Tenant Management

Tenants overview

A tenant is a guest system running software on the F5OS platform layer (for example, a BIG-IP system). You can run several tenants on most platforms, although the F5 r2000 Series only supports a single tenant. For more information, see Tenant data.

The administrator can connect to the tenant’s webUI, CLI, or REST API and have the same experience as on their existing F5 platforms. A tenant on the rSeries platform is managed similarly to how a vCMP guest is managed today on the VIPRION platform. The tenant is assigned dedicated vCPU and memory resources and is restricted to specific VLANs for network connectivity.

The admin is responsible for configuring tenant deployments within the appliance. Once a tenant has been deployed, there is a per-tenant administrator role, whose responsibilities include configuring the services that are available on that tenant.

Important: Tenants inherit certain capabilities, such as the license, VLANs, and management interface speed, from the system. Do not try to install a new license or delete the existing license on the tenants. Tenant admins cannot configure global parameters. You configure these at the platform layer, and values are propagated to all tenants in the system.

This table lists tenant data specifications for rSeries systems.

Tenant data

This table lists tenant data specifications for rSeries systems.

Tenants example

In this diagram, an rSeries system has eight tenants (red and blue).

Each tenant has its own IP address, set of users, and software. You can access each tenant via the CLI, web-based user interface, or API.

After you have configured and deployed a tenant, you can use the tenant management IP address to connect to the tenant’s web-based user interface, API, or CLI. A BIG-IP tenant is running standard TMOS and is managed like any other BIG-IP instance.

Tenant image overview

BIG-IP tenant images

These BIG-IP tenant images are available to deploy on F5 rSeries systems:

• ALL-F5OS
• T4-F5OS
• T2-F5OS
• T1-F5OS (see note)

Note: T1-F5OS has limitations, so using the other images is recommended. Other images must be downloaded from F5 Downloads.

Each image type has different uses so you need to be sure to use the correct type for your tenant needs. For additional information about BIG-IP tenant image types, see K45191957: Overview of the BIG-IP tenant image types.

This table lists general use cases for tenant images.

Each image has different sizing requirements. You will need to understand the system and the tenant requirements to determine the number and type of tenants you can deploy. The amount of memory and disk space that a tenant actually needs is dependent on the number of modules provisioned and its use.

Tenant usage

This table lists general use cases for tenant images.

Tenant sizing

Each image has different sizing requirements. You will need to understand the system and the tenant requirements to determine the number and type of tenants you can deploy. The amount of memory and disk space that a tenant actually needs is dependent on the number of modules provisioned and its use.

Important: The minimum virtual disk size for the tenant image category “ALL-F5OS” depends on the BIG-IP tenant image version you deploy.

• BIG-IP 17.1.3 and later: 83 GB
• BIG-IP 17.1.0 – 17.1.2: 82 GB
• BIG-IP 15.1.x: 77 GB

Tenant resource allocation overview

These are recommended resource considerations for determining the amount of memory (RAM) and disk space to allocate when planning tenant deployments on F5 rSeries systems.

These are recommendations for determining the amount of memory (RAM) to allocate when planning tenant deployments on rSeries systems based on the number of vCPUs assigned.

These are recommendations for determining the amount of disk space when planning tenant deployments on rSeries systems.

Memory allocation

These are recommendations for determining the amount of memory (RAM) to allocate when planning tenant deployments on rSeries systems based on the number of vCPUs assigned.

Note: The formula for finding vcpu-cores-per-node is: multiples of 4 in range of [4, max-cores]. The default value for vcpu-cores-per-node is 4, and the default value for memory is 12288.

There is also an advanced setting through which additional memory can be assigned out of the pool to a tenant. You can specify more than the minimum amount of memory when configuring a tenant, if needed.

Disk space

These are recommendations for determining the amount of disk space when planning tenant deployments on rSeries systems.

