Minimum system requirements and supported browsers

The minimum system requirements for this release are:

• Intel® Pentium® III 550MHz processor
• 512MB disk drive or CompactFlash® card
• 256MB RAM

The supported browsers for the Configuration utility are:

• Microsoft® Internet Explorer 5.0, 5.5, and 6.0
• Netscape® Navigator 4.7x

Installing the software

Important:  If you are upgrading a Link Controller redundant system, you must upgrade both units. We do not support running different versions on a Link Controller redundant system. Additionally, If you are updating the Link Controller module on a BIG-IP system, refer to the BIG-IP version 4.6.3 note for instructions on installing the upgrade.

Important:  If you are upgrading an IP Application Switch or a Link Controller unit that uses a CompactFlash® media drive, use the installation instructions here.

Note:  If you have installed prior releases, this installation does not overwrite any configuration changes that you made for prior releases.

The following instructions explain how to install the BIG-IP Link Controller software version 4.6.3 onto existing systems running version 4.5 and later. The installation script saves your current configuration.

1. Go to the Downloads site and locate the BIG-IP 4.6.3 upgrade file, BIGIP_4.6.3_Upgrade.im.
   
   
2. Download the software image and the BIGIP_4.6.4_Upgrade.md5 file.

   For information about how to download software, refer to SOL167: Downloading software from F5 Networks.

3. If you downloaded the image file to a directory other than /var/tmp, copy the image file to the /var/tmp/ directory on your BIG-IP system.
   
   
4. Check the md5 of the upgrade file by typing the following command:
   
   md5 BIGIP_4.6.3_Upgrade.im
   cat BIGIP_4.6.3_Upgrade.md5

   The two md5 values should be identical.

5. Install the IM by typing the following command:
   
   im BIGIP_4.6.3_Upgrade.im

   The Link Controller automatically reboots once it completes installation.

To upgrade an IP Application Switch or a CompactFlash media drive, use the following process.

1. Create a memory file system, by typing the following:
   
   mount_mfs -s 200000 /mnt
   
   
2. Go to the Downloads site and locate the BIG-IP 4.6.3 upgrade file, BIGIP_4.6.3_Upgrade.im.
   
   
3. Download the software image and the BIGIP_4.6.3_Upgrade.md5 file.

   For information about how to download software, refer to SOL167: Downloading software from F5 Networks.

4. If you downloaded the image file to a directory other than /mnt, copy the image file to the /mnt directory on your BIG-IP system.
   
   
5. Change your directory to /mnt by typing the following command:
   
   cd /mnt
   
   
6. Check the md5 of the upgrade file by typing the following command:
   
   md5 BIGIP_4.6.3_Upgrade.im
   cat BIGIP_4.6.3_Upgrade.md5

   The two md5 values should be identical.

7. On the BIG-IP unit, run the im upgrade script:
   
   im /mnt/BIGIP_4.6.3_Upgrade.im

   The Link Controller automatically reboots once it completes installation.

Note:  This procedure provides over 90MB of temporary space on /mnt.  The partition and the im package file are deleted upon rebooting.

Activating the license

Once you install the upgrade and connect the unit to the network, you need a valid license certificate to activate the software. To gain a license certificate, you need to provide two items to the license server: a registration key and a dossier.

The registration key  is a 25-character string. You should have received the key by email. The registration key lets the license server know which F5 products you are entitled to license.

The dossier  is obtained from the software, and is an encrypted list of key characteristics used to identify the platform.

You can obtain a license certificate using one of the following methods:

• Automatic license activation
  
  You perform automatic license activation from the command line or from the web-based Configuration utility of an upgraded unit. This method automatically retrieves and submits the dossier to the F5 license server, as well as installs the signed license certificate. In order for you to use this method, the unit must be installed on a network with Internet access.
  
  
• Manual license activation
  
  You perform manual license activation from the Configuration utility, which is the software user interface. With this method, you submit the dossier to, and retrieve the signed license file from, the F5 license server manually. In order for you to use this method, the administrative workstation must have Internet access.

Note:  You can open the Configuration utility with Netscape Navigator version 4.7x, or Microsoft Internet Explorer version 5.0, 5.5, or 6.0.

To automatically activate a license from the command line for first time installation

1. Type the user name root and the password default at the logon prompt.
   
   
2. At the prompt, type license. The following prompts display:
   
   IP:
   Netmask:
   Default Route:
   Select interface to use to retrieve license:
   
   The unit uses this information to make an Internet connection to the license server.
   
   
3. After you type the Internet connection information, continue to the following prompt:
   
   The Registration Key should have been included with the software or given when the order was placed. Do you have your Registration Key? [Y/N]:
   
   Type Y, and the following prompt displays:
   
   Registration Key:
   
   
4. Type the 25-character registration key you received. If you received more than one key, enter all of the keys, separating each with a space.
   
