Applies To:
Show VersionsBIG-IP AAM
- 14.1.2
BIG-IP APM
- 14.1.2
BIG-IP Analytics
- 14.1.2
BIG-IP Link Controller
- 14.1.2
BIG-IP LTM
- 14.1.2
BIG-IP PEM
- 14.1.2
BIG-IP AFM
- 14.1.2
BIG-IP FPS
- 14.1.2
BIG-IP DNS
- 14.1.2
BIG-IP ASM
- 14.1.2
BIG-IP Release Information
Version: 14.1.2.5
Build: 3.0
BIG-IP version 14.1.2.5 contains all the fixes from v14.1.2.4, without the issue that necessitated replacement of the v14.1.2.4 release.
Cumulative fixes from BIG-IP v14.1.2.4 that are included in this release
Cumulative fixes from BIG-IP v14.1.2.3 that are included in this release
Cumulative fixes from BIG-IP v14.1.2.2 that are included in this release
Cumulative fixes from BIG-IP v14.1.2.1 that are included in this release
Cumulative fixes from BIG-IP v14.1.2 that are included in this release
Cumulative fixes from BIG-IP v14.1.1 that are included in this release
Cumulative fixes from BIG-IP v14.1.0.6 that are included in this release
Cumulative fixes from BIG-IP v14.1.0.5 that are included in this release
Cumulative fixes from BIG-IP v14.1.0.4 that are included in this release
Cumulative fixes from BIG-IP v14.1.0.3 that are included in this release
Cumulative fixes from BIG-IP v14.1.0.2 that are included in this release
Cumulative fixes from BIG-IP v14.1.0.1 that are included in this release
Known Issues in BIG-IP v14.1.x
Functional Change Fixes
None
Cumulative fixes from BIG-IP v14.1.2.4 that are included in this release
Vulnerability Fixes
ID Number | CVE | Solution Article(s) | Description |
866013 | CVE-2019-11477 CVE-2019-11478 CVE-2019-11479 |
K78234183 | Linux Kernel Vulnerabilities: CVE-2019-11477 CVE-2019-11478 CVE-2019-11479 |
852445-3 | CVE-2019-6477 | K15840535 | Big-IP : CVE-2019-6477 BIND Vulnerability |
839453-4 | CVE-2019-10744 | K47105354 | lodash library vulnerability CVE-2019-10744 |
838677-3 | CVE-2019-10744 | K47105354 | lodash library vulnerability CVE-2019-10744 |
830401-3 | CVE-2020-5877 | K54200228 | TMM may crash while processing TCP traffic with iRules |
819197-4 | CVE-2019-13135 | K20336394 | BIGIP: CVE-2019-13135 ImageMagick vulnerability |
819189-3 | CVE-2019-13136 | K03512441 | BIGIP: CVE-2019-13136 ImageMagick vulnerability |
805837-2 | CVE-2019-6657 | K22441651 | REST does not follow current design best practices |
802261-2 | CVE-2020-5875 | K65372933 | TMM may crash while processing SSL traffic via an HTTP/2 full-proxy |
794561-1 | CVE-2020-5874 | K46901953 | TMM may crash while processing JWT/OpenID traffic. |
780601-2 | CVE-2020-5873 | K03585731 | SCP file transfer hardening |
769589-2 | CVE-2019-6974 | K11186236 | CVE-2019-6974: Linux Kernel Vulnerability |
767373-1 | CVE-2019-8331 | K24383845 | CVE-2019-8331: Bootstrap Vulnerability |
762453-2 | CVE-2020-5872 | K63558580 | Hardware cryptography acceleration may fail |
745377-1 | CVE-2020-5871 | K43450419 | TMM cores in certain scenarios with HTTP virtual server |
739971 | CVE-2018-5391 | K95343321 | Linux kernel vulnerability: CVE-2018-5391 |
873469-1 | CVE-2020-5889 | K24415506 | APM Portal Access: Base URL may be set to incorrectly |
864109-3 | CVE-2020-5889 | K24415506 | APM Portal Access: Base URL may be set to incorrectly |
838881-3 | CVE-2020-5853 | K73183618 | APM Portal Access Vulnerability: CVE-2020-5853 |
832021-1 | CVE-2020-5888 | K73274382 | Port lockdown settings may not be enforced as configured |
832017-1 | CVE-2020-5887 | K10251014 | Port lockdown settings may not be enforced as configured |
829121-3 | CVE-2020-5886 | K65720640 | State mirroring default does not require TLS |
829117-3 | CVE-2020-5885 | K17663061 | State mirroring default does not require TLS |
810537-2 | CVE-2020-5883 | K12234501 | TMM may consume excessive resources while processing iRules |
805557-2 | CVE-2020-5882 | K43815022 | TMM may crash while processing crypto data |
789921-2 | CVE-2020-5881 | K03386032 | TMM may restart while processing VLAN traffic |
775833-2 | CVE-2020-5880 | K94325657 | Administrative file transfer may lead to excessive resource consumption |
887637-1 | CVE-2019-3815 | K22040951 | Systemd-journald Vulnerability: CVE-2019-3815 |
868097-1 | CVE-2020-5891 | K58494243 | TMM may crash while processing HTTP/2 traffic |
823893-2 | CVE-2020-5890 | K03318649 | Qkview may fail to completely sanitize LDAP bind credentials |
748122-1 | CVE-2018-15333 | K53620021 | BIG-IP Vulnerability CVE-2018-15333 |
746091-1 | CVE-2019-19151 | K21711352 | TMSH Vulnerability: CVE-2019-19151 |
760723-2 | CVE-2015-4037 | K64765350 | Qemu Vulnerability |
Functional Change Fixes
ID Number | Severity | Solution Article(s) | Description |
870389-1 | 3-Major | Increase size of /var logical volume to 1.5 GiB for LTM-only VE images | |
859089-5 | 3-Major | TMSH allows SFTP utility access | |
858229-3 | 3-Major | XML with sensitive data gets to the ICAP server | |
837837-3 | 3-Major | SSH Client Requirements Hardening | |
738330-3 | 3-Major | /mgmt/toc endpoint issue after configuring remote authentication |
TMOS Fixes
ID Number | Severity | Solution Article(s) | Description |
872673-3 | 2-Critical | TMM can crash when processing SCTP traffic | |
819009-3 | 2-Critical | Dynamic routing daemon mribd crashes if 'mrib debug all' is enabled in high availability (HA) config with Floating Self IP configured for PIM protocol. | |
814953-3 | 2-Critical | TMUI dashboard hardening | |
792285-2 | 2-Critical | TMM crashes if the queuing message to all HSL pool members fails | |
777993-2 | 2-Critical | Egress traffic to a trunk is pinned to one link for TCP/UDP traffic when L4 source port and destination port are the same | |
775897-1 | 2-Critical | High Availability failover restarts tmipsecd when tmm connections are closed | |
769169-3 | 2-Critical | BIG-IP system with large configuration becomes unresponsive with BIG-IQ monitoring | |
767689-1 | 2-Critical | F5optics_install using different versions of RPM★ | |
749388-3 | 2-Critical | 'table delete' iRule command can cause TMM to crash | |
748205-3 | 2-Critical | SSD bay identification incorrect for RAID drive replacement★ | |
699515-2 | 2-Critical | nsm cores during update of nexthop for ECMP recursive route | |
882557-4 | 3-Major | TMM restart loop if virtio platform specifies RX or TX queue sizes that are too large (4096 or higher) | |
873877 | 3-Major | Kernel page allocation failure seen on VIPRION B2250 Blade★ | |
866925-3 | 3-Major | The TMM pages used and available can be viewed in the F5 system stats MIB | |
852001-3 | 3-Major | High CPU utilization of MCPD when adding multiple devices to trust domain simultaneously | |
849405-1 | 3-Major | LTM v14.1.2.1 does not log after upgrade★ | |
842125-4 | 3-Major | Unable to reconnect outgoing SCTP connections that have previously aborted | |
812981-4 | 3-Major | MCPD: memory leak on standby BIG-IP device | |
811789-2 | 3-Major | Device trust UI hardening | |
810957-2 | 3-Major | Changing a virtual server's destination address from IPv6 to IPv4 can cause tmrouted to core | |
802281-1 | 3-Major | Gossip shows active even when devices are missing | |
800185-4 | 3-Major | Saving a large encrypted UCS archive may fail and might trigger failover | |
795685-2 | 3-Major | Bgpd crash upon displaying BGP notify (OUT_OF_RESOURCES) info from peer | |
772117-3 | 3-Major | Overwriting FIPS keys from the HA peer with older config leads to abandoned key on FIPS card | |
759735-2 | 3-Major | OSPF ASE route calculation for new external-LSA delayed | |
759172-1 | 3-Major | Read Access Denied: user (gu, guest) type (Certificate Order Manager) | |
758387-2 | 3-Major | BIG-IP floods packet with MAC '01-80-c2-00-00-00' to VLAN instead of dropping it | |
751573-1 | 3-Major | Updates to HSL pool members may not take effect | |
749785-2 | 3-Major | nsm can become unresponsive when processing recursive routes | |
749690-1 | 3-Major | MOS_Image2Disk_Installation- kjournald service error★ | |
746861-1 | 3-Major | SFP interfaces fail to come up on BIG-IP 2x00/4x00, usually when both SFP interfaces are populated★ | |
641450-7 | 3-Major | K30053855 | A transaction that deletes and recreates a virtual may result in an invalid configuration |
755317-1 | 4-Minor | /var/log logical volume may run out of space due to agetty error message in /var/log/secure |
Local Traffic Manager Fixes
ID Number | Severity | Solution Article(s) | Description |
715032-2 | 1-Blocking | iRulesLX Hardening | |
868349-3 | 2-Critical | TMM may crash while processing iRules with MQTT commands | |
860881-1 | 2-Critical | TMM can crash when handling a compressed response from HTTP server | |
853329-4 | 2-Critical | HTTP explicit proxy can crash TMM when used with classification profile | |
839401-3 | 2-Critical | Moving a virtual-address from one floating traffic-group to another does not send GARPs out. | |
831325-2 | 2-Critical | K10701310 | HTTP PSM detects more issues with Transfer-Encoding headers |
799649-2 | 2-Critical | TMM crash | |
757391-2 | 2-Critical | Datagroup iRule command class can lead to memory corruption | |
755134-1 | 2-Critical | HTTP/2 connections may leak memory if server-side connection not established | |
879025-4 | 3-Major | When processing server-side TLS traffic, LTM may not enforce certificate chain restrictions | |
868889 | 3-Major | BIG-IP may reset a stream with an empty DATA frame as END_STREAM | |
853613-2 | 3-Major | Improve interaction of TCP's verified accept and tm.tcpsendrandomtimestamp | |
851789-3 | 3-Major | SSL monitors flap with client certs with private key stored in FIPS | |
848405-4 | 3-Major | TMM may consume excessive resources while processing compressed HTTP traffic | |
847325-1 | 3-Major | Changing a virtual server that uses a oneconnect profile can trigger persistence misbehavior. | |
843105-1 | 3-Major | Adding multicast stats for multicast bridging over L2 wire transparent VLAN-group (LACP STP LLDP) | |
834257-3 | 3-Major | TMM may crash when processing HTTP traffic | |
809729-2 | 3-Major | When HTTP/2 stream is reset by a client, BIG-IP may not respond properly | |
795261-2 | 3-Major | LTM policy does not properly evaluate condition when an operand is missing | |
788741-2 | 3-Major | TMM cores in the MQTT proxy under rare conditions | |
777269-1 | 3-Major | Gratuitous ARP may be sent for self IPs from incorrect MAC address at startup | |
770477-2 | 3-Major | SSL aborted when client_hello includes both renegotiation info extension and SCSV | |
761030-2 | 3-Major | tmsh show net route lookup is not showing for IPv4-mapped IPv6 address route | |
758631-4 | 3-Major | ec_point_formats extension might be included in the server hello even if not specified in the client hello | |
757827-1 | 3-Major | Allow duplicate FQDN ephemeral create/delete for more reliable FQDN resolution | |
755997-2 | 3-Major | Non-IPsec listener traffic, i.e. monitoring traffic, can be translated to incorrect source address | |
755727-2 | 3-Major | Ephemeral pool members not created after DNS flap and address record changes | |
755213-1 | 3-Major | TMM cores in certain scenarios with HTTP/2 virtual server | |
751052-1 | 3-Major | HTTP iRule event HTTP_REJECT broken | |
746078-1 | 3-Major | Upgrades break existing iRulesLX workspaces that use node version 6 | |
745923-2 | 3-Major | Connection flow collision can cause packets to be sent with source and/or destination port 0 | |
743257-3 | 3-Major | Fix block size insecurity init and assign | |
705112-4 | 3-Major | DHCP server flows are not re-established after expiration | |
636842-2 | 3-Major | K51472519 | A FastL4 virtual server may drop a FIN packet when mirroring is enabled |
601189-4 | 3-Major | The BIG-IP system might send TCP packets out of order in fastl4 in syncookie mode | |
599567-4 | 3-Major | APM assumes SNAT automap, does not use SNAT pool | |
859113-3 | 4-Minor | Using "reject" iRules command inside "after" may causes core | |
852373-2 | 4-Minor | HTTP2::disable or enable breaks connection when used in iRule and logs Tcl error | |
830833-2 | 4-Minor | HTTP PSM blocking resets should have better log messages | |
760683-1 | 4-Minor | RST from non-floating self-ip may use floating self-ip source mac-address | |
757777-3 | 4-Minor | bigtcp does not issue a RST in all circumstances | |
746077-4 | 4-Minor | If the 'giaddr' field contains a non-zero value, the 'giaddr' field must not be modified |
Global Traffic Manager (DNS) Fixes
ID Number | Severity | Solution Article(s) | Description |
807177-2 | 2-Critical | HTTPS monitoring is not caching SSL sessions correctly | |
704198-4 | 2-Critical | K29403988 | Replace-all-with can leave orphaned monitor_rule, monitor_rule_instance, and monitor_instance |
802961-2 | 3-Major | The 'any-available' prober selection is not as random as in earlier versions | |
772233-4 | 3-Major | IPv6 RTT metric is not set when using collection protocols DNS_DOT and DNS_REV. | |
754901-1 | 3-Major | Frequent zone update notifications may cause TMM to restart | |
750213-4 | 3-Major | K25351434 | DNS FPGA Hardware-accelerated Cache can improperly respond to DNS queries that contain EDNS OPT Records. |
744280-2 | 4-Minor | Enabling or disabling a Distributed Application results in a small memory leak |
Application Security Manager Fixes
ID Number | Severity | Solution Article(s) | Description |
858025-3 | 2-Critical | Proactive Bot Defense does not validate redirected paths | |
852437-1 | 2-Critical | K25037027 | Overly aggressive file cleanup causes failed ASU installation |
883717-3 | 3-Major | BD crash on specific server cookie scenario | |
882377-1 | 3-Major | ASM Application Security Editor Role User can update/install ASU | |
871905-1 | 3-Major | Incorrect masking of parameters in event log | |
854177-3 | 3-Major | ASM latency caused by frequent pool IP updates that are unrelated to ASM functionality | |
850673-3 | 3-Major | BD sends bad acks to the bd_agent for configuration | |
681010-3 | 3-Major | K33572148 | 'Referer' is not masked when 'Query String' contains sensitive parameter |
Application Visibility and Reporting Fixes
ID Number | Severity | Solution Article(s) | Description |
838709-1 | 2-Critical | Enabling DoS stats also enables page-load-time | |
828937-3 | 2-Critical | K45725467 | Some systems can experience periodic high IO wait due to AVR data aggregation |
870957-1 | 3-Major | "Security ›› Reporting : ASM Resources : CPU Utilization" shows TMM has 100% CPU usage | |
863161-3 | 3-Major | Scheduled reports are sent via TLS even if configured as non encrypted | |
835381-1 | 3-Major | HTTP custom analytics profile 'not found' when default profile is modified | |
830073-3 | 3-Major | AVRD may core when restarting due to data collection device connection timeout | |
817649-2 | 3-Major | AVR statistics for NAT cannot be shown on multi-bladed machine | |
865053-1 | 4-Minor | AVRD core due to a try to load vip lookup when AVRD is down | |
863069-3 | 4-Minor | Avrmail timeout is too small |
Access Policy Manager Fixes
ID Number | Severity | Solution Article(s) | Description |
879401-3 | 2-Critical | Memory corruption during APM SAML SSO | |
871761-4 | 2-Critical | Unexpected FIN from APM virtual server during Access Policy evaluation if XML profile is configured for VS | |
858349-1 | 2-Critical | TMM may crash while processing SAML SLO traffic | |
788593-2 | 2-Critical | K43404365 | APM logs may contain additional data |
884797-2 | 3-Major | Portal Access: in some cases data is not delivered via WebSocket connection | |
866685-3 | 3-Major | Empty HSTS headers when HSTS mode for HTTP profile is disabled | |
866161-3 | 3-Major | Client port reuse causes RST when the security service attempts server connection reuse. | |
852313-2 | 3-Major | VMware Horizon client cannot connect to APM after some time if 'Kerberos Authentication' is configured | |
832569-2 | 3-Major | APM end-user connection reset | |
831781-5 | 3-Major | AD Query and LDAP Auth/Query fails with IPv6 server address in Direct mode | |
798261-2 | 3-Major | APMD fails to create session variables if spanning is enabled on SWG transparent virtual server | |
771905-2 | 3-Major | JWT token rejected due to unknown JOSE header parameters | |
768025-4 | 3-Major | SAML requests/responses fail with "failed to find certificate" | |
749036-2 | 3-Major | Some tmsh list commands may fail with message 'Password could not be retrieved' when SSLO is provisioned but not APM | |
747725-3 | 3-Major | Kerberos Auth agent may override settings that manually made to krb5.conf | |
747624-2 | 3-Major | RADIUS Authentication over RSA SecureID is not working in challenge mode |
Service Provider Fixes
ID Number | Severity | Solution Article(s) | Description |
811105-1 | 2-Critical | MRF SIP-ALG drops SIP 183 and 200 OK messages | |
781725-2 | 2-Critical | BIG-IP systems might not complete a short ICAP request with a body beyond the preview | |
882273 | 3-Major | MRF Diameter: memory leak during server down and reconnect attempt which leads to tmm crash and memory usage grow | |
876077-3 | 3-Major | MRF DIAMETER: stale pending retransmission entries may not be cleaned up | |
868381-3 | 3-Major | MRF DIAMETER: Retransmission queue unable to delete stale entries | |
866021-3 | 3-Major | Diameter Mirror connection lost on the standby due to "process ingress error" | |
853545-3 | 3-Major | MRF GenericMessage: Memory leaks if messages are dropped via iRule during GENERICMESSAGE_INGRESS event | |
824149-3 | 3-Major | SIP ALG virtual with source-nat-policy cores if traffic does not match the source-nat-policy or matches the source-nat-policy which does not have source-translation configured | |
815877-1 | 3-Major | Information Elements with zero-length value are rejected by the GTP parser | |
811033-2 | 3-Major | MRF: BiDirectional pesistence does not work in reverse direction if different transport protocols are used | |
788093 | 3-Major | MRF iRule command MR::restore with no argument causes tmm to crash | |
859721-3 | 4-Minor | Using GENERICMESSAGE create together with reject inside periodic after may cause core | |
836357-3 | 4-Minor | SIP MBLB incorrectly initiates new flow from virtual IP to client when existing flow is in FIN-wait2 | |
788005-2 | 4-Minor | Bypass MRF SIP LB restriction of conversion from reliable transport (TCP) to unreliable transport (UDP) |
Advanced Firewall Manager Fixes
ID Number | Severity | Solution Article(s) | Description |
778869-3 | 2-Critical | K72423000 | ACLs and other AFM features (e.g., IPI) may not function as designed |
751292-1 | 2-Critical | mcpd core after changing parent netflow to use version9 | |
852289-2 | 3-Major | DNS over TCP packet is not rate-limited accurately by DoS device sweep/flood vector | |
771173-3 | 3-Major | FastL4 profile syn-cookie-enable attribute is not being rolled forward correctly.★ |
Fraud Protection Services Fixes
ID Number | Severity | Solution Article(s) | Description |
857725 | 3-Major | Anti-Fraud/DataSafe Logging Settings page not found |
Traffic Classification Engine Fixes
ID Number | Severity | Solution Article(s) | Description |
761199-1 | 2-Critical | Wr_urldbd might crash while system is in a restarting loop. | |
816529-2 | 3-Major | If wr_urldbd is restarted while queries are being run against Custom DB then further lookups can not be made after wr_urldbd comes back up from restart. |
Device Management Fixes
ID Number | Severity | Solution Article(s) | Description |
839597-4 | 3-Major | Restjavad fails to start if provision.extramb has large value | |
837773-2 | 3-Major | Restjavad Storage and Configuration Hardening | |
815649-1 | 3-Major | Named.config entry getting overwriting on SSL Orchestrator deployment |
Cumulative fixes from BIG-IP v14.1.2.3 that are included in this release
Vulnerability Fixes
ID Number | CVE | Solution Article(s) | Description |
846365-3 | CVE-2020-5878 | K35750231 | TMM may crash while processing IP traffic |
818709-2 | CVE-2020-5858 | K36814487 | TMSH does not follow current best practices |
818429-4 | CVE-2020-5857 | K70275209 | TMM may crash while processing HTTP traffic |
808301-2 | CVE-2019-6678 | K04897373 | TMM may crash while processing IP traffic |
757357-3 | CVE-2019-6676 | K92002212 | TMM may crash while processing traffic |
782529-2 | CVE-2019-6685 | K30215839 | iRules does not follow current design best practices |
761144-4 | CVE-2019-6684 | K95117754 | Broadcast frames may be dropped |
761112-3 | CVE-2019-6683 | K76328112 | TMM may consume excessive resources when processing FastL4 traffic |
725551-2 | CVE-2019-6682 | K40452417 | ASM may consume excessive resources |
846157-3 | CVE-2020-5862 | K01054113 | TMM may crash while processing traffic on AWS |
817917-1 | CVE-2020-5856 | K00025388 | TMM may crash when sending TCP packets |
789893-2 | CVE-2019-6679 | K54336216 | SCP file transfer hardening |
749324-1 | CVE-2012-6708 | K62532311 | jQuery Vulnerability: CVE-2012-6708 |
738236-7 | CVE-2019-6688 | K25607522 | UCS does not follow current best practices |
Functional Change Fixes
ID Number | Severity | Solution Article(s) | Description |
819397-1 | 1-Blocking | TMM does not enforce RFC compliance when processing HTTP traffic | |
769193-5 | 3-Major | Added support for faster congestion window increase in slow-start for stretch ACKs | |
760234-1 | 4-Minor | Configuring Advanced shell for Resource Administrator User has no effect |
TMOS Fixes
ID Number | Severity | Solution Article(s) | Description |
806093-1 | 2-Critical | Unwanted LDAP referrals slow or prevent administrative login | |
789169-2 | 2-Critical | Unable to create virtual servers with port-lists from the GUI★ | |
780817-5 | 2-Critical | TMM can crash on certain vCMP hosts after modifications to VLANs and guests. | |
762385 | 2-Critical | Wrong remote-role assigned using LDAP authentication after upgrade to 14.1.x and later★ | |
762205-2 | 2-Critical | IKEv2 rekey fails to recognize VENDOR_ID payload when it appears | |
809205 | 3-Major | CVE-2019-3855: libssh2 Vulnerability | |
794501-2 | 3-Major | Duplicate if_indexes and OIDs between interfaces and tunnels | |
785741-1 | 3-Major | K19131357 | Unable to login using LDAP with 'user-template' configuration |
778125-1 | 3-Major | LDAP remote authentication passwords are limited to fewer than 64 bytes | |
760439-4 | 3-Major | After installing a UCS that was taken in forced-offline state, the unit may release forced-offline status | |
760259-3 | 3-Major | Qkview silently fails to capture qkviews from other blades | |
759654-1 | 3-Major | LDAP remote authentication with remote roles and user-template failing | |
759499-2 | 3-Major | Upgrade from version 12.1.3.7 to version 14.1.0 failing with error★ | |
758781-3 | 3-Major | iControl SOAP get_certificate_list commands take a long time to complete when there are a large number of certificates | |
758527-2 | 3-Major | K39604784 | BIG-IP system forwards BPDUs with 802.1Q header when in STP pass-through mode |
757519-1 | 3-Major | Unable to login using LDAP authentication with a user-template | |
756450-1 | 3-Major | Traffic using route entry that's more specific than existing blackhole route can cause core | |
754691-1 | 3-Major | During failover, an OSPF routing daemon may crash. | |
750318-3 | 3-Major | HTTPS monitor does not appear to be using cert from server-ssl profile | |
746266-3 | 3-Major | Vcmp guest vlan mac mismatch across blades. | |
738943-3 | 3-Major | imish command hangs when ospfd is enabled |
Local Traffic Manager Fixes
ID Number | Severity | Solution Article(s) | Description |
816273-2 | 1-Blocking | L7 Policies may execute CONTAINS operands incorrectly. | |
826601-5 | 2-Critical | Prevent receive window shrinkage for looped flows that use a SYN cookie | |
817417-1 | 2-Critical | Blade software installation stalled at Waiting for product image★ | |
816625-1 | 2-Critical | The TMM may crash in a rare scenario involving HTTP unchunking, and plugins. | |
800369-2 | 2-Critical | The fix for ID 770797 may cause a TMM crash | |
800305-2 | 2-Critical | VDI::cmp_redirect generates flow with random client port | |
791057-1 | 2-Critical | MCP may crash when traffic matching criteria is updated | |
770797-1 | 2-Critical | HTTP2 streams may get stuck in rare situations | |
836661 | 3-Major | Incorrect source MAC used when the BIG-IP system in L2 transparent mode generates a TCP RST packet. | |
834373-3 | 3-Major | Possible handshake failure with TLS 1.3 early data | |
830797-2 | 3-Major | Standby high availability (HA) device passes traffic through virtual wire | |
815449-2 | 3-Major | BIG-IP closes connection when an unsized response is served to a HEAD request | |
797977-1 | 3-Major | Self-IP traffic does not preserve the TTL from the Linux host | |
789365-1 | 3-Major | pkcs11d CPU usage increases after running nethsm self validation test | |
772545-3 | 3-Major | Tmm core in SSLO environment | |
765517-1 | 3-Major | Traffic Match Criteria validation fails when create Virtual server with address list with overlapping address space but a different ingress VLAN | |
761185-2 | 3-Major | K50375550 | Specifically crafted requests may lead the BIG-IP system to pass malformed HTTP traffic |
760771-1 | 3-Major | FastL4-steered traffic might cause SSL resume handshake delay | |
758992-2 | 3-Major | The BIG-IP may use the traffic-group MAC address rather than a per-VLAN MAC address | |
758872-3 | 3-Major | TMM memory leak | |
758655-1 | 3-Major | TMC does not allow inline addresses with non-zero Route-domain. | |
753514-3 | 3-Major | Large configurations containing LTM Policies load slowly | |
749689-2 | 3-Major | HTTPS monitor sends different number of cipher suites in client hello after config load and bigd restart | |
726176-2 | 3-Major | Platforms using RSS hash reuse source port too rapidly when the FastL4 virtual server is set to source-port preserve | |
712919-2 | 3-Major | Removing an iRule from a Virtual Server may prevent executing other iRules on the same Virtual Server. | |
687887-3 | 3-Major | Unexpected result from multiple changes to a monitor-related object in a single transaction | |
824365-3 | 4-Minor | Need informative messages for HTTP iRule runtime validation errors | |
806085-2 | 4-Minor | In-TMM MQTT monitor is not working as expected | |
791337-1 | 4-Minor | Traffic matching criteria fails when using shared port-list with virtual servers | |
769309-2 | 4-Minor | DB monitor reconnects to server on every probe when count = 0 | |
754003-3 | 4-Minor | K73202036 | Configuring SSL Forward Proxy and an OCSP stapling profile may allow a connection to a website with a revoked certificate |
747628-1 | 4-Minor | BIG-IP sends spurious ICMP PMTU message to server | |
744210-2 | 4-Minor | DHCPv6 does not have the ability to override the hop limit from the client. |
Performance Fixes
ID Number | Severity | Solution Article(s) | Description |
776133-1 | 2-Critical | RSS hash is not used on VE resulting in performance impact on non-SR-IOV devices |
Global Traffic Manager (DNS) Fixes
ID Number | Severity | Solution Article(s) | Description |
761032-2 | 3-Major | K36328238 | TMSH displays TSIG keys |
760471-3 | 3-Major | GTM iQuery connections may be reset during SSL key renegotiation. |
Application Security Manager Fixes
ID Number | Severity | Solution Article(s) | Description |
813945-3 | 2-Critical | PB core dump while processing many entities | |
813389-1 | 2-Critical | TMM Crashes upon failure in Bot Defense Client-Side code | |
791669 | 2-Critical | TMM might crash when Bot Defense is configured for multiple domains | |
790349-2 | 2-Critical | merged crash with a core file | |
756108-1 | 2-Critical | BD crash on specific cases | |
754109-1 | 2-Critical | ASM/Bot-Defense/DoSL7 content-security-policy header modification violates Content Security Policy directive | |
832857 | 3-Major | Support ID on AJAX CAPTCHA popup (SPA) does not match the Support ID in log | |
832205 | 3-Major | ASU cannot be completed after Signature Systems database corruption following binary Policy import | |
831661-2 | 3-Major | ASMConfig Handler undergoes frequent restarts | |
824101-1 | 3-Major | Request Log export file is not visible for requests including binary data | |
824037-2 | 3-Major | Bot Defense whitelists do not apply for IP 'Any' when using route domains | |
812341-2 | 3-Major | Patch or Delete commands take a long time to complete when modifying an ASM signature set. | |
805353-1 | 3-Major | ASM reporting for WebSocket frames has empty username field | |
800453-3 | 3-Major | False positive virus violations | |
793017-1 | 3-Major | Files left behind by failed Attack Signature updates are not cleaned | |
786913-2 | 3-Major | Upgrade failure from 13.0.x or earlier when using LTM Policies with DOSL7 | |
783513-2 | 3-Major | ASU is very slow on device with hundreds of policies due to logging profile handling | |
781021-2 | 3-Major | ASM modifies cookie header causing it to be non-compliant with RFC6265 | |
778681-2 | 3-Major | Factory-included Bot Signature update file cannot be installed without subscription★ | |
754841-1 | 3-Major | Policy updates stall and never complete | |
754425-1 | 3-Major | Exported requests cannot be opened in Internet Explorer or Edge browser | |
734228 | 3-Major | False-positive illegal-length violation can appear | |
795769-3 | 4-Minor | Incorrect value of Systems in system-supplied signature sets | |
789817-1 | 4-Minor | In rare conditions info fly-out not shown | |
760462-1 | 4-Minor | Live update notification is shown only for provisioned/licensed modules | |
758459-1 | 4-Minor | Cross origin AJAX requests are blocked Cross-Origin Resource Sharing (CORS) protection | |
620301-1 | 4-Minor | Policy import fails due to missing signature System in associated Signature Set |
Application Visibility and Reporting Fixes
ID Number | Severity | Solution Article(s) | Description |
833113-3 | 3-Major | Avrd core when sending large messages via https | |
787677-3 | 3-Major | AVRD stays at 100% CPU constantly on some systems | |
781581-3 | 3-Major | Monpd uses excessive memory on requests for network_log data |
Access Policy Manager Fixes
ID Number | Severity | Solution Article(s) | Description |
757782-1 | 2-Critical | OAuth Authorization Server returns an invalid 'sub' claim in JWT access token when 'subject' field is configured to be a session variable other than the default | |
825805-1 | 3-Major | NTLM Auth may fail due to incorrect handling of EPM response★ | |
766577-2 | 3-Major | APMD fails to send response to client and it already closed connection. | |
756363-1 | 3-Major | SSLO or SWG connections using proxy chaining to Explicit Proxy can get reset | |
741222-2 | 3-Major | Install epsec1.0.0 into software partition.★ | |
643935-4 | 3-Major | Rewriting may cause an infinite loop while processing some objects |
WebAccelerator Fixes
ID Number | Severity | Solution Article(s) | Description |
833213-3 | 3-Major | Conditional requests are served incorrectly with AAM policy in webacceleration profile |
Advanced Firewall Manager Fixes
ID Number | Severity | Solution Article(s) | Description |
802865-1 | 3-Major | The iControl REST query request returning empty list for DoS Protected Objects | |
761345-3 | 3-Major | Additional config-sync may be required after blob compilation on a HA setup in manual config-sync mode | |
738284-2 | 3-Major | Creating or deleting rule list results in warning message: Schema object encode failed |
Fraud Protection Services Fixes
ID Number | Severity | Solution Article(s) | Description |
821133-2 | 3-Major | Wrong wildcard URL matching when none of the configured URLS include QS |
Anomaly Detection Services Fixes
ID Number | Severity | Solution Article(s) | Description |
748813-3 | 2-Critical | tmm cores under stress test on virtual server with DoS profile with admd enabled | |
767045-2 | 3-Major | TMM cores while applying policy |
Protocol Inspection Fixes
ID Number | Severity | Solution Article(s) | Description |
787845 | 4-Minor | Tmsh command 'show running-config' fails when Protocol Inspection is not licensed. |
Cumulative fixes from BIG-IP v14.1.2.2 that are included in this release
Vulnerability Fixes
ID Number | CVE | Solution Article(s) | Description |
741163-3 | CVE-2018-3693 | K54252492 | RHEL7: Kernel CVE-2018-3693 |
740755-6 | CVE-2018-3620 | K95275140 | Kernel vulnerability: CVE-2018-3620 |
721319-1 | CVE-2018-3639 | K29146534 | CVE-2018-3639 |
Functional Change Fixes
None
TMOS Fixes
ID Number | Severity | Solution Article(s) | Description |
815689-3 | 3-Major | Azure walinuxagent has been updated to v2.2.42. | |
760574 | 3-Major | Updating BIG-IP 14.1.x Linux kernel to RHEL7.5 |
Cumulative fixes from BIG-IP v14.1.2.1 that are included in this release
Vulnerability Fixes
ID Number | CVE | Solution Article(s) | Description |
795437-4 | CVE-2019-6677 | K06747393 | Improve handling of TCP traffic for iRules |
795197-1 | CVE-2019-11477, CVE-2019-11478, CVE-2019-11479 | K26618426 | Linux Kernel Vulnerabilities: CVE-2019-11477, CVE-2019-11478, CVE-2019-11479 |
781377-2 | CVE-2019-6681 | K93417064 | tmrouted may crash while processing Multicast Forwarding Cache messages |
778077-3 | CVE-2019-6680 | K53183580 | Virtual to virtual chain can cause TMM to crash |
771873-5 | CVE-2019-6642 | K40378764 | TMSH Hardening |
767653-1 | CVE-2019-6660 | K23860356 | Malformed HTTP request can result in endless loop in an iRule script |
636400-3 | CVE-2019-6665 | K26462555 | CPB (BIG-IP->BIGIQ log node) Hardening |
810657-2 | CVE-2019-6674 | K21135478 | Tmm core while using service chaining for SSLO |
809165-2 | CVE-2020-5854 | K50046200 | TMM may crash will processing connector traffic |
808525-2 | CVE-2019-6686 | K55812535 | TMM may crash while processing Diameter traffic |
795797-2 | CVE-2019-6658 | K21121741 | AFM WebUI Hardening |
788773-2 | CVE-2019-9515 | K50233772 | HTTP/2 Vulnerability: CVE-2019-9515 |
788769-2 | CVE-2019-9514 | K01988340 | HTTP/2 Vulnerability: CVE-2019-9514 |
788033 | CVE-2020-5851 | K91171450 | tpm-status may return "Invalid" after engineering hotfix installation |
781449-2 | CVE-2019-6672 | K14703097 | Increase efficiency of sPVA DoS protection on wildcard virtual servers |
777737-3 | CVE-2019-6671 | K39225055 | TMM may consume excessive resources when processing IP traffic |
773673-2 | CVE-2019-9512 | K98053339 | HTTP/2 Vulnerability: CVE-2019-9512 |
768981-2 | CVE-2019-6670 | K05765031 | vCMP Hypervisor Hardening |
761014-2 | CVE-2019-6669 | K11447758 | TMM may crash while processing local traffic |
758018-5 | CVE-2019-6661 | K61705126 | APD/APMD may consume excessive resources |
756458-3 | CVE-2018-18559 | K28241423 | Linux kernel vulnerability: CVE-2018-18559 |
756218-1 | CVE-2019-6654 | K45644893 | Improve default management port firewall |
751152-1 | CVE-2018-5407 | K49711130 | OpenSSL Vulnerability: CVE-2018-5407 |
751143-1 | CVE-2018-5407 | K49711130 | OpenSSL Vulnerability: CVE-2018-5407 |
745103-6 | CVE-2018-7159 | K27228191 | NodeJS Vulnerability: CVE-2018-7159 |
798249-2 | CVE-2019-6673 | K81557381 | TMM may crash while processing HTTP/2 requests |
779177-2 | CVE-2019-19150 | K37890841 | Apmd logs "client-session-id" when access-policy debug log level is enabled |
759536-2 | CVE-2019-8912 | K31739796 | Linux kernel vulnerability: CVE-2019-8912 |
757617-1 | CVE-2018-16864 CVE-2018-16865 |
K06044762 | Systemd vulnerabilities: CVE-2018-16864, CVE-2018-16865 |
Functional Change Fixes
ID Number | Severity | Solution Article(s) | Description |
759135-2 | 3-Major | AVR report limits are locked at 1000 transactions | |
714292-3 | 3-Major | Transparent forwarding mode across multiple VLAN groups or virtual-wire | |
788269-3 | 4-Minor | Adding toggle to disable AVR widgets on device-groups |
TMOS Fixes
ID Number | Severity | Solution Article(s) | Description |
793045-2 | 2-Critical | File descriptor leak in net-snmpd while reading /shared/db/cluster.conf | |
770953 | 2-Critical | 'smbclient' executable does not work | |
767877-3 | 2-Critical | TMM core with Bandwidth Control on flows egressing on a VLAN group | |
765533-2 | 2-Critical | K58243048 | Sensitive information logged when DEBUG logging enabled |
760475-1 | 2-Critical | Apache spawns more processes than the configured limit, causing system low memory condition | |
755575-1 | 2-Critical | In MOS, the 'image2disk' utility with the '-format' option does not function properly | |
726240-1 | 2-Critical | 'Cannot find disk information' message when running Configuration Utility★ | |
788557-5 | 3-Major | BGP and BFD sessions are reset in GRST timeout period if bgpd daemon is restarted prior | |
788301-5 | 3-Major | K58243048 | SNMPv3 Hardening |
777261-4 | 3-Major | When SNMP cannot locate a file it logs messages repeatedly | |
766873 | 3-Major | Omission of lower-layer types from sFlow packet samples | |
761993-2 | 3-Major | The nsm process may crash if it detects a nexthop mismatch | |
761933-1 | 3-Major | Reboot with 'tmsh reboot' does not log message in /var/log/audit | |
761160-2 | 3-Major | OpenSSL vulnerability: CVE-2019-1559 | |
760998-1 | 3-Major | F5.ip_forwarding iAPP fails to deploy | |
759814-1 | 3-Major | Unable to view iApp component view★ | |
758119-6 | 3-Major | K58243048 | qkview may contain sensitive information |
747592-1 | 3-Major | PHP vulnerability CVE-2018-17082 | |
724109-2 | 3-Major | Manual config-sync fails after pool with FQDN pool members is deleted | |
648621-6 | 3-Major | SCTP: Multihome connections may not expire | |
776073-1 | 4-Minor | OOM killer killing tmm in system low memory condition as process OOM score is high | |
760680-1 | 4-Minor | TMSH may utilize 100% CPU (single core's worth) when set to be a process group leader and SSH session is closed. |
Local Traffic Manager Fixes
ID Number | Severity | Solution Article(s) | Description |
759968-3 | 1-Blocking | Distinct vCMP guests are able to cluster with each other. | |
803845-2 | 2-Critical | When in HA, the Standby device is forwarding traffic causing a loop and subsequent network shutdown | |
787825-2 | 2-Critical | K58243048 | Database monitors debug logs have plaintext password printed in the log file |
774913-1 | 2-Critical | IP-based bypass can fail if SSL ClientHello is not accepted | |
760078-1 | 2-Critical | Incorrect source MAC used when the BIG-IP in L2 transparent mode generates a TCP RST packet. | |
758714-1 | 2-Critical | Virtual wire on a BIG-IP does not pass traffic when configured over two terminating link aggregation/trunk ports. | |
757578-2 | 2-Critical | RAM cache is not compatible with verify-accept | |
757441-4 | 2-Critical | Specific sequence of packets causes Fast Open to be effectively disabled | |
755585-1 | 2-Critical | mcpd can restart on secondary blades if a policy is created, published, and attached to a virtual server in a single transaction | |
747858-2 | 2-Critical | OSPF packets are duplicated in the BIG-IP in L2 transparent mode using virtual wires | |
746710-1 | 2-Critical | Use of HTTP::cookie after HTTP:disable causes TMM core | |
737985-2 | 2-Critical | BIG-IP systems cannot be deployed in an L2 transparent mode with VLAN groups in Standard Proxy mode. | |
734551-3 | 2-Critical | L2 transparent VLAN group based deployments require configuration of a transparent next hop per virtual server | |
801497-2 | 3-Major | Virtual wire with LACP pinning to one link in trunk. | |
798105-1 | 3-Major | Node Connection Limit Not Honored | |
794581 | 3-Major | Transfer might stall for an object served from WAM cache | |
788325-2 | 3-Major | K39794285 | Header continuation rule is applied to request/response line |
787433-3 | 3-Major | SSL forward proxy: OCSP signer certificate isn't refreshed or regenerated when forward proxy CA key/cert is changed | |
784713-3 | 3-Major | When SSL forward proxy is enabled, AKID extension of the OCSP signer certificate on the clientside is not correct | |
773821-1 | 3-Major | Certain plaintext traffic may cause SSLO to hang | |
773421-1 | 3-Major | Server-side packets dropped with ICMP fragmentation needed when a OneConnect profile is applied | |
769801-1 | 3-Major | Internal tmm UDP filter does not set checksum | |
761385-1 | 3-Major | Without a virtual server, responses from server to client are dropped in a BIG-IP system when the latter is deployed in L2 transparent mode using virtual wire. | |
761381-1 | 3-Major | Incorrect MAC Address observed in L2 asymmetric virtual wire | |
754525-1 | 3-Major | Disabled virtual server accepts and serves traffic after restart | |
748891-2 | 3-Major | Traffic bridged between VLANs in virtual-wire setups may have the wrong destination MAC in packets that egress from the BIG-IP system. | |
742237-4 | 3-Major | CPU spikes appear wider than actual in graphs | |
719300-3 | 3-Major | ICMP unreachable packets are transmitted via BIG-IP systems with the BIG-IP system's MAC address as the source MAC address | |
689361-4 | 3-Major | Configsync can change the status of a monitored pool member | |
751586 | 4-Minor | http2 virtual does not honour translate-address disabled | |
747585-3 | 4-Minor | TCP Analytics supports ANY protocol number |
Global Traffic Manager (DNS) Fixes
ID Number | Severity | Solution Article(s) | Description |
783849-2 | 3-Major | DNSSEC Key Generations are not imported to secondary FIPS card |
Application Security Manager Fixes
ID Number | Severity | Solution Article(s) | Description |
781637-2 | 3-Major | ASM brute force counts unnecessary failed logins for NTLM | |
781605-3 | 3-Major | Fix RFC issue with the multipart parser | |
781069-2 | 3-Major | Bot Defense challenge blocks requests with long Referer headers | |
773553-2 | 3-Major | ASM JSON parser false positive. | |
769997-1 | 3-Major | ASM removes double quotation characters on cookies | |
769981-2 | 3-Major | bd crashes in a specific scenario | |
764373-3 | 3-Major | 'Modified domain cookie' violation with multiple enforced domain cookies with different paths | |
753711-1 | 3-Major | Copied policy does not retain signature staging | |
751710-4 | 3-Major | False positive cookie hijacking violation | |
746394-1 | 3-Major | With ASM CORS set to 'Disabled' it strips all CORS headers in response. | |
745802-1 | 3-Major | Brute Force CAPTCHA response page truncates last digit in the support id | |
727107-4 | 3-Major | Request Logs are not stored locally due to shmem pipe blockage | |
803445-3 | 4-Minor | When adding several mitigation exceptions, the previously configured actions revert to the default action | |
772473-3 | 4-Minor | Request reconstruct issue after challenge | |
761088-1 | 4-Minor | Remove policy editing restriction in the GUI while auto-detect language is set | |
695878-2 | 4-Minor | Signature enforcement issue on specific requests |
Application Visibility and Reporting Fixes
ID Number | Severity | Solution Article(s) | Description |
761749-2 | 2-Critical | Security pages unavailable after switching RT mode on off few times | |
797785-2 | 3-Major | AVR reports no ASM-Anomalies data. | |
792265-3 | 3-Major | Traffic logs does not include the BIG-IQ tags | |
773925-2 | 3-Major | Sometimes MariaDB generates multiple error 24 (too many files open) for AVR DB tables files | |
765785-3 | 3-Major | Monpd core upon "bigstart stop monpd" while Real Time reporting is running |
Access Policy Manager Fixes
ID Number | Severity | Solution Article(s) | Description |
811145-2 | 2-Critical | VMware View resources with SAML SSO are not working | |
797541-1 | 2-Critical | K05115516 | NTLM Auth may fail when user's information contains SIDS array |
784989-2 | 2-Critical | TMM may crash with panic message: Assertion 'cookie name exists' failed | |
777173-2 | 2-Critical | Citrix vdi iApp fails in APM standalone deployments with "HTTP header transformation feature not licensed" error | |
821369 | 3-Major | Incomplete Action 'Deny' does not take effect for HTTP-Connect | |
788417-2 | 3-Major | Remote Desktop client on macOS may show resource auth token on credentials prompt | |
787477-2 | 3-Major | Export fails from partitions with '-' as second character | |
786173-1 | 3-Major | UI becomes unresponsive when accessing Access active session information | |
783817-2 | 3-Major | UI becomes unresponsive when accessing Access active session information | |
782569-1 | 3-Major | SWG limited session limits on SSLO deployments | |
775621-2 | 3-Major | urldb memory grows past the expected ~3.5GB | |
769853-2 | 3-Major | K24241590 | Access Profile option to restrict connections from a single client IP is not honored for native RDP resources |
756777-1 | 3-Major | VDI plugin might crash on process shutdown during RDG connections handling | |
750823-1 | 3-Major | Potential memory leaks in TMM when Access::policy evaluate command failed to send the request to APMD | |
749161-2 | 3-Major | Problem sync policy contains non-ASCII characters | |
746768-4 | 3-Major | APMD leaks memory if access policy policy contains variable/resource assign policy items | |
697590-2 | 3-Major | APM iRule ACCESS::session remove fails outside of Access events | |
781445-1 | 4-Minor | named or dnscached cannot bind to IPv6 address | |
759579-1 | 4-Minor | Full Webtop: 'URL Entry' field is available again | |
756019-1 | 4-Minor | OAuth JWT Issuer claim requires URI format |
Service Provider Fixes
ID Number | Severity | Solution Article(s) | Description |
811745-2 | 3-Major | Failover between clustered DIAMETER devices can cause mirror connections to be disconnected | |
804313-2 | 3-Major | MRF SIP, Diameter, Generic MSG, high availability (HA) - mirrored-message-sweeper-interval not loaded. | |
761685-3 | 3-Major | Connections routed to a virtual server lose per-client connection mode if preserve-strict source port mode is set | |
750431-1 | 3-Major | Persistence record is deleted in MRF SIP after updating timeout value with the iRule 'SIP::persist timeout' | |
748253-1 | 3-Major | Race condition between clustered DIAMETER devices can cause the standby to disconnect its mirror connection | |
786565-2 | 4-Minor | MRF Generic Message: unaccepted packets received by GENERIC MESSAGE filter causes subsequent messages to not be forwarded |
Advanced Firewall Manager Fixes
ID Number | Severity | Solution Article(s) | Description |
800209-1 | 3-Major | The tmsh recursive list command includes DDoS GUI-specific data info | |
780837-1 | 3-Major | Firewall rule list configuration causes config load failure | |
761234-2 | 3-Major | Changing a virtual server to use an address list should be prevented if the virtual server has a security policy with a logging profile attached | |
760355 | 4-Minor | Firewall rule to block ICMP/DHCP from 'required' to 'default'★ |
Policy Enforcement Manager Fixes
ID Number | Severity | Solution Article(s) | Description |
760438-3 | 3-Major | PEM iRule to set policy in rigorous loop may crash tmm due to rare timing conditions | |
759192-3 | 3-Major | TMM core during display of PEM session under some specific conditions | |
756311-4 | 3-Major | High CPU during erroneous deletion | |
753163-4 | 3-Major | PEM does not initiate connection request with PCRF/OCS if failover occurs after 26 days |
Fraud Protection Services Fixes
ID Number | Severity | Solution Article(s) | Description |
804185-2 | 3-Major | Some WebSafe request signatures may not work as expected | |
783565-2 | 3-Major | Upgrade support for DB variable to attach AJAX payload to vToken cookie should be consistent with config in MCP | |
775013-2 | 3-Major | TIME EXCEEDED alert has insufficient data for analysis |
Anomaly Detection Services Fixes
ID Number | Severity | Solution Article(s) | Description |
803477-2 | 3-Major | BaDoS State file load failure when signature protection is off |
Cumulative fixes from BIG-IP v14.1.2 that are included in this release
Vulnerability Fixes
ID Number | CVE | Solution Article(s) | Description |
773649-6 | CVE-2019-6656 | K23876153 | APM Client Logging |
Functional Change Fixes
ID Number | Severity | Solution Article(s) | Description |
771705-1 | 3-Major | You may not be able to log into BIG-IP Cloud Edition if FSCK fails | |
754875-1 | 3-Major | Enable FIPS in prelicensed VE images without requiring a reboot |
Application Visibility and Reporting Fixes
ID Number | Severity | Solution Article(s) | Description |
753485-1 | 2-Critical | AVR global settings are being overridden by HA peers |
Advanced Firewall Manager Fixes
ID Number | Severity | Solution Article(s) | Description |
757306-3 | 3-Major | SNMP MIBS for AFM NAT do not yet exist |
Protocol Inspection Fixes
ID Number | Severity | Solution Article(s) | Description |
794285 | 1-Blocking | BIG-IQ reading AFM configuration fails with status 400 |
Cumulative fixes from BIG-IP v14.1.1 that are included in this release
Vulnerability Fixes
ID Number | CVE | Solution Article(s) | Description |
807477-10 | CVE-2019-6650 | K04280042 | ConfigSync Hardening |
797885-2 | CVE-2019-6649 | K05123525 | ConfigSync Hardening |
796469-6 | CVE-2019-6649 | K05123525 | ConfigSync Hardening |
810557-8 | CVE-2019-6649 | K05123525 | ASM ConfigSync Hardening |
809377-6 | CVE-2019-6649 | K05123525 | AFM ConfigSync Hardening |
799617-2 | CVE-2019-6649 | K05123525 | ConfigSync Hardening |
799589-2 | CVE-2019-6649 | K05123525 | ConfigSync Hardening |
794389-6 | CVE-2019-6651 | K89509323 | iControl REST endpoint response inconsistency |
794413-2 | CVE-2019-6471 | K10092301 | BIND vulnerability CVE-2019-6471 |
793937-1 | CVE-2019-6664 | K03126093 | Management Port Hardening |
Functional Change Fixes
ID Number | Severity | Solution Article(s) | Description |
744937-8 | 3-Major | K00724442 | BIG-IP DNS and GTM DNSSEC security exposure |
TMOS Fixes
ID Number | Severity | Solution Article(s) | Description |
798949-3 | 3-Major | Config-Sync fails when Config-Sync IP configured to management IP | |
760622-3 | 3-Major | Allow Device Certificate renewal from BIG-IP Configuration Utility | |
760363-1 | 3-Major | Update Alias Address field with default placeholder text |
Local Traffic Manager Fixes
ID Number | Severity | Solution Article(s) | Description |
811333-2 | 3-Major | Upgrade fails when SSLv2 cipher is in the cipher list of an SSL profile★ |
Cumulative fixes from BIG-IP v14.1.0.6 that are included in this release
Vulnerability Fixes
ID Number | CVE | Solution Article(s) | Description |
769361-2 | CVE-2019-6630 | K33444350 | TMM may crash while processing SSLO traffic |
767401-1 | CVE-2019-6629 | K95434410 | TMM may crash while processing TLS traffic |
759343-6 | CVE-2019-6668 | K49827114 | MacOS Edge Client installer does not follow best security practices |
758909-1 | CVE-2019-6628 | K04730051 | TMM may crash will processing PEM traffic |
758065-4 | CVE-2019-6667 | K82781208 | TMM may consume excessive resources while processing FIX traffic |
757084-2 | CVE-2019-6627 | K00432398 | Bypassing SSL interception in SSL Orchestrator may crash TMM if virtual server is SNAT enabled |
757023-2 | CVE-2018-5743 | K74009656 | BIND vulnerability CVE-2018-5743 |
756538-4 | CVE-2019-6645 | K15759349 | Failure to open data channel for active FTP connections mirrored across an HA pair. |
754944-1 | CVE-2019-6626 | K00432398 | AVR reporting UI does not follow best practices |
754345-2 | CVE-2019-6625 | K79902360 | WebUI does not follow best security practices |
754103-1 | CVE-2019-6644 | K75532331 | iRulesLX NodeJS daemon does not follow best security practices |
753975-2 | CVE-2019-6666 | K92411323 | TMM may crash while processing HTTP traffic with webacceleration profile |
753776-2 | CVE-2019-6624 | K07127032 | TMM may consume excessive resources when processing UDP traffic |
748502-1 | CVE-2019-6623 | K72335002 | TMM may crash when processing iSession traffic |
737731-6 | CVE-2019-6622 | K44885536 | iControl REST input sanitization |
737574-6 | CVE-2019-6621 | K20541896 | iControl REST input sanitization★ |
737565-6 | CVE-2019-6620 | K20445457 | iControl REST input sanitization |
726393-2 | CVE-2019-6643 | K36228121 | DHCPRELAY6 can lead to a tmm crash |
726327 | CVE-2018-12120 | K37111863 | NodeJS debugger accepts connections from any host |
757455-2 | CVE-2019-6647 | K87920510 | Excessive resource consumption when processing REST requests |
753796-1 | CVE-2019-6640 | K40443301 | SNMP does not follow best security practices |
750460-1 | CVE-2019-6639 | K61002104 | Subscriber management configuration GUI |
750298-1 | CVE-2019-6638 | K67825238 | iControl REST may fail while processing requests |
750187-1 | CVE-2019-6637 | K29149494 | ASM REST may consume excessive resources |
745371-1 | CVE-2019-6636 | K68151373 | AFM GUI does not follow best security practices |
745257-1 | CVE-2018-14634 | K20934447 | Linux kernel vulnerability: CVE-2018-14634 |
742226-6 | CVE-2019-6635 | K11330536 | TMSH platform_check utility does not follow best security practices |
710857-5 | CVE-2019-6634 | K64855220 | iControl requests may cause excessive resource usage |
702469-7 | CVE-2019-6633 | K73522927 | Appliance mode hardening in scp |
673842-6 | CVE-2019-6632 | K01413496 | VCMP does not follow best security practices |
773653-6 | CVE-2019-6656 | K23876153 | APM Client Logging |
773641-6 | CVE-2019-6656 | K23876153 | APM Client Logging |
773637-6 | CVE-2019-6656 | K23876153 | APM Client Logging |
773633-6 | CVE-2019-6656 | K23876153 | APM Client Logging |
773621-6 | CVE-2019-6656 | K23876153 | APM Client Logging |
Functional Change Fixes
ID Number | Severity | Solution Article(s) | Description |
749704-2 | 4-Minor | GTPv2 Serving-Network field with mixed MNC digits |
TMOS Fixes
ID Number | Severity | Solution Article(s) | Description |
774445-1 | 1-Blocking | K74921042 | BIG-IP Virtual Edition does not pass traffic on ESXi 6.7 Update 2 |
789993-1 | 2-Critical | Failure when upgrading to 15.0.0 with config move and static management-ip. | |
773677-1 | 2-Critical | K72255850 | BIG-IP 14.1.0 system-journald write to /run/log/journal cause SWAP usage increase★ |
769809-4 | 2-Critical | The vCMP guests 'INOPERATIVE' after upgrade | |
765801 | 2-Critical | WCCP service info field corrupted in upgrade to 14.1.0 final★ | |
760573-1 | 2-Critical | K00730586 | TPM system integrity check may return invalid status when booting into BIG-IP 14.1.0★ |
760508-1 | 2-Critical | K91444000 | On systems with multiple versions of BIG-IP in use, the 'invalid' System Integrity Status may persist★ |
760408-3 | 2-Critical | K23438711 | System Integrity Status: Invalid after BIOS update★ |
760164-1 | 2-Critical | BIG-IP VE Compression Offload HA action requires modification of db variable | |
757722-2 | 2-Critical | Unknown notify message types unsupported in IKEv2 | |
756402-2 | 2-Critical | Re-transmitted IPsec packets can have garbled contents | |
756071-3 | 2-Critical | MCPD crash | |
755254-1 | 2-Critical | Remote auth: PAM_LDAP buffer too small errors★ | |
753650-2 | 2-Critical | The BIG-IP system reports frequent kernel page allocation failures. | |
750586-2 | 2-Critical | HSL may incorrectly handle pending TCP connections with elongated handshake time. | |
743803-1 | 2-Critical | IKEv2 potential double free of object when async request queueing fails | |
741503-1 | 2-Critical | The BIG-IP system fails to load base config file when upgrading with static IPv4★ | |
726487-4 | 2-Critical | MCPD on secondary VIPRION or vCMP blades may restart after making a configuration change. | |
648270-1 | 2-Critical | mcpd can crash if viewing a fast-growing log file through the GUI | |
766365-1 | 3-Major | Some trunks created on VE platform stay down even when the trunk's interfaces are up | |
766329-2 | 3-Major | SCTP connections do not reflect some SCTP profile settings | |
765033 | 3-Major | Upgrades to versions that restrict resource-admin users from accessing bash may fail under certain conditions★ | |
760597-1 | 3-Major | System integrity messages not logged | |
760594 | 3-Major | On BIG-IP VE, 'snmpwalk -v 2c -c public localhost .1.3.6.1.4.1.3375.2.1.7.3' returns only /appdata details. | |
758879 | 3-Major | BIG-IP VE with ixlv devices does not reliably pass some traffic after hard-boot | |
748206-1 | 3-Major | Browser becomes unresponsive when loading the network map with a virtual server that contains a forwarding rule policy in the second position | |
748187-4 | 3-Major | 'Transaction Not Found' Error on PATCH after Transaction has been Created | |
746657-1 | 3-Major | tmsh help for FQDN node or pool member shows incorrect default for fqdn interval | |
740543-1 | 3-Major | System hostname not display in console | |
725791-6 | 3-Major | Potential HW/HSB issue detected | |
718405-2 | 3-Major | RSA signature PAYLOAD_AUTH mismatch with certificates | |
581921-5 | 3-Major | K22327083 | Required files under /etc/ssh are not moved during a UCS restore |
754500-2 | 4-Minor | GUI LTM Policy options disappearing | |
726317-6 | 4-Minor | Improved debugging output for mcpd |
Local Traffic Manager Fixes
ID Number | Severity | Solution Article(s) | Description |
759723-1 | 2-Critical | Abnormally terminated connections on server side may cause client side streams to stall | |
758465-1 | 2-Critical | TMM may crash or iRule processing might be incorrect | |
756356-2 | 2-Critical | External datagroups of type string cannot use iRule command 'class match equals' for entries > 32 characters long | |
753912-4 | 2-Critical | K44385170 | UDP flows may not be swept |
752930-3 | 2-Critical | Changing route-domain on partitions leads to Secondary blade reboot loop and virtual servers left in unusual state | |
747727-1 | 2-Critical | HTTP Profile Request Header Insert Tcl error | |
747239-1 | 2-Critical | TMM SIGABRT seen in HTTP/2 gateway scenario when shutting down connection | |
745533-6 | 2-Critical | NodeJS Vulnerability: CVE-2016-5325 | |
741048-1 | 2-Critical | iRule execution order could change after editing the scripts | |
766293-1 | 3-Major | Monitor logging fails on v14.1.0.x releases | |
760550-5 | 3-Major | Retransmitted TCP packet has FIN bit set | |
758311-1 | 3-Major | Policy Compilation may cause MCPD to crash | |
757985-1 | 3-Major | K79562045 | TMM memory leak |
757698-1 | 3-Major | TMM crashes in certain situations of which iRule execution interleaves client side and server side flows | |
756270-4 | 3-Major | SSL profile: CRL signature verification does not check for multiple certificates with the same name as the issuer in the trusted CA bundle | |
754985-1 | 3-Major | Standby mirrored server SSL connections fail, and tmm may crash while processing mirrored TLS traffic | |
752078-2 | 3-Major | Header Field Value String Corruption | |
749414-4 | 3-Major | Invalid monitor rule instance identifier error | |
747907-2 | 3-Major | Persistence records leak while the HA mirror connection is down | |
742078-6 | 3-Major | Incoming SYNs are dropped and the connection does not time out. | |
740959-4 | 3-Major | User with manager rights cannot delete FQDN node on non-Common partition | |
740345-3 | 3-Major | TMM core files seen on standby device after failover, when connection mirroring, session mirroring and OCSP stapling are enabled. | |
696755-3 | 3-Major | HTTP/2 may truncate a response body when served from cache | |
696735-2 | 3-Major | TCP ToS Passthrough mode does not work correctly | |
504522-4 | 3-Major | Trailing space present after 'tmsh ltm pool members monitor' attribute value | |
747968-3 | 4-Minor | DNS64 stats not increasing when requests go through DNS cache resolver |
Performance Fixes
ID Number | Severity | Solution Article(s) | Description |
777937-3 | 1-Blocking | AWS ENA: packet drops due to bad checksum |
Global Traffic Manager (DNS) Fixes
ID Number | Severity | Solution Article(s) | Description |
759721-2 | 3-Major | K03332436 | DNS GUI does not follow best practices |
749508-1 | 3-Major | LDNS and DNSSEC: Various OOM conditions need to be handled properly | |
749222-1 | 3-Major | dname compression offset overflow causes bad compression pointer | |
748902-5 | 3-Major | Incorrect handling of memory allocations while processing DNSSEC queries | |
746877-1 | 3-Major | Omitted check for success of memory allocation for DNSSEC resource record | |
744707-2 | 3-Major | Crash related to DNSSEC key rollover | |
723288-4 | 3-Major | DNS cache replication between TMMs does not always work for net dns-resolver | |
748177-1 | 4-Minor | Multiple wildcards not matched to most specific WideIP when two wildcard WideIPs differ on a '?' and a non-wildcard character |
Application Security Manager Fixes
ID Number | Severity | Solution Article(s) | Description |
759360-2 | 2-Critical | Apply Policy fails due to policy corruption from previously enforced signature | |
749912-1 | 2-Critical | [BIG-IQ Integration] Deadlock occurs when adding multiple hostnames with transparent enforcement | |
723790-3 | 2-Critical | Idle asm_config_server handlers consumes a lot of memory | |
765449-1 | 3-Major | Update availability status may be inaccurate | |
763001-1 | 3-Major | K70312000 | Web-socket enforcement might lead to a false negative |
761941-1 | 3-Major | ASM does not remove CSRT token query parameter before forwarding a request to the backend server | |
761194-2 | 3-Major | param data type violation on an Integer parameter, if an integer value is sent via websocket JSON | |
760878-3 | 3-Major | Incorrect enforcement of explicit global parameters | |
759483-1 | 3-Major | Message about HTTP status code which are set by default disappeared from the UI | |
758085-1 | 3-Major | CAPTCHA Custom Response fails when using certain characters | |
756418-1 | 3-Major | Live Update does not authenticate remote users | |
742558-1 | 3-Major | Request Log export document fails to show some UTF-8 characters | |
687759-3 | 3-Major | bd crash | |
774941-1 | 4-Minor | GUI misspelling in Bot Defense logging profile | |
768761-2 | 4-Minor | Improved accept action description for suggestions to disable signature/enable metacharacter in policy | |
766357-1 | 4-Minor | Two simultaneously manual installations can cause live-update inconsistency | |
765413-1 | 4-Minor | ASM cluster syncs caused by PB ignored suggestions updates | |
761921-1 | 4-Minor | avrd high CPU utilization due to perpetual connection attempts | |
761553-2 | 4-Minor | Text for analyzed requests improved for suggestions that were created as result of absence of violations in traffic | |
761549-2 | 4-Minor | Traffic Learning: Accept and Stage action is shown only in case entity is not in staging | |
761231-2 | 4-Minor | K79240502 | Bot Defense Search Engines getting blocked after configuring DNS correctly |
759462-1 | 4-Minor | Site names and vulnerabilities cannot be retrieved from WhiteHat server | |
755005-1 | 4-Minor | Request Log: wrong titles in details for Illegal Request Length and Illegal Query String Length violations | |
750689-3 | 4-Minor | Request Log: Accept Request button available when not needed | |
749184-2 | 4-Minor | Added description of subviolation for the suggestions that enabled/disabled them | |
747560-5 | 4-Minor | ASM REST: Unable to download Whitehat vulnerabilities | |
769061-2 | 5-Cosmetic | Improved details for learning suggestions to enable violation/sub-violation |
Application Visibility and Reporting Fixes
ID Number | Severity | Solution Article(s) | Description |
763349-3 | 2-Critical | AVRD can crash with core when HTTPS connection to BIG-IQ DCD node times out | |
756205-1 | 2-Critical | TMSTAT offbox statistics are not continuous | |
756102-2 | 2-Critical | TMM can crash with core on ABORT signal due to non-responsive AVR code | |
771025-3 | 3-Major | AVR send domain names as an aggregate | |
764665-2 | 3-Major | AVRD core when connected to BIG-IQ via HTTPS at the moment of configuration change | |
763005-3 | 3-Major | Aggregated Domain Names in DNS statistics are shown as random domain name | |
760356-2 | 3-Major | Users with Application Security Administrator role cannot delete Scheduled Reports |
Access Policy Manager Fixes
ID Number | Severity | Solution Article(s) | Description |
770557-3 | 2-Critical | Per-Session RADIUS Acct STOP message is forged based on pool route domain, but is sent through default one | |
769281-1 | 2-Critical | Per-request Acess Policy may show user interface pages incorrectly i nlanguages other than English | |
755447-1 | 2-Critical | SSLO does not deliver content generated/originated from inline device | |
753370-3 | 2-Critical | RADIUS auth might not be working as configured when there is change in RADIUS auth config name. | |
774633-2 | 3-Major | Memory leak in tmm when session db variables are not cleaned up | |
774213-1 | 3-Major | SWG session limits on SSLO deployments | |
760410-1 | 3-Major | Connection reset is seen when Category lookup agent is used in per-req policy | |
760250 | 3-Major | 'Unsupported SSO Method' error when requests sharing the same TCP session | |
759868-1 | 3-Major | TMM crash observed while rendering internal pages (like blocked page) for per-request policy | |
758764-2 | 3-Major | APMD Core when CRLDP Auth fails to download revoked certificate | |
758701-1 | 3-Major | APM fails to handle Remote Desktop Gateway connections from standalone RDP clients after fresh install | |
757992-3 | 3-Major | RADIUS Acct STOP message is not being sent when configured with route domain for HA Pool setup | |
757360-1 | 3-Major | Category lookup returns wrong category on subsequent traffic following initial HTTP CONNECT traffic through SSLO | |
755475-1 | 3-Major | Corrupted customization group on target after updating access policy (any agent that is tied to customization group) on source device and config sync | |
755047-1 | 3-Major | Category lookup returns wrong category on CONNECT traffic through SSLO | |
754542-2 | 3-Major | TMM may crash when using RADIUS Accounting agent | |
752875-2 | 3-Major | tmm core while using service chaining for SSLO | |
751807-1 | 3-Major | SSL Orchestrator may not activate service connectors if traffic is an HTTP tunnel | |
751424-1 | 3-Major | HTTP Connect Category Lookup not working properly | |
749057-1 | 3-Major | VMware Horizon idle timeout is ignored when connecting via APM | |
745574-1 | 3-Major | URL is not removed from custom category when deleted | |
738430-3 | 3-Major | APM is not able to do compliance check on iOS devices running F5 Access VPN client | |
734291-1 | 3-Major | Logon page modification fails to sync to standby | |
695985-4 | 3-Major | Access HUD filter has URL length limit (4096 bytes) | |
766761-2 | 4-Minor | Ant-server does not log requests that are excluded from scanning |
Service Provider Fixes
ID Number | Severity | Solution Article(s) | Description |
766405-2 | 2-Critical | MRF SIP ALG with SNAT: Fix for potential crash on next-active device | |
754615-2 | 2-Critical | Tmm crash (assert) during SIP message processing on MRF-SIP-ALG setup. | |
763157-2 | 3-Major | MRF SIP ALG with SNAT: Processing request and response at same time on same connection may cause one to be dropped | |
760370-2 | 3-Major | MRF SIP ALG with SNAT: Next active ingress queue filling | |
759077-2 | 3-Major | MRF SIP filter queue sizes not configurable | |
755630-1 | 3-Major | MRF SIP ALG: Mirrored media flows timeout on standby after 2 minutes | |
752822-1 | 3-Major | SIP MRF INGRESS_ALG_TRANSLATION_FAIL state has incorrect state_type | |
751179-1 | 3-Major | MRF: Race condition may create to many outgoing connections to a peer | |
746825-1 | 3-Major | MRF SIP ALG with SNAT: Ephemeral listeners not created for unsubscribed outgoing calls | |
745947-2 | 3-Major | Add log events for MRF SIP registration/deregistration and media flow creation/deletion | |
745590-1 | 3-Major | SIPALG::hairpin and SIPALG::hairpin_default iRule commands to enable or disable hairpin mode added | |
760930-2 | 4-Minor | MRF SIP ALG with SNAT: Added additional details to log events | |
747909-5 | 4-Minor | GTPv2 MEI and Serving-Network fields decoded incorrectly |
Advanced Firewall Manager Fixes
ID Number | Severity | Solution Article(s) | Description |
757524 | 1-Blocking | Data operation attempt on object that has not been loaded | |
757359-1 | 2-Critical | pccd crashes when deleting a nested Address List | |
754805 | 2-Critical | K97981358 | Possible tmm crash when AFM DoS badactor or attacked-dst or endpoint vector configured |
753028-2 | 3-Major | AFM drops forwarding ICMP traffic matching FW NAT rule for Dest NAT that also has Proxy ARP enabled for destination addresses in the rule | |
745809-2 | 3-Major | The /var partition may become 100% full requiring manual intervention to clear space | |
756477-2 | 5-Cosmetic | Drop Redirect tab incorrectly named as 'Redirect Drop' |
Carrier-Grade NAT Fixes
ID Number | Severity | Solution Article(s) | Description |
744516-4 | 2-Critical | TMM panics after a large number of LSN remote picks |
Anomaly Detection Services Fixes
ID Number | Severity | Solution Article(s) | Description |
748121-3 | 2-Critical | admd livelock under CPU starvation | |
653573-6 | 2-Critical | ADMd not cleaning up child rsync processes | |
756877-1 | 3-Major | Virtual server created with Guided Configuration is not visible in Grafana |
Traffic Classification Engine Fixes
ID Number | Severity | Solution Article(s) | Description |
752803-1 | 2-Critical | CLASSIFICATION_DETECTED running reject can lead to a tmm core | |
752047-1 | 2-Critical | iRule running reject in CLASSIFICATION_DETECTED event can cause core |
Cumulative fixes from BIG-IP v14.1.0.5 that are included in this release
Functional Change Fixes
ID Number | Severity | Solution Article(s) | Description |
755817 | 3-Major | v14.1.0.5 includes Guided Configuration 4.1 | |
751824-1 | 3-Major | Restore old 'merge' functionally with new tmsh verb 'replace' |
Access Policy Manager Fixes
ID Number | Severity | Solution Article(s) | Description |
663819-1 | 3-Major | APM NTLM Authentication for RDP Client Gateway and Microsoft Exchange Proxy are incompatible with Microsoft workaround for MS17-010 (Wannacry / Eternalblue) |
Advanced Firewall Manager Fixes
ID Number | Severity | Solution Article(s) | Description |
761173-1 | 2-Critical | tmm crash after extended whitelist modification | |
751869-2 | 2-Critical | Possible tmm crash when using manual mode mitigation in DoS Profile | |
760393 | 3-Major | GARP is not sent from newly active device after failover for FW NAT policy rule's dest prefixes | |
750477-1 | 3-Major | LTM NAT does not forward ICMP traffic | |
737035-2 | 3-Major | New and improved infrastructure for BDoS to share learned traffic characteristics within the device group/cluster setup. |
Traffic Classification Engine Fixes
ID Number | Severity | Solution Article(s) | Description |
757088-1 | 2-Critical | TMM clock advances and cluster failover happens during webroot db nightly updates | |
758536 | 3-Major | Traffic Intelligence IM pkg for 14.1.0 fails to install on base build version 14.1.0.x |
Protocol Inspection Fixes
ID Number | Severity | Solution Article(s) | Description |
737558-1 | 2-Critical | Protocol Inspection user interface elements are active but do not work | |
774881 | 3-Major | Protocol Inspection profiles can be added to a virtual server without Protocol Inspection being licensed. |
Cumulative fixes from BIG-IP v14.1.0.4 that are included in this release
Functional Change Fixes
None
Cumulative fixes from BIG-IP v14.1.0.3 that are included in this release
Functional Change Fixes
ID Number | Severity | Solution Article(s) | Description |
745783-1 | 3-Major | Anti-fraud: remote logging of login attempts |
TMOS Fixes
ID Number | Severity | Solution Article(s) | Description |
758667-1 | 2-Critical | BIG-IP VE high availability (HA) actions are not invoked when offload hardware hangs | |
754541-2 | 2-Critical | Reconfiguring an iApp that uses a client SSL profile fails | |
760222 | 3-Major | SCP fails unexpected when FIPS mode is enabled | |
725625-1 | 3-Major | BIG-IP VE Cryptographic Offload updated to Intel QAT 1.7 v4.4.0 SDK |
Cumulative fixes from BIG-IP v14.1.0.2 that are included in this release
Vulnerability Fixes
ID Number | CVE | Solution Article(s) | Description |
757025-1 | CVE-2018-5744 | K00040234 | BIND Update |
750292-2 | CVE-2019-6592 | K54167061 | TMM may crash when processing TLS traffic |
749879-2 | CVE-2019-6611 | K47527163 | Possible interruption while processing VPN traffic |
744035-6 | CVE-2018-15332 | K12130880 | APM Client Vulnerability: CVE-2018-15332 |
757027-1 | CVE-2019-6465 | K01713115 | BIND Update |
745713-4 | CVE-2019-6619 | K94563344 | TMM may crash when processing HTTP/2 traffic |
745165-1 | CVE-2019-6617 | K38941195 | Users without Advanced Shell Access are not allowed SFTP access |
737910-4 | CVE-2019-6609 | K18535734 | Security hardening on the following platforms |
703835-5 | CVE-2019-6616 | K82814400 | When using SCP into BIG-IP systems, you must specify the target filename |
702472-7 | CVE-2019-6615 | K87659521 | Appliance Mode Security Hardening |
713806-8 | CVE-2018-0739 | K08044291 | CVE-2018-0739: OpenSSL Vulnerability |
699977-3 | CVE-2016-7055 | K43570545 | CVE-2016-7055: OpenSSL Vulnerability in NodeJS ILX |
Functional Change Fixes
ID Number | Severity | Solution Article(s) | Description |
755641-1 | 2-Critical | Unstable asm_config_server after upgrade, 'Event dispatcher aborted' | |
744685-2 | 2-Critical | BIG-IP does not throw error when intermediate CA is missing the "Basic Constraints" and "CA:True" in its extension | |
744188-1 | 2-Critical | First successful auth iControl REST requests will now be logged in audit and secure log files | |
745387-1 | 3-Major | Resource-admin user roles can no longer get bash access | |
739432 | 3-Major | F5 Adaptive Auth (MFA) Reports are no longer supported on BIG-IP systems | |
738108-1 | 3-Major | SCTP multi-homing INIT address parameter doesn't include association's primary address | |
698376-5 | 3-Major | Non-admin users have limited bash commands and can only write to certain directories |
TMOS Fixes
ID Number | Severity | Solution Article(s) | Description |
753642-1 | 2-Critical | iHealth may report false positive for Critical Malware | |
752835-2 | 2-Critical | K46971044 | Mitigate mcpd out of memory error with auto-sync enabled. |
750580-1 | 2-Critical | Installation using image2disk --format may fail after TMOS v14.1.0 is installed★ | |
724680-6 | 2-Critical | OpenSSL Vulnerability: CVE-2018-0732 | |
707013-3 | 2-Critical | vCMP host secondary member's cluster.conf file may replaced by that of vCMP guest | |
668041-4 | 2-Critical | K27535157 | Config load fails when an iRule comment ends with backslash in a config where there is also a policy.★ |
621260-2 | 2-Critical | mcpd core on iControl REST reference to non-existing pool | |
757026-1 | 3-Major | BIND Update | |
753564-1 | 3-Major | Attempt to change password using /bin/passwd fails | |
751011-3 | 3-Major | ihealth.sh script and qkview locking mechanism not working | |
751009-3 | 3-Major | Generating Qkviews or tcpdumps via GUI or running the 'ihealth' command removes /var/tmp/mcpd.out | |
750661 | 3-Major | URI translation rules defined in Rewrite profile with type 'uri-translation' are not applied. | |
750447-3 | 3-Major | GUI VLAN list page loading slowly with 50 records per screen | |
749382-1 | 3-Major | Bare-metal installs via 'image2disk' may fail in v14.1.0 or greater | |
746873-1 | 3-Major | Non-admin users are not able to run the tmsh list command due to permissions error for LTM message-routing | |
745825-1 | 3-Major | The "audit_forwarder is disabled as the configuration is incomplete" message can be confusing if logged when the configuration is loading | |
737536-2 | 3-Major | Enabling 'default-information originate' on one of the several OSPF processes does not inject a default route into others. | |
721585-1 | 3-Major | mcpd core processing ltm monitors with deep level of inheritance | |
639619-7 | 3-Major | UCS may fail to load due to Master key decryption failure on EEPROM-less systems★ | |
751636-1 | 4-Minor | Downgrading from v14.1.0 to a previous release leaves two directories with improper ownership★ | |
737423-2 | 4-Minor | Binutils vulnerabilities: CVE-2018-7569 CVE-2018-10373 CVE-2018-13033 |
Local Traffic Manager Fixes
ID Number | Severity | Solution Article(s) | Description |
754143-1 | 2-Critical | TCP connection may hang after finished | |
747617-2 | 2-Critical | TMM core when processing invalid timer | |
742184-3 | 2-Critical | TMM memory leak | |
738945-4 | 2-Critical | SSL persistence does not work when there are multiple handshakes present in a single record | |
716714-4 | 2-Critical | OCSP should be configured to avoid TMM crash. | |
750200-3 | 3-Major | DHCP requests are not sent to all DHCP servers in the pool when the BIG-IP system is in DHCP Relay mode | |
749294-4 | 3-Major | TMM cores when query session index is out of boundary | |
746131-4 | 3-Major | OpenSSL Vulnerability: CVE-2018-0732 | |
744686-2 | 3-Major | Wrong certificate can be chosen during SSL handshake | |
743900-1 | 3-Major | Custom DIAMETER monitor requests do not have their 'request' flag set | |
739963-4 | 3-Major | TLS v1.0 fallback can be triggered intermittently and fail with restrictive server setup | |
739349-3 | 3-Major | LRO segments might be erroneously VLAN-tagged. | |
724327-2 | 3-Major | Changes to a cipher rule do not immediately have an effect | |
720219-3 | 3-Major | K13109068 | HSL::log command can fail to pick new pool member if last picked member is 'checking' |
717896-4 | 3-Major | Monitor instances deleted in peer unit after sync | |
717100-1 | 3-Major | FQDN pool member is not added if FQDN resolves to same IP address as another existing FQDN pool member | |
716167-2 | 3-Major | The value of the sys db variable vlan.backplane.mtu may be out-of-sync with the value of the MTU of the kernel interface tmm_bp | |
704450-5 | 3-Major | bigd may crash when the BIG-IP system is under extremely heavy load, due to running with incomplete configuration | |
703593-1 | 3-Major | TMSH tab completion for adding profiles to virtual servers is not working as expected |
Global Traffic Manager (DNS) Fixes
ID Number | Severity | Solution Article(s) | Description |
756774-6 | 2-Critical | Aborted DNS queries to a cache may cause a TMM crash | |
756094-2 | 2-Critical | DNS express in restart loop, 'Error writing scratch database' in ltm log |
Application Security Manager Fixes
ID Number | Severity | Solution Article(s) | Description |
752942-1 | 2-Critical | Live Update cannot be used by Administrator users other than 'admin' and 'root' | |
750922-1 | 2-Critical | BD crash when content profile used for login page has no parse parameters set | |
749136-1 | 2-Critical | Disk partition /var/log is low on free disk space | |
748321-1 | 2-Critical | bd crash with specific scenario | |
744347-4 | 2-Critical | Protocol Security logging profiles cause slow ASM upgrade and apply policy | |
721741-4 | 2-Critical | BD and BD_Agent out-of-sync for IP Address Exception, false positive/negative | |
754420-1 | 3-Major | Missing policy name in exported ASM request details | |
754066-1 | 3-Major | Newly added Systems are not added as part of installing a Server Technologies update file | |
753295-1 | 3-Major | ASM REST: All signatures being returned for policy Signatures regardless of signature sets | |
750973-1 | 3-Major | Import XML policy error | |
750793-2 | 3-Major | Impossible to remove Bot profiles, Logging profiles, and Cloud Security Service profiles from a user-defined partition | |
750686-1 | 3-Major | ASE user cannot create or modify a bot signature. | |
750683-1 | 3-Major | REST Backwards Compatibility: Cannot modify enforcementMode of host-name | |
750668-1 | 3-Major | Impossible to remove Bot profiles, Logging profiles, and Cloud Security Service profiles from a user-defined partition | |
750666-1 | 3-Major | Impossible to create Bot Signature/Bot Category Signature in user partition different from 'Common' | |
750356-2 | 3-Major | Split View pages: if user-defined filter removed right after creation - all user-defined filters are deleted | |
749500-1 | 3-Major | Improved visibility for Accept on Microservice action in Traffic Learning | |
749109-3 | 3-Major | CSRF situation on BIGIP-ASM GUI | |
748999-3 | 3-Major | invalid inactivity timeout suggestion for cookies | |
748848-2 | 3-Major | Anti-Bot Mobile SDK cookie name change to support identical cookies for multiple virtual servers | |
748409-2 | 3-Major | Illegal parameter violation when json parsing a parameter on a case-insensitive policy | |
747977-1 | 3-Major | File manually uploaded information is not synced correctly between blades | |
747777-3 | 3-Major | Extractions are learned in manual learning mode | |
747550-3 | 3-Major | Error 'This Logout URL already exists!' when updating logout page via GUI | |
746750-1 | 3-Major | Search Engine get Device ID challenge when using the predefined profiles | |
746298-1 | 3-Major | Server Technologies logos all appear as default icon | |
745813-1 | 3-Major | Requests are reported to local log even if only Bot Defense remote log is configured | |
745624-1 | 3-Major | Tooltips for OWASP Bot Categories and Anomalies were added | |
745607-1 | 3-Major | Bot Defense : Bot Traffic - 3 month/last year filter not displayed correctly | |
745531-2 | 3-Major | Puffin Browser gets blocked by Bot Defense | |
742852-1 | 3-Major | Bot Defense protection blocks Safari browser requests while using cross site redirect protection by 'Location' header | |
739945-4 | 3-Major | JavaScript challenge on POST with 307 breaks application | |
738676-1 | 3-Major | Errors when trying to delete all bot requests from Security :: Event Logs : Bot Defense : Bot Requests | |
737866-2 | 3-Major | Rare condition memory corruption | |
754365-5 | 4-Minor | Updated flags for countries that changed their flags since 2010 | |
721724-1 | 4-Minor | LONG_REQUEST notice print incorrect in BD log |
Application Visibility and Reporting Fixes
ID Number | Severity | Solution Article(s) | Description |
746941-2 | 2-Critical | avrd memory leak when BIG-IQ fails to receive stats information | |
753446-2 | 3-Major | avrd process crash during shutdown if connected to BIG-IQ | |
749464-2 | 3-Major | Race condition while BIG-IQ updates common file | |
749461-2 | 3-Major | Race condition while modifying analytics global-settings | |
745027-2 | 3-Major | AVR is doing extra activity of DNS data collection even when it should not | |
744595-3 | 3-Major | DoS-related reports might not contain some of the activity that took place | |
744589-3 | 3-Major | Missing data for Firewall Events Statistics | |
715110-1 | 3-Major | AVR should report 'resolutions' in module GtmWideip |
Access Policy Manager Fixes
ID Number | Severity | Solution Article(s) | Description |
752592-1 | 2-Critical | VMware Horizon PCoIP clients may fail to connect shortly after logout | |
754346-2 | 3-Major | Access policy was not found while creating configuration snapshot. | |
746771-3 | 3-Major | APMD recreates config snapshots for all access profiles every minute | |
745654-4 | 3-Major | Heavy use of APM Kerberos SSO can sometimes lead to slowness of Virtual Server | |
743437-3 | 3-Major | Portal Access: Issue with long 'data:' URL |
Service Provider Fixes
ID Number | Severity | Solution Article(s) | Description |
749603-1 | 3-Major | MRF SIP ALG: Potential to end wrong call when BYE received | |
749227-1 | 3-Major | MRF SIP ALG with SNAT: Temporary registration not extended by subsequent INVITE | |
748043-2 | 3-Major | MRF SIP ALG with SNAT: SIP Response message not forwarded by BIG-IP | |
747187-2 | 3-Major | SIP falsely detects media flow collision when SDP is in both 183 and 200 response | |
745715-2 | 3-Major | MRF SIP ALG now supports reading SDP from a mime multipart payload | |
745628-1 | 3-Major | MRF SIP ALG with SNAT does not translate media addresses in SDP after NOTIFY message | |
745514-1 | 3-Major | MRF SIP ALG with SNAT does not translate media addresses in SDP after SUBSCRIBE message | |
745404-4 | 3-Major | MRF SIP ALG does not reparse SDP payload if replaced | |
744949-1 | 3-Major | MRF SIP ALG with SNAT may restore incorrect client identity if client IP does not match NAT64 prefix | |
744275-1 | 3-Major | BIG-IP system sends Product-Name AVP in CER with Mandatory bit set | |
742829-1 | 3-Major | SIP ALG: Do not translate and create media channels if RTP port is defined in the SIP message is 0 |
Advanced Firewall Manager Fixes
ID Number | Severity | Solution Article(s) | Description |
747104-1 | 1-Blocking | K52868493 | LibSSH: CVE-2018-10933 |
752363-2 | 2-Critical | Internally forwarded flows can get dropped with AFM L4 BDoS feature enabled | |
749331-3 | 2-Critical | Global DNS DoS vector does not work in certain cases | |
747922-3 | 2-Critical | With AFM enabled, during bootup, there is a small possibility of a tmm crash | |
748176-1 | 3-Major | BDoS Signature can wrongly match a DNS packet | |
748081-1 | 3-Major | Memory leak in Behavioral DoS module | |
747926-2 | 3-Major | Rare TMM restart due to NULL pointer access during AFM ACL logging |
Policy Enforcement Manager Fixes
ID Number | Severity | Solution Article(s) | Description |
726647-5 | 3-Major | PEM content insertion in a compressed response may truncate some data |
Fraud Protection Services Fixes
ID Number | Severity | Solution Article(s) | Description |
752782-1 | 3-Major | 'DataSafe Profiles' menu has changed to 'BIG-IP DataSafe' | |
741449-3 | 4-Minor | alert_details is missing for COMPONENT_VALIDATION_JAVASCRIPT_THRESHOLD alerts | |
738677-1 | 4-Minor | Configured name of wildcard parameter is not sent in data integrity alerts |
Anomaly Detection Services Fixes
ID Number | Severity | Solution Article(s) | Description |
755378-1 | 2-Critical | HTTPS connection error from Chrome when BADOS TLS signatures configured | |
727136-1 | 3-Major | One dataset contains large number of variations of TLS hello messages on Chrome |
Cumulative fixes from BIG-IP v14.1.0.1 that are included in this release
Functional Change Fixes
ID Number | Severity | Solution Article(s) | Description |
745629 | 2-Critical | Ordering Symantec and Comodo certificates from BIG-IP | |
713817-1 | 3-Major | BIG-IP images are available in Alibaba Cloud | |
738891-1 | 4-Minor | TLS 1.3: Server SSL fails to increment key exchange method statistics |
TMOS Fixes
ID Number | Severity | Solution Article(s) | Description |
746424 | 2-Critical | Patched Cloud-Init to support AliYun Datasource | |
745851 | 3-Major | Changed Default Cloud-Init log level to INFO from DEBUG | |
742251-1 | 4-Minor | Add Alibaba Cloud support to Qkview |
Global Traffic Manager (DNS) Fixes
ID Number | Severity | Solution Article(s) | Description |
749774-5 | 3-Major | EDNS0 client subnet behavior inconsistent when DNS Caching is enabled | |
749675-5 | 3-Major | DNS cache resolver may return a malformed truncated response with multiple OPT records |
Cumulative fix details for BIG-IP v14.1.2.5 that are included in this release
887637-1 : Systemd-journald Vulnerability: CVE-2019-3815
Solution Article: K22040951
884797-2 : Portal Access: in some cases data is not delivered via WebSocket connection
Component: Access Policy Manager
Symptoms:
If a client browser opens a WebSocket connection, Portal Access may not send data to the client if the first message in the new connection comes from the server.