• The amount of disk space that a tenant actually needs is dependent on the number of modules provisioned and its use.
• As the aggregate disk usage within deployed tenants increases, the host disk can start to reach capacity on systems with many large tenants. The administrator will need to monitor disk usage to make sure there is sufficient space for the tenants.

Tenant management from the webUI

Manage tenant images from the webUI

You can add or delete tenant images from the webUI. You must use HTTPS image import or export. Note that tenant images are specific to the rSeries system, and the software version must be compatible with it.

1. Log in to the webUI using an account with admin access.

2. On the left, click TENANT MANAGEMENT > Tenant Images.

3. To upload an image, click Upload and browse to the image location.

4. To import an image:

   1. Click Import.

      A popup opens.

   2. For URL, enter the URL of the remote image server.

      F5 recommends that the remote host be an HTTPS server with PUT/POST enabled and have a valid CA-signed certificate. You can opt to select the Ignore Certificate Warnings check box if you want to skip the certificate check.

   3. For Username, type the user name for an account on the remote image server, if required.

   4. For Password, type the password for the account, if required.

   5. Select Ignore Certificate Warnings to skip the certificate check.

   6. Click Import Image.

   Note: Depending on the image file size and network availability, the import might take a few minutes. When the import is successful, the software image is listed in the webUI.

5. To delete a tenant image, select the image and click Delete.

After you have added the tenant images that you want to use to the system, you can create and deploy tenants that will use that software image. The tenant image must be one that is listed as compatible with the rSeries system.

Create and deploy tenants from the webUI

You must have imported the tenant images that you want to use for the tenant deployments into the system. You must also have previously created any required VLANs. Before you can create and deploy tenants, you also need to estimate resource requirements so you know how many vCPUs, memory, and other resources to assign to the tenant.

An administrator can deploy tenants from the webUI. You can open a preview pane with tenant details by clicking anywhere in a row. You can resize the preview pane to show more or less information. To close the preview pane, click Close or click again anywhere in the row.

1. Log in to the webUI using an account with admin access.

2. On the left, click TENANT MANAGEMENT > Tenant Deployments.

   The Tenant Deployment screen displays showing the existing tenant deployments and associated details.

3. To add a tenant deployment, click Add.

   The Add Tenant Deployment screen displays.

4. For Name, enter a name for the tenant deployment (up to 49 characters).

   Note: The first character in the name cannot be a number. After that, only lowercase alphanumeric characters and hyphens are allowed.

5. For Type, keep the default setting of BIG-IP.

6. For Image, select the software image that was previously imported onto the system.

   Ensure that the image you selected meets your tenant deployment needs.

7. For IP Address, enter the IPv4 address, IPv6 address, or Fully Qualified Domain Name (FQDN) for the tenant.

8. For Prefix Length, enter a number for the length of the prefix.

   The maximum prefix length is 32 for IPv4 and 128 for IPv6.

9. For Gateway, enter the IPv4 address or IPv6 address of the gateway.

10. For VLANs, select one or more VLANs that are available to the tenant.

    You can assign VLANs to more than one tenant.

11. For Virtual Wires, select configured virtual wires for the tenant.

    Note: This field displays only when virtual wires are configured on the system.

12. For Resource Provisioning, select one of these options:

    Option	Description
    Recommended	Recommended values for vCPUs and memory for the tenant.
    Advanced	Enables you to configure custom values for vCPUs and memory on the tenant. For example, if you want to configure a single vCPU tenant, or a tenant that uses more than the recommended amount of memory.

13. For vCPUs, select the number of vCPUs to provide to the tenant.

    The minimum recommended number of vCPUs per typical tenant is two (one vCPU is sufficient only for lightweight tenants that cannot be updated). The number of vCPUs needed depends on the amount of traffic the tenant will be handling. More vCPUs provide faster throughput.

14. For Memory, specify the amount of RAM, in MB, to allocate to the tenant.

    The amount of memory needed depends on the number of vCPUs assigned. The minimum amount of memory needed is determined by the formula [(3.5 * 1024 * #ofvCPUs) + 512].

