top of page

F5 VLAN Failsafe Triggered: tmsh show sys failsafe When the Box Reboots Itself

  • Aug 15
  • 2 min read
F5 BIG-IP network security troubleshooting lab
F5 BIG-IP · Techclick CLI troubleshooting lab
BIG-IP rebooted. Nobody touched it. Logs mention VLAN failsafe. The switch had a brief storm.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

  • Name the first CLI command to run on F5 BIG-IP for this ticket

  • Separate the layer that is actually broken from the layer people blame

  • Apply one scoped fix instead of a global disable

  • Prove the ticket closed with a session, log, or counter

Quick answer

VLAN failsafe reboots or fails over when a VLAN goes quiet. Tune the timeout or the action so a storm does not take the pair down.

Why this ticket shows up

Failsafe thinks a silent VLAN means TMM is dead. A switch loop or a quiet lab VLAN can look like death.

Symptoms operators actually see

  • Unexpected reboot or failover

  • failsafe log

  • One VLAN had a storm or was quiet

  • HA pair flapped

CLI first — copy this block

Run these on the F5 BIG-IP device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

tmsh show sys failsafe
tmsh list sys failsafe
tmsh show net vlan
grep -i failsafe /var/log/ltm
tmsh show sys ha-status

How to read that output

failsafe action reboot versus failover matters. A noisy or silent VLAN plus a short timeout is a self-inflicted outage.

Triage order

  1. Confirm failsafe in the log around the reboot

  2. Identify the VLAN

  3. Increase timeout or change action to failover

  4. Fix the switch storm

  5. Document the new timeout

Classic traps

What you see

Real cause

Fix

Disable failsafe forever

It still protects real TMM death

Tune it

Blame a software bug first

Switch CAM table was churning

Read both sides

Only reboot again

It will trip on the next storm

Fix timeout

Proof the ticket is closed

  • Failsafe still enabled with a sane timeout

  • No reboot on the next quiet period

  • HA stable

Say this in an interview

An uncommanded F5 reboot makes me grep failsafe before I open a TAC software case.

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/

Comments


bottom of page