Conditions:
- Web application with WebSocket connection
- First data in WebSocket connection is sent from server to client
Impact:
Data is not delivered to the client browser via the WebSocket connection.
Fix:
Now Portal Access can deliver data to the client browser via the WebSocket connection when the first data is sent from the server.
883717-3 : BD crash on specific server cookie scenario
Component: Application Security Manager
Symptoms:
BD crash.
Conditions:
Server sends many domain cookies with different domains or paths.
Impact:
Traffic distraction, failover.
Workaround:
There is no workaround, except changing the server's cookies.
Fix:
BD does not crash when server sets many different attributes.
882557-4 : TMM restart loop if virtio platform specifies RX or TX queue sizes that are too large (4096 or higher)
Component: TMOS
Symptoms:
If the underlying virtio platform specifies RX and/or TX queue sizes that are 4096 or larger, the BIG-IP system cannot allocate enough contiguous memory space to accommodate this. Errors similar to these are seen in the tmm log files:
ndal Error: Failed to allocate 2232336 (2228224 + 4096 + 16) bytes
virtio[0:7.0]: Error: Failed to allocate descriptor chain
virtio[0:7.0]: Error: Failed allocate indirect rx buffers
Conditions:
-- Using a BIG-IP Virtual Edition (VE) with virtio drivers.
-- The underlying platform specifies RX and/or TX queue sizes of 4096 or larger.
Impact:
TMM continually restarts.
Workaround:
Use the sock driver instead of virtio.
In your BIG-IP VE VM execute the lspci command to determine which virtio driver is present:
# lspci -nn | grep -i eth | grep -i virtio
00:03.0 Ethernet controller [0200]: Red Hat, Inc Virtio network device [1af4:1000]
00:04.0 Ethernet controller [0200]: Red Hat, Inc Virtio network device [1af4:1000]
00:0b.0 Ethernet controller [0200]: Red Hat, Inc Virtio network device [1af4:1000]
Configure a socket driver:
echo "device driver vendor_dev 1af4:1000 sock" > /config/tmm_init.tcl
Reboot the instance
882377-1 : ASM Application Security Editor Role User can update/install ASU
Component: Application Security Manager
Symptoms:
Live Update modifications are allowed for Application Security Editor Role.
Conditions:
Login as Application Security Editor user and try to install ASU.
Impact:
Application Security Editor Role role is permitted to update Attack Signatures when it shouldn't be.
882273 : MRF Diameter: memory leak during server down and reconnect attempt which leads to tmm crash and memory usage grow
Component: Service Provider
Symptoms:
Memory leak can cause tmm to crash and memory usage to grow.
Conditions:
-- Diameter transmission setting is enabled and action should be retrans.
-- auto-init should be enabled.
-- And server is down.
Impact:
Memory corruption will lead to tmm crash in longer run and memory leak make memory usage to grow in linear order. Traffic disrupted while tmm restarts.
Workaround:
None.
Fix:
When server is down BIG-IP keeps creating new connection to it. there is memory leak need to be fixed.
879401-3 : Memory corruption during APM SAML SSO
Component: Access Policy Manager
Symptoms:
During processing of SAML SSO single logout (SLO) requests, a block of tmm memory may become corrupted.
Conditions:
- BIG-IP system is configured as SAML SP.
- External SAML IdP sends SLO request.
Impact:
Various possible negative effects, including TMM core. Traffic disrupted while tmm restarts.
Fix:
BIG-IP as SAML SP no longer causes memory corruption when handling certain traffic.
879025-4 : When processing server-side TLS traffic, LTM may not enforce certificate chain restrictions
Component: Local Traffic Manager
Symptoms:
When processing server-side TLS traffic, LTM may not enforce certificate chain restrictions as expected. TLS traffic is encrypted as expected but under certain conditions certificate authentication restrictions are not enforced
Conditions:
-Server-side SSL profile.
-Certificate chain validation enabled.
Impact:
LTM may not enforce TLS certificate chain restrictions as expected.
Workaround:
None.
Fix:
LTM now processes server-side TLS traffic as expected.
876077-3 : MRF DIAMETER: stale pending retransmission entries may not be cleaned up
Component: Service Provider
Symptoms:
DIAMETER router messages queued for retransmission may not be deleted until the connection closes.
Conditions:
-- Diameter transmission setting is enabled and a DIAMETER message is queued for retransmission.
-- The retransmission for the message is not triggered
Impact:
The memory used to hold the copy of the message in the retransmission queue is leaked.
Workaround:
None.
Fix:
Stale pending retransmission entries are cleaned up properly.
873877 : Kernel page allocation failure seen on VIPRION B2250 Blade★
Component: TMOS
Symptoms:
Despite having free memory, the BIG-IP system frequently logs kernel page allocation failures to the /var/log/kern.log file:
warning kernel: : [7673174.106142] swapper/6: page allocation failure: order:2, mode:0x104020
Conditions:
This issue is known to occur on the following VIPRION blade models:
- B2250 (A112)
- B4300 (A108)
- B4340N (A110)
- B4450 (A114)
Impact:
As different processes can experience this issue, the system may behave unpredictably. For example, it is possible for installation to fail as a result of this issue. Other processes may not exhibit any side effect as a result of this issue. The exact impact depends on which process becomes affected and how this process is designed to handle such a failure to allocate memory.
Workaround:
You can work around this issue by increasing the value of the min_free_kbytes kernel parameter. This controls the amount of memory that is kept free for use by special reserves.
It is recommend to increase this as follows:
-- 64 MB (65536 KB for 2250 blades).
-- 48 MB (49152 KB for B4300 blades).
-- 128 MB (131072 KB for 4450 blades).
You must do this on each blade installed in the system.
When instantiating this workaround, you must consider whether you want the workaround to survive only reboots, or to survive reboots, upgrades, RMAs, etc. This is an important consideration to make, as you should stop using this workaround when this issue is fixed in a future version of BIG-IP software. So consider the pros and cons of each approach before choosing one.
-- If you want the workaround to survive reboots only, perform the following procedure:
1) Log on to the advanced shell (BASH) of the primary blade of the affected VIPRION system.
2) Run the following commands (with the desired amount in KB):
# clsh "sysctl -w vm.min_free_kbytes=131072"
# clsh "echo -e '\n# Workaround for ID753650' >> /etc/sysctl.conf"
# clsh "echo 'vm.min_free_kbytes = 131072' >> /etc/sysctl.conf"
-- If you want the workaround to survive reboots, upgrades, RMAs, etc., perform the following procedure:
1) Log on to the advanced shell (BASH) of the primary blade of the affected VIPRION system.
2) Run the following commands (with the desired amount in KB):
# clsh "sysctl -w vm.min_free_kbytes=131072"
# echo -e '\n# Workaround for ID753650' >> /config/startup
# echo 'sysctl -w vm.min_free_kbytes=131072' >> /config/startup
Note that the last two commands are not wrapped inside 'clsh' because the /config/startup file is already automatically synchronized across all blades.
Once the issue is fixed in a future BIG-IP version, remove the workarounds:
-- To remove the first workaround:
1) Edit the /etc/sysctl.conf file on all blades and remove the added lines at the bottom.
2) Reboot the system by running 'clsh reboot'. This will restore the min_free_kbytes kernel parameter to its default value for the BIG-IP version you are running.
-- To remove the second workaround:
1) Edit the /config/startup file on the primary blade only, and remove the extra lines at the bottom.
2) Reboot the system by running 'clsh reboot'. This restores the min_free_kbytes kernel parameter to its default value for the BIG-IP version you are running.
To verify the workaround is in place, run the following command (this should return the desired amount in KB):
# clsh "cat /proc/sys/vm/min_free_kbytes"
873469-1 : APM Portal Access: Base URL may be set to incorrectly
Solution Article: K24415506
872673-3 : TMM can crash when processing SCTP traffic
Component: TMOS
Symptoms:
Under certain conditions, TMM may crash while processing SCTP traffic.
Conditions:
-- SCTP listener enabled.
Impact:
TMM crash, leading to a failover event.
Workaround:
None.
Fix:
TMM now processes SCTP traffic as expected.
871905-1 : Incorrect masking of parameters in event log
Component: Application Security Manager
Symptoms:
When using CSRF protection, sensitive parameters values can be masked incorrectly in the event log.
Conditions:
The request contains a CSRF token and sensitive parameters.
Impact:
Sensitive parameters values can be masked incorrectly in the event log.
Workaround:
None.
Fix:
Sensitive parameters values are now correctly masked in the event log when request contains CSRF token.
871761-4 : Unexpected FIN from APM virtual server during Access Policy evaluation if XML profile is configured for VS
Component: Access Policy Manager
Symptoms:
APM virtual server user's GUI (e.g., 'Logon page') cannot be rendered by browsers.
Conditions:
This issue is encountered when an XML profile is configured for the APM virtual server.
Impact:
APM end users are unable to get a logon page.
Workaround:
Disable the XML profile for the APM virtual server.
Fix:
There is no unexpected traffic interruption from the APM virtual server when the XML profile is configured for the virtual server.
870957-1 : "Security ›› Reporting : ASM Resources : CPU Utilization" shows TMM has 100% CPU usage
Component: Application Visibility and Reporting
Symptoms:
TMM CPU utilization around 100 percent under Security ›› Reporting : ASM Resources : CPU Utilization.
Conditions:
No special conditions. Only viewing at the stats of TMM CPU in 'Security ›› Reporting : ASM Resources : CPU Utilization'. They will always be in wrong scale, but when the TMM has ~1% CPU usage, it will be presented as 100% CPU usage.
Impact:
Wrong scale is presented and might cause machine's state to be interpreted wrongly.
Workaround:
1. Backup /etc/avr/monpd/monp_asm_cpu_info_measures.cfg file.
2. Run the following:
$ sed -i 's|tmm_avg_cpu_util)/(count(distinct time_stamp)|tmm_avg_cpu_util)/(count(distinct time_stamp)*100|g' /etc/avr/monpd/monp_asm_cpu_info_measures.cfg
3. Compare the backup file to /etc/avr/monpd/monp_asm_cpu_info_measures.cfg:
Make sure that there are two lines modified, and that the modification is multiplying with 100 the denominator (i.e., actually dividing the TMM value with 100).
4. To make those changes take affect, run the following command:
$ bigstart restart monpd
Fix:
Dividing the TMM value with 100 to fit correct scale.
870389-1 : Increase size of /var logical volume to 1.5 GiB for LTM-only VE images
Component: TMOS
Symptoms:
The /var logical volume size of 950 MiB for LTM-only BIG-IP Virtual Edition (VE) images may be too small for some deployments. This can result in result in loss of SSH access.
Conditions:
This applies to deployments that use declarative onboarding for configuration.
Impact:
Complex declarative onboarding configurations may fill the /var logical volume. You are locked out because of the too-small volume.
Workaround:
The workaround is to manually extend the /var logical volume.
For more information, see K14952: Extending disk space on BIG-IP VE :: https://support.f5.com/csp/article/K14952.
Fix:
The size of the /var logical volume was increased from 950 MiB to 1.5 GiB for LTM-only VE images.
Behavior Change:
The size of the /var logical volume was increased from 950MiB to 1.5GiB for LTM-only Virtual Edition images.
868889 : BIG-IP may reset a stream with an empty DATA frame as END_STREAM
Component: Local Traffic Manager
Symptoms:
HTTP/2 defines END_STREAM flag in a frame as an end of a stream. A peer can send an empty (with no payload) DATA frame to designate a last one in a stream. When BIG-IP receives an empty DATA frame, it handles it incorrectly, sending RST_STREAM to a client.
Conditions:
-- The BIG-IP system has a virtual server configured with an HTTP/2 profile on the client side.
-- The client sends a request containing a payload over a stream, ending the stream with empty DATA frame.
Impact:
The BIG-IP system may reset the stream.
Workaround:
A client should resend the request handling more data.
Fix:
When empty DATA frame with END_STREAM flag is handled by the BIG-IP system, it terminates the stream accordingly.
868381-3 : MRF DIAMETER: Retransmission queue unable to delete stale entries
Component: Service Provider
Symptoms:
DIAMETER messages queued for retransmission that do not receive answer responses may be missed by the sweeper logic and not be deleted until the connection closes.
Conditions:
-- A DIAMETER message is queued for retransmission without a timeout to tigger retransmission.
-- No answer response is received.
Impact:
The memory used to hold the copy of the message in the retransmission queue is leaked.
Workaround:
None.
Fix:
The retransmission queue has been fixes so all stale messages are deleted as expected.
868349-3 : TMM may crash while processing iRules with MQTT commands
Component: Local Traffic Manager
Symptoms:
Under certain conditions, TMM may crash while processing iRules for MQTT profiles.
Conditions:
-MQTT profile.
-MQTT iRule.
Impact:
TMM crash, leading to a failover event.
Workaround:
None.
Fix:
TMM now processes MQTT iRules as expected.
868097-1 : TMM may crash while processing HTTP/2 traffic
Solution Article: K58494243
866925-3 : The TMM pages used and available can be viewed in the F5 system stats MIB
Component: TMOS
Symptoms:
The memory pages available and in use are tracked with system statistics. Previously those statistics were available only with the tmctl command in the shell.
Conditions:
When system resource decisions are being made, the information about memory usage is important.
Impact:
It is not feasible to query each BIG-IP device separately.
Workaround:
None.
Fix:
You can query these statistics with SNMP through the F5-BIGIP-SYSTEM-MIB::sysTmmPagesStat table.
866685-3 : Empty HSTS headers when HSTS mode for HTTP profile is disabled
Component: Access Policy Manager
Symptoms:
HTTP Strict-Transport-Security (HSTS) headers have an empty value for some APM Access Policy-generated responses.
Conditions:
This occurs when the following conditions are met:
-- HTTP profile is configured with HSTS mode=disabled (which it is by default).
-- HTTP requests for APM renderer content, including CSS, JS, and image files from the webtop.
Impact:
Some audit scanners can consider the empty value of Strict-Transport-Security headers as a vulnerability. For browsers, the empty HSTS value equals no HSTS in response.
Workaround:
1. Enable HSTS mode for the HTTP profile.
2. Use an iRule to remove the empty HSTS header from responses:
when HTTP_RESPONSE_RELEASE {
if { [HTTP::header value "Strict-Transport-Security"] eq "" } {
HTTP::header remove "Strict-Transport-Security"
}
}
Fix:
When the HTTP profile is configured with HSTS mode=disabled, responses from APM renderer content are now sent without an HSTS header.
866161-3 : Client port reuse causes RST when the security service attempts server connection reuse.
Component: Access Policy Manager
Symptoms:
If the security service attempts server connection reuse, client port reuse causes RST on new connections.
Conditions:
-- Service profile is attached to virtual server.
or
-- SSL Orchestrator (SSLO) is licensed and provisioned and Service chain is added in the security policy.
-- Security service reuses server-side connection.
-- Client reuses the source port.
Impact:
The BIG-IP system or SSLO rejects new connection from clients when a client reuses the port.
Workaround:
None.
Fix:
The BIG-IP system or SSLO no longer rejects the client connection when the service tries to the reuse server connection and the client reuses the port.
866021-3 : Diameter Mirror connection lost on the standby due to "process ingress error"
Component: Service Provider
Symptoms:
In MRF/Diameter deployment, mirrored connections on the standby may be lost when the "process ingress error" log is observed only on the standby, and there is no matching log on the active.
Conditions:
This can happen when there is a large amount of mirror traffic, this includes the traffic processed by the active that requires mirroring and the high availability (HA) context synchronization such as persistence information, message state, etc.
Impact:
Diameter mirror connections are lost on the standby. When failover occurs, these connections may need to reconnect.
Fix:
Diameter mirror connection no longer lost due to "process ingress error" when there is high mirror traffic.
866013 : Linux Kernel Vulnerabilities: CVE-2019-11477 CVE-2019-11478 CVE-2019-11479
Solution Article: K78234183
865053-1 : AVRD core due to a try to load vip lookup when AVRD is down
Component: Application Visibility and Reporting
Symptoms:
AVRD cores during startup.
Conditions:
Avrd receives a SIGTERM while it is starting.
Impact:
This can lead to an AVRD core.
Fix:
Added some more checks while loading new configuration. Suppose to reduce the frequent of these occurrences. Still can happen in very rare occasions.
864109-3 : APM Portal Access: Base URL may be set to incorrectly
Solution Article: K24415506
863161-3 : Scheduled reports are sent via TLS even if configured as non encrypted
Component: Application Visibility and Reporting
Symptoms:
The scheduled report email is sent from BIG-IP using TLS even if configured to not use encryption. When the mail server TLS is outdated it may lead to failure of the mail delivery.
Conditions:
The scheduled reports are enabled and configured to use a mail server which reports TLS capability.
Impact:
The minor impact is unexpected behaviour. In rare cases it may lead to malfunction of the scheduled reports.
Fix:
The automatic TLS connection was introduced via udate of the phpmailer module. The current fix disables automatic behaviour such that encryption will be used according to BIG-IP configuration.
863069-3 : Avrmail timeout is too small
Component: Application Visibility and Reporting
Symptoms:
AVR report mailer times out prematurely and reports errors:
AVRExpMail|ERROR|2019-11-26 21:01:08 ECT|avrmail.php:325| PHPMailer exception while trying to send the report: SMTP Error: data not accepted.
Conditions:
Configure reports, which will be sent to e-mail
Impact:
Error response from SMTP server, and the report is not sent
Workaround:
Increase timeout in avrmail.php via bash commands
Fix:
The timeout was increased in avrmail.php
860881-1 : TMM can crash when handling a compressed response from HTTP server
Component: Local Traffic Manager
Symptoms:
TMM crashes while handling HTTP response
Conditions:
HTTP virtual server performing decompression of response data from a server, e.g. because a rewrite profile is attached to the virtual server.
Impact:
Traffic disrupted while tmm restarts.
Workaround:
Disable compression on the server.
859721-3 : Using GENERICMESSAGE create together with reject inside periodic after may cause core
Component: Service Provider
Symptoms:
In iRules, when "GENERICMESSAGE::message create" is called after "reject" command inside "after -periodic", it may cause core. Below is an example iRules.
when CLIENT_ACCEPTED {
... omitted ...
after 1000 -periodic {
... omitted ...
reject
GENERICMESSAGE::message create "test"
}
}
This relates to ID 859113.
Conditions:
GENERICMESSAGE::message create" is called after "reject" inside "after -periodic
Impact:
Traffic disrupted while tmm restarts.
Workaround:
There are 2 possible work-arounds
- use "return" command after "reject" to exit after script immediately after "reject" command is invoked
- add routine to cancel the after in CLIENT_CLOSED event
Fix:
Using GENERICMESSAGE create together with reject inside periodic after no longer cause core
859113-3 : Using "reject" iRules command inside "after" may causes core
Component: Local Traffic Manager
Symptoms:
In iRules, when "reject" is used inside "after -periodic" and it is followed by "GENERICMESSAGE::message create". It may trigger a tmm core. Below is an example iRule.
when CLIENT_ACCEPTED {
... omitted ...
after 1000 -periodic {
... omitted ...
reject
GENERICMESSAGE::message create "test"
}
}
This relates to ID 859721
Conditions:
- "reject" is used inside "after -periodic"
- it is followed by "GENERICMESSAGE::message create"
Impact:
Traffic disrupted while tmm restarts.
Workaround:
There are 2 possible work-arounds
- use "return" command after "reject" to exit after script immediately after "reject" command is invoked
- add routine to cancel the after in CLIENT_CLOSED event
Fix:
Using "reject" iRules command inside "after" no longer cause core.
859089-5 : TMSH allows SFTP utility access
Component: TMOS
Symptoms:
The TMSH configuration shell allows users with the Resource Administrator role access to the SFTP command-line utility.
Conditions:
Administrative users with TMSH access and the Resource Administrator role.
Impact:
Resource Administrators have access to the SFTP utility.
Workaround:
None.
Fix:
TMSH no longer allows users with the Resource Administrator role to access the SFTP utility.
Behavior Change:
TMSH users in the Resource Administrator role no longer have access to the SFTP utility. Users may be granted to the Administrator role to provide SFTP access from inside TMSH.
858349-1 : TMM may crash while processing SAML SLO traffic
Component: Access Policy Manager
Symptoms:
Under certain conditions, TMM may crash while processing SAML SLO traffic.
Conditions:
-SAML SLO configured.
Impact:
TMM crash, leading to a failover event.
Workaround:
None.
Fix:
TMM now processes SAML SLO traffic as expected.
858229-3 : XML with sensitive data gets to the ICAP server
Component: Application Security Manager
Symptoms:
XML with sensitive data gets to the ICAP server, even when the XML profile is not configured to be inspected.
Conditions:
XML profile is configured with sensitive elements on a policy.
ICAP server is configured to inspect file uploads on that policy.
Impact:
Sensitive data will reach the ICAP server.
Workaround:
No immediate workaround except policy related changes
Fix:
An internal parameter, send_xml_sensitive_entities_to_icap was added. It's default is 1 as this is the expected behavior. To disable this functionality, change the internal parameter value to 0.
Behavior Change:
An internal parameter has been added, called send_xml_sensitive_entities_to_icap, and the default value is 1.
When this is changed to 0 (using this command):
/usr/share/ts/bin/add_del_internal add send_xml_sensitive_entities_to_icap 0
XML requests with sensitive data will not be sent to ICAP.
858025-3 : Proactive Bot Defense does not validate redirected paths
Component: Application Security Manager
Symptoms:
Under certain conditions, Proactive Bot Defense may redirect clients to an unvalidated path.
Conditions:
-Proactive Bot Defense enabled.
Impact:
Clients may be redirected to an unvalidated path.
Workaround:
None.
Fix:
Proactive Bot Defense now validates redirected paths as expected.
857725 : Anti-Fraud/DataSafe Logging Settings page not found
Component: Fraud Protection Services
Symptoms:
When navigating to Security :: Fraud Protection Service : Anti-Fraud Logging Settings, a 404 error is shown instead of the actual page.
Conditions:
- Provision Fraud Protection Service.
- License DataSafe or Fraud Protection Service.
- Enable the 'antifraud.riskengine.reportlogins' database variable.
Impact:
'Anti-Fraud Logging Settings' page is not found.
Workaround:
Configure logging setting using the Traffic Management Shell (tmsh) utility.
Fix:
'Anti-Fraud Logging Settings' page is shown correctly.
854177-3 : ASM latency caused by frequent pool IP updates that are unrelated to ASM functionality
Component: Application Security Manager
Symptoms:
Whenever a pool IP address is modified, an update is sent to bd regardless of whether that pool is relevant to ASM. When these updates occur frequently, as can be the case for FQDN nodes that honor DNS TTL, latency can be introduced in ASM handling.
Conditions:
Pool nodes have frequent IP address updates, typically due to an FQDN node set to honor DNS TTL.
Impact:
Latency is introduced to ASM handling.
Workaround:
Set the fast changing nodes to static updates every hour.
Fix:
ASM now correctly ignores pool member updates that do not affect remote logging.
853613-2 : Improve interaction of TCP's verified accept and tm.tcpsendrandomtimestamp
Component: Local Traffic Manager
Symptoms:
A TCP connection hangs occasionally.
Conditions:
-- The TCP connection is on the clientside.
-- sys db tm.tcpsendrandomtimestamp is enabled (default is disabled).
-- A virtual server's TCP's Verified Accept and Timestamps are both enabled.
Impact:
TCP connections hangs, and data transfer cannot be completed.
Workaround:
You can use either of the following workarounds:
-- Disable tm.tcpsendrandomtimestamp.
-- Disable either the TCP's Verified Accept or Timestamps option.
Fix:
This release provides improved interaction between TCP's Verified Accept and Timestamps options and the tm.tcpsendrandomtimestamp setting.
853545-3 : MRF GenericMessage: Memory leaks if messages are dropped via iRule during GENERICMESSAGE_INGRESS event
Component: Service Provider
Symptoms:
For each message dropped during GENERICMESSAGE_INGRESS, memory is leaked.
Conditions:
Usage of GENERICMESSAGE::message drop iRule command during GENERICMESSAGE_INGRESS event will leak memory.
Impact:
As more memory is leaked, less memory is available for message processing, eventually leading to a core.
Workaround:
Use MR::message drop during MR_INGRESS event instead to drop a message.
Fix:
Usage of GENERICMESSAGE::message drop iRule command no longer leaks memory.
853329-4 : HTTP explicit proxy can crash TMM when used with classification profile
Component: Local Traffic Manager
Symptoms:
The BIG-IP system may serve HTTP traffic as forward proxy and use DNS resolver objects to provide a server to connect to for request processing. When a classification profile is attached to the virtual server, it may result in a TMM crash with regards to some HTTP requests.
Conditions:
-- PEM is provisioned.
-- HTTP explicit proxy is configured on a virtual server.
-- A classification profile attached to the virtual server.
Impact:
TMM crashes, causing failover. Traffic disrupted while tmm restarts.
Workaround:
None.
Fix:
This release prevents a condition causing this TMM crash.
852445-3 : Big-IP : CVE-2019-6477 BIND Vulnerability
Solution Article: K15840535
852437-1 : Overly aggressive file cleanup causes failed ASU installation
Solution Article: K25037027
Component: Application Security Manager
Symptoms:
Directory cleanup for for failed Attack Signature Updates (ASU) is too aggressive and may delete needed files in the middle of installation itself, which causes the update to fail.
Conditions:
An ASU runs at the same time as the file cleanup task.
Impact:
The ASU fails to complete successfully.
Workaround:
The default clean interval is 300 seconds (5 minutes).
1. Run the following command to monitor the clean activity:
#tailf /var/log/ts/asmcrond.log | grep CleanFiles
2. Watch for following message in the log:
asmcrond|INFO|Mar 20 21:54:44.389|24036|F5::PeriodicTask::Base::run,,Running Task: CleanFiles
3. Upgrade the ASU immediately.
If 5 minutes is not enough, you can increase the clean interval.
1. Adjust the interval in the /etc/ts/tools/asmcrond.cfg file:
From:
[CleanFiles]
Interval=300
To:
[CleanFiles]
Interval=3000
Important: Do not set Interval too high. 50 minutes (3000 seconds) should be enough.
2. Restart the asmcrond by killing the process. It respawns after several seconds.
ps -ef | grep asmcrond
kill <pid>
3. Monitor the asmcrond.log until you see another Cleanfiles log message.
# tailf /var/log/ts/asmcrond.log | grep CleanFiles
4. Install the ASU; the temp files can stay in the folder for 50 minutes.
5. After the ASU is installed, change the interval back to 300 and restart asmcrond.
6. Make sure asmcrond has been started correctly.
# ps -ef | grep asmcrond
# tailf /var/log/ts/asmcrond.log
Fix:
The directory cleanup does not clean up files that are being actively used for an installation.
852373-2 : HTTP2::disable or enable breaks connection when used in iRule and logs Tcl error
Component: Local Traffic Manager
Symptoms:
HTTP/2 connection breaks and Tcl error is logged in /var/log/ltm similar to the following:
TCL error: /Common/http2_disable <CLIENT_ACCEPTED> - Unknown error (line 1) (line 1) invoked from within "HTTP2::disable".
Conditions:
Any of the following Tcl commands are used in any iRule event: HTTP2::enable, HTTP2::enable clientside, HTTP2::disable, HTTP2::disable clientside.
Impact:
HTTP/2 traffic is not passed to the serverside.
Workaround:
Do not use the following Tcl commands: HTTP2::enable, HTTP2::enable clientside, HTTP2::disable, HTTP2::disable clientside
Fix:
When the previously mentioned Tcl commands are used in appropriate HTTP iRule events, such as CLIENT_ACCEPTED, HTTP/2 filter is put into passthrough mode and traffic is delivered to the server.
852313-2 : VMware Horizon client cannot connect to APM after some time if 'Kerberos Authentication' is configured
Component: Access Policy Manager
Symptoms:
VMware Horizon clients cannot ,connect to APM and /var/log/apm contains hte following error:
... err tmm3[12345]: 01490514:3: (null):Common:00000000: Access encountered error: ERR_BOUNDS. File: ../modules/hudfilter/access/access.c, Function: access_do_internal_retry, Line: 16431
Conditions:
-- Access Policy has 'VMware View Logon Page' agent configured with 'Kerberos Authentication'.
-- The policy has been in use for some time.
Impact:
VMware Horizon client cannot connect to APM after some time.
Workaround:
None.
Fix:
Fixed an issue, where 'VMware View Logon Page' agent configured with 'Kerberos Authentication' does not process logon requests after some time.
852289-2 : DNS over TCP packet is not rate-limited accurately by DoS device sweep/flood vector
Component: Advanced Firewall Manager
Symptoms:
DNS over TCP packet is not rate-limited accurately by DoS device sweep and flood vector.
Conditions:
-- Setting the correct DNS pkt type in the DoS device sweep or flood vector.
-- Sending DNS over TCP.
Impact:
DNS over TCP is DDoS attack is not mitigated correctly.
Workaround:
Using DNS DoS vector to mitigate the attack.
Fix:
The attack mitigation by sweep and flood vector is accurate.
852001-3 : High CPU utilization of MCPD when adding multiple devices to trust domain simultaneously
Component: TMOS
Symptoms:
When using more than 4 BIG-IP devices connected in a device cluster, and adding 2 more devices to the trust domain, the mcpd processes of each device may get into a sync loop. This causes mcpd to reach up to 90% CPU utilization during this time, and causes other control-plane functionality to halt. This state may last 10-20 minutes in some cases, or continuous in other cases.
Conditions:
-- More than 4 BIG-IP devices are configured in a trust domain configuration.
-- Adding at least 2 more devices to the trust domain, one after the other, without waiting for the full sync to complete.
-- ASM, FPS, or DHD (DOS) is provisioned.
Impact:
High CPU utilization, GUI, TMSH, and REST API not responding or slow-responding, other system processes halted.
Workaround:
When adding a BIG-IP device to the trust domain, before adding any other device, wait a few minutes until the sync is complete, and no more sync logs display in /var/log/ltm.
Fix:
MCPD no longer utilizes high CPU resources when adding simultaneously 4 or more devices to CMI.
851789-3 : SSL monitors flap with client certs with private key stored in FIPS
Component: Local Traffic Manager
Symptoms:
Bigd reporting 'overload' or 'overloaded' in /var/log/ltm.
SSL monitors flapping while the servers are available.
Conditions:
-- FIPS-enabled platform.
-- HTTPS monitors using client-cert authentication where the key is stored in FIPS HSM.
-- Large number of monitors or low interval.
Impact:
Periodic service interruption depending on which monitors are flapping. Reduced number of available servers.
Workaround:
-- Increase the interval on the monitors.
-- Switch the monitors to use software keys.
Fix:
Optimized FIPS API calls to improve performance of SSL monitors.
850673-3 : BD sends bad acks to the bd_agent for configuration
Component: Application Security Manager
Symptoms:
The bd_agents stops sending configuration in the middle of startup or a configuration change.
The policy maybe incomplete in the bd causing a wrong enforcement.
Conditions:
This is a rare issue and the exact conditions that trigger it are unknown.
Impact:
Bd_agent hangs or restarts which may cause a complete asm restart (and failover).
A partial policy may exist in bd causing improper enforcement.
Workaround:
Export and import the policy in case the policy is enforced incorrectly and un-assigning / re-assigning does not help.
Fix:
Fixed inconsistency scenario between bd and bd_agent.
849405-1 : LTM v14.1.2.1 does not log after upgrade★
Component: TMOS
Symptoms:
After upgrading to v14.1.2.1, logs are not generated and sysstat.service is not running.
Conditions:
-- Upgrade from BIG-IP v12.1.x (which uses CentOS 6) to BIG-IP v14.1.2.1 or later (which uses CentOS 7).
-- The issue is momentary and is not always reproducible.
Impact:
Logs are not generated and sysstat.service is not running.
Workaround:
Once the BIG-IP system starts up, check for failed services:
systemctl list-units --failed
If results show sysstat.service as FAILED, run the following command:
restorecon -Rv /var/log/sa6 && systemctl start sysstat
848405-4 : TMM may consume excessive resources while processing compressed HTTP traffic
Component: Local Traffic Manager
Symptoms:
Under certain conditions, TMM may consume excessive resources while processing compressed HTTP traffic.
Conditions:
-- At least one virtual server with an http-compression profile is configured on BIG-IP.
Impact:
Excessive resource consumption, potentially leading to a failover event.
Workaround:
By removing the compression profile from the virtual servers, possible interruptions of service may be avoided.
Fix:
TMM now processes compressed HTTP traffic as expected.
847325-1 : Changing a virtual server that uses a oneconnect profile can trigger persistence misbehavior.
Component: Local Traffic Manager
Symptoms:
High tmm CPU utilization.
Stalled connection.
Incorrect persistence decisions
Conditions:
A oneconnect profile is combined with certain persist profiles on a virtual server.
The virtual server configuration is changed while there is an ongoing connection to the virtual server. Any connections that make a request after the configuration change can be affected.
The persistence types that are affected are
Source Address (but not hash-algorithm carp)
Destination Address (but not hash-algorithm carp)
Universal
Cookie (only cookie hash)
Host
SSL session
SIP
Hash (but not hash-algorithm carp)
Impact:
High tmm CPU utilization.
Stalled connection.
Incorrect persistence decisions
846365-3 : TMM may crash while processing IP traffic
Solution Article: K35750231
846157-3 : TMM may crash while processing traffic on AWS
Solution Article: K01054113
843105-1 : Adding multicast stats for multicast bridging over L2 wire transparent VLAN-group (LACP STP LLDP)
Component: Local Traffic Manager
Symptoms:
The BIG-IP system can now be configured to collect multicast statistics for LACP, STP, and LLDP. It is controlled by a sys db variable:
l2.virtualwire.multicast.stats
It is enabled by default.
Conditions:
This is encountered when L2 wire transparent VLAN groups are configured.
Impact:
The ability to collect and read multicast statistics makes it easier to debug l2 wire setups.
Multicast statistics can be viewed in the following tmctl table:
tmctl -w250 tmm/l2_mcast_stat
Workaround:
None.
Fix:
Added new stats available like:
tmctl -w250 tmm/l2_mcast_stat
842125-4 : Unable to reconnect outgoing SCTP connections that have previously aborted
Component: TMOS
Symptoms:
When an outgoing SCTP connection is created using an ephemeral port, the connection may appear to be open after an SCTP connection halt. This prevents new connections to the same endpoint, as the connection appears to already exist.
Conditions:
-- A virtual server configured with an SCTP profile.
-- An outgoing SCTP connection after an existing connection to the same endpoint has halted.
Impact:
New connections are unable to be created resulting in dropped messages.
Workaround:
None.
Fix:
SCTP connections can now be halted and recreated to the same endpoint.
839597-4 : Restjavad fails to start if provision.extramb has large value
Component: Device Management
Symptoms:
Rolling restarts of restjavad every few seconds typically due to failure to start and reports messages in daemon log:
daemon.log: emerg logger: Re-starting restjavad
The system reports similar message at the command line.
No obvious cause is logged in rest logs.
Conditions:
-- System DB variable provision.extramb has an unusually high value*:
+ above ~2700-2800MB for v12.1.0 and earlier.
+ above ~2900-3000MB for v13.0.0 and later.
-- On v13.0.0 and later, sys db variable restjavad.useextramb needs to have the value 'true'
*A range of values is shown. When the value is above the approximate range specified, constant restarts are extremely likely, and within tens of MB below that point may be less frequent.
To check the values of these system DB varaiables use:
tmsh list sys db provision.extramb
tmsh list sys db restjavad.useextramb
Impact:
This impacts the ability to use the REST API to manage the system
Workaround:
If needing sys db restjavad.useextramb to have the value 'true', keep sys db provision.extramb well below the values listed (e.g., 2000 MB work without issue).
To set that at command line:
tmsh modify sys db provision.extrammb value 2000
If continual restarts of restjavad are causing difficulties managing the unit on the command line:
1. Stop restjavad (you can copy this string and paste it into the command line on the BIG-IP system):
tmsh stop sys service restjavad
2. Reduce the large value of provision.extramb if necessary.
3. Restart the restjavad service:
tmsh start sys service restjavad
839453-4 : lodash library vulnerability CVE-2019-10744
Solution Article: K47105354
839401-3 : Moving a virtual-address from one floating traffic-group to another does not send GARPs out.
Component: Local Traffic Manager
Symptoms:
Gratuitous ARPs (GARPs) are not sent out when moving a virtual-address from one floating traffic-group to another (e.g., from traffic-group-1 to traffic-group-2).
Conditions:
-- Moving a virtual-address from one floating traffic-group to another.
-- The traffic-groups are active on different devices.
Impact:
Application traffic does not immediately resume after the virtual-address is moved. Instead, the surrounding network devices have to ARP out for the IP address after reaching a timeout condition.
Workaround:
After moving the virtual-address, disable and then re-enable the ARP setting for the virtual-address. This forces GARPs to be sent out.
Fix:
GARPs are sent out as expected.
838881-3 : APM Portal Access Vulnerability: CVE-2020-5853
Solution Article: K73183618
838709-1 : Enabling DoS stats also enables page-load-time
Component: Application Visibility and Reporting
Symptoms:
If collect-all-dos-statistic is enabled, AVR 'promises' to the client a JavaScript injection in the response by adding the expected length of the JavaScript to the Content-length header.
Conditions:
Security :: reporting : settings : collect-all-dos-statistic is enabled.
Impact:
In addition to collecting DoS statistics, JavaScript injection also occurs.
Workaround:
Can use iRules to control which pages should get the JavaScript injection.
For detailed information, see K13859: Disabling CSPM injection with iRules :: https://support.f5.com/csp/article/K13859.
Fix:
Changed the condition that insert the JavaScript injection in case that "collect all dos stats" is enabled.
838677-3 : lodash library vulnerability CVE-2019-10744
Solution Article: K47105354
837837-3 : SSH Client Requirements Hardening
Component: TMOS
Symptoms:
In some configurations, BIG-IP systems allow the use of DSA keys for SSH authentication.
Conditions:
Terminal Access (SSH) enabled for users with DSA keys.
Impact:
DSA keys are allowed for authentication, exposing BIG-IP to the limitations of this key format, including potential compromise of the authenticated session.
Workaround:
For ssh key based authentications, DSA keys should not be used.
Fix:
ssh-dss is disabled from supported authentication methods. It can be enabled under BIGIP using command tmsh modify sys sshd { include '"HostKeyAlgorithms +ssh-dss"' }
Behavior Change:
ssh-dss is now disabled by default from supported SSH authentication methods. It can be explicitly enabled under BIG-IP using command: tmsh modify sys sshd { include '"HostKeyAlgorithms +ssh-dss"' }
837773-2 : Restjavad Storage and Configuration Hardening
Component: Device Management
Symptoms:
The restjavad component does not follow current best coding practices.
Conditions:
-REST endpoints in use
Impact:
The restjavad component does not follow current best coding practices.
Workaround:
None.
Fix:
The restjavad component now follows current best coding practices.
836661 : Incorrect source MAC used when the BIG-IP system in L2 transparent mode generates a TCP RST packet.
Component: Local Traffic Manager
Symptoms:
Packet with unexpected source MAC is seen on the adjacent node to the BIG-IP system.
Conditions:
-- The BIG-IP system is configured in an L2 transparent mode using virtual wires.
-- Traffic forwarded between client and server in an asymmetric manner across virtual wires.
Impact:
Incorrect source MAC is used. Possible impacts to services on nodes adjacent to the BIG-IP system if policy decisions on those nodes are made with the source MAC of the received packet as input.
Workaround:
None.
836357-3 : SIP MBLB incorrectly initiates new flow from virtual IP to client when existing flow is in FIN-wait2
Component: Service Provider
Symptoms:
In MBLB/SIP, if the BIG-IP system attempts to send messages to the destination over a TCP connection that is in FIN-wait2 stage, instead of returning a failure and silently dropping the message, the BIG-IP system attempts to create a new TCP connection by sending a SYN. Eventually, the attempt fails and causes the connection to be aborted.
Conditions:
-- This happens on MBLB/SIP deployment with TCP.
-- There is message sent from the server to the BIG-IP system.
-- The BIG-IP system forwards the message from the server-side to client-side.
-- The destination flow (for the BIG-IP system to forward the message to) is controlled by 'node <ip> <port>' and 'snat <ip> <port>' iRules command.
-- The destination flow is in the FIN-wait2 stage.
Impact:
This causes the BIG-IP system to abort the flow that originates the message.
Workaround:
None.
Fix:
SIP MBLB correctly initiates a new flow from a virtual IP to the client when an existing flow is in the FIN-wait2 stage.
835381-1 : HTTP custom analytics profile 'not found' when default profile is modified
Component: Application Visibility and Reporting
Symptoms:
Adding SMTP config to default HTTP analytics profile results in config parsing failures for child profiles that are assigned to virtual servers. Removing SMTP config resolves the issue. The 'tmsh load sys config' command fails with the following error:
-- 01020036:3: The requested profile (/Common/child-analytics) was not found.
-- Unexpected Error: Validating configuration process failed.
Conditions:
-- Child analytics profile applied to virtual server.
-- Parent analytics profile contains SMTP config.
Impact:
Loading configuration might fail.
Workaround:
None.
Fix:
The system now avoids setting SMTP field for child profiles on MCP validation when in load/merge phase.
834373-3 : Possible handshake failure with TLS 1.3 early data
Component: Local Traffic Manager
Symptoms:
During TLS 1.3 early data handshake, a code alert and handshake failure may occur
Conditions:
TLS 1.3 with early data resumption.
Impact:
Handshake failure.
Workaround:
Turn off early data.
Fix:
Fixes a possible TLS 1.3 early data handshake failure and code alert.
834257-3 : TMM may crash when processing HTTP traffic
Component: Local Traffic Manager
Symptoms:
Under certain conditions, TMM may crash while processing HTTP traffic.
Conditions:
A virtual with standard HTTP profile is configured.
Impact:
When TMM crashes it causes a failover event and may interrupt traffic processing.
Workaround:
None.
Fix:
TMM now processes HTTP traffic as expected.
833213-3 : Conditional requests are served incorrectly with AAM policy in webacceleration profile
Component: WebAccelerator
Symptoms:
HTTP 1.1 allows a conditional request with header If-Modified-Since or If-Unmodified-Since to determine whether a resource changed since a specified date and time. If AAM is provisioned and its policy is assigned to a virtual server, it may incorrectly respond with 304 Not Modified, even after the resource was updated.
Conditions:
-- AAM is provisioned and webacceleration policy is attached to a virtual server.
-- Client sends a conditional request with If-Modified-Since or If-Unmodified-Since header.
-- The BIG-IP system responds from AAM cache.
Impact:
Client does not receive an updated resource.
Workaround:
Use webacceleration profile without AAM policy for resources that require conditional checks falling back into Ramcache.
Fix:
The BIG-IP system now respects If-Modified-Since or If-Unmodified-Since header and provides an appropriate response for the requested resource when compared to the date supplied in either header.
833113-3 : Avrd core when sending large messages via https
Component: Application Visibility and Reporting
Symptoms:
When sending large messages (>4KB) via HTTPs may cause avrd to core.
Conditions:
This typically happens when BIG-IP is managed by BIG-IQ and configuration is large and complex or traffic capturing is enabled.
Impact:
Messages to BIG-IQ are lost. In severe cases, analytics functionality may be unavailable due contiguous AVRD cores.
Workaround:
None.
Fix:
Fixed an avrd crash
832857 : Support ID on AJAX CAPTCHA popup (SPA) does not match the Support ID in log
Component: Application Security Manager
Symptoms:
The Support ID shown to the ASM end user does not appear in the logs.
Conditions:
-- ASM provisioned.
-- Bot Defense profile attached to a virtual server.
-- Single Page Application (SPA) is enabled in the Bot Defense profile.
-- AJAX request is blocked by bot defense, and CAPTCHA is shown to the ASM end user.
Impact:
ASM end user might complain about CAPTCHA and provide their Support ID to the BIG-IP administrator, but the BIG-IP administrator will not be able to find the Support ID in the logs.
Workaround:
None.
Fix:
Bot defense has been fixed so that the Support ID shown to the ASM end user matches the Support ID in the logs.
832569-2 : APM end-user connection reset
Component: Access Policy Manager
Symptoms:
When the URL being accessed exceeds a length of 8 KB, the BIG-IP resets the connection.
Conditions:
-- APM deployed with a per-request policy.
-- The per-request policy includes a category lookup.
Impact:
The APM end-user connection is reset, and the system posts an error message in /var/log/apm:
-- crit tmm[23363]: 01790601:2: [C] 10.62.118.27:65343 -> 65.5.55.254:443: Maximum URL size exceeded.
Workaround:
None.
832205 : ASU cannot be completed after Signature Systems database corruption following binary Policy import
Component: Application Security Manager
Symptoms:
Signatures cannot be updated after signature systems have become corrupted in the configuration database, after a binary policy containing a user-defined Signature Set using an unknown System was imported.
Conditions:
Signature systems are corrupted in configuration database, because a binary policy containing a user-defined Signature Set using an unknown System was imported.
Impact:
Signatures cannot be updated.
Workaround:
Delete signature systems with an ID greater than 38, and re-add them by performing a signature update. You can delete these signature systems by running the following command:
mysql -u root -p$(perl -MPassCrypt -nle 'print PassCrypt::decrypt_password($_)' /var/db/mysqlpw) -e "DELETE FROM PLC.NEGSIG_SYSTEMS WHERE system_group = ''"
832021-1 : Port lockdown settings may not be enforced as configured
Solution Article: K73274382
832017-1 : Port lockdown settings may not be enforced as configured
Solution Article: K10251014
831781-5 : AD Query and LDAP Auth/Query fails with IPv6 server address in Direct mode
Component: Access Policy Manager
Symptoms:
Both AD Query and LDAP Auth/Query fails.
Conditions:
-- AD Query Agent, LDAP Auth Agent, or LDAP Query Agent is configured in Per-Session or Per-Request Policy.
-- These agents are configured in Direct mode.
-- The AD and LDAP server address is configured as IPv6 address.
Impact:
Users may not be able to login to APM, and hence service is disrupted.
Workaround:
None.
Fix:
Users are now able to login to APM.
831661-2 : ASMConfig Handler undergoes frequent restarts
Component: Application Security Manager
Symptoms:
Under some settings and load the RPC handler for the Policy Builder process restarts frequently, causing unnecessary churn and slower learning performance.
Conditions:
Configure one or more policies with automatic policy building enabled and learn traffic with violations
Impact:
Control Plane instability and poor learning performance on the device.
Fix:
The Policy Builder handler is now restored to a more robust process lifecycle.
831325-2 : HTTP PSM detects more issues with Transfer-Encoding headers
Solution Article: K10701310
Component: Local Traffic Manager
Symptoms:
HTTP PSM may not detect some invalid Transfer-Encoding headers.
Conditions:
HTTP PSM is used to detect HTTP RFC violations. A request with an invalid Transfer-Encoding header is sent.
Impact:
Traffic is not alarmed/blocked as expected.
Workaround:
None.
Fix:
HTTP PSM detects new cases of invalid Transfer-Encoding headers.
830833-2 : HTTP PSM blocking resets should have better log messages
Component: Local Traffic Manager
Symptoms:
When reset-cause logging is turned on, or when RST packet logging is used, the reset reason used when rejecting bad HTTP PSM traffic is not descriptive.
Conditions:
This occurs under either of these conditions:
-- HTTP PSM is used, and a request is blocked.
-- Reset cause or RST packet logging is enabled.
Impact:
The reset reason given is not descriptive, making troubleshooting difficult.
Workaround:
None.
Fix:
The reset reason used when rejecting HTTP PSM traffic is more descriptive.
830797-2 : Standby high availability (HA) device passes traffic through virtual wire
Component: Local Traffic Manager
Symptoms:
Virtual wire is forwarding traffic on standby resulting in traffic loops and potential network outage.
Conditions:
-- High availability (HA) configured.
-- Virtual wire configured.
Impact:
Standby device is passing traffic, which may create traffic loops and bring down the network.
Workaround:
Do not configure virtual wire on standby devices.
Fix:
Although you can create this configuration, the standby no longer forwards any traffic, which prevents the traffic loop and potential network outage.
830401-3 : TMM may crash while processing TCP traffic with iRules
Solution Article: K54200228
830073-3 : AVRD may core when restarting due to data collection device connection timeout
Component: Application Visibility and Reporting
Symptoms:
Avrd crashes, one or more core avrd files exist in /var/core
Conditions:
-- A BIG-IP system is managed by BIG-IQ via secure channel
-- Avrd is restarted.
Impact:
Avrd cores as it is shutting down. During avrd shutdown, the BIG-IQ data collection device (DCD) is unreachable for 10 minutes
Workaround:
None.
Fix:
The AVRD HTTPS module now stops any connection attempts when shutdown sequence is in progress, so this issue no longer occurs.
829121-3 : State mirroring default does not require TLS
Solution Article: K65720640
829117-3 : State mirroring default does not require TLS
Solution Article: K17663061
828937-3 : Some systems can experience periodic high IO wait due to AVR data aggregation
Solution Article: K45725467
Component: Application Visibility and Reporting
Symptoms:
Systems with a large amount of statistics data collected in the local database (i.e., systems not working with BIG-IQ) can have high IO Wait CPU usage, peaking at 10 minutes, 1 hour, and 24 hours. This is caused by the data aggregation process that is running on the local database.
Conditions:
-- The BIG-IP system is collecting statistics locally (i.e., not sending data to BIG-IQ or another external device).
-- There is a large amount of statistics data.
Impact:
High IO can impact various processes on BIG-IP systems. Some of them can experience timeouts and might restart.
Workaround:
The most effective workaround is to lower the amount of data collected by setting the 'avr.stats.internal.maxentitiespertable' DB variable to a lower value. The recommended values are 20000 (on larger, more powerful systems with more than 16 cores) or 2148 (on smaller systems).
Note: After you lower the database value, continue to monitor the BIG-IP system for long I/O wait times and high CPU usage. If symptoms persist and the system continues to experience resource issues, you may need to reset the BIG-IP AVR statistics. For information about resetting BIG-IP AVR statistics, refer to K14956: Resetting BIG-IP AVR statistics :: https://support.f5.com/csp/article/K14956.
Fix:
Set default value of avr.stats.internal.maxentitiespertable DB variable to 20000. Set it to 2148 on systems with fewer than or equal to CPU 16 cores.
826601-5 : Prevent receive window shrinkage for looped flows that use a SYN cookie
Component: Local Traffic Manager
Symptoms:
TMM cores.
Conditions:
-- VIP to VIP (looped flow) configuration.
-- SYN cookie is used.
-- Initial receive window is greater than 3.
Impact:
Traffic disrupted while tmm restarts.
Workaround:
-- Set the initial receive window value of the VIP to 3.
Fix:
Receive window shrinkage is prevented for looped flows using SYN cookies.
825805-1 : NTLM Auth may fail due to incorrect handling of EPM response★
Component: Access Policy Manager
Symptoms:
NTLM passthrough authentication may stop working after upgrade.
Conditions:
-- NTLM authentication configured.
-- Upgraded to a BIG-IP software version that contains the implementation for the Microsoft Internet Explorer feature, 'Enhanced protected mode' (EPM).
-- There are more than two protocol sequence towers included in the EPM response.
Impact:
APM end users cannot login.
Workaround:
None.
Fix:
The system can now parse EPM response as expected.
824365-3 : Need informative messages for HTTP iRule runtime validation errors
Component: Local Traffic Manager
Symptoms:
For HTTP iRule runtime validation errors, an ERR_NOT_SUPPORTED error message is appended (with rule name and event) to /var/log/ltm, but the message is not informative about the cause of the validation error:
err tmm1[20445]: 01220001:3: TCL error: /Common/example <HTTP_REQUEST> - ERR_NOT_SUPPORTED (line 1) invoked from within "HTTP::uri".
The system should post a more informative message, in this case:
err tmm[10662]: 01220001:3: TCL error: /Common/example <HTTP_REQUEST> - can't call after responding - ERR_NOT_SUPPORTED (line 1) invoked from within "HTTP::uri"
Conditions:
-- HTTP filter and HTTP iRules are used by a virtual server.
-- An HTTP iRule runtime validation error happens. For example, HTTP::uri is called after HTTP::respond () which is not supported.
Impact:
With no informative error messages, it is difficult to identify the validation error.
Workaround:
There is no workaround at this time.
Fix:
Informative messages are provided for HTTP iRule runtime validation errors.
824149-3 : SIP ALG virtual with source-nat-policy cores if traffic does not match the source-nat-policy or matches the source-nat-policy which does not have source-translation configured
Component: Service Provider
Symptoms:
In SIP ALG virtual with source-nat-policy assigned, if traffic processed by the virtual server does not match source-nat-policy, or if it matches source-nat-policy that does not have source-translation configured, tmm cores and restarts.
Conditions:
-- SIP ALG virtual server with an assigned source-nat-policy.
-- Traffic does not match the source-nat-policy, or traffic matches a source-nat-policy that has no source-translation configured.
Impact:
Traffic disrupted while tmm restarts.
Workaround:
Configure SIP ALG virtual so that the condition never happens. For example, apply a source attribute to the virtual server that filters out traffic that will not match the source-nat-policy. Never use a source-nat-policy that has no source-translation.
824101-1 : Request Log export file is not visible for requests including binary data
Component: Application Security Manager
Symptoms:
Request Log export file is not visible.
Conditions:
Request Log export file contain request with binary data
Impact:
Cannot get data from Request Log export file.
Workaround:
None.
824037-2 : Bot Defense whitelists do not apply for IP 'Any' when using route domains
Component: Application Security Manager
Symptoms:
When defining whitelists in bot defense profiles, when the IP is set to 'Any' and route domains are in use, whitelists are not applied.
Conditions:
-- Bot Defense profile is enabled.
-- Whitelist is configured for IP 'Any' (for URL or GEO),
-- Sending a request that matches the whitelist using route domains.
Impact:
Request will be mitigated.
Workaround:
For url whitelist only:
Add micro service to the bot defense profile, configure:
1. Add required URL.
2. Specify service type 'Custom Microservice Protection'.
3. Set the 'Mitigation and Verification' setting as required (relevant for logging only).
4. In 'Automated Threat Detection', set 'Mitigation Action' to 'None'.
5. Set the microservice 'Enforcement Mode' to 'Transparent'.
This causes the associated URL to never be blocked (but no 'whitelist' will be seen in reporting).
Fix:
Enabling IP 'Any' on route domains now works as expected.
823893-2 : Qkview may fail to completely sanitize LDAP bind credentials
Solution Article: K03318649
821369 : Incomplete Action 'Deny' does not take effect for HTTP-Connect
Component: Access Policy Manager
Symptoms:
Per-request policy's incomplete-action 'Deny' does not take effect for HTTP-Connect request.
Conditions:
-- SSL Orchestrator (SSLO) or APM is licensed and provisioned.
-- Per-request policy is created and attached to a virtual server.
-- Incomplete Action value of per-request policy is set to 'Deny'.
Impact:
The BIG-IP system does not reject the HTTP-Connect request when incomplete-action is set to 'Deny'.
Workaround:
None.
Fix:
Incomplete Action 'Deny' now takes effect for HTTP-Connect request.
821133-2 : Wrong wildcard URL matching when none of the configured URLS include QS
Component: Fraud Protection Services
Symptoms:
Wildcard URLs has a flag (include_query_string) which indicates if the matching should include traffic URL's QS or not
For example, if the traffic URL is '/path?a=b' and configured URL is '/path*b':
1. if include QS enabled, URL is matched
2. otherwise, no match (since matching against '/path' only)
if there are no configured URLs with "Include Query String" enabled, matching may be wrong
Conditions:
1. Wildcard URL configured in anti-fraud profile (URL name contains an asterisk)
2. None of the configured URLs has "Include Query String" enabled
3. Traffic URL contains a query-string
Impact:
URL is incorrectly matched (when it either shouldn't be matched at all or should match another configured URL). Features/signatures might not work as expected.