    If you do not allocate sufficient memory, you may receive a warning message.

15. For Virtual Disk Size, specify the storage quota, in GB, for the tenant virtual disk.

    Default size depends on the image type used. The default size for the ALL image is 82GB.

16. For State, choose one of these options:

17. For Crypto/Compression Acceleration, select Enabled if the tenant requires high-performance crypto processing and compression.

    When this option is enabled, the tenant receives dedicated crypto devices proportional to the number of vCPU cores. Crypto processing and compression are off-loaded to the hardware. When the option is disabled, the tenant receives no crypto devices.

18. To restrict usage of the Bash shell for tenant administrators, set Appliance Mode to Enabled (this is Disabled by default.)

19. Click Save & Close.

The tenant is now configured and in the Deployed state. When the status says Running, the tenant administrator can log in to the tenant webUI or CLI using the management IP address (with HTTPS or SSH) and continue configuring the tenant system.

Note: If the Status says Pending instead of Running, this may mean that there are not enough resources (vCPUs, memory, or other resources) for the tenant to be deployed. See the Tenant Details screen in the webUI for more information about the specific tenant.

Modify tenant deployments from the webUI

Depending on the state that the tenant is in, you can change certain tenant settings from the webUI. A warning displays if you try to make any other changes.

• Deployed: You can change the State only while tenants are running.

  Note: Once a tenant is Deployed (and is up and running), changing its state back to Provisioned or Configured stops the tenant. You will receive a warning message before this occurs.

• Provisioned: You can change all settings except Image.

• Configured: You can change all settings except Image.

1. Log in to the webUI using an account with admin access.

2. On the left, click TENANT MANAGEMENT > Tenant Deployments.

   The Tenant Deployment screen displays showing the existing tenant deployments and associated details.

3. Click the name of the tenant deployment you want to modify.

   The Edit Tenant Deployment screen displays.

4. For Image, select a different software image to use for the tenant, if in Configured state.

5. You can change the IP Address, Prefix Length (1-32), and Gateway for the tenant, if in Configured or Provisioned state. Enter an IPv4 address or IPv6 address.

6. For VLANs, you can select different VLANs for the tenant, if in Configured or Provisioned state.

7. For Virtual Wires, select configured virtual wires for the tenant.

   Note: This field displays only when virtual wires are configured on the system.

8. For MAC Data/MAC Block Size, select One, Small, Medium, or Large.

   Option	Description
   One	Represents a block with one MAC. This is used when l2-inline-device functionality is not needed. This is the default value.
   Small	Represents a block of 8 MACs. When this value is used, the l2-inline-device is enabled, and the tenant gets a block of 8 contiguous MACs.
   Medium	Represents a block of 16 MACs. When this value is used, the l2-inline-device is enabled, and the tenant gets a block of 16 contiguous MACs.
   Large	Represents a block of 32 MACs. When this value is used, the l2-inline-device is enabled, and the tenant gets a block of 32 contiguous MACs.

9. For Resource Provisioning, if changing resources, select either: Recommended (to use recommended values) or Advanced (to customize values), if in Configured or Provisioned state.

10. For vCPUs, select the number of vCPUs for the tenant, if in Configured or Provisioned state.

    The minimum recommended number of vCPUs per typical tenant is two (one vCPU is sufficient only for lightweight tenants that cannot be updated). The number of vCPUs needed depends on the amount of traffic the tenant will be handling. More vCPUs provide faster throughput.

11. For Memory, specify the amount of RAM in MB to allocate to the tenant, if in Configured or Provisioned state.

    The amount of memory needed depends on the number of vCPUs assigned. The minimum amount of memory needed is determined by the formula [(3.5 * 1024 * #ofvCPUs) + 512], so a two vCPU tenant needs a minimum of 7680 MB, and a four vCPU tenant needs a minimum of 14,848MB.

