Updated Date: 07/07/2026
New Features in BIG-IP Version 17.0.0
F5 is changing the standard support phase of the BIG-IP software lifecycle for Long-Term Stability (LTS) releases from five (5) years to four (4) years effective with the release of BIG-IP v17.0.0. This means that EoSD and EoTS dates will now be reached 4 years after individual versions are released, with this change remaining in effect for all subsequent BIG-IP LTS releases. As F5 shifts to deliver more software-based solutions this change is intended to maintain alignment with the industry, while also helping facilitate migration of customers BIG-IP’s to newer versions.
You can find more information about the updated software lifecycle here:
K8986: F5 software lifecycle policy
K5903: BIG-IP software support policy
BIG-IP version 17.0.0 introduces the following new features for LTM/TMOS:
A new hashing mode is introduced to the DAG to support the distribution of traffic for GTP-U traffic. A new system database variable “iptunnel.gtp.teid_hash” is introduced, when this variable is enabled the packets are disaggregated based on the TEID value in the GTP-U header instead of IP or L4 ports for DAG calculation in the software. This helps in distributing the traffic load across multiple TMMs based on the entropy of the inside-user TEIDs.
A GTP-U tunneled packet is disaggregated using TEID only if it meets all the following conditions:
-
Outer/First L3 header must be well-formed IPv4 or IPv6
-
Outer/First L4 header must be well-formed UDP
-
UDP payload must be at least 8 bytes (enough to include the TEID field)
-
L4 Destination Port must be 2152 (decimal)
-
GTP-U version must be 1
-
GTP-U Protocol must be 1
When this feature is enabled, there can exist identical connections (same 5-tuple) across TMMs since the hashing is based on the TEIDs and no ephemeral port is allocated. The only supported virtual server is of type IP forwarding for this feature. As the same 5-tuple traffic is distributed across all TMMs, the Protocol Inspection module DROP or REJECT actions at the connection level are applied to all the identical connections on different TMMs.
The Message Queuing Telemetry Transport (MQTT) filter over WebSocket is enabled to offer an MQTT filter when MQTT is encapsulated using WebSockets, such as MQTT iRule based enrichment and inspection.
In addition to the current behavior of the WebSockets filter, support for the following is added:
-
Support for MQTT protocol profile over WebSockets when both client-side and server-side connflows are encapsulated using WebSockets.
-
Support for MQTT protocol profile over WebSockets when only client-side connflow is encapsulated using WebSockets.
BIG-IP 17.0.0 now has a new Log Manager role that grants users permission to view all configuration data on the system, similar to an Auditor role. However, users with this role can modify the system log configuration settings, including creating log filters, destinations, and publishers. In addition, users with the Log Manager role have access to all partitions on the system.
BIG-IP now supports (RSA)-AES128-CCM and (RSA)-AES128-CCM8 ciphers.
BIG-IP now supports Elliptic Curve Diffie-Helman (ECDH) ciphers in SSL Forward Proxy, which includes support in SSL Orchestrator. Note that Elliptic Curve Diffie-Helman Ephemeral (ECDHE) has been supported in SSL Forward Proxy since version 14.1.
BIG-IP now supports Negotiated Finite Field Diffie-Helman Ephemeral (FFDHE) ciphers.
BIG-IP version 17.0.0 introduces the following new features for Advanced WAF:
For ease of configuration and use, several features have been moved to existing or new tabs under the Policy screen.
- Audit Log
- Cookies
- Brute Force Attacks
- Headers
- Event Correlation
- Request Logs
In addition, the current configured Enforcement Mode and Learning Mode were added to the Policy Configuration status bar.
Advanced WAF supports the ingestion of GraphQL requests over HTTP traffic and applies attack signatures to the parsed values of the GraphQL queries in the requests. A dedicated GraphQL policy template is available. This template is best for a GraphQL-only service with no additional URLs. If GraphQL is only part of a service, the URL can to be added. The GraphQL template:
- Has no websocket URL. The URLs are added as endpoints.
- Is the same as the Fundamental template with the exception of:
- The illegal URL violation is turned on.
- The illegal request content type is turned on.
- The language is UTF-8.
- Differentiate between HTTP/WS and HTTPS/WSS URLs is turned on.
