To remove the AGC objects, use the command clear-rest-storage. To keep the AGC objects, undeploy all AGC applications before you run tmsh load sys config default.

• Open port 443 on any Self-IPs you are using for REST Config Sync.
• When you set-up HA using the Run Config sync/HA utility from the BIG-IP UI, make sure you select Allow Default on the port lockdown setting of the Config Sync Self IP (internal or HA). The default setting is Allow Default.
• Enable auto-sync on the failover device group.
• Enable network failover on the failover device group.

You cannot add Credential Protection to an existing AGC deployment. For example, you cannot create an AGC SAML IdP deployment, then use AGC Credential Protection and add it to the AGC SAML IdP deployment.

As a workaround, to create a deployment with Credential Protection, follow these steps:

1. Create the desired AGC deployment.
2. Recreate manually the objects created by AGC deployment using TMSH or TMUI.
3. Run the Credential Protection AGC and apply the credential protection to the app created in step 3.

963625

982745

982753

982769

978501

929117-1

982801

1009157

CVE-2015-9251, CVE-2016-7103, CVE-2017-18214, CVE-2018-16487, CVE-2018-3721, CVE-2019-1010266, CVE-2019-10744, CVE-2019-10768, CVE-2019-10768, CVE-2019-11358, CVE-2020-11022, CVE-2020-11023, CVE-2020-28168, CVE-2020-28500, CVE-2020-7676, CVE-2020-8203, CVE-2021-23337.

As a workaround, use the command-line interface for Image upgrade:

• When you want to move configuration from the old partition to the new partition, use the following TMSH commands: modify sys db liveinstall.moveconfig value enable modify sys db liveinstall.saveconfig value enable install sys software image <image_name> create-volume volume HD1.2 reboot
• When you do NOT want to move configuration from the old partition to the new partition, use the following TMSH commands: modify sys db liveinstall.moveconfig value disable install sys software image <image_name> create-volume volume HD1.2 reboot

• The administrator provides configuration properties using the Guided Configuration interface.
• When the Guided Configuration is deployed, the iAppLX framework deploys the configuration. A specific Guided Configuration processor deploys the configuration on the device.
• The configuration is synced to peer HA devices regardless of HA mode (auto-sync or manual).
• If HA mode is auto-sync when a deploy or undeploy action is taken, the configuration is deployed, and changes are synced to peer HA devices.
• If HA mode is manual sync, you must manually sync these changes to other devices when a configuration is deployed or undeployed.

As a result of the configuration options, it is possible that the Guided Configuration application status (deployed, pending, or not-deployed) may not reflect the state of configuration objects when the sync mode is manual. It is recommended that the administrator should use auto-sync mode when devices are in an HA environment.

As a workaround, to display the new monitor assignment in UI, follow the steps below:

1. Assign the old_monitor value to the pool and deploy the config.
2. Un-deploy the configuration to remove the old_monitor association to the pool.
3. Assign the new_monitor value to the pool and deploy the configuration.

As a workaround, you can apply the access policy using the following TMSH command:

Prepend the <profile-name> with the folder name of the app. For example, if you deployed an application using the name "apiProtection101", the command to run would be:

As a workaround, upload the metadata file again using a different file name before deploying the configuration.

error : transaction failed:<transaction_number>: The requested API Protection Profile (/<partition path>/<profile name>) already exists in partition Common.

With 200 rate-limiting overrides, and no whitelist/blacklists, the configuration is able to deploy on the i5800 platform.

As a workaround,

• Increase the restjavad heap space.
• Use the GUI when adding a large number of rate-limiting overrides or whitelist/blacklist entries.

Refer to the following AskF5 articles for information on how to increase the restjavad heap space:

K26427018: Overview of Management provisioning

K06150134: The restjavad process may run out of memory when processing a large amount of data

error : transaction failed:<transaction_number>: Cannot delete customization group (/Common/OauthServer.app/OauthServer_act_logon_page) because it is used.

error : transaction failed:<transaction_number>: The requested API Protection Profile (/<partition path>/<profile name>) already exists in partition Common.

1. Export the API Protection Proxy configuration on the BIG-IP 14.1 system.
2. Upgrade the BIG-IP system to version 15.0.
3. Import the exported configuration.
4. Redeploy the configuration.

As a workaround, select the existing DNS resolver before redeploying.

As a workaround, do either of the following to disable the strictUpdates and modify configuration:

• Log in to the BIG-IP system's Advanced Shell (bash) and enter the following command:

  restcurl -u admin:admin -X PATCH /mgmt/tm/sys/application/service/~Common~IAP.app~IAP?ver\u003d16.0.0 -d '{"strictUpdates": "disabled"}'

  Note: Replace admin:admin and IAP with your credentials and configuration name.
• Use the following TMSH command for your configuration.

  modify sys application service IAP.app/IAP strictUpdates disabled

  Note: Replace IAP with your configuration name.

transaction failed: Invalid IP address:

As a workaround,

• Use an existing virtual server that has Address List as the destination address.
• Create a new virtual server using the BIG-IP Traffic Management User Interface (TMUI) that has Address List as the destination address and select it in AGC.

As a workaround, make change to the configuration by disabling Manage Configuration in Guided Configuration.

transaction failed:01b70022:3: If URL (https://<url>) is of https scheme, serverssl profile must be present in API Server (/Common/test2.app/test2_server1)

As a workaround, for successful deployment, add a ServerSSL Profile in the Path step if the re-imported OpenAPI Spec file has URLs with HTTPS scheme.

As a workaround, make change to the configuration by disabling Manage Configuration in Guided Configuration.

Permission being assigned already exists on the object.

As a workaround, do either of the following:

• If the user is already assigned to the application in the Azure portal, skip the user assignment in Azure AD Application before deploying the configuration.
• Remove the user from the Azure portal and assign it to the application using Guided Configuration > Azure AD Application .