12. Change State (with caution!):

    Option	Description
    Configured	If tenant has been Provisioned or Deployed, the virtual disk is deleted.
    Provisioned	If Deployed, this option stops the tenant from running, but maintains the configuration. If Configured, causes the system to install the software, assign the tenant to nodes, and create virtual disks for the tenant on those nodes. The tenant does not run, consume resources, or pass traffic.
    Deployed	Directly deploys the tenant. This sets up the tenant, allocates resources, moves the image onto the system, and installs the software. When these tasks are complete, the tenant is fully deployed and running.

13. Change Crypto/Compression Acceleration only if the tenant is in either the Configured or Provisioned state.

14. To restrict usage of the Bash shell for tenant administrators, set Appliance Mode to Enabled (this is Disabled by default.)

15. Click Save & Close.

The tenant is reconfigured according to the changes made.

Tenant management from the CLI

Use the tenants command from the CLI to configure a cluster of virtual machines (VMs) that run on one or more nodes within the system

Display tenant resources from the CLI

Before creating a tenant, you can display total and available tenant resources, such as vCPUs, memory, and disk space from the CLI. You can also display storage and tenant volume size from the CLI.

1. Log in to the command line interface (CLI) of the system using an account with admin access.

   When you log in to the system, you are in user (operational) mode.

2. Show the storage and tenant volume size.

   show components component storage

   This example displays the storage and tenant volume size:

   Copy

   appliance-1# show components component storage
   components component platform
   storage state disks disk nvme0n1
     state model Micron_7300_MTFDHBA480TDF
     state vendor Micron
     state version 954300T0
     state serial-no 213931BC1153
     state size 480.00GB

Import a tenant image from the CLI

Before you get started, you might want to upload the tenant image you want to use to a local Linux server that uses HTTPS, so you can more easily import it to the rSeries system.

You can import a tenant image onto the system from the CLI.

1. Log in to the command line interface (CLI) of the system using an account with admin access.

   When you log in to the system, you are in user (operational) mode.

2. Import a tenant image to the system.

   file import remote-port <*port-number*> username <*user*> password <*password*> remote-host <*ip-address-or-fqdn*> remote-file <*remote-file-path*> remote-url <*full-remote-url*> local-file images

   This example imports a BIG-IP tenant image from server.company.com:

   Copy

   appliance-1(config)# file import username admin password remote-url 
     https://server.company.com/images/BIGIP-1x.x.x-x.x.x.ALL-F5OS.qcow2.zip.bundle
     local-file images

Create and deploy tenants from the CLI

Before you get started, import the tenant images you want to use for the tenant deployments. You must already have created VLANs on the system. Before you can create and deploy tenants, you also need to estimate resource requirements so you know how many vCPUs, memory, and other resources to assign to the tenant.

You can create and deploy tenants from the CLI.

1. Log in to the command line interface (CLI) of the system using an account with admin access.

   When you log in to the system, you are in user (operational) mode.

2. Change to config mode.

   config

   The CLI prompt changes to include (config).

3. Create and deploy the tenant.

   tenants tenant <*name*> config <*options*>

   For more information about CLI options, see Tenant CLI command syntax.

   This example creates a BIG-IP tenant called big-ip that is in the configured running-state, by default:

   Copy

   appliance-1(config)# tenants tenant big-ip config type BIG-IP 
     image BIGIP-15.1.6-0.0.3.ALL-F5OS.qcow2.zip.bundle mgmt-ip 192.0.2.200
     prefix-length 24 gateway 192.0.2.254 nodes 1

4. Commit the configuration changes.

   commit

5. Return to user (operational) mode.

   end

6. You can monitor the operational state of the tenant and move the tenant into the provisioned running-state.

   tenants tenant big-ip config running-state provisioned

   This causes the system to assign the tenant to nodes and create virtual disks for the tenant on those nodes.

