Configure disaster recovery

This guide provides instructions for configuring and managing the F5 Insight disaster recovery (DR) feature.

Overview

The F5 Insight disaster recovery feature helps your system keep running even if one server fails. It works by maintaining two synchronized systems:

1. Primary instance: Handles all active operations.
2. Standby instance: A backup system that continuously syncs data from the primary.

If the primary fails or requires maintenance, you can “promote” the standby to take over as the primary. After fixing the first system, you can perform a “failback” to restore it to normal operation.

Important

Before promoting the standby, make sure the primary is fenced (not actively scraping BIG-IP devices). This prevents problems caused by both instances trying to process data at the same time.

---

How disaster recovery works

Disaster recovery status and user interface

• Primary node: Shows “Active” and “Read/Write” statuses in green. You can make and apply changes here.
• Standby node: Shows “Standby” and “Read-only” in gray. You can’t make changes on the standby node.
• DR pair status: Displays “Operational Status: Active” in green when everything is running correctly.

When you access the standby node, you’ll see a banner:

“This node is in standby mode. Configuration changes must be made on the primary node.”

This visual indicator confirms you are viewing the backup instance rather than the active system.

Data synchronization

F5 Insight automatically copies all data (for example, configuration changes, device information, and performance metrics) from the primary instance to the standby instance in real time.

Security with WireGuard tunnel

All data replication is secured through a WireGuard tunnel:

• This is an encrypted connection between the primary and standby nodes.
• It uses UDP port 51820 and requires minimal system resources.

Before you start

Infrastructure requirements

• Two F5 Insight instances with the same software version. The instances must have network connectivity to each other, and you must have Secure Shell (SSH) access with sudo privileges on both systems.
• Confirm these network ports are open between the instances:
  • UDP port 51820 for the WireGuard tunnel (critical).
  • TCP port 22 for SSH (initial setup only).
  • TCP port 443 for the HTTPS UI.

You need administrator credentials for both instances for the web UI and SSH.

Checklist before setting up disaster recovery

• Both instances are operational.
• Passwordless SSH setup between the primary and standby instances is completed.

Set up disaster recovery

Prepare the instances

Verify the system is working on both instances. Record their IP addresses, for example:

• Primary: f5-insight-1-ip
• Standby: f5-insight-2-ip

Configure SSH access

1. Generate an SSH key on the primary if one doesn’t already exist.
2. Copy the public key to the standby instance.
3. Repeat the process from standby to primary.

Set up the WireGuard tunnel

1. Log in to the primary instance through SSH.
2. Go to /opt/f5insight/scripts.
3. Run the WireGuard setup script to:
   • Generate keys.
   • Establish the tunnel.
   • Configure iptables rules.

Run the below command to execute the WireGuard setup script:

sudo ./wireguard-dr-setup.sh \
   --node1-ip f5-insight-1-ip \      # primary-node
   --node2-ip f5-insight-2-ip \      # secondary-node
   --tunnel-network 100.80.2.0/24  # private /24 subnet for the WireGuard tunnel (must not overlap with existing networks)

Once complete, a confirmation message displays.

Set up disaster recovery in the UI

1. Access the primary instance web UI.

2. Go to Settings > Disaster Recovery.

3. Select Configure on the Standby Peer Node card.

4. Provide the following details:

   • Primary (hostname and IP): for example, hostname: primary-node, IP: f5-insight-1-ip.
   • Standby (hostname and IP): for example, hostname: standby-node, IP: f5-insight-2-ip.
   

5. Select Save Configuration.

This might take a few minutes while initial data synchronization occurs.

Verify disaster recovery configuration

Go back to the DR settings page:

• Primary node: Should show “Active” and “Read/Write.”
• Standby node: Should show “Standby” and “Read-only.”
• DR pair status: Shows “Active” with a green indicator.

To verify standby configuration, open a browser and go to your standby instance IP address. The standby mode banner should be visible on all settings pages: “This node is in standby mode. Configuration changes must be made on the primary node.”

Verify data synchronization

To verify data replication, make a configuration change on the primary instance, such as adding a device or modifying a setting. Then access the standby UI and refresh the page to verify the change has been synchronized.

For example, a BIG-IP device named bigip/bigip-africa-central is added to the primary.

All the dashboards and Homepage on secondary should start showing data for this device.

Disaster recovery operations

Failover (promote standby to primary)

If the primary instance fails or needs maintenance, promote the standby to act as the primary.

1. Scale the OTEL collector to zero replicas on the primary node:

   sudo kubectl scale deployment otel-collector --replicas=0 -n f5-insight
   

   When the primary instance fails or requires maintenance, promote the standby instance to assume the primary role.

2. Access the standby instance (https://<standby-ip>).

   

3. Go to Settings > Disaster Recovery.

4. Select Promote Node to Primary on the Standby Node card.

   A confirmation message displays: “Switching node roles in progress.”

   

5. Log back in to the new primary instance and verify the status.

Post-promotion steps:

• Update BIG-IP log configurations to redirect logs to the new primary.
• You can now make changes on the new primary instance.

Failback (restore the original primary)

After fixing the original primary instance:

1. Access the original primary (https://<primary-ip>).

2. Go to Settings > Disaster Recovery.

3. Select Demote Node to Standby on the Primary Node card.

   A confirmation message displays: “Switching node roles in progress.”

   • A confirmation dialog appears:
   

4. Log back in to verify the system returns to standby mode. Confirm the standby mode banner is visible.

   

Related resources

The F5 Insight DR feature helps your system stay functional even during failures. Synchronized instances, encrypted data replication, and UI-based controls make it simple for teams to maintain business continuity. Regular maintenance and familiarity with the failover and failback processes will keep your system running smoothly.