Description

BIG-IP VIPRION blades may be marked down when using Packet Filters.

This issue occurs when all of the following conditions are met:

• You have a VIPRION BIG-IP system.
• You have enabled Packet Filters with the Unhandled packet Action option set to Reject or Discard.

This issue occurs because the packet filter filters internal MPI communication between blades.

Impact

BIG-IP VIPRION blades are marked down and fail over to other hosts in the device group.

Symptoms

As a result of this issue, you may encounter the following symptoms:

• You may see error messages that appear similar to the following example in the /var/log/ltm file:

   err tmm[<pid>]: 01340003:3: Cluster error: Local MPI connections failed, bringing down my blade, and an automatic MPI recovery is underway.

• Blades are marked down in the BIG-IP Configuration utility.

Status

F5 Product Development has assigned ID 390540 to this issue, and has confirmed that this issue exists in the products listed in the Applies To box. For information about releases or hotfixes that resolve this issue, refer to the following table:

Workaround

To work around this issue, add a packet filter rule to allow MPI traffic between blades. To do so, perform the following procedure:

Impact of workaround: None

1. From the BIG-IP Configuration utility, navigate to Network  > Packet Filters  > Rules.
2. Click Create.
3. In the Name box, type the following:

   MPINet_Allow

4. In the Order box, select First.
5. In the Action box, select Accept.
6. In the Rate Class box, select None.
7. In the VLAN / Tunnel box, select *ALL.
8. In the Logging box, select Disabled.
9. Under Filter Expression Method, select Enter Expression Text.
10. In the Filter Expression box, type the following:

    ( src net 127.0.0.0/8 ) and ( dst net 127.0.0.0/8 )

11. Click Finished.

Supplemental Information

• SOL4918: Overview of the F5 critical issue hotfix policy