   The dossier is retrieved and sent to the F5 license server, and a signed license file is returned and installed. A message displays indicating the process was successful.
   
   
5. You are asked to accept the End User License Agreement.
   
   The system is not fully functional until you accept this agreement.
   
   
6. You are prompted to reboot the system. Press Enter to reboot.
   
   The system is not fully functional until you reboot.
   

To automatically activate a license from the command line for upgrades

1. Type your user name and password at the logon prompt.
   
   
2. At the prompt, type setup.
   
   
3. Choose menu option L.
   
   
4. The following prompt displays:
   
   Number of keys: 1
   
   If you have more than one registration key, enter the appropriate number.
   
   
5. The following prompt displays:
   
   Registration Key:
   
   Type the 25-character registration key you received. If you received more than one key, enter all of the keys, separating each with a space.
   
   The dossier is retrieved and sent to the F5 license server, and a signed license file is returned and installed. A message displays indicating the process was successful.
   
   
6. When you are finished with the licensing process, type the following command to restart the services on the system:
   
   bigstart restart
   
   

To manually activate a license using the Configuration utility

1. Open the Configuration utility according to the type of BIG-IP unit you are licensing:
   
   
   • If you are licensing a previously configured BIG-IP unit, open the Configuration utility using the configured address.
     
     
   • If you are licensing a new BIG-IP unit, from the administrative workstation, open the Configuration utility using one of the following addresses: https://192.168.1.245 or https://192.168.245.245. These are default addresses on the units local area network.
     
2. Type the user name and password, based on the type of BIG-IP unit you are licensing:
   
   
   • If you are licensing a previously configured BIG-IP unit, type your user name and password at the logon prompt.
     
     
   • If you are licensing a new BIG-IP system, type the user name root, and the password default at the logon prompt.
     
   The Configuration utility menu displays.
   
   
3. Click License Utility to open the License Administration screen.
   
   
4. In the Registration Key box, type the 25-character registration key that you received. If you have more than one key to install, click Enter More Keys to install multiple keys. Once you have entered all registration keys, click Manual Authorization.
   
   
5. At the Manual Authorization screen, retrieve the dossier using one of the following methods:
   
   
   • Copy the entire contents of the Product Dossier box.
     
     
   • Click Download Product Dossier, and save the dossier to the hard drive.
     
6. Click the link in the License Server box.
   
   The Activate F5 License screen opens in a new browser window.
   
   
7. From the Activate F5 License screen, submit the dossier using one of the following methods:
   
   
   • Paste the data you just copied into the Enter your dossier box, and click Activate.
     
     
   • At the Product Dossier box, click Browse to locate the dossier on the hard drive, and then click Activate.
     
   The screen returns a signed license file.
   
   
8. Retrieve the license file using one of the following methods:
   
   
   • Copy the entire contents of the signed license file.
     
     
   • Click Download license, and save the license file to the hard drive.
     
9. Return to the Manual Authorization screen, and click Continue.
   
   
10. At the Install License screen, submit the license file using one of the following methods:
    
    
    • Paste the data you copied into the License Server Output box, and click Install License.
      
      
    • At the License File box, click Browse to locate the license file on the hard drive, and then click Install License.
      
    The License Status screen displays status messages, and Process complete appears when the licensing activation is finished.
    
    
11. Click License Terms, review the EULA, and accept it.
    
    
12. At the Reboot Prompt screen, select when you want to reboot the platform.
    
    License activation is complete only after rebooting.
    
    

To automatically activate a license using the Configuration utility

1. Open the Configuration utility according to the type of BIG-IP unit you are licensing:
   
   
   • If you are licensing a previously configured BIG-IP unit, open the Configuration utility using the configured address.
     
     
   • If you are licensing a new BIG-IP unit, from the administrative workstation, open the Configuration utility using one of the following addresses: https://192.168.1.245 or https://192.168.245.245. These are default addresses on the units local area network.
     
2. Type the name and password, based on what type of BIG-IP unit you are licensing:
   
   
   • If you are licensing a previously configured BIG-IP unit, type your user name and password at the logon prompt.
     
     
   • If you are licensing a new BIG-IP unit, type the user name root, and the password default at the logon prompt.
     
   The Configuration utility menu displays.
   
   
3. Click License Utility to open the License Administration screen.
   
   
4. In the Registration Key box, type the 25-character registration key that you received. If you have more than one key to install, click Enter More Keys to install multiple keys. Once you have entered all registration keys, click Automated Authorization.
   
