All, I am having an issue with Virtual servers staying up even when there are no no nodes on the back end up and running. I need to make the VIP address not availible when this event occurs. I currently use an Irule like this but this takes effect after the request is accepted. Is there anyway to turn down the VIP address so even a ping gets a bad respone or timeout? when CLIENT_ACCEPTED { if { [active_members pool1] == 0 } { discard } }

The trouble with disabling ping is that any single IP can potentially host 64k virtual servers. How do you then control the shared behavior if 64k-1 virtuals are available?

I kind of don't understand what you are asking? I want to basically disable a Vip address / Virtual server if all my nodes are down. In the case where the Virtual server supports more than one url I would think if the pmultiple pools are involved the traffic would pass and the application with the issue would have an issue. In the case where one pool is responsible for multiple urls if the nodes equal 0 then the url's will all be down.

If monitors mark all your pool members down, the vip will be marked down. If you disable all the pool members, but monitors are still affective, you also need to change the the pool member settings to active traffic only. That way, once all active traffic is bled off, the virtual will be marked down. Basically I was saying, disabling ping is not an option you could bind to the virtual server availability since more than one virtual server is possible on an IP, and this logic rides higher in the stack than icmp.

Turning off the tcp port is a function of the vip being available or not (assuming it's a port-based vip) Member availability can mean different things based on your settings. If you have 4 members, and you have administratively disabled them, by default, the vip will still be available (ie, the tcp port is still responding) as long as the health monitors, if applied, are successful. This is because the default behavior of a pool member when disabled is changed from allow all traffic to allow active/persistence connections only. You need to change the setting on the pool member to allow active traffic only in order to get the virtual to a truly down state UNLESS the health monitors are all failing, in which case the virtual will be marked down. Clear as mud?

Hello, if i vip has http profile and pool is down i can connect vip port 80 but if i remove http profile from vip it does not accept connections so what i want? if vip is down dont accept connection, how can i do this? regards zafer

Turning VS off when nodes down

19 Replies

What_Lies_Bene1
Cirrostratus
Apr 10, 2013
Take a look at Local Traffic ›› Virtual Servers : Virtual Address List >> the VS address in question

You'll see an ICMP Echo option there; it's operation is dependent on what other VSs share the IP and your needs. As Hoolio notes, this can't be adjusted from within an iRule.
Dean_Morris_151
Historic F5 Account
Oct 13, 2014
Ref for above comment:

https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/ltm-implementations-11-5-1/48.print.html
Felix888_164906
Nimbostratus
Oct 22, 2014
Thanks, I did based on above doc says, choose the selective icmp response for the virtual server. But it doesn't work. It still response the ICMP regardless of the status of the virtual server and nodes. all servers down in this case, but VS still response to icmp and http
- StephanManthey
  MVP
  Oct 23, 2014
  What software version are you on? I´m sure it works fine for v11.5.1 for virtual servers in standard mode. Please keep in mind, that there is a separate "switch" for SNATs as well. There is no overlap for virtual IPs and self / floating self IPs / NATs?
Felix888_164906
Nimbostratus
Oct 23, 2014
Hi Stephan:

My software ver is 10.6 in standard mode. not sure what separate switch for snat is, but I did use automap for the VS. Also I turn it off later on. Any idea? in VS setup, I choose Notify Status to Virtual Address. In Pool setup, I choose Action On Service Down. And configure the rest based on the document. Please help, I really need the selective ICMP respond. In virtual address list setup, I set all virtual server are available with enabling advertise the Route Advertisement. And the virtual server I am working on has no real servers up and running, but atfer all these have been done, I am still able to ping the VS and even telnet on port 80..... This is not what I want, please advise. Thanks
StephanManthey
MVP
Oct 23, 2014
Hi Felix,
in case you are using SNAT automap there is no need to disable ARP (and it is not even possible for egress floating self IP (which will be used here), afaik).
I remember having problems with the "selective" ICMP response settings after migrating to v11.5.1HF5 and picked just "enabled" (had the VIP in ARP and ICMP and generally disabled state before).
I just tested on v11.6.0 (no hotfix) and it seemed to work as expected:
tmsh modify ltm virtual-address 10.131.131.239 icmp-echo enabled tmsh modify ltm virtual-address 10.131.131.239 icmp-echo disabled tmsh modify ltm virtual-address 10.131.131.239 icmp-echo selective

Depending on chosen setting the ping to the virtual address worked / worked not. In case all pool members down in selective mode it stopped responding.
Is there an iRule associated with the virtual server referencing another pool? Can you please provide the configuration of your virtual server:
tmsh list ltm virtual <virtual_server_name> tmsh list ltm virtual-address <virtual_ip_address>

Thanks, Stephan
Felix888_164906
Nimbostratus
Oct 24, 2014
Stephan, I'm so sorry to get you back due to the busy days recently. I'll set it up and let you know!
Felix888_164906
Nimbostratus
Oct 24, 2014
weird enough, I just found my virtual address list is disappeared completely...
- StephanManthey
  MVP
  Oct 25, 2014
  Hi Felix, just open the submenu in the virtual server configuration (tab located next to virtual server list), please: Local Traffic ›› Virtual Servers : Virtual Address List Cheers, Stephan

Forum Discussion

Turning VS off when nodes down

19 Replies

Recent Discussions

Enterprise Security best practices with F5 WAF

Disk space full - what files, folders are safe to delete?

ASM instance creation

BIG-IP DNS: Check Status Of Multiple Monitors Against Pool Member

Open Redirection Mitigation

Related Content

Single Node Persistence

F5 Active Standby Node Configuration

Nodes forwarding

Run Advanced Containers like OPSWAT Content Scrubbing Directly On F5 Distributed Cloud Nodes

Multiple CE nodes in vmware?