Workaround:
Configure at least one URL with "Include Query String" enabled
Fix:
FPS should match query string correctly (according to configuration)
819397-1 : TMM does not enforce RFC compliance when processing HTTP traffic
Component: Local Traffic Manager
Symptoms:
TMM does not require RFC compliance when processing HTTP traffic. This does not impact the performance or security of BIG-IP systems, but may impact connected systems if they expect only compliant traffic to be forwarded.
Conditions:
-- HTTP virtual server
-- Non-compliant HTTP request from client
Impact:
Pool members may be exposed to non-compliant HTTP requests.
Workaround:
None.
Fix:
The HTTP filter now optionally performs basic RFC compliance checks. If a request fails these checks, then the connection is reset.
Behavior Change:
A new BigDB variable has been added.
The new 'Tmm.HTTP.RFC.Enforcement' option may be enabled or disabled. It is disabled by default.
If enabled, the HTTP filter performs basic RFC compliance checks. If a request fails these checks, then the connection is reset.
The checks performed are a subset of those described within the HTTP PSM module. If a blocking page is required, or more detailed control over which checks are performed, configure HTTP PSM or ASM on the virtual server.
If either HTTP PSM or ASM are configured on a virtual server, the state of the 'Tmm.HTTP.RFC.Enforcement' BigDB variable is ignored on that virtual server.
819197-4 : BIGIP: CVE-2019-13135 ImageMagick vulnerability
Solution Article: K20336394
819189-3 : BIGIP: CVE-2019-13136 ImageMagick vulnerability
Solution Article: K03512441
819009-3 : Dynamic routing daemon mribd crashes if 'mrib debug all' is enabled in high availability (HA) config with Floating Self IP configured for PIM protocol.
Component: TMOS
Symptoms:
The multicast routing protocols are implemented by pimd and mribd daemons. mribd daemon crashes in a specific configuration when debug logging is enabled for this daemon.
Conditions:
1) Dynamic Routing bundle is enabled and PIM protocol is enabled on a route domain.
2) High availability (HA) group/pair with floating self IP address is configured.
3) PIM neighbors are configured for each peer in high availability (HA) group/pair.
4) One of the peers in high availability (HA) is configured to use floating self IP address as an IP address for PIM protocol.
This is done using the 'ip pim use-floating-address' command in the PIM configuration in imish:
# ip pim use-floating-address
5) Multicast routing is configured in imish:
# ip multicast-routing
6) Debug logging for mribd is enabled:
# debug ip mrib all
# debug ipv6 mrib all
---
Note: Although steps 3 and 4 are optional, a practical configuration makes no sense without them.
Impact:
Dynamic routing daemon mribd crashes. Advanced routing not available while mribd restarts.
Workaround:
None.
Fix:
Dynamic routing daemon mribd no longer crashes when mribd debug logging is enabled.
818709-2 : TMSH does not follow current best practices
Solution Article: K36814487
818429-4 : TMM may crash while processing HTTP traffic
Solution Article: K70275209
817917-1 : TMM may crash when sending TCP packets
Solution Article: K00025388
817649-2 : AVR statistics for NAT cannot be shown on multi-bladed machine
Component: Application Visibility and Reporting
Symptoms:
The system presents an error messagewhen trying to get AVR statistics for NAT:
Data Input Error: Database is unavailable.
Conditions:
Using AVR reports for NAT on a multi-bladed BIG-IP device.
Impact:
Cannot view AVR statistics for NAT.
Workaround:
1. Back up the file /etc/avr/monpd/monp_tmstat_fw_nat_entities.cfg
2. Run the following command:
sed -i 's/measures=/measures=period,/' /etc/avr/monpd/monp_tmstat_fw_nat_entities.cfg
3. Verify that the only change made to 'sed -i 's/measures=/measures=period,/' /etc/avr/monpd/monp_tmstat_fw_nat_entities.cfg' was adding a 'period,' to the list of measures (can be compared against the backup file).
4. Restart monpd (to pick up the changes):
bigstart restart monpd
Fix:
Fixed formula for statistics to allow using it on a multi-bladed BIG-IP device.
817417-1 : Blade software installation stalled at Waiting for product image★
Component: Local Traffic Manager
Symptoms:
On a chassis system where the active/primary blade is running version 14.1.0 or later and a new blade is inserted that has version 14.0.0 or lower, the secondary blades fail to receive the updated images and the installation stalls. The primary blade reports 'Waiting for product image' when running the tmsh show sys software status command.
Conditions:
Primary blade running version 14.1.0 or above.
Secondary running an earlier version is inserted.
Impact:
Newly inserted blade does not synchronize volumes with the primary blade and cannot be used.
The tmsh show sys software status command reports that one or more blades are in 'waiting for product image' status indefinitely.
Workaround:
Ensure all blades are running the same version. This can be accomplished manually by running the following command at the command prompt (this example is for new blade inserted at slot #3):
scp /shared/images/* slot3:/shared/images
816625-1 : The TMM may crash in a rare scenario involving HTTP unchunking, and plugins.
Component: Local Traffic Manager
Symptoms:
The TMM crashes while passing traffic.
Conditions:
This occurs rarely on a Virtual Server configured with an HTTP profile that has HTTP response chunking enabled.
Impact:
Traffic disrupted while tmm restarts.
Workaround:
None.
Fix:
The TMM no longer crashes in a rare scenario involving HTTP unchunking and plugins.
816529-2 : If wr_urldbd is restarted while queries are being run against Custom DB then further lookups can not be made after wr_urldbd comes back up from restart.
Component: Traffic Classification Engine
Symptoms:
URLCAT lookups to Custom DB return Unknown result.
Conditions:
-- URL is being looked up against Custom DB
-- wr_urldbd is restarted at the same time
Impact:
Queries will likely fail in highly loaded environments if wr_urldbd is restarted for any reason.
Workaround:
None.
Fix:
Wr_urldbd restores connection to Custom DB after restart.
816273-2 : L7 Policies may execute CONTAINS operands incorrectly.
Component: Local Traffic Manager
Symptoms:
L7 Policies involving CONTAINS operands may execute incorrectly in some cases.
The policy compiler may incorrectly combine some internal states, 'forgetting' degrees of partial evaluation of a CONTAINS operation.
Conditions:
Multiple CONTAINS conditions are used on the same virtual server.
Impact:
The wrong policy actions may be triggered.
Workaround:
It may be possible to reorder the rules in a policy to restore correct operation. However, the more complex the policy, the less likely this is.
Fix:
L7 Policy CONTAINS operations are compiled correctly. Policies with CONTAINS operations no longer trigger the wrong rule actions.
815877-1 : Information Elements with zero-length value are rejected by the GTP parser
Component: Service Provider
Symptoms:
When processing a GTP message containing zero-length IEs (which are allowed by the 3GPP Technical Specification), the message might get rejected.
Conditions:
Virtual server with GTP profile enabled processing GTP traffic.
Impact:
Well-formed GTP messages might get rejected.
Workaround:
Avoid sending GTP messages containing zero-length IEs.
Fix:
Zero-length IEs are now processed correctly.
815689-3 : Azure walinuxagent has been updated to v2.2.42.
Component: TMOS
Symptoms:
Some onboarding features are not available in the current version of walinuxagent.
Conditions:
Attempting to use a feature that is not available in the current version of the Azure walinuxagent that is included in the BIG-IP release.
Impact:
Cannot use new features in the Azure walinuxagent until the Azure walinuxagent is updated.
Workaround:
None.
Fix:
The Azure walinuxagent has been updated to v2.2.42.
815649-1 : Named.config entry getting overwriting on SSL Orchestrator deployment
Component: Device Management
Symptoms:
When topology or general settings are re-deployed, named.config is modified, and entries which do not belong to SSL Orchestrator are overwritten.
Conditions:
This occurs when topology or system settings are re-deployed.
Impact:
Content of named.conf file is lost/overwritten.
Workaround:
Modify named.conf manually or using zoneRunner (DNS :: Zones : ZoneRunner : named Configuration) after SSL orchestrator deployment.
815449-2 : BIG-IP closes connection when an unsized response is served to a HEAD request
Component: Local Traffic Manager
Symptoms:
When HTTP response has neither Content-Length nor Transfer-Encoding and has a body, BIG-IP closes a connection to designate end of the response body. HTTP protocol allows to send HEAD request instead of GET request to obtain a response headers only (without). BIG-IP erroneously closes a connection when a response to HEAD request lacks both Content-Length and Transfer-Encoding.
Conditions:
BIG-IP has a virtual server configured to use an HTTP profile.
The server response does not include the Content-Length or Transfer-Encoding headers in response to a HEAD request, and both client and server sides expects the communication to continue over the same connection.
Impact:
Connection closes and a client may not repeat the corresponding GET request on another connection.
Fix:
Connection keeps opened when an unsized response provided to a HEAD request.
814953-3 : TMUI dashboard hardening
Component: TMOS
Symptoms:
The TMUI dashboard does not comply with current best practices.
Conditions:
TMUI dashboard accessed by authenticated administrative user.
Impact:
The TMUI dashboard does not comply with current best practices.
Workaround:
None.
Fix:
The TMUI dashboard now complies with current best practices.
813945-3 : PB core dump while processing many entities
Component: Application Security Manager
Symptoms:
PB core dump.
Conditions:
This may happen when the system is strained and PB is processing large policies (updating many entities may happen during periodic processing, response analysis).
This is a very rarely occurring scenario.
Impact:
PB core dump and restart.
Workaround:
None.
Fix:
PB core dump no longer occurs.
813389-1 : TMM Crashes upon failure in Bot Defense Client-Side code
Component: Application Security Manager
Symptoms:
On some cases, when Bot Defense Client-Side code is running on the browser, it causes TMM to crash.
Conditions:
-- Bot Defense is enabled with any JS browser verification (before or after access).
-- Surfing using a browser to an html page.
Impact:
Traffic disrupted while tmm restarts.
Workaround:
None.
Fix:
Adding sanity test so TMM will not crash.
812981-4 : MCPD: memory leak on standby BIG-IP device
Component: TMOS
Symptoms:
MCPD memory consumption may increase on standby BIG-IP device if APM configuration is updated. Some of the allocated memory is not freed after configuration update.
Conditions:
-- BIG-IP high availability (HA) pair is installed and configured
-- APM is provisioned
-- Access Policy is configured and updated periodically
Impact:
MCPD may take a lot of memory on the standby device. Normal functionality of standby device may be stopped; reboot of the device is required.
Fix:
MCPD on standby BIG-IP device does not take more memory than the same daemon on active BIG-IP device.
812341-2 : Patch or Delete commands take a long time to complete when modifying an ASM signature set.
Component: Application Security Manager
Symptoms:
When modifying an ASM signature set that is not attached to any security policy using iControl REST Patch or Delete commands, the command takes a long time to complete.
Conditions:
-- ASM provisioned.
-- Using REST API Patch or Delete command to modify an ASM signature set.
Impact:
Command takes longer (several seconds) to process on detached ASM signature sets than it takes to complete on attached signature sets.
Workaround:
None.
Fix:
Changes to signatures and signatures sets now only recompile policies that are affected by the change.
811789-2 : Device trust UI hardening
Component: TMOS
Symptoms:
Improved device trust UI input sanitization
Conditions:
-ConfigSync in use
Impact:
Improved device trust UI input sanitization
Workaround:
None
Fix:
Improved device trust UI input sanitization
811745-2 : Failover between clustered DIAMETER devices can cause mirror connections to be disconnected
Component: Service Provider
Symptoms:
When using DIAMETER with certain settings, a failover might cause mirror connections to get disconnected.
Conditions:
-- Two or more BIG-IP systems in a high availability (HA) configuration.
-- Aggressive settings for the DIAMETER watchdog timeout and max failures.
Impact:
Loss of mirroring between BIG-IP systems.
Workaround:
None.
Fix:
Mirror connections no longer disconnect during a failover.
811333-2 : Upgrade fails when SSLv2 cipher is in the cipher list of an SSL profile★
Component: Local Traffic Manager
Symptoms:
After upgrade, configuration load fails and the following error is present in /var/log/ltm log:
01070312:3: Invalid keyword 'sslv2' in ciphers list for profile /Common/serverssl-insecure-compatible
Unexpected Error: Loading configuration process failed.
Conditions:
-- BIG-IP system with SSLv2 as ciphers option in SSL profile running software v12.x/v13.x.
-- Upgrading to a version that reports an error when using SSLv2, such as v14.x/v15.x.
Impact:
The config is not loaded, and upgrade fails.
Workaround:
If you are encountering this after upgrading, run the following commands from the bash prompt:
1. Backup the configuration:
#cp /config/bigip.conf /config/bigip_backup.conf
2. List the occurrences of 'sslv2' in the bigip.conf:
#more bigip.conf | grep -i sslv2
3. Remove the SSLv2 references:
#sed -i "s/\!SSLv2://g" /config/bigip.conf
4. Check to ensure there are no 'sslv2' references:
#more bigip.conf | grep -i sslv2
5. Verify the configuration:
#tmsh load sys config verify
6. Try loading the configuration:
#tmsh load sys config
Fix:
SSLv2 validation is removed from the configuration and upgrade succeeds.
811145-2 : VMware View resources with SAML SSO are not working
Component: Access Policy Manager
Symptoms:
Connections to SAML-enabled VMware View resources fail with following error in /var/log/apm:
err vdi[18581]: 019cffff:3: /pathname: {a7.C} Failed to handle View request: Can't find 'artifact' parameter.
Conditions:
VMware View resource is configured with SAML SSO method.
Impact:
Users cannot launch VMware View apps/desktops via SAML-enabled resource.
Workaround:
None.
Fix:
Can now successfully use VMware View resources with SAML SSO.
811105-1 : MRF SIP-ALG drops SIP 183 and 200 OK messages
Component: Service Provider
Symptoms:
SIP 183 and 200 OK messages are dropped after an INVITE in MRF SIP-ALG when media info is present in the Session Description Protocol.
Conditions:
- MRF SIP-ALG default configuration
- INVITE sent with media info in SDP
- Media info contains an rtcp without an IP address
Impact:
SIP calls are unable to establish media connections.
Workaround:
Ensure all RTCP attributes in the SDP have IP addresses.
Example: Change "a=rtcp:29974\r\n" to "a=rtcp:29974 IN IP4 10.10.10.10\r\n"
Fix:
Calls are able to establish media connections in MRF SIP-ALG when media info contains an RTCP with no IP information.
811033-2 : MRF: BiDirectional pesistence does not work in reverse direction if different transport protocols are used
Component: Service Provider
Symptoms:
If a message is routed from one transport protocol (for example TCP) to another transport protocol (for example UDP), messages traveling from the destination to the source of the persistence entry are incorrectly delivered to the destination.
Conditions:
-- A message is routed from one transport protocol (for example TCP) to another transport protocol (for example UDP).
-- Messages are traveling from the destination to the source of the persistence entry.
Impact:
Messages are forwarded to an incorrect endpoint.
Workaround:
None.
Fix:
For all bi-directional persistence records the transport protocol of the connection is not used in the key used to store the record.
810957-2 : Changing a virtual server's destination address from IPv6 to IPv4 can cause tmrouted to core
Component: TMOS
Symptoms:
When using dynamic routing, changing a virtual server's address from IPv6 to IPv4 can cause tmrouted to core.
Conditions:
-- Using dynamic routing.
-- Changing a virtual server's destination address from IPv6 to IPv4.
-- The virtual server's state changes.
Impact:
Tmrouted cores and restarts, which causes a temporary interruption of dynamic routing services.
Workaround:
Use TMSH to modify both the destination address and the netmask at the same time, e.g.:
tmsh modify ltm virtual <virtual server name> destination <destination address> mask <netmask>
Fix:
Now preventing tmrouted from coring when a virtual server's address is changed from IPv6 to IPv4.
810657-2 : Tmm core while using service chaining for SSLO
Solution Article: K21135478
810557-8 : ASM ConfigSync Hardening
Solution Article: K05123525
810537-2 : TMM may consume excessive resources while processing iRules
Solution Article: K12234501
809729-2 : When HTTP/2 stream is reset by a client, BIG-IP may not respond properly
Component: Local Traffic Manager
Symptoms:
When a client resets the HTTP/2 stream, the BIG-IP system may have several DATA frames ready to send. It drops these frames but does not account back those in a connection-send window. It can reduce this window to the value when no DATA frames are sent over this connection until the client updates the send window.
Conditions:
-- BIG-IP system has a virtual server.
-- HTTP/2 profile is assigned to it.
Impact:
For any subsequent request after the send window loses enough size, DATA frames with payload are not sent to the client over the affected HTTP/2 connection.
Workaround:
None.
Fix:
BIG-IP systems correctly handle dropping DATA frames accounting back their lengths in a connection-send window.
809377-6 : AFM ConfigSync Hardening
Solution Article: K05123525
809205 : CVE-2019-3855: libssh2 Vulnerability
Component: TMOS
Symptoms:
An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server.
Conditions:
-- Authenticated administrative user with Advanced Shell Access.
-- Use of cURL from the command line to connect to a compromised SSH server.
Impact:
A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.
Workaround:
None.
Fix:
libcurl updated
809165-2 : TMM may crash will processing connector traffic
Solution Article: K50046200
808525-2 : TMM may crash while processing Diameter traffic
Solution Article: K55812535
808301-2 : TMM may crash while processing IP traffic
Solution Article: K04897373
807477-10 : ConfigSync Hardening
Solution Article: K04280042
807177-2 : HTTPS monitoring is not caching SSL sessions correctly
Component: Global Traffic Manager (DNS)
Symptoms:
In situations where a cached SSL session cannot be used, there are conditions where the information for old and new SSL sessions are not properly updated, and valid SSL sessions are not terminated in an orderly fashion.
Conditions:
When using GTM HTTPS monitoring.
Impact:
Information for old and new SSL sessions are not properly updated, and valid SSL sessions are not terminated in an orderly fashion.
Workaround:
Restart big3d by running the following command:
bigstart restart big3d
806093-1 : Unwanted LDAP referrals slow or prevent administrative login
Component: TMOS
Symptoms:
On a BIG-IP system configured with remote LDAP/Active Directory authentication, attempting to login to the Configuration Utility or to the command-line interface may proceed very slowly or fail.
Conditions:
-- LDAP/Active Directory 'system-auth' authentication configured.
-- The Active Directory enables LDAP referral chasing (the default).
-- There are a number of Active Directory servers in the enterprise, or the BIG-IP system does not have complete network connectivity to all Active Directory servers (caused by firewalls or special routes).
Impact:
The BIG-IP system may chase LDAP referrals that reference LDAP servers that are unreachable, resulting in authentication timeouts/failures.
Workaround:
Which workaround to use to temporarily disable referrals chasing depends on the version you have.
-- For BIG-IP 14.1.0 - 14.1.2.2, and 15.0.0 - 15.0.1.0
1. Edit the configuration files
-- /etc/nslcd.conf
2. Add add the following line to the end of the file:
referrals no
3. Restart nslcd service to apply change:
systemctl restart nslcd
Important: This change is not persistent, and will be lost whenever MCPD reloads the BIG-IP configuration (tmsh load sys config), or when other changes are made to system-auth configuration values.
-- For BIG-IP 14.1.2.3 (and later 14.1.x releases), and 15.0.1.1 (and later 15.0.x.x releases), a db key has been added to allow this setting to be controlled. After making the db key change, the BIG-IP configuration must be saved and then loaded again, in order to update nslcd.conf
tmsh modify sys db systemauth.referrals value no
tmsh save sys config
tmsh load sys config
Fix:
Changes to LDAP referrals value in configuration are now saved, so this issue no longer occurs.
806085-2 : In-TMM MQTT monitor is not working as expected
Component: Local Traffic Manager
Symptoms:
The monitoring probes are not being sent out to the network. Regardless of the monitor config and sys db variable.
Conditions:
Configuring the in-TMM MQTT monitor.
Impact:
Pool members with attached MQTT monitor state is incorrectly shown as DOWN.
Workaround:
None.
Fix:
In-TMM MQTT monitor now works as expected.
805837-2 : REST does not follow current design best practices
Solution Article: K22441651
805557-2 : TMM may crash while processing crypto data
Solution Article: K43815022
805353-1 : ASM reporting for WebSocket frames has empty username field
Component: Application Security Manager
Symptoms:
When using ASM to inspect and report WebSocket frames, the username field is always reported as empty or absent.
Conditions:
-- ASM provisioned.
-- ASM policy attached to a virtual server.
-- WebSocket profile attached to a virtual server.
-- ASM logging profile attached to a virtual server.
-- WebSocket traffic inspected by ASM and logged as event log message or remote logger message.
Impact:
Poor visibility of current logged-in user in the event log for WebSocket frames.
Workaround:
None.
Fix:
ASM populates username field for logged WebSocket frames
804313-2 : MRF SIP, Diameter, Generic MSG, high availability (HA) - mirrored-message-sweeper-interval not loaded.
Component: Service Provider
Symptoms:
The mirrored-message-sweeper-interval configuration option has no effect on the BIG-IP.
Conditions:
MRF in use, high availability configured, and a SIP profile is configured to use a specific Mirrored Message Sweeper Interval setting.
Impact:
On a system under high load, the next active device in a high availability (HA) pair could run out of memory.
Workaround:
None
Fix:
Message sweeper interval value now loads correctly.
804185-2 : Some WebSafe request signatures may not work as expected
Component: Fraud Protection Services
Symptoms:
Request signatures are part of the WebSafe signature mechanism. The request signature is achieved by configuring an FPS-protected URL and a corresponding custom-alert. If the URL is a wildcard, a priority must be assigned to determine the order of matching. URL matching by priority is not working properly. As a result, the signature do not work as expected
Conditions:
There is at least one wildcard URL configured by the request signature update file.
Impact:
A portion of WebSafe request signature do not work as expected:
-- An alert is sent, though it should not be (false-positive).
-- An alert was not sent, though it should be (false-negative).
Workaround:
Configure the same signature manually in the BIG-IP system's GUI/tmsh.
Fix:
FPS now correctly handles signature-based wildcard URL's priority.
803845-2 : When in HA, the Standby device is forwarding traffic causing a loop and subsequent network shutdown
Component: Local Traffic Manager
Symptoms:
Standby is passing traffic when a virtual wire is configured.
Conditions:
-- Virtual wire configured in high availability (HA).
Impact:
Standby device is forwarding traffic traffic when it should not, causing a loop and subsequent network shutdown.
Workaround:
None.
Fix:
The Standby device no longer passes traffic through virtual wire when it should not.
803477-2 : BaDoS State file load failure when signature protection is off
Component: Anomaly Detection Services
Symptoms:
Behavioral DoS (BADoS) loses its learned thresholds.
Conditions:
Restart of admd when signature protection is off.
Impact:
The system must relearn the thresholds, BADoS protection is not available during the learning time.
Workaround:
Turn on signatures detection.
Fix:
BADoS State file successfully loads after admd restart, even without signatures detection.
803445-3 : When adding several mitigation exceptions, the previously configured actions revert to the default action
Component: Application Security Manager
Symptoms:
After adding a new item to the mitigation exception list, you can also change its mitigation action. If you do not save the changes and then add more new exception items, the mitigation actions of the previously added items return to their default value actions.
Conditions:
-- Add mitigation exception to the Bot Configuration.
-- Change mitigation action on that new exception.
-- Add new items to exception list without first saving.
Impact:
Mitigation action exceptions might be saved with their default value actions instead of the actions you configured.
Workaround:
After adding a group of exception items and editing their actions, save the Bot Configuration properties before adding any new mitigation exception items.
Fix:
When adding several mitigation exceptions, the previously configured actions no longer revert to the default action.
802961-2 : The 'any-available' prober selection is not as random as in earlier versions
Component: Global Traffic Manager (DNS)
Symptoms:
Some big3d instances can be periodically busier than other big3d instances.
Conditions:
-- When 'any-available' is selected for either the prober-preference or prober-fallback options.
-- A large number of monitors are defined.
Impact:
When the 'any-available' prober option is used, the selection of big3d probers may not be as random as in BIG-IP software versions prior to v13.0.0.
Workaround:
None.
802865-1 : The iControl REST query request returning empty list for DoS Protected Objects
Component: Advanced Firewall Manager
Symptoms:
DoS Protection profiles are not displayed in the GUI, but they are visible when using the tmsh command:
tmsh list security dos profile | grep "security dos profile"
Conditions:
This is encountered in Security :: DoS Protection : Protection Profiles.
Impact:
DoS Protected Objects are not included in the REST endpoint /mgmt/tm/security/presentation/tmui/virtual-list, so the GUI cannot display the DoS Protected Objects
Workaround:
Use tmsh.
Fix:
DoS Protected Objects are now visible in the GUI
802281-1 : Gossip shows active even when devices are missing
Component: TMOS
Symptoms:
Gossip appears Active even when one or more devices go missing from device group. 'restcurl shared/gossip' shows active on both devices, even when the devices are not listed in 'restcurl shared/resolver/device-groups/tm-shared-allBIG-IPs/devices'.
Conditions:
The conditions under which this issue occurs are unknown. This is an intermittent issue.
Impact:
Gossip reports that it is working when it is not.
Workaround:
-- If the missing device is the active device, run the following command on the Active DSC Device:
restcurl -X POST -d '{}' tm/shared/bigip-failover-state
-- If the missing device is the standby device, reboot the device, make it active, and then run the following command:
restcurl -X POST -d '{}' tm/shared/bigip-failover-state
802261-2 : TMM may crash while processing SSL traffic via an HTTP/2 full-proxy
Solution Article: K65372933
801497-2 : Virtual wire with LACP pinning to one link in trunk.
Component: Local Traffic Manager
Symptoms:
A virtual-wire that uses interface trunks may use a single interface on egress.
Conditions:
Virtual-wire configured across multi-interface trunks.
Impact:
This may lead to unexpected link saturation.
Workaround:
None.
800453-3 : False positive virus violations
Component: Application Security Manager
Symptoms:
False positive ASM virus violations.
Conditions:
Specific connection characteristics between ASM and the antivirus server may cause replies from the antivirus server to be missed by the ASM. ASM reports a virus when the antivirus reply is timed out.
Impact:
False positive blocking or violation reporting.
Workaround:
The EnableASMByPass internal parameter setting can be configured to allow the antivirus server to not reply, so it won't issue a violation when it occurs.
/usr/share/ts/bin/add_del_internal add EnableASMByPass 1
bigstart restart asm
Notes:
When the internal is enabled, asm will also bypass huge HTTP requests (when they come on multiple connections) instead of reseting them.
800369-2 : The fix for ID 770797 may cause a TMM crash
Component: Local Traffic Manager
Symptoms:
In rare situations the TMM may crash after the original fix for ID 770797 is applied.
Conditions:
HTTP2 is used on the client-side of a virtual server without an MRF http_router profile.
The original fix for ID 770797 is used.
Impact:
Traffic disrupted while tmm restarts.
Workaround:
None.
Fix:
The fix for ID 770797 has been altered to prevent the TMM from crashing in rare situations.
800305-2 : VDI::cmp_redirect generates flow with random client port
Component: Local Traffic Manager
Symptoms:
The VDI::cmp_redirect iRule command generates a flow with a randomly-assigned client port.
Conditions:
-- VDI::cmp_redirect iRule command used
Impact:
Client port is not the same as the original client port.
Fix:
The VDI::cmp_redirect iRule command now uses the same port.
800209-1 : The tmsh recursive list command includes DDoS GUI-specific data info
Component: Advanced Firewall Manager
Symptoms:
DDoS GUI-specific data is included when running the command: tmsh recursive list. This irrelevant information might cause confusion.
Conditions:
This occurs when the AFM module is enabled
Impact:
Extra, irrelevant data is provided in output, which can cause confusion.
Workaround:
This always happens as long as AFM is enabled. You can deprovision the AFM module to disable this command.
Fix:
DDoS GUI-specific data is now filtered out when running the command: tmsh recursive list.
800185-4 : Saving a large encrypted UCS archive may fail and might trigger failover
Component: TMOS
Symptoms:
-- When saving a very large encrypted UCS file, you may encounter an error:
# tmsh save /sys ucs my_ucs passphrase <mysecret>
Saving active configuration...
Can't fork at /usr/local/bin/im line 305.
/var/tmp/configsync.spec: Error creating package
-- If saving UCS is automated you may find related errors in /var/log/audit:
err scriptd[45342]: 014f0013:3: Script (/Common/f5.automated_backup__backup) generated this Tcl error: (script did not successfully complete: (UCS saving process failed. while executing "tmsh::save /sys ucs $fname ))
-- Other services might be restarted due to lack of memory, which might result in failover.
--System management via config utility or command line may be sluggish while UCS saves.
Conditions:
-- Large encrypted UCS files and low free host memory.
-- UCS file sizes in hundreds of MB are much more likely to encounter this issue, along with free memory less than 1 GB.
Impact:
The operation uses at least 1.3 times the UCS file size of RAM. The UCS may not get saved correctly, and if not enough memory is available, low free-memory symptoms become apparent.
The latter may result in services being killed to free memory, resulting in service impact and failover, though it is quite typical for the overly large process saving the UCS to be terminated with no other impact.
Workaround:
A mitigation is to minimise UCS file size. UCS files large enough to encounter this issue typically contain very large files, some of which may not be needed or are no longer necessary.
Remove unnecessary large files from directories that contribute to UCS archives, for example, stray, large files such as packet captures in /config or its subdirectories. (For help understanding what is in UCS archives, see K12278: Removing non-essential files from a UCS when disk space errors are encountered :: https://support.f5.com/csp/article/K12278.)
If using APM, remove unnecessary EPSEC ISO files. (For more information, see K21175584: Removing unnecessary OPSWAT EPSEC packages from the BIG-IP APM system :: https://support.f5.com/csp/article/K21175584.
Fix:
Saving a large UCS file no longer fails.
799649-2 : TMM crash
Component: Local Traffic Manager
Symptoms:
TMM SIGSEGV crash due to memory corruption.
Conditions:
HTTP Security profile attached to a virtual server.
Impact:
Traffic disrupted while tmm restarts.
Workaround:
Remove the HTTP Security profile.
Fix:
HTTP Security profile does not cause TMM crash.
799617-2 : ConfigSync Hardening
Solution Article: K05123525
799589-2 : ConfigSync Hardening
Solution Article: K05123525
798949-3 : Config-Sync fails when Config-Sync IP configured to management IP
Component: TMOS
Symptoms:
Device Group Sync Fails with error in the GUI: 01070712:3: Caught configuration exception (0), Failed to sync files.
Conditions:
Config-Sync IP configured to management IP:
sys db configsync.allowmanagement value enable
Impact:
Config-Sync of file objects such as SSL certificates fails.
Workaround:
None.
Fix:
Config-Sync has been updated to allow synchronization of file objects over the mgmt port.
798261-2 : APMD fails to create session variables if spanning is enabled on SWG transparent virtual server
Component: Access Policy Manager
Symptoms:
The following logs showed up in APM log and user session was terminated.
Jun 13 09:56:35 F5-i4600 notice apmd[4562]: 01490248:5: /Common/Phase1-fwproxy:Common:6833364e: Received client info - Hostname: Type: Mozilla Version: 5 Platform: Win8.1 CPU: x64 UI Mode: Full Javascript Support: 1 ActiveX Support: 0 Plugin Support: 0
Jun 13 09:56:35 F5-i4600 notice apmd[4562]: 01490248:5: /Common/Phase1-fwproxy:Common:6833364e: Received client info - Hostname: Type: Mozilla Version: 5 Platform: Win8.1 CPU: x64 UI Mode: Full Javascript Support: 1 ActiveX Support: 0 Plugin Support: 0
Jun 13 09:56:35 F5-i4600 notice apmd[4562]: 01490000:5: memcache.c func: "mc_finish_set_pipeline()" line: 720 Msg: Error: Set pipeline: While receiving response to 0 cmd set /.*/tmm.session.6833364e.session.assigned.uuid 0 0 32 s
Jun 13 09:56:35 F5-i4600 notice apmd[4562]: 01490000:5: memcache.c func: "mc_server_disconnect()" line: 2533 Msg: Error: bad memcache connection (tmm:1), (fd:205)
Jun 13 09:56:35 F5-i4600 notice tmm1[22065]: 01490501:5: /Common/Phase1-fwproxy:Common:6833364e: Session deleted due to user logout request.
Jun 13 09:56:35 F5-i4600 notice tmm1[22065]: 01490501:5: /Common/Phase1-fwproxy:Common:6833364e: Session deleted due to user logout request.
The SET command failed because it incorrectly attempted to create session variable in all traffic groups.
Conditions:
1. Virtual address for SWG transparent is 0.0.0.0
2. Spanning on the virtual address is enabled.
Impact:
User sessions will be terminated
Workaround:
Disable virtual address spanning.
Fix:
N/A
798249-2 : TMM may crash while processing HTTP/2 requests
Solution Article: K81557381
798105-1 : Node Connection Limit Not Honored
Component: Local Traffic Manager
Symptoms:
Connection limits on nodes are not honored.
Conditions:
A node with connection limits set.
Impact:
More traffic will pass to the node than the limit is supposed to allow.
Workaround:
Modify the node's limit after the node is created and it will start honoring the limit.
Fix:
The node's limit is now honored.
797977-1 : Self-IP traffic does not preserve the TTL from the Linux host
Component: Local Traffic Manager
Symptoms:
The Egress traffic from TMM has IP TTL set to 255 instead of keeping the TTL from the Linux host.
Conditions:
IP/IPv6 TTL for host traffic.
Impact:
Tools like traceroute do not work because Linux host rejects the packets.
Workaround:
Adjust TTL verification restrictions
Fix:
IP TTL is preserved.
797885-2 : ConfigSync Hardening
Solution Article: K05123525
797785-2 : AVR reports no ASM-Anomalies data.
Component: Application Visibility and Reporting
Symptoms:
AVR collects data for ASM-Anomalies, which include Brute-Force and Web-Scraping activities. When reported, all metrics and dimensions are hidden. AVR output looks like this:
errdefs_msgno=\"22282253\",Entity=\"ASM_ANOMALIES\
Conditions:
When gathering statistics reporting a Brute-Force or Web-Scraping attack.
Impact:
AVR reports no ASM-Anomalies data.
Workaround:
None.
797541-1 : NTLM Auth may fail when user's information contains SIDS array
Solution Article: K05115516
Component: Access Policy Manager
Symptoms:
NTLM authentication fails when the authentication response contains a nonempty sid_and_attributes array. This will most likely occur when a user is a member of universal groups from a trusted domain.
Conditions:
- NTLM front-end authentication is configured.
- The authentication response contains nonempty sid_and_attributes array (most likely user is a member of universal groups from trusted domain)
Impact:
Users are unable to log in through the BIG-IP.
Warning messages similar to the following can be found in /var/log/apm logfile:
warning eca[11436]: 01620002:4: [Common] 192.168.0.1:60294 Authentication with configuration (/Common/server1.testsite.com) result: user01@USER01 (WORKSTATION): Fail (UNEXP_006C0065)
warning nlad[11472]: 01620000:4: <0x2b4d27397700> client[46]: DC[172.29.67.112]: schannel[0]: authentication failed for user 'user01', return code: 0x006c0065
NOTE: the return code is not necessary 0x006c0065 or 0x00000007. It can be any value. However, the larger the size of SIDS and Attributes array. The more likely the error value will be 0x00000007
Workaround:
None.
796469-6 : ConfigSync Hardening
Solution Article: K05123525
795797-2 : AFM WebUI Hardening
Solution Article: K21121741
795769-3 : Incorrect value of Systems in system-supplied signature sets
Component: Application Security Manager
Symptoms:
In properties of system-supplied Attack Signature Sets, the field "Systems" is always displayed with value All.
For example, for Generic Detection Signatures the "Systems" field should be: System Independent, General Database, Various systems
Instead, "Systems" is set to "All".
Conditions:
Only for system-supplied signature sets, while user-defined signatures sets are displayed with correctly assigned Systems.
Impact:
Misleading value of Systems
Workaround:
N/A
Fix:
Correct value of "Systems" is displayed for system-supplied signature sets
795685-2 : Bgpd crash upon displaying BGP notify (OUT_OF_RESOURCES) info from peer
Component: TMOS
Symptoms:
If the BIG-IP system receives a BGP notification for OUT_OF_RESOURCES from its BGP peer, then displaying the peer information on the BIG-IP system causes bgpd to crash (running show ip bgp neighbor).
Conditions:
-- Receive a BGP notification for OUT_OF_RESOURCES from the BGP peer.
-- Run the 'show ip bgp neighbor' command to display the BGP peer information.
Impact:
Bgdp crashes. Routing may be affected while bgpd restarts.
Workaround:
None.
Fix:
All the supporting BGP notification now have the corresponding message to display in show commands.
795437-4 : Improve handling of TCP traffic for iRules
Solution Article: K06747393
795261-2 : LTM policy does not properly evaluate condition when an operand is missing
Component: Local Traffic Manager
Symptoms:
The BIG-IP system provides an LTM policies mechanism to process traffic based on a set of rules. A rule may include a number of conditions and a number of actions to execute when the conditions are satisfied. Conditions use operands to evaluate. When an operand is missing, the BIG-IP system may fail to properly evaluate the condition.
Conditions:
-- A virtual server is configured with an LTM policy.
-- The policy contains a rule with a condition which has an operand and a negative matching type like 'not equals' or 'not starts-with', etc. (e.g., http-referer host not contains { www.example.com }).
-- A processing entity (like HTTP request, etc.) is missing an operand or has an empty value (e.g., header 'Referer' is missing from the request).
Impact:
The policy is improperly evaluated on the processing entity and may produce incorrect results when load balancing a request and/or serving a response.
Workaround:
You can use either workaround:
-- Convert rules into a 'positive' (lacking of negative matching type) whenever possible.
-- Use iRules instead of a policy (might impact performance).
Fix:
The BIG0IP system no longer incorrectly evaluates conditions in LTM policy rules when their operands are missing in a processing entity.
795197-1 : Linux Kernel Vulnerabilities: CVE-2019-11477, CVE-2019-11478, CVE-2019-11479
Solution Article: K26618426
794581 : Transfer might stall for an object served from WAM cache
Component: Local Traffic Manager
Symptoms:
When HTTP response is served from cache, a transfer stalls due to incorrect value in Content-Length header.
Conditions:
- Virtual server with HTTP profile that has standard chunking settings.
- Web acceleration profile is configured on the virtual server.
- HTTP response is served from AAM cache.
Impact:
Transfer stalls as the client is expecting more bytes from peer (due to Content-Length header being advertised as greater than than object's actual size).
Workaround:
For the HTTP profile used, set request-chunking to selective.
Fix:
Transfer completes for an object served from WAM cache.
794561-1 : TMM may crash while processing JWT/OpenID traffic.
Solution Article: K46901953
794501-2 : Duplicate if_indexes and OIDs between interfaces and tunnels
Component: TMOS
Symptoms:
In certain instances, having a configuration with both tunnels and interfaces can result in duplicate if_indexes between a tunnel and an interface, which also results in duplicate OIDs for SNMP.
Conditions:
There is no completely predictable trigger, but at a minimum, a configuration with at least one interface and at least one tunnel is needed.
Impact:
Duplicate if_indexes and duplicate OIDs. SNMP logs error messages:
# tmsh list net interface all -hidden all-properties | egrep "(^net)|(if-index)"; tmsh list net vlan all -hidden all-properties | egrep "(^net)|(if-index)"; tmsh list net tunnel all-properties | egrep "(^net)|(if-index)"
net interface 0.10 {
if-index 64 <-------------------------------
net interface mgmt {
if-index 32
net vlan external {
if-index 96
net vlan internal {
if-index 112
net vlan test {
if-index 128
net vlan tmm_bp {
if-index 48
net tunnels tunnel http-tunnel {
if-index 64 <-------------------------------
net tunnels tunnel socks-tunnel {
if-index 80
# snmpwalk -c public -v 2c localhost >/dev/null; tail /var/log/ltm
-- notice sod[4258]: 010c0044:5: Command: running disable zrd bigstart.
-- notice zxfrd[6556]: 01530007:5: /usr/bin/zxfrd started
-- notice mcpd[3931]: 01070404:5: Add a new Publication for publisherID ZXFRD_Publisher and filterType 1024
-- info bigd[11158]: 0114002b:6: high availability (HA) daemon_heartbeat bigd enabled.
-- info cbrd[6106]: 0114002b:6: high availability (HA) daemon_heartbeat cbrd enabled.
-- notice mcpd[3931]: 01070404:5: Add a new Publication for publisherID cbrd and filterType 1152921504606846976
-- info runsm1_named[6104]: 0114002b:6: high availability (HA) proc_running named enabled.
=========================
-- warning snmpd[5413]: 010e0999:4: Duplicate oid index found: bigip_if.c:374
-- warning snmpd[5413]: 010e0999:4: Duplicate oid index found: bigip_if.c:374
-- warning snmpd[5413]: 010e0999:4: Duplicate oid index found: bigip_if_x.c:289
Workaround:
No workaround currently known.
Fix:
Duplicate if_indexes are no longer assigned to tunnels and interfaces. The resulting duplicate SNMP OIDs are prevented.
794413-2 : BIND vulnerability CVE-2019-6471
Solution Article: K10092301
794389-6 : iControl REST endpoint response inconsistency
Solution Article: K89509323
794285 : BIG-IQ reading AFM configuration fails with status 400
Component: Protocol Inspection
Symptoms:
When the BIG-IQ tries to read the AFM configuration, using REST, the operations fails with status 400, if AFM is provisioned but the Protocol Inspection module is not licensed.
Conditions:
-- AFM provisioned on BIG-IP system.
-- Protocol Inspection module is not licensed.
Impact:
The operations fails with status 400. BIG-IQ cannot read AFM configuration if Protocol Inspection module is not licensed.
Workaround:
License Protocol Inspection.
793937-1 : Management Port Hardening
Solution Article: K03126093
793045-2 : File descriptor leak in net-snmpd while reading /shared/db/cluster.conf
Component: TMOS
Symptoms:
Net-snmpd is leaking the file descriptors during the SNMP traps add/delete via tmsh.
Observe that the file descriptors used by snmpd increase using 'ls -l /proc/$(pidof snmpd)/fd'
Following error is logging into /var/log/daemon.log
err snmpd[5160]: /proc/stat: Too many open files
Conditions:
Perform add/delete on SNMP traps via tmsh.
Impact:
Failure of snmpd operations on BIG-IP systems.
Workaround:
None.
Fix:
No longer leaks file descriptors in net-snmpd while reading /shared/db/cluster.conf.
793017-1 : Files left behind by failed Attack Signature updates are not cleaned
Component: Application Security Manager
Symptoms:
If an Attack Signature update encounters an error during installation, files that are meant to be temporary are left behind on disk and a not subject to a periodic cleanup. This can eventually lead to disk space issues.
Conditions:
Attack Signature update encounters an error during installation.
Impact:
This can eventually lead to disk space issues.
Workaround:
Old sigfile.tmp.* directories under /var/ts/var/tmp can be safely removed.
Fix:
These directories are now included in the periodic file cleanup task.
792285-2 : TMM crashes if the queuing message to all HSL pool members fails
Component: TMOS
Symptoms:
When a system uses a High Speed Logging (HSL) configuration with the HSL pool, TMM is crashing if the queuing message to all HSL pool members fails.
Conditions:
-- Two-member pool configured as remote-high-speed-log destination.
-- Data-Plane logging using for example but not limited to: iRule HSL::send.
Impact:
TMM crash. Traffic disrupted while tmm restarts.
Workaround:
None.
792265-3 : Traffic logs does not include the BIG-IQ tags
Component: Application Visibility and Reporting
Symptoms:
AVR collects traffic data. When that data is reported to BIG-IQ, it omits the BIG-IQ tags which are required by BIG-IQ.
Conditions:
When AVR collects traffic data and sending it BIG-IQ.
Impact:
There are no BIG-IQ tags in the traffic logs. BIG-IQ is unable to map traffic-capturing logs to applications.
Workaround:
None.
Fix:
Traffic logs now include the BIG-IQ tags.
791669 : TMM might crash when Bot Defense is configured for multiple domains
Component: Application Security Manager
Symptoms:
TMM might crash and generate a core file when using a Bot Defense profile that is configured for multiple domains.
Conditions:
Bot Defense is configured with multiple 'Related Site Domains' and attached to a virtual server.
Impact:
TMM crash with core. Traffic disrupted while tmm restarts.
Workaround:
None,
Fix:
TMM no longer crashes when Bot Defense is configured for multiple domains.
791337-1 : Traffic matching criteria fails when using shared port-list with virtual servers
Component: Local Traffic Manager
Symptoms:
The system reports an error:
01b90011:3: Virtual Server /Common/vs1's Traffic Matching Criteria /Common/vs1_tmc_obj illegally shares destination address, source address, service port, and ip-protocol with Virtual Server /Common/vs2 destination address, source address, service port.
Conditions:
-- Creating virtual servers with shared object port-list.
-- Using the same port in another virtual server with different protocol with overlapping sources and destination IP address.
Impact:
Config validation failure prevents configuration changes.
Workaround:
Use different IP addresses and ports.
791057-1 : MCP may crash when traffic matching criteria is updated
Component: Local Traffic Manager
Symptoms:
MCP may crash when traffic matching criteria is updated, either directly or as the result of a configuration sync operation.
Conditions:
The specific root cause is unknown, although the crash is related to the update of traffic matching criteria.
Impact:
mcpd restarts. This results in a failover (when DSC is in use) or a halt to traffic processing (when DSC is not in use) while mcpd is restarting.
Workaround:
None.
790349-2 : merged crash with a core file
Component: Application Security Manager
Symptoms:
merged crash and restart.
Conditions:
A tmstat sync operation is occurring in the background.
Impact:
Statistical data is not available for system utilities/graphs while merged restarted. There is no other impact beside the appearance of the core file.
Workaround:
None.
Fix:
merged core scenario fix.
789993-1 : Failure when upgrading to 15.0.0 with config move and static management-ip.
Component: TMOS
Symptoms:
Upgrade to 15.0.0 from earlier version fails.
Conditions:
This happens when upgrading to 15.0.0 from earlier versions with static management-ip (dhclient.mgmt set to disabled).
Impact:
As the config move fails, the Management IP address might not be correct on the newly installed 15.0.0 device.
Workaround:
Keep DHCP enabled before upgrading or reset the management-ip after upgrade.
Fix:
Failure when upgrading to 15.0.0 with config move and static management-ip.
789921-2 : TMM may restart while processing VLAN traffic
Solution Article: K03386032
789893-2 : SCP file transfer hardening
Solution Article: K54336216
789817-1 : In rare conditions info fly-out not shown
Component: Application Security Manager
Symptoms:
When the question mark icon ('?') is close to the right upper corner of the page, the info fly-out is not shown when the question mark icon is clicked.
Conditions:
This can occur under the following conditions:
-- On Security :: Application Security screens that display a question mark for a help icon.
-- The ? icon is close to the right upper corner of the page.
-- Clicking the question mark icon to open the fly-out menu.
Impact:
Info fly-out not shown.
Workaround:
Change page size so that the ? icon is not in the right upper corner.
Fix:
Fly-out is shown correctly in all cases.
789365-1 : pkcs11d CPU usage increases after running nethsm self validation test
Component: Local Traffic Manager
Symptoms:
pkcs11d CPU usage rises from less than 5% to more than 80% after running 'tmsh run sys crypto nethsm-test' command.
Conditions:
pkcs11d is up when running nethsm self-validation test.
Impact:
pkcs11d CPU usage is higher than expected.
Workaround:
Restart pkcs11d to recover CPU usage.
Fix:
Do not subscribe to MCPD for nethsm self=validation test. Instead, use one-time MCPD message passing routine.
789169-2 : Unable to create virtual servers with port-lists from the GUI★
Component: TMOS
Symptoms:
Using the GUI to create a virtual server with a port-list or address-list fails with the following error:
01070096:3: Virtual server <virtual server name> lists profiles incompatible with its protocol.
Conditions:
- The virtual server is created with an ip-protocol set to a value other than 'any'.
- A port-list or address-list is used.
Impact:
Virtual server creation fails.
Workaround:
Create the configuration in tmsh.
1. Create an LTM traffic-matching-criteria object to define the port-list and/or address list. The protocol on the traffic-matching-criteria must be set to the protocol that the virtual server will use.
2. Create the LTM virtual server, and set the traffic-matching-criteria to the name of the traffic-matching-criteria object.
Fix:
While creating virtual server with port-list from the GUI, a traffic-matching-criteria is created internally and mapped to the virtual server. This ensures that the traffic-matching-criteria object uses the same ip-protocol as the virtual server.
788773-2 : HTTP/2 Vulnerability: CVE-2019-9515
Solution Article: K50233772
788769-2 : HTTP/2 Vulnerability: CVE-2019-9514
Solution Article: K01988340
788741-2 : TMM cores in the MQTT proxy under rare conditions
Component: Local Traffic Manager
Symptoms:
TMM may core in the MQTT proxy under unknown conditions.
Conditions:
-- MQTT proxy in use.
-- It is not known what other conditions are required to cause this issue.
Impact:
TMM cores. Failover or outage. Traffic disrupted while tmm restarts.
Workaround:
None.
Fix:
TMM no longer cores in the MQTT proxy.
788593-2 : APM logs may contain additional data
Solution Article: K43404365
Component: Access Policy Manager
Symptoms:
Under certain conditions, APM logs may include more information than was requested.
Conditions:
-APM licensed and enabled.
-ACCESS::log iRule in use.
Impact:
Additional data recorded in the APM log, potentially disrupting log filters or logging unrequested data.
Workaround:
None.
Fix:
APM logs now contain the expected information.
788557-5 : BGP and BFD sessions are reset in GRST timeout period if bgpd daemon is restarted prior
Component: TMOS
Symptoms:
GRST - BGP graceful reset.
The problem occurs when the routing daemon bgpd restarts/starts (e.g., by terminating the bgpd daemon) its distribution of a process and is not supported. Another way we've found is to call "bigstart restart" command on a primary blade on chassis with more than one blade.
After the new primary blade takes over, BGP and BFD sessions are recreated at around the 'graceful restart' timeout interval.
Conditions:
-- BGP and BFD are configured.
-- BGP router's 'graceful restart' option is configured, enabled (set to 120 by default).
-- The bgpd daemon is terminated.
Another way to trigger the issue is to run 'bigstart restart' on a primary blade on a chassis with more than one blade.
Impact:
If BGP peering is reset, it causes the routing protocol to withdraw dynamic routes learnt by the configured protocol, making it impossible to advertise dynamic routes of affected routing protocol from the BIG-IP system to the configured peers. This can lead to unexpected routing decisions on the BIG-IP system or other devices in the routing mesh.
In most cases, unexpected routing decisions come from networks learnt by affected routing protocol when the routing process on the BIG-IP system become unreachable. However, this state is short-lived, because the peering will be recreated shortly after the routing protocol restarts. The peering time depends on the routing configuration and responsiveness of other routing devices connected to the BIG-IP system, typically, the routing convergence period, which includes setting the peering and exchanging routing information and routes.
Workaround:
None.
Fix:
BGP and BFD peering is not recreated in GRST timeout anymore.
788417-2 : Remote Desktop client on macOS may show resource auth token on credentials prompt
Component: Access Policy Manager
Symptoms:
APM uses the 'username' attribute to pass auth token for SSO enabled native RDP resources on macOS. In case Windows policy forces the user to provide credentials, or if Single Sign-on fails, the end user may see a credentials prompt containing the base 64-encoded auth token in the username field.
This behavior is observed only with Remote Desktop Client v10.x for macOS.
Conditions:
-- APM Webtop is configured with Single Sign-on enabled native RDP resource.
-- Try to access the RDP resource from macOS using RDP client v10.x.
Note: This issue is known to occur when Microsoft Group Policy 'Always prompt for password upon connection' is enabled on the target RDP server: Computer Configuration \ Administrative Templates \ Windows Components \ Remote Desktop Services \ Remote Desktop Session Host \ Security \ Always prompt for password upon connection.
Impact:
Prompt for credentials (contains auth token in username field) causing APM end user confusion.
Workaround:
Apply the following iRule:
Note: With the following iRule implemented, users running RDP client v8 for macOS may see an empty credentials prompt when launching APM native RDP resources.
when HTTP_RESPONSE_RELEASE {
catch {
set locationUri [HTTP::header Location]
if { [HTTP::status] == 302 && $locationUri starts_with "rdp://" &&
$locationUri contains "username=s:f5_apm"} {
HTTP::header Location \
[string map {"username=s:f5_apm" "gatewayaccesstoken=s:"} $locationUri]
}
}
}
Fix:
Remote Desktop client on macOS does not show resource auth token on credentials prompt.
788325-2 : Header continuation rule is applied to request/response line
Solution Article: K39794285
Component: Local Traffic Manager
Symptoms:
When a browser communicates with a server over HTTP, it can split a long header into several lines, prepending continuation lines with leading whitespace symbols. This rule does not apply to request or response line, so having leading whitespace in a first header line is invalid. The BIG-IP system parses such line a header with empty value.
Conditions:
A virtual server is configured on the BIG-IP system with HTTP profile.
Impact:
The BIG-IP system can hide some important HTTP headers either passing those to the pool member or failing to properly handle the request (or response) or failing to correctly load balance a connection (or request in case of OneConnect profile).
Workaround:
None.
Fix:
Now, when the BIG-IP system receives an invalid request or response with leading whitespace in first header line, it properly parses the header and handles it correctly.
788301-5 : SNMPv3 Hardening
Solution Article: K58243048
Component: TMOS
Symptoms:
SNMPv3 agents do not follow current best practices.
Conditions:
SNMPv3 agents enabled.
Impact:
SNMPv3 agents do not follow current best practices.
Fix:
SNMPv3 features now follow current best practices.
788269-3 : Adding toggle to disable AVR widgets on device-groups
Component: Application Visibility and Reporting
Symptoms:
Devices on device-group get into state of not-synced when AVR-related widgets are created or modified.
It occurs more frequently when manual config sync is enabled.
It can also occur when visiting a widgets page for the first time that automatically creates default widgets on the first page visit, such as Security :: Overview : Application : Traffic. This can make it appear that a 'read-only' user visiting the page has triggered the need for a config sync.
Conditions:
-- Two or more devices are in a device-group.
-- AVR-related widgets are created or modified.
Impact:
Devices go into a non-synced state.
Workaround:
None.
Fix:
A DB-variable called avr.gui.widgets.sync has been added to disable widgets syncing. Possible values are 'disable' or 'enable', it is enabled by default.
Behavior Change:
This release adds a DB-variable, avr.gui.widgets.sync, to disable widget syncing. Possible values are 'disable' or 'enable'. It is enabled by default.
788093 : MRF iRule command MR::restore with no argument causes tmm to crash
Component: Service Provider
Symptoms:
Executing MRF iRule command MR::restore with no arguments intended to restore all variables saved previously with MR::store causes tmm to crash.
Conditions:
Using iRule command MR::restore with no arguments intended to restore all variables saved previously with MR::store.
Impact:
Traffic disrupted while tmm restarts.
Workaround:
Use MR::restore command with explicitly mentioned variables intended to be restored.
Fix:
MR:restores works as intended: when no variable is given it brings back all variables saved previously with MR::store.
788033 : tpm-status may return "Invalid" after engineering hotfix installation
Solution Article: K91171450
788005-2 : Bypass MRF SIP LB restriction of conversion from reliable transport (TCP) to unreliable transport (UDP)
Component: Service Provider
Symptoms:
The SIP RFC states that if converting a message from a reliable transport to an unreliable transport, the proxy must guarantee delivery.
Conditions:
A adminstator required conversion of SIP messages from TCP to UDP and was willing to forgo the delivery requirement.
Impact:
A system db variable was added to disable the TCP to UDP protection.
Workaround:
None
Fix:
A DB variable has been added, Tmm.Sp.Sip.AllowTcpUdpConversion, possible values are enable|disable, the default value is disable. Enabling the DB variable enables the protection blocking TCP to UDP conversion for SIP messages.
787845 : Tmsh command 'show running-config' fails when Protocol Inspection is not licensed.
Component: Protocol Inspection
Symptoms:
If the Protocol Inspection feature is not licensed then tmsh command 'show running-config' fails with 'Protocol Inspection feature not licensed.' message.
Conditions:
- AFM Protocol Inspection feature is not licensed.
Impact:
'tmsh show running-config' command returns an error: 'Protocol Inspection feature not licensed.'
Workaround:
None.
Fix:
'tmsh show running-config' command works as expected.
787825-2 : Database monitors debug logs have plaintext password printed in the log file
Solution Article: K58243048
Component: Local Traffic Manager
Symptoms:
When monitor instance is in "debug" logging enabled mode for certain monitor types, the resulting monitor instance logs may contain sensitive details like password
Conditions:
When debug mode is enabled for following monitoring types
1. mssql
2. mysql
3. oracle
4. postgresql
Impact:
The user-account password configured in the health monitor may appear in plain text form in the monitor instance logs under /var/log/monitors/.
Workaround:
1. Do not enable monitor instance logging or monitor debug logging for affected monitor types. 2. If it is necessary to enable monitor instance logging or monitor debug logging for troubleshooting purposes , remove the resulting log files from the BIG-IP system after troubleshooting is completed.
Fix:
The password filed for monitor will now be redacted by external monitors when monitor debugging is enabled.
787677-3 : AVRD stays at 100% CPU constantly on some systems
Component: Application Visibility and Reporting
Symptoms:
One thread of the avrd process spontaneously starts to consume 100% CPU.
Conditions:
The exact conditions under which this occurs are unknown, but might occur only on vCMP configurations.
Impact:
System performance degrades.
Workaround:
Restart TMM:
bigstart restart tmm
Fix:
Added processing that prevents AVRD from entering endless loops.
787477-2 : Export fails from partitions with '-' as second character
Component: Access Policy Manager
Symptoms:
Attempting to export a profile/policy from partition using the hyphen/dash (-) as the second character results in error message:
'Incorrect arguments: <partition> is not specified' error.
Conditions:
Partition with '-' as second character in the name.
Impact:
Unable to export policy from given partition
Workaround:
Rename partition without '-' as the second character.
Fix:
Export is working as expected in this scenario.
787433-3 : SSL forward proxy: OCSP signer certificate isn't refreshed or regenerated when forward proxy CA key/cert is changed
Component: Local Traffic Manager
Symptoms:
When stapling the OCSP response (and hence OCSP certificate) to the SSL client, the issuer that appears on the OCSP certificate mismatches with what is configured in the client SSL profile as the forward proxy CA cert.
Conditions:
The issue is seen when all the below conditions are met.
-- The BIG-IP system is using SSLO or SSL forward proxy.
-- The client hello sent from the SSL client includes the status request extension. This means that it requests BIG-IP system to staple the OCSP response.
-- The forward proxy CA cert in the client SSL profile is modified.
Impact:
In SSLO or SSL forward proxy mode, the server cert and the OCSP response the BIG-IP system sends to the SSL client should be both signed (issued) by the forward proxy CA cert configured at the client SSL profile. If they are signed by different issuers, it may not pass some of the validation check performed by the SSL client and might lead to SSL client's terminating the SSL handshake.
Workaround:
To updates and regenerates the OCSP signer information, after modifying the forward proxy CA cert, run the command:
bigstart restart tmm
Fix:
The issuer appearing on the OCSP response always matches the forward proxy CA cert configured at the client SSL profile.
786913-2 : Upgrade failure from 13.0.x or earlier when using LTM Policies with DOSL7
Component: Application Security Manager
Symptoms:
Upgrade fails when upgrading from 13.0.x or under if the config includes an LTM Policy (CPM) which modifies a DoS Application Profile.
Conditions:
-- LTM Policy is configured to specify a DoSL7 profile name.
-- Upgrade is from version 13.0.x or earlier.
Impact:
Upgrade failure.
Workaround:
1. Manually edit the /config/bigip.conf file, and place all of the 'security dos profile' objects before any 'ltm policy' objects.
2. Load the config.
Fix:
Upgrade no longer fails when using an LTM Policy which specifies a DoSL7 profile name.
786565-2 : MRF Generic Message: unaccepted packets received by GENERIC MESSAGE filter causes subsequent messages to not be forwarded
Component: Service Provider
Symptoms:
When a message is created using the GENERICMESSAGE::message create iRule command during the CLIENT_DATA event, if the TCP payload buffer is not cleared before the event completes, the data in the payload buffer is forwarded to the generic message filter disrupting its statemachine.
Conditions:
-- A message is created using GENERICMESSAGE::message create iRule command during CLIENT_DATA event.
-- TCP payload buffer is not cleared before the event completes.
Impact:
The data in the payload buffer is forwarded to the generic message filter disrupting its statemachine. Subsequent messages are not forwarded.
Workaround:
To fix the problem, add the following to CLIENT_DATA:
TCP::payload replace 0 [TCP::payload length] ""
Fix:
Data left in the TCP payload buffer is now ignored and does not negatively impact the filter.
786173-1 : UI becomes unresponsive when accessing Access active session information
Component: Access Policy Manager
Symptoms:
When accessing Admin UI Access :: Overview :: Active Sessions page, the page status is stuck in 'Receiving configuration data from your device'. TMSH command 'show apm access-info' also hangs.
Conditions:
-- Two vCMP guests or two chassis are set up in high availability mode.
-- If Network Mirroring is toggled between 'Within Cluster' and 'Between Cluster' while traffic is going through the device.
Impact:
Some session variables may be lost, which results in the GUI becoming unresponsive. The Access :: Overview :: Active Sessions page in the Admin UI becomes unusable.
Workaround:
Do not toggle between 'Within Cluster' and 'Between Cluster' while traffic is going through the device.
Fix:
The solution for the reported issue is handled by the fix provided for ID 783817. ID 786173 fixes a null pointer exception that might occur in the specific case of a certain missing session variable, which is relevant only in BIG-IP releases 14.1.0 or later.
785741-1 : Unable to login using LDAP with 'user-template' configuration
Solution Article: K19131357
Component: TMOS
Symptoms:
Unable to login as remote-user.
Conditions:
When the following are true:
-- LDAP remote-auth configured with user-template.
-- Remote-user configured to permit login.
Impact:
Unable to login with remote-user.
Workaround:
Use bind-dn for authentication.
784989-2 : TMM may crash with panic message: Assertion 'cookie name exists' failed
Component: Access Policy Manager
Symptoms:
TMM crashes with SIGFPE panic
panic: ../modules/hudfilter/http/http_cookie.c:489: Assertion 'cookie name exists' failed.
Conditions:
-- Virtual server with remote desktop or VDI profile attached.
-- VDI logging level is set to Debug.
-- iRule that modifies/reads HTTP cookies.
Impact:
Traffic disrupted while TMM restarts.
Workaround:
Increase the log-level for VDI from 'Debug' to a higher level.
Fix:
Fixed TMM crash, which occurred when remotedesktop/VDI profile was used together with custom iRule and Debug level logging.
784713-3 : When SSL forward proxy is enabled, AKID extension of the OCSP signer certificate on the clientside is not correct
Component: Local Traffic Manager
Symptoms:
When SSL forward proxy is configured, or for SSLO, if OCSP or CRL is set on the serverside, the certificate that signs the OCSP response on the clientside does not have the correct Authority Key Identifier (AKID).
Conditions:
Configure SSL forward proxy or enable SSLO and enable OCSP or CRL on serverside/server SSL profiles.
Impact:
Incorrect AKID X509 extension for the OCSP signer certificate on the clientside. Depending on browsers/clients, this may result in the browsers/clients to not be able to use the stapled OCSP response.
Workaround:
None.
Fix:
After the fix, the OCSP signer certificate has the correct AKID X509 extension.
783849-2 : DNSSEC Key Generations are not imported to secondary FIPS card
Component: Global Traffic Manager (DNS)
Symptoms:
When new DNSSEC Key Generations are generated by FIPS card, the Generation is not imported to secondary FIPS card.
Conditions:
BIG-IP has a GTM sync group with FIPS cards in sync. New DNSSEC Key Generation is created.
Impact:
New DNSSEC Key Generation is not imported to secondary FIPS card, but the generation is synced within GTM sync group.
Workaround:
N/A
Fix:
DNSSEC Key Generation is not imported to secondary FIPS card over creation
783817-2 : UI becomes unresponsive when accessing Access active session information
Component: Access Policy Manager
Symptoms:
When accessing Admin UI Access :: Overview :: Active Sessions page, the page status is stuck in 'Receiving configuration data from your device'. TMSH command 'show apm access-info' also hangs.
The following error messages shows up in TMM log:
-- notice mcp error: 0x1020002 at ../mcp/db_access.c:831
-- notice mcp error: 0x1020031 at ../mcp/mcp_config.c:588
Conditions:
-- Two vCMP guests or two chassis are set up in high availability mode.
-- If Network Mirroring is toggled between 'Within Cluster' and 'Between Cluster' while traffic is going through the device.
Impact:
Some session variables may be lost, which results in UI hang. Admin UI becomes unusable.
Workaround:
Do not toggle between 'Within Cluster' and 'Between Cluster' while traffic is going through the device.
783565-2 : Upgrade support for DB variable to attach AJAX payload to vToken cookie should be consistent with config in MCP
Component: Fraud Protection Services
Symptoms:
Upgrade support for DB variable to attach AJAX payload to vToken cookie sets 'send in alerts' flag configured on parameters without checking whether automatic transaction detection is turned on on the URL.
Conditions:
-- BIG-IP version 13.1.x or 14.0.x
-- A protected URL is configured with automatic transaction detection turned off.
-- A parameter on that URL is configured with all flags turned off.
-- The DB variable antifraud.internalconfig.flag1 is set to 'enabled' value.
-- Upgrade to 13.1.x or later (with load config) started.
Impact:
After upgrade, the configuration fails to load due to an error during schema change validation
Workaround:
-- Set the DB variable antifraud.internalconfig.flag1 value to 'disabled' before the upgrade.
-- Configure 'send in alerts' flag on the parameters manually.
Fix:
Now upgrade support takes into consideration the automatic transaction detection flag on URL and sets 'send in alerts' flag on URL parameters only for URLs with automatic transaction detection turned on.
783513-2 : ASU is very slow on device with hundreds of policies due to logging profile handling
Component: Application Security Manager
Symptoms:
Signature Update (ASU) is very slow on devices with hundreds of policies due to logging profile handling.
Conditions:
-- There are hundreds of ASM policies on the device.
-- ASU is performed.
-- The BIG-IP is configured for logging profile handling.
Impact:
The ASU process takes hours to complete.
Workaround:
None.
782569-1 : SWG limited session limits on SSLO deployments
Component: Access Policy Manager
Symptoms:
SWG limited session limits are enforced on SSLO deployments that enable Explicit proxy authentication.
Conditions:
-- SSLO with Explicit proxy authentication is deployed.
-- Many concurrent SSLO connections that use custom category lookup (beyond the SWG limited session limit).
Impact:
SSLO fails to connect when the SWG limited session limit is reached.
Workaround:
None.
Fix:
If there is an SSLO profile paired with either an APM or SSLO per-request policy on a virtual server, and the operation has done a custom category only lookup, an SWG limited license is no longer consumed. This answers the case where there is auth (APM) on one virtual server, and the transparent virtual server is SSLO with custom category lookup only.
782529-2 : iRules does not follow current design best practices
Solution Article: K30215839
781725-2 : BIG-IP systems might not complete a short ICAP request with a body beyond the preview
Component: Service Provider
Symptoms:
An ICAP request (REQMOD or RESPMOD) body goes out to the ICAP server as far as a preview. If the server responds 100-continue, only a single chunk of the remaining payload might be sent to the server. Eventually the connection times out.
Conditions:
-- An ICAP profile is configured with a preview.
-- The HTTP request or response to be modified has a body that is more than one chunk longer than the preview length, yet short enough to be completely buffered in BIG-IP system before the preview is sent to the ICAP server.
-- The ICAP server responds with 100-continue.
Impact:
Only the first chunk of payload is sent after the preview, and eventually the connection times out.
Workaround:
None.
Fix:
The BIG-IP system now sends the complete ICAP request to the server, and the transaction completes normally.
781637-2 : ASM brute force counts unnecessary failed logins for NTLM
Component: Application Security Manager
Symptoms:
False positive brute force violation raised and login request is blocked
Conditions:
-- ASM provisioned.
-- ASM policy attached to a virtual server.
-- ASM Brute force protection enabled for NTLM login type
Impact:
login request blocked by asm policy
Workaround:
Define higher thresholds in brute force protection settings
Fix:
asm code has been fixed and do not count unnecessary failed logins for NTLM
781605-3 : Fix RFC issue with the multipart parser
Component: Application Security Manager
Symptoms:
false positive or false negative attack signature match on multipart payload.
Conditions:
very specific parsing issue.
Impact:
A parameter specific excluded signature may be matched or un-matched.
Workaround:
N/A
Fix:
Multi part parser issue was fixed.
781581-3 : Monpd uses excessive memory on requests for network_log data
Component: Application Visibility and Reporting
Symptoms:
Monpd allocates excessive memory on multi-blade devices, and in some cases the kernel may kill monpd. The following log signature may be encountered in /var/log/kern.log:
err kernel: : [1537424.588160] Out of memory: Kill process 28371 (monpd) score 117 or sacrifice child
Conditions:
This can occur in a multi-blade BIG-IP environment when you are displaying pages that query for network_log data, for example Bot Defense requests in the event log, or realtime AVR data.
Impact:
Large fluctuations in host memory usage, occasionally leading to OOM events.
Workaround:
None.
Fix:
A db variable has been added: avr.eventlogsreportrownumber, which controls the number of logs displayed. The db variable default is 10000, and supports a range from 100 through 1000000.
Note: Using the maximum value may trigger the behavior described here. The system behavior depends on the specific machine hardware.
781449-2 : Increase efficiency of sPVA DoS protection on wildcard virtual servers
Solution Article: K14703097
781445-1 : named or dnscached cannot bind to IPv6 address
Component: Access Policy Manager
Symptoms:
In some scenarios, the named process cannot bind to IPv6 addresses. This occurs because the dnscached process listens to the wildcard IPv6 address port 53 (i.e., :::53) so it cannot respond to queries sent to IPv6 addresses.
Following message is reported in ltm log:
err named[16593]: binding TCP socket: address in use.
Conditions:
-- The named and dnscached processes are not running.
-- The dnscached process is started first.
-- The named process is started later.
Impact:
The named process does not respond to the queries that are sent to IPv6 addresses at port 53.
Workaround:
1) Stop both named and dnscached process.
2) Edit the startup script for dnscached to start in IPv4-only mode.
2a) On BIG-IP system, open the file /etc/bigstart/startup/dnscached.
2b) Add "-4" to the command line option of dnscached.
3) Restart the processes:
bigstart restart named dnscached
Fix:
The dnscached startup script has been modified to start in IPv4-only mode, so it does not listen on any IPv6 address.
781377-2 : tmrouted may crash while processing Multicast Forwarding Cache messages
Solution Article: K93417064
781069-2 : Bot Defense challenge blocks requests with long Referer headers
Component: Application Security Manager
Symptoms:
The Bot Defense challenge may block the client if the Referer header is between about 1400 characters and 3072 characters long.
This client may get blocked by TCP RST, or suffer from a challenge loop.
Conditions:
-- Bot Defense with Verify before Access, or Proactive Bot Defense are configured
-- Request has a Referer header that is between ~1400 and 3072 characters long
Impact:
Legitimate browsers may get blocked or suffer from a challenge loop
Workaround:
Use an iRule to override the Referer header from the HTTP_REQUEST event, to make it shorter.
Fix:
Challenges with long Referer headers no longer block legitimate clients.
781021-2 : ASM modifies cookie header causing it to be non-compliant with RFC6265
Component: Application Security Manager
Symptoms:
When ASM strips the cookie header from the ASM cookies, it leaves the cookie header in a way that is not compliant with RFC6265 on two aspects:
-- No space after the semicolon
-- A cookie with no value is sent without the equals sign
Conditions:
-- ASM Security Policy is used.
-- Request includes an ASM cookie.
Impact:
Some web servers may refuse to handle non-compliant Cookie headers, causing the application flow to break.
Workaround:
Disable the cookie stripping by modifying the DB variable as follows:
tmsh modify sys db asm.strip_asm_cookies value false
Fix:
ASM now strips the ASM cookies from the request in a way that is compliant with RFC6265.
780837-1 : Firewall rule list configuration causes config load failure
Component: Advanced Firewall Manager
Symptoms:
'tmsh load sys config' reports a syntax error.
The syntax error is reported on 'security firewall rule-list rule' configuration.
