Forum Discussion

Basavaraj_16797's avatar
Basavaraj_16797
Icon for Nimbostratus rankNimbostratus
Jan 04, 2016

Device group configuration

HI Team,

 

We are replacing our old F5 with new 5250 series F5, when we are uploading the UCS file in the new F5, we got an errors saying cookie encryption error and because of which we are unable to upload UCS file in the new F5.

 

The possible solution for me is i can add these new F5 into the existing device group and i can sync the configuration.

 

My question is old F5 is 3900 series and our new F5 are 5250 series, can we add all this four devices into same device group ? or all the hardware should be same module to be part same group ?

 

Thanks/Basavaraj

 

application delivery
BIG-IP
ha

3 Replies

Sort By
  • nathe's avatar
    nathe
    Icon for Cirrocumulus rankCirrocumulus
    Jan 04, 2016

    Basavaraj,

     

    Since TMOS v11.3 Device Groups can have BIG-IPs of different platforms. So if you're at a latest version then you should be able to add them into the existing sync group and configsync the changes across.

     

    Good luck.

     

    N

     

  • Basavaraj_16797's avatar
    Basavaraj_16797
    Icon for Nimbostratus rankNimbostratus
    Jan 05, 2016

    Hi Nathan,

     

    Thank you so much for the response, we are running version 11.6 and hot fix 8, i guess we will not be having any issues in the adding new F5s into existing device group.

     

    I have one more doubt, say for example in old F5 there are some persistence profiles are configured and they are secured with encrypted password which users dont remember.

     

    so if add my new F5s into the existing device group and sync, will it create any problem because of these encrypted cookie passwords?

     

    i would like to understand how these cookies persistence profiles with encrypted password works ?

     

    can i also delete this encrypted cookie and re-create again ?

     

    Thanks/Basavaraj

     

  • jaiAdityaSingla's avatar
    jaiAdityaSingla
    Icon for Nimbostratus rankNimbostratus
    Feb 25, 2016

    Although in this case, you cannot load a UCS from one device to another without intervention, the admin can now change the master key and then successfully load the configuration onto a different device.

     

    1. Before taking the UCS to a different system, set the master key from a passphrase using the following command: tmsh modify sys crypto master-key prompt-for-password.
    2. On the system where the UCS will be restored, load the UCS. (Here, it fails to load due to encrypted attributes which cannot be decrypted.)
    3. On the new system with the failed UCS load, set the master key using the previously specified passphrase, by running the command: tmsh modify sys crypto master-key prompt-for-password.
    4. Load the configuration with the command: tmsh load sys config. The configuration loads and the encrypted attributes are accessible.