How to Check Default VLAN on BIG IP F5?

1. Understanding Default VLANs on BIG-IP

By design, when you first run the BIG-IP Setup Utility, TMOS automatically creates two VLAN objects in the Common partition:

• external VLAN: Typically carries traffic between the data‐center network and client networks.
• internal VLAN: Usually used for traffic between the BIG-IP and backend application servers or private subnets.

Each default VLAN is automatically assigned:

• A static and a floating self IP
• A VLAN tag (chosen by you during setup or assigned automatically)
• One or more physical interfaces

These VLANs serve as the foundation for all local traffic configurations—virtual servers, pools, and route domains—so it’s crucial to confirm their definitions before proceeding with advanced networking or security policies.

2. Checking Default VLANs via the CLI

For many seasoned F5 administrators, the Traffic Management Shell (tmsh) is the fastest way to inspect system objects. To view all VLANs—including the defaults—issue:

tmsh list net vlan

This command outputs every VLAN object, its tag, and its interface assignments. Look for entries similar to:

net vlan external {
    tag 1
    interfaces {
        1.1 { }
    }
    mtu 1500
    auto-lasthop disabled
    // … self IPs, MACs, and other settings
}
net vlan internal {
    tag 2
    interfaces {
        1.2 { }
    }
    mtu 1500
    auto-lasthop disabled
    // … self IPs, MACs, and other settings
}

To inspect a single VLAN in detail (for example, internal), use:

tmsh list net vlan internal

This focused output shows you exactly which interfaces are assigned, the VLAN tag, MTU, source checking settings, and any other custom parameters.

3. Viewing Default VLANs in the GUI

If you prefer the Configuration Utility (GUI), the default VLAN objects are found under Network:

1. Log in to https://<BIG-IP-management-IP>/ as an administrator.
2. Navigate to Network → VLANs → VLAN List.
3. In the list, locate the entries named external and internal in the Common partition.

Clicking on a VLAN name reveals its Properties page, where you can review:

• VLAN Tag: The 802.1Q ID used on trunk ports.
• Interface Assignments: Which physical or trunked interfaces carry this VLAN—tagged or untagged.
• MTU and Source Checking settings.
• Self IPs associated via floating and static addresses.

This GUI view mirrors the CLI output, giving you a visual confirmation of how BIG-IP is mapping traffic on each VLAN.

4. Why Verifying the Default VLAN Matters

1. Troubleshooting Reachability
   Misassigned interfaces or incorrect VLAN tags can silently black-hole traffic. Confirming default VLAN settings helps isolate whether the problem lies at Layer 2 or above.
2. Secure Management
   If your management or HA traffic is supposed to ride on a specific VLAN, verifying that no unintended interfaces are members of the default VLANs ensures that sensitive traffic remains isolated.
3. Foundation for Virtual Servers
   Every virtual server you create inherits the VLAN membership of its self IP. Ensuring that internal and external map correctly prevents downstream misconfigurations when you associate pools and profiles.
4. Avoiding Overlaps
   In multi-tenant or vCMP environments, confirming that the default VLANs reside only in Common and aren’t accidentally recreated in guest partitions avoids address-space conflicts.

5. Best Practices for Managing Default VLANs

• Tag Consistency: Ensure the VLAN tag on BIG-IP matches the external switch configuration. A tag mismatch is a leading cause of link-up but no-traffic scenarios.
• Interface Hygiene: Limit interface assignments to only the necessary ports—avoid adding management or HA interfaces to data VLANs unless explicitly required.
• Use Explicit Tags: While BIG-IP can auto-assign tags, defining them explicitly during setup provides clearer documentation and fewer surprises.
• Document Your Setup: Record the VLAN tags, assigned interfaces, and self IPs in your network inventory. Keeping this in sync with BIG-IP’s actual configuration expedites future troubleshooting.
• Leverage Route Domains Carefully: By default, VLANs internal and external map to route domain 0. If you introduce additional route domains, verify that new VLANs don’t inadvertently overlap with the defaults.

6. Advanced Tips: Automating VLAN Checks

For environments with many BIG-IP systems, a simple script can automate default VLAN verification:

#!/bin/bash
# Check default VLANs on multiple BIG-IP hosts

BIGIPS=("10.0.0.1" "10.0.0.2")
for host in "${BIGIPS[@]}"; do
  echo "Checking $host..."
  ssh admin@"$host" tmsh list net vlan '{internal external}'
done

This quick check reports the interface and tag assignments for internal and external across your fleet—alerting you to any drift from the standard configuration.

Please follow and like us: