F5 Logo MyF5
Search
  1. MyF5 Home
  2. Knowledge Centers
  3. BIG-IP LTM
  4. BIG-IP TMOS: Implementations
  5. Creating an Active-Active Configuration Using the Setup Utility
Manual Chapter : Creating an Active-Active Configuration Using the Setup Utility

Applies To:

Show Versions Show Versions

BIG-IP AAM

  • 11.6.5, 11.6.4, 11.6.3, 11.6.2, 11.6.1

BIG-IP APM

  • 11.6.5, 11.6.4, 11.6.3, 11.6.2, 11.6.1

BIG-IP GTM

  • 11.6.5, 11.6.4, 11.6.3, 11.6.2, 11.6.1

BIG-IP Analytics

  • 11.6.5, 11.6.4, 11.6.3, 11.6.2, 11.6.1

BIG-IP Link Controller

  • 11.6.5, 11.6.4, 11.6.3, 11.6.2, 11.6.1

BIG-IP LTM

  • 11.6.5, 11.6.4, 11.6.3, 11.6.2, 11.6.1

BIG-IP PEM

  • 11.6.5, 11.6.4, 11.6.3, 11.6.2, 11.6.1

BIG-IP AFM

  • 11.6.5, 11.6.4, 11.6.3, 11.6.2, 11.6.1

BIG-IP ASM

  • 11.6.5, 11.6.4, 11.6.3, 11.6.2, 11.6.1
Manual Chapter
Table of Contents | << Previous Chapter | Next Chapter >>

Creating an Active-Active Configuration Using the Setup Utility

 

Overview: Creating a basic active-active configuration

This implementation describes how to use the Setup utility to configure two new BIG-IP® devices that function as an active-active pair. An active-active pair is a pair of BIG-IP devices configured so that both devices are actively processing traffic and are ready to take over one another if failover occurs. The two devices synchronize their configuration data to one another.

Note: Access Policy Manager (APM) is not supported in an Active-Active configuration. APM is supported in an Active-Standby configuration with two BIG-IP systems only.
Note: Policy Enforcement Manager (PEM) is not supported in an Active-Active configuration. PEM is supported in an Active-Standby configuration with two BIG-IP systems only.
Important: The same version of BIG-IP system software must be running on all devices in the device group.

Using this implementation, you begin by running the Setup utility on each device to configure its base network components. Base network components include a management port, administrative passwords, and default VLANs and their associated self IP addresses. You also use Setup to configure configuration synchronization and high availability.

You then use the BIG-IP® Configuration utility to:

  • Establish trust between the two devices
  • Create a Sync-Failover type of device group that contains two member devices
  • Create a second traffic group
  • Create two iApp™ application services

In this configuration, both devices actively process application traffic, each for a different application. One device processes its application traffic using the configuration objects associated with the default floating traffic group, traffic-group-1. By default, this traffic group contains the floating self IP addresses of the default VLANs. The other device processes its application traffic using a second traffic group that you create.

If one of the devices becomes unavailable for any reason, the other device automatically begins processing traffic for the unavailable peer, while continuing to process the traffic for its own application.

This illustration shows an example of the device group that this implementation creates, named Device Group A. This device group contains two BIG-IP devices, Device 1 and Device 2.

The configuration shows two traffic groups, traffic-group-1 and traffic-group-2, each containing failover objects. For traffic-group-1, Device 1 is the default device. For traffic-group-2, Device 2 is the default device. If Device 1 becomes unavailable, traffic-group-1 floats to Device 2. If Device 2 becomes unavailable, traffic-group-2 floats to Device 1.

Device group with active-active configuration

Device group with active-active configuration

By implementing this configuration, you ensure that:

  • Each device has base network components configured.
  • Any objects on a BIG-IP device that you configure for synchronization remain synchronized between the two devices.
  • Failover capability and connection mirroring are enabled on each device.
Important: For active-active configurations, you must enable network failover instead of hard-wired serial failover.

Task summary

The BIG-IP® configuration process begins with running the Setup utility on each of the two BIG-IP devices. Once you have completed that task, you can log into either of the BIG-IP devices and perform all of the remaining tasks, on that device only. This results in both BIG-IP devices being configured properly for an active-active implementation.