As a workaround, do either of the following:

• Create more than one configuration and limit the number of applications deployed in each configuration.
• Increase socketTimeout value in the /etc/bigstart/scripts/restnoded script and restart restnoded by using the command bigstart restart restnoded.

  if [ -f /service/${service}/debug ]; then exec /usr/bin/f5-rest-node --inspect=0.0.0.0:5858 /usr/share/rest/node/src/restnode.js -p 8105 --socketTimeout=120000 --logLevel finest -i ${LOG_FILE} -s none >> /var/tmp/${service}.out 2>&1 else exec /usr/bin/f5-rest-node /usr/share/rest/node/src/restnode.js -p 8105 --socketTimeout=120000 --logLevel finest -i ${LOG_FILE} -s none >> /var/tmp/${service}.out 2>&1 fi

• You can also increase the timeout value in the getDefaultTimeout function in /usr/share/ret/node/infrastructure/restHelper.js. The default value is 60 seconds (60000 msec) and can be increased to 120000 msec. Restart restnoded by using the command bigstart restart restnoded.

Access Guided Configuration Azure Active Directory deployment fails when the unverified custom domain is configured in the usecase.

Error: "Values of identifierUris property must use a verified domain of the organization or its subdomain"

Workaround: Use verified custom domains (that are added in the azure portal) in entity ID for the successful Azure AD deployment. Refer to the verified domains for the entity ID to follow any of the formats mentioned on the page.

It is recommended to deploy the application id URI that is using a verified custom domain only so that users can trust the application. During the first-time deployment of Azure AD, the application allows you to verified domain only. In addition, you can get the option to change from verified to unverified domain. However, it is not recommended from the Microsoft end.

Error: "The configuration was updated successfully but could not be retrieved. The error is \\"

Workaround:

Once AGC is up and running, deploy the application again.

Error: "Resource '<resource_id>' does not exist or one of its queried reference-property objects are not present"

Workaround: You can undeploy and redeploy the application. This workaround is intermittent.

After the AGC is upgraded to the latest version, the secureID configuration file is not restored and redeploy of the usecase fails.

Error: file (/var/config/rest/iapps/f5-iappslx-access-adfs/securid-files/adfs_instance_2/sdconf.rec) expected to exist

Workaround: You can re-upload the secureID configuration file and start the redeployment process. The application is redeployed successfully.

Error: transaction failed:01071ca0:3: When the manual flag is enabled, OAuth Provider (/Common/testoauth_crs_customjson.app/testoauth_crs_customjson_oauthProvider_custjson) must have manual JWT config attached for the JWT provider list (/Common/testoauth_crs_customjson.app/testoauth_crs_customjson_providerList_custjson)

1009837

Error: transaction failed:01020036:3: The requested virtual server profile (/Common/oauth_server.app/oauth_server_vs /Common/clientssl) was not found.

1. Log in to the BIG-IP device via SSH.
2. Run the following command: cd /var/config/rest/iapps/
3. Run the following command: rm -rf f5-iappslx*
4. In the BIG-IP UI, navigate to Security > Guided Configuration . The guided configurations will reinstall for viewing and editing.

error: The requested URL /iapps/f5-iappslx-waf-app-comp-protection/index.html was not found on this server.

1. Log in to the BIG-IP device via SSH.
2. Run the following command: cd /var/config/rest/iapps/
3. Run the following command: rm -rf f5-iappslx*
4. In the BIG-IP UI, navigate to Security > Guided Configuration . The guided configurations will reinstall for viewing and editing.

1. Open the imported configuration.
2. Make any change to the configuration.
3. Save the modified configuration and redeploy.

As a workaround, you can apply the access policy using the following TMSH command:

Prepend the <profile-name> with the folder name of the app. For example, if you deployed an application using the name "apiSecurity101", the command to run would be:

On BIG-IP i5800 with APM and AVR provisioned, deploying a REST API security (Open API Spec) configuration with 200 or more rate-limiting overrides or 200 or more whitelist/blacklist entries, may result in an error message. With 200 rate-limiting overrides, and no whitelist/blacklists, the configuration is able to deploy on the i5800 platform.

As a workaround,

• Increase the restjavad heap space.
• Use the GUI when adding a large number of rate limiting overrides or whitelist/blacklist entries.

Refer to the following AskF5 articles for information on how to increase the restjavad heapspace:

K26427018: Overview of Management provisioning

K06150134: The restjavad process may run out of memory when processing a large amount of data

https://f5.com/support :: Self-solve Options

Free self-service tools give you 24x7 access to a wealth of knowledge and technical support. Whether it is providing quick answers to questions, training your staff, or handling entire implementations from design to deployment, F5 services teams are ready to ensure that you get the most from your F5 technology.

https://support.f5.com/csp/home

The storehouse for thousands of knowledgebase articles that help you manage your F5 products more effectively. Whether you want to browse periodically to research a solution, or you need the most recent news about your F5 products, AskF5 is your source.

https://f5.com/support/tools/ihealth

BIG-IP iHealth Diagnostics identifies issues, including common configuration problems and known software issues. It also provides solutions and links to more information. With BIG-IP iHealth Viewer, you can see the status of your system at-a-glance, drill down for details, and view your network configuration.

https://devcentral.f5.com/

Collaborate and share innovations including code samples, new techniques, and other tips, with more than 300,000 F5 users worldwide. DevCentral is the place to ask questions, find solutions, learn to harness the power of F5’s powerful scripting language, iRules, and much more.

https://interact.f5.com/F5-Preference-Center.html

Here, you can subscribe to a number of communications from F5. For information about the types of notifications F5 provides, see K9970: Subscribing to email notifications regarding F5 products.