7. Show the current status for the tenant:

   show tenants tenant big-ip

   When the system is creating the virtual disk and installing the image on a disk, the operational state of the tenant shows this information:

   • PHASE – Allocating resources to the tenant is in progress
   • status – Provisioning A summary similar to this example displays:
   Copy

   appliance-1# show tenants tenant big-ip
   tenants tenant big-ip
    state name          big-ip
    state unit-key-hash PcPJWXRSLgdL3FRivOJODwrIZdYLncH3rqrjkW0X03uKHZFSLPjAc3d3E3Pbgd+Piq8p86LsMgma/kHoRdd+Kg==
    state type          BIG-IP
    state image         BIGIP-15.1.6-0.0.3.ALL-F5OS.qcow2.zip.bundle
    state mgmt-ip       192.0.2.200
    state prefix-length 24
    state gateway       192.0.2.254
    state cryptos       disabled
    state vcpu-cores-per-node 2
    state memory        7680
    state running-state provisioned
    state mac-data mgmt-mac 00:0a:49:ff:20:0c
    state mac-data base-mac 00:0a:49:ff:20:0d
    state mac-data mac-pool-size 1
    state appliance-mode disabled
    state status        Provisioning
                   INSTANCE                                                 CREATION  READY          MGMT
   NODE  POD NAME  ID        PHASE                                          TIME      TIME   STATUS  MAC
   --------------------------------------------------------------------------------------------------------
   1     big-ip-1  1         Allocating resources to tenant is in progress                           -

   When the system completes the virtual disk creation, the operational state shows this information:

   • PHASE – Ready to deploy
   • status – Provisioned A summary similar to this example displays:
   Copy

   appliance-1# show tenants tenant big-ip
   tenants tenant big-ip
    state name          big-ip
    state unit-key-hash PcPJWXRSLgdL3FRivOJODwrIZdYLncH3rqrjkW0X03uKHZFSLPjAc3d3E3Pbgd+Piq8p86LsMgma/kHoRdd+Kg==
    state type          BIG-IP
    state image         BIGIP-15.1.6-0.0.3.ALL-F5OS.qcow2.zip.bundle
    state mgmt-ip       192.0.2.200
    state prefix-length 24
    state gateway       192.0.2.254
    state cryptos       disabled
    state vcpu-cores-per-node 2
    state memory        7680
    state running-state provisioned
    state mac-data mgmt-mac 00:0a:49:ff:20:0c
    state mac-data base-mac 00:0a:49:ff:20:0d
    state mac-data mac-pool-size 1
    state appliance-mode disabled
   state status        Provisioned
                   INSTANCE                   CREATION  READY          MGMT
   NODE  POD NAME  ID        PHASE            TIME      TIME   STATUS  MAC
   --------------------------------------------------------------------------
   1     big-ip-1  1         Ready to deploy                           -

8. Change to config mode.

   config

   The CLI prompt changes to include (config).

9. You can then deploy the tenant.

   tenants tenant big-ip config running-state deployed

   This example moves the tenant into the deployed state, which causes the system to start and maintain VMs on each node to which the tenant is assigned.

10. Commit the configuration changes.

    commit

11. Return to user (operational) mode.

    end

12. You can check the status of the tenant.

    show tenants tenant big-ip state instances

    A summary similar to this example displays:

    Copy

    appliance-1# show tenants tenant big-ip state instances
                    INSTANCE
    NODE  POD NAME  ID        PHASE    CREATION TIME         READY TIME            STATUS                   MGMT MAC
    ---------------------------------------------------------------------------------------------------------------------------
    1     big-ip-1  1         Running  2022-04-08T15:30:20Z  2022-04-08T15:30:21Z  Started tenant instance  00:94:a1:69:34:25

Once you configure and deploy the tenant, and the Status is updated to Running, then you can use the management IP address to access the tenant system using SSH, the web-based interface, or TMOS Shell (tmsh).

Note: Once a tenant is Deployed (and is up and running), changing its state back to Configured or Provisioned stops the tenant. You will receive a warning message before this occurs.

