-
F5 ip-forward virtual-server to a10 vs configuration
Hi guys I'm asking for your help to clarify the use of the ip-forward option on F5 devices for virtual-servers, for me looks simple, but I didn't use it before in our a10 devices This is an example of the current configuration on F5 that I need to migrate: } ltm virtual DNS_Telefonica_171 { description "Forwarding DNS…
-
DROP in A10
Hello everyone... I am participating in a Citrix ADC migration project to A10 ACOS and the client has some DROPs configured to certain virtual servers so that they reach an application from certain network segments, more like this example:…
-
[T&C] DNS over HTTPS (DoH) with certificate from Let's Encrypt
DNS over HTTPS (DoH) is a protocol for securing DNS communication by sending DNS queries and getting DNS responses over HTTPS. For details, refer to RFC 8484 (https://tools.ietf.org/html/rfc8484). This article shows you can deploy DNS over HTTPS (DoH) with automatic certificate enrollment and renewal from Let's Encrypt CA…
-
CPU AVAREGE
Hello, Can you help me to create a script with aflex to get cpu avarege and at the same time create a file?
-
Is someone having problems with Detected problem in Health Monitor DataCPU ?
Hello everyone, I need some help with this issue. It started a couple of moth ago. I was then on version 4.1.4-GR1-P5, build 81 (I've a 1030S pair, VCS + VRRP-A config). Is not only the CPU problem, also slave device was taking over the master several times by day and sessions were offloading from one ADC to another. I…
-
Ddos attack knocking down A10 by pps
Even without any client on the CGN, an attack of less than 500 Mb with millions of ppps could bring down A10. I just have a route to A10's WAN address like x.x.x.x/24 192.168.0.2 Even without any session. I tried blackhole like ip route x.x.x.x /24 lif 100 with no changes. The attack bring down A10 (All data CPUS increase…
-
Can we use curl and openssl command in A10 CLI?
In F5, we have the option to use curl and openssl command from the CLI to validate certificates as well as simulate health checks. Can we do this in A10? Thanks in Advance.
-
Certificate for admin access
Hi, I would like you to help me verify where the certificate that comes in the GUI of the appliance is installed, since I need to verify what ciphers and protocols it is using. Thanks.
-
Dual internet connections
Hello! We have 2 communication channels. We want to raise the service to switch in case of a connection break on one of the channels, as well as load balancing. The service will redirect requests to external application publications.D.b. a boxed solution, for example A1030S, I can’t figure out if it can be implemented on…
-
Backup A10
Hello everyone, I would like you to guide me on how to configure a backup of my A10 device and how to restore it in case of loss of service Thank you very much
-
Current Request Rate
Hello, What is difference between "current request" and "current request rate" in show slb virtual-server detail command?
-
I have some doubts about the A10 GSLB configuration,
Good day,dear all. We encountered some difficulties in configuring GSLB.Some configurations are as follows: gslb zone sgss.com.cn policy policy-test service 80 www policy policy-test dns-a-record www-ctc static admin-ip 100 dns-a-record www-ctcv6 static admin-ip 100 dns-a-record www-cuc static admin-ip 100 service 80 sso…
-
Error A10 on web interface code: 3d03c007
What is this error: Unknown string code: 3d03c007 It is visible when accessed through the WEB interface. What should be done to fix this error? Thanks for any advice!
-
[T&C] Load balancing Kubernetes traffic with Thunder ADC and TKC using IPIP Tunnels
In an earlier article, we saw how you can use the Thunder Kubernetes Connector (TKC) to dynamically configure the Thunder ADC for load-balancing traffic to a Kubernetes cluster. In that article, the Thunder device load-balanced traffic to the worker nodes. Starting from TKC v1.11, the TKC can dynamically configure Thunder…
-
THUNDER 14045CGN SINGLE MODULE or DUAL MODULE?
