top of page

F5 Config Sync Failed: tmsh show cm sync-status When Standby Has Yesterday's VIP

  • Aug 15
  • 2 min read
F5 BIG-IP network security troubleshooting lab
F5 BIG-IP · Techclick CLI troubleshooting lab
You added a VIP on the active. Standby does not have it. Failover would drop that app.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

  • Name the first CLI command to run on F5 BIG-IP for this ticket

  • Separate the layer that is actually broken from the layer people blame

  • Apply one scoped fix instead of a global disable

  • Prove the ticket closed with a session, log, or counter

Quick answer

show cm sync-status. If Changes Pending, sync from the device that has the good config. Do not sync the wrong way.

Why this ticket shows up

Device groups do not always auto-sync. A failed sync leaves a silent failover bomb.

Symptoms operators actually see

  • Changes Pending

  • Standby missing the new VIP

  • Sync error about a version or a locked file

  • Recent failed deploy

CLI first — copy this block

Run these on the F5 BIG-IP device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

tmsh show cm sync-status
tmsh show cm device-group
tmsh run cm config-sync to-group device-group-1
tmsh show sys software
cat /var/log/ltm | grep -i sync

How to read that output

sync-status says which device is newer. Always sync from the device you just changed, never blindly from standby.

Triage order

  1. Read sync-status on both

  2. Confirm the active has the new VIP

  3. Sync to the group from that device

  4. Verify the VIP exists on standby

  5. Fix CMI trust if sync is refused

Classic traps

What you see

Real cause

Fix

Sync from standby

You will wipe the new VIP

Check who is newer

Force failover to test

Standby lacks the VIP

Sync first

Rebuild the pair

Trust is just stale

Recreate CMI if needed

Proof the ticket is closed

  • sync-status In Sync

  • tmsh list ltm virtual on standby shows the VIP

  • Config checksums match

Say this in an interview

I never test failover while Changes Pending. Standby might not know the new VIP.

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/

Comments


bottom of page