
F5 Config Sync Failed: tmsh show cm sync-status When Standby Has Yesterday's VIP
- Aug 15
- 2 min read

You added a VIP on the active. Standby does not have it. Failover would drop that app.
This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.
What you will be able to do
Name the first CLI command to run on F5 BIG-IP for this ticket
Separate the layer that is actually broken from the layer people blame
Apply one scoped fix instead of a global disable
Prove the ticket closed with a session, log, or counter
Quick answer
show cm sync-status. If Changes Pending, sync from the device that has the good config. Do not sync the wrong way.
Why this ticket shows up
Device groups do not always auto-sync. A failed sync leaves a silent failover bomb.
Symptoms operators actually see
Changes Pending
Standby missing the new VIP
Sync error about a version or a locked file
Recent failed deploy
CLI first — copy this block
Run these on the F5 BIG-IP device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.
tmsh show cm sync-status
tmsh show cm device-group
tmsh run cm config-sync to-group device-group-1
tmsh show sys software
cat /var/log/ltm | grep -i syncHow to read that output
sync-status says which device is newer. Always sync from the device you just changed, never blindly from standby.
Triage order
Read sync-status on both
Confirm the active has the new VIP
Sync to the group from that device
Verify the VIP exists on standby
Fix CMI trust if sync is refused
Classic traps
What you see | Real cause | Fix |
Sync from standby | You will wipe the new VIP | Check who is newer |
Force failover to test | Standby lacks the VIP | Sync first |
Rebuild the pair | Trust is just stale | Recreate CMI if needed |
Proof the ticket is closed
sync-status In Sync
tmsh list ltm virtual on standby shows the VIP
Config checksums match
Say this in an interview
I never test failover while Changes Pending. Standby might not know the new VIP.
Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/



Comments