Important: After using the Setup utility to create a redundant system configuration, you can re-enter the utility at any time to adjust the configuration. Simply click the F5 logo in the upper-left corner of the BIG-IP Configuration utility, and on the Welcome screen, click Run the Setup Utility. Then page through the utility to find the appropriate screens.

Licensing and provisioning the BIG-IP system

Using the Setup utility, you can activate the license and provision the BIG-IP® system.
  1. From a workstation attached to the network on which you configured the management interface, type the following URL syntax where <management_IP_address> is the address you configured for device management:
    https://<management_IP_address>
  2. At the login prompt, type the default user name admin, and password admin, and click Log in.
    The Setup utility screen opens.
  3. Click Next.
  4. Click Activate.
    The License screen opens.
  5. In the Base Registration Key field, paste the registration key.
  6. Click Next and follow the process for licensing and provisioning the system.
    Note: When you perform the licensing task so that you can run the F5 cloud ADC, you can accept the default provisioning values.
  7. Click Next.
    This displays the screen for configuring general properties and user administration settings.
The BIG-IP system license is now activated, and the relevant BIG-IP modules are provisioned.

Configuring a device certificate

Import or verify the certificate for the BIG-IP device.
Do one of the following:
  • Click Import, import a certificate, click Import, and then click Next.
  • Verify the displayed information for the certificate and click Next.

Configuring the management port and administrative user accounts

Configure the management port, time zone, and the administrative user names and passwords.
  1. On the screen for configuring general properties, for the Management Port Configuration setting, select Manual and specify the IP address, network mask, and default gateway.
  2. In the Host Name field, type a fully-qualified domain name (FQDN) for the system.
    The FQDN can consist of letters, numbers, and/or the characters underscore ( _ ), dash ( - ), or period ( . ).
  3. For the Host IP Address setting, retain the default value Use Management Port IP Address.
  4. From the Time Zone list, select a time zone.
    The time zone you select typically reflects the location of the F5® system.
  5. For the Root Account setting, type and confirm a password for the root account.
    The root account provides console access only.
  6. For the Admin Account setting, type and confirm a password.
    Typing a password for the admin account causes the system to terminate the login session. When this happens, log in to the F5 Configuration utility again, using the new password. The system returns to the appropriate screen in the Setup utility.
  7. For the SSH Access setting, select or clear the check box.
  8. Click Next.
  9. In the Standard Network Configuration area of the screen, click Next.
    This displays the screen for enabling configuration synchronization and high availability.

Enabling ConfigSync and high availability

When you perform this task, you set up config sync and connection mirroring, and you can specify the failover method (network, serial, or both).
  1. For the Config Sync setting, select the Display configuration synchronization options check box.
    This causes an additional ConfigSync screen to be displayed later.
  2. For the High Availability setting, select the Display failover and mirroring options check box.
    This displays the Failover Method list and causes additional failover screens to be displayed later.
  3. From the Failover Method list, select Network and serial cable.
    If you have a VIPRION® system, select Network.
  4. Click Next.
    This displays the screen for configuring the default VLAN internal.

Configuring the internal network

Specify self IP addresses and settings for VLAN internal, which is the default VLAN for the internal network.
  1. Specify the Self IP setting for the internal network:
    1. In the Address field, type a self IP address.
    2. In the Netmask field, type a network mask for the self IP address.
    3. For the Port Lockdown setting, retain the default value.
  2. Specify the Floating IP setting:
    1. In the Address field, type a floating IP address.
      This address should be distinct from the address you type for the Self IP setting.
      Important: If the BIG-IP device you are configuring is accessed using Amazon Web Services and the device needs to failover to a device group peer, use the second, Secondary Private IP address for the floating IP address.
    2. For the Port Lockdown setting, retain the default value.
  3. For the VLAN Tag ID setting, retain the default value, auto.
    This is the recommended value.
  4. For the VLAN Interfaces setting, click the interface 1.2 and, using the Move button, move the interface number from the Available list to the Untagged list.
  5. Click Next.
    This completes the configuration of the internal self IP addresses and VLAN, and displays the screen for configuring the default VLAN external.