Conditions:
This occurs only if any of the rule-list rule ip-protocol contains one of the following protocols:
Note: You can see the mismatched protocol names in the /etc/protocols listing file (column 1 and column 3 differ):
bbn-rcc 10 BBN-RCC-MON # BBN RCC Monitoring
nvp 11 NVP-II # Network Voice Protocol
dcn 19 DCN-MEAS # DCN Measurement Subsystems
ospf 89 OSPFIGP # Open Shortest Path First IGP
crdup 127 CRUDP # Combat Radio User Datagram
Impact:
The system fails to load the configuration.
Workaround:
Manually edit the configuration file: /config/bigip_base.conf
1. Replace the ip-protocol name from rule-list configuration:
-- Change BBN-RCC-MON to bbn-rcc.
-- Change NVP-II to nvp.
-- Change DCN-MEAS to dcn.
-- Change OSPFIGP to ospf.
-- Change CRUDP to crudp.
2. Save the file.
3. Issue the command:
tmsh load sys config.
The configuration now loads without syntax errors.
780817-5 : TMM can crash on certain vCMP hosts after modifications to VLANs and guests.
Component: TMOS
Symptoms:
TMM crashes and produces a core file. TMM logs show the crash was of type SIGFPE, with the following panic message:
notice panic: ../base/vcmp.c:608: Assertion "guest has vlan ref" failed.
Conditions:
-- The vCMP host is a platform with more than one tmm process per blade or appliance.
+ VIPRION B4300, B4340, and B44xx blades.
+ BIG-IP iSeries i15x00 platforms
-- A VLAN is assigned to a vCMP guest.
-- The TAG of the VLAN is modified.
-- The VLAN is removed from the vCMP guest.
Impact:
While TMM crashes and restarts on the host, traffic is disrupted on all the guests running on that system.
Guests part of a redundant pair may fail over.
Workaround:
None.
Fix:
TMM no longer crashes on certain vCMP hosts after modifications to VLANs and guests.
780601-2 : SCP file transfer hardening
Solution Article: K03585731
779177-2 : Apmd logs "client-session-id" when access-policy debug log level is enabled
Solution Article: K37890841
778869-3 : ACLs and other AFM features (e.g., IPI) may not function as designed
Solution Article: K72423000
Component: Advanced Firewall Manager
Symptoms:
Under certain conditions, ACLs, IPI and other AFM features may not function as designed.
Conditions:
AFM provisioned and configured.
TCP mitigations active.
Impact:
AFM features do not function as designed.
Workaround:
None.
Fix:
ACLs and other AFM rules (e.g., IPI) features now function as designed.
778681-2 : Factory-included Bot Signature update file cannot be installed without subscription★
Component: Application Security Manager
Symptoms:
After upgrade, the factory-included Bot Signature update file cannot be installed without subscription, even if it is already installed.
Conditions:
Device is upgraded to 14.1.0 from previous version, and does not have a Bot Signatures subscription.
Impact:
The factory-included Bot Signature update file cannot be installed.
778125-1 : LDAP remote authentication passwords are limited to fewer than 64 bytes
Component: TMOS
Symptoms:
The LDAP remote authentication password is limited to fewer than 64 bytes.
Conditions:
Configured for remote authentication with a password is longer than or equal to 64 bytes.
Impact:
Unable to login as remote-user with long password.
Workaround:
Set password that is shorter than 64 bytes.
778077-3 : Virtual to virtual chain can cause TMM to crash
Solution Article: K53183580
777993-2 : Egress traffic to a trunk is pinned to one link for TCP/UDP traffic when L4 source port and destination port are the same
Component: TMOS
Symptoms:
Egress TCP/UDP traffic with same L4 source port and destination port to an external trunk is pinned to one link only.
Conditions:
This happens on BIG-IP hardware platforms with broadcom switch chip, so BIG-IP 2000/4000 and i2000/i4000 series are not impacted.
Impact:
Performance degradation as only a portion of the trunk bandwidth is utilized.
Workaround:
None.
Fix:
Egress TCP/UDP traffic with same L4 source port and destination port is now evenly distributed among trunk ports.
777937-3 : AWS ENA: packet drops due to bad checksum
Component: Performance
Symptoms:
-- Lower throughput and tps.
-- High availability (HA) heartbeat is getting dropped, resulting in an active-active configuration.
Conditions:
AWS Elastic Network Adapter (ENA) NIC is in use.
Impact:
Performance degradation and invalid HA configuration.
Workaround:
On the BIG-IP system, turn off checksum offloading in on TX as follows:
modify sys db tm.tcpudptxchecksum value Software-only
Important: This workaround negatively affects NICs other than ENA. Therefore, the workaround is recommended exclusively when ENA is the only dataplane NICs in use in the BIG-IP system.
Fix:
AWS ENA: no packet drops due to bad checksum.
777737-3 : TMM may consume excessive resources when processing IP traffic
Solution Article: K39225055
777269-1 : Gratuitous ARP may be sent for self IPs from incorrect MAC address at startup
Component: Local Traffic Manager
Symptoms:
The Address Resolution Protocol is used to allow IP endpoints to advertise their L2 (Ethernet MAC) addresses, and to query their network peers to request needed associations. Typically, TMM will immediately broadcast an ARP announcing its IP-MAC association (sometimes called a "gratuitous" ARP), so that switches can begin directing traffic to the self-ip immediately.
When BIGIP-VE starts with interfaces provided by some hypervisors, it may not immediately know the MAC address assigned to the interface until several milliseconds after the interface is created. In these cases, the gratuitous ARP will contain the MAC address 00:98:76:54:32:10, which is a valid but incorrect MAC address.
Normally, this is harmless, because the correct MAC address is immediately announced once it is known. However, it may be possible for a L2 switch upstream from multiple BIGIP-VE instances to believe a L2 loop has developed, and block one or both ports through which it saw the gratuitous ARPs.
Conditions:
BIG-IP VE, version 13.0.0 or later, running with the virtio driver on an OpenStack-compatible hypervisor.
Impact:
If an upstream switch sees gratuitous ARPs from multiple downstream BIG-IP instances on the same L2 LAN, it might block connectivity to one or more ports through which the gratuitous ARPs are seen. The self IP may appear to have connectivity for some time after it comes up, before connectivity is blocked at the upstream switch.
Fix:
Gratuitous ARPs sent with an incorrect MAC address are no longer broadcast.
777261-4 : When SNMP cannot locate a file it logs messages repeatedly
Component: TMOS
Symptoms:
When the SNMP daemon experiences an error when it attempts to statfs a file then it logs an error message. If the file is not present then this error is repeatedly logged and can fill up the log file.
Conditions:
When an SNMP request causes the daemon to query a file on disk it is possible that a system error occurs. If the file is not present then the error is logged repeatedly.
Impact:
This can fill up the log with errors.
Fix:
The SNMP daemon has been fixed to log this error once.
777173-2 : Citrix vdi iApp fails in APM standalone deployments with "HTTP header transformation feature not licensed" error
Component: Access Policy Manager
Symptoms:
When administrator runs Citrix vdi iApp in APM standalone deployment (LTM is not licensed), iApp fails with the following error:
01070356:3: HTTP header transformation feature not licensed
This is result of a license check added for HTTP header transformation.
Conditions:
- APM is licensed as stand alone (no LTM license)
- Admin tries to run Citrix vdi iApp
Impact:
Administrator is not able to use the iApp to configure Citrix vdi access
Workaround:
Adding LTM module license will resolve the error.
Fix:
Citrix vdi iApp now can be used to configure Citrix vdi access in an APM standalone deployment.
776133-1 : RSS hash is not used on VE resulting in performance impact on non-SR-IOV devices
Component: Performance
Symptoms:
RSS hash is not used on BIG-IP Virtual Edition (VE).
You can run the following command to see the 'n' (no) for RSS results:
tmctl -d blade -i tmm/ndal_dev_status
Example:
iface device pci if_up link_up rcso lro sw_lro lro_no_md rvho rss tcso tso
1.1 vmxnet3 11:0.0 n n y:n y:n n y y:n n y:y y
Conditions:
This is encountered on BIG-IP VE.
Impact:
Performance degradation on non-SR-IOV devices.
Workaround:
None.
776073-1 : OOM killer killing tmm in system low memory condition as process OOM score is high
Component: TMOS
Symptoms:
When BIG-IP system running under low memory situation, Out-Of-Memory killer more likely selects tmm to kill and release the resources.
Conditions:
BIG-IP version 13.0.x or later installed and system running with low memory.
AFM provisioned makes the tmm process more likely to be selected by the oom killer
Impact:
Traffic disrupted while tmm restarts.
Workaround:
Adjust OOM score of "tmm" process through oom_score_adj proc setting.
echo "-500" > /proc/<pid_of_tmm>/oom_score_adj
Fix:
OOM score for "tmm" process is adjusted such that OOM killer will not prioritize "tmm" during system low memory condition.
775897-1 : High Availability failover restarts tmipsecd when tmm connections are closed
Component: TMOS
Symptoms:
All security associations (SAs) can be deleted when tmipsecd restarts as a result of closing tmm connections during failover from active to standby.
Conditions:
When failover happens for high availability (HA), tmipsecd aims to close tmm connections when on standby, because tmm must connect instead to the daemon running in the active system. But a side effect of this restarts tmipsecd, resulting in deletion of all SAs when tmipsecd came back up.
Impact:
tmipsecd restarts. All IPsec tunnels experience an interruption of service until new SAs are negotiated.
Workaround:
None.
Fix:
Now tmipsecd no longer restarts when the tmm connections are closed in response to failover from active to standby.
775833-2 : Administrative file transfer may lead to excessive resource consumption
Solution Article: K94325657
775621-2 : urldb memory grows past the expected ~3.5GB
Component: Access Policy Manager
Symptoms:
When using the categorization engine (urldb), memory may increase when real-time update databases are downloaded (once every ten minutes, as available).
Conditions:
-- SWG provisioned.
-- Using urldb.
-- Real-time database updates occurring.
Impact:
Memory increases, and if there is not enough room on the BIG-IP system, urldb can core.
Workaround:
None.
Fix:
The system no longer preloads the database into memory, so memory no longer grows past what is expected.
775013-2 : TIME EXCEEDED alert has insufficient data for analysis
Component: Fraud Protection Services
Symptoms:
The time-exceeded alert does not include sufficient alert details to troubleshoot the process. It is difficult to determine whether or not the alert is valid, or how long past the request time the alert occurred.
Conditions:
Viewing alert logs for time-exceeded messages.
Impact:
Makes troubleshooting and/or analysis difficult.
Workaround:
None.
Fix:
All encryption failures alert now provides additional details to assist in troubleshooting the process.
774941-1 : GUI misspelling in Bot Defense logging profile
Component: Application Security Manager
Symptoms:
There is a misspelling in the logging profile for Bot Defense: Log Requests by Classificaiton.
Conditions:
Go to Security :: Event Logs : Logging Profiles :: Logging Profile :: Bot Defense :: Request Log.
Impact:
GUI shows misspelled word. There is no functional impact to this issue.
Workaround:
None needed. This is a cosmetic issue only.
Fix:
The text has been corrected: Log Requests by Classification.
774913-1 : IP-based bypass can fail if SSL ClientHello is not accepted
Component: Local Traffic Manager
Symptoms:
IP-based bypass can fail for SSL stream if the client sends a ClientHello that is not accepted by the BIP-IP system.
Conditions:
Client's SSL ClientHello message is not accepted by the BIG-IP system.
Impact:
Connection drop.
Workaround:
None.
Fix:
Check SSL bypass policy before parsing ClientHello message.
774881 : Protocol Inspection profiles can be added to a virtual server without Protocol Inspection being licensed.
Component: Protocol Inspection
Symptoms:
Protocol Inspection profiles can be added to a virtual server but are not applied to traffic.
To add a Protocol Inspection profile now it is required to have an AFM standalone license or to have an add-on AFM license, which includes Protocol Inspection module. Otherwise a error message is shown.
Conditions:
-- AFM is licensed as an add-on module without Protocol Inspection feature.
-- Protocol Inspection profile is configured and added to a virtual server or referenced in a firewall rule.
Impact:
It might appear that the configured Protocol Inspection profile attached to a virtual server or referenced in a firewall rule should work, but in fact, it is not applied to the actual traffic.
Workaround:
None.
Fix:
An error message is shown when trying to apply a Protocol Inspection profile to a virtual server or to a firewall rule having no Protocol Inspection license.
774633-2 : Memory leak in tmm when session db variables are not cleaned up
Component: Access Policy Manager
Symptoms:
There are some session db variables created as part of the split session proxy that have an indefinite timeout. If there is an error path or a failure with an inline service, the delete never gets called and these session keys build up over time, causing memory to leak in tmm.
Conditions:
SSLO setup with a service connector that fails.
Impact:
tmm eventually runs out of memory and generates a core file.
Workaround:
None.
Fix:
Variables have been set with a timeout so that they don't leak memory if the inline service fails.
774445-1 : BIG-IP Virtual Edition does not pass traffic on ESXi 6.7 Update 2
Solution Article: K74921042
Component: TMOS
Symptoms:
BIG-IP Virtual Edition (VE) does not pass traffic when deployed on ESXi 6.7 Update 2 hypervisors, when the VE is using VMXNET 3 network interfaces (VMXNET 3 interfaces are the default).
Conditions:
-- BIG-IP VE running on VMware ESXi 6.7 Update 2 (build number 13006603) hypervisor.
-- VMXNET 3 NICs.
Impact:
Traffic does not pass through non-mgmt interfaces.
Workaround:
You can use the following workarounds:
-- Until this issue is fixed in a Point-Release for your software branch, you can contact F5 Networks Technical Support to obtain an Engineering Hotfix to address the issue. This workaround allows TMM to continue to use the VMXNET3 driver, which is preferable.
-- On BIG-IP version 14.1.0, you can switch to the 'sock' driver.
-- On BIG-IP versions earlier than 14.1.0, you can switch to the 'unic' driver.
Note: The workarounds that switch driver must be applied individually to devices, as they do not synchronize via ConfigSync.
IMPORTANT: The driver must be configured the same way on all devices in a sync-failover device group.
To switch driver:
1. Add a line to /config/tmm_init.tcl that reads 'device driver vendor_dev 15ad:07b0 DRIVER' (replacing DRIVER with 'unic' or 'sock', as appropriate). For example:
echo "device driver vendor_dev 15ad:07b0 sock" >> /config/tmm_init.tcl
2. Restart tmm for the changes to take effect (restarting tmm disrupts traffic):
bigstart restart tmm
3. After tmm restarts, confirm the driver in use by examining the output of:
tmctl -d blade tmm/device_probed
Fix:
BIG-IP VE now passes traffic on ESXi 6.7 Update 2.
774213-1 : SWG session limits on SSLO deployments
Component: Access Policy Manager
Symptoms:
SWG session limits are enforced on SSLO deployments that enable Explicit proxy authentication.
Conditions:
-- SSLO with Explicit proxy authentication is deployed.
-- Many concurrent SSLO connections (beyond the SWG session limit).
Impact:
SSLO fails to connect when the SWG session limit is reached.
Workaround:
None.
Fix:
If there is an SSLO profile paired with either an APM or SSLO per-request policy on a virtual server, and the operation has done a hostname only lookup, an SWG license is no longer consumed. This answers the case where there is auth (APM) on one virtual server, and the transparent virtual server is SSLO with hostname Category Lookup only.
773925-2 : Sometimes MariaDB generates multiple error 24 (too many files open) for AVR DB tables files
Component: Application Visibility and Reporting
Symptoms:
For unknown reasons, sometimes MariaDB generates multiple error 24 (too many files open) for AVR DB table files. MySQL starts reporting error 24 in its error log:
190228 8:21:17 [ERROR] mysqld: Can't open file: './AVR/AVR_STAT_FW_NAT_TRANS_DEST_H.frm' (errno: 24)
190228 8:45:36 [ERROR] mysqld: Can't open file: './AVR/AVR_STAT_ASM_NETWORK_T.frm' (errno: 24)
190228 9:12:22 [ERROR] mysqld: Can't open file: './AVR/AVR_STAT_ASM_NETWORK_T.frm' (errno: 24)
Conditions:
-- Statistics are collected locally on the BIG-IP system (that is, the BIG-IP system is not associated with a BIG-IQ device).
-- There is a considerable amount of traffic.
Impact:
Statistic reports stop working. In some cases DB becomes corrupted.
Workaround:
In /etc/my.cnf file:
1. Change the value of the 'open_files_limit' parameter from 2500 to 5000.
2. Add the following parameter (right after 'open_files_limit'):
table_open_cache=2000
3. Restart MySQL:
bigstart restart mysql
Note: This workaround does not survive upgrade. It must be reapplied after every upgrade until the upgraded version contains a fix.
Fix:
Embed MariaDB configuration change into the standard BIG-IP versions.
773821-1 : Certain plaintext traffic may cause SSLO to hang
Component: Local Traffic Manager
Symptoms:
SSLO relies on SSL hudfilter to detect non-SSL traffic; but certain plaintext can be mistaken as SSL traffic, which can cause a hang.
Conditions:
Initial plaintext traffic resembles SSLv2 hello message or has less than enough bytes for SSL to process.
Impact:
SSLO hangs, unable to bypass traffic.
Workaround:
None.
Fix:
Improve SSL hello parser.
773677-1 : BIG-IP 14.1.0 system-journald write to /run/log/journal cause SWAP usage increase★
Solution Article: K72255850
Component: TMOS
Symptoms:
The system-journald process writes to temporary storage /run/log/journal when storage mode is set to 'auto'. The persistent directory /var/log/journal that controls where the log goes (temporary or persistent memory) is usually created during BIG-IP system reboot. In some cases, /var/log/journal is not created. In the absence of this, system-journald writes to temporary storage /run/log/journal.
Conditions:
BIG-IP upgraded from versions prior to v14.1.0 to version 14.1.0 or later.
Impact:
As it writes to temporary memory, system SWAP memory usage increases, impacting overall system performance and may result in the kernel out-of-memory killer running and killing system processes.
Workaround:
Perform these steps while running the upgraded 14.1.x system.
1. Create system-journald persistent log directory manually:
mkdir /var/log/journal
chown root:systemd-journal /var/log/journal
chmod 2755 /var/log/journal
chcon system_u:object_r:var_log_t:s0 /var/log/journal
2. Reboot the system.
Fix:
The system-journald persistent directory is always created during reboot or when the system-journald storage option is set to 'persistent'.
773673-2 : HTTP/2 Vulnerability: CVE-2019-9512
Solution Article: K98053339
773653-6 : APM Client Logging
Solution Article: K23876153
773649-6 : APM Client Logging
Solution Article: K23876153
773641-6 : APM Client Logging
Solution Article: K23876153
773637-6 : APM Client Logging
Solution Article: K23876153
773633-6 : APM Client Logging
Solution Article: K23876153
773621-6 : APM Client Logging
Solution Article: K23876153
773553-2 : ASM JSON parser false positive.
Component: Application Security Manager
Symptoms:
False positive JSON malformed violation.
Conditions:
-- JSON profile enabled (enabled is the default).
-- Specific JSON traffic is passed.
Impact:
HTTP request is blocked or an alarm is raised.
Workaround:
There is no workaround other than disabling the JSON profile.
Fix:
JSON parser has been fixed as per RFC8259.
773421-1 : Server-side packets dropped with ICMP fragmentation needed when a OneConnect profile is applied
Component: Local Traffic Manager
Symptoms:
When OneConnect is applied to a virtual server, the server-side packets larger than the client-side MTU may be dropped.
Conditions:
-- If the client-side MTU is smaller than server-side (either via Path MTU Discovery (PMTUD), or by manually configuring the client-side VLAN).
-- OneConnect is applied.
-- proxy-mss is enabled (the default value starting in v12.0.0).
Impact:
The BIG-IP system rejects server-side ingress packets larger than the client-side MTU, with an ICMP fragmentation needed message. Connections could hang if the server ignores ICMP fragmentation needed and still sends TCP packets with larger size.
Workaround:
Disable proxy-mss in the configured TCP profile.
Fix:
OneConnect prevents sending ICMP fragmentation needed messages to servers.
772545-3 : Tmm core in SSLO environment
Component: Local Traffic Manager
Symptoms:
Unexpected SSL events can occur in SSLO configuration, possibly resulting in tmm core.
Conditions:
SSLO environment which can cause serverside ssl to become enabled during clientside handshake causing unexpected events.
Impact:
Traffic disrupted while tmm restarts.
Workaround:
Enabling SSL forward proxy verified-handshake setting available in 14.0.
772473-3 : Request reconstruct issue after challenge
Component: Application Security Manager
Symptoms:
False positive on Content-Type header in GET request.
Conditions:
After challenge is completed, the server responds to the reconstructed request with a 302-redirect.
Impact:
The BIG-IP adds to the next request (GET request) a Content-Type header.
Workaround:
There is no workaround at this time.
Fix:
The BIG-IP no longer reconstructs the next request after a redirect.
772233-4 : IPv6 RTT metric is not set when using collection protocols DNS_DOT and DNS_REV.
Component: Global Traffic Manager (DNS)
Symptoms:
When probing DNS Path, the metric round trip time (RTT) is not set correctly if the collection protocols used are NDS_DOT or DNS_REV.
The problem occurs only if the Path involves an IPv6 address; IPv4 address works fine.
Conditions:
-- Path involves IPv6 addresses.
-- Collection protocol used is either DNS_DOT or DNS_REV.
Impact:
RTT metric is not set at all.
Workaround:
Use collection protocols - ICMP instead.
Fix:
The problem for both collection protocols - DNS_DOT and DNS_REV no longer occurs, and the RTT is set correctly.
772117-3 : Overwriting FIPS keys from the HA peer with older config leads to abandoned key on FIPS card
Component: TMOS
Symptoms:
A key being overwritten is not removed from the FIPS card, so it becomes an abandoned key in the FIPS card, which cannot be used and properly tracked by the BIG-IP system.
An abandoned key appears similar to the following:
[root@big8:Active:Standalone] config # tmsh show sys crypto fips
-------------------------------------------
FIPS 140 Hardware Device
-------------------------------------------
=== private keys (1)
ID MOD.LEN(bits)
d3d8ecc5a489c64b8dfd731945d59950 2048 <==== properly tracked and configured key in BIG-IP
/Common/fffff.key
e35e900af8b269d2f10b20c47e517fd1 2048 <==== no name, abandoned
Conditions:
The issue is seen when all the following conditions are met:
1. High availability (HA) setup formed by multiple BIG-IP systems with FIPS cards.
2. An Administrator of one of the BIG-IP systems deletes its FIPS key, and creates another FIPS key using the same name.
3. HA sync occurs from another BIG-IP system (with the older config) back to the first BIG-IP system (i.e., the operation overwrites the newly created FIPS key with the old FIPS key).
Impact:
It leads to orphan keys on the FIPS card, meaning that the keys are not present in the BIG-IP configuration as a configured key, so the key cannot be used by the BIG-IP system.
Workaround:
Manually delete the abandoned key from the FIPS card using the following command.
tmsh delete sys crypto fips key <key-id>
For example, for the abandoned key specified earlier, use the following command:
tmsh delete sys crypto fips key "e35e900af8b269d2f10b20c47e517fd1"
Fix:
Now, the overwritten key is successfully removed, so there is no longer an abandoned key present on the FIPS card.
771905-2 : JWT token rejected due to unknown JOSE header parameters
Component: Access Policy Manager
Symptoms:
JWT token rejected and OAuth Scope Agent fails.
Conditions:
When JWT access token contains unregistered JSON Object Signing and Encryption (JOSE) header parameters (e.g., nonce).
Impact:
Unregistered JOSE header parameters causes JWT access token to be rejected. OAuth Scope Agent fails.
Workaround:
None.
Fix:
If an unregistered parameter in the JOSE header is present in the JWT token, the system ignores the parameter instead of rejecting the token.
771873-5 : TMSH Hardening
Solution Article: K40378764
771705-1 : You may not be able to log into BIG-IP Cloud Edition if FSCK fails
Component: TMOS
Symptoms:
During BIG-IP Cloud Edition bootup, if FSCK fails and requires manual intervention to recover, you may not be able to proceed. This occurs because login requires the password for root, which is not typically set.
Conditions:
-- BIG-IP Cloud Edition.
-- FSCK failure on bootup requires manual intervention to recover.
Impact:
Cannot log in to BIG-IP Cloud Edition.
Important: There is no way to recover if the FSCK failure has already occurred. You must begin the BIG-IP Cloud Edition configuration again. You should implement the Workaround to prevent the issue from occurring.
Workaround:
To prevent the issue from occurring, run the following command for every filesystem:
tune2fs -i 0 <file system>
Following is a list of file systems (replace '1' with the relevant slot number if the active slot is not 1):
/dev/vg-db-vda/set.1.root
/dev/mapper/vg--db--vda-set.1._var
/dev/mapper/vg--db--vda-set.1._usr
/dev/mapper/vg--db--vda-set.1._config
/dev/mapper/vg--db--vda-dat.share
/dev/mapper/vg--db--vda-dat.log
/dev/mapper/vg--db--vda-dat.appdata
Fix:
FSCK is disabled BIG-IP Virtual Edition (VE) for both cloud and hypervisor configurations, so this issue no longer occurs.
Note: Disabling FSCK in virtual machines is considered standard operating procedure. In BIG-IP VE, FSCK is disabled upon the image creation and during live install of the full ISO. It is disabled for all file systems on all slots (boot locations). Although it is not recommended, you can manually reenable FSCK in Linux, in particular, using tune2fs to set the FSCK schedule, and updating /etc/fstab to allow it.
Behavior Change:
FSCK is now disabled in BIG-IP Virtual Edition (VE) for both cloud and hypervisor, preventing failure during bootup. FSCK disablement also persists during a downgrade. F5 Networks does not recommend reenabling FSCK. However, you can reenable it in Linux by updating /etc/fstab, so you can use tune2fs to set the FSCK schedule.
771173-3 : FastL4 profile syn-cookie-enable attribute is not being rolled forward correctly.★
Component: Advanced Firewall Manager
Symptoms:
The system does not roll forward the FastL4 profile syn-cookie-enable attribute after upgrading from 12.x to 13.x and beyond.
Conditions:
This happens when upgrading from 12.x to 13.x and beyond.
Impact:
If syn cookies are explicitly disabled on a FastL4 profile prior to upgrading, they may be enabled.
Workaround:
You can fix the configuration by modifying it manually after upgrading.
In tmsh:
tmsh modify ltm profile fastl4 <profile_name> syn-cookie-enable <enabled|disabled>
771025-3 : AVR send domain names as an aggregate
Component: Application Visibility and Reporting
Symptoms:
AVR sends domain name as an aggregate of a number of domain names.
Conditions:
-- AVR receives more than the number of domain names it can handle.
-- After AVR gets DNS calls with different domain name, it no longer clears the domain name.
-- When AVR receives the maximum number of total domain names, it start to aggregate all the new domain names.
Impact:
Cannot see the correct domain name.
Workaround:
None.
Fix:
AVR now removes old domain names, so it can add new ones and send the actual domain names it collected.
770953 : 'smbclient' executable does not work
Component: TMOS
Symptoms:
Service Message Block (SMB) monitor is not functional.
Conditions:
This occurs under all conditions.
Impact:
SMB monitors fail. This occurs because the 'smbclient' executable is not functional.
Workaround:
None.
Fix:
'smbclient' executable is runnable and SMB monitoring is working.
770797-1 : HTTP2 streams may get stuck in rare situations
Component: Local Traffic Manager
Symptoms:
If HTTP2 is used in a 'gateway' configuration on a virtual server, without the use of an MRF http_router profile, HTTP connections are used to connect to the back-end servers.
The HTTP connections are pooled, and may be reused between streams. In rare situations, an HTTP connection is reused whilst it is in the process of shutting down. This may cause the corresponding HTTP2 stream to get into an unexpected state, and get 'stuck'.
The stuck streams persist until the client closes the HTTP2 connection. If a client keeps opening new streams on the affected connection, it may eventually run out of the total allowed streams limited by the HTTP2 profile. The client may then deadlock, waiting for streams to close.
Conditions:
An HTTP2 profile is used on a virtual server without an MRF http_router profile.
Impact:
The impact depends on client behavior. Some clients will open new connections for stuck streams, so the impact will be minimal. Others will show loss of performance or hang waiting for resources that will never be delivered.
Workaround:
None.
Fix:
HTTP2 streams no longer get stuck in rare situations.
770557-3 : Per-Session RADIUS Acct STOP message is forged based on pool route domain, but is sent through default one
Component: Access Policy Manager
Symptoms:
The per-Session RADIUS Acct STOP message is forged based on the pool route domain, but is sent through the default one.
Conditions:
1. Deploy the BIG-IP system with two route domains
2. Under each route domains you have a path to the RADIUS server.
3. Create Access Policy with a Logon Page, RADIUS Acct agent fallback-to-Deny ending.
4. Attach it to the virtual server.
5. Run tcpdump -i any port 1813 -ne on the BIG-IP system.
5. Navigate to the virtual server.
6. Wait 20 seconds till STOP packets arrive.
Impact:
The BIG-IP system sends the STOP packets according to the default routing table instead of the configured route domain RADIUS server.
Workaround:
None.
Fix:
The BIG-IP system now sends the STOP packets according to the configured route domain RADIUS server.
770477-2 : SSL aborted when client_hello includes both renegotiation info extension and SCSV
Component: Local Traffic Manager
Symptoms:
Client SSL reports an error and terminates handshake.
Conditions:
Initial client_hello message includes both signaling mechanism for secure renegotiation: empty renegotiation_info extension and TLS_EMPTY_RENEGOTIATION_INFO_SCSV.
Impact:
Unable to connect with SSL.
Workaround:
None.
Fix:
Allow both signaling mechanism in client_hello.
769997-1 : ASM removes double quotation characters on cookies
Component: Application Security Manager
Symptoms:
ASM removes the double quotation characters on the cookie.
Conditions:
Cookie sent that contains double quotation marks.
Impact:
The server returns error as the cookie is changed by ASM.
Workaround:
Set asm.strip_asm_cookies to false using the following command:
tmsh modify sys db asm.strip_asm_cookies value false
Fix:
ASM no longer removes the double quotation characters on the cookie.
769981-2 : bd crashes in a specific scenario
Component: Application Security Manager
Symptoms:
bd crash with a core file.
Conditions:
-- XML profile with schema validation is attached to a security policy.
-- The bd.log shows out-of-memory messages relating to XML.
Impact:
Failover; traffic disruption.
Workaround:
Increase the memory XML uses by using the internal parameters total_xml_memory and/or additional_xml_memory_in_mb. For more information, see K10803: Customizing the amount of memory allocated to the BIG-IP ASM XML processing engine available at https://support.f5.com/csp/article/K10803
769853-2 : Access Profile option to restrict connections from a single client IP is not honored for native RDP resources
Solution Article: K24241590
Component: Access Policy Manager
Symptoms:
When launching a native RDP resource (desktop/application) from APM Webtop, APM provides an RDP file to the browser and the browser invokes the native RDP client to launch the resource with the parameters specified in the RDP file.
When Access profile option 'Restrict to Single Client IP' option is enabled, user should only be allowed to launch the resource from the client that initiated the request.
Conditions:
-- APM Webtop is configured with native RDP resource.
-- 'Restrict to Single Client IP' option is enabled in Access Profile.
Impact:
RDP file provided by APM can be used for launching the RDP resource on a client machine that did not initiate the APM session.
Workaround:
None.
Fix:
When Access Profile option 'Restrict to Single Client IP' is enabled, APM restricts native RDP resource launch from the client that initiated the APM session.
769809-4 : The vCMP guests 'INOPERATIVE' after upgrade
Component: TMOS
Symptoms:
After upgrading the host or creating new vCMP guests, the prompt in the vCMP guests report as INOPERATIVE.
Conditions:
-- The system truncates the unit key. (Note: This occurs because the unit key is designed to be a certain length, and the internally generated unit key for the guest has a NULL in it.)
-- Upgrading the host.
-- Creating new guests.
Impact:
The vCMP guests are sent a truncated unit key and fail to decrypt the master key needed to load the config. vCMP Guests report 'INOPERATIVE' after upgrade.
Workaround:
Note: Upgrading vCMP hosts from an affected version to an unaffected version may not clear issue.
Upon encountering this issue, it may be best to roll back to the previously used, unaffected version on the vCMP host, and then install a version unaffected by this issue (i.e., versions later than 12.1.4.1 or later than 13.1.1.5).
Fix:
The system now handles a guest unit key that has a NULL in it, so vCMP guests are no longer 'INOPERATIVE' after upgrade
769801-1 : Internal tmm UDP filter does not set checksum
Component: Local Traffic Manager
Symptoms:
An internal tmm UDP filter does not set checksum for outgoing UDP packets.
Conditions:
-- An internal tmm UDP filter is in use.
Impact:
Even though a UDP packet with no checksum is permitted, it could cause some problems with some firewalls/servers.
Workaround:
For internal tmm udp filters, add the following to the UDP profile in use:
no_cksum 0
Fix:
Internal tmm UDP filters set checksum for outgoing UDP packets.
769589-2 : CVE-2019-6974: Linux Kernel Vulnerability
Solution Article: K11186236
769361-2 : TMM may crash while processing SSLO traffic
Solution Article: K33444350
769309-2 : DB monitor reconnects to server on every probe when count = 0
Component: Local Traffic Manager
Symptoms:
When using an LTM database monitor configured with the default 'count' value of 0 (zero), the database monitor reconnects to the monitored server (pool member) to perform each health monitor probe, then closes the connection once the probe is complete.
Conditions:
This occurs when using one of the LTM mssql, mysql, oracle or postgresql monitor types is configured with the default 'count' value of 0 (zero).
Impact:
Connections to the monitored database server are opened and closed for each periodic health monitor probe.
Workaround:
Configure the 'count' value for the monitor to some non-zero value (such as 100) to allow the network connection to the database server to remain open for the specified number of monitor probes before it is closed and a new network connection is created.
Fix:
The LTM database monitor keeps the network connection to the monitored database server open indefinitely when configured with the default 'count' value of 0 (zero).
769281-1 : Per-request Acess Policy may show user interface pages incorrectly i nlanguages other than English
Component: Access Policy Manager
Symptoms:
If per-request Access Policy contains a user interface page (logon page, message box, etc.), this page may not be shown correctly in the browser if English is not the preferred language.
Conditions:
-- Browser with preferred language other than English.
-- Per-request Access Policy with support of this language.
-- Access Policy Agent with user interface included in the policy (logon page, message box, decision box, various forms of Rejected Ending Agent).
Impact:
The browser shows incorrect items on the response page presented to the APM end user (e.g., the page displays incorrect language strings).
Workaround:
None.
Fix:
Now, user interface pages in non-English languages are shown correctly by per-request Access Policy Agents.
769193-5 : Added support for faster congestion window increase in slow-start for stretch ACKs
Component: Local Traffic Manager
Symptoms:
When Appropriate Byte Counting is enabled (the default), TCP's congestion window increases slower in slow-start when the data receiver sends stretch ACKs.
Conditions:
-- TCP data sender receives stretch ACKs (ACKs that acknowledges more than 2*MSS bytes of data).
-- Appropriate Byte Counting (ABC) is enabled in slow-start.
Impact:
ABC limits the increase of congestion window by 2*MSS bytes per ACK. TCP's congestion window is increased slower in slow-start, which may lead to longer transfer times.
Workaround:
There is no workaround at this time.
Fix:
A new sys db (TM.TcpABCssLimit) is provided to set TCP's ABC limit (the default is 2*MSS) on increasing congestion window per ACK. With a larger limit (default is 2*MSS), TCP's congestion window increases faster in slow-start when stretch ACKs are received. If the data receiver sends regular ACKs/delayed ACKs, this setting has no impact.
Behavior Change:
There is a new db variable, TM.TcpABCssLimit for specifying TCP's ABC limit (the default is 2*MSS) on increasing congestion window per ACK. With a larger limit (default is 2*MSS), TCP's congestion window increases faster in slow-start when stretch ACKs are received.
Note: If the data receiver sends regular ACKs/delayed ACKs, this setting has no impact.
769169-3 : BIG-IP system with large configuration becomes unresponsive with BIG-IQ monitoring
Component: TMOS
Symptoms:
BIG-IQ sends a lot of request to the BIG-IP system to collect the stats it makes the BIG-IP slow and eventually GUI goes unresponsive.
Conditions:
-- BIG-IQ monitoring a large BIG-IP configuration.
-- With a very large number of requests, and with resource-expensive requests.
Impact:
ICRD requests wait longer in the ICRD queue, which can make the BIG-IP system becomes unresponsive. Policy Creation, Device Overview, and stats pages take more time to respond, and eventually, the GUI becomes unresponsive on these three pages.
Lot of process terminated/re-created messages in restjavad logs.
Workaround:
Remove the BIG-IP device from the BIG-IQ and restart the mcpd.
Fix:
The system now handles the queue so that there is time for BIG-IP system to recover and become responsive.
769061-2 : Improved details for learning suggestions to enable violation/sub-violation
Component: Application Security Manager
Symptoms:
The title for the entity in suggestions to enable violation/sub-violation is 'Match violation'/'Matched HTTP Check', though these suggestions are created when there is no match in the observed traffic.
Conditions:
There are learning suggestions to enable violations/sub-violation in the policy
Impact:
Misleading suggestion details.
Workaround:
None.
Fix:
The misleading word 'Matched' was removed from the title.
768981-2 : vCMP Hypervisor Hardening
Solution Article: K05765031
768761-2 : Improved accept action description for suggestions to disable signature/enable metacharacter in policy
Component: Application Security Manager
Symptoms:
It is difficult to understand the description for suggestions to disable signature or enable metacharacter on parameter/URL alternative action (accept for all entities).
Conditions:
There are suggestions to disable signature or enable metacharacter on parameter/URL.
Impact:
Action description can be difficult to understand.
Workaround:
None.
Fix:
'Accept for Any Entity' action has been renamed to 'Accept Globally'. The 'Charset' type is now mentioned in the action description for better understanding of the applied action.
768025-4 : SAML requests/responses fail with "failed to find certificate"
Component: Access Policy Manager
Symptoms:
BIG-IP as SP and BIG-IP as IdP fail to generate signed SAML requests/responses or SAML Single Logout (SLO) requests/responses after the certificate that is used for signing is modified.
Conditions:
The certificate used for signing SAML requests/responses or SAML SLO requests/responses is modified or re-imported.
Impact:
When this issue occurs, SAML services are impacted when BIG-IP is configured as SP or IdP. Subsequent SAML/SAML SLO requests/responses fail with the error 'failed to find certificate'.
-- When BIG-IP is configured as IdP, then SAML Authentication fails and SAML/SAML SLO services do not work.
-- When BIG-IP is configured as SP, resources that need SAML Authentication cannot be accessed. Also, SAML SLO service does not work.
Workaround:
-- When BIG-IP as IdP is affected, configure a different certificate associated with SAML IdP configuration that is used for signing, change it back to the original certificate, and then the apply policy.
-- Similarly, when BIG-IP as SP is affected, configure a different certificate associated with SAML SP configuration that is used for signing, change it back to the original certificate, and then apply the policy.
Fix:
BIG-IP as SP and BIG-IP as IdP works as expected while generating signed SAML requests/responses or SAML Single Logout (SLO) requests/responses after certificate that is used for signing is modified.
767877-3 : TMM core with Bandwidth Control on flows egressing on a VLAN group
Component: TMOS
Symptoms:
TMM cores during operation.
Conditions:
Known condition:
1. BWC attached to serverside connflow
2. Serverside traffic traversing/egressing VLAN group
Impact:
Traffic disrupted while tmm restarts.
767689-1 : F5optics_install using different versions of RPM★
Component: TMOS
Symptoms:
Symptoms have been observed only in one case: A bare metal install to BIG-IP 14.1.0. In this case, a messages indicating the RPM database under /shared is corrupted.
Conditions:
Bare metal installation via PXE boot or USB install.
Impact:
The /shared/lib/rpm database must be recreated and f5optics manually installed.
Workaround:
1. Backup the current Packages file:
cp /shared/lib/rpm/Packages /shared/tmp/
2. Remove all the files from the database directory"
rm -f /shared/lib/rpm/*
3. Initiate the database by using the old version RPM:
/opt/bin/rpm --dbpath /shared/lib/rpm --initdb
4. Restore the Packages file (Press 'y' when promoted by 'cp: overwrite'):
cp /shared/tmp/ /shared/lib/rpm/Packages
Now you should be able to install the package.
Fix:
With these changes, the corruption of the /shared/lib/rpm database is no longer observed.
767653-1 : Malformed HTTP request can result in endless loop in an iRule script
Solution Article: K23860356
767401-1 : TMM may crash while processing TLS traffic
Solution Article: K95434410
767373-1 : CVE-2019-8331: Bootstrap Vulnerability
Solution Article: K24383845
767045-2 : TMM cores while applying policy
Component: Anomaly Detection Services
Symptoms:
TMM core and possible cores of other daemons.
Conditions:
The exact conditions are unknown.
Occurrences have been seen during specialized internal testing and while applying a copied and edited ASM policy.
Impact:
Traffic disrupted while tmm restarts.
Workaround:
None.
766873 : Omission of lower-layer types from sFlow packet samples
Component: TMOS
Symptoms:
The packet samples transmitted from BIG-IP to an sFlow receiver may contain only 'http' samples, with no 'vlan' or 'interface' FLOW samples appearing. sFlow will continue to transmit CNTR (counter) telemetry packets.
Conditions:
When the BIG-IP system is configured with one or more sFlow receivers, with non-zero sampling-rate configured for 'vlan' or 'interface' types.
Impact:
External network-monitoring or management systems, which may depend on sFlow packet samples from BIG-IP systems and from other equipment, are unable properly to characterize the flow of data throughout the network.
Workaround:
None.
Fix:
This issue no longer occurs.
766761-2 : Ant-server does not log requests that are excluded from scanning
Component: Access Policy Manager
Symptoms:
Based on Request/Response Analytics agent 'Exclude Types' settings, the requests that are excluded from scanning should log a message that states, 'Response content is in excluded content list'.
Conditions:
Response or Request Analytics agent in the Per-Request Policy.
Impact:
These particular logs are not available.
Workaround:
None.
Fix:
Appropriate messages now get logged.
766577-2 : APMD fails to send response to client and it already closed connection.
Component: Access Policy Manager
Symptoms:
APMD fails to send response to client and produces error message:
err apmd[8353]: 01490085:3: /pt-qp-campus/apm-cdp-qp-qa:pt-qp-campus:bb651ae6: Response could not be sent to remote client. Socket error: Connection reset by peer
APMD does most of its action with backend authentication servers (e.g., AD, LDAP, RADIUS). If the backend server response is very slow (because of various reasons such as network issues), it might cause slow apmd client response. Sometimes, the client has already closed the connection to the virtual server, so the client connection is no longer valid.
Conditions:
Backend server is slow, causing longer-than-usual response times.
Impact:
This causes the client to close the connection. APMD fails to respond to the client.
The cumulative slowness of the backend server causes delay in response. Most of the time, the client connection is already closed. As a result, the request queue gets full. When apmd starts processing the request from the queue, the client connection is already closed for some of them, and processing those requests still continues, which is unnecessary and causes more delay.
Fix:
The system now tests the client connection after picking up the request from the request queue and before processing.
-- If the connection is already closed, the system drops the request.
-- If the request is already in progress, the system checks the client connection before saving the session variables and sending the response to client.
766405-2 : MRF SIP ALG with SNAT: Fix for potential crash on next-active device
Component: Service Provider
Symptoms:
The next active device may crash with a core when attempting to create media flows.
Conditions:
The names for the LSN pool and router profile are longer than expected.
Impact:
The TMM on the next active device may core. Traffic disrupted while tmm restarts; If the next-active device was not carrying traffic for a traffic group, traffic is not disrupted.
Workaround:
None.
Fix:
Device no longer cores.
766365-1 : Some trunks created on VE platform stay down even when the trunk's interfaces are up
Component: TMOS
Symptoms:
Trunk configured on BIG-IP Virtual Edition (VE) does not pass traffic because it is in 'down' state
Conditions:
Trunk is created on VADC for NICs that use XNet drivers.
Note: In this release, XNet drivers are used by Mellanox and AWS ENA NICs on the VE platform only
Impact:
Trunk marked 'down'; traffic does not pass through the trunk.
Workaround:
None.
Fix:
Drivers that suffered from this problem now set speed correctly for the interface.
766357-1 : Two simultaneously manual installations can cause live-update inconsistency
Component: Application Security Manager
Symptoms:
When running two manual installations of the same update type simultaneously from different browser instances, live-update may encounter inconsistencies, and one of the installations gets stuck in the 'installing' state.
Conditions:
-- Two different installations of the same update type exists.
-- Manual installation occurs both at the same time from different browser instances.
Impact:
-- One of the installations stays in the 'installing' state.
-- Cannot install other installations (.im files).
Workaround:
Run the following command:
bigstart restart tomcat
Live-update changes the status of the installation from 'installing' to 'error' and allows subsequent installation operations.
Fix:
Live-update now queues all manual installations, so they start one after another. After all installations end, only one installation has the 'installed' status.
766329-2 : SCTP connections do not reflect some SCTP profile settings
Component: TMOS
Symptoms:
The effective receive-chunks, transmit-chunks, in-streams, and out-streams parameters in SCTP traffic do not match the settings from the configured SCTP profile:
-- The in-streams setting alters both the in-streams parameter and the tx-chunks parameter.
-- The out-streams setting alters both the out-streams parameter and the rx-chunks parameter.
-- The tx-chunks setting has no effect.
-- The rx-chunks setting has no effect.
Conditions:
An SCTP virtual server is configured.
Impact:
Unexpected SCTP parameters are negotiated on SCTP connections.
Workaround:
None.
Fix:
The SCTP profile settings are now used during SCTP connection negotiation.
766293-1 : Monitor logging fails on v14.1.0.x releases
Component: Local Traffic Manager
Symptoms:
With a fresh install of v14.1.0.x, you attempt to enable monitor logging for a node or pool member, an error message appears in /var/log/ltm. Also the log file to be created fails to be created.
This behavior is due to SELinux changes. /var/log/auditd/audit.log show the SELinux violations logs.
System reports messages similar to the following in /var/log/ltm:
-- info bigd[12457]: Couldn't open logging file /var/log/monitors/Common_Splunk_HTTP_monitor-Common_node1-8088.log for monitor /Common/Splunk_HTTP_monitor on node /Common/node1.
Conditions:
-- Clean installation of v14.1.0.x software.
-- Enable monitor logging for a node or pool member.
Impact:
Monitor logging fails. Error messages logged.
Workaround:
None.
Fix:
Updated bigd SELinux rules to allow the monitor log file creations.
765801 : WCCP service info field corrupted in upgrade to 14.1.0 final★
Component: TMOS
Symptoms:
WCCP 'Here I am' packets from BIG-IP to routers have corrupted service info. No 'I see you' response received from routers due to mismatched service flags information.
Conditions:
No specific condition other than WCCP configuration on BIG-IP 14.1.0.x version.
Impact:
Unable to deploy WCCP on BIG-IP in version 14.1.0.x.
Workaround:
None.
Fix:
Corrected WCCP service flags during initialization.
765785-3 : Monpd core upon "bigstart stop monpd" while Real Time reporting is running
Component: Application Visibility and Reporting
Symptoms:
Monpd cores upon "bigstart stop monpd" while Real Time reporting is running
Conditions:
Real Time UI view is active.
Impact:
None.
Workaround:
None.
Fix:
Fixed a monpd core.
765533-2 : Sensitive information logged when DEBUG logging enabled
Solution Article: K58243048
Component: TMOS
Symptoms:
For more information see: https://support.f5.com/csp/article/K58243048
Conditions:
For more information see: https://support.f5.com/csp/article/K58243048
Impact:
For more information see: https://support.f5.com/csp/article/K58243048
Workaround:
For more information see: https://support.f5.com/csp/article/K58243048
Fix:
For more information see: https://support.f5.com/csp/article/K58243048
765517-1 : Traffic Match Criteria validation fails when create Virtual server with address list with overlapping address space but a different ingress VLAN
Component: Local Traffic Manager
Symptoms:
When two virtual servers are created and they have same address list but different incoming VLANs, Traffic Match Criteria validation fails.
Conditions:
Create 2 virtual servers and they have same address list but different incoming VLANs.
Impact:
System validation fails.
Workaround:
Use non-overlapping address lists.
765449-1 : Update availability status may be inaccurate
Component: Application Security Manager
Symptoms:
Under certain condition the UI may indicate that attack signature updates are available.
Conditions:
ASM provisioned.
Impact:
Attack signature updates are listed as available when the latest signatures are already installed.
Workaround:
An accurate status for availability of updates is available in System::Software Management::Live Update
Fix:
The UI now displays an accurate availability status for attack signatures.
765413-1 : ASM cluster syncs caused by PB ignored suggestions updates
Component: Application Security Manager
Symptoms:
Frequent syncs occurring within an ASM device group.
Conditions:
Several (updating) suggestions are marked 'ignored'.
Impact:
Syncs appear in the logs (no actual performance degradation).
Workaround:
-- Remove the Ignored Suggestions. (Note: These might be re-added and you must refrain from clicking the Ignore button).
-- Remove the Ignored Suggestions and uncheck the Learn flag for the violation that causes it. (Note: The impact is that the system does not learn this violation anymore, so any future suggestions to amend the policy for that violation will not be created.)
Fix:
Policy Builder (PB) no longer updates Ignored Suggestions, so unnecessary sync operations no longer occur.
765033 : Upgrades to versions that restrict resource-admin users from accessing bash may fail under certain conditions★
Component: TMOS
Symptoms:
Some versions of BIG-IP software have removed the ability to access bash from users that have resource-admin roles. Upgrades to one of these versions may fail to load the configuration on the upgraded volume with a message in /var/log/ltm similar to:
err mcpd[14994]: 01070825:3: Access denied - Administrators only: Custom shells only available to administrators, not testuser.
Conditions:
-- Users with the resource-admin role also have bash access.
-- Upgrading to an affected version from certain versions.
Impact:
The upgraded volume's configuration does not load.
Workaround:
You can use either of the following workarounds:
-- Ensure that all users with the resource-admin role do not have bash access prior to upgrading.
-- Hand-edit the bigip_user.conf to remove bash from any users with the resource-admin role and reload the configuration using the following command:
tmsh load sys config
Fix:
Upgrades no longer fail under these conditions.
764665-2 : AVRD core when connected to BIG-IQ via HTTPS at the moment of configuration change
Component: Application Visibility and Reporting
Symptoms:
When BIG-IP is registered on BIG-IQ system, sometimes avrd crashes with core.
Conditions:
-- BIG-IP is registered at BIG-IQ.
-- BIG-IQ sends configuration update to BIG-IP.
Impact:
Avrd cores and restarts. Functionality is not impacted, stats data are sent to BIG-IQ.
Workaround:
None.
Fix:
Corrected issue in setting value for internal flag.
764373-3 : 'Modified domain cookie' violation with multiple enforced domain cookies with different paths
Component: Application Security Manager
Symptoms:
When the server sends enforced cookies with the same name for different paths, a false-positive 'Modified domain cookie' violation is reported.
Conditions:
Server sends enforced cookies with the same name but with different paths.
Impact:
A valid request might be rejected.
Workaround:
None.
Fix:
The system now checks all enforced cookies correctly, so this issue no longer includes.
763349-3 : AVRD can crash with core when HTTPS connection to BIG-IQ DCD node times out
Component: Application Visibility and Reporting
Symptoms:
avrd application on BIG-IP crashes; core is generated.
Conditions:
-- The BIG-IP is configured to send data to BIG-IQ DCD node via the HTTPS protocol.
-- Connection to DCD is established but response does not arrive within the timeout interval, so the connection times out.
Impact:
avrd crashes, and a core is generated.
Workaround:
None.
Fix:
avrd now reconnects to BIG-IQ DCD in a different sequence so this issue no longer occurs.
763157-2 : MRF SIP ALG with SNAT: Processing request and response at same time on same connection may cause one to be dropped
Component: Service Provider
Symptoms:
Processing the response to an outbound request at the same time as an inbound request message on the same connection could cause internal state generated to be confused and the inbound request to be dropped.
Conditions:
Processing the response to an outbound request at the same time as an inbound request message on the same connection.
Impact:
The inbound request will be dropped.
Workaround:
None.
Fix:
The internal state generated is no longer confused so the inbound request is no longer dropped.
763005-3 : Aggregated Domain Names in DNS statistics are shown as random domain name
Component: Application Visibility and Reporting
Symptoms:
Many DNS queries (e.g., 50000) with different query domain names are sent and AVR aggregates data it shows aggregated names using a random name taken from the first lookup table record.
Conditions:
-- Run 50000 DNS queries, all with different domain names.
-- View Statistics :: Analytics :: DNS, and choose View By : Domain Names.
Impact:
There is one random domain name with a high counter value, other domains are shown with counter 1.
Workaround:
None.
763001-1 : Web-socket enforcement might lead to a false negative
Solution Article: K70312000
Component: Application Security Manager
Symptoms:
A request that should be blocked will be passed to server.
Conditions:
Parse parameters flag in json profile is enabled.
Requests are sent in json websocket.
Impact:
Bad requests may be passed to the server
Workaround:
Disable parse parameters flag in json profile
Fix:
Web-socket enforcement now filters requests as expected.
762453-2 : Hardware cryptography acceleration may fail
Solution Article: K63558580
762385 : Wrong remote-role assigned using LDAP authentication after upgrade to 14.1.x and later★
Component: TMOS
Symptoms:
When multiple attributes in a list match multiple roles, the wrong role may be assigned. Alternatively, authentication may fail when check-roles-group is disabled.
Conditions:
LDAP server replies with a list of attributes (e.g., list of memberOf) where more than one match existing role.
Impact:
BIG-IP assigns the user to the last attribute in the list that matches a role, potentially yielding a more restrictive set of permissions.
Authentication may fail when check-roles-group is disabled.
Workaround:
None.
Fix:
The correct remote-role is now assigned using LDAP authentication.
762205-2 : IKEv2 rekey fails to recognize VENDOR_ID payload when it appears
Component: TMOS
Symptoms:
Rekey with non BIG-IP systems can fail when a response contains a VENDOR_ID payload.
Conditions:
- IKEv2 Responder sends VENDOR_ID payload in rekey response.
- The ipsec.log misleadingly reports:
[I] [PROTO_ERR]: unexpected critical payload (type 43)
Note: This message may be correctly present under other conditions, with different type constants not equal to 43.
Impact:
BIG-IP as the initiator of rekey drops the rekey negotiation without making further progress when the responder included a VENDOR_ID payload in a response. This will result in deleting the SA for good when the hard lifetime expires, causing a tunnel outage.
Workaround:
No workaround is known at this time.
Fix:
Handling of payload types during rekey will now ignore VENDOR_ID when it appears, the same way we ignore VENDOR_ID in other messages during IKE negotiation.
761993-2 : The nsm process may crash if it detects a nexthop mismatch
Component: TMOS
Symptoms:
If there is a mismatch between tmrouted and nsm for the interface index or gateway of a nexthop, nsm may crash and restart.
Conditions:
-- Dynamic routing is in use.
-- A mismatch between tmrouted and nsm for the interface index or gateway of a nexthop exists.
Impact:
There is a temporary interruption to dynamic routing while nsm is restarted.
Workaround:
None.
Fix:
Prevented nsm crashing when there is a mismatch between tmrouted and nsm for the interface index or gateway of a nexthop.
761941-1 : ASM does not remove CSRT token query parameter before forwarding a request to the backend server
Component: Application Security Manager
Symptoms:
CSRT query parameter observed in tcpdump on the BIG-IP system's server side.
Conditions:
-- ASM provisioned.
-- ASM policy attached to a virtual server.
-- CSRF enabled in ASM policy.
Impact:
Backend app gets CSRT parameter, which might impact its business logic.
Workaround:
You can remove a CSRT query parameter using a URI modification iRule on the server side.
Fix:
The system now removes the csrt query parameter before forwarding a request to the backend server
761933-1 : Reboot with 'tmsh reboot' does not log message in /var/log/audit
Component: TMOS
Symptoms:
The tmsh reboot command is missing from /var/log/audit.
Conditions:
-- Reboot a system using the command 'tmsh reboot'.
-- View the /var/log/audit log.
Impact:
The system does not log the tmsh reboot operation in the /var/log/audit log. A message similar to the following should be reported:
notice tmsh[19115]: 01420002:5: AUDIT - pid=19115 user=root folder=/Common module=(tmos)# status=[Command OK] cmd_data=reboot.
Workaround:
None.
761921-1 : avrd high CPU utilization due to perpetual connection attempts
Component: Application Security Manager
Symptoms:
avrd shows high CPU utilization. Repeated retries on auth token client failed connection attempts.
Conditions:
-- The BIG-IQ system is not available (even though it is configured).
-- Frequent connection retries.
Impact:
avrd consumes a large amount of CPU.
Workaround:
Correct BIG-IQ availability and restart avrd.
Fix:
avrd now waits between connection retries, so this issue does not occur.
761749-2 : Security pages unavailable after switching RT mode on off few times
Component: Application Visibility and Reporting
Symptoms:
Security dashboard and analytics pages display "Unable to load application" and no statistics available.
Conditions:
A BIG-IP configured to collect statistics from security modules and new statistics are generated periodically.
The problem may appear when a user switches real-time mode on off few times.
Impact:
Security dashboard and analytics pages unavailable for at least few hours and some real-time statistics are lost.
Fix:
Added timeout for fetching data from statistics module.
761685-3 : Connections routed to a virtual server lose per-client connection mode if preserve-strict source port mode is set
Component: Service Provider
Symptoms:
Systems desiring to create a unique connection per connection client may silently end up with clients sharing an outgoing connection if routing uses a virtual server as the outgoing connection transport definition, and the virtual server has the source-port attribute set to preserve-strict.
Conditions:
-- Routing using a virtual server as the transport definition for the outgoing connection.
-- The virtual server has the source-port attribute set to preserve-strict.
Impact:
Systems desiring to create a unique connection per connection client may silently end up sharing an outgoing connection.
Workaround:
None.
Fix:
Per-client mode is now maintained when routing to a virtual server, even when preserve-strict is selected.
761553-2 : Text for analyzed requests improved for suggestions that were created as result of absence of violations in traffic
Component: Application Security Manager
Symptoms:
Text for analyzed requests might be misleading for suggestions that are created as result of an absence of violations in traffic:
X requests triggered this suggestion from date:time until date:time.
Actually:
-- 'X requests' did not trigger a violation, and no sampled are requests provided.
-- The format of the time in 'from date:time until date:time' is difficult to parse.
Conditions:
There are suggestions that were created as result of an absence of violations in traffic in the policy.
Impact:
Text might be misleading.
Workaround:
None.
Fix:
Improved text for analyzed requests for suggestions that were created as result of absence of violations in traffic
761549-2 : Traffic Learning: Accept and Stage action is shown only in case entity is not in staging
Component: Application Security Manager
Symptoms:
Accept and Stage action is available, even for entities that are in staging already.
Conditions:
Create suggestion for the entity (e.g., Attack signature on parameter) that is in staging.
Impact:
Action that is not relevant is shown.
Workaround:
None.
Fix:
Accept and Stage action is available only for suggestions on entities that are not in staging
761385-1 : Without a virtual server, responses from server to client are dropped in a BIG-IP system when the latter is deployed in L2 transparent mode using virtual wire.
Component: Local Traffic Manager
Symptoms:
Responses from a server are not received by the client.
Conditions:
-- BIG-IP system deployed in L2 transparent mode using virtual wire.
-- No virtual server is configured.
Impact:
Responses from server to client are dropped. Loss of service.
Workaround:
None.
Fix:
Set the L2 transparent flag for the server-side flow if the client-side flow has this flag set.
761381-1 : Incorrect MAC Address observed in L2 asymmetric virtual wire
Component: Local Traffic Manager
Symptoms:
Incorrect MAC Address observed in L2 asymmetric virtual wire for ICMP unreachable on UDP traffic.
Conditions:
L2 asymmetric virtual wire is configured.
Impact:
Incorrect MAC Address in teh packet when the BIG-IP system sends ICMP unreachable on UDP traffic
Workaround:
None.
Fix:
The correct MAC address is seen in the packet that is flowing from the BIG-IP system.
761345-3 : Additional config-sync may be required after blob compilation on a HA setup in manual config-sync mode
Component: Advanced Firewall Manager
Symptoms:
When manual config-sync mode is enabled for a HA setup, additional config-sync may be required after firewall blob compilation.
Conditions:
Firewall rule configuration modified on a high availability (HA) setup with manual config-sync mode enabled.
Impact:
Additional config-sync may be required after compilation completion.
A warning may be given: "There is a possible change conflict between <device1> and <device2>.", and full sync may be forced.
Workaround:
Enable auto config-sync instead of manual config-sync.
Fix:
Additional config-sync is not required in these conditions.
761234-2 : Changing a virtual server to use an address list should be prevented if the virtual server has a security policy with a logging profile attached
Component: Advanced Firewall Manager
Symptoms:
If you create a virtual server with a single address ('Host' in the GUI) for both its source and destination, then configure the virtual server's security policy with a logging profile, and then (after creating the virtual server) modify the source or destination to use a traffic matching condition, the system reports no error when updating the configuration.
Conditions:
Attempting to use a virtual server with a security policy attached that uses a logging profile with an address list as the virtual server's source or destination.
Impact:
An invalid configuration is not caught. When later loading the configuration, the system reports a validation error, and the configuration does not load.
Workaround:
None.
Fix:
An error is now generated under these conditions.
761231-2 : Bot Defense Search Engines getting blocked after configuring DNS correctly
Solution Article: K79240502
Component: Application Security Manager
Symptoms:
Bot Defense performs a reverse DNS for requests with User-Agents of known Search Engines.
A cache is stored for legal / illegal requests to prevent querying the DNS again.
This cache never expires, so in case of an initial misconfiguration, after fixing the DNS configuration, or routing or networking issue, the Search Engines may still be blocked until TMM is restarted.
Conditions:
-- Initial misconfiguration of DNS or routing or networking issue.
-- Cache stores requests to prevent future queries to DNS.
-- Correct the misconfiguration.
Impact:
Cache does not expire and is never updated, so it retains the misconfigured requests. As a result, valid Search Engines are getting blocked by Bot Defense.
Workaround:
Restart TMM by running the following command:
bigstart restart tmm
Fix:
The internal DNS cache within Bot Defense and DoSL7 now expires after five minutes.
761199-1 : Wr_urldbd might crash while system is in a restarting loop.
Component: Traffic Classification Engine
Symptoms:
Webroot daemon (wr_urldbd) crashes if it gets back to back SIGTERM signals. Subsequent SIGTERM is handled by default signal handler instead of registered one.
As a result wr_urldbd's threads are not prevented from starting if wr_urldbd is in the process of shutting down.
Conditions:
-- System configuration is changing
-- wr_urldbd is restarting continuously at the same time
Impact:
Wr_urldbd crashes during restart and generates core file.
Workaround:
None.
Fix:
Wr_urldbd handles all signals with registered handler and does not crash.
761194-2 : param data type violation on an Integer parameter, if an integer value is sent via websocket JSON
Component: Application Security Manager
Symptoms:
A false positive occurs with 'Illegal parameter data type' violation on an integer parameter, on websocket messages
Conditions:
An explicit parameter with type integer is configured.
Impact:
A false positive can occur, 'Illegal parameter data type' is reported.
Workaround:
N/A
Fix:
Fixed a false positive with integer values
761185-2 : Specifically crafted requests may lead the BIG-IP system to pass malformed HTTP traffic
Solution Article: K50375550
Component: Local Traffic Manager
Symptoms:
For more information please see: https://support.f5.com/csp/article/K50375550
Conditions:
For more information please see: https://support.f5.com/csp/article/K50375550
Impact:
For more information please see: https://support.f5.com/csp/article/K50375550
Workaround:
For more information please see: https://support.f5.com/csp/article/K50375550
Fix:
For more information please see: https://support.f5.com/csp/article/K50375550
761173-1 : tmm crash after extended whitelist modification
Component: Advanced Firewall Manager
Symptoms:
tmm might crash and restart.
Conditions:
Modifying the whitelist extended entry in tmsh.
Impact:
Tmm crashes. Traffic disrupted while tmm restarts.
Workaround:
None.
Fix:
The tmm process no longer crashes when modifying the whitelist extended entry in tmsh.
761160-2 : OpenSSL vulnerability: CVE-2019-1559
Component: TMOS
Symptoms:
If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway).
Conditions:
If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway).
Impact:
If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway).
Workaround:
None.
Fix:
Update OpenSSL to 1.0.2s.
761144-4 : Broadcast frames may be dropped
Solution Article: K95117754
761112-3 : TMM may consume excessive resources when processing FastL4 traffic
Solution Article: K76328112
761088-1 : Remove policy editing restriction in the GUI while auto-detect language is set
Component: Application Security Manager
Symptoms:
While policy language was set to auto-detect, the policy editing was not allowed.
Conditions:
Create a new policy and set the language to auto-detect.
Impact:
While policy language was set to auto-detect, the policy editing was not allowed.
Workaround:
The policy language must be set to something other than auto-detect to allow user to edit the policy from GUI. However, policy editing is possible using REST API.
Fix:
The GUI restriction was removed. User can modify the policy while the language is set to auto-detect.
761032-2 : TMSH displays TSIG keys
Solution Article: K36328238
Component: Global Traffic Manager (DNS)
Symptoms:
TSIG key is displayed when related configuration is listed in TMSH.
Conditions:
Authenticated administrative user.
Listing TSIG keys using TMSH.
Impact:
Displaying TSIG keys is a security exposure.
Workaround:
None.
Fix:
TMSH no longer displays TSIG keys when listing configuration.
761030-2 : tmsh show net route lookup is not showing for IPv4-mapped IPv6 address route
Component: Local Traffic Manager
Symptoms:
Route entries for IPv4-mapped IPv6 address (::ffff:<IPv4>) are not shown using the show net route lookup command.
Conditions:
-- Route entry is for IPv4-mapped IPv6 address, that is ::ffff:<IPv4>.
-- Dynamic Routing protocols such as OSPFv3 configured.
Impact:
Cannot see any dynamic routes added while IPv4-mapped IPv6 addresses are configured.
Workaround:
None.
Fix:
The query for IPv4-mapped IPv6 addresses now shows dynamic routes added while IPv4-mapped IPv6 is configured.
761014-2 : TMM may crash while processing local traffic
Solution Article: K11447758
760998-1 : F5.ip_forwarding iAPP fails to deploy
Component: TMOS
Symptoms:
F5.ip_forwarding iApp fails to deploy due to a syntax error in the tmsh command for syn-cookie-enable.
Conditions:
Deployment of the f5.ip_forwarding iApp fails unless you specify an existing FastL4 profile.
Impact:
Cannot deploy the f5.ip_forwarding iApp template.
Workaround:
To deploy the f5.ip_forwarding iApp, select 'Advanced' configuration mode and choose an existing FastL4 profile for the question 'What Fast L4 profile do you want to use?'
Fix:
The f5.ip_forwarding iApp template deploys the recommended FastL4 profile without error.
760930-2 : MRF SIP ALG with SNAT: Added additional details to log events
Component: Service Provider
Symptoms:
Subscriber name is not included in debug log events for temporary subscriber registration creation and deletion.
Conditions:
debug log events for temporary subscriber registration creation and deletion.
Impact:
No functional impact, but the associated MRF SIP ALG with SNAT issue might be difficult to debug.
Workaround:
None.
Fix:
Subscriber ID is now included in the log events.
760878-3 : Incorrect enforcement of explicit global parameters
Component: Application Security Manager
Symptoms:
A false positive or false negative enforcement of explicit global parameter.
Conditions:
-- A configuration with more than 255 security policies.
-- Policies configured with an explicit parameter that is unique (for example, 'static', a disabled signature, etc.).
-- Attempt to enforce that parameter.
Impact:
Wrong blocking/violations. The parameter is not found, and the wildcard * parameter is enforced instead.
Workaround:
Make the explicit parameters a wildcard parameter.
Fix:
Explicit parameters are enforced correctly on all parameters.
760771-1 : FastL4-steered traffic might cause SSL resume handshake delay
Component: Local Traffic Manager
Symptoms:
When a FastL4 virtual server steers traffic to another SSL-enabled virtual server, there can be a delay on SSL session resumption because SSL is unable to identify the connection flow.
Additionally, it has been observed that if fallback persistence is configured, the BIG-IP system might fail to start the connection serverside.
Conditions:
-- FastL4 virtual server.
-- iRule is used to steer traffic to another virtual server with client SSL enabled.
-- Multiple tmm's.
Impact:
-- Potential impact to SSL performance.
-- Possible connection failure.
Workaround:
To workaround this issue:
-- Disable FastL4.
-- Enable OneConnect.
Fix:
FastL4-steered traffic no longer causes SSL resume handshake delay.
760723-2 : Qemu Vulnerability
Solution Article: K64765350
760683-1 : RST from non-floating self-ip may use floating self-ip source mac-address
Component: Local Traffic Manager
Symptoms:
A RST from non-floating self-ip may use floating self-ip source mac-address when AFM or ASM is enabled.
Conditions:
-- AFM or ASM is enabled.
-- RST generated from non-floating self-ip address.
Impact:
An L2 switch may update the fwd table incorrectly.
Workaround:
None.
Fix:
The system now uses the correct source mac-address under these conditions.
760680-1 : TMSH may utilize 100% CPU (single core's worth) when set to be a process group leader and SSH session is closed.
Component: TMOS
Symptoms:
TMSH does not correctly handle absence of input stream after closing an interactive SSH session and remains active in an infinite loop using 100% CPU.
Conditions:
If TMSH is a process group leader, it is not killed when the parent shell is terminated upon SSH session close.
This is a rare case, as TMSH must be deliberately promoted to a process group leader, e.g., with the 'setsid' command.
Usually the shell process is a group leader and, when it is terminated upon SSH session close, it kills its child processes, including TMSH.
Impact:
The equivalent of one CPU core is utilized to 100% by the TMSH process. It may be mostly scheduled on one core or spread over multiple control plane cores.
Workaround:
TMSH should not be intentionally promoted to a process group leader.
You can kill all TMSH processes using the command:
killall -9 tmsh
Warning: This command kills both abandoned and in-use TMSH processes. The latter can include other users' TMSH shells, and even system-level processes invoking the TMSH utility internally. Killing all TMSH processes can lead to various unexpected failures. You can use the 'top' command to see which TMSH process is using high CPU (e.g., 90% or more), and kill just those, as those are the likely zombie processes. pstree may also show the problem TMSH processes with no sshd ancestor.
You can kill specific TMSH processes using the command:
kill -9 <pid>
Where <pid> is the process ID of the TMSH instance to kill.
Possible mitigation
===================
Set a CLI idle timeout to a value lower than the sshd idle timeout (which is not set by default):
tmsh modify cli global-settings idle-timeout <timeout in minutes>
Fix:
I/O error handling in TMSH has been corrected, so it no longer ignores absence of input stream, which led to infinite loop.
760622-3 : Allow Device Certificate renewal from BIG-IP Configuration Utility
Component: TMOS
Symptoms:
Unable to renew Device Certificate from System :: Certificate Management : Device Certificate Management : Device Certificate :: server.crt in non-English BIG-IP configurations.
Conditions:
Attempting to renew a device certificate on the System :: Certificate Management : Device Certificate Management : Device Certificate :: using the server.crt-equivalent on a non-English BIG-IP system.
Impact:
Unable to renew Device Certificate from the BIG-IP Configuration Utility.
Workaround:
Use a command of the following syntax, replacing key name, cert name, and # of days with your values:
openssl req -new -x509 -key ../ssl.key/server.key -days <# of days> -out server.crt
For example, to renew the siteserver.key and siteserver.crt for 90 days, use the following command:
openssl req -new -x509 -key ../ssl.key/siteserver.key -days 90 -out siteserver.crt
Fix:
The system now allows Device Certificate renewal from BIG-IP Configuration Utility.
760597-1 : System integrity messages not logged
Component: TMOS
Symptoms:
On TPM-equipped platforms, log messages indicating recovery from a very rarely triggered condition, where the TPM chip needs to be cleared, are not being recorded in the logs on boot.
Conditions:
-- TPM-equipped platforms.
-- Rarely triggered condition in which the TPM chip needs to be cleared.
Impact:
No message indicating the need to clear the TPM.
Note: The need to clear the TPM does not affect the subsequent operation of system integrity checks.
Workaround:
None. The TPM is automatically cleared on boot. Once cleared, it operates normally.
Using remote attestation by submitting a QKview file to iHealth and checking the System Integrity status in the resulting report will reliably indicate any tampering in the BIOS or system startup files.
Fix:
TPM needing to be cleared message is now logged.
760594 : On BIG-IP VE, 'snmpwalk -v 2c -c public localhost .1.3.6.1.4.1.3375.2.1.7.3' returns only /appdata details.
Component: TMOS
Symptoms:
Executing 'snmpwalk -v 2c -c public localhost .1.3.6.1.4.1.3375.2.1.7.3' returns only /appdata details.