Note: If the Status is Pending instead of Running, this might mean that there are not enough resources (vCPUs, memory, or other resources) for the tenant to be deployed. See the Tenant Details screen in the webUI for more information about the specific tenant.

Display tenant information from the CLI

You can display detailed information about configured tenants from the CLI.

1. Log in to the command line interface (CLI) of the system using an account with admin access.

   When you log in to the system, you are in user (operational) mode.

2. Show the tenants that are currently configured.

   show tenants

   This example displays the operational data for a BIG-IP tenant. It uses one VLAN, no cryptos, two vCPU cores, and appliance mode is not enabled. The Instance table in the output displays the live health of the tenant running on the rSeries system.

   Copy

   appliance-1# show tenants tenant big-ip
   tenants tenant bigip
    state unit-key-hash oa9gv8VYHcSoApv1234GQMn2uM9UzNKiDz78cIbqKv26LVjlIo9TCdp56z5UnXcVvr3hj0/ym2kbdWyBhPbkLA==
    state type          BIG-IP
    state image         BIGIP-15.1.6-0.0.3.ALL-F5OS.qcow2.zip.bundle
    state mgmt-ip       192.0.2.59
    state prefix-length 24
    state gateway       192.0.2.254
    state cryptos       enabled
    state vcpu-cores-per-node 2
    state memory       7680
    state storage size 77
    state running-state deployed
    state mac-data base-mac 00:12:a1:8e:70:0a
    state mac-data mac-pool-size 1
    state appliance-mode disabled
    state status        Starting
                   INSTANCE                                                 CREATION  READY          MGMT
   NODE  POD NAME  ID        PHASE                                          TIME      TIME   STATUS  MAC
   --------------------------------------------------------------------------------------------------------
   1     big-ip-1  1         Allocating resources to tenant is in progress                           - 

3. Show the running configuration of the tenants.

   show running-config tenants tenant

   A summary similar to this example displays:

   Copy

   appliance-1# show running-config tenants tenant
   tenants tenant big-ip
    config name         big-ip
    config type         BIG-IP
    config image        BIGIP-15.1.6-0.0.3.ALL-F5OS.qcow2.zip.bundle
    config nodes        [ 1 ]
    config mgmt-ip      192.0.2.59
    config prefix-length 24
    config gateway      192.0.2.254
    config cryptos      enabled
    config vcpu-cores-per-node 2
    config memory       7680
    config storage size 77
    config running-state deployed
    config appliance-mode disabled
   !

Modify tenant configuration from the CLI

You can modify a tenant configuration from the CLI.

The administrator is able to modify only these fields while the tenant is running:

• Running-state
• VLANS
• Nodes

1. Log in to the command line interface (CLI) of the system using an account with admin access.

   When you log in to the system, you are in user (operational) mode.

2. Show configuration information for the tenant you want to update.

   show tenants tenant <*name*>

3. Change to config mode.

   config

   The CLI prompt changes to include (config).

4. You can modify these options while the tenant is running: vlans, nodes, running-state, or virtual-wires.

   tenants tenant <*name*> config [ vlans <*vlan-id*> | nodes { 1 | 2 } | running-state { configured | provisioned | deployed } ]

5. To modify any of the other options, first change the running state of the tenant to provisioned.

   tenants tenant <*name*> config running-state provisioned

   Make the desired changes. For more information, see the Tenant CLI command syntax section.

6. Commit the configuration changes.

   commit

Resize tenant virtual disk from the CLI

You can resize the storage quota for a tenant virtual disk from the CLI.

1. Log in to the command line interface (CLI) of the system using an account with admin access.

   When you log in to the system, you are in user (operational) mode.

2. Display configuration information for the tenant you want to update.

   show tenants tenant <*name*>

3. Change to config mode.

   config

   The CLI prompt changes to include (config).

