# F5 LTM Module 6 high availability & DSC Source: https://ai.techclick.in/blog_f5_ltm_module_6_high_availability Markdown: https://ai.techclick.in/blog_f5_ltm_module_6_high_availability.md Publisher: Techclick Infosec Pvt Ltd Build BIG-IP Active/Standby with Device Service Clustering: Device Trust, ConfigSync, traffic-group-1, network failover, and optional connection mirroring. Lessons · F5 LTM series · Module 6 F5 LTM recorded course · 7 modules Same lab numbers on every page: client 198.51.100.50 , VIP 192.0.2.100 , Self IPs 192.0.2.10 / 10.20.20.10 , members 10.20.20.101–103 . - Hub · Course map - M1 · Fundamentals & admin - M2 · Networking & traffic flow - M3 · Virtual Servers & pools - M4 · Profiles, SNAT, SSL - M5 · Monitors, iRules, policies - M6 · High availability ← you are here - M7 · Troubleshooting Next → M7 · Troubleshooting Recorded course + workbooks: My Courses · syllabus F5 LTM / GTM / ASM ## One box is a single point of failure Hardware dies, TMM dies, a trunk dies, or you need a maintenance window. Device Service Clustering (DSC) pairs two BIG-IP devices so floating objects move. HA does not fix a down pool or a bad iRule. It only removes the appliance as the unique choke point. Hero · Active and Standby The floating Self IP 192.0.2.10 and the VIP travel with traffic-group-1. They are not nailed to chassis A. Quick answer Order is a stack: Device Trust → Device Group (Sync-Failover) → ConfigSync → Traffic Group → Network Failover → optional mirroring . Active owns traffic-group-1. Standby has the config and is ready. Force Standby to test; watch gratuitous ARP. ## DSC stack Flow 1 · dependency order Flow 1 · dependency order - Trust certs/keys Group Sync-Failover Sync bigip.conf Traffic group floating IPs Failover heartbeat Skip Device Trust and ConfigSync will never be a trusted peer relationship. Piece Job Device-specific? Device Trust Authenticate the peer Each device has its own identity Device Group Who syncs / fails over with whom Shared membership ConfigSync Push LTM objects Mgmt IP, hostname, non-floating Self IPs stay local Traffic Group Bundle of floating IPs/VIPs Owner is Active Network Failover Unicast heartbeat Failover addresses are per device Connection mirroring Copy live table to standby Only if you enable it; not magic for every protocol Say this out loud Automatic Sync from a box with a bad config will copy the bad config. Sync direction is a loaded gun. Always know who has Changes Pending. Journey · Trust, Sync, Failover ConfigSync is control-plane. Failover of traffic-group-1 is data-plane ownership. They fail independently — you can be In Sync and still Active/Active by mistake. ## What should float Object Float? Why Floating Self IP Yes ARP target for the VLAN Virtual addresses / VS Yes Users keep the same VIP SNAT translation addresses used by apps Usually yes Stay in the same traffic group Management IP No Each chassis is reachable for admin Non-floating / local-only Self IP No Device-specific ## Runbook — first Active/Standby pair ### Side A · trust and group #### Identical versions and provisioned modules Mismatched provision is a classic ConfigSync fail. - #### Device Trust Device Management → Device Trust. Point A at B’s management or specified config-sync address. - #### Device Group type Sync-Failover Device Management → Device Groups → Create. Wrong type = sync without failover or vice versa. - #### Enable Network Failover Unicast heartbeat on a dedicated or at least reliable path. Do not share it casually with noisy client VLANs if you can avoid it. https://192.168.100.10/tmui/Control/jspmap/tmui/system/ha/device_group Training mock · not live Device Management > Device Groups > Create ### New Device Group Name dg_ltm_ha Group Type Sync-Failover Members f5-ltm-a , f5-ltm-b Network Failover Enabled Automatic Sync