Conditions:
BIG-IP Virtual Edition
Impact:
The snmpwalk command shows the details of all partitions on previous versions. It now shows only the '/appdata' details.
Workaround:
No workaround exists for this issue currently.
760574 : Updating BIG-IP 14.1.x Linux kernel to RHEL7.5
Component: TMOS
Symptoms:
The kernel for the BIG-IP 14.1.x Linux kernel needs updating to RHEL7.5.
Conditions:
Using the most current version of the BIG-IP software.
Impact:
The Linux kernel update is a typical function of ongoing BIG-IP software development.
Workaround:
None.
Fix:
Below are the advantages of kernel update:
-- Ease of maintenance.
-- Security fixes part of RHEL 7.5.
-- New / Enhanced feature support.
760573-1 : TPM system integrity check may return invalid status when booting into BIG-IP 14.1.0★
Solution Article: K00730586
Component: TMOS
Symptoms:
The Trusted Platform Module (TPM) system integrity check may return an invalid status.
As a result of this issue, you may encounter one or more of the following symptoms:
-- While the system boots to BIG-IP 14.1.0, you observe an error message that appears similar to the following example:
tpm-status-check[5025]: System Integrity Status: Invalid
-- After rebooting the system to different volumes, you continue to observe the previous error message.
Conditions:
This issue occurs when the following condition is met:
You reboot a system running either BIG-IP 13.1.x or 14.0.0 (including their point releases) to BIG-IP 14.1.0.
Impact:
The BIG-IP system reports an invalid TPM status and TPM is non-functional.
Workaround:
To recover from this issue, you must delete the grub configuration file and reboot the system twice for an automatic repair to occur. To do so, perform the following procedure:
Impact of workaround: The system will not be available while performing multiple reboots. F5 recommends that you perform this procedure during an appropriate maintenance window.
1. Log in to the command line of the affected system.
2. Mount the boot partition by typing the following command:
mkdir -p /mnt/boot; mount /dev/mapper/$(ls /dev/mapper | grep boot) /mnt/boot
3. Delete the grub.multiboot.cfg file by typing the following command:
rm -f /mnt/boot/grub2/grub.multiboot.cfg
4. Reboot the system by typing the following command:
reboot
Note: The system software fixes the grub.multiboot.cfg file automatically upon booting.
5. When the system has completed booting, log in to the command line and reboot the system again by typing the following command:
reboot
This final step properly boots the system with TPM enabled.
Fix:
Rebooting a system no longer returns the TPM error.
760550-5 : Retransmitted TCP packet has FIN bit set
Component: Local Traffic Manager
Symptoms:
After TCP sends a packet with FIN, retransmitted data earlier in the sequence space might also have the FIN bit set.
Conditions:
-- Nagle is enabled.
-- TCP has already sent a FIN.
-- A packet is retransmitted with less than MSS bytes in the send queue.
Impact:
The retransmitted packet has the FIN bit set even if it does not contain the end of the data stream. This might cause the connection to stall near the end.
Workaround:
Set Nagle to disabled in the TCP profile.
Fix:
The incorrect FIN bit is removed.
760508-1 : On systems with multiple versions of BIG-IP in use, the 'invalid' System Integrity Status may persist★
Solution Article: K91444000
Component: TMOS
Symptoms:
The system security state reported by the shell utility 'tpm-state' may report 'Invalid'.
Conditions:
-- The system contains a volume running BIG-IP software version that does not support Trusted Platform Module (TPM).
-- You install a version that does support TPM.
-- The system is rebooted, from the old (non-TPM-capable) BIG-IP version to the new, TPM-capable version.
Impact:
The BIG-IP system reports an invalid TPM status upon the first boot of the upgraded BIG-IP 14.1.0 slot.
Workaround:
Rebooting the system again into 14.1.0 after initially booting into 14.1.0 resolves the issue.
760475-1 : Apache spawns more processes than the configured limit, causing system low memory condition
Component: TMOS
Symptoms:
Apache (httpd) process count MaxClients on BIG-IP systems is set to '10' in the configuration. When more requests are received, Apache spawns more processes than 10, consuming more memory.
Conditions:
Numerous clients trying to connect simultaneously to the BIG-IP GUI.
Impact:
System low memory condition can severely impact application/system performance, and sometimes triggers Out-Of-Memory (OOM) Killer, so critical applications might be terminated.
Workaround:
Complete the following procedure:
1. Modify /etc/httpd/conf/httpd.conf to have the following configuration outside of the prefork module (global):
MaxClients 10
2. Run the following command:
bigstart restart httpd
760471-3 : GTM iQuery connections may be reset during SSL key renegotiation.
Component: Global Traffic Manager (DNS)
Symptoms:
During routine iQuery SSL renegotiation, the iQuery connection will occasionally be reset.
Conditions:
This occurs occasionally during routine renegotiation.
Impact:
The affected iQuery connection is briefly marked down as the connection is marked down before the connection is immediately re-established.
Workaround:
There is no workaround.
Fix:
GTM iQuery renegotiations no longer cause the error that reset the connection.
760462-1 : Live update notification is shown only for provisioned/licensed modules
Component: Application Security Manager
Symptoms:
Live update notification in the left top corner of the screen was shown even when you cannot install updates, e.g., no permissions or no license/provisioning.
Conditions:
-- There is update for non-provisioned/licensed module.
-- Attempt to install the update.
Impact:
A notification appears and it cannot be removed.
Workaround:
None.
Fix:
Live update notification is now shown only for provisioned/licensed modules.
760439-4 : After installing a UCS that was taken in forced-offline state, the unit may release forced-offline status
Component: TMOS
Symptoms:
After installing a UCS that was taken in forced-offline state, the unit may release forced-offline status (e.g., transitions to standby or active).
Conditions:
Installing UCS that was taken in forced-offline state on clean installed unit.
Impact:
Unit may become active/standby before intended (e.g., during maintenance).
Workaround:
After installing the UCS, ensure that the unit is in forced-offline state as intended. If not in forced-offline state, force the unit offline before proceeding.
760438-3 : PEM iRule to set policy in rigorous loop may crash tmm due to rare timing conditions
Component: Policy Enforcement Manager
Symptoms:
tmm coredump
Conditions:
-- Using an iRule to apply a referential policy in a rigorous loop.
-- This is a rarely occurring timing issue.
Impact:
Traffic impact due to tmm coredump. Traffic disrupted while tmm restarts.
Workaround:
None.
Fix:
The BIG-IP system now validates session presence before applying the policy.
760410-1 : Connection reset is seen when Category lookup agent is used in per-req policy
Component: Access Policy Manager
Symptoms:
The BIG-IP system sends reset to client when Category Lookup agent is used in per-req policy.
Conditions:
-- APM or SSLO is licensed and provisioned.
-- URLDB and SWG are not provisioned.
-- Category Lookup agent is used in the policy to process custom categories.
Impact:
Connection reset is seen on client from APM/SSLO box.
Workaround:
Modify Category Lookup agent 'lookup-type' property to 'custom-only' via TMSH, for example, by using a command similar to the following:
modify apm policy agent category-lookup example_prp_act_category_lookup_ag lookup-type custom-only
Fix:
Category lookup agent in per-req policy now successfully processes custom categories, so the reset no longer occurs.
760408-3 : System Integrity Status: Invalid after BIOS update★
Solution Article: K23438711
Component: TMOS
Symptoms:
When BIG-IP system boots, it performs a System Integrity Check. The System Integrity Status may return one of three states: Valid, Unavailable, or Invalid.
This issue causes the System Integrity Status to return a value of 'Invalid'.
Conditions:
-- BIG-IP systems that have been manufactured using a earlier BIOS version.
-- Updating to a newer BIOS version.
Impact:
The System Integrity Status returns a status of Invalid, which may falsely indicate that the system BIOS or OS has been compromised.
Workaround:
Install the new BIOS, which fixes the issue that causes the 'Invalid' status to be reported, and, on systems where the BIOS and OS have not been compromised, returns a status of 'Valid'.
Fix:
The System Integrity Status check now return 'Valid' for systems that have not been compromised.
760393 : GARP is not sent from newly active device after failover for FW NAT policy rule's dest prefixes
Component: Advanced Firewall Manager
Symptoms:
After failover, there is no GARP from the newly active device for FW NAT policy rule's dest prefixes.
Conditions:
Configure FW NAT policy rules with proxy arp enabled for destination prefixes. After failover no GARP is sent for those destinations prefixes.
Impact:
After failover traffic can fail/degrade.
Workaround:
No workaround other than forcing the initial active HA device to be active again.
Fix:
The system now sets the high availability (HA) unit correctly for FW NAT policy.
760370-2 : MRF SIP ALG with SNAT: Next active ingress queue filling
Component: Service Provider
Symptoms:
When running MRF SIP ALG with SNAT, the ingress queue may fill, causing messages to be dropped on the next-active device.
Conditions:
-- The active device determines that an operation can be skipped because the details are already discovered processing a previous message.
-- The next-active device has not yet processed the previous message and is not able to skip the operation.
Impact:
Mirroring state is lost for the connection.
Workaround:
None.
Fix:
When the connection is mirrored, the processing operation is not skipped on either the active or next-active device.
760363-1 : Update Alias Address field with default placeholder text
Component: TMOS
Symptoms:
Unable to update Alias Address field with the default value under Local Traffic :: Monitors :: [MonitorName] after removing everything from the input field and updating again with the placeholder text.
Conditions:
-- Using a system running software in which the GUI supports Chinese characters.
-- Remove content from the Alias Address field under Local Traffic :: Monitors:: [MonitorName].
-- Enter the default placeholder text.
Impact:
Unable to update the Alias Address input field with default placeholder text after replacing the said field with blank text or a valid value.
Workaround:
Pass empty value or ::
Fix:
Allow monitors to update with default placeholder text for Alias Address
760356-2 : Users with Application Security Administrator role cannot delete Scheduled Reports
Component: Application Visibility and Reporting
Symptoms:
User accounts configured with the Application Security Administrator role cannot delete scheduled reports, while they can create/view/edit them.
Conditions:
-- Logged on with a user account configured as an Application Security Administrator.
-- Attempting to delete a scheduled report.
Impact:
Cannot complete the delete operation. Deleting scheduled reports requires root/admin intervention.
Workaround:
Use root or a user account configured as Administrator to delete scheduled reports.
Fix:
User accounts configured with the Application Security Administrator role can now delete Scheduled Reports
760355 : Firewall rule to block ICMP/DHCP from 'required' to 'default'★
Component: Advanced Firewall Manager
Symptoms:
If firewall is configured on the management port with an ICMP rule, after upgrading to v14.1.x or later, the ICMP rule does not work.
Conditions:
-- Firewall is configured on the management port.
-- Firewall is configured with an ICMP rule to block.
Impact:
ICMP packets cannot be blocked with a firewall rule to drop on management port. ICMP packets are allowed from the management port.
Workaround:
Run the following commands after upgrading to v14.1.x or later from earlier versions.
# /sbin/iptables -N id760355
# /sbin/iptables -I INPUT 1 -j id760355
# /sbin/iptables -A id760355 -i mgmt -p icmp --icmp-type 8 -s 172.28.4.32 -j DROP
Fix:
ICMP firewall rule has been moved from the f5-required to f5-default.
760259-3 : Qkview silently fails to capture qkviews from other blades
Component: TMOS
Symptoms:
When capturing a qkview on a chassis, there are no warnings provided if the qkview utility is run to gather a qkview from other blades.
Conditions:
-- On a chassis system, rename/move the qkview binary from a given blade.
-- Execute qkview on another blade, verify that no warnings or errors are produced.
Impact:
There is no warning that the qkview failed for a given blade.
Workaround:
There is no workaround other than running the qkview on the actual blade.
760250 : 'Unsupported SSO Method' error when requests sharing the same TCP session
Component: Access Policy Manager
Symptoms:
In API Protection configurations, 'Unsupported SSO Method' error occurs when requests sharing the same TCP session, and some branch selects Single-Sign On (SSO).
Conditions:
-- On the virtual server, the OneConnect profile is selected.
-- Requests sharing the same TCP session.
Impact:
Some requests are rejected.
Workaround:
Remove the OneConnect profile from the virtual server.
Fix:
Reset the SSO selection for each request, regardless of whether requests share the same TCP connection.
760234-1 : Configuring Advanced shell for Resource Administrator User has no effect
Component: TMOS
Symptoms:
Advanced shell is present in the Terminal Access dropdown list when creating a Resource Administrator User, but the functionality is not available.
Conditions:
Configuring Advanced shell for Resource Administrator User.
Impact:
There is no warning message, but the setting has no effect. Gives the false impression that you can configure a Resource Administrator User to have Advanced shell access when the role does not support it.
Workaround:
None.
Fix:
The Advanced shell option is no longer present in the Resource Administrator User Terminal Access dropdown list.
Behavior Change:
Resource Administrator User can no longer select Advanced shell. The option has been removed from the dropdown list in the GUI for the Resource Administrator User.
760222 : SCP fails unexpected when FIPS mode is enabled
Component: TMOS
Symptoms:
Secure Copy (scp) to some locations fails with the following message:
Path not allowed.
Conditions:
-- FIPS mode is enabled.
-- Copying a file to a restricted location using SCP.
Impact:
Cannot use SCP to copy to restricted locations on the BIG-IP system.
Workaround:
None.
Fix:
This scp issue no longer occurs when FIPS cards are installed.
760164-1 : BIG-IP VE Compression Offload HA action requires modification of db variable
Component: TMOS
Symptoms:
When TMM detects a compression offload device hang it does not invoke the configured high availability (HA) action.
Conditions:
This occurs when the following conditions exist:
-- BIG-IP Virtual Edition (VE) Cryptographic Offload is licensed.
-- BIG-IP VE VM has been assigned QuickAssist Virtual Functions (VFs).
-- A QuickAssist endpoint associated with one of the VFs hangs.
-- BIG-IP VE executes compression operations.
Impact:
The configured HA action does not occur when a compression offload device hangs. Clients compression requests eventually time out.
Workaround:
Disable the pfmand by running the following commands:
tmsh modify sys db pfmand.healthstatus value disable
tmsh save sys config
The configured HA action will now occur when a compression offload device hangs.
Note: The pfmand daemon is not needed for BIG-IP VE, so disabling the db variable has no impact for BIG-IP VE configurations.
760078-1 : Incorrect source MAC used when the BIG-IP in L2 transparent mode generates a TCP RST packet.
Component: Local Traffic Manager
Symptoms:
Packet with unexpected source MAC seen on the adjacent node to the BIG-IP.
Conditions:
- BIG-IP configured in an L2 transparent mode using virtual wires
- Traffic forwarded between client and server in an asymmetric manner across virtual wires.
Impact:
Possible impacts to services on nodes adjacent to the BIG-IP if policy decisions on those nodes are made with the source MAC of the received packet as input.
759968-3 : Distinct vCMP guests are able to cluster with each other.
Component: Local Traffic Manager
Symptoms:
-- Distinct vCMP guests are able to cluster with each other.
-- Guests end up having duplicate rebroad_mac on one or more slots. This can be checked using below command:
clsh tmctl -d blade tmm/vcmp -w 200 -s vcmp_name,tmid,rebroad_mac
Check the 'rebroad_mac' field for duplicate mac addresses.
vcmp_name tmid rebroad_mac
--------- ---- -----------------
default 0 02:01:23:45:01:00
vcmp1 0 00:00:00:00:00:00
vcmp5 0 02:01:23:45:01:04
vcmp6 0 00:00:00:00:00:00
vcmp7 0 02:01:23:45:01:06
vcmp8 0 00:00:00:00:00:00
vcmp9 0 02:01:23:45:01:08
vcmp10 0 02:01:23:45:01:0A <--------------
vcmp11 0 02:01:23:45:01:0A <--------------
Conditions:
-- It is not yet clear under what circumstances the issue occurs.
-- One of the ways this issue occurs is when guests are moved between blades and they end up having a non-null and duplicate 'rebroad_mac' on one or more slots.
Impact:
Only the vCMP guest acting as primary will be operative.
Workaround:
-- Disable clusterd from sending packets over tmm_bp by turning off the db variable clusterd.communicateovertmmbp:
modify sys db clusterd.communicateovertmmbp value false.
To disable the db variable on the affected guest use the following procedure:
1. stop sys service clusterd
2. modify sys db clusterd.communicateovertmmbp value false
3. start sys service clusterd
4. save sys conf
Afterwards, the affected guest may still have the wrong management IP address. To resolve that, log into the vCMP Hypervisor and force a management IP update such as changing the netmask.
Fix:
The vCMP guests no longer end up having a non-null and duplicate 'rebroad_mac' on one or more slots. Distinct vCMP guests are no longer able to cluster with each other.
759868-1 : TMM crash observed while rendering internal pages (like blocked page) for per-request policy
Component: Access Policy Manager
Symptoms:
TMM crashes.
Conditions:
-- SSLO/SWG configured.
-- Rendering internal pages (like a blocked page).
-- Per-request policy.
Impact:
Traffic disrupted while tmm restarts.
Workaround:
None.
Fix:
TMM no longer cores while rendering internal pages (like blocked page) for per-request policy.
759814-1 : Unable to view iApp component view★
Component: TMOS
Symptoms:
When accessing the iApp Components tab, the system presents an error similar to the following:
An error has occurred while trying to process your request.
Conditions:
-- Upgrade to v14.1.x.
-- Create a new iApp with an SSL, ASM, or Traffic policy profile.
-- Or, attempt to view an iApp containing ASM information
Impact:
Unable to access the iApp Component view. Cannot reconfigure the iApp directly (iApp : Application Services : application : any app).
Workaround:
To reconfigure the iApp, do the following:
1. Navigate to the following location in the GUI:
Local Traffic :: Virtual Server List.
2. Click the Application Link :: Reconfigure.
Note: Although this allows you to reconfigure an iApp, it does not provide access to the iApp application details Components page.
759735-2 : OSPF ASE route calculation for new external-LSA delayed
Component: TMOS
Symptoms:
External link-state advertisement (LSA) update does not trigger OSPF ASE route calculation, resulting in delay for route state changes from external LSA.
Conditions:
-- OSPF enabled.
-- More than 20 updated external LSA.
-- No updated router and network LSA.
Impact:
Delay of route update from external LSA.
Workaround:
Manually clear ip ospf process.
Fix:
OSPF ASE route calculation from external LSA are happening as normal.
759723-1 : Abnormally terminated connections on server side may cause client side streams to stall
Component: Local Traffic Manager
Symptoms:
The BIG-IP system provides HTTP/2 Gateway configuration when an HTTP/2 client is served by HTTP/1.x pool members. When a server-side connection terminates abnormally, TMM may crash.
Conditions:
-- A virtual server with HTTP/2 Gateway configuration is configured on the BIG-IP system.
-- Traffic on the server side has some abnormalities, resulting in aborted or unclosed connections.
Impact:
Traffic disrupted while tmm restarts.
Workaround:
None.
Fix:
Fixed a tmm crash when a virtual server is configured as a HTTP/2 gateway.
759721-2 : DNS GUI does not follow best practices
Solution Article: K03332436
Component: Global Traffic Manager (DNS)
Symptoms:
The DNS WebUI does not follow best security practices.
Conditions:
DNS services provisioned, enabled, and configured
Impact:
The DNS WebUI does not follow best security practices.
Workaround:
None.
Fix:
The DNS WebUI now follows best security practices.
759654-1 : LDAP remote authentication with remote roles and user-template failing
Component: TMOS
Symptoms:
The directory server that performs authentication requests refuses a query for authorization (user attributes), which prevents the BIG-IP user from logging on with remote authentication.
BAD_NAME errors are usually present in LDAP communication.
Conditions:
-- Configure LDAP remote authentication with remote roles and a user template.
-- As a remote user, attempt to logon.
Impact:
The query request sent to the directory server is refused because the password is not included in the request, and the server does not accept an anonymous bind request. The refused request prevents a lookup of the user account attributes on the directory server. As a result, the BIG-IP user cannot logon.
Workaround:
Remove user-template. bind-dn must be used to authenticate against LDAP server.
759579-1 : Full Webtop: 'URL Entry' field is available again
Component: Access Policy Manager
Symptoms:
'URL Entry' field is no longer visible from full webtop.
Conditions:
Using Portal Access full webtop screen.
Impact:
It is not possible to open Portal Access session with arbitrary URL from full webtop screen.
Workaround:
None.
Fix:
Now 'URL Entry' field can be enabled and used on full webtop.
759536-2 : Linux kernel vulnerability: CVE-2019-8912
Solution Article: K31739796
759499-2 : Upgrade from version 12.1.3.7 to version 14.1.0 failing with error★
Component: TMOS
Symptoms:
Upgrade from version 12.1.3.7 to version 14.1.0 fails. Running 'tmsh show sys software' shows the following message:
failed (Could not access configuration source; sda,n)
Conditions:
1. Install BIG-IP version 12.1.3.7 in new volume.
2. From 12.1.3.7, try to install 14.1.0 in new volume.
Impact:
Upgrade fails.
Workaround:
To work around this issue, delete the 14.1.0 volume and try the installation again.
The second installation of 14.1.0 succeeds in this scenario.
759483-1 : Message about HTTP status code which are set by default disappeared from the UI
Component: Application Security Manager
Symptoms:
When creating a new policy using the policy-creation page, there are status codes (200-399) that are enabled by default. There is no message about HTTP status codes that are set by default does not appear in the GUI.
Conditions:
Open Create a New Policy page.
Impact:
The message is not shown on Create Policy page
Workaround:
None.
Fix:
The message was added and shown always next to Allowed Response Status Codes input.
759462-1 : Site names and vulnerabilities cannot be retrieved from WhiteHat server
Component: Application Security Manager
Symptoms:
Site names and/or vulnerabilities cannot be retrieved from WhiteHat's server, and you get this error:
Failed to get site names
500 Can't connect to 63.128.163.17:443
Additionally, if configured, the HTTP/HTTPS proxy is not used.
Conditions:
You attempt to retrieve site names and/or vulnerabilities from WhiteHat's server.
Impact:
The site names and/or vulnerabilities cannot be retrieved.
Workaround:
You can manually enter site name in the field 'WhiteHat Site Name' on the Security :: Application Security :: Vulnerability Assessments :: Settings page, and vulnerabilities can be downloaded from the WhiteHat server and uploaded to ASM.
Fix:
Site names and vulnerabilities can now be retrieved directly from WhiteHat's server.
759360-2 : Apply Policy fails due to policy corruption from previously enforced signature
Component: Application Security Manager
Symptoms:
Apply Policy fails due to policy corruption in PLC database from a previously enforced signature.
Conditions:
1. Export a policy containing a signature with an enforced rule.
2. Update ASM Signatures (ASU).
3. Import that previously exported policy.
4. Apply the newly imported policy.
Impact:
Apply policy fails.
Workaround:
As a workaround, run the following SQL, and then apply the policy:
----------------------------------------------------------------------
UPDATE PLC.PL_POLICY_NEGSIG_SIGNATURES SET previous_enforced_rule_md5 = '' WHERE previous_enforced_rule = '' and previous_enforced_rule_md5 != ''
----------------------------------------------------------------------
759343-6 : MacOS Edge Client installer does not follow best security practices
Solution Article: K49827114
759192-3 : TMM core during display of PEM session under some specific conditions
Component: Policy Enforcement Manager
Symptoms:
TMM crashes during display of PEM session if the session has multiple IP addresses added under certain conditions.
Conditions:
-- Session has multiple IP addresses added.
-- When the session was created, addition of multiple IP addresses was not allowed.
Impact:
TMM restart. Traffic disrupted while tmm restarts.
Workaround:
Do not change the value of sys db variable tmm.pem.session.ip.addr.max while some sessions are already created.
Fix:
TMM core during display of PEM session no longer occurs.
759172-1 : Read Access Denied: user (gu, guest) type (Certificate Order Manager)
Component: TMOS
Symptoms:
GUI guest user is supposed to see Key properties (which includes cert order manager association details) and Certificate Order Manager object itself, but reports an error:
-- General database error retrieving information.
-- err mcpd[6586]: 01070823:3: Read Access Denied: user (gu) type (Certificate Order Manager)
Conditions:
-- BIG-IP Virtual Edition (VE).
-- Guest user attempts to view Key properties (including cert order manager association details) and Certificate Order Manager object information.
Impact:
Certificate Manager role does not allow users to create certificates. They can upload and delete certificates, but when trying to create one, the GUI stays blank and the logs show a Read Access Denied error.
Workaround:
None.
759135-2 : AVR report limits are locked at 1000 transactions
Component: Application Visibility and Reporting
Symptoms:
AVR reports are limited to 1000 transactions. This is due to a hard-coded limit.
Conditions:
Using AVR reports for more than 1000 transactions.
Impact:
Unable to create reports with more than 1000 rows.
Workaround:
None.
Fix:
A db variable avr.stats.reportrownumberlimit has been added, that can be controlled via TMSH. The variable controls the number of rows in report within the range of 1 to 100000.
For example, for a report with 10000 rows, modify the 'avr.stats.reportrownumberlimit' variable using the following command:
tmsh modify sys db avr.stats.reportrownumberlimit value 10000
Behavior Change:
There is a new db variable avr.stats.reportrownumberlimit available in TMSH, which controls the number of rows in an AVR report. Valid values are from 1 to 100000.
For example, to create a report with 10000 rows, modify the 'avr.stats.reportrownumberlimit' variable using the following command:
tmsh modify sys db avr.stats.reportrownumberlimit value 10000
759077-2 : MRF SIP filter queue sizes not configurable
Component: Service Provider
Symptoms:
The ingress and egress queues of the MRF SIP filter have fixed sizes that cannot be configured.
Conditions:
If the hard-coded queue size of 512 messages or 65535 bytes are exceeded, the filter enables its flow control logic.
Impact:
Messages may be dropped.
Workaround:
None.
Fix:
The max-pending-messages and max-pending-bytes values in the SIP router profile will be used as the limits for the SIP filter's queues. If the configured value is less than the existing hard-coded limits (512 bytes or 65535 bytes), the hard-coded limits will be used.
758992-2 : The BIG-IP may use the traffic-group MAC address rather than a per-VLAN MAC address
Component: Local Traffic Manager
Symptoms:
tmm may use a combination of the traffic-group MAC address and the per-VLAN MAC address for traffic associated with the traffic-group.
Conditions:
All of the following:
-- The traffic-group has a MAC address set.
-- The sys db variable 'tm.macmasqaddr_per_vlan' is set to true.
-- There are multiple tmm processes running on the BIG-IP system.
Note: BIG-IP Virtual Edition is not affected since there is only one tmm process.
Impact:
Incorrect MAC address used for traffic associated with the traffic-group.
Workaround:
None.
Fix:
tmm uses the proper MAC address when there is a traffic-group mac address defined and 'tm.macmasqaddr_per_vlan' is set to true.
758909-1 : TMM may crash will processing PEM traffic
Solution Article: K04730051
758879 : BIG-IP VE with ixlv devices does not reliably pass some traffic after hard-boot
Component: TMOS
Symptoms:
BIG-IP Virtual Edition (VE) with ixlv devices (Intel X710/XL710/XXV710 family) might not reliably pass traffic after a hard boot of the host on which it runs.
The tmm log contains messages similar to the following:
ixlv[0:8.0]: Error: AQ returned error -1 to request 10!
ixlv[0:8.0]: Error: Error -1 waiting for PF to complete operation 4
ixlv[0:8.0]: Error: WARNING: Error adding VF mac filter!
ixlv[0:8.0]: Error: WARNING: Device may not receive traffic!
The host's kernel log might contain messages similar to the following:
i40e 0000:06:00.0: VF is not trusted, switch the VF to trusted to add more functionality
Conditions:
-- BIG-IP VE with one or more virtual functions that utilize the ixlv driver within tmm.
-- Hard reboot the host and observe traffic.
Note: This issue might be dependent upon the version of the PF driver in the host, and has been observed with at least 2.1.4 and 2.4.10, but this list is incomplete.
Impact:
IPv6 and other network traffic may be handled unreliably.
Workaround:
Reboot the guest. This problem has been observed only on the very first boot after a hard boot of the host.
758872-3 : TMM memory leak
Component: Local Traffic Manager
Symptoms:
When a Clustered Multiprocessing (CMP) disabled virtual server enters syncookie mode the flows created on TMM instances other than tmm0 are not removed, resulting in a TMM memory leak.
Note: CMP-disabled virtual servers are not distributed among the available TMM processes, but instead are processed on tmm0.
Conditions:
-- Virtual server is CMP disabled.
-- The same virtual server enters syncookie mode.
Impact:
Elevated memory utilization that may impact performance. In extreme cases, it might lead to out-of-memory crash.
Workaround:
Make sure the virtual server is not CMP disabled, for example, avoid using global variables in iRules.
Fix:
Flows of CMP-disabled virtual servers are now properly removed from all TMM instances.
758781-3 : iControl SOAP get_certificate_list commands take a long time to complete when there are a large number of certificates
Component: TMOS
Symptoms:
The following commands take a long time to complete when there are a large number of certificates:
get_certificate_list()
get_certificate_list_v2()
get_certificate_list_v3()
Conditions:
-- Using the get_certificate_list(), get_certificate_list_v2(), and get_certificate_list_v3() commands to get certificate information.
-- A large number of certificates (typically in the thousands) are installed on the BIG-IP system.
Impact:
Slowness might cause timeouts in applications that are calling these functions.
Workaround:
Use iControl REST API corresponding to sys/file/ssl-cert.
758764-2 : APMD Core when CRLDP Auth fails to download revoked certificate
Component: Access Policy Manager
Symptoms:
Download CRLDP Auth fails to download revoked certificates, so the list of revoked certificate remains empty (NULL). APMD cores while accessing this empty (NULL) list.
Conditions:
Empty revoked-certificate list handling.
Impact:
APMD core. No access policy enforcement for user session or any MPI-reliant processes, such as rewrite and websso while apmd restarts.
Workaround:
None.
Fix:
The system now checks for empty revoked certificate lists (for NULL) and lets the validation OK (because there is nothing to validate against).
758714-1 : Virtual wire on a BIG-IP does not pass traffic when configured over two terminating link aggregation/trunk ports.
Component: Local Traffic Manager
Symptoms:
Traffic does not pass through the BIG-IP system.
Conditions:
- Configure two trunk/LAG ports on a BIG-IP system.
- Create a virtual wire across it.
Impact:
Loss of service across the virtual wire.
Workaround:
None.
Fix:
Corrected the faulty validation checks during configuration that were a result of collateral damage.
758701-1 : APM fails to handle Remote Desktop Gateway connections from standalone RDP clients after fresh install
Component: Access Policy Manager
Symptoms:
Remote Desktop (RD) Gateway connections from standalone RDP clients on Mac/iOS/Android fail against a fresh APM installation.
Following error is logged into /var/log/ltm:
... 01220001:3: TCL error: /Common/_sys_APM_Citrix_SmartAccess <HTTP_REQUEST> - ERR_NOT_SUPPORTED (line 1) invoked from within "HTTP::path"
Conditions:
- Fresh APM installation.
- Standalone Mac/iOS/Android RDP client uses APM as RD Gateway.
Impact:
Connection can't be established.
Workaround:
Disable "tmm.http.tcl.validation" variable:
# tmsh modify sys db tmm.http.tcl.validation value disable
Fix:
Remote Desktop (RD) Gateway connections from standalone RDP clients on Mac/iOS/Android are not failing anymore against fresh APM installation.
758667-1 : BIG-IP VE high availability (HA) actions are not invoked when offload hardware hangs
Component: TMOS
Symptoms:
When TMM detects a crypto or compression offload device hang it does not invoke the configured high availability (HA) action.
Conditions:
This occurs when the following conditions exist:
-- BIG-IP Virtual Edition (VE) Cryptographic Offload is licensed.
-- BIG-IP VE VM has been assigned QuickAssist Virtual Functions (VFs).
-- A QuickAssist endpoint associated with one of the VFs hangs.
-- BIG-IP VE executes crypto or compression operations.
Impact:
Client requests eventually time out.
Workaround:
None.
758655-1 : TMC does not allow inline addresses with non-zero Route-domain.
Component: Local Traffic Manager
Symptoms:
When trying to create a traffic-matching-criteria with inline addresses with non-zero Route-domain, receive an error:
TMC(/Common/tmc333) and addresses within the address list have different route domain.
Conditions:
Attempting to creating a traffic-matching-criteria with inline address (source or destination) and non-zero route-domain, e.g.:
create ltm traffic-matching-criteria tmc333 destination-address-inline 111.111.111.194 source-address-inline 0.0.0.0 route-domain 100
Impact:
Cannot create the traffic-matching-criteria.
Workaround:
None.
Fix:
You can now create a traffic-matching-criteria with inline addresses with non-zero Route-domain.
758631-4 : ec_point_formats extension might be included in the server hello even if not specified in the client hello
Component: Local Traffic Manager
Symptoms:
RFC 5246 states that if an extension does not exist in the client hello, it must not exist in the server hello. When an EC cipher suite is selected, the server might send the ec_point_formats extension, even if none exists in the client hello.
Conditions:
-- An EC cipher suite is selected.
-- The client does not send an ec_point_formats extension.
Impact:
Some clients abort the connection in this case.
Workaround:
There is no workaround other than not configuring any EC cipher suites.
Fix:
With this change, the server does not send an unsolicited ec_point_formats extension.
758536 : Traffic Intelligence IM pkg for 14.1.0 fails to install on base build version 14.1.0.x
Component: Traffic Classification Engine
Symptoms:
Traffic Intelligence IM pkg for v14.1.0 fails to install on base build version v14.1.0.1 through v14.1.0.4. This is due to strict version check in upgrade scripts.
Conditions:
When hitless upgrade for traffic intelligence with version 14.1.0 is used on base build v14.1.0.1 through v14.1.0.4.
Impact:
The process fails to load/install. The system does not receive the latest traffic intelligence signatures.
Workaround:
There is no workaround other than requesting a purpose-built traffic intelligence IM for that particular build.
Fix:
You can now install 14.1.0 IM on any other 14.1.0.x with minor version update.
758527-2 : BIG-IP system forwards BPDUs with 802.1Q header when in STP pass-through mode
Solution Article: K39604784
Component: TMOS
Symptoms:
Under certain conditions BIG-IP may forward VLAN-tagged frames even if the VLAN is not defined on the ingress interface.
Conditions:
Tagged VLANs in use.
STP pass-through mode enabled.
Impact:
Frames not delivered as expected.
Workaround:
Disable global STP.
Fix:
Frames now delivered as expected.
758465-1 : TMM may crash or iRule processing might be incorrect
Component: Local Traffic Manager
Symptoms:
After modifying an iRule:
- The iRules on one or more virtual servers might fire in the wrong order.
- The iRules on one or more virtual servers might not fire at all.
- TMM might crash if the iRule event is modified again.
- TMM might crash if a virtual server is modified.
Conditions:
This occurs when all of the following conditions are met:
- An iRule is in use on more than one virtual server.
- The iRule occupies a different position in the iRule list on various virtual servers, and one or more of the other iRules define the same event.
- The iRule event is modified.
Impact:
Traffic interruption while TMM restarts.
Incorrect iRule processing.
Workaround:
None.
758459-1 : Cross origin AJAX requests are blocked Cross-Origin Resource Sharing (CORS) protection
Component: Application Security Manager
Symptoms:
When enabling Single Page Application (SPA) option in ASM, cross origin AJAX requests are resulting in the following error in the browser console, and site application might not work:
Access to XMLHttpRequest at 'https://x.com' from origin 'https://www.y.com' has been blocked by CORS policy: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'. The credentials mode of requests initiated by the XMLHttpRequest is controlled by the withCredentials attribute.
Conditions:
-- ASM with SPA enabled
-- App is sending cross-origin requests
Impact:
App does not work as expected.
Workaround:
Using an iRule, add the following headers to the response:
-- Access-Control-Allow-Origin with originating domain.
-- Access-Control-Allow-Credentials: true.
Fix:
This release adds the relevant CORS fields to responses.
758387-2 : BIG-IP floods packet with MAC '01-80-c2-00-00-00' to VLAN instead of dropping it
Component: TMOS
Symptoms:
In STP 'passthru' mode, any packet sent to the BIG-IP system with a destination MAC of 01-80-c2-00-00-00 is treated as an STP bridge protocol data unit (BPDU), and is flooded to the VLAN.
Conditions:
-- The BIG-IP system is configured for STP 'passthru' mode
-- The BIG-IP system receives a packet with MAC 01-80-c2-00-00-00.
Impact:
A packet that is not an STP BPDU, but is sent to the same destination MAC address may be flooded as if it was a BPDU.
Workaround:
None.
758311-1 : Policy Compilation may cause MCPD to crash
Component: Local Traffic Manager
Symptoms:
If a policy has rules involving IPv6 addresses, and the addresses differ only on 32-bit boundaries, then the compilation of that policy may cause MPCD to crash.
Conditions:
-- A policy is attached to a virtual server.
-- That policy contains conditions that involve IPv6 addresses.
-- The addresses in different rules differ only on 32-bit boundaries.
Impact:
MCPD cores, and then restarts. The policy is not usable.
Workaround:
You can try either of the following:
-- It may be possible to create multiple rules from a given rule by altering the netmask.
-- Another possibility is to add a placeholder rule with no action that matches IP addresses differently.
Fix:
Policies involving matching IP addresses now compile correctly.
758119-6 : qkview may contain sensitive information
Solution Article: K58243048
Component: TMOS
Symptoms:
For more information see: https://support.f5.com/csp/article/K58243048
Conditions:
For more information see: https://support.f5.com/csp/article/K58243048
Impact:
For more information see: https://support.f5.com/csp/article/K58243048
Workaround:
For more information see: https://support.f5.com/csp/article/K58243048
Fix:
For more information see: https://support.f5.com/csp/article/K58243048
758085-1 : CAPTCHA Custom Response fails when using certain characters
Component: Application Security Manager
Symptoms:
When setting the CAPTCHA Custom Response in the Bot Defense GUI, saving the profile fails when using certain characters.
For example, using the following response will return the error: 'black' unknown property
This question is for testing whether you are a human visitor and to prevent automated spam submission.
<p style="color: black; padding-right:20px">
<br>
%BOTDEFENSE.captcha.image% %BOTDEFENSE.captcha.change%
<br>
<b>What code is in the image\?</b>
%BOTDEFENSE.captcha.solution%
<br>
%BOTDEFENSE.captcha.submit%
<br>
<br>
Your support ID is: %BOTDEFENSE.captcha.support_id%.
Conditions:
Attempting to configure custom CAPTCHA response in the Bot Defense profile GUI.
Impact:
Cannot configure custom CAPTCHA response in the Bot Defense Profile GUI.
Workaround:
Use TMSH or REST API to configure the CAPTCHA Custom Response.
Fix:
Configuring custom CAPTCHA response page in the Bot Defense Profile no longer fails when using certain characters.
758065-4 : TMM may consume excessive resources while processing FIX traffic
Solution Article: K82781208
758018-5 : APD/APMD may consume excessive resources
Solution Article: K61705126
757992-3 : RADIUS Acct STOP message is not being sent when configured with route domain for HA Pool setup
Component: Access Policy Manager
Symptoms:
RADIUS Acct STOP message is not being sent when configured with route domain for HA Pool setup
Conditions:
-- Configure Floating IP with route domain.
-- Configure RADIUS accounting server with Pool Setup.
-- Configure the virtual server containing the access policy to use the RADIUS Accounting server.
-- Access the virtual server.
Impact:
-- START message is being sent through proper egress floating IP address.
-- STOP message is not sent, and the system logs the following error message:
-- err tmm1[11193]: 01490586:3: (null):Common:8a505e8c: Processing radius acct stop message failed, connection failure.
-- err tmm1[11193]: 01490514:3: (null):Common:00000000: Access encountered error: ERR_RTE. File: ../modules/hudfilter/access/access_session.c, Function: access_session_final_callback, Line: 4439.
Workaround:
This issue is present only when the floating IP address is configured with a non-default route domain. It works fine with the default route domain. Use of default route domain is recommended.
Fix:
RADIUS Acct STOP message is now sent as expected.
757985-1 : TMM memory leak
Solution Article: K79562045
Component: Local Traffic Manager
Symptoms:
-- TMM memory utilization baseline is slowly increasing.
-- The 'allocated' column of the 'tcl' row in the memory_usage_stat tmctl table is high and is close to the 'max_allocated' value.
Conditions:
-- The header-insert option in a custom HTTP profile is configured.
-- The profile is attached to a virtual server.
Impact:
Degraded performance, and eventual out-of-memory condition that may trigger a TMM crash. Traffic disrupted while tmm restarts.
Workaround:
Instead of the profile header-insert, use HTTP::header iRule commands.
Fix:
The header-insert option can now be configured in HTTP profiles without causing a TMM memory leak.
757827-1 : Allow duplicate FQDN ephemeral create/delete for more reliable FQDN resolution
Component: Local Traffic Manager
Symptoms:
When using FQDN nodes and pool members, ephemeral pool members may not be created as expected immediately after a configuration-load or BIG-IP reboot operation.
Conditions:
This may occur on affected BIG-IP versions when:
1. Multiple FQDN names (configured for FQDN nodes/pool members) resolve to the same IP address.
2. DNS queries to resolve these FQDN names occur almost simultaneously.
3. The BIG-IP version in use contains the fix for ID 726319.
The occurrence of this issue is very sensitive to timing conditions, and is more likely to occur when there are larger numbers of FQDN names resolving to a common IP address.
Impact:
When this issue occurs, some subset of ephemeral pool members may not be created as expected.
As a result, some pools may not have any active pool members, and will not pass traffic.
This issue, when it occurs, may persist until the next DNS queries occur for each FQDN name, at which point the missing ephemeral pool members are typically created as expected. Using the default fqdn interval value of 3600 seconds, such downtime would last approximately one hour.
Workaround:
To minimize the duration of time when pools may be missing ephemeral pool members, configure a shorter fqdn interval value for the FQDN nodes:
tmsh mod ltm node fqdn-node-name { fqdn { interval ## } }
Where ## is the desired number of seconds between successive DNS queries to resolve the configure FQDN name.
Fix:
When using FQDN nodes and pool members, ephemeral pool members will be created as expected following a configuration-load or BIG-IP reboot operation.
However, messages similar to the following may be logged when the DNS server returns a different set of IP address records to resolve the FQDN name:
err mcpd[20479]: 01020066:3: The requested Node (****) already exists in partition ****.
err mcpd[20479]: 01020066:3: The requested Pool Member (****) already exists in partition ****.
757782-1 : OAuth Authorization Server returns an invalid 'sub' claim in JWT access token when 'subject' field is configured to be a session variable other than the default
Component: Access Policy Manager
Symptoms:
Invalid 'sub' claim in JWT access token that is generated by OAuth Authorization Server.
Conditions:
-- OAuth Authorization Server is configured to return JWT access token.
-- Subject field is configured to be a session variable other than the default '%{session.assigned.uuid}'.
Impact:
Invalid value in 'sub' claim in JWT access token. If OAuth resource server depends on the value of 'sub' claim, then that functionality does not work.
Workaround:
Add Variable assign agent after OAuth Authorization agent, and assign session.assigned.oauth.authz.token.subject with the session variable name such as the following:
session.logon.last.logonname.
Fix:
OAuth Authorization Server sends valid value in 'sub' claim in the generated JWT token when subject is configured to use a session variable.
757777-3 : bigtcp does not issue a RST in all circumstances
Component: Local Traffic Manager
Symptoms:
bigtcp does not issue a TCP reset, e.g. when using the iRule reject command on CLIENT_ACCEPTED
Conditions:
bigtcp in use, tcp connection, connection ungracefully shut down via a 'reject' command in an iRule
Impact:
TCP RST is not sent, and the SYN is silently dropped.
Workaround:
none
Fix:
bigtcp virtuals send now a TCP RST if needed.
757722-2 : Unknown notify message types unsupported in IKEv2
Component: TMOS
Symptoms:
IKE negotiation fails when an unrecognized notify payload type is seen in a message processed by IKEv2.
Conditions:
Receiving an IKE message that contains a notify payload whose numeric type value is unrecognized by IKEv2.
Impact:
Negotiation fails with an aborted connection, preventing tunnel creation.
Workaround:
A peer can suppress notification payloads with advisory values that get rejected by IKEv2 within the BIG-IP system.
Fix:
All unknown notify types are now logged and then ignored.
757698-1 : TMM crashes in certain situations of which iRule execution interleaves client side and server side flows
Component: Local Traffic Manager
Symptoms:
TMM crashes in certain situations in which iRule execution interleaves client-side and server-side flows.
Conditions:
The exact conditions that cause this issue are unknown, although appear to happen in at least one configuration: OneConnect with an iRule whose execution leads to that, inside TMM, the client-side and server-side flow operations interleave.
Impact:
TMM crashes and restarts. Traffic disrupted while tmm restarts.
Workaround:
None.
Fix:
iRule clears the right side data after execution.
757617-1 : Systemd vulnerabilities: CVE-2018-16864, CVE-2018-16865
Solution Article: K06044762
757578-2 : RAM cache is not compatible with verify-accept
Component: Local Traffic Manager
Symptoms:
The TCP profile's verify-accept option is not compatible with the RAM cache feature
Conditions:
A TCP profile is used with the 'verify-accept' option enabled, together with a Web Acceleration via RAM cache.
Impact:
There may be a log message in /var/log/tmm# describing an 'Invalid Proxy Transition'. The RAM cache feature may not handle later pipelined requests due to the proxy shutting down the connection.
Workaround:
Do not use TCP's verify-accept option together with RAM cache.
Fix:
RAM cache now works correctly when the TCP profile enables the verify-accept option.
757524 : Data operation attempt on object that has not been loaded
Component: Advanced Firewall Manager
Symptoms:
While assigning VLANs to Traffic Matching Criteria, you get an error:
01070712:3: Data operation attempt on object that has not been loaded.
Conditions:
This occurs while trying to add or modify VLANs on a Traffic Matching Criteria.
Impact:
Error is reported; unable to add or modify VLAN assignment to Traffic Matching Criteria.
Workaround:
None.
Fix:
Fixed the issue to allow configuration of VLANs to Traffic Matching Criteria object.
757519-1 : Unable to login using LDAP authentication with a user-template
Component: TMOS
Symptoms:
User cannot login using remote LDAP authentication. This occurs because LDAP with user-template uses user-template username as DN for search.
Conditions:
LDAP authentication configuration includes user-template, which is not a valid DN.
Impact:
Remote LDAP authentication users are unable to login.
Workaround:
You can use either of the following workarounds:
-- Create a specific user for bind by configuring bind-dn and bind-pw and remove user-template.
-- Switch to local authentication.
757455-2 : Excessive resource consumption when processing REST requests
Solution Article: K87920510
757441-4 : Specific sequence of packets causes Fast Open to be effectively disabled
Component: Local Traffic Manager
Symptoms:
You see this warning in the logs:
warning tmm[21063]: 01010055:4: Syncookie embryonic connection counter -1 exceeded sys threshold 64000.
Conditions:
-- TCP Fast Open and ECN are both enabled.
-- There are multiple RST segments from the receive window received in SYN_RECEIVED state.
Impact:
TCP Fast open is disabled, as the pre_established_connections becomes very large (greater than a threshold).
Workaround:
TCP ECN option can be disabled.
Fix:
TCP Fast Open is prevented from being disabled when some conditions are met.
757391-2 : Datagroup iRule command class can lead to memory corruption
Component: Local Traffic Manager
Symptoms:
When using the iRule command to access datagroups within a foreach loop, memory can be corrupted and tmm can crash.
Conditions:
A [class] command used within a foreach loop.
Impact:
Traffic disrupted while tmm restarts.
Workaround:
No workaround aside from removing that iRule.
Fix:
tmm no longer crashes under these conditions.
757360-1 : Category lookup returns wrong category on subsequent traffic following initial HTTP CONNECT traffic through SSLO
Component: Access Policy Manager
Symptoms:
Category lookup returns the wrong category on subsequent traffic following initial HTTP CONNECT traffic through F5 SSL Orchestrator (SSLO).
Conditions:
-- Outbound deployment configured in SSLO, where SSLO behaves as a transparent proxy.
-- A policy has a branch to lookup category using HTTP Connect.
-- An HTTPS client generates HTTPS traffic via an explicit proxy on the local network with a private address through SSLO as the gateway.
Impact:
Category Match is not performed on subsequent requests, resulting in fallback branch to be taken.
Workaround:
None.
Fix:
Category lookup now works correctly in this scenario.
757359-1 : pccd crashes when deleting a nested Address List
Component: Advanced Firewall Manager
Symptoms:
When removing a nested Address List or Port List, the pccd process might crash.
Conditions:
This might occur under the following conditions:
-- Removing a nested Address List or Port List using a tmsh transaction with an incorrect tmsh command order consistently results in this crash.
-- A high availability (HA) setup with config-sync enabled and there are intermittent problems with HA-connections, or out-of-memory system state, might intermittently result in this crash.
Impact:
pccd crashes with core, restarts, and correctly compiles the new configuration. There is a resulting, small delay in applying the new configuration due to the pccd restart.
Workaround:
-- If the crash occurs as a result of incorrect tmsh commands in a transaction, reorder commands to the parent list is modified or deleted before deleting the nested list.
-- If the crash is an intermittent issue due to problems with HA-connections, or an out-of-memory system state, no action is necessary; pccd correctly compiles new configuration after it restarts.
Fix:
pccd no longer crashes under these conditions, and correctly compiles the new configuration.
757357-3 : TMM may crash while processing traffic
Solution Article: K92002212
757306-3 : SNMP MIBS for AFM NAT do not yet exist
Component: Advanced Firewall Manager
Symptoms:
SNMP MIBS for AFM NAT do not yet exist.
Conditions:
This occurs in normal operation.
Impact:
Unable to read values that do not exist in SNMP, meaning that you cannot access information that you need.
Workaround:
None.
757088-1 : TMM clock advances and cluster failover happens during webroot db nightly updates
Component: Traffic Classification Engine
Symptoms:
Webroot database mapping and unmapping takes a very long amount of time on TMM, so you might see clock advances occur. The long interval might result in a failover/state-transition in clustered environment.
Conditions:
-- Webroot database is downloaded.
-- TMM needs to swap to the new instance.
Impact:
TMM does not process traffic because of the long delay in mapping and unmapping, and failover might happen in a clustered environment.
Workaround:
You can avoid this issue by disabling BrightCloud updates, however, your environments will miss the latest updates as a result.
#vi /etc/wr_urldbd/bcsdk.cfg
DoBcap=true
DoRtu=false
DownloadDatabase=false
Fix:
Mapping/Unmapping the database is done asynchronously and the delay is reduced so that the CDP failover does not happen.
757084-2 : Bypassing SSL interception in SSL Orchestrator may crash TMM if virtual server is SNAT enabled
Solution Article: K00432398
757027-1 : BIND Update
Solution Article: K01713115
757026-1 : BIND Update
Component: TMOS
Symptoms:
Upgrade BIND to 9.11.5-P4 per recommendation from ISC
Conditions:
GTM provisioned.
Impact:
BIND not up-to-date
Workaround:
None.
Fix:
Upgrade to BIND 9.11.5-P4
757025-1 : BIND Update
Solution Article: K00040234
757023-2 : BIND vulnerability CVE-2018-5743
Solution Article: K74009656
756877-1 : Virtual server created with Guided Configuration is not visible in Grafana
Component: Anomaly Detection Services
Symptoms:
The traffic of Virtual Server created with the Guided Configuration is not visible with Grafana monitoring tool.
Statistics of this virtual server are not included in the admdb part of qkview.
Conditions:
-- Create virtual server using Guided Configuration.
-- Use the Grafana monitoring tool to view virtual server statistics.
-- Create a qkview.
Impact:
Cannot view virtual server using the Grafana monitoring tool. The resulting qkview contains no statistics for this virtual server. Lack of information for debugging and troubleshooting
Workaround:
Configure virtual server manually, without the Guided Configuration
Fix:
Virtual server created with Guided Configuration is visible in Grafana and its statistics present in qkview.
756777-1 : VDI plugin might crash on process shutdown during RDG connections handling
Component: Access Policy Manager
Symptoms:
VDI plugin might crash on process shutdown if it is stopped during handling of RDG connections.
Conditions:
VDI plugin process is stopped while new RDG connection is established via APM.
Impact:
The process will be shutdown, but generated core file might cause unnecessary confusion.
Workaround:
None.
Fix:
Fixed VDI plugin crash on process shutdown during RDG connections handling.
756774-6 : Aborted DNS queries to a cache may cause a TMM crash
Component: Global Traffic Manager (DNS)
Symptoms:
TMM may crash if an attempt is made to send a response to a TCP connection that has already been torn down.
Conditions:
TCP connections that are aborted before receiving a RESPONSE from a cache.
Impact:
Loss of service until TMM is restarted. Traffic disrupted while tmm restarts.
Workaround:
None.
Fix:
Aborted DNS queries to a cache no longer cause a TMM crash.
756538-4 : Failure to open data channel for active FTP connections mirrored across an HA pair.
Solution Article: K15759349
756477-2 : Drop Redirect tab incorrectly named as 'Redirect Drop'
Component: Advanced Firewall Manager
Symptoms:
Incorrect naming on navigation tabs Security :: Debug :: Drop Redirect.
Conditions:
Navigating to Security :: Debug :: Drop Redirect.
Impact:
The page name is Drop Redirect instead of Redirect Drop.
Workaround:
None.
Fix:
Drop Redirect tab is now correctly named as 'Drop Redirect'
756458-3 : Linux kernel vulnerability: CVE-2018-18559
Solution Article: K28241423
756450-1 : Traffic using route entry that's more specific than existing blackhole route can cause core
Component: TMOS
Symptoms:
TMM asserts with 'Attempting to free loopback interface'message.
Conditions:
- Using blackhole routes.
- Have a route entry that is more specific than the existing blackhole route.
Impact:
Traffic disrupted while tmm restarts.
Workaround:
Use /32 blackhole routes.
Fix:
TMM no longer cores when using blackhole routes that are less specific than non-blackhole routes.
756418-1 : Live Update does not authenticate remote users
Component: Application Security Manager
Symptoms:
Remote users with Administrator or Application Security Administrator roles cannot run Live Update.
Conditions:
-- Remote user (LDAP/RADIUS).
-- Remote user logged in.
-- New installation is available.
Impact:
-- Remote users cannot manually check for updates.
-- Remote users cannot manually upload new files.
-- Remote users cannot install new update files.
Workaround:
Log in with a local user like admin, application security editor, or application security administrator.
Fix:
Authentication is directly done from MCP. Remote users are not treated like local users, so only the role of the user determines the ability to perform operations such as Live Update.
756402-2 : Re-transmitted IPsec packets can have garbled contents
Component: TMOS
Symptoms:
Before re-transmitting a packet, it is discovered to be garbled, mainly in the form of having physical length that no longer matches the logical length recorded inside the packet.
Conditions:
Possibly rare condition that might cause packet freeing while still in use.
Impact:
Likely tunnel outage until re-established.
Workaround:
No workaround is known at this time.
Fix:
This release adds checksums to verify IPsec packets are not altered between first creation and later re-transmission.
756363-1 : SSLO or SWG connections using proxy chaining to Explicit Proxy can get reset
Component: Access Policy Manager
Symptoms:
Connections get reset with reset cause "repick failed"
Conditions:
SSLO with proxy chaining to Explicit Proxy or SWG per-request policy using proxy select agent with No URI rewrite
Impact:
Connections get reset with reset cause "repick failed"
Workaround:
None
Fix:
Connections no longer get reset.
756356-2 : External datagroups of type string cannot use iRule command 'class match equals' for entries > 32 characters long
Component: Local Traffic Manager
Symptoms:
iRules using the command 'class match' with the 'equals' operator on long entries fail to return a positive match, even if they are in the datagroup, for example:
my_datagroup:
"abcdefghijklmnopqrstuvwxyz0123456" := "value1"
class match "abcdefghijklmnopqrstuvwxyz0123456" equals my_datagroup
Conditions:
This is encountered when all of the following conditions are met:
- Using an external datagroup of type string with keys longer than 32 characters.
- Using an iRule with the 'class match' command and the 'equals' operator on the external datagroup.
- Trying to match keys that are longer than 32 characters.
Impact:
iRules will act incorrectly
Workaround:
If none of the keys in the datagroup are prefixes of each other, the 'equals' operator can be changed to 'starts_with' or 'ends_with' (if none are suffixes of each other).
Fix:
iRules using the command 'class match' with the 'equals' operator on long entries now correctly matches external datagroup string entries which are longer than 32 characters.
756311-4 : High CPU during erroneous deletion
Component: Policy Enforcement Manager
Symptoms:
The utilization of some CPU cores increases and remains high for a long time. Rebooting just one blade can cause the high CPU usage to move to another blade in the chassis.
There might be messages similar to the following in tmm logs:
-- notice PEM: spm_subs_id_consistency_check_cb: Session 10.1.10.10%0-4a89723e; Instance ID mismatch ERR_OK for subscriber id 310012348494 with 10.1.10.10-0-4a8987ea.
-- notice PEM: spm_subs_id_consistency_check_cb: Session 10.1.18.10%0-4a8b850c; Look up returned err ERR_OK for subscriber id 3101512411557
Conditions:
The exact conditions under which this occurs are not fully understood, but one way it can be triggered is when a single TMM is crashing on a chassis system.
Impact:
The CPU usage is coming from an erroneous cleanup function, which is only running on a TMM when it's not busy; traffic is not expected to have a significant impact. However, recovering may result in a cluster-wide TMM restart, if the CPU usage does not subside. Traffic disrupted while tmm restarts.
Workaround:
Delete all subscribers from the CLI.
756270-4 : SSL profile: CRL signature verification does not check for multiple certificates with the same name as the issuer in the trusted CA bundle
Component: Local Traffic Manager
Symptoms:
If there are multiple certificates in the trusted CA bundle with the same common name, CRL signature verification checks only one of them while looking for CRL issuer.
Conditions:
Multiple certificates with the same subject name as the CRL issuer in the trusted CA bundle used for authentication in SSL profiles.
Impact:
Handshake failure.
Workaround:
None.
Fix:
This has been fixed to check for the issuer among all certificates that have the same subject name as the CRL issuer.
756218-1 : Improve default management port firewall
Solution Article: K45644893
756205-1 : TMSTAT offbox statistics are not continuous
Component: Application Visibility and Reporting
Symptoms:
When BIG-IP systems are manged by BIG-IQ, the device health statistics have gaps (missing samples).
Conditions:
BIG-IP systems managed by BIG-IQ,
Impact:
Missing data on device health, such as CPU load and memory occupancy.
Workaround:
None.
Fix:
Functionality restored - BIG-IP systems send all the data as expected.
756108-1 : BD crash on specific cases
Component: Application Security Manager
Symptoms:
BD crash on specific cases.
Conditions:
Have a feature that requires Captcha/ Client side Integrity in ASM.
Impact:
No traffic to app.
Workaround:
None.
Fix:
This release fixes the specific crash scenario.
756102-2 : TMM can crash with core on ABORT signal due to non-responsive AVR code
Component: Application Visibility and Reporting
Symptoms:
ABORT signal is sent to TMM by SOD; TMM aborts with a core.
Conditions:
Non-responsive AVR code. No other special conditions.
Impact:
Traffic disrupted while tmm restarts.
Workaround:
None.
756094-2 : DNS express in restart loop, 'Error writing scratch database' in ltm log
Component: Global Traffic Manager (DNS)
Symptoms:
DNS express (zxfrd) daemon gets stuck in a restart loop with the messages:
-- In /var/log/ltm:
Error writing scratch database (no error information available), serving database is unchanged. zxfrd will exit and restart.
-- The system posts the following message on the command line every few seconds:
emerg logger: Re-starting zxfrd
Conditions:
An update to an SOA record (and only an SOA) is received through a incremental zone transfer update (IXFR).
Impact:
Zone updates from the DNS master servers are not processed.
Workaround:
As a partial workaround, the DNS express cache files can be removed, forcing zxfrd to pull the entire zone using an AXFR request. To do so, use the following commands, in sequence:
bigstart stop zxfrd
rm /shared/zxfrd/*
bigstart start zxfrd
Note: DNS express will not be able to service DNS responses until the zone transfers have completed. For this reason, this procedure should be carried out on the standby device, if possible.
Fix:
The system now properly handles IXFRs that contain only starting and ending SOA RRs, and no other RRs.
756071-3 : MCPD crash
Component: TMOS
Symptoms:
mcpd crashes on out of memory.
Conditions:
MCPD experiences a memory leak under one of the following conditions:
- A tmsh command such as the following is run:
tmsh reset-stats ltm virtual
- The ASM or AVR module is provisioned.
In both circumstances, the 'cur_allocs' for one of MCPD's internal memory allocation types generally increases and becomes very high (e.g., millions):
tmctl -I --select cur_allocs memory_stat program=mcpd name=umem_alloc_40
Impact:
MCPD can run out of memory and crash. Traffic disrupted while mcpd restarts.
Workaround:
None.
Fix:
A memory leak that occurred in the MCPD process has been fixed.
756019-1 : OAuth JWT Issuer claim requires URI format
Component: Access Policy Manager
Symptoms:
APM currently expects the OAuth JSON web tokens (JWT) Issuer claim to be in the URI format:
-- JWT-Config does not allow Issuer setting unless it is in the URI format.
-- The issuer value in the incoming token is expected to be in the URI format and should match with the Issuer setting in the JWT-Config.
Conditions:
OAuth JWT Issuer claim in the URI format for JWT access token and ID token.
Impact:
As per RFC 7519, 'iss' claim value is a case-sensitive string containing a StringOrURI value. To comply with RFC 7519, basically allowing any string value in the Issuer claim, APM should ease this validation.
Workaround:
None.
Fix:
JWT config issuer Validation is removed to allow a string or URI value for the JWT issuer.
755997-2 : Non-IPsec listener traffic, i.e. monitoring traffic, can be translated to incorrect source address
Component: Local Traffic Manager
Symptoms:
When IPsec traffic is processed by a FastL4 profile, which is not related to an IPsec listener, and is send out via a gateway pool or a dynamic route, the source address of this traffic can be erroneously changed to 127.0.0.x.
Conditions:
-- IPsec traffic is processed by a FastL4 profile, which is not related to an IPSEC listener.
-- The traffic is sent out via a gateway pool or a dynamic route.
Impact:
The incorrect source address is used.
Workaround:
None.
Fix:
The IPsec traffic uses now the correct IP source-address.
755817 : v14.1.0.5 includes Guided Configuration 4.1
Component: Access Policy Manager
Symptoms:
Guided Configuration is not upgraded automatically with each release; it must be manually upgraded between versions. It should be bundled into the release.
Version 14.1.0.5 includes Guided Configuration 4.1.
Conditions:
Upgrading Guided Configuration.
Impact:
Have to manually upgrade Guided Configuration.
Workaround:
Manually upgrade Guided Configuration.
Fix:
Guided Configuration v4.1 is bundled into BIG-IP software v14.1.0.5 and no longer requires manual upgrade.
Behavior Change:
Guided Configuration v4.1 is bundled into BIG-IP software v14.1.0.5. For versions earlier than 14.1.0.5 (e.g., 14.1.0.0), you had to upgrade Guided Configuration manually. That is no longer necessary.
755727-2 : Ephemeral pool members not created after DNS flap and address record changes
Component: Local Traffic Manager
Symptoms:
When using FQDN node/pool members, ephemeral pool members may not be created for one or more pools after address records change on the DNS server.
Once this condition occurs, ephemeral pool members are no longer created for a given FQDN name in the affected pool.
Conditions:
This issue may occur under rare timing conditions when the following factors are present:
-- Using FQDN nodes/pool members.
-- Changes occur in the address records on the DNS server, causing new ephemeral nodes/pool members to be created and old ephemeral nodes/pool members to be deleted.
-- There is a temporary loss of connectivity to/responsiveness from the DNS server.
Impact:
When this issue occurs, the affected pool may be left with no active pool members. In that case, virtual servers targeting the affected pool become unavailable and stop passing traffic.
Workaround:
When this issue occurs, the ability to create ephemeral pool members can be restored by either of the following actions:
1. Restart the dynconfd daemon:
bigstart restart dynconfd
2. Delete and re-create the FQDN template pool member using the following two commands:
tmsh mod ltm pool affected_pool members del { fqdn_pool_member:port }
tmsh mod ltm pool affected_pool members add { fqdn_pool_member:port { additional field values } }
To ensure that a pool contains active members even if this issue occurs, populate each pool with more than one FQDN pool member, or with an additional non-FQDN pool member.
755641-1 : Unstable asm_config_server after upgrade, 'Event dispatcher aborted'
Component: Application Security Manager
Symptoms:
Ignored suggestions for Multiple decoding or HTTP Protocol Settings present after upgrading a unit to 14.1.0 can cause the asm_config_server and pabnagd processes to enter restart loops.
Conditions:
1) On a 13.1.x system send traffic that will generate suggestions for Max Decoding Passes, Maximum Headers, and/or Maximum Parameters.
2) Set those Suggestions to be Ignored.
3) Upgrade to 14.1.0.
Impact:
-- Multiple asm_config_server restarts.
-- System instability, including inability to manage ASM settings or use traffic learning.
-- No local logging.
Workaround:
You can use either of the following workarounds:
A) Delete any such ignored suggestions using the following SQL command:
> DELETE FROM PL_SUGGESTIONS WHERE element_type IN (7,193,75);
B) Delete any such ignored suggestions before upgrade using the GUI/REST/SQL.
Fix:
The system now handles removed Entity types during upgrade for Ignored Suggestions: Ignored suggestions for Multiple decoding or HTTP Protocol Settings are removed during upgrade. You must reconfigure the Ignore settings after upgrade.
Behavior Change:
Refactoring in 14.1.0 modified the functionality of the following Entity types: Max Decoding Passes, Maximum Headers, and/or Maximum Parameters. Ignored suggestions for Multiple decoding or HTTP Protocol Settings are removed during upgrade, so you must reconfigure the Ignore settings after upgrade.
755630-1 : MRF SIP ALG: Mirrored media flows timeout on standby after 2 minutes
Component: Service Provider
Symptoms:
The media flows get terminated after the UDP idle timeout expires on a Standby device.
Conditions:
-- High availability (HA) configuration.
-- SIP media calls on a SIP-ALG with SNAT feature enabled.
Impact:
SIP calls fail to deliver media when high availability (HA) failover occurs.
Workaround:
Partial mitigation is to set the UDP idle timeout to a higher value.
Fix:
Properly set SIP ALG media pinhole connection flags so that to not time out due to inactivity on the next active device.
755585-1 : mcpd can restart on secondary blades if a policy is created, published, and attached to a virtual server in a single transaction
Component: Local Traffic Manager
Symptoms:
On a VIPRION cluster, if a single transaction creates a policy with the name Drafts/NAME, publishes the policy, and attaches the policy to a virtual server, mcpd restarts on the secondary blades.
Conditions:
-- VIPRION chassis with more than one blade.
-- Single mcp transaction that:
* Creates a policy with 'Drafts/' as part of the policy name.
* Publishes that policy.
* Attaches that policy to a virtual server, either in the same transaction or a later transaction.
Impact:
mcpd restarts on all secondary blades of a cluster.
Workaround:
You can use either of the following workarounds:
-- Do not create policies with 'Drafts/' in the name.
-- Do not create and publish a policy in the same transaction.
755575-1 : In MOS, the 'image2disk' utility with the '-format' option does not function properly
Component: TMOS
Symptoms:
When the BIG-IP system boots, mcpd continually restarts.
Conditions:
This occurs if you issue the 'image2disk' command with the '-format' option in the MOS (Maintenance Operating System) shell.
Impact:
When the system boots, it cannot become active.
Workaround:
In the MOS shell, do not issue the 'image2disk' utility with the '-format' option. You can achieve the same result by following the shell guidance. To begin, type 'start<enter>'.
If the system is already in the defective state, use this shell command, and then reboot:
touch /.tmos.platform.init
The problem should be resolved.
Fix:
In MOS, running 'image2disk' with the '-format' option no longer causes continuous mcpd restarts.
755475-1 : Corrupted customization group on target after updating access policy (any agent that is tied to customization group) on source device and config sync
Component: Access Policy Manager
Symptoms:
After making changes to the logon page agent field, performing config sync to another device and opening the logon agent in VPE on the sync target device encounters an error. Though this problem described to the logon page agent, this is applicable to any agent that is tied to customization group.
Conditions:
1. Form a failover device group with two devices.
2. On one device, create an access policy with logon page agent. Initiate config sync to sync the policy to other devices. Verify everything is correct on target device (specifically: open VPE for the policy, Logon Page is in the policy, click on the agent, and edit box appears without issue).
3. On source device, launch VPE for the policy, click on Logon Page agent, make changes to Agent (e.g., choose 'password' type for field3. Save the change and make a config sync again.
4. Go to target device, open VPE for the policy, and click on Logon Page is in the policy.
Impact:
Config is not synced properly to another device in the device group.
Workaround:
- Workaround 1:
Step1. On Standby (where the problem happens): delete the policy in question.
Step2. On Active: modify the access policy and Sync it.
* Problem with this workaround: sometimes, you cannot properly delete the access policy in question on the standby (as customization is corrupted, some related config deletion fails).
- Workaround 2:
Step 1. On Standby (where the problem happens): try to open up access policy item using VPE. Error will show the exact location of the file that is missing, for example:
"An error 'customization::getMessages: Unable to get xml dom from /config/filestore/files_d/Common_d/customization_group_d/:Common:MyAccessPolicy_act_logon_page_ag_5678_4' has occured on server... Dialogue loading has failed."
Step 2. On Standby: copy the exact file from active unit to standby unit, change the permission (ownership/group, permission flags) of the file so that it looks similar to active.
Fix:
Target device receives identical configuration as source one after config sync after user updates logon page field in logon agent editing dialog.
755447-1 : SSLO does not deliver content generated/originated from inline device
Component: Access Policy Manager
Symptoms:
If any inline service acting as a proxy generates content for the client while resetting the server side connection, then the client might not see the content, and will instead see a reset.
Conditions:
-- F5 SSL Orchestrator (SSLO) with inline services intercepting requests and replying without letting the content go to back-end server.
-- Inline services resetting the back-end connection
Impact:
Client receives a reset instead of a redirect or error page.
Workaround:
None.
Fix:
Clients now receive the content that the inline device generates.
755378-1 : HTTPS connection error from Chrome when BADOS TLS signatures configured
Component: Anomaly Detection Services
Symptoms:
HTTPS connection error occurs. The system posts the following ltm.log warnings:
-- warning tmm1[25112]: 01260009:4: Connection error: ssl_basic_crypto_cb:694: Decryption error (20)
-- warning tmm1[25112]: 01260009:4: Connection error: hud_ssl_handler:1941: codec alert (20)
Conditions:
-- BADOS TLS signatures configured.
-- DoS profile is attached to a virtual server.
-- Using Google Chrome browser.
Impact:
HTTPS virtual server is not responsive.
Workaround:
Turn off TLS signatures flag.
Fix:
HTTPS connection error no longer occurs when connecting from Chrome to virtual server with TLS signature BADOS protection.
755317-1 : /var/log logical volume may run out of space due to agetty error message in /var/log/secure
Component: TMOS
Symptoms:
An agetty error message is output to the /var/log/secure log fil every 10 seconds while the instance remains on:
agetty[<process_id>]: /dev/tty0 ttyS0: No such file or directory.
Conditions:
This agetty error message is an issue on all BIG-IP Virtual Edition and Cloud instances. It is not configuration-dependent.
Impact:
This may fill the /var/log/secure log file. When /var/log is full, certain system services may degrade or become unresponsive (e.g., DNS).
Workaround:
Manually extend the /var/log logical volume.
For more information, see Increase disk space for BIG-IP VE :: https://clouddocs.f5.com/cloud/public/v1/shared/disk_space.html.
Fix:
The issue causing the agetty error message in /var/log/secure has been resolved.
755254-1 : Remote auth: PAM_LDAP buffer too small errors★
Component: TMOS
Symptoms:
You are unable to log into the BIG-IP system using an LDAP account.
The system might log the following message in /var/log/secure:
-- crit httpd[28010]: pam_ldap(httpd:account): buffer 'buffer_size' too small.
Note: This message might not be logged for all occurrences of this issue.
Conditions:
This occurs when the following conditions are met:
-- Remote-LDAP authentication is configured.
-- There is a user account with attributes longer than 255 characters in length.
-- That user attempts a logon to the BIG-IP system.
Impact:
LDAP authentication not working properly.
Workaround:
Configure user accounts with attributes shorter than 255 characters.
Fix:
LDAP authentication and authorization now succeeds for users under these conditions.
755213-1 : TMM cores in certain scenarios with HTTP/2 virtual server
Component: Local Traffic Manager
Symptoms:
TMM cores when attempting to reset a stream. Parent connection may be resetting and going away, race conditions may lead to TMM core in HTTP MR proxy.