- The new GraphQL violations are turned on:
- GraphQL data does not comply with format settings
- GraphQL disallowed pattern in response
- GraphQL introspection query
- Malformed GraphQL data
- There is no parent or child inheritance.
Advanced WAF can enforce GraphQL profile attributes on GraphQL variables and learning on signatures, metacharacters and graphql violations. GraphQL payload is supported both as a json format and as form-data, with GraphQL POST requests using content type application/graphql. Multiple GraphQL queries on the same request are supported. The GraphQL Profile Properties:
- Maximum Total Length of (GraphQL query)
- Maximum Value Length
- Maximum Structure Depth
- Maximum Batched Queries
- Maximum Query Cost - A schema file with costs definition can be uploaded with custom cost definitions.
GraphQL introspection queries are supported but generate a violation by default as they could be used in an attack.
The full declarative policy export uses a blank template, i.e., no underlying default configurations. The export includes the full declarative policy configuration; including, for example, the exact attack signatures and signature sets as configured in the original policy. This allows a full export and then re-import of a declarative policy to be identical with no unwanted default settings from a non-blank template.
This factory bot defense profile is meant to be used for Virtual Servers that also deploy at least one of the Shape DID or IBD profiles. To use bot settings other than those configured in the new bot defense profile, create a new profile using the same settings as this new factory profile and then modify it as needed.
Additional Evasion Technique Detected subviolations were added to allow you to block these evasion attempts:
- Multiple consecutive slashes (//)
- Path parameters (;/)
- Trailing dot (/aaa.php. or [domain.com|http://domain.com/].)
- Trailing slash (/aaa.php/)
- Unescaped whitespace in URL
Threat campaigns can be sorted by their last update date.
To improve usability and event correlation, an incident ID was added to /var/log/asm log records. When the incident is added/updated, the log includes the incident ID of the changed log.
Advanced WAF is aligned with the 2021 OWASP Top 10 changes, including the 3 new categories as well as the naming, positioning, and scope changes to existing categories.
With this release, you can configure SSRF Hosts to allow, deny, or resolve the IP addresses and domain names.
There are no new features specific to this product area in this BIG-IP version.
The 17.0.0 release of Access Policy Manager (APM) enhances the application and network access security and includes several bug fixes to improve performance.
For the CRLDP cache cleanup, a Max Cache Size configurable setting is added for the CRLDP agent to check and limit the maximum entries of the CRLDP cache. If the number of cache entries reaches the configured cache size limit, a cache entry that is least recently used (LRU) is removed and a new entry is populated into the cache. You can set the cache size value between 0 to 10,000 entries. The maximum number of entries allowed is 10,000 entries which is a default value set for the Cache size option.
Effective August 2021, due to new restrictions from Google, F5 Access application can be uploaded to play store only If the app is built against API level 29. Google has added restrictions on device administration policies that can be enforced by application vendors. Because of this change, F5 has to move to new API’s to enforce password policies on devices running Android 10 and higher.
A new setting Device Lock Complexity option in Connectivity Profile settings for Android F5 Access Client allows the administrator to configure the password policies for devices. You can continue to use the older method of enforced device lock on devices running on Android 9 and lower. The client-side support for the device lock complexity is added from F5 Access for Android 3.0.8 versions.
Access Policy Manager (APM) already supports most of the functionalities for the JSON Web Token (JWT) use case to provide mobile or system access (through either native apps or browser based) to enterprise applications. However, secure authentication requires JSON Web Encryption (JWE) to encrypt the JWT. Now, F5 Oauth Client and Resource Server support consumption of JWE which is issued by the Identity providers. This feature aims to extend the existing JWT functionality for APM as Client and Resource Server with the following algorithm sets mentioned below to decrypt the JWE token.
RSA OAEP with AES_GCM_128
RSA OAEP with AES_GCM_256
The Network Location Awareness (NLA) on machine tunnel for Windows determines when a client should start a Network Access connection. During a network switch, such as changing WiFi connections, NLA detects whether a connection is corporate or remote and enables BIG-IP Edge Client to automatically terminate a VPN session on a corporate network and establish a VPN connection on a remote network.