Configuring the external network

Specify self IP addresses and settings for VLAN external, which is the default VLAN for the external network.
  1. Specify the Self IP setting for the external network:
    1. In the Address field, type a self IP address.
    2. In the Netmask field, type a network mask for the self IP address.
    3. For the Port Lockdown setting, retain the default value.
  2. In the Default Gateway field, type the IP address that you want to use as the default gateway to VLAN external.
  3. Specify the Floating IP setting:
    1. In the Address field, type a floating IP address.
      This address should be distinct from the address you type for the Self IP setting.
      Important: If the BIG-IP device you are configuring is accessed using Amazon Web Services and the device needs to failover to a device group peer, use the second, Secondary Private IP address for the floating IP address.
    2. For the Port Lockdown setting, retain the default value.
  4. For the VLAN Tag ID setting, retain the default value, auto.
    This is the recommended value.
  5. For the VLAN Interfaces setting, click the interface 1.2 and, using the Move button, move the interface number from the Available list to the Untagged list.
  6. Click Next.
    This completes the configuration of the external self IP addresses and VLAN, and displays the screen for configuring the default VLAN HA.

Configuring the network for high availability

To configure a network for high availability, specify self IP addresses and settings for VLAN HA, which is the VLAN that the system will use for failover and connection mirroring.
  1. For the High Availability VLAN setting, retain the default value, Create VLAN HA.
  2. Specify the Self IP setting for VLAN HA:
    1. In the Address field, type a self IP address.
    2. In the Netmask field, type a network mask for the self IP address.
  3. For the VLAN Tag ID setting, retain the default value, auto.
    This is the recommended value.
  4. For the VLAN Interfaces setting, click an interface number, and using the Move button, move the interface number from the Available list to the Untagged list.
  5. Click Next.
    This configures the self IP address and VLAN that the system will use for high availability and displays the default IP address that the system will use for configuration synchronization.

Configuring a ConfigSync address

Use this task to specify the address that you want the system to use for configuration synchronization.
  1. From the Local Address list, select a self IP address.
    Do not select a management IP address.
  2. Click Next.
    This displays the screen for configuring unicast and multicast failover addresses.

Configuring failover and mirroring addresses

Follow these task steps to specify the unicast IP addresses of the local device that you want the system to use for failover. Typically, you specify the self IP address for the local VLAN HA, as well as the IP address for the management port of the local device. If you are configuring a VIPRION® system, configure a multicast failover address as well.
Important: When configuring failover and mirroring IP addresses, you select addresses of the local device only. Later, during the process of device discovery, the two devices in the device group discover each other's addresses.
  1. Locate the Failover Unicast Configuration area of the screen.
  2. Under Local Address, confirm that there are entries for the self IP addresses that are assigned to the HA and internal VLANs and for the local management IP address for this device. If these entries are absent, click the Add button to add the missing entries to the list of Failover Unicast Addresses.
    1. For the Address setting, select the address for the VLAN you need to add (either HA or internal).
    2. In the Port field, type a port number or retain the default port number, 1026.
    3. Click Repeat to add additional self IP addresses, or click Finished.
    4. Repeat these steps to add a management IP address.
  3. Click Next.
  4. From the Primary Local Mirror Address list, retain the default value, which is the self IP address for VLAN HA.
  5. From the Secondary Local Mirror Address list, select the address for VLAN internal.
  6. Click Finished.
    This causes you to leave the Setup utility.

Establishing device trust

Before you begin this task, verify that:

  • Each BIG-IP® device that is to be part of the local trust domain has a device certificate installed on it.
  • The local device is designated as a certificate signing authority.

You perform this task to establish trust among devices on one or more network segments. Devices that trust each other constitute the local trust domain. A device must be a member of the local trust domain prior to joining a device group.

By default, the BIG-IP software includes a local trust domain with one member, which is the local device. You can choose any one of the BIG-IP devices slated for a device group and log into that device to add other devices to the local trust domain. For example, devices Bigip_1, Bigip_2, and Bigip_3 each initially shows only itself as a member of the local trust domain. To configure the local trust domain to include all three devices, you can simply log into device Bigip_1 and add devices Bigip_2 and Bigip_3 to the local trust domain; there is no need to repeat this process on devices Bigip_2 and Bigip_3.