4. Change the storage quota, in GB, for the virtual disk for a specified tenant.

   The default size is 77 GB.

   tenants tenant big-ip config storage size 80

   Note: You cannot modify the size of the virtual disk when the tenant is in the deployed running-state. The tenant must be in a configured or provisioned running-state.

5. Commit the configuration changes.

   commit

Delete a tenant from the CLI

You can delete tenant configurations from the CLI.

1. Log in to the command line interface (CLI) of the system using an account with admin access.

   When you log in to the system, you are in user (operational) mode.

2. Show the tenants that are currently configured in the system to check the names of the tenants.

   show tenants

3. Change to config mode.

   config

   The CLI prompt changes to include (config).

4. Remove a tenant configuration.

   no tenants tenant <*tenant-name*>

5. Commit the configuration changes.

   commit

The tenant deployment is removed from the system.

Tenant CLI command syntax

Use the tenants command from the CLI to configure a cluster of virtual machines (VMs) that run on one or more nodes within the system

The tenant command includes this syntax and these options:

tenants tenant <*options*>

Tenant high availability (HA) overview

You can configure tenants for high-availability (HA) on an rSeries system similar to how it is done on a BIG-IP system or for vCMP guests. To implement high-availability, you set up device service clustering or DSC. DSC provides synchronization and failover of BIG-IP configuration data and traffic groups on two or more tenants. The tenant administrator sets up DSC on the tenants.

If you plan to set up mirroring, you must use an additional system. Connection mirroring requires that both rSeries systems have identical hardware platforms.

Important: Tenants must have identical resources to ensure seamless HA failover. F5 does not support HA between tenants on disparate platforms.

For more information, see these guides at K000130285: F5 Product Manuals Index:

• vCMP for VIPRION Systems: Administration
• BIG-IP Device Service Clustering: Administration

Configure high availability (HA) for BIG-IP tenants

Before you begin, you must set up two rSeries systems with initial configuration, management IP addresses, gateways, DNS servers, and licensing. For more information, see F5 rSeries Systems: Software Installation and Upgrade and other sections in this guide.

Note:

The F5 r2000/r4000 systems require that MAC masquerade (MM) is configured for high availability (HA). MAC masquerade can only be configured on trusted tenants. Ensure that you have enabled trust-mode for any tenant on which you plan to configure HA (see Create and deploy tenants from the CLI.

You can set up high availability for two BIG-IP tenants that reside on two separate systems.

1. Log in to the system and deploy a BIG-IP tenant.

   Note: Make sure that both tenants are running the same BIG-IP software version and that it is compatible with rSeries systems.

2. On the tenants, set up L2 network connectivity between the two tenants including setting up VLANs and self-IPs for ConfigSync, failover, and mirroring.

   For example, create the same VLAN on both tenants with management IP addresses that can communicate with each other.

3. Log in to each tenant and set the failover ConfigSync address to the self IP addresses on both sides.

4. Establish device trust: On one of the tenants, go to Device Management > Device Trust, create a device trust, and add the management IP of the other tenant.

5. Create a Sync-Failover device group: On the tenants, go to Device Management > Device Group and create a device group with the Group Type option set to Sync-Failover.

   For more information, see the “Working with Device Groups” section in BIG-IP Device Service Clustering: Administration at K000130285: F5 Product Manuals Index).

6. On the tenants, go to Device Management > Devices, select the device and initiate the first ConfigSync manually.

7. For tenants on the F5 r2000/r4000 platforms, configure MAC masquerade.

   For more information, see the “Managing Failover” section in BIG-IP Device Service Clustering: Administration at K000130285: F5 Product Manuals Index).

   For information about configuring MAC masquerade, see K13502: Configuring MAC masquerade (11.x - 17.x).

After setting up HA for tenants, you can optionally create traffic groups, enable mirroring on the virtual servers, and sync the configurations.

Understand that there are many ways to configure HA, and this summary explains the general work flow for how to approach tenant HA. Your environment might require additional steps.