Using management NIC to connect to Cloud API

[vvt137]

By default AWS in multi-NIC templates (e.g. https://github.com/F5Networks/f5-aws-cloudformation/tree/master/supported/failover/across-net/via-api/3nic/existing-stack/payg) cause CFE connectivity to AWS APIs to be established via External interface (eth1) rather than the Management interface (eth0). This leads to the following issues with CFE implementation:

• EIPs (public IPs) corresponding to the external SelfIPs cannot be removed from the stack (without using more complex design based on AWS Endpoints) when EIPs for VIPs are required. Such removal would have improved security and would reduce the AWS subscription costs.
• CFE initiation could occur quicker improving the chances to be completed by the time a BIG-IP instance within the HA cluster needs to assume an active role (see Failover is not triggered when it should be after both F5 VMs are stopped or rebooted #36 (comment)).

It is not clear from the CFE documentation whether it is an inherent limitation of CFE that dictates using the external interface for API calls. If it is the case, please consider this an "enhancement request". If it is not the case, the CFE documentation should be updated to show additional steps required to use the management interface for this purpose.

[KrithikaChidambaram]

Hi, AUTOSDK-432 has been created to track this. Thanks!

[vvt137]

I have changed the title of this issue ticket as the issue also affects some Azure deployments, where it becomes necessary to add and maintain very large sets of static route as a workaround:
https://support.f5.com/csp/article/K80487062
https://github.com/grf5/tmos_azure_api_host_routes

[vvt137]

In both AWS and Azure cases the F5-supported templates do implement default routes via both external and management interfaces. Yet, the CEF API calls use the external (TMM) interface unless more specific routes to API destinations are specified. This behaviour indicates that the root cause of the issue is that the process/application (curl?) used for generation this API traffic is executed by CFE without specifying "the source address or interface that the daemon uses to initiate traffic..." (see https://support.f5.com/csp/article/K10239).