  1. On the Main tab, click Device Management > Device Trust , and then either Peer List or Subordinate List.
  2. Click Add.
  3. Type a device IP address, administrator user name, and administrator password for the remote BIG-IP® device with which you want to establish trust. The IP address you specify depends on the type of BIG-IP device:
    • If the BIG-IP device is an appliance, type the management IP address for the device.
    • If the BIG-IP device is a VIPRION® device that is not licensed and provisioned for vCMP®, type the primary cluster management IP address for the cluster.
    • If the BIG-IP device is a VIPRION device that is licensed and provisioned for vCMP, type the cluster management IP address for the guest.
    • If the BIG-IP device is an Amazon Web Services EC2 device, type one of the Private IP addresses created for this EC2 instance.
  4. Click Retrieve Device Information.
  5. Verify that the certificate of the remote device is correct.
  6. Verify that the management IP address and name of the remote device are correct.
  7. Click Finished.
After you perform this task, the local device is now a member of the local trust domain. Also, the BIG-IP system automatically creates a special Sync-Only device group for the purpose of synchronizing trust information among the devices in the local trust domain, on an ongoing basis.
Repeat this task to specify each device that you want to add to the local trust domain.

Creating a Sync-Failover device group

This task establishes failover capability between two BIG-IP® devices. If the active device in a Sync-Failover device group becomes unavailable, the configuration objects fail over to another member of the device group and traffic processing is unaffected. You can perform this task on any authority device within the local trust domain.
  1. On the Main tab, click Device Management > Device Groups .
  2. On the Device Groups list screen, click Create.
    The New Device Group screen opens.
  3. Type a name for the device group, select the device group type Sync-Failover, and type a description for the device group.
  4. In the Configuration area of the screen, select a host name from the Available list for each BIG-IP device that you want to include in the device group, including the local device. Use the Move button to move the host name to the Includes list.
    The Available list shows any devices that are members of the device's local trust domain but not currently members of a Sync-Failover device group. A device can be a member of one Sync-Failover group only.
  5. For the Network Failover setting, select or clear the check box:
    • Select the check box if you want device group members to handle failover communications by way of network connectivity. This choice is required for active-active configurations.
    • Clear the check box if you want device group members to handle failover communications by way of serial cable (hard-wired) connectivity.
    For active-active configurations, you must select network failover, as opposed to serial-cable (hard-wired) connectivity.
  6. Click Finished.
You now have a Sync-Failover device group containing two BIG-IP devices as members.

Creating an iApp application for the local device

Use this procedure to create a set of related configuration objects on the system (that is, an application).
  1. On the Main tab, click iApp > Application Services .
  2. Click Create.
  3. In the Name field, type the name for your application service.
  4. From the Template list, select a template.
  5. From the Template Selection list, select Advanced.
    This causes additional settings to appear.
  6. For the Configure Sync and/or Failover for this application? setting, select Yes.
  7. For the Traffic Group setting, ensure that the Inherit traffic group from current partition / path field and traffic-group-1 are selected.
  8. Configure remaining settings as needed.
  9. At the bottom of the screen click Finished to save your changes.
You now have an iApp application service, which is associated with the traffic group assigned to the root folder, traffic-group-1.

Creating a traffic group for a remote device

Prerequisite: If you intend to specify a MAC masquerade address when creating a traffic group, you must first create the address, using an industry-standard method for creating a locally-administered MAC address.
Perform this procedure to create a traffic group to run on the remote BIG-IP ®device. You create this traffic group on the local device. Later, you move the traffic group to the remote device by forcing this traffic group on the local device to a standby state.
  1. On the Main tab, click Device Management > Traffic Groups .
  2. On the lower half of the screen, verify that the list shows the default floating traffic group (traffic-group-1) for the local device.
  3. On the Traffic Group List screen, click Create.
  4. Type the name traffic-group-2 for the new traffic group.
  5. Type a description of the new traffic group.
  6. Click Next.
  7. In the MAC Masquerade Address field, type a MAC masquerade address.
    When you specify a MAC masquerade address, you reduce the risk of dropped connections when failover occurs. This setting is optional.
  8. Click Next.
  9. Select or clear the check box for the Auto Failback option:
    • Select the check box to cause the traffic group, after failover, to fail over again to the first device in the traffic group's ordered list when that device (and only that device) is available.
    • Clear the check box to cause the traffic group, after failover, to remain active on its current device until failover occurs again.
  10. Click Next.
  11. Confirm that the displayed traffic group settings are correct.
  12. Click Finished.
You now have a floating traffic group for which the default device is the peer device.

