing.
Check the default route of the system behind it.

Use wireshark or ms network monitor on the web server to see whether it sees traffic voting from 192.168.0.177

Presumably your web server are connected directly or via switch into the F5.
0
 
LVL 64

Expert Comment

by:btan
ID: 41811727
Make sure client is in same subnet as VIP. Minimally the VIP should be able to reach if you already cobfigured your pooled member.
Run tcpdump in F5 to see the traffic routing information of your attempts.
https://support.f5.com/kb/en-us/solutions/public/0000/400/sol411.html

I am thinking if the VIP is to just forward traffic then should use forwarding VIP
https://support.f5.com/kb/en-us/solutions/public/7000/500/sol7595.html
0
 
LVL 47

Accepted Solution

by:
Craig Beck earned 1000 total points
ID: 41812271
A forwarding VIP wouldn't load-balance traffic, so if you want distributed load-balancing a forwarding VIP isn't what you need.  You'd generally use a forwarding VIP if you want to pass infrastructure traffic through the F5 without doing any magic to it.

Where are you on the network in relation to the web servers when you're testing?

Looking at your latest attachment it appears you've configured a Virtual Address.  You want to configure a Virtual Server too, if you haven't already.  The Virtual Address is used to create a Virtual Server which allows you to load-balance the protocols you require.

This will help you understand...
https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/ltm_configuration_guide_10_1/ltm_virtual.html#1178291
0
 
LVL 64

Expert Comment

by:btan
ID: 41812354
agree with Craig. It depends on your use case. better to do network log check within F5 (tcpdump) to see where it fails
0
 

Author Comment

by:gbolly1913
ID: 41814233
Thanks Btan and Craig, I am sorry that I haven’t posted response to your message, I am out of town and my lab laptop is not with me.

I should be back on Tuesday and apply your suggestion in reference to virtual server and Virtual Address and update you of my progress.

Thanks for your help.
0
 

Author Comment

by:gbolly1913
ID: 41828743
Apology, i am occupied with some other issue that i will need to concentrate on.

Hope to continue investigate at a later date.

Thanks for all your help.
0
 

Author Closing Comment

by:gbolly1913
ID: 41828745
Thanks
0

Featured Post

Turn your laptop into a mobile console!

The CV211 Laptop USB Console Adapter provides a direct Laptop-to-Computer connection for fast and easy remote desktop access with no software to install.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this article, we’ll look at how to deploy ProxySQL.
In this article, WatchGuard's Director of Security Strategy and Research Teri Radichel, takes a look at insider threats, the risk they can pose to your organization, and the best ways to defend against them.
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …

722 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question