   The License Status screen displays status messages, and Process complete appears when the licensing activation is finished.
   
   
5. Click License Terms, review the EULA, and accept it.
   
   
6. At the Reboot Prompt screen, select when you want to reboot the platform.
   
   License activation is complete only after rebooting.
   
   

Changes to existing features

This release includes the following changes in product behavior.

New features in this release

This release includes the following new features.

Connection Rate Limit settings  (CR24840)
This release of the BIG-IP system includes new Connection Rate and Rate Limit settings with which you can measure the number of connections per second. You can then use this statistic to limit the number of connections to a node address. This feature is useful if there are times when you expect to have insufficient resources to service all requests, but you also want to ensure that all available servers are performing at maximum capacity. For example, if you have a data center that has enough capacity to handle the load when all the servers are functional, but you need to bring down half of the servers at a certain time in order to update the content. In this instance, the load may exceed the capacity of the remaining servers and cause the servers to become overloaded and unable to function at their maximum sustainable capacity. To avoid this situation, you can configure the BIG-IP system node connection rate limits to the maximum sustainable rate for each server. This prevents the servers from becoming over-burdened, and thus fewer requests are discarded.

In addition, if you are using the 3-DNS Controller to load balance traffic between data centers, you can use the virtual server rate limit in conjunction with global Available Connection Rate or Quality of Service load balancing to shift the load from the degraded data center to a data center with sufficient capacity.

For more information on configuring the Connection Rate and Rate Limit settings, see SOL4183: Can BIG-IP limit connections to a node based on the rate of requests rather than the number of concurrent requests?

Configuration load time settings  (CR43629)
In this release you can configure the amount of time that the BIG-IP system waits for the configuration to load before it the system begins load balancing traffic. The default setting is 15 seconds, and this should be adequate for most configurations. However, in instances where the configuration takes longer than 15 seconds to load, the BIG-IP system may begin load balancing based on a partially-loaded configuration. This situation can occur if you have an older platform and are loading a very large configuration. If you experience this issue, we recommend that you increase the default timeout for configuration load time. For more information, see SOL4322: How do I configure the configuration load timeout?

New fixes in this release

In the 4.6.3 release, on a trial basis, we have modified the format for displaying CRs for fixes and known issues. The CRs are now listed in a table format, with the corresponding solution listed next to the CR. Clicking the solution link directs you to the more detailed solution document that is posted on the AskF5 Technical Support Web Site. We continually update these solution documents on AskF5 as new details become available. If additional known issues are discovered after we release version 4.6.3, we will update the known issues table with the new CR and solution numbers, with the goal of keeping you current on our known issues.

If you encounter a solution that does not have an active link, it is likely that we have not yet had a chance to get the solution posted on AskF5, but please continue to check this table for new content or links.

This release includes the following new fixes.

Features and fixes released in prior releases

The current release includes the features and fixes that were distributed in prior feature releases, as listed below.

Version 4.6.2

System statistics screen  (CR28085)
This release includes a System Graph Statistics screen in the Configuration utility that displays statistics about the BIG-IP system in a graphical format so that you can view changes and trends in statistics over time. The System Graph Statistics screen displays statistics including CPU usage, memory usage, throughput, connections per second, and packets per second.

To view the System Graph Statistics screen, in the left pane of the Configuration utility, click Statistics and then click System Graphs.

ARP requests with incorrect source protocol IP address  (CR34526)
The BIG-IP system no longer uses inactive floating self-IP addresses or virtual server addresses in the source protocol address field for ARP requests. If the system cannot generate an ARP request because there is no usable IP address available on a VLAN, the BIG-IP system logs the following warning message to /var/log/messages:

kernel: arpresolve: no usable src addr on iface: <interface_index>

The system may log this message during a config sync from active to standby or during a configuration load on the standby unit. The system may also log this message on BIG-IP systems that have a VLAN configured with only floating self-IP addresses; this type of configuration is not supported.

Support for BIND 9.2.2 
This version of the BIG-IP software includes the BIND DNS server version 9.2.2. This version of the BIND software contains security enhancements as well as DNS protocol enhancements. For added security, the named utility now runs in a chroot environment. This version of the Link Controller software does not support A6 or ipv6 (AAAA) records.

Important:  If you are currently using BIND version 8, be aware that the file system layout has changed and there are new executables and scripts in version 9.2.2. If you have named.conf or zone-files stored in non-standard locations, you need to move these files before you upgrade to this version of the software. For more information see, BIND 9 file system migration in the Required configuration changes section of this release note.