When an administrator adds corporate DNS suffixes in the DNS name setting of the BIG-IP APM connectivity profile, the NLA feature compares the DNS suffixes present on the system against the administrator configured DNS list on a network switch. If the DNS Suffix matches, the connection is identified as a corporate network, and the client does not attempt to establish a Network Access connection. The machine tunnel service that supports the maintenance and remote troubleshooting is disabled on a corporate network. When the suffixes don’t match, the connection is identified as a non-corporate network, and the client attempts to establish a Network Access VPN connection. The machine tunnel service is enabled on a non-corporate network.
This release includes an implementation of Proof Key for Code Exchange (PKCE) that extends the authorization code flow. PKCE mitigates authorization code interception attacks when the public clients request access using authorization code. Clients generate a random code verifier string and employ a code challenge method (plain or SHA256) to validate themselves with the authorization server.
You can enable the PKCE feature for both the Client Application and the OAuth profile. The settings in the Client Application override the settings in OAuth Profile. This option is useful for the use cases that support both public and private clients in the same authorization server. PKCE is used primarily for public clients with a more restricted “s256” challenge method and is optional for private clients.
During PKCE configuration on the client-side, you can choose the code challenge method. By default, clients are expected to authorize with APM using the SHA256 code challenge method. Clients who cannot perform the SHA256 code challenge (s256) can use the plain code challenge (plain) method. Refer to the RFC7636 document for more details.
In June 2021, Microsoft released the Compliance Retrieval service to replace the Intune NAC service, offering improved security and reliability. This means Microsoft is moving away from the device ID based compliance check towards Intune ID in the certificate based compliance check.
The BIG-IP APM now supports the new Compliance Retrieval service and uses certificate-based authentication to check for device enrollment and compliance state with Intune. You can configure an access policy to allow access to devices that have Intune ID in the authentication certificate. Refer to the latest Edge Client and Application Configuration guide for the settings required on the BIG-IP system and the Microsoft Endpoint Manager admin center to maintain NAC availability.
Refer to the New Microsoft Intune service for network access control for additional details.
Starting January 31, 2022, Microsoft has discontinued support for Transport Layer Security (TLS) 1.0/1.1/3DES cipher suites due to potential protocol downgrade attacks and other TLS vulnerabilities. Microsoft Azure AD plans to phase out support for the TLS 1.0/1.1/3DES cipher suites and implement a secure TLS 1.2 cipher suite that supports the secure transmission of data between clients and servers. Therefore, Microsoft Azure AD chooses the following TLS 1.2 AES GCM cipher suites during the TLS handshake:
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
In addition, the latest version of the OpenShift Container Platform recommends the use of the most secure TLS 1.2 AES GCM cipher suite over previous weak cipher suites. Due to the use of weak TLS 1.0, 1.1, 3DES cipher suites, the Oauth provider discovery module option does not function. TLS 1.2 AES GCM cipher suites support is added to resolve the Oauth provider discovery failures.
There are no new features specific to this product area in this BIG-IP version.
There are no new features specific to this product area in this BIG-IP version.
There are no new features specific to this product area in this BIG-IP version.
BIG-IP version 17.0.0 introduces the following new features for SaaS:
The F5 Distributed Cloud (XC) Bot Defense protects web and mobile properties from automated attacks by identifying and mitigating malicious bots. The Bot Defense uses JavaScript and API calls to collect telemetry and mitigate malicious users.
The F5 Distributed Cloud (XC) Bot Defense is available in Standard and Enterprise service levels. In both the service levels the Bot Defense is available for traffic form web, web scarping, and mobile. The web scrapping is only applicable to web endpoints.
For more information, refer to BIG-IP SaaS: Bot Defense Implementation.
The F5 Application Traffic Insight (ATI) is a Proof-of-Value (PoV) tool that provides insight into unwanted user connections, devices, and behavior on your web application. With ATI, you can easily analyze traffic flow anomalies, determining both malicious and legitimate human and non-human (bots/automation) actors.
The ATI leverages ATI JavaScript (JS) for the data collection. ATI JS is a lightweight JavaScript deployed asynchronously on the web pages of the application. Because it is deployed asynchronously, there is minimal impact on user experience and system performance. This JS collects all the required data fields for generating insights on your web application traffic. The ATI is available in Standard and Enterprise service levels.
For more information, refer to BIG-IP SaaS: Application Traffic Insight (ATI) Implementation.
There are no new features specific to this product area in this BIG-IP version.
There are no new features specific to this product area in this BIG-IP version.