Conditions:
Virtual server with HTTP/2, HTTP, TCP, SSL and httprouter profiles. Race conditions when resetting connections.
Impact:
Traffic disrupted while tmm restarts.
755134-1 : HTTP/2 connections may leak memory if server-side connection not established
Component: Local Traffic Manager
Symptoms:
Xhead and xdata memory caches grow over time when HTTP/2 traffic is present. Eventual performance degradation and potential traffic outage due to memory exhaustion.
Conditions:
-- HTTP/2 configured with HTTP Router profile.
-- Configuration or network issues which prevent server-side connection from being established.
Impact:
Memory leakage over time may result in performance degradation and eventual traffic outage if TMM restarts due to memory exhaustion.
Workaround:
None.
Fix:
HTTP/2 connections no longer leak memory when server-side connection establishment fails.
755047-1 : Category lookup returns wrong category on CONNECT traffic through SSLO
Component: Access Policy Manager
Symptoms:
Category lookup returns wrong category on CONNECT traffic through F5 SSL Orchestrator (SSLO).
Conditions:
-- Outbound deployment configured in SSLO, where SSLO behaves as a transparent proxy.
-- A policy has a branch to lookup category using HTTP Connect.
-- An HTTPS client generates HTTPS traffic via an explicit proxy on local network with private address through SSLO as the gateway.
Impact:
Category Match is not performed, resulting in fallback branch to be taken.
Workaround:
None
Fix:
Category lookup now works correctly in this scenario.
755005-1 : Request Log: wrong titles in details for Illegal Request Length and Illegal Query String Length violations
Component: Application Security Manager
Symptoms:
Illegal Request Length uses Illegal Query String Length template and vice versa, so the incorrect titles are shown in violation details.
Conditions:
Open details of Illegal Request Length or Illegal Query String Length violation in request log.
Impact:
Illegal Request Length uses Illegal Query String Length template and vice versa. Only the titles are wrong. The actual requests are recorded correctly.
Workaround:
None.
Fix:
Correct templates are now used for Illegal Request Length and Illegal Query String Length violations, so the correct titles show.
754985-1 : Standby mirrored server SSL connections fail, and tmm may crash while processing mirrored TLS traffic
Component: Local Traffic Manager
Symptoms:
Server SSL mirrored connections fail, showing any6.any - any6.any as the server connection.
Under certain conditions, the standby TMM may crash while processing mirrored TLS traffic.
Conditions:
-- Virtual server with server-side SSL.
-- Connection mirroring enabled.
Impact:
High availability (HA) connection mirroring fails. Traffic disrupted while tmm restarts.
Workaround:
None.
Fix:
TMM now processes TLS traffic as expected.
754944-1 : AVR reporting UI does not follow best practices
Solution Article: K00432398
754901-1 : Frequent zone update notifications may cause TMM to restart
Component: Global Traffic Manager (DNS)
Symptoms:
When there are frequent zone update notifications, the watchdog for TMM may trip and TMM crash/restarts. There may also be 'clock advanced' messages in /var/log/ltm.
Conditions:
- Using DNS express.
- DNS zone with allow notify.
- Frequent zone NOTIFY messages resulting in zone transfers.
Impact:
TMM restart potentially resulting in failing or impacting services. Traffic disrupted while tmm restarts.
Workaround:
None.
Fix:
Frequent zone update notifications no longer cause TMM to restart.
754875-1 : Enable FIPS in prelicensed VE images without requiring a reboot
Component: Local Traffic Manager
Symptoms:
Must reboot a FIPS-enabled PAYG-Best BIG-IP Virtual Edition (VE) image to see the FIPS prompt.
Conditions:
-- Using FIPS.
-- Using PAYG-Best.
-- Using VE.
Impact:
Must reboot the system to see the FIPS prompt.
Workaround:
Reboot the system to see the FIPS prompt.
Fix:
This release enables FIPS in prelicensed VE images without requiring a reboot.
Behavior Change:
You no longer need to reboot a FIPS-enabled PAYG-Best VE image to see the FIPS prompt.
754841-1 : Policy updates stall and never complete
Component: Application Security Manager
Symptoms:
When applying new or updated ASM policies, the update process stalls and never returns.
This error is logged in /var/log/asm:
crit perl[7333]: 01310027:2: ASM subsystem error (bd_agent,F5::BdAgent::start): No ack received from BD after 600 seconds -- aborting.
Conditions:
This can occur intermittently when making policy updates.
Impact:
The policy update is not applied, and you are unable to make configuration changes.
Workaround:
Restart ASM:
bigstart restart asm
Fix:
The system now handles the application of new or updated ASM policies so that the issue no longer occurs.
754805 : Possible tmm crash when AFM DoS badactor or attacked-dst or endpoint vector configured
Solution Article: K97981358
Component: Advanced Firewall Manager
Symptoms:
tmm might crash and restart.
Conditions:
When AFM DoS badactor or attacked dst is configured on a vector, there is a race condition which can cause tmm to crash. The same race condition is present when single endpoint vectors are configured.
Impact:
Tmm crashes. Traffic disrupted while tmm restarts.
Workaround:
None.
Fix:
The race condition is now fixed.
754691-1 : During failover, an OSPF routing daemon may crash.
Component: TMOS
Symptoms:
With a specific OSPF configuration, during a failover, a peer which is changed from standby to active may experience an ospfd daemon crash.
Conditions:
High availability configuration with a routing configuration:
1) access-list with 0.0.0.0/0 filtering:
access-list 199 remark test
access-list 199 deny ip host 0.0.0.0 host 0.0.0.0
access-list 199 permit ip any any
2) OSPF router with this access-list:
router ospf 1
ospf router-id 10.14.0.11
bfd all-interfaces
network 10.14.0.0/16 area 0.0.0.1
distribute-list 199 in
!
-- The device with this configuration is in the standby state.
-- A failover occurs.
Impact:
An OSPF daemon crashes, losing routing information and OSPF dynamic routes for a moment while ospfd daemon restarts.
Workaround:
None.
Fix:
An ospfd daemon no longer crashes during a failover.
754615-2 : Tmm crash (assert) during SIP message processing on MRF-SIP-ALG setup.
Component: Service Provider
Symptoms:
tmm crashes.
Conditions:
-- SIP calls under load.
-- MRF-SIP-ALG setup.
-- Most of the calls re-use the conn flow.
Impact:
Traffic disrupted while tmm restarts.
Workaround:
No workaround.
Fix:
If connections reach a threshold value of 64500, the connection is dropped, drop stats are updated, and a log message is reported: Message handling threshold reached on flow.
754542-2 : TMM may crash when using RADIUS Accounting agent
Component: Access Policy Manager
Symptoms:
TMM may crash when using RADIUS Accounting agent in either per-session or per-request policy.
Conditions:
- APM is provisioned and licensed.
- RADIUS Accounting agent is used in either per-session or per-request policy.
Impact:
TMM crashes. Traffic disrupted while tmm restarts.
Workaround:
None.
Fix:
TMM no longer crashes when RADIUS Accounting agent is used in the access policy.
754541-2 : Reconfiguring an iApp that uses a client SSL profile fails
Component: TMOS
Symptoms:
As a result of this issue, you may encounter one or more of the following symptoms:
-- A virtual server is created but no client SSL profile is applied.
-- In the /var/log/ltm file, the system logs messages similar to the following example:
err mcpd[6434]: 01b4002b:3: Client SSL profile (/Common/Example.app/Example_client-ssl): the profile has no RSA cert/key pair that can be modified. To add RSA cert/key, please use [cert-key-chain add]
Conditions:
This issue occurs when the following conditions are met:
-- Attempting to reconfigure an iApp.
-- The iApp contains a client SSL profile.
Impact:
The system fails to create and apply the client SSL profile to the virtual server.
Workaround:
To work around this issue, you can temporarily disable SSL in the iApp, and then enable it again.
Impact of workaround:
Reconfiguring your iApp reconfigures all BIG-IP objects associated with the iApp. This might cause service disruptions to the application the iApp has been deployed for.
1. Navigate to the impacted iApp in GUI:
iApps :: Application Services : Applications :: Example.
2. Find the setting associated with the client SSL profile, often titled "How should the BIG-IP system handle SSL traffic?"
3. Change the associated setting to one that does not imply the use of SSL, for example: "Plain text to and from both clients and servers."
4. Press the Reconfigure button.
5. Return to the same question and change the field back to its original setting.
6. Press the Reconfigure button once more.
Fix:
Reconfiguring an iApp that uses a client SSL profile now succeeds as expected.
This issue is resolved in the following release candidates:
f5.microsoft_exchange_2016.v1.0.3rc5.tmpl
f5.microsoft_exchange_2016.v1.0.3rc6.tmpl
Issues resolved:
- Corrected an issue that caused TCL iApps using client-ssl profiles to break when the iApp was reconfigured. This issue only affected iApps running on BIG-IP 14.1.
754525-1 : Disabled virtual server accepts and serves traffic after restart
Component: Local Traffic Manager
Symptoms:
Disabled virtual servers accept traffic after being upgraded to an affected version, or after restarting.
Conditions:
1. A virtual server is configured on pre-v14.1.0.
2. Disable the virtual server.
3. Either upgrade to an affected version, or restart the system.
Impact:
The virtual server remains 'Disabled', but it accepts and processes traffic.
Workaround:
To correct the behavior, manually enable/disable the virtual server.
Fix:
Disabled virtual servers no longer process traffic after a restart.
754500-2 : GUI LTM Policy options disappearing
Component: TMOS
Symptoms:
Listed policies disappear under 'Do the following when traffic is matched' in Local Traffic :: Policies : Policy List :: {Rule Name} when pressing Cancel or Save and opening the list again.
Conditions:
Click the Cancel or Save button on the Local Traffic :: Policies : Policy List :: /Common/policy1:rule1 properties page.
Here are some specific steps to reproduce this issue (this procedure assumes you have at least one policy with at least one rule defined):
1. Navigate to Local Traffic :: Policies : Policy List :: /Common/policy1:rule1 to open the rule1 properties page.
2. In the section 'Do the following when the traffic is matched', click to open the first dropdown menu.
- The system lists all of the items.
3. Click Cancel.
4. Click to reopen the properties page, and click the first dropdown menu.
- The system lists fewer of the options.
5. Repeat steps 3 and 4.
Impact:
Options disappear from the list each time you click Cancel or Save. Cannot select options because they are no longer visible in the list.
Workaround:
To return all options to the list, use the refresh button in the browser.
You can also use the following the tmsh command:
modify ltm policy Drafts/<policy name> modify { <rule name> { actions add { ...
Fix:
Policies no longer disappear under these conditions.
754425-1 : Exported requests cannot be opened in Internet Explorer or Edge browser
Component: Application Security Manager
Symptoms:
Any exported report (requests/correlation/learning) cannot be opened in Microsoft Internet Explorer (IE) or Edge brower due to javascript error
Conditions:
Viewing an exported report using IE or Edge.
Impact:
Unable to view the exported report.
Workaround:
Use a different browser.
Fix:
Exported files are now visible in all officially supported browsers.
754420-1 : Missing policy name in exported ASM request details
Component: Application Security Manager
Symptoms:
No Policy name in exported ASM Request details.
Conditions:
This is encountered when viewing the Security Events Report.
Impact:
Missing policy name in request details.
Workaround:
None.
Fix:
Policy name is now displayed in exported ASM request details.
754365-5 : Updated flags for countries that changed their flags since 2010
Component: Application Security Manager
Symptoms:
Old flags for countries that changed their flags since 2010.
Conditions:
Requests from one of the following counties:
-- Myanmar
-- Iraq
-- Libya
Impact:
Old flag is shown.
Workaround:
None.
Fix:
The three flags are now updated in ASM.
754346-2 : Access policy was not found while creating configuration snapshot.
Component: Access Policy Manager
Symptoms:
APMD fails to create configuration snapshot with the following error:
--err apmd[16675]: 01490000:3: AccessPolicyProcessor/AccessPolicyProcessor.cpp func: "dispatchEvent()" line: 1195 Msg: EXCEPTION AccessPolicyProcessor/ProfileAccess.cpp line:234 function: snapshotConfigVariables - AccessPolicy ("/Common/myPolicy") not found while creating configuration snapshot!!!!
If you attempt to modify the policy in question, the system reports a second error:
-- err apmd[16675]: 01490089:3: 00000000: Configuration change notification received for an unknown access profile: /Common/myPolicy
Conditions:
If TMM restarts and new access policy is added before TMM is fully up and running.
Impact:
Configuration snapshot is not created, and users cannot log on.
Workaround:
Recreate the access profile when TMM is stable.
754345-2 : WebUI does not follow best security practices
Solution Article: K79902360
754143-1 : TCP connection may hang after finished
Component: Local Traffic Manager
Symptoms:
TCP connections hang. Memory usage increases. TMM restarts.
Numerous hanging connections reported similar to the following:
-- config # tmsh show sys conn protocol tcp
Sys::Connections
10.0.0.1:5854 10.0.0.250:80 any6.any any6.any tcp 449 (tmm: 0) none none
10.0.0.1:5847 10.0.0.250:80 any6.any any6.any tcp 449 (tmm: 0) none none
10.0.0.1:5890 10.0.0.250:80 any6.any any6.any tcp 449 (tmm: 0) none none
10.0.0.1:5855 10.0.0.250:80 any6.any any6.any tcp 449 (tmm: 0) none none
10.0.0.1:5891 10.0.0.250:80 any6.any any6.any tcp 449 (tmm: 0) none none
Conditions:
Pool member fails to respond with an ACK to BIG-IP system serverside FIN. The BIG-IP system serverside connection eventually times out, and the clientside connection is orphaned.
Impact:
Those connections hang indefinitely (even past the idle timeout). Memory increases, eventually leading to a possible TMM out-of-memory condition, requiring a TMM restart. Traffic disrupted while tmm restarts.
Workaround:
None.
Fix:
TCP connections no longer hang under these conditions.
754109-1 : ASM/Bot-Defense/DoSL7 content-security-policy header modification violates Content Security Policy directive
Component: Application Security Manager
Symptoms:
When the backend server sends a content-security-policy header where source-src and default-src directives are missing, ASM will modify the header when it does its own JavaScript injection, which might cause a csp policy violation for inline JavaScript code.
Conditions:
-- ASM provisioned.
-- ASM or Bot-Defense/DoS attached on a virtual server.
-- ASM or Bot/Dos does inline injections, like CSRF/CSHUI.
Impact:
Inline JavaScript does not run. The Browser reports a content-security-policy violation.
Workaround:
You can use either of the following workarounds:
-- Disable csp in ASM by running the following commands:
/usr/share/ts/bin/add_del_internal add csp_enabled 0
bigstart restart asm
-- Disable csp in Bot/DoS using an iRule:
when HTTP_REQUEST {
set csp 0
}
when HTTP_RESPONSE {
if { [HTTP::header exists Content-Security-Policy] } {
set csp "[HTTP::header values Content-Security-Policy]"
}
}
when HTTP_RESPONSE_RELEASE {
if { $csp != 0 } {
HTTP::header replace Content-Security-Policy $csp
}
set csp 0
}
Fix:
ASM/Bot/DoSL7 no longer modifies the csp header when both source-src and default-src directives are missing.
754103-1 : iRulesLX NodeJS daemon does not follow best security practices
Solution Article: K75532331
754066-1 : Newly added Systems are not added as part of installing a Server Technologies update file
Component: Application Security Manager
Symptoms:
Newly added Systems are not added as part of installing a Server Technologies update file, which prevents acceptance of Server Technology suggestion.
Conditions:
A Server Technology update file contained newly added Systems is installed.
Impact:
A suggestion to add a Server Technology using a newly added System cannot be accepted.
Workaround:
The corresponding ASM Signature update file must be loaded first.
Fix:
Newly added Systems are added correctly after installing Server Technology update file.
754003-3 : Configuring SSL Forward Proxy and an OCSP stapling profile may allow a connection to a website with a revoked certificate
Solution Article: K73202036
Component: Local Traffic Manager
Symptoms:
For more information please see: https://support.f5.com/csp/article/K73202036
Conditions:
For more information please see: https://support.f5.com/csp/article/K73202036
Impact:
For more information please see: https://support.f5.com/csp/article/K73202036
Workaround:
None.
Fix:
For more information please see: https://support.f5.com/csp/article/K73202036
753975-2 : TMM may crash while processing HTTP traffic with webacceleration profile
Solution Article: K92411323
753912-4 : UDP flows may not be swept
Solution Article: K44385170
Component: Local Traffic Manager
Symptoms:
Some UDP connection flows do not show in connection table but do show up in stats. This might occur with datagram_lb mode is enabled on the UDP profile under heavy load.
Conditions:
-- UDP profile with datagram_lb mode enabled.
-- System under heavy load.
Impact:
Increased memory utilization of TMM.
Workaround:
None.
Fix:
The system now correctly manages all expired flows.
753796-1 : SNMP does not follow best security practices
Solution Article: K40443301
753776-2 : TMM may consume excessive resources when processing UDP traffic
Solution Article: K07127032
753711-1 : Copied policy does not retain signature staging
Component: Application Security Manager
Symptoms:
When copying a modified policy or a policy that has never been applied, all signatures are set to staging enabled.
Conditions:
Copying a modified policy or policy that has never been applied.
Impact:
All signatures in the copied policy are set to staging enabled.
Workaround:
Export the policy (either as binary or XML) and re-import.
Fix:
Signature staging settings are retained correctly after the policy is copied.
753650-2 : The BIG-IP system reports frequent kernel page allocation failures.
Component: TMOS
Symptoms:
Despite having free memory, the BIG-IP system frequently logs kernel page allocation failures to the /var/log/kern.log file. The first line of the output appears similar to the following example:
swapper/16: page allocation failure: order:2, mode:0x104020
After that, a stack trace follows. Note that the process name in the line ('swapper/16', in this example) varies. You may see generic Linux processes or processes specific to F5 in that line.
Conditions:
This issue is known to occur on the following VIPRION blade models:
- B2250 (A112)
- B4300 (A108)
- B4340N (A110)
- B4450 (A114)
Please note the issue is known to occur regardless of whether or not the system is running in vCMP mode, and regardless of whether the system is Active or Standby.
Impact:
As different processes can experience this issue, the system may behave unpredictably. For example, it is possible for a TMOS installation to fail as a result of this issue. Other processes may not exhibit any side effect as a result of this issue. The exact impact depends on which process becomes affected and how this process is designed to handle such a failure to allocate memory.
Workaround:
You can work around this issue by increasing the value of the min_free_kbytes kernel parameter. This controls the amount of memory that is kept free for use by special reserves.
It is recommend to increase this as follows:
-- 64 MB (65536 KB for 2250 blades)
-- 48 MB (49152 KB for B4300 blades)
-- 128 MB (131072 KB for 4450 blades).
You must do this on each blade installed in the system.
When instantiating this workaround, you must consider whether you want the workaround to survive only reboots, or to survive reboots, upgrades, RMAs, etc. This is an important consideration to make, as you should stop using this workaround when this issue is fixed in a future version of BIG-IP software. So consider the pros and cons of each approach before choosing one.
-- If you want the workaround to survive reboots only, perform the following procedure:
1) Log on to the advanced shell (BASH) of the primary blade of the affected VIPRION system.
2) Run the following commands (with the desired amount in KB):
# clsh "sysctl -w vm.min_free_kbytes=131072"
# clsh "echo -e '\n# Workaround for ID753650' >> /etc/sysctl.conf"
# clsh "echo 'vm.min_free_kbytes = 131072' >> /etc/sysctl.conf"
-- If you want the workaround to survive reboots, upgrades, RMAs, etc., perform the following procedure:
1) Log on to the advanced shell (BASH) of the primary blade of the affected VIPRION system.
2) Run the following commands (with the desired amount in KB):
# clsh "sysctl -w vm.min_free_kbytes=131072"
# echo -e '\n# Workaround for ID753650' >> /config/startup
# echo 'sysctl -w vm.min_free_kbytes=131072' >> /config/startup
Note that the last two commands are not wrapped inside 'clsh' because the /config/startup file is already automatically synchronized across all blades.
Once the issue is fixed in a future BIG-IP version, remove the workarounds:
-- To remove the first workaround:
1) Edit the /etc/sysctl.conf file on all blades and remove the added lines at the bottom.
2) Reboot the system by running 'clsh reboot'. This will restore the min_free_kbytes kernel parameter to its default value for the BIG-IP version you are running.
-- To remove the second workaround:
1) Edit the /config/startup file on the primary blade only, and remove the extra lines at the bottom.
2) Reboot the system by running 'clsh reboot'. This restores the min_free_kbytes kernel parameter to its default value for the BIG-IP version you are running.
To verify the workaround is in place, run the following command (this should return the desired amount in KB):
# clsh "cat /proc/sys/vm/min_free_kbytes"
Fix:
The BIG-IP system no longer experiences kernel page allocation failures.
753642-1 : iHealth may report false positive for Critical Malware
Component: TMOS
Symptoms:
A minor change in the way qkview reports executable filenames may cause iHealth to interpret the presence of malware.
Conditions:
qkview files produced by 14.1.0 when uploaded to ihealth.f5.com
Impact:
iHealth may report a false positive for malware.
Workaround:
Ignore critical errors for malware reported by iHealth for version 14.1.0 only.
Fix:
This is fixed in 14.1.0.1
753564-1 : Attempt to change password using /bin/passwd fails
Component: TMOS
Symptoms:
When we run /bin/passwd as root:
passwd.bin: unable to start pam: Critical error - immediate abort
Failed to change user's password. Exiting.
If we then do /bin/ausearch -m avc -ts recent, we see a lot of selinux denials for passwd.bin.
Conditions:
No special conditions needed
Impact:
Root/admin user cannot change password using the standard /bin/passwd executable.
Workaround:
The workaround would be to disable selinux, change the password and re-enable selinux:
# setenforce Permissive
# passwd
# setenforce Enforcing
Alternatively, one can use the tmsh commands to change the passwords: tmsh modify auth password root
Lastly, if one wishes to modify the selinux policy, there is the standard way of doing this
# ausearch -c passwd.bin --raw | audit2allow -M mypasswd
# semoduile -i mypasswd.pp
Fix:
With fix, we have no issues with /bin/passwd.bin being denied by selinux and /bin/passwd works as expected.
753514-3 : Large configurations containing LTM Policies load slowly
Component: Local Traffic Manager
Symptoms:
Very slow performance when loading a configuration, for example, at system start up. During this time, the tmsh process shows high CPU usage.
Conditions:
Big IP 13.1.x, 14.x. Large configuration (1 MB or larger) and at least one, but more likely tens or hundreds of LTM policies defined in the configuration.
Impact:
Slow configuration loading, or in cases with very large configurations, full config load may fail after a long wait. Slowness increases with overall configuration size and number of LTM policies defined.
Workaround:
None.
Fix:
Large configurations containing LTM Policies load normally.
753485-1 : AVR global settings are being overridden by HA peers
Component: Application Visibility and Reporting
Symptoms:
Configuration of AVR global settings is being overridden by high availability (HA) peers, and thus report incorrectly to BIG-IQ Data Collection Devices (DCDs).
Conditions:
Configuring HA for systems connected to BIG-IQ.
Impact:
Configuration of BIG-IP systems in HA configuration can override each other. This might result in the following behavior:
-- A common symptom is the 'Stats Last Collection Date' shows up as Dec 31, 1969 or Jan 01, 1970, depending the timezone configuration of the device
-- The 'Stats Last Collection Date' shows up as '--'
-- The BIG-IP systems incorrectly identify themselves to BIG-IQ.
-- The BIG-IP systems report to the wrong DCD.
-- The BIG-IP systems report to DCD, even if they are not configured to report at all.
-- The BIG-IP systems do not report at all, even if they are configured to report.
Note: This bug is tightly related to BIG-IQ Bug ID 757423.
Workaround:
None.
Fix:
Synchronization of relevant fields on AVR global settings are disabled, so this issue no longer occurs.
753446-2 : avrd process crash during shutdown if connected to BIG-IQ
Component: Application Visibility and Reporting
Symptoms:
During shutdown of BIG-IP, if it is connected to BIG-IQ then avrd might crash.
Conditions:
BIG-IP is set to shutdown and configured to send statistics to BIG-IQ.
Impact:
No serious impact, since the BIG-IP is already instructed to shutdown, so the process crash is not causing any damage.
Workaround:
N/A
Fix:
Issue is fixed, avrd does not crash during shutdown
753370-3 : RADIUS auth might not be working as configured when there is change in RADIUS auth config name.
Component: Access Policy Manager
Symptoms:
RADIUS auth might not be working as configured when there is change in RADIUS auth config name. You might also see an error:
err apmd[14182]: 01490108:3: /Common/:Common:cc55b9e2: RADIUS module: authentication with 'testuser@example' failed: no response from server (0).
Conditions:
In an LTM pool that uses APM AAA RADIUS to authenticate, change (modify/delete) the name of the RADIUS authentication server in config file.
Impact:
When using tmm.default version, intermittently MCP error messages in tmm logs indicate that the RADIUS server cannot be found, and RADIUS authentication does not work as expected.
Workaround:
None.
753295-1 : ASM REST: All signatures being returned for policy Signatures regardless of signature sets
Component: Application Security Manager
Symptoms:
By default, only signatures that are included in the Security Policy enforcement via the Policy's Signature Sets are included in the response to /tm/asm/policies/<ID>/signatures.
Additionally, there should be the capability to $filter for either signatures that are in the policy or not in the policy.
These filters are not working
Conditions:
ASM REST/GUI is used to determine the number of signatures enabled on a Security Policy
Impact:
More data that expected will be returned to REST clients which may cause confusion.
Learning statistics/graphs may have confusing/incorrect numbers.
Workaround:
None
Fix:
inPolicy $filter works again, and the default behavior only returns the signatures that are in the policy.
753163-4 : PEM does not initiate connection request with PCRF/OCS if failover occurs after 26 days
Component: Policy Enforcement Manager
Symptoms:
No connection request with PCRF/OCS if high availability (HA) failover occurs after 26 days. tmm crash
Conditions:
-- Using PEM.
-- high availability (HA) failover occurs after 26 days.
Impact:
PEM does send the reconnect request within the configured reconnect, so there is no connection initiated with PCRF/OCS.
Workaround:
To restart the connection, restart tmm restart using the following command:
tmm restart
Note: Traffic disrupted while tmm restarts.
Fix:
PEM now initiates the connection with PCRF/OCS under these conditions.
753028-2 : AFM drops forwarding ICMP traffic matching FW NAT rule for Dest NAT that also has Proxy ARP enabled for destination addresses in the rule
Component: Advanced Firewall Manager
Symptoms:
When Proxy ARP is enabled for destination addresses in an FW NAT rule performing destination NAT (static-nat/static-pat), forwarding ICMP traffic matching that rule is incorrectly dropped by AFM instead of being forwarded through the BIG-IP system.
Conditions:
-- Proxy ARP is enabled for destination addresses in an FW NAT rule.
-- The BIG-IP system (AFM) receives forwarding ICMP traffic for these (untranslated) destination addresses.
Impact:
Forwarding ICMP traffic is dropped by the BIG-IP system.
Workaround:
You can disable Proxy ARP functionality for FW NAT rules to cause the BIG-IP system (AFM) to handle forwarding ICMP traffic correctly and pass it through the system to the backend.
However, this causes the BIG-IP system to not respond to ARP requests anymore for destination addresses in such rules. As a further mitigation action, you can configure static ARP entries to handle this.
Fix:
The BIG-IP system (AFM) now correctly forwards ICMP traffic through to the backend when Proxy ARP is enabled on destination addresses in the matching FW NAT rule.
752942-1 : Live Update cannot be used by Administrator users other than 'admin' and 'root'
Component: Application Security Manager
Symptoms:
When users configured with the Administrator role log into the system, they are not allowed to install security update files on the new live-update page:
System :: Software Management : Live Update
Conditions:
Logged in BIG-IP user is not 'admin' (the built-in Administrator account for the TMUI) or 'root' (the built-in Administrator account for the TMSH).
Impact:
Cannot apply security updates.
Workaround:
To install the security updates, log in as 'admin' or a BIG-IP user configured as a web-application-security-administrator or web-application-security-editor (role must be configured on all partitions or at least on the Common partition).
Fix:
Any BIG-IP user configured as Administrator can now apply security updates.
752930-3 : Changing route-domain on partitions leads to Secondary blade reboot loop and virtual servers left in unusual state
Component: Local Traffic Manager
Symptoms:
Virtual Servers left in unknown state. Blade keeps restarting.
Conditions:
Change default route domain (RD) of partition with wildcard Virtual Servers.
Impact:
-- Cannot persist the wildcard virtual server RD configuration.
-- Changing virtual server description after moving route-domain fails.
-- Secondary blade in constant reboot loop or mcpd process restarting loop.
Workaround:
1. Delete wildcard virtual servers before changing default route-domain on partition.
2. Execute the following commands, in sequence, substituting your values for the configuration-specific ones in this example:
# ssh slot2 bigstart stop
# modify auth partition pa-1098-blkbbsi0000csa21ad1142 default-route-domain 109
# save sys config
# clsh rm -f /var/db/mcpdb.bin
# ssh slot2 bigstart start
Note: This recovery method might have to be executed multiple times to restore a working setup.
752875-2 : tmm core while using service chaining for SSLO
Component: Access Policy Manager
Symptoms:
tmm cores when using security services (service connect agent in per-request policies) for SSLO deployment.
Conditions:
-- Service connect agent in per-request policy.
-- SSLO deployment.
Impact:
tmm cores. Traffic disrupted while tmm restarts.
Workaround:
None.
Fix:
tmm no longer cores when using security services (service connect agent in per-request policies) for SSLO deployment.
752835-2 : Mitigate mcpd out of memory error with auto-sync enabled.
Solution Article: K46971044
Component: TMOS
Symptoms:
If auto-sync is enabled and many configuration changes are sent quickly, it is possible for a peer system to fall behind in syncs. Once it does, it will exponentially get further behind due to extra sync data, leading to the sending mcpd running out of memory and core dumping.
Conditions:
-- Auto-sync enabled in an high availability (HA) pair.
-- High volume of configuration changes made in rapid succession. Typically, this requires hundreds or thousands of changes per minute for several minutes to encounter this condition.
Impact:
Mcpd crashes.
Workaround:
There are no workarounds other than not using auto-sync, or reducing the frequency of system configuration changes.
Fix:
This is not a complete fix. It is still possible for mcpd to run out of memory due to a peer not processing sync messages quickly enough. It does, however, make it more difficult for this scenario to happen, so configuration changes with auto-sync on can be sent somewhat more quickly without crashing mcpd as often.
752822-1 : SIP MRF INGRESS_ALG_TRANSLATION_FAIL state has incorrect state_type
Component: Service Provider
Symptoms:
SIP ALG calls that fail translation during ingress are not cleaned up by the system, which might result in memory being leaked inside the TMM processes.
Conditions:
SIP ALG calls that fail translation during ingress.
Impact:
TMM leaks memory, which can slow down performance and eventually cause TMM to run out of memory and restart. Traffic disrupted while tmm restarts.
Workaround:
None.
Fix:
The system now cleans up SIP ALG calls that fail translation during ingress, so this issue no longer occurs.
752803-1 : CLASSIFICATION_DETECTED running reject can lead to a tmm core
Component: Traffic Classification Engine
Symptoms:
When the CLASSIFICATION_DETECTED event is run on a serverside flow, and then an iRule command (e.g., to reject a flow) is run, tmm crashes.
Conditions:
-- CLASSIFICATION_DETECTED event runs on a serverside flow.
-- An iRule command runs (e.g., reject a flow).
Impact:
tmm crashes. Traffic disrupted while tmm restarts.
Workaround:
None.
Fix:
tmm no longer crashes under these conditions.
752782-1 : 'DataSafe Profiles' menu has changed to 'BIG-IP DataSafe'
Component: Fraud Protection Services
Symptoms:
The 'DataSafe Profiles' menu has changed to 'BIG-IP DataSafe'.
Conditions:
FPS Provisioning and a DataSafe license.
Impact:
The menu name has changed in this release.
Workaround:
None.
Fix:
'DataSafe Profiles' menu has changed to 'BIG-IP DataSafe'.
752592-1 : VMware Horizon PCoIP clients may fail to connect shortly after logout
Component: Access Policy Manager
Symptoms:
Sometimes if user closes opened PCoIP desktop and logs out and then logs in again, he can't launch the same desktop anymore.
Conditions:
PCoIP UDP VS has "vdi" profile assigned.
Impact:
User can't open PCoIP remote desktop during short time period (1 minute).
Workaround:
Remove "vdi" profile and assign "remotedesktop" profile to the PCoIP UDP VS:
# tmsh modify ltm virtual <PCoIP UDP VS> profiles delete { vdi }
# tmsh modify ltm virtual <PCoIP UDP VS> profiles add { remotedesktop }
In admin UI the assignment of "remotedesktop" profile can be controlled via "Application Tunnels (Java & Per-App VPN)" checkbox (right under "VDI Profile" dropdown).
Fix:
Assignment of "vdi" profile to PCoIP UDP VS does not cause intermittent connection problems anymore.
752363-2 : Internally forwarded flows can get dropped with AFM L4 BDoS feature enabled
Component: Advanced Firewall Manager
Symptoms:
Client request fails, due to being dropped on the BIG-IP system.
Conditions:
-- The BIG-IP AFM L4 BDoS feature is enabled.
-- Virtual server setup is such that the client-facing virtual server's destination is forwarded through another virtual server, which is an internally forwarded flow.
Impact:
Client request gets dropped due to BIG-IP AFM dropping the flow.
Workaround:
Disable BDoS feature. The feature can be disabled using the following commands:
-- To disable BDoS globally, run the following command:
modify security dos device-config dos-device-config dynamic-signatures { network { detection disabled mitigation none }}
To disable BDoS globally per-profile, run the following command:
modify security dos profile <profile-name> dos-network modify { test { dynamic-signatures { detection disabled mitigation none } } }
modify security dos profile test protocol-dns modify { test { dynamic-signatures { detection disabled mitigation none } } }
Fix:
The system now handles the looped flows properly, so the BDoS module does not incorrectly cause the packet to be dropped.
752078-2 : Header Field Value String Corruption
Component: Local Traffic Manager
Symptoms:
This is specific to HTTP/2.
In some rare cases, the header field value string can have one or more of its prefix characters removed by the BIG-IP system.
Conditions:
-- The header field value string is exceptionally long, and has embedded whitespace characters.
-- HTTP/2 is used.
Impact:
A header such as:
x-info: very_long_string that has whitespace characters
may be sent to the client as:
x-info: ery_long_string that has whitespace characters
Workaround:
None.
Fix:
The BIG-IP system no longer removes the prefix characters from very long HTTP/2 header field value strings containing embedded whitespace characters.
752047-1 : iRule running reject in CLASSIFICATION_DETECTED event can cause core
Component: Traffic Classification Engine
Symptoms:
The CLASSIFICATION_DETECTED iRule event can run very early when classification happens in the classification database (srdb). If the iRule then issues a reject command, tmm cores.
Conditions:
CLASSIFICATION_DETECTED on L4 executing reject command.
Impact:
tmm restarts. Traffic disrupted while tmm restarts.
Workaround:
None.
Fix:
iRule running reject in CLASSIFICATION_DETECTED event no longer causes tmm core.
751869-2 : Possible tmm crash when using manual mode mitigation in DoS Profile
Component: Advanced Firewall Manager
Symptoms:
tmm crash and restart is possible when using manual mode mitigation in DoS Profile.
Conditions:
When manual mode mitigation is used for any vector that is enabled in the DoS Profile that is attached to a Protected Object.
Impact:
tmm crash and restart is possible. Traffic disrupted while tmm restarts.
Workaround:
None.
Fix:
tmm crash and restart no longer occurs when using manual mode mitigation in DoS Profile.
751824-1 : Restore old 'merge' functionally with new tmsh verb 'replace'
Component: TMOS
Symptoms:
Prior to v12.1.3.4, the 'merge' command merged a specified config with the existing config, replacing certain conflicting values. In this release, the merge command operates differently, so there is a new command, 'replace', to now perform the operation previously accomplished with 'merge'.
Conditions:
Running the following command:
tmsh load /sys config file <scf-filename> merge
Impact:
Operation does not work like it did in previous releases.
Workaround:
None.
Fix:
This release restores the merge functionally from v12.x and earlier with a new tmsh verb: replace. The new TMSH command is as follows:
tmsh load sys config file <filepath> replace
Behavior Change:
This release restores the merge functionally from v12.x and earlier with a new tmsh verb: replace. The new TMSH command is as follows:
tmsh load sys config file <filepath> replace
The merge command now operates as follows:
-- Previously: if a top-level object (virtual server) existed in the config and also in the merge file, the top-level object was replaced.
-- Now: if a top-level object (virtual server) exists in both, the top-level object is recursively merged. (Pool members are merged together. LTM virtual server profiles are merged together (appended vs. replace-all-with)).
751807-1 : SSL Orchestrator may not activate service connectors if traffic is an HTTP tunnel
Component: Access Policy Manager
Symptoms:
Decrypted traffic is not forwarded to services despite even though a matching rule action in security policy selects a service chain.
Conditions:
-- Matching rule action in security policy selects a service chain.
-- Traffic is an HTTP tunnel (CONNECT method) is accepted by an outbound transparent proxy created by SSL Orchestrator.
Impact:
No visibility to decrypted traffic if it is an HTTP tunnel through SSL Orchestrator.
Workaround:
None.
Fix:
Decrypted traffic is forwarded as expected to services, when matching rule action in security policy selects a service chain, for HTTP tunnel traffic sent through SSL Orchestrator.
751710-4 : False positive cookie hijacking violation
Component: Application Security Manager
Symptoms:
A false positive cookie hijacking violation.
Conditions:
-- Several sites are configured on the policy, without subdomain.
-- TS cookies are sent with the higher domain level then the configured.
-- A single cookie from another host (that belongs to the same policy) arrives and is mistaken as the other site cookie.
Impact:
False positive violation / blocking.
Workaround:
N/A
751636-1 : Downgrading from v14.1.0 to a previous release leaves two directories with improper ownership★
Component: TMOS
Symptoms:
Downgrading from BIG-IP version 14.1.0 to an earlier version, the group ID of /var/lock and /var/spool/mail are incorrect. This can be encountered after you boot into the earlier-versioned software image. /var/log/liveinstall.log contains the following messages:
-- info: RPM: filesystem-2.4.30-3.el6.0.0.10.i686
-- info: RPM: warning: group lock does not exist - using root
-- info: RPM: warning: group mail does not exist - using root
When running the following command:
config # rpm -V filesystem
......G.. /var/lock
......G.. /var/spool/mail
The expected results are as follows:
config # rpm -V filesystem
config # stat -c %G /var/lock
lock
config # stat -c %G /var/spool/mail
mail
In this version, the results are as follows:
config # rpm -V filesystem
config # stat -c %G /var/lock
root
config # stat -c %G /var/spool/mail
root
Conditions:
-- BIG-IP version 14.1.0 is running.
-- An earlier software version is installed.
-- The system is then booted into that earlier version.
Impact:
There is no known impact to the system if this occurs; however, running rpm -V will report these two discrepancies.
This occurs because rpm versions 4.8 and earlier have built-in recognition of exactly three group names; 'root', 'mail', and 'lock'. In v4.8, these special names appear in <src>/lib/misc.c:gnameToGid. To use the group names 'mail' and 'lock' as intended, all BIG-IP releases earlier than BIG-IP v14.1.0 rely on this special feature of rpm.
BIG-IP v14.1.0 moved to rpm version 4.11, in which the function no longer exists.
Workaround:
Using a shell command, correct the group ID of the two directories that are incorrect using the following two commands:
config # chgrp lock /var/lock
config # chgrp mail /var/spool/mail
751586 : http2 virtual does not honour translate-address disabled
Component: Local Traffic Manager
Symptoms:
translate-address disabled on a http2 virtual is getting ignored
Conditions:
http2 virtual and translate-address disabled configured
Impact:
The traffic is translated to the destination address to the pool member
Workaround:
none
Fix:
translate-address disabled is working correctly now.
751573-1 : Updates to HSL pool members may not take effect
Component: TMOS
Symptoms:
High Speed Logging (HSL) does not respect the configured pool's changes and continues to send logs to the previous state of the pool.
For example, consider the following configuration:
-- HSL configured to send logs to pool (pool-HSL) where pool-HSL has 2 members: pm-1, and pm-2.
-- There is a manual update to pool-HSL to remove pm-2, or a monitor marks pm-2 down.
-- That change is not honored, and HSL continues to send logs to pm-2.
Conditions:
-- High Speed Logging configured to log to a pool of multiple members.
-- Pool members change manually or due to a monitoring probe.
-- Running one of the known affected TMOS versions.
Impact:
HSL logs continue being forwarded according to the previous state of the configured pool. The new state is not reflected.
Workaround:
None.
Fix:
Updates to pool members used as HSL destination are correctly reflected in HSL log forwarding.
751424-1 : HTTP Connect Category Lookup not working properly
Component: Access Policy Manager
Symptoms:
1. HTTP Connect Category Lookup does not return the correct category.
2. HTTP Connect Category Lookup cannot attach the service chain correctly.
Conditions:
-- Using SSLO iApp to configure a security policy.
-- Choose conditions 'Category Lookup (All)' and '"Category Lookup (HTTP Connect)'.
Impact:
Service chain is not correctly triggered based on the SSLO iApp policy selection when HTTP Connect traffic is passed.
Workaround:
There is no workaround at this time.
Fix:
1. The Access Per-request Policy HTTP Connect Category Lookup agent now returns the correct category ID.
2. Service connector is now inserted correctly, which ensures the correct behavior when dealing with HTTP Connect tunnel traffic.
751292-1 : mcpd core after changing parent netflow to use version9
Component: Advanced Firewall Manager
Symptoms:
When making changes to netflow profile (changing between v9 and v5), mcpd CPU usage on one core goes high, and a core file is written.
The problem occurs only when modifying root netflow profile that is referenced by a child netflow. Modifying the root netflow profile works as expected when it is not being referred to by any child netflow. When the issue occurs, mcpd gets into a loop and hangs there for a long time.
Conditions:
The problem occurs only when modifying root netflow profile that is referenced by a child netflow.
Impact:
The config changes appear to have been made. However, mcpd processes the config and stops responding. While mcpd restarts, there is no traffic management functionality (e.g., cannot retrieve or update system status, cannot reconfigure system, other daemons are not functional).
Workaround:
No workaround.
751179-1 : MRF: Race condition may create to many outgoing connections to a peer
Component: Service Provider
Symptoms:
If two different connections attempt to create an outgoing connection to a peer at the same time, multiple connections may be created, even if the peer object is configured for one connection per peer. This is due to a race condition in message routing framework during connection creation.
Conditions:
-- Two different connections attempt to create an outgoing connection to a peer at the same time.
-- The peer is configured for one connection per peer.
Impact:
More than one connection to a peer is created.
Workaround:
None.
Fix:
Only one connection is created under these conditions.
751152-1 : OpenSSL Vulnerability: CVE-2018-5407
Solution Article: K49711130
751143-1 : OpenSSL Vulnerability: CVE-2018-5407
Solution Article: K49711130
751052-1 : HTTP iRule event HTTP_REJECT broken
Component: Local Traffic Manager
Symptoms:
When an action causes an HTTP_REJECT event to be triggered, the content isn't executed, and BIG-IP logs an error log message that the event aborted:
info tmm[16852]: 01220009:6: Pending rule (null) <HTTP_REJECT> aborted
Conditions:
Any actions that cause an HTTP_REJECT event to be triggered.
Impact:
iRule content is not executed and the iRule action is aborted.
Fix:
Fixed an issue with the HTTP_REJECT event
751011-3 : ihealth.sh script and qkview locking mechanism not working
Component: TMOS
Symptoms:
Two qkviews can be started up on a system at the same time, which results in conflicts for each.
Conditions:
Running qkview on one terminal and then ihealth.sh in another.
Impact:
Running of two qkviews at the same time breaks both qkviews since they compete for the same files.
Workaround:
Run either qkview or ihealth.sh, not both simultaneously.
Fix:
Starting a qkview and then running ihealth.sh halts immediately as the system detects that qkview is running.
751009-3 : Generating Qkviews or tcpdumps via GUI or running the 'ihealth' command removes /var/tmp/mcpd.out
Component: TMOS
Symptoms:
After generating a Qkview or collecting a tcpdump via the BIG-IP GUI, or using the 'tmsh run util ihealth' command to do the equivalent, the /var/tmp/mcpd.out file is missing.
Conditions:
-- Generating a Qkview or collecting a tcpdump via the BIG-IP GUI.
-- Using the 'tmsh run util ihealth' command to do the equivalent operation.
Impact:
The file /var/tmp/mpcd.out is a debug file used by mcpd, primarily for collecting debug-level log information from MCPD.
The file being deleted causes challenges with trying to collect diagnostic information from a BIG-IP system (turning on mcpd debug logging), because it now requires a service impact (restarting mcpd).
Additionally, may cause challenges in managing disk space on /shared filesystem, as mcpd keeps writing to a deleted file, and it cannot be truncated.
Workaround:
Generating Qkviews by invoking the 'qkview' command directly avoids this issue.
Edit the /usr/bin/ihealth.sh script to remove the corresponding line.
From a bash shell:
1. mount -o remount,rw /usr
2. /bin/cp /usr/bin/ihealth.sh{,751009.bak}
3. sed -i '/\/bin\/rm -f \/var\/tmp\/mcpd.out/d' /usr/bin/ihealth.sh
4. mount -o remount,ro /usr
Note: This workaround does not persist across software installs/upgrades, nor does it ConfigSync or replicate across blades in a VIPRION chassis.
Fix:
The problem line has been removed from the script, so this mcpd debug file is left alone (not deleted) after running ihealth.sh. Note that the GUI version of running qkview uses ihealth.sh script.
750973-1 : Import XML policy error
Component: Application Security Manager
Symptoms:
Import XML policy fails with errors:
--------
The security policy file does not conform to the schema and cannot be imported
element attack_type: Schemas validity error : Element
'attack_type': 'Web Scraping' is not a valid value
--------
Conditions:
-- A user-defined Signature Set having Attack Type 'Web Scraping' defined.
-- This Signature Set is included in an exported XML policy.
Impact:
Schema validation on XML policy import fails. Import XML policy fails with errors.
Workaround:
Use binary policy export/import.
Fix:
This release fixes the XML policy export/import process to not fail or produce Attack Type 'Web Scraping'-related errors.
750922-1 : BD crash when content profile used for login page has no parse parameters set
Component: Application Security Manager
Symptoms:
Bd crashes. No traffic goes through ASM.
Conditions:
-- A Json Login page is configured.
-- The content profile used for the login page does not have parse parameters set.
Impact:
No traffic goes through ASM. Bd crashes.
Workaround:
Set the parse parameters setting.
Fix:
BD no longer crashes when the content profile used for login page has no parse parameters set.
750823-1 : Potential memory leaks in TMM when Access::policy evaluate command failed to send the request to APMD
Component: Access Policy Manager
Symptoms:
Memory usage in TMM keeps going up.
Conditions:
Access::policy evaluate command fails with error message in /var/log/ltm:
TCL error: ... - Failed to forward request to apmd.
Impact:
Memory leaks in TMM, which cause a TMM crash eventually.
Workaround:
Limit the amount of data that will be forwarded to APMD.
750793-2 : Impossible to remove Bot profiles, Logging profiles, and Cloud Security Service profiles from a user-defined partition
Component: Application Security Manager
Symptoms:
Removing Bot/Logging/Security Service profiles that were created in a user-defined partition fails via GUI.
Conditions:
Attempting to delete Bot/Logging/Security Service profiles that were created in a user-defined partition.
Impact:
The Bot/Logging/Security Service Profile cannot be deleted via GUI.
Workaround:
Remove Bot/Logging/Cloud Security Service profiles via TMSH.
Fix:
You can now remove Bot profiles, Logging profiles, and Cloud Security Service profiles from user-defined partition.
750689-3 : Request Log: Accept Request button available when not needed
Component: Application Security Manager
Symptoms:
There are several violations that make requests unlearnable, but the Accept Request Button is still enabled.
Conditions:
This occurs in the following scenarios:
1. Request log has requests with following violations that make requests unlearnable:
- Threat Campaign detected.
- Null character found in WebSocket text message.
- Access from disallowed User/Session/IP/Device ID.
- Failed to convert character.
2. Subviolations of HTTP protocol compliance fails violation:
- Unparsable request content.
- Null in request.
- Bad HTTP version.
3. Only the following violations are detected:
- Access from malicious IP address.
- IP address is blacklisted.
- CSRF attack detected.
- Brute Force: Maximum login attempts are exceeded.
Impact:
Accept Request button is available, but pressing it does not change the policy.
Workaround:
None.
Fix:
The Accept Request button is now disabled when there is nothing to be learned from request.
750686-1 : ASE user cannot create or modify a bot signature.
Component: Application Security Manager
Symptoms:
Application Security Editor user role gets a validation exception while trying to create or modify bot defense signature either via GUI, tmsh, or REST.
Conditions:
The logged on user account is configured with an Application Security Editor role.
Impact:
Application Security Editor unable to define user-defined signatures for bot defense module.
Workaround:
Change user role to Administrator or Web Application Security Administrator to create or modify bot defense signatures.
Fix:
User accounts configured for Application Security Editor can now create/modify bot defense signatures.
750683-1 : REST Backwards Compatibility: Cannot modify enforcementMode of host-name
Component: Application Security Manager
Symptoms:
Modifying the enforcementMode value fails with the following message: Valid Host Name already exists in this policy.
In 14.1.0, the capability to treat specific domains as Transparent while the rest of the policy is in Blocking moved from Host Names to the new Microservices feature. The REST endpoint for Host Names (/mgmt/tm/asm/policies/<ID>/host-names) is meant to still support setting and modifying this attribute. However, this is not happening successfully.
Conditions:
-- Running version 14.1.0 software.
-- Using a pre-14.1.0 REST API to modify the enforcementMode of a host name (/mgmt/tm/asm/policies/<ID>/host-names).
Impact:
The value change fails.
Workaround:
You can use either workaround:
-- Change the value using the GUI.
-- Use the newer endpoint: (/mgmt/tm/asm/policies/<ID>/microservices).
Fix:
Using the backwards compatible REST to update the enforcementMode of a host name now succeeds.
750668-1 : Impossible to remove Bot profiles, Logging profiles, and Cloud Security Service profiles from a user-defined partition
Component: Application Security Manager
Symptoms:
Removing Bot/Logging/Security Service profiles that were created in a user-defined partition fails via GUI.
Conditions:
Attempting to delete Bot/Logging/Security Service profiles that were created in a user-defined partition.
Impact:
The Bot/Logging/Security Service Profile cannot be deleted via GUI.
Workaround:
Remove Bot/Logging/Cloud Security Service profiles via TMSH.
Fix:
You can now remove Bot profiles, Logging profiles, and Cloud Security Service profiles from user-defined partition.
750666-1 : Impossible to create Bot Signature/Bot Category Signature in user partition different from 'Common'
Component: Application Security Manager
Symptoms:
For any partition other than 'Common'(i.e., a user-defined partition), cannot create a new Bot Signature or Bot Category Signature via GUI, because the form fields and buttons are disabled (grayed out).
Conditions:
-- Creating Bot Signature/Bot Category Signature.
-- The partition is set to a user-defined partition.
Impact:
No creation of Bot Signature/Bot Category Signature can be completed through GUI in a user-defined partition.
Workaround:
Create Bot Signature/Bot Category Signature in TMSH.
Fix:
Can now create Bot Signature/Bot Category Signature in user partition different from 'Common'.
750661 : URI translation rules defined in Rewrite profile with type 'uri-translation' are not applied.
Component: TMOS
Symptoms:
A regression in configuration processing causes LTM Rewrite profile to ignore configured URI translation rules.
Conditions:
Using LTM Rewrite profiles to ignore configured URI translation rules.
Impact:
URI translation rules defined in Rewrite profile with type 'uri-translation' are not applied.
Workaround:
None.
Fix:
Restored functionality of LTM Rewrite URI translation rules.
750586-2 : HSL may incorrectly handle pending TCP connections with elongated handshake time.
Component: TMOS
Symptoms:
HSL may incorrectly handle TCP connections that are pending 3-way handshake completion that exceed default handshake timeout.
Conditions:
-- HSL or ReqLog configured to send logging data to pool via TCP protocol.
-- TCP 3-way handshake takes longer than 20 seconds (the default handshake timeout) to complete.
Impact:
-- Service interruption while TMM restarts.
-- Failover event.
Workaround:
None.
Fix:
HSL handles unusually long pending TCP handshakes gracefully and does not cause outage.
750580-1 : Installation using image2disk --format may fail after TMOS v14.1.0 is installed★
Component: TMOS
Symptoms:
When v14.1.0 is installed, subsequent installations of software performed using image2disk with the --format=volumes option from within a TMOS installation slot.
The failure occurs after the disks have been formatted, but before the TMOS installation slot is bootable, and the system is left without a TMOS installation slot.
While performing the installation, the system posts messages similar to the following in the serial console:
-- info: tm_install::RPM::rpm_db_find_by_namearch -- not found : MySQL-shared/i686
...
-- info: tm_install::VolumeSet::VolumeSet_install_packages -- installing package MySQL-shared (i686)
-- info: tm_install::RPM::rpm_db_find_by_namearch -- not found : openssl/x86_64
...
-- info: tm_install::VolumeSet::VolumeSet_install_packages -- installing package openssl (x86_64)
-- info: capture: status 32512 returned by command: chroot /mnt/tm_install/1258.DHwcwN rpm --rebuilddb
...
-- info: chroot: failed to run command 'rpm': No such file or directory
Conditions:
This issue occurs when all of the following conditions are met:
-- Version 14.1.0 is installed on the system, even if the system never boots into the 14.1.0 installation slot.
-- Using image2disk with the --format=volumes option specified from TMOS.
-- Installing another version of the software.
In particular, this issue affects MOS version 2.12.0-140.0, which can be checked by running this command from a bash shell on the BIG-IP system:
grub_default -d | grep -A6 'TMOS maintenance' | grep 'TIC_STATIC_VERSION'
Impact:
The installation fails, and the system is left in a state where it is not accessible on the network and has no configuration. You must use the console to access the system.
Workaround:
You can use the following workarounds:
-- Use the Software Management screens in the GUI to perform installations
-- Use the tmsh 'sys software' commands to perform software installations.
-- Do not use the image2disk --format command to install software.
750477-1 : LTM NAT does not forward ICMP traffic
Component: Advanced Firewall Manager
Symptoms:
ICMP traffic that matches LTM NAT object on a BIG-IP system, is not forwarded through but instead is dropped on the BIG-IP system.
Conditions:
-- LTM NAT object is configured on the BIG-IP system.
-- The BIG-IP system receives ICMP traffic matching the LTM NAT object.
Impact:
Client ICMP traffic (matching LTM NAT) is not forwarded to the destination causing traffic disruption.
Workaround:
None.
Fix:
ICMP traffic matching an LTM NAT object is now forwarded to the destination as expected.
750460-1 : Subscriber management configuration GUI
Solution Article: K61002104
750447-3 : GUI VLAN list page loading slowly with 50 records per screen
Component: TMOS
Symptoms:
GUI VLAN list page is loading slowly with there are 3200+ VLANs with the Records Per Screen Preference set to 50.
Conditions:
-- Using a VIPRION system.
-- Configuration containing 3200 or more VLANs.
-- System Preferences Records Per Screen set to 50.
Impact:
Cannot use the page.
Workaround:
Use tmsh or guishell tool to see the VLANs.
You can also try using a smaller value for the Records Per Screen option in System :: Preferences.
Fix:
Improved data retrieval and rendering for the VLAN list page.
750431-1 : Persistence record is deleted in MRF SIP after updating timeout value with the iRule 'SIP::persist timeout'
Component: Service Provider
Symptoms:
MRF SIP persistence records are deleted after updating the timeout value with the iRule 'SIP::persist timeout'.
Conditions:
-- MRF SIP configured with a persistence mode enabled.
-- Persistence timeout value is modified with iRule 'SIP::persist timeout'.
Impact:
Connections are not persisted as expected, causing additional processing, load balancing, and potential for misrouted messages.
Workaround:
Do not use 'SIP::persist timeout' to update timeouts. Increase initial timeout values when using custom persistence mode or switch to a non-custom persistence mode that updates timeouts automatically without iRules.
Fix:
The iRule 'SIP::persist timeout' no longer causes the persistence record to be deleted when updating the timeout value.
750356-2 : Split View pages: if user-defined filter removed right after creation - all user-defined filters are deleted
Component: Application Security Manager
Symptoms:
In any Split View page (Request Log, Learning, etc.): All user-defined filters are removed if you delete a newly created filter without reloading the page first.
Conditions:
-- Create a new filter.
-- Remove the new filter.
Impact:
The system removes all user-defined filters.
Workaround:
Before you delete a newly created filter, reload the page.
Fix:
Filter removal now completes successfully for all scenarios.
750318-3 : HTTPS monitor does not appear to be using cert from server-ssl profile
Component: TMOS
Symptoms:
An HTTPS monitor using a client certificate configured in the server-ssl profile fails to send the certificate during the SSL handshake.
A tcpdump shows a 0-byte certificate being sent.
Conditions:
-- In-tmm monitoring is disabled (default).
-- The server-ssl profile has been modified but without changing the configured certificate or key.
The resulting message passed from mcpd to bigd will contain only the incremental modification to the profile, which bigd treats as a complete profile, meaning that it is possible for the certificate and key parameters to be lost.
Impact:
SSL handshake might fail to complete and the HTTPS monitor fails.
Workaround:
Restart bigd process by running the following command:
bigstart restart bigd
Fix:
mcpd now sends the full profile configuration to bigd upon modification.
750298-1 : iControl REST may fail while processing requests
Solution Article: K67825238
750292-2 : TMM may crash when processing TLS traffic
Solution Article: K54167061
750213-4 : DNS FPGA Hardware-accelerated Cache can improperly respond to DNS queries that contain EDNS OPT Records.
Solution Article: K25351434
Component: Global Traffic Manager (DNS)
Symptoms:
FPGA hardware-accelerated DNS Cache can respond improperly to DNS queries that contain EDNS OPT Records. This improper response can take several forms, ranging from not responding with an OPT record, to a query timeout, to a badvers response.
Conditions:
-- Using VIPRION B2250 blades.
-- This may occur if a client sends a query with an EDNS OPT record that has an unknown version or other values that the Hardware-accelerated Cache does not understand. These errors only occur when matching the query to a hardware cached response.
Note: If the response is not in the hardware cache, then the query should be properly handled.
Impact:
Hardware-accelerated DNS Cache drops the request. Clients will experience a timeout for that query.
This is occurring now because of the changes coming to software from certain DNS software vendors that remove specific workarounds on February 1st, 2019. This is known as DNS Flag Day.
Workaround:
None.
750200-3 : DHCP requests are not sent to all DHCP servers in the pool when the BIG-IP system is in DHCP Relay mode
Component: Local Traffic Manager
Symptoms:
DHCP requests from the client are sent only to the first member in the DHCP server pool.
Conditions:
- BIG-IP system configured as a DHCP Relay.
- DHCP server pool contains more than one DHCP server.
Impact:
- DHCP server load balancing is not achieved.
- If the first DHCP server in the DHCP server pool does not respond or is unreachable, the DHCP client will not be assigned an IP address.
Workaround:
None.
750187-1 : ASM REST may consume excessive resources
Solution Article: K29149494
749912-1 : [BIG-IQ Integration] Deadlock occurs when adding multiple hostnames with transparent enforcement
Component: Application Security Manager
Symptoms:
Transparent enforcement by hostname has been moved from the Host Name configuration to the Microservice configuration.
REST API Clients that use the backwards-compatible, old endpoint, and send multiple requests in parallel may encounter a deadlock when configuring this element.
Conditions:
1) REST API Clients configure policy enforcement transparency by hostname.
2) They use the backwards-compatible, old endpoint to do so.
3) Multiple requests are sent in parallel.
Note: This is the case for BIG-IQ managing the BIG-IP system and configuring multiple domain names.
Impact:
Configuration calls fail due to internal DB deadlocks
Workaround:
Retry the API calls (or BIG-IQ deployment)
Fix:
Deadlocks during configuration calls are retried automatically and do not interrupt deployments.
749879-2 : Possible interruption while processing VPN traffic
Solution Article: K47527163
749785-2 : nsm can become unresponsive when processing recursive routes
Component: TMOS
Symptoms:
imish hangs, and the BIG-IP Network Services Module (nsm) daemon consuming 100% CPU.
Conditions:
-- Dynamic routing enabled
-- Processing recursive routes from a BGP peer with different prefixlen values.
Impact:
Dynamic routing, and services using dynamic routes do not operate. nsm does not recover and must be restarted.
Workaround:
None.
Fix:
nsm now processes recursive route without issues.
749774-5 : EDNS0 client subnet behavior inconsistent when DNS Caching is enabled
Component: Global Traffic Manager (DNS)
Symptoms:
When EDNS0 client subnet information is included in a DNS request, and DNS caching is enabled, the responses differ in their inclusion of EDNS0 client subnet information based on whether the response was supplied by the cache or not.
Conditions:
This occurs when EDNS0 client subnet information is included in a DNS request, and DNS caching is enabled.
Impact:
Inconsistent behavior.
Workaround:
None.
Fix:
In this release, responses are now consistent when caching is enabled.
749704-2 : GTPv2 Serving-Network field with mixed MNC digits
Component: Service Provider
Symptoms:
iRules command 'GTP::ie get value' incorrectly decodes Serving-Network field, putting the least significant digit of mobile network codes (MNC) value before the other two.
Conditions:
Using the iRule command 'GTP::ie get value' to retrieve the Serving-Network field from a GTP message (the iRule construction: GTP::ie get value -message $gtp_message 83).
Impact:
The operation returns results in which the least significant digit is inserted before the other two, resulting in incorrect data being returned.
Workaround:
None.
Fix:
The iRule command 'GTP::ie get -message $gtp_message 83' that retrieves the Serving-Network now returns the correctly ordered, three-digit values for mobile country codes (MCC) and mobile network codes (MNC) as a two-element list: {{<MCC> <MNC>} <optional data>}, where the first element is another list containing actual MCC and MNC values, while the second element is optional binary data which follows MCC and MNC. It is the same format as used for ULI field decoding.
Behavior Change:
The iRule command 'GTP::ie get -message $gtp_message 83' that retrieves the Serving-Network now returns the correctly ordered, three-digit values for mobile country codes (MCC) and mobile network codes (MNC) as a two-element list: {{<MCC> <MNC>} <optional data>}, where the first element is another list containing actual MCC and MNC values, while the second element is optional binary data which follows MCC and MNC. It is the same format as used for ULI field decoding.
749690-1 : MOS_Image2Disk_Installation- kjournald service error★
Component: TMOS
Symptoms:
Attempted local installation of BIG_IP software image via MOS. During installation, there is a procedure error:
tm_install::TMOS::TMOS_getenforce --
Command not found: /usr/sbin/getenforce.
Installation is successful, even with this error.
Conditions:
Attempted installation of a copied .iso image:
image2disk --nosaveconfig --instslot=MD1.2 BIGIP-15.0.0-0.0.1248.iso
Impact:
When the installation of packages starts, the system reports the message. Installation completes successfully. There is no functional impact on the system, so you can safely ignore this message.
Workaround:
None.
Fix:
The 'Command not found: /usr/sbin/getenforce' error no longer occurs.
749689-2 : HTTPS monitor sends different number of cipher suites in client hello after config load and bigd restart
Component: Local Traffic Manager
Symptoms:
HTTPS monitor sends different amount of cipher suites in client hello during SSL handshake and sometimes back end server fails to find a desired cipher suite from client hello. As a result, sometimes SSL handshake fails and monitor wrongly marks pool member down.
Conditions:
-- Have an SSL profile to be used by an HTTPS monitor.
-- Load the same config more than once.
Impact:
HTTPS monitor might incorrectly mark pool member down because of a failed SSL handshake.
Workaround:
Restart bigd using the following command:
bigstart restart bigd
Fix:
HTTPS monitor now sends a consistent number of cipher suites in the client hello message during the SSL handshake.
749675-5 : DNS cache resolver may return a malformed truncated response with multiple OPT records
Component: Global Traffic Manager (DNS)
Symptoms:
A configured DNS resolving cache returns a response with two OPT records when the response is truncated and not in the cache.
Conditions:
This can occur when:
-- A DNS resolving cache is configured.
-- The DNS query being handled is not already cached.
-- The response for the query must be truncated because it is larger than the size the client can handle (either 512 bytes or the buffer size indicated by an OPT record in the query).
Impact:
A DNS message with multiple OPT records is considered malformed and will likely be dropped by the client.
Workaround:
A second query will return the cached record, which will only have one OPT record.
Fix:
DNS cache resolver now returns the correct response under these conditions.
749603-1 : MRF SIP ALG: Potential to end wrong call when BYE received
Component: Service Provider
Symptoms:
When a BYE is received, the media flows for a different call might be closed in error.
Conditions:
If the hash of the call-id (masked to 12 bits) matches the hash of another's call-id.
Impact:
The media flows for both calls will be closed when one receives a BYE command. A call may be incorrectly terminated early.
Workaround:
None.
Fix:
Entire call-id checked before terminating media flows.
749508-1 : LDNS and DNSSEC: Various OOM conditions need to be handled properly
Component: Global Traffic Manager (DNS)
Symptoms:
Some LDNS and DNSSEC out-of-memory (OOM) conditions are not handled properly.
Conditions:
LDNS and DNSSEC OOM conditions.
Impact:
Various traffic-processing issue, for example, TMM panic during processing of DNSSEC activity.
Workaround:
None.
Fix:
The system contains improvements for handling OOM conditions properly.
749500-1 : Improved visibility for Accept on Microservice action in Traffic Learning
Component: Application Security Manager
Symptoms:
Low visibility for accepted on microservice action.
Conditions:
There are suggestions that can be accepted on microservice.
Impact:
The system does not show Accept on Microservice in a suggestion.
Workaround:
None.
Fix:
Improved visibility for Accept on Microservice action and microservice-related details of suggestions.
749464-2 : Race condition while BIG-IQ updates common file
Component: Application Visibility and Reporting
Symptoms:
The file /var/config/rest/downloads/app_mapping.json is being used by two processes: BIG-IQ and avrd.
This can cause a race-condition between the two and in some rare cases can cause avrd to crash.
Conditions:
BIG-IQ updating /var/config/rest/downloads/app_mapping.json while avrd is reading it.
Impact:
avrd might read incomplete data, and can even core in some rare cases.
Workaround:
None.
Fix:
This race condition no longer occurs.
749461-2 : Race condition while modifying analytics global-settings
Component: Application Visibility and Reporting
Symptoms:
Updating the analytics global-settings might cause a core for avrd.
The avrd.log contains the following record:
AVRD_CONFIG|NOTICE... 13931|lib/avrpublisher/infrastructure/avr_mcp_msg_parser.cpp:2985| Modified Analytics Global Settings, added "0" offbox TCP addresses
Conditions:
Analytics global-settings are updated either explicitly, using a tmsh command, or implicitly, by internal process script.
Impact:
Might cause a core for avrd. After coring once, avrd is expected to start normally without any additional cores. The configuration change is expected to be applied correctly after restart is complete.
Workaround:
None.
Fix:
This represents a partial fix. See bug 764665 for an additional fix.
749414-4 : Invalid monitor rule instance identifier error
Component: Local Traffic Manager
Symptoms:
Modifying nodes/pool-member can lose monitor_instance and monitor_rule_instances for unrelated objects.
Conditions:
-- BIG-IP system is configured with nodes, pool-members, and pools with monitors.
-- Modify one of the nodes that is in a pool.
-- Run the following command: tmsh load /sys config
-- Loading UCS/SCF file can trigger the issue also.
-- Nodes share the same monitor instance.
-- default-node-monitor is not configured.
Impact:
-- The system might delete monitor rule instances for unrelated nodes/pool-members.
-- Pool members are incorrectly marked down.
Workaround:
You can use either of the following:
-- Failover or failback traffic to the affected device.
-- Run the following command: tmsh load sys config.
749388-3 : 'table delete' iRule command can cause TMM to crash
Component: TMOS
Symptoms:
TMM SegFaults and restarts.
Conditions:
'table delete' gets called after another iRule command.
Impact:
Traffic is disrupted while TMM restarts.
Workaround:
Call 'table lookup' on any key before performing a 'table delete'.
Whether or not the key was added into the database beforehand does not matter.
Fix:
Fixed code to prevent invalid use of internal data structure.
749382-1 : Bare-metal installs via 'image2disk' may fail in v14.1.0 or greater
Component: TMOS
Symptoms:
Running a bare-metal installation via image2disk (IE, 'image2disk --format=volumes <ISO>') may fail due to a missing command in the maintenance OS.
Conditions:
The version of MOS installed on the system is from a v14.1.0 or newer ISO, and a user attempts a bare-metal installation via the 'image2disk' command.
Impact:
Unable to perform bare-metal installations/installations from MOS in affected versions.
Workaround:
The installed version of MOS can be removed with the command '/usr/lib/bpdiag -a mos'. After doing this, installing a version older than 14.1.0 will re-install an older version of MOS without this issue. You can then reboot to MOS and manually run the installation using 'image2disk' from there.
Fix:
Fix issues with bare-metal installations via 'image2disk' failing.
749331-3 : Global DNS DoS vector does not work in certain cases
Component: Advanced Firewall Manager
Symptoms:
Global DNS DoS vector stops working under certain conditions.
Conditions:
Packets are not made to go through its entirety.
Impact:
Global DNS data structures are overwritten by subsequent incoming packets. Global DNS DoS vector does not rate-limit the packets.
Workaround:
None.
Fix:
Global DNS DoS vector checks now prevent this issue, so rate-limiting works as expected.
749324-1 : jQuery Vulnerability: CVE-2012-6708
Solution Article: K62532311
749294-4 : TMM cores when query session index is out of boundary
Component: Local Traffic Manager
Symptoms:
TMM cores when the queried session index is out of boundary. This is not a usual case. It is most likely caused by the memory corrupted issue.
Conditions:
When session index equals the size of session caches.
Impact:
TMM cores. Traffic disrupted while tmm restarts.
Workaround:
None.
Fix:
The index boundary check now operates correctly in this situation, so tmm no longer cores.
749227-1 : MRF SIP ALG with SNAT: Temporary registration not extended by subsequent INVITE
Component: Service Provider
Symptoms:
INVITE message being processed operation creates a temporary registration entry for a unregistered subscriber, this registration entry is not extended if a subsequent invite occurs. This could cause the registration to expire during a call, thus allowing the reserved translated addresses to be provided to a different subscriber.
Conditions:
An INVITE message is received when unregistered-subscriber-callout attribute in the siprouter-alg profile
Impact:
The system adds a temporary registration entry to the registration table. The lifetime for this entry is the max-session-timeout value from the siprouter-alg profile. Subsequent INVITES will not extend the lifetime.
This could cause the registration to expire during a call, allowing the reserved translated addresses to be provided to a different subscriber.
Workaround:
None.
Fix:
Subsequent INVITEs now extend the lifetime by another max-session-timeout value.
749222-1 : dname compression offset overflow causes bad compression pointer
Component: Global Traffic Manager (DNS)
Symptoms:
DNS requests receive error response:
-- Got bad packet: bad compression pointer.
-- Got bad packet: bad label type.
Conditions:
When the DNS response is large enough so that dname redirects to an offset larger than 0x3f ff.
Impact:
DNS response is malformed. Because the DNS record is corrupted, zone transfer fails.
Workaround:
None.
Fix:
dname compression offset overflow no longer causes bad compression pointer.
749184-2 : Added description of subviolation for the suggestions that enabled/disabled them
Component: Application Security Manager
Symptoms:
Missing description of subviolation for the suggestions that enabled/disabled them.
Conditions:
There are suggestions that enabled/disabled subviolations in the security policy.
Impact:
Cannot determine the subviolation for the suggestions that enabled/disabled them.
Workaround:
Open Description in an additional tab in Learning and Blocking settings screen.
Fix:
Added description of subviolation for the suggestions that enabled/disabled them.
749161-2 : Problem sync policy contains non-ASCII characters
Component: Access Policy Manager
Symptoms:
When access policy contain non-ASCII characters, policy sync either fails or the characters are not sync'ed properly on the target.
Conditions:
-- Using an access profile.
-- Access profile contains non-ASCII characters (code point greater than 0x7f), e.g.,in VPE, add an 'Advanced Resource Assign' agent and specify an expression similar to the following in addition to the resource:
expr { [string tolower [mcget -decode {session.ad.last.attr.memberOf}]] contains [string tolower "CN=Suporte_TransmissãČo,"] || [string tolower [mcget -decodde {session.ad.last.attr.memberOf}]] contains [string tolower "CN=suporte_tx,"]}
-- Start policy sync on the profile.
