Forum Discussion
Sarah_258804
Cirrus
May 09, 2016Can I change the default ephemeral ports that the F5 uses for health monitoring?
Currently I see that my F5 is reaching out to the servers in my server pools on low ephemeral ports for health monitoring. For example, I have a health monitor for DNS so that the F5 reaches out to t...
ekaleido_26616
Cirrocumulus
May 11, 2016Same as you would on a linux host:
echo "49152 65535" > /proc/sys/net/ipv4/ip_local_port_range- Sarah_258804May 11, 2016
Cirrus
I ran that command on each F5 but am still seeing it try to communicate on 43900 and lower. Do I need to perform a system reboot for the changes to take effect, or something of that nature? - ekaleido_26616May 11, 2016
Cirrocumulus
That will apply after a reboot. Try, sysctl -w net.ipv4.ip_local_port_range = 49152 65535 - Sarah_258804May 11, 2016
Cirrus
Received this error: error: "net.ipv4.ip_local_port_range" must be of the form name=value error: Malformed setting "=" error: "49152" must be of the form name=value error: "65535" must be of the form name=value - ekaleido_26616May 11, 2016
Cirrocumulus
Sorry, been awhile... sysctl -w net.ipv4.ip_local_port_range="49152 65535" - Sarah_258804May 11, 2016
Cirrus
That command took. And this will ensure that the F5 will start using only these ephemeral ports without the need of a reboot, correct? - ekaleido_26616May 11, 2016
Cirrocumulus
It should. And since you did the echo above, anytime it does reboot it will come back with the ephermeral range configured. - Sarah_258804May 11, 2016
Cirrus
Hm, so I have found that after a reboot the port range went back to using 32768 - 61000. Furthermore, I'm seeing that the F5 monitors are reaching out on ports even lower than that (5612). [ Wed May 11 16:44:37 2016 830113 usecs]: Src IP: 10.251.12.3, Dst IP: 10.251.113.11, Src Port: 5929, Dst Port: 80, Src Intf: port-channel11 , Protocol: 6 The source IP from the F5 is it's own self-IP on a port-channel interface. I'm not sure if that matters, but could there be another location where it's pulling its own source port range?
Help guide the future of your DevCentral Community!
What tools do you use to collaborate? (1min - anonymous)Recent Discussions
Related Content
DevCentral Quicklinks
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com
Discover DevCentral Connects