How to physically distinguish between them THUNDER 14045CGN SINGLE MODULE and 4045CGN DUAL MODULE? because they have different Throughput 150Gbps 300Gbps and that's important
-
Persistence issue with aflex
Hi, I have a very simple script handling redirection to an outage server if my primary servers aren't available (see below). I have however got an issue that when persistence is applied (source-ip or cookie persistence), users are being persisted to the outage pool even after the primary service group is back online. Is…
-
SNAT from Health Monitor
Hello First time posting here and new to A10..... hopefully I'm within guidelines :-) I'm currently trialing the 4.1.4 P10 software in our lab and can't get the real servers to come up. The reason is, the real servers are UAT servers in the prod network but the ADC is in our lab, where the IP's are not routable from prod.…
-
IPv6 Dual-stack
Hi team I'm wondering if some of you have an example for a dual-stack implementation (IPv4 and IPv6) for CGN, ADC or Both. For me this deployment seems to be simple, but the end customer wants to see a general topology/example made before with other clients, Thanks,
-
nslookup shown request timed-out
Hi Friends, I've been recently deployed GSLB setup in both DC & DR and dns delegation is working fine with the health checks. But when I try to trace the sites which I'm hosting it will show time-out waiting response. Any thoughts what cause this?
-
Troubleshooting high CPU issues
We are looking for tips on troubleshooting high CPU usage on a pair of 5440s. We reach 95% CPU (as indicated by "show cpu overall" in the shared partition). We do run quite a few AFLEX scripts, but even after simplifying them we're still running into 90%+ CPU regularly when doing around 95K requests/sec (HTTP +-55K,…
-
Multiple head in template
Hi All, its possible to use multiple header in the same template. ACOS-TH####(config)#slb template http add-HSTS ACOS-TH####(config-http)#response-header-insert "Strict-Transport-Security: max-age=31536000; includeSubDomains; preload" insert-if-not-exist
-
Problem with WinSCP Windows Client
Hi, I would like to know if this problem has happened to someone when entering the appliance with the WinSCP client, it throws the following message: Cannot initialize SFTP protocol. Is the host running an SFTP server? If someone knows how to correct the problem to access, thank you.
-
2.7.2-P17 server cert/key replace procedure
We have a problem of replacing server cert and key after upgrading ACOS version from 2.7.2-P8 to 2.7.2-P17. The symptom is as follows: key <new-key> ... (error) Key parsing failed cert <new-cert> ... (error) Key parsing failed I assume that 2.7.2-P17 verifies public/private keys and mismatch was found. But, I can't find…
-
API for 'show backup' command
I am looking for an API to find if last backup has been successful or not for A10 Load Balancer. It should be equivalent to "show backup" command.
-
[T&C] Thunder ADC with Thunder Kubernetes Connector (TKC) using CRDs
In an earlier article, we saw how you can use the Thunder Kubernetes Connector (TKC) to dynamically configure the Thunder ADC for load-balancing traffic to a Kubernetes cluster. In that article, we specified the SLB configuration using annotations in an Ingress resource. Starting from TKC v1.11, Thunder Kubernetes…
-
Why does A10 device send ARP attack?
Our switch received an ARP attack alarm from A10 device.And the SourceAttackIP 202.104.30.228 is deployed on our A10. What is the original cause of this? Aug 8 2022 19:09:34+08:00 GDSD-BDC-INT-CR01 %%01SECE/4/SPECIFY_SIP_ATTACK(l)[12]:The specified source IP address attack occurred. (Slot=MPU,…
-
Need help to config DNS static entry on GSLB.
From the ADC datasheet ACOS ADC support DNS RPZ (response policy zone). We have a10 thunder boxes acting as GSLB controller/device and would like to move few thousands static dns entries from the old dns server to A10. For now each static entry is a GSLB service-ip with health-check disable, attach to a site name PRIVATE…
-
F5 automap feature
Hi, I have one F5 with irule contain "automap snat", this functionality allows changing the IP when the destination is local to one of the F5 in order to prevent asymmetric routing. The automap options tells to BIG-IP to decide what source ip to use to reach the destination network. I rule like this when CLIENT_ACCEPTED {…
-
Changing the IP address of the management interface in the VCS.
Hello! There are 2 A1030S, VCS is enabled. You need to change the address of the management interface. How to do it correctly? Through the CLI? What is the sequence?
-
Balance HTTPS traffic(without decryption)
Hi all! The task is to balance HTTPS traffic to 2 servers (TLS1 + TLS2), without decryption. How to configure the virtual server correctly in this case? The TLS|SSL processing itself will continue on TLS1+TLS2, i.e. you only need to do balancing 1.slb virtual-server VIP_HTTPS 192.168.195.2 port 443 https source-nat pool…