Impact:
Policy sync fails or does not complete properly for the non-ASCII characters.
Workaround:
None.
Fix:
Policy sync now works properly when the policy contains non-ASCII characters.
749136-1 : Disk partition /var/log is low on free disk space
Component: Application Security Manager
Symptoms:
Warning messages, such as these on system CLI:
--------------
Broadcast message from root@bigip1.test.net (Wed Nov 7 09:01:01 2018):
011d0004:3: Disk partition /var/log (slot 1) has only 0% free
--------------
Conditions:
ASM or DoS is provisioned.
Impact:
Disk partition /var/log is low on free disk space.
Workaround:
Manually delete nsyncd logs from /var/log.
Fix:
There is now stricter log rotation for nsyncd.
749109-3 : CSRF situation on BIGIP-ASM GUI
Component: Application Security Manager
Symptoms:
CSRF situation on the BIG-IP ASM GUI that might potentially lead to resource exhaustion on the device for the moment it is being run.
Conditions:
The following URL accepts a wildcard in the parameter id, making it a heavy URL:
https://BIG-IP/dms/policy/pl_negsig.php?id=*
Impact:
Once multiple requests are sent to the target GUI, it is possible to see httpd process spiking even in core 0 (VMWare).
Workaround:
None.
Fix:
If the query string parameter has a string value the query is not executed.
749057-1 : VMware Horizon idle timeout is ignored when connecting via APM
Component: Access Policy Manager
Symptoms:
VMware Horizon has an option to set idle timeout under "View Configuration\Global Settings\General\Client-dependent settings\For clients that support applications". When there is no keyboard or mouse activity for the given time, application sessions should be disconnected (desktop sessions are staying, though).
This settings has no effect when connecting via APM.
Conditions:
VMware Horizon idle timeout setting for applications is configured and remote application is launched via APM.
Impact:
VMware Horizon idle timeout setting for applications has no effect.
Workaround:
None.
Fix:
VMware Horizon idle timeout "For clients that support applications" is now honored when connecting via APM.
749036-2 : Some tmsh list commands may fail with message 'Password could not be retrieved' when SSLO is provisioned but not APM
Component: Access Policy Manager
Symptoms:
Some tmsh list commands may fail while SSLO is provisioned but no urldb or APM modules are provisioned with the following message: 'Password could not be retrieved'.
Conditions:
-- SSLO is provisioned.
-- Neither APM or URLDB are provisioned.
-- Run the generic tmsh list command.
Impact:
tmsh command fails and posts the error: Unexpected Error: Password could not be retrieved.
Note: Some 'tmsh list' commands with arguments do run. For example, 'tmsh list net vlan' provides correct output, but 'tmsh list' does not.
Workaround:
There is no workaround other than provisioning APM or URLDB.
Note: You can provision APM or URLDB even if they are not licensed. Although the full feature set is not available without a license, provisioning loads the daemons needed to support the generic 'tmsh list' command.
Fix:
BIG-IP no longer requires SQL to be up with SSLO. Oauth is not needed under SSLO.
748999-3 : invalid inactivity timeout suggestion for cookies
Component: Application Security Manager
Symptoms:
ASM will report "invalid inactivity timeout" suggestions to delete a cookie, even though the cookies are being sent and are valid.
Conditions:
- Inactivity timeout feature is configured in Policy Builder
- Cookie entity is configured in the policy
- Valid, non-violating traffic containing cookies is passed
Impact:
Since non-violating traffic is not sent to the policy engine, the inactivity timeout timer is never reset, which will eventually lead to suggestions to delete the inactive cookie entities. These suggestions are erroneous because valid cookies are being sent in the traffic.
Workaround:
Ignore the inactive entity suggestions for cookies
Fix:
Inactivity learning for cookies has been deprecated, the feature does not cover cookies anymore.
748902-5 : Incorrect handling of memory allocations while processing DNSSEC queries
Component: Global Traffic Manager (DNS)
Symptoms:
tmm crashes.
Conditions:
-- Heavy DNS traffic using DNS security signatures.
-- Use of external HSM may aggravate the problem.
Impact:
Traffic disrupted while tmm restarts.
Workaround:
None.
Fix:
This release corrects the handling of memory allocations while processing DNSSEC queries.
748891-2 : Traffic bridged between VLANs in virtual-wire setups may have the wrong destination MAC in packets that egress from the BIG-IP system.
Component: Local Traffic Manager
Symptoms:
Potential MAC relearning at the switches the BIG-IP system is connected to.
Conditions:
-- DB variable connection.vlankeyed set to disabled.
-- Multiple virtual-wires configured on the BIG-IP system.
-- Client to server and server to client traffic using different virtual wires on the BIG-IP system.
Impact:
Packets reach their L3 destination using an unexpected L2 path.
Workaround:
None.
Fix:
Connflow next hop and previous hop updates are now done in the correct order for virtual wires.
748848-2 : Anti-Bot Mobile SDK cookie name change to support identical cookies for multiple virtual servers
Component: Application Security Manager
Symptoms:
Multiple virtual servers are each using different cookie names for cookies 72, 74, and 76. This occurred because these cookie names are dependent on virtual server properties.
Conditions:
-- Multiple subdomains are configured to resolve to different virtual servers with different ASM policies.
-- Anti-Bot Mobile SDK attempts to connect to these virtual servers.
Impact:
Anti-Bot Mobile SDK is not able to connect to multiple virtual servers using the same cookie.
Workaround:
None.
Fix:
The relevant cookie names were changed.
The format TS00000000_7x (prefix/suffix may change according to configuration) is now used for cookies 72, 74, and 76, which results in identical cookie names for all configured virtual servers.
This will allow Anti-Bot Mobile SDK to connect to multiple virtual servers using the same cookie.
748813-3 : tmm cores under stress test on virtual server with DoS profile with admd enabled
Component: Anomaly Detection Services
Symptoms:
tmm cores
Conditions:
-- Systems under stress testing.
-- Virtual server with DoS profile with admd enabled.
Impact:
Traffic disrupted while tmm restarts.
Workaround:
Turn off Behavioral DOS.
Fix:
This tmm core no longer occurs under these conditions.
748502-1 : TMM may crash when processing iSession traffic
Solution Article: K72335002
748409-2 : Illegal parameter violation when json parsing a parameter on a case-insensitive policy
Component: Application Security Manager
Symptoms:
An illegal parameter violation is raised although the parameter is configured
Conditions:
The policy is configured as case insensitive, and a parameter is configured with capital letters
Impact:
False positive illegal parameter violation
Workaround:
Configure violation as case sensitive
748321-1 : bd crash with specific scenario
Component: Application Security Manager
Symptoms:
BD crash
Conditions:
A specific scenario may cause bd crash.
Impact:
Failover, traffic disturbance.
Workaround:
N/A
748253-1 : Race condition between clustered DIAMETER devices can cause the standby to disconnect its mirror connection
Component: Service Provider
Symptoms:
Depending on the DIAMETER settings of the BIG-IP system, there can be a race condition in a mirrored device cluster where the standby BIG-IP system resets its mirror connection to the active device.
Conditions:
-- MRF DIAMETER in use.
-- The DIAMETER session profile on the BIG-IP system is configured to use a non-zero watchdog timeout.
-- The DIAMETER session profile on the BIG-IP system is configured to use Reset on Timeout.
-- This is more likely to happen if (in the DIAMETER session profile) the Maximum Watchdog Failures is set to 1, and the Watchdog Timeout is configured to be the same value as the remote DIAMETER system.
Impact:
The standby is no longer mirroring the active system, and gets out of sync with it. There may be connections lost if a failover occurs.
Workaround:
To mitigate this issue:
1. Configure the Maximum Watchdog Failures to a value greater than 1.
2. Configure the Watchdog Timeout as something different from the same timeout on the remote peer, preferably to something that will have little overlap (i.e., the two timers should fire at the exact same time very infrequently).
Fix:
Prevented the standby from sending DWR packets to the active device, so that it no longer expects DWA responses that never arrive.
748206-1 : Browser becomes unresponsive when loading the network map with a virtual server that contains a forwarding rule policy in the second position
Component: TMOS
Symptoms:
Browser becomes unresponsive.
Conditions:
Loading the network map with a virtual server that contains a forwarding rule policy in the second position.
Impact:
Browser becomes unresponsive and must be restarted.
Workaround:
Change the position of the forwarding rule policy.
Fix:
The browser now behaves as expected when loading the network map with a virtual server that contains a forwarding rule policy in the second position.
748205-3 : SSD bay identification incorrect for RAID drive replacement★
Component: TMOS
Symptoms:
On iSeries platforms with dual SSDs, the 'bay' of a given SSD indicated in the 'tmsh show sys raid' command may be incorrect. If a drive fails, or for some other reason it is intended to be replaced, and you are using the bay number listed from the tmsh command, the wrong drive could be removed from the system resulting in system failure to operate or boot.
Conditions:
iSeries platform with dual SSDs.
Impact:
Removal of the one working drive could result in system failure and subsequent failure to boot
Workaround:
If you discover that you removed the incorrect drive, you can attempt to recover by re-inserting the drive into the bay that it was in, and powering on the device.
The following steps will help to avoid inadvertently removing the wrong drive:
As a rule for systems with this issue:
-- Power should be off when you remove a drive. This makes it possible to safely check the serial number of the removed drive.
-- Power should be on, and the system should be completely 'up' before you add a new drive.
Here are some steps to follow to prevent this issue from occurring.
1. Identify the failed drive, taking careful note of its serial number (SN). You can use any of the following commands to get the serial number:
• tmsh show sys raid
• tmsh show sys raid array
• array
2. Logically remove the failed drive using the following command: tmsh modify sys raid array MD1 remove HD<>
3. Power down the unit.
4. Remove the fan tray and physically remove the failed drive.
5. Manually inspect the SN on the failed drive to ensure that the correct drive was removed.
6. Replace the fan tray.
7. Power on the unit with the remaining, single drive.
8. Once booted, wait for the system to identify the remaining (good) drive. You can confirm that this has happened when it appears in the 'array' command output.
9. Remove fan tray again (with the system running).
10. Install the new drive.
11. Use the 'array' command to determine that the new drive is recognized (Note: the tmsh commands do not show new drive at this stage.)
12. Logically add the new drive using the command command: tmsh modify sys raid array MD1 add HD<>
13. Monitor the rebuild using any of the commands shown in step 1.
Note: You must follow these steps exactly. If you insert the new drive while the system is off, and you then boot the system with the previously existing working drive and the new blank drive present, the system recognizes the blank drive as the working Array member, and you cannot add it to the array. That means system responds and replicates as if 'HD already exists'.
748187-4 : 'Transaction Not Found' Error on PATCH after Transaction has been Created
Component: TMOS
Symptoms:
In systems under heavy load of transactions with multiple icrd_child processes, the system might post an erroneous 'Transaction Not Found' response after the transaction has definitely been created.
Conditions:
Systems under heavy load of transactions with multiple icrd_child processes.
Impact:
Failure to provide PATCH to a transaction whose ID has been created and logged as created.
Workaround:
If transaction is not very large, configure icrd_child to only run single-threaded.
Fix:
Erroneous 'Transaction Not Found' messages no longer occur under these conditions.
748177-1 : Multiple wildcards not matched to most specific WideIP when two wildcard WideIPs differ on a '?' and a non-wildcard character
Component: Global Traffic Manager (DNS)
Symptoms:
Multiple wildcards not matched to the most specific WideIP.
Conditions:
Two wildcard WideIPs differ on a '?' and a non-wildcard character.
Impact:
DNS request gets wrong answer.
Workaround:
There is no workaround at this time.
Fix:
Multiple wildcards are now matched to the most specific WideIP when two wildcard WideIPs differ on a '?' and a non-wildcard character.
748176-1 : BDoS Signature can wrongly match a DNS packet
Component: Advanced Firewall Manager
Symptoms:
When using BDoS feature for DNS protocol, and when there are auto-generated DNS Signatures or if Custom DNS signatures are configured manually, it is found that at times, a valid DNS request is dropped because it wrongly matches the configured/dynamically generated DNS Signature when the box is under load, and BDoS mitigation is ongoing.
Conditions:
Configured DNS Signature (Or) there exists a Dynamically generated DNS Signature.
Such a DNS signature is found to match a DNS packet wrongly, even though the signature match criteria is different from the matched DNS packet.
Impact:
When box is under load, the configured DNS signature gets into Attack Mitigation mode (which is normal), but may wrongly drop a DNS packet that does not match the signature.
Workaround:
Disable BDoS for protocol DNS. Also, do not use Manually configured DNS Signatures.
Fix:
The parsed DNS information is cached and re-used wrongly as a performance optimization, which is corrected.
748122-1 : BIG-IP Vulnerability CVE-2018-15333
Solution Article: K53620021
748121-3 : admd livelock under CPU starvation
Component: Anomaly Detection Services
Symptoms:
Due to the resources starvation the worker thread of admd does not get CPU for more than two minutes. At the same time, the configuration thread does get CPU.
The admd heartbeat failure occurs at 120 seconds. The SOD daemon kills admd.
The system posts messages similar to the following:
-- notice sod[6783]: 01140041:5: Killing /usr/bin/admd pid 6732
-- warning sod[6783]: 01140029:4: high availability (HA) daemon_heartbeat ADMD.Anomaly0 fails action is restart.
-- warning sod[6783]: 01140029:4: high availability (HA) daemon_heartbeat ADMD.Publisher0 fails action is restart.
Conditions:
-- High CPU / memory utilization,
-- Very large configuration.
Note: There are no known special configuration requirements to have this occur.
Impact:
admd restarts.
Behavioral DoS does not work.
Workaround:
Reboot the BIG-IP system.
Fix:
admd livelock event no longer occurs in response to CPU starvation in very large configurations.
748081-1 : Memory leak in Behavioral DoS module
Component: Advanced Firewall Manager
Symptoms:
TMM runs out of memory and restarts.
The memory usage as shown in "tmctl memory_usage_stat", under module line tag "session" is noticed to be high, and keeps growing.
Conditions:
The issue is seen when BDoS feature is configured, and if there exits Custom or Auto Generated BDoS Signatures. When such signatures exist, the BDoS one second timer callback leaks memory.
Impact:
Traffic disrupted while tmm restarts.
Workaround:
1. Disable BDoS feature.
2. Disable all configured and auto generated BDoS signatures using TMSH command:
# cd dos-common
# modify security dos dos-signature all { state disabled }
748043-2 : MRF SIP ALG with SNAT: SIP Response message not forwarded by BIG-IP
Component: Service Provider
Symptoms:
SIP Server sends SIP Request to the client.
The SIP Server inserts a different port, so that response are received on a different port.
The Client sends the response on the new requested port.
BIG-IP drops the packet
Conditions:
SIP Server wants the SIP Response to be coming on a different port.
Impact:
SIP Request will not receive the SIP Response
Workaround:
There is no workaround.
Fix:
Fix BIG-IP to process the SIP Response and send it to the SIP Server
747977-1 : File manually uploaded information is not synced correctly between blades
Component: Application Security Manager
Symptoms:
When you upload a file, the file is marked internally as manually uploaded. When the system downloads a file, it is marked as not being manually uploaded. This information is not passed and handled correctly on chassis.
Conditions:
-- Configuration is deployed on multiple blades
-- Fail over has occurred.
-- New update file is downloaded from ESDM on the primary blade.
Impact:
Security updates are not automatically installed on the new primary blade after failover.
Workaround:
Manually install security updates on new primary blade.
Fix:
Corrected sync/handle information about file files, whether they are manually uploaded or downloaded from ESDM.
747968-3 : DNS64 stats not increasing when requests go through DNS cache resolver
Component: Local Traffic Manager
Symptoms:
DNS64 stats are not incrementing when running the 'tmsh show ltm profile dns' or 'tmctl profile_dns_stat' commands if responses are coming from DNS cache resolver.
Conditions:
-- DNS responses are coming from DNS cache resolver.
-- Viewing statistics using the 'tmsh show ltm profile dns' or 'tmctl profile_dns_stat' commands.
Impact:
DNS64 stats are not correct.
Workaround:
There is no workaround at this time.
747926-2 : Rare TMM restart due to NULL pointer access during AFM ACL logging
Component: Advanced Firewall Manager
Symptoms:
Tmm crashes while performing log ACL match logging.
Conditions:
The problem can happen only with the following configuration:
1) AFM Logging for ACLs enabled.
2) Security Network Logging profile has the property "log-translation-fields enabled"
The problem happens under extremely rare circumstances.
Impact:
Traffic disrupted while tmm restarts.
Fix:
Defensive error handling to avoid the scenario of NULL pointer access.
747922-3 : With AFM enabled, during bootup, there is a small possibility of a tmm crash
Component: Advanced Firewall Manager
Symptoms:
During bootup or re-provisioning, with AFM enabled, there is a small possibility of a tmm crash. The tmm process generates a core file and then automatically restart.
Conditions:
-- AFM enabled.
-- sPVA-capable hardware platform.
-- Boot up or re-provision the system.
Impact:
Tmm crashes, coredumps, and then restarts. Traffic disrupted while tmm restarts.
Workaround:
None.
Fix:
The race-condition has been fixed, so this issue no longer occurs.
747909-5 : GTPv2 MEI and Serving-Network fields decoded incorrectly
Component: Service Provider
Symptoms:
MEI and Serving-Network vales obtained with GTP::ie get iRule command contains digits swapped in pairs, first digit missing and a random digit added at the back.
Conditions:
Processing GTP traffic with iRules.
Impact:
It is impossible to obtain correct value of MEI and Serving-Network fields of the GTPv2 packets when processing with iRules.
Workaround:
No workaround.
Fix:
Decoding of GTPv2 MEI and Serving-Network fields corrected.
747907-2 : Persistence records leak while the HA mirror connection is down
Component: Local Traffic Manager
Symptoms:
Memory might leak on the active unit while the high availability (HA) mirror connection is down.
Conditions:
-- The persistence configured that requires its state to be stored stored on the BIG-IP system.
-- Mirroring is configured on the persistence profile or the virtual server.
-- Mirror connection is down, for example, next active is down/offline/unavailable.
Impact:
Memory leak until the HA mirror connection is up. Once mirror connection is up, the system releases the memory.
Workaround:
-- Disable persistence while HA mirror connection is down (e.g., performing maintenance).
-- Disable session mirroring for iRules.
-- Use persistence that does not requires its state to be stored on the BIG-IP system.
-- Restore HA connection.
Fix:
Persistence records no longer leak memory while the HA mirror connection is down.
747858-2 : OSPF packets are duplicated in the BIG-IP in L2 transparent mode using virtual wires
Component: Local Traffic Manager
Symptoms:
OSPF packets are duplicated while traversing a virtual wire.
Conditions:
BIG-IP configured in L2 transparent mode using a virtual wire.
Impact:
OSPF unreliability can impact the overall routing domain and in turn impact services dependent on it.
Workaround:
None.
Fix:
Handle multicast packets through a virtual wire correctly.
747777-3 : Extractions are learned in manual learning mode
Component: Application Security Manager
Symptoms:
- BIG-IP reports "Changes pending" frequently
- Errors in pabnagd.log: "Missing Parameter Rule1 attribute element"
Conditions:
Direct cause: Policy contains parameters with dynamic type
Indirect cause: Policy Builder is configured to classify parameters as dynamic (related to bug 717525)
Impact:
- BIG-IP reports "Changes pending" frequently
- Errors in pabnagd.log: "Missing Parameter Rule1 attribute element"
Workaround:
- Change all dynamic parameters value types to User Input with Alpha Numeric data type
- Unset parameters' dynamic value type (or uncheck all parameters' dynamic classification options in 'Learning And Blocking Settings').
Fix:
Policy Builder does not set extractions for dynamic parameters in manual mode
747727-1 : HTTP Profile Request Header Insert Tcl error
Component: Local Traffic Manager
Symptoms:
A TMM crash.
Conditions:
When the HTTP profile Request Header Insert field contains a Tcl interpreted string, Tcl is executed to expand the string before the header is inserted into the request header block.
If a Tcl error occurs
Impact:
In some cases this can cause TMM to crash. Traffic disrupted while tmm restarts.
Workaround:
You can use either of the following to mitigate this:
-- Verify that your Tcl executes correctly in all cases.
-- Use a static string.
Fix:
TMM no longer crashes under these conditions.
747725-3 : Kerberos Auth agent may override settings that manually made to krb5.conf
Component: Access Policy Manager
Symptoms:
when apmd starts up, it can override settings in krb5.conf file with those required for Kerberos Auth agent
Conditions:
- Kerberos Auth is configured in an Access Policy,
- administrator made changes to krb5.conf manually
to the section [realms] of the configured realm
Impact:
Kerberos Auth agent behavior is not what administrator expects with the changes.
it may also affect websso(kerberos) to behave properly
Workaround:
None
Fix:
after fix, the configuration file changes are merged.
Kerberos Auth agent adds the lines it requires and does not override existing settings
747628-1 : BIG-IP sends spurious ICMP PMTU message to server
Component: Local Traffic Manager
Symptoms:
After negotiating an MSS in the TCP handshake, the BIG-IP system then sends an ICMP PMTU message because the packet is too large.
Conditions:
-- The server side allows timestamps and the client side does not negotiate them.
-- The client-side MTU is lower than the server-side MTU.
-- There is no ICMP message on the client-side connection.
Impact:
Unnecessary retransmission by server; suboptimal xfrag sizes (and possibly packet sizes).
Workaround:
Disable timestamps or proxy-mss on the server-side TCP profile.
747624-2 : RADIUS Authentication over RSA SecureID is not working in challenge mode
Component: Access Policy Manager
Symptoms:
Cannot change/reset RSA PIN.
Conditions:
Using RADIUS Auth Agent to communicate with RSA SecurID server for user authentication.
Impact:
Users cannot change or reset RSA PIN.
Workaround:
None.
Fix:
RADIUS Authentication over RSA SecurID now works in challenge mode.
747617-2 : TMM core when processing invalid timer
Component: Local Traffic Manager
Symptoms:
TMM crashes while processing an SSLO iRules that enables the SSL filter on an aborted flow.
Conditions:
SSLO is configured and passing traffic.
Impact:
Traffic disrupted while tmm restarts.
Workaround:
No workaround
Fix:
SSL filter will no longer be enabled after connection close.
747592-1 : PHP vulnerability CVE-2018-17082
Component: TMOS
Symptoms:
The Apache2 component in PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 allows XSS via the body of a "Transfer-Encoding: chunked" request, because the bucket brigade is mishandled in the php_handler function in sapi/apache2handler/sapi_apache2.c.
Conditions:
This exploit doesn't need any authentication and can be exploited via POST request. Because of 'Transfer-Encoding: Chunked' header php is echoing the body as response.
Impact:
F5 products not affected by this vulnerability. Actual impact of this vulnerability is possible XSS attack.
Workaround:
No known workaround.
Fix:
The brigade seems to end up in a messed up state if something fails in shutdown, so we clean it up.
747585-3 : TCP Analytics supports ANY protocol number
Component: Local Traffic Manager
Symptoms:
No TCP analytics data is collected for an ANY virtual server.
Conditions:
1. Provision AVR
2. Create a FastL4 server that accepts all protocols.
3. Attach a TCP Analytics profile
4. Try to run UDP traffic through it.
Impact:
No TCP analytics data is collected for TCP flows when a virtual server's protocol number is ANY.
Workaround:
There is no workaround this time.
Fix:
TCP analytics now supports both ANY and TCP protocol numbers and would collect analytics for TCP flows if protocol number is ANY or TCP.
747560-5 : ASM REST: Unable to download Whitehat vulnerabilities
Component: Application Security Manager
Symptoms:
When using the Whitehat Sentinel scanner, the REST endpoint for importing vulnerabilities (/mgmt/tm/asm/tasks/import-vulnerabilities) does not download the vulnerabilities from the server automatically when no file is provided.
Conditions:
The ASM REST API (/mgmt/tm/asm/tasks/import-vulnerabilities) is used to download vulnerabilities from the server when a Whitehat Sentinel Scanner is configured.
Impact:
Vulnerabilities from the Whitehat server are not automatically downloaded when no file is provided, and it must be downloaded manually, or the GUI must be used.
Workaround:
The ASM GUI can be used to download the vulnerabilities from the Whitehat Server, or the file can be downloaded separately, and provided to the REST endpoint directly.
Fix:
The REST endpoint for importing Scanner Vulnerabilities for the Whitehat Scanner now correctly downloads the vulnerability file automatically when no file is provided.
747550-3 : Error 'This Logout URL already exists!' when updating logout page via GUI
Component: Application Security Manager
Symptoms:
When you try to update the Logout Page, you get an error about the URL existence: Error 'This Logout URL already exists!'
Conditions:
1. Create any Logout page.
2. Try to update it.
Impact:
The properties of the Logout Page cannot be updated.
Workaround:
Delete the logout page and create a new one.
Fix:
This release addresses the issue, so that no error is reported when updating the Logout Page.
747239-1 : TMM SIGABRT seen in HTTP/2 gateway scenario when shutting down connection
Component: Local Traffic Manager
Symptoms:
TMM SIGABRT seen in HTTP/2 gateway scenario when shutting down connection.
Conditions:
This might occur rarely when the HTTP/2 gateway is configured on a virtual server.
Impact:
Traffic disrupted while tmm restarts.
Workaround:
No workaround.
Fix:
TMM SIGABRT no longer occurs under these conditions.
747187-2 : SIP falsely detects media flow collision when SDP is in both 183 and 200 response
Component: Service Provider
Symptoms:
A spurious error message is logged ("MR SIP: Media flow creation (...) failed due to collision") and media does not flow.
Conditions:
A SIP server responds to an INVITE with both a 183 "Session Progress" and later a "200 OK" for a single SIP call, and both responses contain an SDP with the same media info.
Impact:
Media does not flow on pinholes for which a collision was detected and reported.
Workaround:
None
Fix:
No collision is detected or logged when multiple messages with SDP recreate the same flows in the same call.
747104-1 : LibSSH: CVE-2018-10933
Solution Article: K52868493
Component: Advanced Firewall Manager
Symptoms:
For more information see: https://support.f5.com/csp/article/K52868493
Conditions:
For more information see: https://support.f5.com/csp/article/K52868493
Impact:
For more information see: https://support.f5.com/csp/article/K52868493
Fix:
For more information see: https://support.f5.com/csp/article/K52868493
746941-2 : avrd memory leak when BIG-IQ fails to receive stats information
Component: Application Visibility and Reporting
Symptoms:
AVRD has memory leak when it is failing to send statistical information to BIG-IQ.
Conditions:
BIG-IP is used by BIG-IQ version 6.0.0 or higher, and stats collection is enabled.
Plus, BIG-IQ has some malfunction that prevents it from receiving the statistical information that BIG-IP is sending (for example: all DCDs are down, or not network connection between BIG-IP and BIG-IQ).
Impact:
avrd memory is increased over time, leading to avrd restart when it is getting too large
Workaround:
Connectivity issue between BIG-IP and BIG-IQ should be fixed, not just in order to prevent this memory leak, but for more important functionality such as visibility and alerts features in BIG-IQ.
Fix:
Memory leak is fixed.
746877-1 : Omitted check for success of memory allocation for DNSSEC resource record
Component: Global Traffic Manager (DNS)
Symptoms:
The TMM may panic from SIGABRT while logging this message:
./rdata.c:25: ldns_rdf_size: Assertion `rd != ((void *)0)' failed.
Conditions:
During memory stress while handling DNSSEC traffic.
Impact:
TMM panic and subsequent interruption of network traffic.
Workaround:
Keeping the workload within normal ranges reduces the probability of encounter.
Fix:
The system now checks for success of memory allocation for DNSSEC resource record, so this issue no longer occurs.
746873-1 : Non-admin users are not able to run the tmsh list command due to permissions error for LTM message-routing
Component: TMOS
Symptoms:
Any non-admin cannot use tmsh list commands. Running the command gives the following error:
Unexpected Error: Can't display all items, can't get object count from mcpd.
Conditions:
Run a tmsh list command when logged in as non-admin user.
Impact:
Error is posted. Non-admin users cannot use the tmsh list commands.
Workaround:
Log in as admin to execute the tmsh list command.
Fix:
Non-admin users can now run tmsh list commands, as appropriate for the Role associated with the type of user account.
746861-1 : SFP interfaces fail to come up on BIG-IP 2x00/4x00, usually when both SFP interfaces are populated★
Component: TMOS
Symptoms:
The SFP interfaces do not come up or flap up and down repeatedly on BIG-IP 2000/4000 on boot up when both SFP interfaces are populated.
When interface flaps state changes such as those below are logged in ltm log:
info pfmand[PID]: 01660009:6: Link: 2.1 is UP
info pfmand[PID]: 01660009:6: Link: 2.1 is DOWN
Conditions:
Both SFP interfaces, 2.1 and 2.2, on BIG-IP 2000/4000 are populated.
This is typically observed after an upgrade to an affected version.
Impact:
Traffic cannot be sent/received from these interfaces.
Workaround:
None.
Fix:
The interfaces now come up successfully. Occasional link bounce may be seen on reboot.
746825-1 : MRF SIP ALG with SNAT: Ephemeral listeners not created for unsubscribed outgoing calls
Component: Service Provider
Symptoms:
When a temporary registration is created for an unsubscribed user making an outgoing call, an ephemeral listener to receive incoming messages is not created.
Conditions:
-- If nonregister-subscriber-callout attribute is enabled in the siprouter-alg profile.
-- An unregistered client device places an outgoing call. At this point, a temporary registration is created. This temporary registration lives for the life of the call.
-- During the lifetime of the temporary registration, if the connection from the client is closed, it is not possible for an external device to reach the client device.
Impact:
The callee of an outgoing call initiated by an unregistered SIP device cannot end the call.
Workaround:
There is no workaround at this time.
Fix:
When a temporary registration is created, an ephemeral listener is created to receive SIP commands to be forwarded to the client device.
746771-3 : APMD recreates config snapshots for all access profiles every minute
Component: Access Policy Manager
Symptoms:
When the access profile configurations in APMD and MCPD are out of sync, APMD detects that the config snapshot for one access profile is missing. This triggers AMPD to recreates the config snapshots for all access profiles. The detect-recreate cycle repeats every minute, posting log messages:
-- err apmd[18013]: 01490259:3: Exception occurred for memcache operation: AccessPolicyProcessor/ProfileAccess.cpp line:492 function: resetTimeout - Config snapshot for profile /Common/ap could not be found using key tmm.session.a9735a75704_0ooooooooooooooooooo
...
-- notice apmd[18013]: 014902f3:5: (null):Common:00000000: Successfully created config snapshots for all access profiles.
...
-- err apmd[18013]: 01490259:3: Exception occurred for memcache operation: AccessPolicyProcessor/ProfileAccess.cpp line:492 function: resetTimeout - Config snapshot for profile /Common/ap could not be found using key tmm.session.a9735a75704_0ooooooooooooooooooo
...
-- notice apmd[18013]: 014902f3:5: (null):Common:00000000: Successfully created config snapshots for all access profiles.
Conditions:
The conditions under which the access profile configurations in APMD and MCPD become out of sync is unknown.
Impact:
TMM memory usage increases due to excessive config snapshots being created.
Workaround:
Restart APMD to clear the APMD and MCPD out-of-sync condition.
Fix:
This issue has been fixed.
746768-4 : APMD leaks memory if access policy policy contains variable/resource assign policy items
Component: Access Policy Manager
Symptoms:
If an access policy contains variable/resource assign policy items, APMD will leak memory every time the policy is modified and applied.
Conditions:
1. Access policy has variable/resource assign policy items.
2. The access policy is modified and applied.
Impact:
APMD's memory footprint will increase whenever the access policy is applied.
Workaround:
There is no workaround.
Fix:
Memory growth has been addressed.
746750-1 : Search Engine get Device ID challenge when using the predefined profiles
Component: Application Security Manager
Symptoms:
When using one of the pre-defined profiles, "bot-defense-device-id-generate-after-access" and "bot-defense-device-id-generate-after-access", Search Engines might get Device ID challenges (and will most likely get blocked since cannot run JS)
Conditions:
One of the pre-defined profiles ("bot-defense-device-id-generate-after-access" or "bot-defense-device-id-generate-after-access") are attached to vs, and a valid search engine sends requests.
Impact:
Search Engines may be blocked.
Workaround:
Change mitigation of "Trusted Bot" in the attached profile to "Alarm":
1. Go to
Security ›› Bot Defense : Bot Defense Profiles ›› bot-defense-device-id-generate-after-access
or
Security ›› Bot Defense : Bot Defense Profiles ›› bot-defense-device-id-generate-before-access
2. Go to tab "Mitigation Settings"
3. For "Trusted Bot" choose "Alarm".
4. Save profile.
746710-1 : Use of HTTP::cookie after HTTP:disable causes TMM core
Component: Local Traffic Manager
Symptoms:
When an iRule disables HTTP with HTTP:disable, subsequent use of HTTP::cookie for that request will cause a TMM core dump.
Conditions:
1) HTTP profile is configured on the virtual.
2) HTTP:disable is called on request.
3) HTTP:cookie is then called on that request.
Impact:
Use of iRules in the above mentioned order will result in a TMM core. Traffic disrupted while tmm restarts.
Workaround:
Do not call HTTP:cookie on requests that have had HTTP disabled by HTTP:disable
746657-1 : tmsh help for FQDN node or pool member shows incorrect default for fqdn interval
Component: TMOS
Symptoms:
The tmsh help text for LTM nodes and pools shows the incorrect default for the FQDN 'interval' value.
The default is indicated as the TTL, whereas the actual default value is 3600 seconds (1 hour).
The configured value is displayed correctly if the node or pool is displayed using the 'all-properties' keyword.
Conditions:
This occurs when viewing tmsh help text.
Impact:
FQDN nodes and pool members may be created with a different FQDN refresh interval than intended.
Workaround:
When creating an FQDN node or pool member, specify the desired FQDN 'interval' value (either TTL, or the desired number of seconds).
Fix:
The tmsh help text for LTM nodes and pools correctly shows the default value of 3600 seconds for the FQDN 'interval' value.
746424 : Patched Cloud-Init to support AliYun Datasource
Component: TMOS
Symptoms:
Shipped Cloud-Init in this version of VE has no support of Alibaba Cloud metadata service for having no support of AliYun Datasource.
Conditions:
VE for Alibaba Cloud
Impact:
Provisioning VE through Cloud-Init won't work on Alibaba cloud
Workaround:
N/A
Fix:
Patched Cloud-Init to support AliYun Datasource
746394-1 : With ASM CORS set to 'Disabled' it strips all CORS headers in response.
Component: Application Security Manager
Symptoms:
All access-control-* headers are removed by ASM, including Cross-Origin Resource Sharing (CORS) headers. This causes CORS-related JavaScript errors on the browser console, and blocks cross-domain requests that should be allowed.
Conditions:
-- ASM provisioned.
-- ASM policy attached to a virtual server.
-- Backend server sends CORS headers access-control-*.
Impact:
Any webapp that sends cross origin AJAX requests might not work.
Workaround:
Set up an iRule on a virtual server, for example:
when HTTP_RESPONSE {
array set header_list { }
foreach header_name [HTTP::header names] {
if { [string tolower $header_name] starts_with "access-control-" } {
set header_list($header_name) [HTTP::header $header_name]
}
}
}
when HTTP_RESPONSE_RELEASE {
foreach header_name [array names header_list] {
if {!([HTTP::header exists $header_name])} {
HTTP::header insert $header_name $header_list($header_name)
}
}
}
Fix:
ASM no longer removes CORS headers when the feature is set to set to 'Disabled'. This is correct behavior.
746298-1 : Server Technologies logos all appear as default icon
Component: Application Security Manager
Symptoms:
Server Technologies logos all appear as the default icon.
Conditions:
Browsing the list of available Server Technologies in an ASM policy.
Impact:
Server Technologies logos all appear as the default icon.
Workaround:
Install the most recent Server Technologies update file.
Fix:
Server Technology-specific logos appear correctly.
746266-3 : Vcmp guest vlan mac mismatch across blades.
Component: TMOS
Symptoms:
Guests running on blades in a single chassis report different MAC addresses on a single vlan upon host reboot for vcmp guest.
Conditions:
This issue may be seen when all of the following conditions are met:
- One (or more) blade(s) are turned off completely via AOM.
- Create two vlans.
- Deploy a multi-slot guest with the higher lexicographic vlan.
- Now, assign the smaller vlan to the guest.
- Reboot the host
Impact:
Incorrect MAC addresses are reported by some blades.
Workaround:
There is no workaround at this time.
746131-4 : OpenSSL Vulnerability: CVE-2018-0732
Component: Local Traffic Manager
Symptoms:
OpenSSL RSA key generation was found to be vulnerable to cache side-channel attacks. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover parts of the private key.
Conditions:
Advanced shell access.
Impact:
OpenSSL RSA key generation was found to be vulnerable to cache side-channel attacks. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover parts of the private key.
Workaround:
None.
Fix:
Updated to OpenSSL 1.0.2p
746091-1 : TMSH Vulnerability: CVE-2019-19151
Solution Article: K21711352
746078-1 : Upgrades break existing iRulesLX workspaces that use node version 6
Component: Local Traffic Manager
Symptoms:
When upgrading a BIG-IP with iRulesLX plugins, if those plugins are based on workspaces that use node version 6 (instead of version 0.12) they will fail to work properly after the upgrade once the plugin is reloaded from the workspace.
Errors like this will be seen in /var/log/ltm:
Oct 5 06:37:12 B7200-R14-S36 info sdmd[17582]: 018e0017:6: pid[26853] plugin[/Common/test-jt-plugin.test-jt-extension] Starting the server.....jt...after upgrade...
Oct 5 06:37:12 B7200-R14-S36 err sdmd[17582]: 018e0018:3: Resuming log processing at this invocation; held 233 messages.
Oct 5 06:37:12 B7200-R14-S36 err sdmd[17582]: 018e0018:3: pid[26850] plugin[/Common/test-jt-plugin.test-jt-extension] /var/sdm/plugin_store/plugins/:Common:test-jt-plugin_62858_3/extensions/test-jt-extension/node_modules/f5-nodejs/lib/ilx_server.js:30
Oct 5 06:37:12 B7200-R14-S36 err sdmd[17582]: 018e0018:3: pid[26850] plugin[/Common/test-jt-plugin.test-jt-extension] ILXServerWrap = process.binding('ILXServerWrap').ILXServerWrap;
Oct 5 06:37:12 B7200-R14-S36 err sdmd[17582]: 018e0018:3: pid[26850] plugin[/Common/test-jt-plugin.test-jt-extension] ^
Oct 5 06:37:12 B7200-R14-S36 err sdmd[17582]: 018e0018:3: pid[26850] plugin[/Common/test-jt-plugin.test-jt-extension] Error: No such module: ILXServerWrap
Oct 5 06:37:12 B7200-R14-S36 err sdmd[17582]: 018e0018:3: pid[26850] plugin[/Common/test-jt-plugin.test-jt-extension] at Error (native)
Conditions:
Upgrading a version of BIG-IP that is using iRulesLX that has a workspace based on node version 6. Later reloading the iRulesLX plugin from the workspace.
Impact:
The iRulesLX plugin no longer works.
Workaround:
- Navigate to the workspace folder on the BIG-IP (/var/ilx/workspaces/<partition>/<workspace name>.
- Make the file "node_version" writable (chmod +w node_version).
- Edit the node_version file: change "0.12" to "6"
- Save the node_version file.
- Make the file "node_version" read-only (chmod -w node_version).
- Reload the iRulesLX plugin from the workspace.
Fix:
Prevented the node version from getting reverted to default during an upgrade.
746077-4 : If the 'giaddr' field contains a non-zero value, the 'giaddr' field must not be modified
Component: Local Traffic Manager
Symptoms:
DHCP-RELAY overwrites the 'giaddr' field containing a non-zero value. This violates RFC 1542.
Conditions:
DHCP-RELAY processing a message with the 'giaddr' field containing a non-zero value,
Impact:
RFC 1542 violation
Workaround:
None.
Fix:
DHCP-RELAY no longer overwrites the 'giaddr' field containing a non-zero value.
745947-2 : Add log events for MRF SIP registration/deregistration and media flow creation/deletion
Component: Service Provider
Symptoms:
Generally, only error conditions are logged for SIP. More logging is needed around SIP registration/deregistration, media flow creation/deletion, to help with debugging operations.
Conditions:
log.mrsip.level notice or above.
Impact:
Only error conditions are logged. Events helpful for debugging are not available in the logs.
Workaround:
There is no workaround at this time.
Fix:
Log information logging is available around SIP registration/deregistration and media flow creation/deletion.
745923-2 : Connection flow collision can cause packets to be sent with source and/or destination port 0
Component: Local Traffic Manager
Symptoms:
Symptoms vary based on traffic impacted:
Virtual server may reset a connection with the source and/or destination port set to 0 when the client sends an ACK after a 4-way close
UDP traffic to virtual server with UDP profile immediate timeout configured or datagram load-balancing can collide with existing connections and be incorrectly sent with source and/or destination port 0.
Conditions:
-- Conditions to trigger this issue with TCP traffic:
- 3-way handshake initiated by client to virtual server.
- Client actively closing the connection - 4-way close.
- Client continues to send ACK after 4-way close.
-- Conditions to trigger this issue with UDP traffic:
- UDP profile has timeout immediate configured or datagram load-balancing.
- UDP packet arrives that matches an expiring but still-present connection.
-- Provisioned for AFM.
Impact:
Virtual server performs an incorrect reset with source or destination port 0, or UDP proxy traffic is sent incorrectly with source and/or destination port 0.
Workaround:
None.
Fix:
Connection flow collision no longer causes packets to be sent from source port 0.
745851 : Changed Default Cloud-Init log level to INFO from DEBUG
Component: TMOS
Symptoms:
Cloud-Init services generate too many debug log lines that populate their systemd journal.
Conditions:
Any BIG-IP VE release with Cloud-Init enabled and using "systemd".
Impact:
There're too many debug log lines that might make VE admin miss any more important information and severe errors when reading it.
Workaround:
Manually change all Cloud-Init's log levels to INFO from DEBUG.
Fix:
Cloud-Init's log default levels have been changed to INFO from DEBUG.
745825-1 : The "audit_forwarder is disabled as the configuration is incomplete" message can be confusing if logged when the configuration is loading
Component: TMOS
Symptoms:
This message may be logged while the audit_forwarder is loading the configuration:
audit_forwarder is disabled as the configuration is incomplete. Please define the following db variables: config.auditing.forward.sharedsecret, config.auditing.forward.destination and config.auditing.forward.type. And make sure config.auditing.forward.destination is not set to "::".
These DB variables may all be actually configured correctly, but since the configuration has not loaded yet this message may be logged multiple times.
Conditions:
The audit_forwarder process is starting up and loading the configuration.
Impact:
Confusing error messages in /var/log/ltm. Logging will still work as configured.
Workaround:
There is no workaround.
Fix:
Message has been modified to indicate the possibility of loading the configuration. Message is now logged only once. A new messages is logged indicating when audit_forwarder is enabled.
745813-1 : Requests are reported to local log even if only Bot Defense remote log is configured
Component: Application Security Manager
Symptoms:
Requests are logged locally on the BIG-IP system while they supposed to be sent only to the remote logger.
Conditions:
- Bot Defense profile attached to a virtual server.
- Bot Defense remote logger profile attached to a virtual server.
Impact:
Requests logged locally on the BIG-IP system when they are not supposed to be.
Workaround:
None.
Fix:
Logging profile filter mechanism now honors remote and local logging configurations.
745809-2 : The /var partition may become 100% full requiring manual intervention to clear space
Component: Advanced Firewall Manager
Symptoms:
The /var partition might become completely full on the disk due to files being written to /var/config/rest. This condition may be accompanied by console error messages similar to the following:
011d0004:3: Disk partition /var (slot #) has only 0% free
Additionally, there may be periodic restjavad and bigd daemons restarts related to disk space exhaustion.
Conditions:
Process traffic while DoS Dashboard is open.
Impact:
The partition housing /var/config/rest may become 100% full, impacting future disk IO to the partition
Workaround:
This workaround is temporary in nature, and may need to be periodically performed either manually or from a script. While these steps are performed, the BIG-IP REST API will be temporarily inaccessible, and higher disk IO may be seen.
Run the following commands, in sequence:
bigstart stop restjavad
rm -rf /var/config/rest/storage*.zip
rm -rf /var/config/rest/*.tmp
bigstart start restjavad
Manual application of these workaround steps clears the 100% utilized space condition and allows the partition to resume normal operation.
745802-1 : Brute Force CAPTCHA response page truncates last digit in the support id
Component: Application Security Manager
Symptoms:
Brute Force CAPTCHA response page shown to an end-user has a support id and the last digit is truncated.
Conditions:
- ASM Provisioned
- ASM policy attached to a virtual server
- ASM Brute Force Protection enabled in the asm policy
- ASM Brute Force sends captcha mitigation page when a website is under brute force attack.
Impact:
The support id presented to an end-user won't be matched to the one shown in the asm logs
Workaround:
There is no workaround at this time.
Fix:
The code is fixed, correct support id is shown in the captcha response page.
745783-1 : Anti-fraud: remote logging of login attempts
Component: Fraud Protection Services
Symptoms:
There is no support for logging of login attempts to a remote service.
Conditions:
Using high speed logging (HSL) to log login attempts.
Impact:
There is no support for logging of login attempts.
Workaround:
None.
Fix:
FPS now uses HSL to report login attempts using configured templates, rate-limit, and publisher to a remote service.
To enable this feature:
# via tmsh only
tmsh modify sys db antifraud.riskengine.reportlogins value enable
# via tmsh or GUI
tmsh modify sys db antifraud.internalconfig.string1 value "<login attempt log template>"
tmsh modify sys db antifraud.internalconfig.string2 value "<log-rate-exceeded log template>"
tmsh modify sys db antifraud.internalconfig.number1 value "<log-rate-exceeded threshold>"
tmsh modify security anti-fraud profile <fps profile> risk-engine-publisher <publisher>
It is recommended that you use encoding when composing an HTTP template. The default encoding level is 0, meaning 'never encode'.
To change encoding level:
tmsh modify sys db antifraud.internalconfig.number2 value <0/1/2>
Behavior Change:
FPS now includes the ability to perform High Speed Logging (HSL) of all login attempts to specific protected URLs. These events can be forwarded to remote services (e.g. SIEM Server), and, when enabled, can help indicate whether applications are under attack.
745715-2 : MRF SIP ALG now supports reading SDP from a mime multipart payload
Component: Service Provider
Symptoms:
Previously all non-SDP SIP payloads were ignored. This would cause media pinhole flows to not be created.
Conditions:
An INVITE message or its response contained a SDP section in a mime multipart payload.
Impact:
Media pinhole flows were not created
Workaround:
None.
Fix:
The SIP ALG functions can now extract and process the SDP section of a mime multipart payload.
745713-4 : TMM may crash when processing HTTP/2 traffic
Solution Article: K94563344
745654-4 : Heavy use of APM Kerberos SSO can sometimes lead to slowness of Virtual Server
Component: Access Policy Manager
Symptoms:
When there are a lot of tcp connections that needs new kerberos ticket to be fetched from kdc, then the websso processes requests slower than the incoming requests. This could lead to low throughput and virtual server is very slow to respond to requests.
Conditions:
Large number of APM users using Kerberos SSO to access backend resources and all the tickets expire at the same time.
Impact:
Low throughput and slow responses from Virtual server.
Workaround:
There is no workaround at this time.
Fix:
Increase the size of websso worker queue, so that tmm and websso process can communicate effectively. This eliminates VS slowness and hence increase throughput.
745629 : Ordering Symantec and Comodo certificates from BIG-IP
Component: TMOS
Symptoms:
This new feature enables ordering Symantec and Comodo certificates from the BIG-IP system.
Conditions:
You must have a Symantec or Comodo CA account to make certificate orders from the BIG-IP system.
Impact:
This new feature enables ordering of certificates from CAs Symantec and Comodo. CA-Approved certificates are automatically fetched and installed on the BIG-IP system.
Workaround:
None. This is a new feature.
Fix:
This release adds the capability to order/fetch and install certificates from CAs Symantec and Comodo.
Behavior Change:
You can now order/fetch and install certificates from the Symantec and Comodo Certificate Authorities.
745628-1 : MRF SIP ALG with SNAT does not translate media addresses in SDP after NOTIFY message
Component: Service Provider
Symptoms:
The media addresses in the SDP payload are not translated by MRF SIP ALD with SNAT after a NOTIFY message has been processed.
Conditions:
This occurs because the NOTIFY message has has the TO and FROM headers with the same value causing the ALG to enter hairpin mode.
Impact:
Media addresses in the SDP payload are not translated.
Workaround:
There is no workaround.
Fix:
Hairpin mode is not entered when processing NOTIFY messages
745624-1 : Tooltips for OWASP Bot Categories and Anomalies were added
Component: Application Security Manager
Symptoms:
Tooltips for some OWASP Bot Categories and Anomalies are 'N/A' in GUI/REST.
Conditions:
- GUI page: Event Logs:: Bot Defense :: Bot Traffic.
- Bot classification is 'OWASP Automated Threat'.
Impact:
Tooltip shows 'N/A' instead of detailed description. You cannot see detailed description of Bot classification of traffic.
Workaround:
None.
Fix:
Tooltips for OWASP Bot Categories and Anomalies were added.
745607-1 : Bot Defense : Bot Traffic - 3 month/last year filter not displayed correctly
Component: Application Security Manager
Symptoms:
3 month/last year filters are not displayed correctly in the applied filter.
Conditions:
3 month/last year filter applied in Bot Defense : Bot Traffic.
Impact:
You cannot see which filter is currently applied.
Workaround:
None.
Fix:
3 month/last year filter is now displayed correctly in applied filter.
745590-1 : SIPALG::hairpin and SIPALG::hairpin_default iRule commands to enable or disable hairpin mode added
Component: Service Provider
Symptoms:
In MRF SIP ALG, the hairpin flag is part of the translation_details structure. Because a connection/translation might be used for multiple simultaneous calls, if any call is hairpinned, subsequent calls on the same connection will not translate SDP addresses.
Conditions:
-- A connection/translation using multiple simultaneous calls
-- A call is hairpinned.
Impact:
Subsequent calls on the same connection do not translate SDP addresses.
Workaround:
None.
Fix:
SIPALG::hairpin and SIPALG::hairpin_default iRule commands to enable or disable hairpin mode added.
745574-1 : URL is not removed from custom category when deleted
Component: Access Policy Manager
Symptoms:
When the admin goes to delete a certain URL from a custom category, it should be removed from the category and not be matched anymore with that category. In certain cases, the URL is not removed effectively.
Conditions:
This only occurs when the syntax "http*://" is used at the beginning of the URL when inserted into custom categories.
Impact:
When the URL with syntax "http*://" is deleted from the custom category, it will not take effect for SSL matches. For example, if "http*://www.f5.com/" was inserted and then deleted, and the user passed traffic for http://www.f5.com/ and https://www.f5.com/, the SSL traffic would still be categorized with the custom category even though it was deleted. The HTTP traffic would be categorized correctly.
Workaround:
"bigstart restart tmm" will resolve the issue.
Fix:
Made sure that the deletion takes effect properly and SSL traffic is no longer miscategorized after removal of the URL from the custom category.
745533-6 : NodeJS Vulnerability: CVE-2016-5325
Component: Local Traffic Manager
Symptoms:
It was found that the reason argument in ServerResponse#writeHead() was not properly validated.
Conditions:
iRules LX is running at the BIG-IP.
Impact:
A remote attacker could possibly use this flaw to conduct an HTTP response splitting attack via a specially-crafted HTTP request.
Workaround:
N/A.
Fix:
NodeJS updated to patch for CVE-2016-5325
745531-2 : Puffin Browser gets blocked by Bot Defense
Component: Application Security Manager
Symptoms:
Users using the Puffin Browser are blocked when accessing the Virtual Server when it is protected with either Proactive Bot Defense (within DoSL7 profile) or with the Bot Defense profile.
This applies to all version of the Puffin Browsers: Desktop, Android, iOS.
Conditions:
- Users using the Puffin Browser on Desktop, Android, iOS
- Bot Defense Profile, or: DoSL7 profile with Proactive Bot Defense is used while the "Block Suspicious Browsers" checkbox is enabled
Impact:
Users of the Puffin Browser cannot access the website
Workaround:
None
Fix:
Users of the Puffin Browser can now access the website that is protected by Bot Defense without getting blocked.
For the fix to be applied, both BIG-IP Release and ASU must be installed which contain the fix. Also, it is recommended to enable the following DB variables:
tmsh modify sys db dosl7.proactive_defense_validate_ip value disable
tmsh modify sys db dosl7.cs_validate_ip value disable
745514-1 : MRF SIP ALG with SNAT does not translate media addresses in SDP after SUBSCRIBE message
Component: Service Provider
Symptoms:
The media addresses in the SDP payload are not translated by MRF SIP ALD with SNAT after a SUBSCRIBE message has been processed.
Conditions:
This occurs because the SUBSCRIBE message has has the TO and FROM headers with the same value causing the ALG to enter hairpin mode.
Impact:
Media addresses in the SDP payload are not translated.
Workaround:
There is no workaround.
Fix:
Hairpin mode is not entered when processing SUBSCRIBE messages
745404-4 : MRF SIP ALG does not reparse SDP payload if replaced
Component: Service Provider
Symptoms:
When a SIP message is loaded, the SDP is parsed. If modified or replaced, the system does not reparse the modified payload.
Conditions:
This occurs internally while processing SDP in a SIP message.
Impact:
Changes to the SDP are ignored when creating media pinhole flows
Workaround:
None.
Fix:
The SDP payload is now reparsed if modified or replaced.
745387-1 : Resource-admin user roles can no longer get bash access
Component: TMOS
Symptoms:
Resource-admin users with bash access may write to system files beyond the scope of their assigned access.
Conditions:
Resource-admin users configured with bash shell access.
Impact:
Resource-admin users with bash access may write to system files causing security risks.
Workaround:
Do not assign bash access for resource-admin users.
Fix:
Resource-admin users restricted to tmsh access now. If a resource-admin user had bash access in a prior version and upgrades to this version, that user will get converted to tmsh access automatically after the upgrade process.
Behavior Change:
Resource-admin roles can no longer have bash shell access. And upon upgrade, resource-admin users with bash access will get converted to tmsh shell access.
745377-1 : TMM cores in certain scenarios with HTTP virtual server
Solution Article: K43450419
745371-1 : AFM GUI does not follow best security practices
Solution Article: K68151373
745257-1 : Linux kernel vulnerability: CVE-2018-14634
Solution Article: K20934447
745165-1 : Users without Advanced Shell Access are not allowed SFTP access
Solution Article: K38941195
745103-6 : NodeJS Vulnerability: CVE-2018-7159
Solution Article: K27228191
745027-2 : AVR is doing extra activity of DNS data collection even when it should not
Component: Application Visibility and Reporting
Symptoms:
When collecting DNS data, AVR generates data that is used only for BIG-IQ, even if not connected to BIG-IQ.
Conditions:
DNS Statistics collection or DNS-DoS is configured.
Impact:
avrd process is taking more CPU cycles for activity that is not needed. There is no impact to functionality.
Workaround:
None.
Fix:
The system no longer performs extra computation that is not needed in this case.
744949-1 : MRF SIP ALG with SNAT may restore incorrect client identity if client IP does not match NAT64 prefix
Component: Service Provider
Symptoms:
SIP response messages have the wrong IP address in the FROM header when using NAT64.
Conditions:
If the client's IPv6 address does not match the virtual server's configured IPv6 prefix, the FROM header on a response message will have a different IP address that the request message.
Impact:
The SIP ALG with SNAT system will be unable to establish a call for the client.
Workaround:
There is no workaround at this time.
Fix:
The FROM header will now contain the client's IP address.
744937-8 : BIG-IP DNS and GTM DNSSEC security exposure
Solution Article: K00724442
Component: Global Traffic Manager (DNS)
Symptoms:
For more information please see: https://support.f5.com/csp/article/K00724442
Conditions:
For more information please see: https://support.f5.com/csp/article/K00724442
Impact:
For more information please see: https://support.f5.com/csp/article/K00724442
Workaround:
None.
Fix:
For more information please see: https://support.f5.com/csp/article/K00724442
Behavior Change:
Note: After installing a version of the software that includes the fix for this issue, you must set the following db variables:
-- dnssec.nsec3apextypesbitmap
-- dnssec.nsec3underapextypesbitmap.
These two db variables are used globally (i.e., not per-DNSSEC zone) to configure the NSEC3 types bitmap returned in one-off NODATA responses for apex and under-apex responses, respectively.
When the BIG-IP system is queried for a DNS name in which the DNS name exists and is not of the RR type requested, the NSEC3 types bitmap on the response reflects what you configure for the db variable, minus the queried-for type.
When using these variables:
-- Configure type values as all lowercase.
-- Enclose multiple types in quotation marks (e.g., "txt rrsig").
-- Understand that there is likely no need to change the apex type setting; do so with extreme care. The under-apex settings are what you will find helpful in addressing the negative caching issue.
744707-2 : Crash related to DNSSEC key rollover
Component: Global Traffic Manager (DNS)
Symptoms:
When running out of memory, a DNSSKEY rollover event might cause a tmm crash and core dump.
Conditions:
-- System has low memory or is out of memory.
-- DNSSKEY rollover event occurs.
Impact:
tmm crashes and restarts. Traffic disrupted while tmm restarts.
Workaround:
There is no workaround.
Fix:
Fixed an issue in DNSSEC Key Rollover event that could cause a crash.
744686-2 : Wrong certificate can be chosen during SSL handshake
Component: Local Traffic Manager
Symptoms:
If two certificates of the same type are configured in an SSL profile, one marked `usage CA' and the other not, the wrong one could be chosen during the handshake.
Conditions:
Two certificates of the same type are configured in an SSL profile.
Impact:
The wrong certificate could be chosen during the handshake.
Workaround:
Do not configure two certificates of the same type on an SSL profile.
744685-2 : BIG-IP does not throw error when intermediate CA is missing the "Basic Constraints" and "CA:True" in its extension
Component: Local Traffic Manager
Symptoms:
An intermediate CA certificate should be considered invalid if the certificate does not contain both 'Basic Constraints: critical' and 'CA:TRUE' in its extension. The BIG-IP system does not enforce this.
Conditions:
The SSL profile has peer-cert-mode set to require and untrusted-cert-response-control set to drop.
Impact:
The system might unexpectedly accept the SSL connection while the peer is using an inappropriate certificate.
Workaround:
None.
Fix:
With this fix, if the SSL profile has peer-cert-mode set to require and untrusted-cert-response-control set to drop, the system drops the SSL handshake if the peer's CA certificate does not contain both 'Basic Constraints: critical' and 'CA:TRUE' in its extension.
Behavior Change:
When authenticating a peer's SSL certificate, the system requires a CA certificate to have the 'Basic Constraints' and 'CA:True' in its extension, like this:
X509v3 Basic Constraints: critical
CA:TRUE
If an SSL profile has peer-cert-mode set to require and untrusted-cert-response-control set to drop, the system drops the handshake if the peer's CA certificate does not satisfy this requirement.
744595-3 : DoS-related reports might not contain some of the activity that took place
Component: Application Visibility and Reporting
Symptoms:
Occasionally, some telemetry data of DoS related activity is lost.
Conditions:
No specific condition other than using the BIG-IP system anti-DDoS feature.
Impact:
DoS related reports might not contain some of the activity that takes place.
Workaround:
None.
Fix:
Issue was fixed, all telemetry data is collected without errors.
744589-3 : Missing data for Firewall Events Statistics
Component: Application Visibility and Reporting
Symptoms:
Statistical information that is collected for Firewall event, has some data that is getting lost and not reported.
When this is taking place, the following message appears at avrd log:
Some rows of load_stat_firewall_events_<some number> not loaded
Conditions:
AFM is used, no particular condition that leads to this situation of losing some of the stats, usually takes place under heavy activity.
Impact:
Statistical reports of Firewall Events are missing some the the activity that actually took place.
Workaround:
There is no workaround at this time.
Fix:
Issue with missing data was fixed.
744516-4 : TMM panics after a large number of LSN remote picks
Component: Carrier-Grade NAT
Symptoms:
TMM panics with the assertion 'nexthop ref valid' failed. This occurs after a large number of remote picks cause the nexthop reference count to overflow.
Conditions:
An LSN Pool and remote picks. Remote picks occur when the local TMM does not have any addresses or port blocks available. Remote picks are more likely when inbound and hairpin connections are enabled.
Impact:
TMM restarts. Traffic is interrupted.
Workaround:
There is no workaround.
Fix:
TMM no longer panics regardless of the number of remote picks.
744347-4 : Protocol Security logging profiles cause slow ASM upgrade and apply policy
Component: Application Security Manager
Symptoms:
ASM upgrade and apply policy are delayed by an additional 3 seconds for each virtual server associated with a Protocol Security logging profile (regardless of whether ASM is active on that virtual server). During upgrade, all active policies are applied, which leads to multiple delays for each policy.
Conditions:
There are multiple virtual servers associated with Protocol Security logging profiles.
Impact:
ASM upgrade and apply policy are delayed.
Workaround:
There is no workaround at this time.
744280-2 : Enabling or disabling a Distributed Application results in a small memory leak
Component: Global Traffic Manager (DNS)
Symptoms:
Enabling or disabling a Distributed Application results in an 8 byte memory leak.
Conditions:
Enabling or disabling a Distributed Application.
Impact:
8 bytes of memory are leaked every time a Distributed Application is enabled or disabled. If Distributed Applications are repeatedly programmatically enabled and disabled, over time, the system might eventually exhaust all available memory.
Workaround:
None.
Fix:
Enabling or disabling a Distributed Application no longer results in a memory leak.
744275-1 : BIG-IP system sends Product-Name AVP in CER with Mandatory bit set
Component: Service Provider
Symptoms:
The BIG-IP system always sets the Mandatory bit flag for Product-Name AVPs in DIAMETER Capabilities Exchange Request messages.
Conditions:
Using DIAMETER to send a Capabilities Exchange Request message with the Product-Name AVP.
Impact:
If the DIAMETER peer is intolerant of this Mandatory bit being set, it will reset the DIAMETER connection.
Workaround:
Configure an iRule in the MRF transport-config, for example:
ltm rule workaround {
when DIAMETER_EGRESS {
if {[serverside] && [DIAMETER::command] == "257" } {
DIAMETER::avp flags set 269 0
}
}
}
Fix:
This release always clears the Mandatory bit for Product-Name AVPs in DIAMETER Capabilities Exchange Request messages.
744210-2 : DHCPv6 does not have the ability to override the hop limit from the client.
Component: Local Traffic Manager
Symptoms:
DHCPv6 packet may be dropped by a device after the DHCP relay if the client provided hop limit is 1.
Conditions:
DHCPv6 Relay configured on the BIG-IP.
Impact:
Loss of DHCPv6 service.
Workaround:
There is no workaround at this time.
Fix:
Configurable hop limit over-ride capabilities provided for client sent DHCPv6 packets.
744188-1 : First successful auth iControl REST requests will now be logged in audit and secure log files
Component: TMOS
Symptoms:
Previously, when making a REST request from a client for the first time and it is successful, this action was not logged.
Just subsequent REST calls were logged or initial failed REST calls from a client were logged.
Conditions:
Making a successfully auth-ed initial REST request from a new client to BIG-IP.
Impact:
BIG-IP admins would not know when a new client first made a successful REST call to BIG-IP.
Workaround:
None.
Fix:
Now on the first successful REST call, these actions are logged in /var/log/audit and /var/log/secure log files.
Here's an example of what shows in audit log:
-- info httpd(pam_audit)[26561]: 01070417:6: AUDIT - user bart2 - RAW: httpd(pam_audit): user=bart2(bart2) partition=[All] level=Guest tty=(unknown) host=10.10.10.10 attempts=1 start="Fri Oct 12 17:07:53 2018" end="Fri Oct 12 17:07:53 2018".
Here's an example of what shows in secure log:
-- info httpd(pam_audit)[26561]: user=bart2(bart2) partition=[All] level=Guest tty=(unknown) host=10.10.10.10 attempts=1 start="Fri Oct 12 17:07:53 2018" end="Fri Oct 12 17:07:53 2018".
-- info httpd(pam_audit)[26561]: 01070417:6: AUDIT - user usr2 - RAW: httpd(pam_audit): user=usr2(usr2) partition=[All] level=Guest tty=(unknown) host=10.10.10.10 attempts=1 start="Fri Oct 12 17:07:53 2018" end="Fri Oct 12 17:07:53 2018".
Subsequent REST calls will continue to be logged normally.
Behavior Change:
Now on the first successful REST call, these actions are logged in /var/log/audit and /var/log/secure log files.
Subsequent REST calls will continue to be logged normally.
744035-6 : APM Client Vulnerability: CVE-2018-15332
Solution Article: K12130880
743900-1 : Custom DIAMETER monitor requests do not have their 'request' flag set
Component: Local Traffic Manager
Symptoms:
Using the technique detailed in the Article: K14536: Customizing the BIG-IP Diameter monitor https://support.f5.com/csp/article/K14536 to create custom DIAMETER monitor requests fails for any request that uses the numeric form of a DIAMETER command code, because the 'request' flag is not set in the DIAMETER packet.
Conditions:
-- Using custom DIAMETER monitor requests.
-- Using numeric DIAMETER command codes.
Impact:
The monitor probes fail because the BIG-IP system does not set the DIAMETER 'request' flag for requests it sends when using a numeric value for the command code, so the DIAMETER server thinks it is a response
Workaround:
None.
Fix:
Ensured that the 'request' flag is set for all DIAMETER monitor requests.
743803-1 : IKEv2 potential double free of object when async request queueing fails
Component: TMOS
Symptoms:
TMM may core during an IPsec cleanup of a failed async operation.
Conditions:
When an async IPsec crypto operation fails to queue.
Impact:
Restart of tmm. All tunnels lost must be re-established.
Workaround:
No workaround known at this time.
743437-3 : Portal Access: Issue with long 'data:' URL
Component: Access Policy Manager
Symptoms:
HTML page may contain a very long 'data:' URL. Portal Access cannot handle such URLs correctly.
Conditions:
HTML page with very long 'data:' similar to the following example:
data:image/png;base64,...
Such URLs might be several megabytes long.
Impact:
The rewrite plugin cannot process HTML pages with very long URLs and restarts. The page is not sent to the end user client; web application may not work correctly.
Workaround:
There is no workaround at this time.
Fix:
Now Portal Access handles very long 'data:' URLs correctly.
743257-3 : Fix block size insecurity init and assign
Component: Local Traffic Manager
Symptoms:
After an HA failover the block size insecurity checks were creating conditions for an infinite loop. This causes tmm to be killed by sod daemon via SIGABRT.
Conditions:
Rare not reproducible.
Impact:
Traffic disrupted while tmm restarts.
Workaround:
There is no workaround.
Fix:
The init and assign of block size insecurity were modified and debug checks added. A possible loop condition in ssl renegotiation was removed.
742852-1 : Bot Defense protection blocks Safari browser requests while using cross site redirect protection by 'Location' header
Component: Application Security Manager
Symptoms:
Bot defense blocks a request containing a TSPD101 cookie in query string. TSPD101 is sent when using the Safari browser, and cross-site redirect protection is applied on a request.
Conditions:
- ASM provisioned.
- Bot Defense profile attached to a virtual server.
- Cross-site redirection is applied on a request.
- Using the Safari browser.
Impact:
Cross-site requests are blocked during the grace period configured on the bot defense profile.
Workaround:
Disable browser verification in the bot defense profile.
Fix:
Cross-site redirect protection now works as expected when cookie is sent via query string.
742829-1 : SIP ALG: Do not translate and create media channels if RTP port is defined in the SIP message is 0
Component: Service Provider
Symptoms:
The BIG-IP system incorrectly handles SDP media ports. UAC sends SDP message body publishing capable of handling voice, text, and video. UAS responds, publishing voice, text and video not desired by setting video port to '0'. The BIG-IP system does not honor the fact that UAS does not want video, and translates video port '0' to an ephemeral port, causing the UAC to believe it must open a video channel. When the UAC sends a video connection request, the BIG-IP system sends the request to the wrong port, i.e., to the media port for text, which causes the connection to fail.
Conditions:
RTP media port defined in the SIP message is set to 0.
Impact:
Improper media channel creation.
Workaround:
You can use an iRule workaround to remove the media attributes with ports set to 0 at the ingress, and update the message body size accordingly.
742558-1 : Request Log export document fails to show some UTF-8 characters
Component: Application Security Manager
Symptoms:
After exporting an ASM security event log, the log file exists but the characters are not visible.
Conditions:
Decoding of UTF-8 characters fails in Request Log export on small range of characters.
Impact:
The contents of the log are not human readable.
Workaround:
None.
Fix:
Request Log export document now shows UTF-8 characters correctly.
742251-1 : Add Alibaba Cloud support to Qkview
Component: TMOS
Symptoms:
Qkview has been updated to support obtaining files relevant to the Alibaba Cloud.
Conditions:
Run Qkview.
Impact:
Files related to the Alibaba Cloud were not collected.
Workaround:
None
Fix:
Files related to Alibaba Cloud are now collected.
742237-4 : CPU spikes appear wider than actual in graphs
Component: Local Traffic Manager
Symptoms:
Graphs of CPU usage show spikes that are wider than actual CPU usage.
Conditions:
CPU usage has spikes.
Impact:
Graphs of CPU spikes appear to last longer than they actually last.
Workaround:
Perform the following procedure:
1. Run the following command to record the 5-second average rather than the 1-second average:
sed -i.bak 's/TMCOLNAME "ratio"/TMCOLNAME "five_sec_avg.ratio"/;s/TMCOLNAME "cpu_ratio_curr"/TMCOLNAME "cpu_ratio_5sec"/g' /config/statsd.conf
2. Restart statsd to load the new configuration:
bigstart restart statsd
Fix:
CPU samples for graphs are averaged over longer time to more closely represent actual time between samples.
742226-6 : TMSH platform_check utility does not follow best security practices
Solution Article: K11330536
742184-3 : TMM memory leak
Component: Local Traffic Manager
Symptoms:
-- High TMM memory utilization;
-- Aggressive sweeper activated;
-- the 'packet', 'xdata' and 'xhead' caches in the memory_usage_stat tmstat table have high 'allocated' and 'curr_allocs' numbers with a steadily increasing profile.
Conditions:
A fastL4 and a L7 profile (e.g. HTTP) are assigned to a virtual server.
Impact:
Degraded performance, possible TMM crash due to out-of-memory condition.
Workaround:
Do not add a L7 profile to a fastL4 virtual server.
Fix:
No memory leak in the TMM.
742078-6 : Incoming SYNs are dropped and the connection does not time out.
Component: Local Traffic Manager
Symptoms:
There is a hard-coded limit on the number of SYNs forwarded on a FastL4 connection. This might cause a problem when a connection is reused, for example, if a connection is not correctly closed.
Conditions:
-- SYN forwarding on FastL4 connections.
-- The number of SYNs on a single connection reaches the hard-coded limit.
Impact:
If the number of SYNs on a single connection reaches this limit, subsequent incoming SYNs are dropped and the connection might not time out.
Workaround:
There is no workaround.
Fix:
The following command enables the forwarding of an an unlimited number of SYNs:
tmsh modify sys db tm.dupsynenforce value disable
741503-1 : The BIG-IP system fails to load base config file when upgrading with static IPv4★
Component: TMOS
Symptoms:
The BIG-IP system cannot load base config when upgrading with static IPv4. By default, the configuration is not moved on previous releases during the installation, but it moves mgmt address settings and the license.
Conditions:
This occurs during upgrade when a static mgmt IPv4 address is configured.
Impact:
Configuration does not load after upgrade.
Workaround:
Manually set the mgmt-dhcp value to 'disabled' in bigip_base.conf file.
Fix:
The BIG-IP system now loads the base config file as expected when upgrading with static IPv4 as mgmt address.
741449-3 : alert_details is missing for COMPONENT_VALIDATION_JAVASCRIPT_THRESHOLD alerts
Component: Fraud Protection Services
Symptoms:
JAVASCRIPT_THRESHOLD alert should contain 2 timestamps:
1. component-validation cookie timestamp (set on cookie creation)
2. current BIG-IP timestamp
currently, these timestamps are not available in the alert details
Conditions:
JAVASCRIPT_THRESHOLD alert is triggered
Impact:
it is impossible to analyze the alert
Workaround:
There is no workaround at this time.
Fix:
FPS should always include both timestamps when triggering the JAVASCRIPT_THRESHOLD alert
741222-2 : Install epsec1.0.0 into software partition.★
Component: Access Policy Manager
Symptoms:
On some hardware configurations, after the BIG-IP software upgrade, epsec1.0.0 install fails.
Conditions:
-- Upgrade from earlier versions to BIG-IP 14.1.0.
