Solved

I need help getting Virtual Server working on F5--LAB

Posted on 2016-09-21
13
83 Views
Last Modified: 2016-10-04
Please I need help getting Virtual Server working on F5 on my lab.
The lab setup is as follow—From VMware Workstation 12.1
Internal interface (Self IP)--10.2.0.145
External interface (Self IP) –192.168.0.145 (default gateway 192.168.0.1—DSL router)
Nodes (10.2.0.11, 22 and 33)
Virtual server—192.168.0.177
Management (Self IP) address is 10.1.0.145
I can ping to 10.1.0.X and 10.2.0.x addresses, but unable to ping  192.168.0.177 (VS ip address) , not sure what I have been doing wrong.
Ping to -- 10.1.0.145--(Successful)
Ping to --10.2.0.145 (Successful)
Ping to Nodes (10.2.0.11, 22 and 33) -- (Successful)
Ping to 192.168.0.145 (Successful)
Ping to Virtual server—192.168.0.177 (Failed—Destination host Unreachable)
Also attached is some graphic result to give an idea of what is working and what is not working.
Please help.
Ping-results-and-others.pdf
0
Comment
Question by:gbolly1913
  • 6
  • 3
  • 3
  • +1
13 Comments
 
LVL 76

Assisted Solution

by:arnold
arnold earned 125 total points
ID: 41810091
You usually can not ping the virtual interface from the F5. Nor from the systems to which the virtual interface forwards.
If you have ping as part of the DSL troubleshooting toolset, you should be able to ping 192.168.0.177 from 192.168.0.1.

Are you able to access the services for which the virtual interface on the F5 is setup from the outside?
For more experienced F5 experts, I think you need to provide greater detail on what the contex is for this question.
0
 
LVL 76

Expert Comment

by:arnold
ID: 41810096
To test, telnet to the ports/services for which the virtual Is interface is setup.
0
 

Author Comment

by:gbolly1913
ID: 41810837
Thank  you sir for looking at this for me.

Just started learning F5 load balancing, I have zero experience.

“You usually can not ping the virtual interface from the F5. Nor from the systems to which the virtual interface forwards”.

This is why expert exchange is a valuable service, because I don’t know that you cannot ping the VS  ip address from F5 itself, and not even from my laptop that is connected to my DSL, thanks you very much for pointing that out to me.

The main purpose of my question is that when I setup up the lab, I was expecting to be able to toggle between each of the three server when I refresh my browser which  I mentioned in my post (10.2.0.11, 22, 33) when I http to virtual server ip address 192.168.0.177 from my laptop browser, which I believe would have simulated real environment.

Note:

When I http directly to the three server from my laptop i.e. http:/10.2.0.11, 22, 33 I was able to see them

“If you have ping as part of the DSL troubleshooting toolset, you should be able to ping 192.168.0.177 from 192.168.0.1”.
I can ping all other addresses from my laptop and F5, as shown in my previous attachment, including 192.168.0.145 as shown below
C:\Users>ping 192.168.0.145

Pinging 192.168.0.145 with 32 bytes of data:
Reply from 192.168.0.145: bytes=32 time=28ms TTL=255
Reply from 192.168.0.145: bytes=32 time=10ms TTL=255
Reply from 192.168.0.145: bytes=32 time=10ms TTL=255
Reply from 192.168.0.145: bytes=32 time=11ms TTL=255

Ping statistics for 192.168.0.145:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 10ms, Maximum = 28ms, Average = 14ms
0
 

Author Comment

by:gbolly1913
ID: 41810864
[root@BIGIP-Test-1:Active:Standalone] config # telnet 192.168.0.177 http
Trying 192.168.0.177...
telnet: connect to address 192.168.0.177: No route to host
[root@BIGIP-Test-1:Active:Standalone] config #
0
 
LVL 61

Assisted Solution

by:btan
btan earned 125 total points
ID: 41810899
1) Check that arp is enabled on the virtual addresses
2) Check that icmp is enabled on the virtual addresses
https://support.f5.com/kb/en-us/solutions/public/14000/800/sol14822

3) Check that the the virtual servers are enabled on the LTM vlan where you are trying to reach them (virtual servers are enabled on all vlans by default)
4) Check virtual server/address statistics to see if any traffic is reaching them

Another is to configure the profile to your pool member of web server and try if the browser can reach the server thru the VIP.
0
 

Author Comment

by:gbolly1913
ID: 41811119
Thanks btan, i have follow your instruction and tested the VS via both IE and firefox, does not work as shown in the attached.

I can browse to the three server from both IE and firefox, also as shown in the attached.

Thanks for your help.
Browse-to-the-Virtual-server-and-po.docx
0
Find Ransomware Secrets With All-Source Analysis

Ransomware has become a major concern for organizations; its prevalence has grown due to past successes achieved by threat actors. While each ransomware variant is different, we’ve seen some common tactics and trends used among the authors of the malware.

 
LVL 76

Expert Comment

by:arnold
ID: 41811715
Ok, so you ave the virtual server, the section I think covered in the link attaches the forwarding of the connection info seems to be missing.
Check the default route of the system behind it.

Use wireshark or ms network monitor on the web server to see whether it sees traffic voting from 192.168.0.177

Presumably your web server are connected directly or via switch into the F5.
0
 
LVL 61

Expert Comment

by:btan
ID: 41811727
Make sure client is in same subnet as VIP. Minimally the VIP should be able to reach if you already cobfigured your pooled member.
Run tcpdump in F5 to see the traffic routing information of your attempts.
https://support.f5.com/kb/en-us/solutions/public/0000/400/sol411.html

I am thinking if the VIP is to just forward traffic then should use forwarding VIP
https://support.f5.com/kb/en-us/solutions/public/7000/500/sol7595.html
0
 
LVL 45

Accepted Solution

by:
Craig Beck earned 250 total points
ID: 41812271
A forwarding VIP wouldn't load-balance traffic, so if you want distributed load-balancing a forwarding VIP isn't what you need.  You'd generally use a forwarding VIP if you want to pass infrastructure traffic through the F5 without doing any magic to it.

Where are you on the network in relation to the web servers when you're testing?

Looking at your latest attachment it appears you've configured a Virtual Address.  You want to configure a Virtual Server too, if you haven't already.  The Virtual Address is used to create a Virtual Server which allows you to load-balance the protocols you require.

This will help you understand...
https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/ltm_configuration_guide_10_1/ltm_virtual.html#1178291
0
 
LVL 61

Expert Comment

by:btan
ID: 41812354
agree with Craig. It depends on your use case. better to do network log check within F5 (tcpdump) to see where it fails
0
 

Author Comment

by:gbolly1913
ID: 41814233
Thanks Btan and Craig, I am sorry that I haven’t posted response to your message, I am out of town and my lab laptop is not with me.

I should be back on Tuesday and apply your suggestion in reference to virtual server and Virtual Address and update you of my progress.

Thanks for your help.
0
 

Author Comment

by:gbolly1913
ID: 41828743
Apology, i am occupied with some other issue that i will need to concentrate on.

Hope to continue investigate at a later date.

Thanks for all your help.
0
 

Author Closing Comment

by:gbolly1913
ID: 41828745
Thanks
0

Featured Post

Enabling OSINT in Activity Based Intelligence

Activity based intelligence (ABI) requires access to all available sources of data. Recorded Future allows analysts to observe structured data on the open, deep, and dark web.

Join & Write a Comment

Article by: btan
Provide an easy one stop to quickly get the relevant information on common asked question on Ransomware in Expert Exchange.
This article explains in simple steps how to renew expiring Exchange Server Internal Transport Certificate.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

757 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now