Creating an iApp application for a remote device

Use this procedure when you want to create an application to run on a remote device and associate it with the traffic group named traffic-group-2 that you previously created.
  1. On the Main tab, click iApp > Application Services .
  2. Click Create.
  3. From the Template list, select a template.
  4. From the Template Selection list, select Advanced.
    This causes additional settings to appear.
  5. In the Name field, type the name for your application service.
  6. For the Configure Sync and/or Failover for this application? setting, select Yes.
  7. For the Traffic Group setting, clear the Inherit traffic group from current partition / path field and from the list, select traffic-group-2.
  8. Configure remaining settings as needed.
  9. At the bottom of the screen click Finished to save your changes.
You now have an iApp application associated with traffic-group-2.

Forcing a traffic group to a standby state

You perform this task when you want the selected traffic group on the local device to fail over to another device (that is, switch to a Standby state). Users typically perform this task when no automated method is configured for a traffic group, such as auto-failback or an HA group. By forcing the traffic group into a Standby state, the traffic group becomes active on another device in the device group. For device groups with more than two members, you can choose the specific device to which the traffic group fails over.

  1. Log in to the device on which the traffic group is currently active.
  2. On the Main tab, click Device Management > Traffic Groups .
  3. In the Name column, locate the name of the traffic group that you want to run on the peer device.
  4. Select the check box to the left of the traffic group name.
    If the check box is unavailable, the traffic group is not active on the device to which you are currently logged in. Perform this task on the device on which the traffic group is active.
  5. Click Force to Standby.
    This displays target device options.
  6. Choose one of these actions:
    • If the device group has two members only, click Force to Standby. This displays the list of traffic groups for the device group and causes the local device to appear in the Next Active Device column.
    • If the device group has more than two members, then from the Target Device list, select a value and click Force to Standby.
The selected traffic group is now in a standby state on the local device and active on another device in the device group.

Syncing the BIG-IP configuration to the device group

Before you sync the configuration, verify that the devices targeted for config sync are members of a device group and that device trust is established.
This task synchronizes the BIG-IP® configuration data from the local device to the devices in the device group. This synchronization ensures that devices in the device group operate properly. When synchronizing self IP addresses, the BIG-IP system synchronizes floating self IP addresses only.
Important: You perform this task on either of the two devices, but not both.
  1. On the Main tab, click Device Management > Overview .
  2. In the Device Groups area of the screen, in the Name column, select the name of the relevant device group.
    The screen expands to show a summary and details of the sync status of the selected device group, as well as a list of the individual devices within the device group.
  3. In the Devices area of the screen, in the Sync Status column, select the device that shows a sync status of Changes Pending.
  4. In the Sync Options area of the screen, select Sync Device to Group.
  5. Click Sync.
    The BIG-IP system syncs the configuration data of the selected device in the Device area of the screen to the other members of the device group.
Except for non-floating self IP addresses, the entire set of BIG-IP configuration data is replicated on each device in the device group.

Implementation Results

To summarize, you now have the following BIG-IP® configuration on each device of the pair:

  • A management port, management route, and administrative passwords defined
  • A VLAN named internal, with one static and one floating IP address
  • A VLAN named external, with one static and one floating IP address
  • A VLAN named HA with a static IP address
  • Configuration synchronization, failover, and mirroring enabled
  • Failover methods of serial cable and network
  • Local IP addresses defined for failover and connection mirroring
  • A designation as an authority device, where trust is established with the peer device
  • A Sync-Failover type of device group with two members
  • The default traffic group named traffic-group-1 with Device 1 as the default device
  • An iApp application associated with traffic-group-1
  • A traffic group named traffic-group-2 with Device 2 as the default device
  • An iApp application associated with traffic-group-2
Table of Contents | << Previous Chapter | Next Chapter >>
Contact Support Contact Support

Have a Question?

Support and Sales >

About F5

Education

F5 Sites

Support Tasks




©2023 F5 Networks, Inc. All rights reserved.


Trademarks Policies Privacy California Privacy Do Not Sell My Personal Information