Off until both configs are known-good Cancel Finished Source: F5-BIG-IP-LTM-Module-6.pdf. Official DSC admin: techdocs Device Service Clustering. ### Side B · traffic group and floating IPs https://192.168.100.10/tmui/Control/jspmap/tmui/system/ha/traffic_group Training mock · not live Device Management > Traffic Groups ### traffic-group-1 Name traffic-group-1 Floating Self IP 192.0.2.10 on external VIP 192.0.2.100 Failover method HA-order / HA-group as designed Cancel Finished Assign the floating Self IP and virtual address to the same traffic group or they split-brain at Layer 3. ### Side C · sync, then force standby TMSH · HA from Module 6 PDF tmsh show cm failover-status tmsh show cm sync-status tmsh show cm device tmsh show cm device-group tmsh show cm traffic-group tmsh list net self floating tmsh run sys failover standby - #### ConfigSync to the group Device Management → Overview. If one device shows Changes Pending, sync from the intended source only. - #### Force BIG-IP A to Standby GUI traffic-group-1 → Force to Standby, or tmsh run sys failover standby . - #### Prove ownership traffic-group-1 owned by B. Floating IP answers from B’s MAC. GARP should appear in tcpdump. - #### Optional mirroring Enable connection mirroring only for the VS that need it. Then tmsh show ltm connection mirror on the standby. Ops · two chassis Interruption during failover is expected unless mirroring and the app protocol cooperate. Say that in the change ticket. ## Runtime after failover Flow 2 · who owns the VIP Flow 2 · who owns the VIP - Heartbeat unicast Active owns TG GARP new MAC Clients same VIP If heartbeat dies both ways you can get Active/Active — two MACs claiming 192.0.2.10. ## Traps + proof Failure Symptom Fix Auto Sync too early Bad config copied to both Manual sync; know the source of truth Trust broken Cannot sync Hostname, time, network, then re-trust Mgmt IP expected to float Cannot reach standby GUI after fail Mgmt stays local No network failover path Slow or false failover Dedicated unicast addresses Assumed zero drop TCP apps reset Mirroring + app retry; document RTO You are done with Module 6 when tmsh show cm sync-status is In Sync. - A forced standby moves 192.0.2.10 and the VIP. - You can list what does not sync. ## Knowledge check HA is a stack. Skip a layer and sync lies to you. Q1 Correct first DSC layer: Traffic group Device Trust iRule UCS Correct: b . Trust before group. Q2 Sync-Failover group type means: Sync only, never fail Failover only, never sync Both configuration sync and failover coordination Active/Active always Correct: c . Wrong type is a common setup miss. Q3 Management IP in HA: Must float Stays device-local Is the VIP Replaces Network Failover Correct: b . Each chassis remains admin-reachable. Q4 Automatic Sync danger: It encrypts cookies A bad config can overwrite the peer It disables TMM It tags VLANs Correct: b . Know Changes Pending source. Q5 tmsh run sys failover standby: Deletes the pool Forces this device Standby so the peer can go Active Saves UCS Provisions AFM Correct: b . Then check traffic-group owner. Q6 Connection mirroring: Is always on and free Is optional and protocol-dependent Replaces ConfigSync Fixes a down monitor Correct: b . HA still may drop some sessions. Check answers Reset ## Sources - Techclick PDF: F5-BIG-IP-LTM-Module-6.pdf (from OneDrive_1_8-26-2026.zip, 26 Aug 2026) - Companion deck: F5-Ltm-Training-Ppt (1).pptx.pdf - DSC administration: BIG-IP Device Service Clustering - Official lab paths: F5 cert Lab 1 — VLANs, Self IPs, pools, virtual servers - TMSH virtual server reference: ltm virtual - Related deep dives on this site: SSL modes · SNAT · Persistence · VS/pools · VIP down / tcpdump Related: Course hub · Syllabus · My Courses · F5 LTM interview --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt