Forum Discussion

Deep_287674's avatar
Deep_287674
Icon for Nimbostratus rankNimbostratus
Aug 27, 2016

F5 HA issue as dependency is on FW

Hi, I am facing issue with F5 Failvoer. Active Switch---> Active F5--->Active Firewall. When Checkpoint Failover happens , F5 is forced to failover, as in this case F5 forced to Standby.

 

There is option of Fail Safe option in F5 which can monitor a particular interface connected to FW. If incase interface VLAN 40 goes down at FW or F5 , F5 will take care of Failover.

 

But, my question is sometimes FW failover occurs but FW interface connected to active F5 remains up. In this case we have to forcefully make the F5 standby. Because if automatic failover don't happens it will impact the business.

 

ASM Advanced WAF
BIG-IP
security

2 Replies

Sort By
  • Vijay_E's avatar
    Vijay_E
    Icon for Cirrus rankCirrus
    Aug 27, 2016

    Failover in the upstream router/fw should not affect the downstream F5 as long as the configuration on the F5/FW/Routes are good. I think you need to revisit this and fix any possible issues. If you don't want to change this, you can try and explore the Gateway Failsafe option.

     

  • boneyard's avatar
    boneyard
    Icon for MVP rankMVP
    Aug 27, 2016

    i assume you are thinking about VLAN failsafe and that doesn't care if the interfaces goes up or down, it cares about seeing traffic on that VLAN.

     

    what you want is kinda tricky, because how would the F5 know the status of the firewall? if the traffic does indeed fall away from a VLAN that would be enough, but if anything still happens there then it isn't. isn't it possible to add a switch layer between the firewalls and F5s so it doesn't matter which F5 is active?