RSA SecurID authentication 
This version of the BIG-IP software includes support for RSA SecurID® authentication, the remote authentication protocol used by RSA ACE/Server® software. RSA SecurID authentication is a two-part authentication mechanism that requires both a user ID and a passcode that changes every 60 seconds. For more information on RSA SecurID authentication, please see http://www.rsasecurity.com/node.asp?id=1156. To configure RSA SecurID authentication, see Configuring RSA SecurID authentication in the Optional configuration changes section of this release note.

Version rollback script 
This release includes a rollback script that allows you to return to the previous version of the BIG-IP software, after you upgrade. This script is designed to allow you to rollback the software version in instances where you upgrade before you discover that the new version of the software is incompatible with your specific network configuration. You can use the script to return only within the major version (see SOL4476: BIG-IP Software Lifecycle Policy) of the BIG-IP software that was installed on the system prior to the upgrade. Any configuration changes you make after the upgrade are lost when you run the rollback script.

To use the rollback feature you must create a rollback IM package before you upgrade to a different version of the software.

To create a rollback IM package in /var/tmp/rb using the version 4.6.3 mkrb file, use the following procedure:

1. Change your directory to /var/tmp by typing the following command:
   
   cd /var/tmp
   
   
2. Extract the mkrb file from the 4.6.3 upgrade package by typing the following command:
   
   -tar -xzf BIGIP_4.6.3_Upgrade.im usr/local/bin/mkrb
   
   
3. Create the necessary rollback files by typing the following command:
   
   ./usr/local/bin/mkrb BIGIP_4.6.3_Upgrade.im
   
   

This creates an IM package that you can run on the BIG-IP system if you want to return to the previous version of the software. The IM upgrade package you create is located in the /var/tmp/rb directory.

To install the rollback IM package, type the following commands:

cd /var/tmp/rb
im <rollback_im_package_name>.im

Note:  If you install the rollback package created by the script and decide that you want to upgrade to a later version of the software in the future, you will need to use the im -force /var/tmp/rb/<rollback_im_package_name>.im command to install the IM package.

named watchdog 
A new variable is included in this release that initiates a failover and restarts the named utility if the named utility fails for any reason. You can enable this variable using the command line utility. Use the following command to enable this feature:

bigpipe db set "Common.Bigip.Failover.OnNamedFail" = true

After you enable or disable this variable, we recommend that you start, stop, and restart the named utility using the following commands:

bigstart startup named
bigstart shutdown named
bigstart restart named

Support for TFTP 
This version of the BIG-IP software includes support for TFTP (Trivial File Transport Protocol rev 2 - rfc1350) traffic control. TFTP configuration objects must use TFTP port 69.

System health monitor timing 
The algorithm used by the BIG-IP system to perform health monitoring at offset intervals in order to prevent spikes in CPU consumption is improved in this release.

SNMP link up/down traps 
New SNMP traps are included in this release. Traps are now issued each time a link goes up or down. The new traps are loadBalTrapLinkUp and loadBalTrapLinkDown.

Version 4.6.1

The OpenSSL package has been upgraded to version 0.9.7d (CR33306) (CR33755)
The OpenSSL package has been upgraded to version 0.9.7d. This upgrade addresses several recent security issues with OpenSSL described in Technical Cyber Security Alert TA04-078A. This version addresses CERT vulnerabilities VU#288574 and VU#484726. For more information on the resolved security issues, see http://www.us-cert.gov/cas/techalerts/TA04-078A.html.

Version 4.6

Passing ICMP packets through a SNAT  (CR25315)
This release includes improvements in the way the BIG-IP system handles ICMP echo replies through a SNAT.

When two clients each send an ICMP echo through a SNAT on the BIG-IP system, the system now routes the ICMP echo replies and the ICMP time exceeded message back to the correct client.

In addition, when the BIG-IP system is configured to perform ICMP monitoring, and a client sends an ICMP echo through SNAT automap on the BIG-IP system, the system now correctly routes replies to either the BIG-IP system or the client, as appropriate.

Known issues

The following items are known issues in the current release.

Copyright © 2002-2005, F5 Networks, Inc., Seattle, Washington. All rights reserved.
F5, F5 Networks, the F5 logo, BIG-IP, 3-DNS, iControl, GLOBAL-SITE, SEE-IT, EDGE-FX, FireGuard, Internet Control Architecture, IP Application Switch, iRules, OneConnect, Packet Velocity, SYN Check, Control Your World, ZoneRunner, uRoam, FirePass, and TrafficShield are registered trademarks or trademarks of F5 Networks, Inc., in the U.S. and certain other countries. All other trademarks mentioned in this document are the property of their respective owners. F5 Networks' trademarks may not be used in connection with any product or service except as permitted in writing by F5.

This product protected by U.S. Patents 6,374,300; 6,473,802. Other patents pending.