-- Attempting to install epsec1.0.0.
Note: This occurs on only some hardware platforms, including the following:
+ BIG-IP 4000
+ BIG-IP i2800 series
+ BIG-IP Virtual Edition
+ BIG-IP vCMP Guest
Impact:
Unable to install or use software check with APM endpoint inspection.
Workaround:
There is no workaround other than upgrading to a fixed version of the software.
Fix:
The epsec1.0.0 installation is now performed into active BIG-IP software volume (/var), so this issue no longer occurs.
741163-3 : RHEL7: Kernel CVE-2018-3693
Solution Article: K54252492
741048-1 : iRule execution order could change after editing the scripts
Component: Local Traffic Manager
Symptoms:
iRule execution order might change. For example, you have the following iRules configured on a virtual server: rule1, rule2, rule3, and they all have CLIENT_ACCEPTED. If you do not specify their priority, or if you specify the same priority to each one, when you edit one, the execution order changes. For example, if you edit the rule2 script, the execution order changes to rule2, rule1, rule3.
Conditions:
Multiple events have the same priority.
Impact:
Execution order changes.
Workaround:
Specify different priorities for iRules containing the same event.
Fix:
iRule execution order is now maintained after editing the scripts.
740959-4 : User with manager rights cannot delete FQDN node on non-Common partition
Component: Local Traffic Manager
Symptoms:
A user that has manager rights for a non-Common partition, but not for the /Common partition, may be denied delete privileges for an FQDN template node that is created on the non-Common partition for which the user does have manager rights.
This occurs because ephemeral nodes created from the FQDN template node are 'shared' in the /Common partition, so the delete transaction fails because the user has insufficient permissions to delete the dependent ephemeral nodes on the /Common partition.
Conditions:
-- A user is created with manager rights for a non-Common partition.
-- That user does not have manager rights for the /Common partition;
-- At least one ephemeral node is created from that FQDN template node (due to DNS lookup), which is not also shared by other FQDN template nodes.
-- That user attempts to delete an FQDN template node on the non-Common partition for which the user has manager rights.
Impact:
The transaction to delete the FQDN template node fails due to insufficient permissions. No configuration changes occur as a result of the FQDN template node-delete attempt.
Workaround:
You can use either of the following workarounds:
-- Perform the FQDN template node-delete operation with a user that has manager rights to the /Common partition.
-- Create the FQDN template node on the /Common partition.
Fix:
A user with manager rights for a non-Common partition that has no manager rights to the /Common partition, is now able to successfully delete an FQDN template node created on that non-Common partition.
740755-6 : Kernel vulnerability: CVE-2018-3620
Solution Article: K95275140
740543-1 : System hostname not display in console
Component: TMOS
Symptoms:
Hostname is not displayed in the shell prompt in bash and tmsh.
Conditions:
After reboot or upgrade, login to the host console, shell, or tmsh.
Impact:
Hostname is not displayed in the shell prompt.
Workaround:
Update hostname from GUI/TMSH.
Fix:
Hostname is now displayed in the shell prompt in bash and tmsh.
740345-3 : TMM core files seen on standby device after failover, when connection mirroring, session mirroring and OCSP stapling are enabled.
Component: Local Traffic Manager
Symptoms:
TMM generates cores files on the device.
Conditions:
Issue is seen when connection mirroring, session mirroring and OCSP stapling is enabled.
Impact:
If a failover happens when a SSL handshake is in progress,
TMM restarts and a core file is generated on the standby device. Traffic disrupted while tmm restarts.
Workaround:
None.
739971 : Linux kernel vulnerability: CVE-2018-5391
Solution Article: K95343321
739963-4 : TLS v1.0 fallback can be triggered intermittently and fail with restrictive server setup
Component: Local Traffic Manager
Symptoms:
HTTPS monitors mark a TLS v1.2-configured pool member down and never mark it back up again, even if the pool member is up. The monitor works normally until the SSL handshake fails for any reason. After the handshake fails, the monitor falls back to TLS v1.1, which the pool members reject, and the node remains marked down.
Conditions:
This might occur when the following conditions are met:
-- Using HTTPS monitors.
-- Pool members are configured to use TLS v1.2 only.
Impact:
Once the handshake fails, the monitor remains in fallback mode and sends TLS v1.0 or TLS v1.1 requests to the pool member. The pool member remains marked down.
Workaround:
To restore the state of the member, remove it and add it back to the pool.
739945-4 : JavaScript challenge on POST with 307 breaks application
Component: Application Security Manager
Symptoms:
A JavaScript whitepage challenge does not reconstruct when the challenge is on a POST request and the response from the back-end server is 307 Redirect. This happens only if the challenged URL is on a different path than the redirected URL. This prevents the application flow from completing.
Conditions:
- JavaScript challenge / CAPTCHA is enabled from either Bot Defense, Proactive Bot Defense, Web Scraping, DoSL7 Mitigation or Brute Force Mitigation.
- The challenge is happening on a POST request on which the response from the server is a 307 Redirect to a different path.
Impact:
Server is not able to parse the request payload and application does not work. This issue occurs because the TS*75 cookie is set on the path of the challenged URL, so the redirected URL does not contain the cookie, and the payload is not reconstructed properly to the server.
Workaround:
As a workaround, you can construct an iRule to identify that the response from the server is 307 Redirect, retrieve the TS*75 cookie from the request, and add to the response a Set-Cookie header, setting the TS*75 cookie on the '/' path.
Fix:
Having a JavaScript challenge on a POST request with 307 Response no longer prevents the application from working.
739432 : F5 Adaptive Auth (MFA) Reports are no longer supported on BIG-IP systems
Component: Access Policy Manager
Symptoms:
F5 Adaptive Auth Configuration is a configuration required on BIG-IP systems. This allows access to F5 Adaptive Authentication Service hosted on the cloud. As the reporting feature is deprecated, the Reports associated with feature are removed from the BIG-IP system. The associated reports are now shown in the F5 Adaptive Auth Service instead.
Conditions:
Admin attempts to view F5 Adaptive Auth reports on the BIG-IP system.
Impact:
Admin cannot use F5 Adaptive Auth Reports on the BIG-IP system. This is because F5 Adaptive Auth Reports functionality has been removed from BIG-IP systems, and is no longer supported.
Workaround:
View the associated reports in the F5 Adaptive Auth Service instead.
Fix:
F5 Adaptive Auth (MFA) Reports are no longer supported on BIG-IP systems.
Behavior Change:
The reporting feature of the F5 Adaptive Auth Configuration, which allows access to F5 Adaptive Authentication Service hosted on the cloud, is deprecated with this release, so the Reports associated with feature are removed from the BIG-IP system. The associated reports are now shown in the F5 Adaptive Auth Service instead.
739349-3 : LRO segments might be erroneously VLAN-tagged.
Component: Local Traffic Manager
Symptoms:
Segments being processed for large receive offload (LRO) (the action the system performs to aggregate multiple incoming packets within a buffer before passing them up)
might be erroneously VLAN-tagged when LRO is enabled.
Conditions:
-- TCP LRO enabled.
-- Egress VLAN untagged.
Impact:
Egress traffic might sometimes be tagged.
Workaround:
Disable TCP LRO. To enable or disable LRO functionality, you can use the following command syntax:
tmsh modify sys db tm.tcplargereceiveoffload value <enable | disable>
Fix:
The system now ensures that fragment packet flags are correctly set.
738945-4 : SSL persistence does not work when there are multiple handshakes present in a single record
Component: Local Traffic Manager
Symptoms:
SSL persistence hangs while parsing SSL records comprising multiple handshake messages.
Conditions:
This issue intermittently happens when an incoming SSL record contains multiple handshake messages.
Impact:
SSL persistence parser fails to parse such messages correctly. The start of the record may be forwarded on to server but then connection will stall and eventually idle timeout.
Workaround:
There is no workaround other than using a different persistence, or disabling SSL persistence altogether.
After changing or disabling persistence, the transaction succeeds and no longer hangs.
738943-3 : imish command hangs when ospfd is enabled
Component: TMOS
Symptoms:
- dynamic routing enabled
- ospfd protocol enabled
- imish hangs
Conditions:
- running imish command
Impact:
ability to show dynamic routing state using imish
Workaround:
restart ospfd daemon
738891-1 : TLS 1.3: Server SSL fails to increment key exchange method statistics
Component: Local Traffic Manager
Symptoms:
When TLS 1.3 is negotiated with a server SSL profile, the key exchange method statistics do not increment.
Conditions:
-- TLS 1.3 is configured on a server SSL profile.
-- TLS 1.3 is the protocol version negotiated.
Impact:
Missing statistics.
Workaround:
None.
Fix:
The key exchange method statistics are now correctly incremented.
Behavior Change:
When TLS 1.3 is now supported for configuration on server SSL profiles, so these statistics are now present.
738677-1 : Configured name of wildcard parameter is not sent in data integrity alerts
Component: Fraud Protection Services
Symptoms:
FPS sends a data integrity alert when a parameter is configured with 'Check Data Manipulation' enabled.
the alert includes parameter's actual-name, actual-val-crc, and expected-val-crc.
For wildcard parameters, it is difficult to tell which parameter was found and triggered the data integrity alert, since FPS sends only the actual name that was found in the request.
Conditions:
Wildcard parameter defined for integrity check.
Impact:
Alert analysis is more difficult, as the actual matched parameter is not obvious.
Workaround:
None.
Fix:
FPS now includes wildcard parameter's configured-name in the data integrity alert.
738676-1 : Errors when trying to delete all bot requests from Security :: Event Logs : Bot Defense : Bot Requests
Component: Application Security Manager
Symptoms:
When trying to delete all bot requests from Security :: Event Logs : Bot Defense : Bot Requests
Delete fails with error and exceptions in restjavad.log:
[WARNING][593][30 Jul 2018 14:42:26 UTC][8100/mgmt ForwarderPassThroughWorker] URI:http://localhost:8100/mgmt/tm/asm/events/bot-defense-events?$top=200000, Referrer:https://<local_IP>/dms/bot_defense/bot_requests.php, Method:DELETE, Exception:java.util.concurrent.TimeoutException: remoteSender:<remote_IP>, method:DELETE
Conditions:
This can be encountered when deleting all bot requests while traffic is passing.
Impact:
Delete fails, and there is significant memory consumption in asm_config_server.
Workaround:
None.
Fix:
This release fixes the bot-requests deletion process to not fail with errors and not cause substantial memory consumption in asm_config_server.
738430-3 : APM is not able to do compliance check on iOS devices running F5 Access VPN client
Component: Access Policy Manager
Symptoms:
Compliance check against Microsoft Intune fails when an APM end user attempts a VPN connection from a managed iOS device running the F5 Access VPN client.
Conditions:
-- APM policy is configured to use Microsoft Intune for device compliance check.
-- APM end user is attempting VPN connection using the F5 Access VPN client on an iOS device.
Impact:
APM is not able to do compliance checks on the device, and VPN connection fails.
Workaround:
None.
Fix:
APM can now check iOS devices for compliance against Microsoft Intune.
738330-3 : /mgmt/toc endpoint issue after configuring remote authentication
Component: TMOS
Symptoms:
'Invalid username or password.' error on the /mgmt/toc page after configuring remote authentication.
Conditions:
When remote auth is configured.
Impact:
Cannot configure remote authentication.
After configuring remote authentication, you can login to the mgmt/toc area with the admin user, but using a remote auth user ended up with 'You are not authorized to use this resource'.
Workaround:
On BIG-IP versions since 14.1.0.6 and 13.1.1.5:
Enable 'Fallback to Local' in the remote auth config section on the BIG-IP system:
tmsh modify auth source fallback true.
Both local BIG-IP user 'admin' and LDAP user are now able to authenticate and access https://XX.XX.XX.XX/mgmt/toc.
On other versions of BIG-IP software, there is no workaround.
Fix:
When source type is set to a remote auth method, login now succeeds. If the remote server is unavailable, authentication now falls back to local authentication, if authentication source fallback is set to true.
Behavior Change:
This release allows fallback to local authentication. When the authentication source type is set to a remote authentication source, if the remote server is unavailable, authentication now falls back to local authentication, if authentication source fallback is set to true.
738284-2 : Creating or deleting rule list results in warning message: Schema object encode failed
Component: Advanced Firewall Manager
Symptoms:
"Schema object encode failed: No foreign keys found for nested object" warning message is logged into /var/log/ltm while creating or deleting the rule list.
Jul 25 05:44:49 localhost.localdomain warning icr_eventd[4778]: 01a10008:4: Schema object encode failed: No foreign keys found for nested object with tag 17547
Conditions:
Observed when creating or deleting rule list in /var/log/ltm
tmsh create security firewall rule-list rule-list1
tmsh delete security firewall rule-list rule-list1
Impact:
The warning message has no impact on functionality and can be ignored.
Fix:
Log message has been changed to log at the debug level.
738236-7 : UCS does not follow current best practices
Solution Article: K25607522
738108-1 : SCTP multi-homing INIT address parameter doesn't include association's primary address
Component: TMOS
Symptoms:
When multihoming is enabled in an SCTP profile, the source-address of the INIT chunk was not added as an Address parameter in that INIT chunk.
Conditions:
Any SCTP profile where multi-homing is enabled.
Impact:
No impact for peers that implement SCTP in accordance with RFC 4960.
RFC does not require that the address either should or should not be included in the INIT chunk, but does require that an entity receiving an INIT chunk include the source-address in its list regardless of whether that is included in the INIT chunk.
Workaround:
No known workaround.
Fix:
BIG-IP now includes all relevant addresses in the INIT chunk.
Behavior Change:
When multihoming is enabled, the local address will now be added to the INIT chunk. Previously the local address (that is, the address that the datagram is sent from) was not listed as an Address parameter. This is permitted, but not required, by RFC 4960 section 3.3.2.1.
737985-2 : BIG-IP systems cannot be deployed in an L2 transparent mode with VLAN groups in Standard Proxy mode.
Component: Local Traffic Manager
Symptoms:
Services that require Standard Proxy mode cannot be availed of.
Conditions:
A BIG-IP system deployed in an L2 transparent mode using VLAN groups.
Impact:
Prevents services that require Standard Proxy mode from being leveraged in an L2 transparent deployment.
Workaround:
None.
Fix:
Support standard proxy mode.
737910-4 : Security hardening on the following platforms
Solution Article: K18535734
737866-2 : Rare condition memory corruption
Component: Application Security Manager
Symptoms:
BD dameon core
Conditions:
Slow server and slow offload services.
Impact:
A bd crash, traffic distrubance
Workaround:
None.
Fix:
A memory corruption condition was solved.
737731-6 : iControl REST input sanitization
Solution Article: K44885536
737574-6 : iControl REST input sanitization★
Solution Article: K20541896
737565-6 : iControl REST input sanitization
Solution Article: K20445457
737558-1 : Protocol Inspection user interface elements are active but do not work
Component: Protocol Inspection
Symptoms:
Protocol Inspection (PI) user interface options are present, but are not applied to traffic.
Protocol Inspection (PI) now requires the presence of either an add-on subscription or an AFM standalone license for any of the features to work. A 'Good' or 'Better' license does not activate the PI features. The Configuration Utility still allows you to configure inspection profiles, compliance checks, and signatures, but they are not applied to traffic. There is no feedback that they are not applied.
Conditions:
-- AFM licensed and provisioned through 'Good' or 'Better' license, but no add-on subscription license for Protocol Inspection. Alternately, AFM licensed as an add-on module to another module (typically LTM).
-- PI profile configured and applied to a virtual server or referenced in a firewall rule in an active firewall policy.
Impact:
If you previously had Protocol Inspection configured without the add-on license installed, the features are no longer applied to traffic until the add-on license is obtained. However, the GUI options remain active.
Workaround:
None.
737536-2 : Enabling 'default-information originate' on one of the several OSPF processes does not inject a default route into others.
Component: TMOS
Symptoms:
The use case is the following:
|OSPF 1|---|Network1|------[|OSPF process 1|---BIG-IP system---|OSPF process 2|]-----|Network2|---|OSPF 2|
Attempting to redistribute default route received from OSPF process that is peering with the Internet to OSPF process 2. However, if that route is removed (e.g., an Internet link goes down), OSPF process 2 removes the associated route and the 'default-information originate' command is the ideal choice, because as long as the OSPF process 1 default route is in the routing table, the default route is redistributed into OSPF process 2. If that route is gone, OSPF process 2 immediately removes it from routing table. Enabling 'default-information originate' on OSPF process 2 does not affect the outcome, and a default route is not injected like it should be.
Conditions:
-- On the BIG-IP system, OSPF routing protocol is enabled on a route-domain.
-- Routing configuration example:
OSPF router config examples:
***
OSPF 1:
!router ospf 1
ospf router-id 10.13.0.7
redistribute ospf
network 10.13.0.0/16 area 0.0.0.1
default-information originate
OSPF 2:
router ospf 1
ospf router-id 10.14.0.5
redistribute ospf
network 10.14.0.0/16 area 0.0.0.1
BIG-IP system:
router ospf 1
ospf router-id 10.13.0.2
network 10.13.0.0/16 area 0.0.0.1
router ospf 2
ospf router-id 10.14.0.9
network 10.14.0.0/16 area 0.0.0.1
***
-- Enable 'default-information originate' on BIG-IP OSPF process 2 should allow OSPF process 2 to receive advertised default route from BIG-IP OSPF process 1 if such exists.
# expected OSPF routers configuration on the BIG-IP system:
router ospf 1
ospf router-id 10.13.0.2
network 10.13.0.0/16 area 0.0.0.1
router ospf 2
ospf router-id 10.14.0.9
network 10.14.0.0/16 area 0.0.0.1
default-information originate
Impact:
A default route from OSPF process 1 is not advertised into OSPF process 2 routing table.
Workaround:
None.
Fix:
Enabling 'default-information originate' on OSPF process 2 forces OSPF process 2 to receive a default route from OSPF process 1 if such exists.
737423-2 : Binutils vulnerabilities: CVE-2018-7569 CVE-2018-10373 CVE-2018-13033
Component: TMOS
Symptoms:
An integer wraparound has been discovered in the Binary File Descriptor (BFD) library distributed in GNU Binutils up to version 2.30. An attacker could cause a crash by providing an ELF file with corrupted DWARF debug information.
concat_filename in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted binary file, as demonstrated by nm-new.
The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted ELF file, as demonstrated by _bfd_elf_parse_attributes in elf-attrs.c and bfd_malloc in libbfd.c. This can occur during execution of nm.
Conditions:
Command-line usage of binutils tools by users with Advanced Shell Access
Impact:
None in default, standard and recommended configurations.
Workaround:
None.
Fix:
Upgraded binutils to an unaffected version.
737035-2 : New and improved infrastructure for BDoS to share learned traffic characteristics within the device group/cluster setup.
Component: Advanced Firewall Manager
Symptoms:
BDoS feature (AFM/DHD) needs to share learned traffic characteristics across nodes (within a cluster) and across devices (within the device group).
Previous infrastructure used by BDOS could cause spikes in disk usage due to a large number of snapshot files being saved under /config/filestore/ partition (.trash_bin_d and files_d/Common_d/l4bdos_context_d sub-directories).
Conditions:
BDOS feature is enabled on at least 1 context (either at global context or at least 1 virtual server).
Impact:
The /config partition on the BIG-IP system consistently fills up with large numbers of directories/files under /config/filestore/, eventually causing system to run out of disk space under /config partition.
Workaround:
As a workaround, manually delete files/directories filling up under /config/filestore/ partition (.trash_bin_d and files_d/Common_d/l4bdos_context_d sub-directories) to free up disk space.
Fix:
BDOS now uses a new (and improved) infrastructure for sharing data across nodes/devices (within device group/cluster setup) that does not require snapshot files to be maintained under /config/filestore/ partition.
734551-3 : L2 transparent VLAN group based deployments require configuration of a transparent next hop per virtual server
Component: Local Traffic Manager
Symptoms:
Configuration overhead that requires configuration of a virtual server per VLAN group.
Conditions:
A BIG-IP system deployed in an L2 transparent mode using VLAN groups.
Impact:
Configuration overhead to configure virtual server per VLAN group.
Workaround:
None.
Fix:
Prevent the need to configure a virtual server per VLAN group.
734291-1 : Logon page modification fails to sync to standby
Component: Access Policy Manager
Symptoms:
Changes in the login page of VPE do not sync to standby.
Conditions:
1. You make changes to the logon page on the active device, making changes to the username or any other field on the login page of VPE.
2. You sync to standby, and it succeeds.
Impact:
When you access in standby device, the customization error failure message appears, and the dialog fails to open in VPE. You cannot see the changes made on the active device from standby device.
Workaround:
Do not make changes to fields on the login page.
Fix:
Changes in the login page of VPE now sync to standby.
734228 : False-positive illegal-length violation can appear
Component: Application Security Manager
Symptoms:
A false-positive illegal-length violation.
Conditions:
A chunked request where the request length is more than half of the configured max-request length.
Impact:
False-positive illegal-length violation.
Workaround:
Configure a higher max request length violation.
Fix:
Fixed a false-positive request-length violation.
727136-1 : One dataset contains large number of variations of TLS hello messages on Chrome
Component: Anomaly Detection Services
Symptoms:
Dataset of TLS fingerprints of clients of a site can consume significantly more space than needed.
Conditions:
-- BADOS with TLS signatures.
-- AFM end user clients using the Mozilla Chrome browser.
Impact:
Dataset is full, so it does not contain a full TLS fingerprints set. As result there is a risk of creating false-positive TLS signatures.
Workaround:
Turn off TLS signatures.
Fix:
Dataset of TLS fingerprints contains unique TLC fingerprints regardless GREASE ciphers.
727107-4 : Request Logs are not stored locally due to shmem pipe blockage
Component: Application Security Manager
Symptoms:
An unknown issue causes the communication layer between pabnagd and asmlogd to be become stuck. Messages similar to the following appear in pabnagd.log:
----------------------------------------------------------------------
account |NOTICE|... src/Account.cpp:183|Skipped 36 repeated messages. Request Log protobuf subscription queue is full. Message dropped.
rqlgwriter |WARNIN|... src/RequestLogWriter.cpp:137|Skipped 599 repeated messages. No space to write in shmem.
Messages similar to the following appear in pabnagd.log:
Conditions:
Request Logs are not stored locally due to shmem pipe blockage.
Impact:
Event logs stop logging locally.
Workaround:
Restart policy builder with:
killall -s SIGHUP pabnagd
Fix:
The policy builder now detects the blockage, and restarts the connection with the request logger.
726647-5 : PEM content insertion in a compressed response may truncate some data
Component: Policy Enforcement Manager
Symptoms:
HTTP compressed response with content insert action can truncate data.
Conditions:
PEM content insertion action with compressed HTTP response.
Impact:
Data might be truncated.
Workaround:
There is no workaround other than disabling compression accept-encoding attribute in the HTTP request.
Fix:
HTTP compressed response with content insert action no longer truncates data.
726487-4 : MCPD on secondary VIPRION or vCMP blades may restart after making a configuration change.
Component: TMOS
Symptoms:
The MCPD daemon on secondary VIPRION or vCMP blades exits and restarts, logging errors similar to the following:
-- err mcpd[11869]: 01070734:3: Configuration error: Node name /group1/5.5.5.5 encodes IP address 5.5.5.5%18 which differs from supplied address field 5.5.5.5.
-- err mcpd[11869]: 01070734:3: Configuration error: Configuration from primary failed validation: 01070734:3: Configuration error: Node name /group1/5.5.5.5 encodes IP address 5.5.5.5%18 which differs from supplied address field 5.5.5.5... failed validation with error 17237812.
Or:
--- err mcpd[8320]: 0107003b:3: Pool member IP address (5.5.5.5%999) cannot be assigned to node (/group1/node1). The node already has IP address (5.5.5.5).
--- err mcpd[8320]: 01070734:3: Configuration error: Configuration from primary failed validation: 0107003b:3: Pool member IP address (5.5.5.5%999) cannot be assigned to node (/group1/node1). The node already has IP address (5.5.5.5).... failed validation with error 17236027.
Or:
err mcpd[12620]: 01070734:3: Configuration error: Configuration from primary failed validation: 01070734:3: Configuration error: Invalid static route modification. A destination change from 172.25.0.1%500 to 172.25.0.1 is not supported... failed validation with error 17237812.
Conditions:
This issue occurs when all of the following conditions are met:
-- VIPRION or vCMP platform with more than one blade.
-- A partition with a non-default route domain.
-- Either:
+ Creating a pool member in that partition while a configuration save is taking place at the same time (either system- or user-initiated).
+ Modifying a route in that partition while a configuration save is taking place at the same time (either system- or user-initiated).
Impact:
If the system is Active, traffic is disrupted as the secondary blades restart. The capacity of the system will be reduced until all blades are on-line again. Additionally, depending on the system configuration, the system may fail over to its peer (if one exists).
Workaround:
There is no workaround other than not to create pool members or modify routes from one client while saving configuration changes in another client. However, this does not help if the configuration save operation was system-initiated.
Fix:
MCPD on secondary blades no longer restarts if a pool member is created or a route is modified in a partition that uses a non-default route domain at the same as the configuration is being saved.
726393-2 : DHCPRELAY6 can lead to a tmm crash
Solution Article: K36228121
726327 : NodeJS debugger accepts connections from any host
Solution Article: K37111863
726317-6 : Improved debugging output for mcpd
Component: TMOS
Symptoms:
In some cases, mcpd debugging output is insufficient for diagnosing a problem.
Conditions:
Using debugging in mcpd, specifically, setting log.mcpd.level to debug.
Impact:
None. Has no effect without log.mcpd.level set to debug.
Workaround:
None.
Fix:
New output helps F5 engineers diagnose mcpd problems more easily.
726240-1 : 'Cannot find disk information' message when running Configuration Utility★
Component: TMOS
Symptoms:
When running the Configuration Utility in the GUI, after clicking Next on the License screen, the GUI reports an error and you are unable to proceed: Cannot find disk information.
Conditions:
The conditions that trigger this are unknown; in one scenario, it was observed after running 'tmsh load sys config default', suspending the BIG-IP Virtual Edition (VE) guest, and then restarting it and running the Configuration Utility.
Impact:
You are unable to proceed through the configuration utility.
Workaround:
If this occurs, reboot the device, and the error will fix itself.
726176-2 : Platforms using RSS hash reuse source port too rapidly when the FastL4 virtual server is set to source-port preserve
Component: Local Traffic Manager
Symptoms:
The BIG-IP system running RSS DAG hash attempts to reuse ports while pool members remain in a TIME_WAIT state and are unable to process new connections.
Conditions:
This issue occurs when all of the following conditions are met:
-- You are running on a BIG-IP platform using RSS DAG hash, for instance, z100 and 2000 or 4000 series hardware platform
-- You have the FastL4 profile associated with a virtual server.
-- The virtual server is configured with source-port preserve.
Impact:
Traffic throughput may be degraded.
Workaround:
Set source-port to change.
Fix:
Platforms running RSS DAG hash now reuse source port at the correct rate when virtual server sets source-port preserve.
725791-6 : Potential HW/HSB issue detected
Component: TMOS
Symptoms:
There are a number of High-Speed Bridge (HSB) stats registers that monitor the errors in HSB SRAM that are critical for passing traffic, for example, RQM_CRC_ERROR Count 0, RQM_CRC_ERROR count 1, RQM_CRC_ERROR Count 2, etc. Any errors in any of these registers may indicate a hardware error in the HSB SRAM that impedes traffic through embedded Packet Velocity Acceleration (ePVA). In that case, ePVA-accelerated flow might fail.
With a burst of CRC errors in the SRAM for ePVA transformation cache, it does not trigger a failover and causes a silent traffic outage on the FastL4 VIP with hardware traffic acceleration. This occurs because the health check watchdog packets are still functioning correctly, and the current TMOS software primarily monitors watchdog packets tx/rx failures to trigger failover.
In these cases, there might be the following messages in /var/log/tmm*:
Device error: hsb_lbb* tre2_crc_errs count *
Conditions:
Traffic is offloaded to HSB hardware for acceleration.
Impact:
Hardware accelerated traffic drop.
Workaround:
Switch traffic to software acceleration.
Fix:
Including traffic-critical registers in failover triggers, helps failover happen quickly with minimum disruption to traffic in the case of SRAM hardware failures.
725625-1 : BIG-IP VE Cryptographic Offload updated to Intel QAT 1.7 v4.4.0 SDK
Component: TMOS
Symptoms:
Data compression offload to QuickAssist devices is now enabled as part of BIG-IP Virtual Edition (VE) Cryptographic Offload feature.
BIG-IP VE Cryptographic Offload uses the Intel QAT 1.7 SDK. A newer QAT 1.7 SDK v4.4.0 provides code and firmware that fixes several known QAT defects, including a compression defect specific to Lewisburg/Lewis Hill QuickAssist devices.
Conditions:
-- BIG-IP VE SSL Offload is licensed
-- The BIG-IP VE VM has been assigned QAT Virtual Functions.
Impact:
BIG-IP VE Cryptographic and Compression offload are more reliable. The QAT 1.7 v4.4.0 SDK should be installed on the hypervisor host.
Workaround:
None.
Fix:
Several Intel QuickAssist defects have been fixed for
BIG-IP VE Cryptographic and Compression Offload by
upgrading BIG-IP VE to the Intel QAT 1.7 v4.4.0 SDK.
This newer QAT SDK introduces code and firmware support to fix several defects. A new Compress and Verify mode is introduced to work around a compression defect specific to Lewisburg/Lewis Hill QuickAssist devices.
See Intel's QuickAssist Release Notes for additional details:
https://01.org/sites/default/files/downloads//336211-009qatrelnotes.pdf.
725551-2 : ASM may consume excessive resources
Solution Article: K40452417
724680-6 : OpenSSL Vulnerability: CVE-2018-0732
Component: TMOS
Symptoms:
For more information see: https://support.f5.com/csp/article/K21665601
Conditions:
For more information see: https://support.f5.com/csp/article/K21665601
Impact:
For more information see: https://support.f5.com/csp/article/K21665601
Workaround:
None.
Fix:
For more information see: https://support.f5.com/csp/article/K21665601
724327-2 : Changes to a cipher rule do not immediately have an effect
Component: Local Traffic Manager
Symptoms:
If a cipher rule is changed, and a cipher group that uses the rule is attached to an SSL profile, the change does not take effect until something else on the SSL profile changes.
Conditions:
-- A cipher group is used by an SSL profile.
-- One of its cipher rules changes.
Impact:
Unexpected behavior occurs because the cipher rule change does not take effect immediately.
Workaround:
After changing the cipher rule that's used by a cipher group, make a change to any SSL profile that uses the associated cipher group.
Fix:
Any changes to a cipher rule or cipher group now takes immediate effect.
724109-2 : Manual config-sync fails after pool with FQDN pool members is deleted
Component: TMOS
Symptoms:
If a user, deletes a fqdn pool on one BIG-IP in a cluster and then run a manual config sync with another BIG-IP, the change fails to sync with the other BIG-IPs in the cluster.
Conditions:
- Create fqdn pool in one BIG-IP
- Save sys config
- Run config sync
- Delete fqdn pool
- Save sys config
- Run config sync manually
Result: After deleting fqdn pool in BIG-IP and config sync with another BIG-IP, Manual config sync failed. Still, we can see the deleted fqdn pool in another BIG-IP
Impact:
FQDN pool delete failed in another BIG-IP and manual config sync operation is failed.
Workaround:
The workaround for this issue is to use auto-sync.
723790-3 : Idle asm_config_server handlers consumes a lot of memory
Component: Application Security Manager
Symptoms:
Idle asm_config_server handlers needlessly uses a large amount of memory.
Conditions:
This issue might result from several sets of conditions. Here is one:
Exporting a big XML ASM policy and then leaving the BIG-IP system idle. Relevant asm_config_server handler process increases its memory consumption and stays that way, holding on to the memory until it is released with a restart.
Impact:
Unnecessary memory consumption.
Workaround:
1) Lower the MaxMemorySize threshold from 450 MB to 250 MB, per process of asm_config_server:
---------------
# perl -pi.bak -e 's/MaxMemorySize=471859200/MaxMemorySize=262144000/' /etc/ts/tools/asm_config_server.cfg
---------------
2) Restart asm_config_server, to free up all the memory that is currently taken by all asm_config_server processes and to impose the new MaxMemorySize threshold:
---------------
# pkill -f asm_config_server
---------------
Notes:
-- The provided workaround does not permanently fix the issue. Instead it alleviates the symptoms of memory pressure, by (1) lowering the MaxMemorySize threshold from 450 MB to 250 MB, per process of asm_config_server, and (2) freeing up all the memory that is currently taken by all asm_config_server processes.
-- This workaround does not cause any down time; the asm_config_server processes automatically start within ~30 seconds.
723288-4 : DNS cache replication between TMMs does not always work for net dns-resolver
Component: Global Traffic Manager (DNS)
Symptoms:
System DNS resolvers (net dns-resolver objects) do not share DNS reply information between the dns resolver instances across TMMs, which can result in separate TMMs performing seemingly-unnecessary DNS lookups.
Conditions:
There are no LTM DNS *cache* objects present in the BIG-IP configuration.
Impact:
A performance impact resulting from each TMM having to perform unnecessary DNS lookups.
Workaround:
Use tmsh to create a placeholder LTM DNS cache resolver object. The object does not need to be used anywhere, just present in the config.
Note: This workaround is effective even without a DNS license (although in that case, the placeholder object must be created using tmsh, as the GUI menu would not be available without a DNS license.)
721741-4 : BD and BD_Agent out-of-sync for IP Address Exception, false positive/negative
Component: Application Security Manager
Symptoms:
bd log spits this error.
-------
ECARD_POLICY|NOTICE|May 24 04:49:42.035|4143|table.h:2408|IPTableList::del_object key not found in table
ECARD|ERR |May 24 04:49:42.035|4143|table.h:0398|KEY_UPDATE: Failed to REMOVE data will continue to add
-------
Conditions:
Configuring IP Address Exceptions in certain order - w/ and w/o route domain.
Impact:
BD and BD_Agent out-of-sync for IP Address Exception, causes false positives / false negatives
Workaround:
There is no workaround at this time.
Fix:
System no longer generates these false positive/negative log entries.
721724-1 : LONG_REQUEST notice print incorrect in BD log
Component: Application Security Manager
Symptoms:
LONG_REQUEST notice print shows incorrect memory usage.
Conditions:
-- A long request is received.
-- View the LONG_REQUEST notice in the BD log.
Impact:
LONG_REQUEST notice is seen in BD logs containing an incorrect value for total memory used by long request buffers. Incorrect logging of total memory used by long request buffers.
Workaround:
None.
Fix:
LONG_REQUEST notice print in BD log now shows correct amount of memory used by long request buffers.
721585-1 : mcpd core processing ltm monitors with deep level of inheritance
Component: TMOS
Symptoms:
If the level of ltm monitor inheritance (defaults-from) is too large, i.e 9. then mcpd will fail to send sod a heartbeat within the heartbeat timeout; therefore sod will restart mcpd.
Conditions:
LTM monitors that have 9 levels of inheritance
i.e.
mon1 defaults from mon2, which defaults from mon3, which defaults from mon4 ... to mon10
Impact:
mcpd is restarted which will cause services to failover.
Workaround:
Rework the ltm monitors so that the level of inheritance is less than 9.
721319-1 : CVE-2018-3639
Solution Article: K29146534
720219-3 : HSL::log command can fail to pick new pool member if last picked member is 'checking'
Solution Article: K13109068
Component: Local Traffic Manager
Symptoms:
This occurs in certain configurations where the HSL::log command is using a remote high speed log (HSL) pool with failing pool members. If a pool member goes into a 'checking' state and the command attempts to send the log via that pool member, it can fail to send and all future log commands from that iRule will also fail, if that pool member is actually unavailable.
Conditions:
-- Using HSL::log command.
-- iRule with a remote high speed logging configured.
Impact:
Failure to send log messages via HSL.
Workaround:
Follow this procedure:
1. Change the 'distribution' method of the remote high speed config to something else.
2. Save the configuration.
3. Change the method back.
Fix:
This issue no longer occurs. If a 'down' pool member is picked, it will eventually be bypassed to find an 'up' pool member, if possible.
719300-3 : ICMP unreachable packets are transmitted via BIG-IP systems with the BIG-IP system's MAC address as the source MAC address
Component: Local Traffic Manager
Symptoms:
ICMP unreachable packets sent by a server may be received by a client with the BIG-IP system's MAC address as the source MAC address.
Conditions:
BIG-IP deployed in an L2 transparent mode using VLAN groups.
Impact:
May impact services on the client that rely on source MAC address of incoming packets.
Workaround:
None.
Fix:
ICMP packets are now sent via the BIG-IP system in an L2 transparent mode.
718405-2 : RSA signature PAYLOAD_AUTH mismatch with certificates
Component: TMOS
Symptoms:
IPsec IKEv2 negotiation with other vendors may fail to establish tunnels when certificate authentication is configured, using either RSA signature or DSS.
The value of PAYLOAD_AUTH does not match when the BIG-IP system compares it with what the remote peer sends. The same certificate works when the BIG-IP system is the initiator, but not when another vendor is the initiator.
Conditions:
Interoperating with other vendors under IKEv2 while using certificates.
Impact:
IKEv2 tunnels fail to establish, failing the second IKE_AUTH exchange in the protocol.
Workaround:
Use pre-shared key authentication.
Fix:
BIG-IP systems now correctly build -- and verify -- AUTH payloads for RSA signatures and DSS, which should match other vendors and succeed, resulting in IKEv2 tunnels being created using certificates.
The DSS signature is no longer DER encoded, and the RSA signature now includes the 15-byte DER prefix (mandated by RFC3447, page 42) before the 20-byte SHA1 digest is signed by RSA.
717896-4 : Monitor instances deleted in peer unit after sync
Component: Local Traffic Manager
Symptoms:
An incremental-sync from a modified-node that was set to 'user-down' causes the target-node on the target-device to have only a single monitor instance, rather than the several monitor instances that were present on the from-node.
During the incremental sync, the system issues several messages similar to the following: err mcpd[6900]: 01070712:3: Caught configuration exception (0), Invalid monitor rule instance identifier: 24913.
Conditions:
-- In high availability (HA) configurations.
-- A node is modified, and then manually set to 'user-down'.
-- That node has more than one associated monitor.
-- An incremental-sync occurs to the paired device.
Impact:
After incremental-sync, a single monitor instance exists for the node on a 'backup' unit in an HA configuration, rather than the several monitor instances that exist for that node on the 'active' unit; and that node session is 'enabled' (where the 'from-node' was 'disabled); and that node status may be 'up' (where the 'from-node' was 'user-down'), and later transition to 'down' from a monitor-fail.
Thus, after incremental-sync, the target-node may then be 'down', while the active unit in the HA configuration continues to function as expected.
Workaround:
There are several workarounds:
-- Perform a 'full-sync' (rather than an 'incremental-sync').
-- Ensure the node is 'user-up' (not 'user-down') before the incremental-sync.
-- Perform 'tmsh load sys config' on the target unit. In this case, the 'Invalid monitor rule instance identifier' messages will be seen, but the configuration will successfully load, and the target-unit will run correctly with the expected configuration.
Fix:
An incremental-sync from a modified-node that was set to 'user-down' successfully replicates the several monitor instances on that node to the target-node on the backup device in an HA configuration.
717100-1 : FQDN pool member is not added if FQDN resolves to same IP address as another existing FQDN pool member
Component: Local Traffic Manager
Symptoms:
FQDN ephemeral pool members and corresponding FQDN ephemeral nodes may not be created if multiple FQDN template pool members are created rapidly, without the corresponding FQDN template nodes being created first.
The missing FQDN ephemeral pool members may be created an hour after initial operations.
Conditions:
This may occur when all of the following conditions are true:
-- Multiple FQDN template pool members are created rapidly, such as during config load or multiple FQDN template pool members created in a single tmsh cli transaction, without the corresponding FQDN template nodes being created first.
-- The FQDN names in the newly-created FQDN template nodes all resolve to the same IP address.
Impact:
One or more FQDN ephemeral pool members may not be created, which could result in a pool with no members, and any virtual servers using that pool to fail to pass traffic.
Workaround:
The following steps, alone or in combination, may help avoid this issue:
1. Avoid rapid creation of multiple FQDN template pool members (such as by creating multiple in a single tmsh CLI transaction).
2. Create the corresponding FQDN template nodes first, before creating the FQDN template pool members.
Once this issue occurs (such as, after a config load), you can recover from this condition by deleting and recreating the FQDN template pool members that have no corresponding FQDN ephemeral pool members.
In addition, creating the corresponding FQDN template nodes first, with an FQDN 'interval' value set to a shorter timeout than the default (3600 seconds) allows automatic recovery from this condition after the configured FQDN 'interval' period (instead of after the default period of one hour).
Fix:
Ephemeral pool members are now created for each pool under these conditions.
716714-4 : OCSP should be configured to avoid TMM crash.
Component: Local Traffic Manager
Symptoms:
TMM generates a core if OCSP is not configured in the SSL profile.
Conditions:
OCSP not configured in the SSL profile.
Impact:
TMM crashes. Traffic disrupted while tmm restarts.
Workaround:
There is no workaround other than configuring OCSP in SSL profiles.
Fix:
In this release, TMM skips processing OCSP if it is not enabled.
716167-2 : The value of the sys db variable vlan.backplane.mtu may be out-of-sync with the value of the MTU of the kernel interface tmm_bp
Component: Local Traffic Manager
Symptoms:
The MTU of the tmm_bp kernel interface may be out-of-sync with the value of sys db vlan.backplane.mtu as well as out-of-sync with the MTU displayed by the following command:
tmsh show /net vlan all-properties -hidden.
Conditions:
This issue occurs on first-boot after upgrading to versions later than v12.1.1 HF1.
Impact:
From the data plane perspective, this issue can cause excessive IP fragmentation on tmm_bp VLAN and high CPU usage.
In some cases it also causes packet loss.
From the config perspective, this issue has a few smaller impacts:
-- Fragmented packets on the tmm_bp interface for those packets greater in length than the actual MTU of this interface as given by the kernel in response to the command:
ip address list dev tmm_bp | egrep -i mtu or $ifconfig tmm_bp.
Note: This has no impact to the running system. Fragmented packets are reassembled in order for TCP clients of the tmm_bp interface.
-- The sys db variable vlan.backplane.mtu may be out-of-sync with the value of the MTU of the kernel interface tmm_bp as given by either of the following commands:
ip address list dev tmm_bp
ifconfig tmm_bp
-- Similarly, the sys db variable vlan.backplane.mtu may be out-of-sync with the value of the MTU of the Net::Vlan tmm_bp as returned by the command:
tmsh show net vlan -hidden tmm_bp
Paraphrasing: The value of VLAN tmm_bp MTU (as found in vlan.backplane.MTU) is not applied to the corresponding kernel interface.
Workaround:
A series of subsequent restarts rolls the correct setting by issuing the following commands, in sequence:
tmsh stop sys service all
tmsh start sys service all
To verify the setting is correct, issue the command:
ip addr show dev tmm_bp ; tmsh show net vlan -hidden tmm_bp \; list sys db vlan.backplane.mtu
715110-1 : AVR should report 'resolutions' in module GtmWideip
Component: Application Visibility and Reporting
Symptoms:
AVR does not report 'resolutions' in GtmWideip module.
Conditions:
One of the following modules is provisioned: AVR, AFM, or DNS/GTM.
Impact:
There are no statistics reported on 'resolutions' in GtmWideip module.
Workaround:
There is no workaround.
Fix:
AVR now reports 'resolutions' in GtmWideip module.
715032-2 : iRulesLX Hardening
Component: Local Traffic Manager
Symptoms:
iRulesLX does not follow current best practices and should be updated to ensure layered protections.
Conditions:
-iRulesLX in use
Impact:
iRulesLX does not follow current best practices.
Workaround:
None.
Fix:
iRulesLX now follows current best practices.
714292-3 : Transparent forwarding mode across multiple VLAN groups or virtual-wire
Component: Local Traffic Manager
Symptoms:
This is a virtual-wire or vlan-group deployment scenario in which there is a BIG-IP system connecting two networks with more than one link. This scenario is referred as 'asymmetric deployment'. In this case. the outgoing packet does not have the correct VLAN configured.
Conditions:
-- Virtual-wire or vlan-group configured.
-- BIG-IP system is connecting two networks with more than one link.
-- There is more than one virtual-wire/vlan-group to handle the traffic across multiple links.
-- Packets belonging to a flow arrive on any link with a valid VLAN.
Impact:
The connectivity between the endpoints fails.
Workaround:
None.
Fix:
Transparent forwarding mode now works across multiple VLAN groups or virtual-wire.
Behavior Change:
Transparent forwarding mode now works across multiple VLAN groups or virtual-wire.
713817-1 : BIG-IP images are available in Alibaba Cloud
Component: TMOS
Symptoms:
BIG-IP Virtual Edition (VE) images are now available in the Alibaba International Cloud Marketplace.
Conditions:
Create virtual server instance within Alibaba International Cloud environment and select BIG-IP from the list of available images.
Impact:
New offerings for BYOL and PAYG for BIG-IP VE are now available in the Alibaba International Cloud Marketplace.
Workaround:
BIG-IP VE images are now available in Alibaba Cloud.
Fix:
BIG-IP VE images are now available in Alibaba Cloud.
Behavior Change:
BIG-IP VE now supports the Alibaba International Cloud Marketplace.
713806-8 : CVE-2018-0739: OpenSSL Vulnerability
Solution Article: K08044291
712919-2 : Removing an iRule from a Virtual Server may prevent executing other iRules on the same Virtual Server.
Component: Local Traffic Manager
Symptoms:
When an iRule is removed from a Virtual Server, especially one with explicitly specified high priority (with "priority" keyword), other iRules on the same Virtual Server may become "invisible" i.e. they are present but some of them are no longer executed. It may affect all the events or only certain types of them. Under certain conditions the defect may even disappear upon removing another iRule, particularly if it has low priority and handles the same event as the one which introduced the problem.
Conditions:
Removing an iRule from a Virtual Server.
Impact:
Some or all iRules on given Virtual Servers stop being executed.
Workaround:
Restart or reload the configuration. If removing iRules needs to be performed in run-time and it triggers the problem, it can be prevented by having any iRule (even an empty one) for the same event, as the iRule which is going to be removed, but with higher priority e.g. with attribute "priority 1".
Fix:
Corrected scanning of iRules stored behind the one which is being deleted.
710857-5 : iControl requests may cause excessive resource usage
Solution Article: K64855220
707013-3 : vCMP host secondary member's cluster.conf file may replaced by that of vCMP guest
Component: TMOS
Symptoms:
-- clusterd restarts on secondary blade.
-- Messages similar to the following are logged in each secondary blade's /var/log/ltm file as clusterd restarts:
Management IP (<guest_management_ip>) already in use by (vcmp guest <guest_name>)
-- Messages similar to the following are logged in the primary blade's /var/log/ltm file when clusterd restarts on a secondary blade:
notice clusterd[3676]: 013a0006:5: Hello from slot 1.
notice clusterd[3676]: 013a0006:5: Informing MCP about slot ID 1 member status.
notice clusterd[3676]: 013a0006:5: Goodbye from slot 1.
Conditions:
-- Power-cycling a blade reproduces the issue most of the time.
-- Possibly specific to platform:
+ This issue has been seen multiple hardware platforms, including B2100, B2150, B2250, and PB300.
+ Issue does not reproduce under the same conditions on a VIPRION 4800.
Impact:
Secondary slot on VIPRION hypervisor is in 'INOPERATIVE' state.
Workaround:
On the vCMP Host, copy the file /shared/db/cluster.conf from the primary to each secondary cluster members. For each secondary blade's slot, use a command similar to the following:
scp /shared/db/cluster.conf slot<slot number>:/shared/db/cluster.conf
Note: Implementing the workaround does not prevent the issue from recurring. An upgrade to an unaffected version is recommended.
705112-4 : DHCP server flows are not re-established after expiration
Component: Local Traffic Manager
Symptoms:
DHCP relay agent does not have server flows connecting to all active DHCP servers after a while.
Conditions:
- More than one DHCP servers configured for a DHCP virtual.
- Server flows timeout in 60 seconds
Impact:
DHCP server traffic not load balanced.
Workaround:
None.
Fix:
A new logic to re-establish server flows is introduced to ensure a relay agent will have all DHCP servers connected.
704450-5 : bigd may crash when the BIG-IP system is under extremely heavy load, due to running with incomplete configuration
Component: Local Traffic Manager
Symptoms:
A rarely seen scenario exists where 'bigd' crashes when the BIG-IP system is under extremely heavy load, due to 'bigd' running with an incomplete configuration and attempting to interact with 'mcpd' prior to being fully configured by 'mcpd'. This may occur when 'mcpd' is sufficiently delayed in configuring 'bigd' upon 'bigd' process start (at system-start, or upon 'bigd' process re-start), such that 'bigd' attempts to report monitoring results to 'mcpd' prior to fully receiving its configuration (from 'mcpd').
Conditions:
BIG-IP is under heavy load; and 'bigd' process is (re-)started; and 'mcpd' is delayed in relaying the full configuration to 'bigd'; and 'bigd' attempts to report monitoring results to 'mcpd'.
Impact:
Monitoring is delayed while bigd is restarting. If the load lasts for a long enough period of time, bigd might repeatedly fail to start and monitoring will not resume. In some cases 'bigd' may run with an incomplete configuration.
Workaround:
Reduce the load on the system.
Fix:
'bigd' does not crash and runs with complete configuration when (re-)starting when BIG-IP runs under heavy configuration resulting in 'mcpd' delaying its configuration of 'bigd'.
704198-4 : Replace-all-with can leave orphaned monitor_rule, monitor_rule_instance, and monitor_instance
Solution Article: K29403988
Component: Global Traffic Manager (DNS)
Symptoms:
Orphaned monitor_instance records in mcpd. Secondary blade restarting in a loop.
Conditions:
Modify the monitor for GTM objects using tmsh with replace-all-with.
Impact:
There is an leaked/extra monitor instance. Restarting the secondary slot results in a restart loop.
Workaround:
Impact of workaround: Might change the primary slot.
Restart services using the following command:
# bigstart restart
703835-5 : When using SCP into BIG-IP systems, you must specify the target filename
Solution Article: K82814400
703593-1 : TMSH tab completion for adding profiles to virtual servers is not working as expected
Component: Local Traffic Manager
Symptoms:
TMSH tab completion for adding profiles to virtual servers does not work. The list of profiles is not displayed when tab is pressed.
root@(localhost)(cfg-sync Standalone)(Active)(/Common)(tmos)# create ltm virtual asdf profiles add {
Configuration Items:
[enter profile name]
Conditions:
List of profiles is not displayed when trying to add profiles during creation of a virtual server.
Impact:
List of available profiles is not displayed.
Workaround:
None.
Fix:
TMSH tab completion for adding profiles to virtual servers now shows the list of profiles.
702472-7 : Appliance Mode Security Hardening
Solution Article: K87659521
702469-7 : Appliance mode hardening in scp
Solution Article: K73522927
699977-3 : CVE-2016-7055: OpenSSL Vulnerability in NodeJS ILX
Solution Article: K43570545
699515-2 : nsm cores during update of nexthop for ECMP recursive route
Component: TMOS
Symptoms:
The Network Services Module daemon (nsm) cores while processing updates for ECMP recursive route nexthop.
Conditions:
Dynamic routing enabled.
BGP peers provides ECMP routes with recursive nexthop.
Impact:
Failures passing traffic using the dynamic routes.
Workaround:
There is no workaround.
Fix:
nsm is able to process ECMP route updates without problem.
698376-5 : Non-admin users have limited bash commands and can only write to certain directories
Component: TMOS
Symptoms:
TMSH access to Linux utilities does not follow best security practices.
Conditions:
Users without Advanced Shell Access running Linux utilities from inside TMSH.
Impact:
TMSH does not follow best security practices
Workaround:
None.
Fix:
TMSH access to Linux utilities now follows best security practices.
Behavior Change:
Some tmsh util commands will be restricted to writing files to certain directories.
697590-2 : APM iRule ACCESS::session remove fails outside of Access events
Component: Access Policy Manager
Symptoms:
ACCESS::session remove fails
Conditions:
iRule calling ACCESS::session remove outside of Access events.
Impact:
APM iRule ACCESS::session remove fails to remove session
Workaround:
Use "ACCESS::session modify" and set the timeout/lifetime to something small, like 1 second. This should cause the session to be deleted due to timeout almost immediately, but note that it will show up in logs as timeout.
696755-3 : HTTP/2 may truncate a response body when served from cache
Component: Local Traffic Manager
Symptoms:
BIG-IP systems provide a client-side HTTP/2 Gateway protocol implementation in conjunction with HTTP 1.x on a server side. A response can be cached on the BIG-IP system with a web acceleration profile. Sometimes a response served from cache is prematurely marked with END_STREAM flag, causing the client to ignore the rest of the response body.
Conditions:
BIG-IP system has a virtual server for which HTTP/2 and Web Acceleration profiles are configured.
Impact:
Some clients' browsers do not retry a resource, causing incorrect rendering of an HTML page.
Workaround:
Adding the following iRule causes the body to be displayed:
when HTTP_RESPONSE_RELEASE {
set con_len [string trim [HTTP::header value Content-Length]]
HTTP::header remove Content-Length
HTTP::header insert Content-Length "$con_len"
}
Fix:
With provided fix, HTTP/2 end users no longer experience the problem of incorrect page rendering due to this issue.
696735-2 : TCP ToS Passthrough mode does not work correctly
Component: Local Traffic Manager
Symptoms:
For Standard virtual server with a TCP profile, when using ToS passthough, the ToS value is not passed from the server to the client-side.
ip-tos-to-client pass-through
link-qos-to-client pass-through
Conditions:
- Standard virtual server.
- TCP profile configured with ToS passthrough.
Impact:
ToS is not passed to the client.
Workaround:
None.
Fix:
ToS is now passed correctly from the server to the client-side.
695985-4 : Access HUD filter has URL length limit (4096 bytes)
Component: Access Policy Manager
Symptoms:
Access HUD filter cannot process a URL if it is longer than 4096 bytes.
Conditions:
Any URL with a request consisting of more than 4096 bytes.
Impact:
The URL cannot be processed, and client gets a RST.
Workaround:
None.
Fix:
In this release, the URL length limit increased to 8192 bytes.
695878-2 : Signature enforcement issue on specific requests
Component: Application Security Manager
Symptoms:
Request payload does not get enforced by attack signatures on a certain policy configuration with specific traffic.
Conditions:
-- The violation 'Request exceeds max buffer size' is turned off.
-- The request is longer than the max buffer size (i.e., a request is larger than the internal long_request_buffer_size).
Impact:
Attack signatures are not enforced on the payload of this request at all.
Workaround:
Turn on the violation in blocking 'Request exceed max buffer size'.
Fix:
The operation now looks into part of the payload for the attack signatures enforcement.
689361-4 : Configsync can change the status of a monitored pool member
Component: Local Traffic Manager
Symptoms:
It is possible for a configsync operation to incorrectly change a monitor's state. For example, it can change an 'unchecked' monitor to 'up', when that unchecked monitor references a node that does not respond to ICMP requests. This may occur when a node does not respond to ICMP requests for exactly one of two paired devices, but a configuration change made to one device causes the 'up' status to be propagated to the 'unchecked' device. Other state changes are possible.
Conditions:
Pool members are monitored and a configsync is initiated from a paired device.
Impact:
The configsync causes the monitor on the standby system to transition to an incorrect state, out of sync with the active system.
Workaround:
There is a workaround for the case described in 'Symptoms':
Ensure network configuration such that a monitored node responds to ICMP requests from both (or neither) of each paired-device. Alternatively, initiate configuration changes only from the device to which the node does not respond to ICMP requests.
Fix:
A configsync no longer causes an unexpected monitor transition on the standby system.
687887-3 : Unexpected result from multiple changes to a monitor-related object in a single transaction
Component: Local Traffic Manager
Symptoms:
When a transaction attempts multiple commands (delete, create, modify) for the same object in the same transaction, the results can be unexpected or undefined. A common example is: 'transaction { delete key create_if key }' where the transaction will attempt to 'delete key', and then 'create_if key', which unmarks the delete operation on the key (so in this case the key remains unmodified). In other cases it is possible that monitoring stops for the associated object, such as for: pool, pool_member, node_address, monitor.
Conditions:
A user-initiated transaction attempts multiple commands for the same monitor-related object, such as (delete, create, modify).
Impact:
The monitor-related object may be unchanged; or monitoring may stop for that object.
Workaround:
Transactions modifying a monitor-related object (pool, pool_member, node_address, monitor) should perform a single command upon that object (such as one of: 'delete', 'create', 'modify').
Fix:
Behavior is as-expected when a transaction executes multiple commands (such as 'delete', 'create', 'modify') upon the same monitor-related object (pool, pool_member, node_address, monitor).
687759-3 : bd crash
Component: Application Security Manager
Symptoms:
A bd crash.
Conditions:
-- A config change follows a bd crash.
-- There is a policy that is misconfigured, for example, a form-data parsing is applied on a non-form-data payload (such as XML or JSON).
Impact:
bd crashes; system fails over; traffic disturbance occurs.
Workaround:
Set the following internal parameter to 0: max_converted_length_to_cache
681010-3 : 'Referer' is not masked when 'Query String' contains sensitive parameter
Solution Article: K33572148
Component: Application Security Manager
Symptoms:
While 'Query String' contains masked sensitive parameter value the 'Referer' header sensitive parameter value is exposed.
Conditions:
-- Sensitive parameter is defined in: 'Security :: Application Security : Parameters : Sensitive Parameters'.
-- 'Query String' contains the defined sensitive parameter.
Impact:
"Referer" header contains unmasked value of the sensitive parameter.
Workaround:
Enable 'Mask Value in Logs' in: 'Security :: Application Security : Headers : HTTP Headers :: referer'.
Fix:
The 'Referer' header value is masked in case of sensitive parameter in 'Query String'.
673842-6 : VCMP does not follow best security practices
Solution Article: K01413496
668041-4 : Config load fails when an iRule comment ends with backslash in a config where there is also a policy.★
Solution Article: K27535157
Component: TMOS
Symptoms:
Config load fails when an iRule contains a commented line that ends with an escape character (backslash), and the config also contains an LTM policy. Depending on the iRule, you might also see the following error: Syntax Error:(/config/bigip.conf at line: 42078) double quotes are not balanced.
Conditions:
-- iRule contains commented line that ends with a backslash.
-- The config also contains a policy.
For example, an iRule similar to the first example, and a policy similar to the second:
ltm rule /Common/log_info {
when HTTP_RESPONSE {
#log local0. "Original Location header value: [HTTP::header value Location],\
updated: [string map ":[TCP::remote_port]/ /" [HTTP::header value Location]]"
}
}
...
ltm policy /Common/Test_Policy {
controls { forwarding }
requires { http tcp }
rules {
TestPol_Rule1 {
actions {
0 {
forward
select
node 10.2.10.20
}
}
conditions {
0 {
tcp
address
matches
values { 10.1.10.20 }
}
}
}
}
strategy /Common/first-match
}
Impact:
Config load fails.
Workaround:
You can use any of the following workarounds:
-- Delete the line of code with the comment.
-- Put the entire comment on one line of code.
-- Divide lengthy comments into a series of smaller ones, so that each comment fits within one line of code.
-- Move the iRule so that it is sequentially before the LTM policy in the config file.
Fix:
Config load no longer fails when an iRule comment ends with backslash in a config where there is also a policy.
663819-1 : APM NTLM Authentication for RDP Client Gateway and Microsoft Exchange Proxy are incompatible with Microsoft workaround for MS17-010 (Wannacry / Eternalblue)
Component: Access Policy Manager
Symptoms:
Microsoft recently released security bulletin MS17-010 (https://technet.microsoft.com/library/security/MS17-010). This bulletin announces a recommended software patch to fix multiple vulnerabilities in SMBv1. It suggests an alternate workaround to disable SMBv1. When this workaround is followed, NTLM Authentication does not work in the following APM configurations:
-- APM RDP Gateway and NTLM Auth.
-- APM Exchange (Outlook Anywhere/ActiveSync) and NTLM Auth.
-- SWG Explicit and NTLM Auth.
Conditions:
-- SMBv1 is disabled as described in the Microsoft workaround in MS17-010.
-- Together with one or more of the following APM/SWG configurations, which can be configured to use NTLM Authentication:
+ APM RDP Gateway and NTLM Auth.
+ APM Exchange (Outlook Anywhere/ActiveSync) and NTLM Auth.
+ SWG Explicit and NTLM Auth.
Impact:
Authentication for connecting clients fails.
Workaround:
Do one of the following:
-- Do not follow the Microsoft workaround to disable SMBv1; instead install the recommended security patch.
-- For Exchange: Reconfigure Exchange CAS pool to use Kerberos Constrained Delegation SSO rather than NTLM. This will ensure that NTLM Passthrough is not used.
-- For RDP Proxy: Instead of RDP Proxy, use the Native RDP resource mode in BIG-IP APM v13.0.0 and later.
-- For SWG Explicit: Reconfigure to use Kerberos Authentication.
Fix:
APM no longer uses SMBv1/v2 protocols. Beginning with BIG-IP software v15.0.0, NTLM passthrough authentication works using Netlogon protocol over TCP directly (MSRPC over TCP). All issues related to SMB protocol are not applicable anymore.
Note: The new functionality was ported to the v14.1.0.5 release as well.
653573-6 : ADMd not cleaning up child rsync processes
Component: Anomaly Detection Services
Symptoms:
ADMd daemon on the device is spinning up rsync processes and not cleaning them up properly, which can result in zombie processes.
Conditions:
The rsync process ends via exit (which might occur if there is an issue with the process).
Impact:
Although there is no technical impact, there are many zombie processes left behind.
Workaround:
Restart admd to remove all existing rsync zombies:
bigstart restart admd
Fix:
admd now handles the SIGCHLD signal from rsync, so the issue no longer occurs.
648621-6 : SCTP: Multihome connections may not expire
Component: TMOS
Symptoms:
SCTP: Multihome connections may not expire when forcibly deleted.
Conditions:
When the multi-homing connections have been forcibly deleted from tmsh command.
Impact:
The multi-homing connections won't be expired.
Workaround:
Don't manually deleted the multi-homing connections.
648270-1 : mcpd can crash if viewing a fast-growing log file through the GUI
Component: TMOS
Symptoms:
If the GUI tries to display a log file that is actively growing by thousands of log entries per second, the GUI might hang, and mcpd could run out of memory and crash.
Conditions:
The GUI tries to display a log file that is actively growing by thousands of log entries per second.
Impact:
mcpd crashes, and it and tmm restart. Traffic disrupted while tmm restarts.
Workaround:
Do not use the GUI to view a log file that is growing by thousands of log entries per second.
643935-4 : Rewriting may cause an infinite loop while processing some objects
Component: Access Policy Manager
Symptoms:
Browser might become unresponsive when the end user client attempts to access a page containing specific script constructions through Portal Access.
Conditions:
The client application code contains an object that includes a toString() method and property names similar to ones from the JavaScript builtin Location interface.
Impact:
Browser becomes unresponsive when accessing the page through Portal Access.
Workaround:
None.
Fix:
None.
641450-7 : A transaction that deletes and recreates a virtual may result in an invalid configuration
Solution Article: K30053855
Component: TMOS
Symptoms:
Deleting and recreating a virtual server within a transaction (via tmsh or iControl REST) and trying to modify the profiles on the virtual server (e.g., changing from fastl4 to tcp) may result in an invalid in-memory configuration. This may also result in traffic failing to pass, because TMM rejects the invalid configuration.
Config load error:
01070095:3: Virtual server /Common/vs_icr_test lists incompatible profiles.
Configuration-change-time error in /var/log/ltm:
err tmm[22370]: 01010007:3: Config error: Incomplete hud chain for listener: <name>
Conditions:
Deleting and recreating a virtual server within a transaction (via tmsh or iControl REST) and trying to modify the profiles on the virtual server (e.g., changing from fastl4 to tcp).
Impact:
Configuration fails to load in the future.
Traffic fails to pass, because TMM rejects the configuration.
Workaround:
Within tmsh, use the following command: profiles replace-all-with.
Within iControl REST, use three separate calls:
1. Delete virtual server.
2. Create virtual server (with an empty profile list).
3. Modify the virtual server's profile list.
639619-7 : UCS may fail to load due to Master key decryption failure on EEPROM-less systems★
Component: TMOS
Symptoms:
The following error:
'Symmetric Unit Key decrypt failure - decrypt failure'
is logged to /var/log/ltm when attempting to load a UCS.
Configuration fails then to load due to a secure attribute decryption failure.
Conditions:
1. UCS contains secure attributes.
2. UCS contains a '/config/bigip/kstore/.unitkey' file.
3. The current '/config/bigip/kstore/.unitkey' file does not match the '.unitkey' file within UCS.
4. System does not utilize an EEPROM for storing its unitkey. (For more information, see K73034260: Overview of the BIG-IP system Secure Vault feature :: https://support.f5.com/csp/article/K73034260.)
Impact:
The configuration fails to load.
Workaround:
Perform the following procedure:
1. Stop the system:
# bigstart stop
2. Replace the '/config/bigip/kstore/.unitkey' file with the '.unitkey' file from the UCS
3. Replace the '/config/bigip/kstore/master' file with the 'master' file from the UCS
4. Remove the mcp db to forcibly reload the keys:
# rm -f /var/db/mcpd.bin
# rm -f /var/db/mcpd.info
5. Restart the system and reload the configuration:
# bigstart start
# tmsh load sys config
or
# reboot
Fix:
The system now always reload the .unitkey from storage when loading other keys, so the UCS loads as expected.
636842-2 : A FastL4 virtual server may drop a FIN packet when mirroring is enabled
Solution Article: K51472519
Component: Local Traffic Manager
Symptoms:
A FastL4 virtual server may drop a FIN packet when mirroring is enabled.
Conditions:
- The virtual server uses the FastL4 profile.
- The virtual server performs mirroring.
- The tm.fastl4_ack_mirror db key is enabled (default).
- The client or the server sends a FIN packet, immediately followed by a RST packet.
Impact:
The BIG-IP system forwards the RST packet but not the FIN packet.
As the RST sent by one of the TCP endpoints would have its sequence number increased by 1 to account for the FIN packet, the other TCP endpoint may not accept the RST as the FIN packet was never seen.
This issue is exacerbated if the FIN packet also carries application data (for example, if it is actually a FIN,PSH,ACK packet). In this case, the other TCP endpoint never sees the application data contained within the packet, and the sequence number in the RST will be off by more than just 1.
Ultimately this can cause application failures and also the two connection flows to stall for some time.
Workaround:
To workaround this issue you can either:
1) Disable mirroring for the virtual server (but this comes with a loss of functionality, which may not be acceptable).
or
2) Disable the tm.fastl4_ack_mirror db key (but this would affect all FastL4 virtual servers performing mirroring on the box).
Fix:
A FastL4 virtual server no longer drops a FIN packet when mirroring is enabled.
636400-3 : CPB (BIG-IP->BIGIQ log node) Hardening
Solution Article: K26462555
621260-2 : mcpd core on iControl REST reference to non-existing pool
Component: TMOS
Symptoms:
MCPd cores when attempting to create a pool and a monitor reference by using a REST call such as:
curl -u admin:admin -H "Content-Type: application/json" -X POST http://localhost:8100/tm/ltm/pool -d'{"name":"test_pool","monitor":" "}'
Conditions:
The monitor reference in the REST call must be comprised of a single space character.
Impact:
MCPd restarts, causing many of the system daemons to restart as well.
Workaround:
Don't use spaces in the monitor reference name.
620301-1 : Policy import fails due to missing signature System in associated Signature Set
Component: Application Security Manager
Symptoms:
ASM policy import fails due to a missing System, used in an associated Signature Set.
Conditions:
ASM policy is imported using an export file from a device with a more recent ASM Signature Update.
Impact:
The ASM policy import fails.
Workaround:
Update the ASM Signature on the target device before importing the policy.
601189-4 : The BIG-IP system might send TCP packets out of order in fastl4 in syncookie mode
Component: Local Traffic Manager
Symptoms:
The BIG-IP system might send TCP packets out of order in Fastl4 in syncookie mode.
Conditions:
-- Fastl4 VS.
-- syncookie mode.
Impact:
TCP packet are sent out of order.
Workaround:
None.
Fix:
The BIG-IP system no longer sends TCP packets out of order in Fastl4 in syncookie mode.
599567-4 : APM assumes SNAT automap, does not use SNAT pool
Component: Local Traffic Manager
Symptoms:
When a virtual server configured to use a SNAT pool is also associated with APM (for example, when configured as a RDP gateway), the SNAT pool setting is not honored.
Also SNAT configuration of 'None' does not work. It always works as if it is configured with Automap.
Conditions:
SNAT pool configured.
-- APM configured (one example is deploying the Horizon View iApp for APM).
Impact:
The VLAN Self IP address is used instead of the SNAT pool addresses.
Workaround:
First, follow the configuration details in K03113285: Overview of BIG-IP APM layered virtual servers :: https://support.f5.com/csp/article/K03113285, to ensure everything is configured properly.
Then ensure that the appropriate SNAT pool is set on the new layered forwarding virtual sever.
Note: This workaround does not work when using a pool of VMware vCenter Server (VCS) as configured by default with the iApp.
Fix:
The system now honors the virtual server SNAT configuration.
581921-5 : Required files under /etc/ssh are not moved during a UCS restore
Solution Article: K22327083
Component: TMOS
Symptoms:
The SSH files required for SSH sign on are not transferred when performing a UCS restore operation. Further, files are not transferred even during upgrade.
Conditions:
This can happen when performing a UCS restore operation, or when upgrading from one version to the next.
Impact:
This might impact SSH operations.
Workaround:
Add the /etc/ssh directory to the UCS backup configuration. This causes all subsequent UCS backup and restore operations will now include the /etc/ssh/ directory.
To complete this procedure, refer to K4422: Viewing and modifying the files that are configured for inclusion in a UCS archive :: https://support.f5.com/csp/article/K4422.
Fix:
The correct folder is now present when performing a UCS restore operation, so that all of the files required for the operation of SSH are transferred.
504522-4 : Trailing space present after 'tmsh ltm pool members monitor' attribute value
Component: Local Traffic Manager
Symptoms:
Values returned from the tmsh command 'ltm pool pool members monitor' have a trailing space, such as returning '/Common/myhttps ' (note the trailing-space). This trailing-space is also observed for the value returned from a REST call.
Conditions:
'tmsh' or a REST call is used to return the 'monitor' for pool members.
Impact:
Scripts or custom applications processing this returned output may wish to 'trim' whitespace on the value (as a trailing space is present); or should not assume the trailing space will be present in the future (as this behavior is not guaranteed).
Workaround:
Use a script or custom applications to 'trim' trailing whitespace for returned values.
Fix:
Values returned from the tmsh command 'ltm pool pool members monitor' no longer have a trailing space.
Known Issues in BIG-IP v14.1.x
TMOS Issues
ID Number | Severity | Solution Article(s) | Description |
885949 | 1-Blocking | Untagged packet traffic does not work on vwire | |
864513-3 | 1-Blocking | ASM policies didn't load immediately after upgrade to v14.1.0.1★ | |
860245-3 | 1-Blocking | SSL Orchestrator configuration not synchronized across HA peers after upgrade from 14.1.2.x | |
858173-1 | 1-Blocking | SSL Orchestrator RPM not installed on HA-peer after upgrade from 14.1.2.1 | |
809553-4 | 1-Blocking | ONAP Licensing - Cipher negotiation fails | |
778317-1 | 1-Blocking | IKEv2 HA after Standby restart has race condition with config startup | |
896217-4 | 2-Critical | BIG-IP GUI unresponsive | |
894593 | 2-Critical | High CPU usage caused by the restjavad daemon continually crashing and restarting | |
891477 | 2-Critical | No retransmission occurs on TCP flows that go through a BWC policy-enabled virtual server | |
888341-5 | 2-Critical | HA Group failover may fail to complete Active/Standby state transition | |
886693-2 | 2-Critical | System may become unresponsive after upgrading★ | |
885961 | 2-Critical | Tagged vlan will work only if it is configured in virtual wire. | |
884921-1 | 2-Critical | Tcpdump capture with very large packet (size close to 65535 bytes) can cause tmm to core | |
882757-3 | 2-Critical | sflow_agent crash SIGABRT in the cleanup flow | |
871561-3 | 2-Critical | Hotfix installation on vCMP guest fails with '(Software compatibility tests failed.)' | |
865329-3 | 2-Critical | WCCP crashes on "ServiceGroup size exceeded" exception | |
860517-3 | 2-Critical | MCPD may crash on startup with many thousands of monitors on a system with many CPUs. | |
860349-1 | 2-Critical | Upgrading from previous versions to 14.1 or creating a new configuration with user-template, which involves the usage of white-space character, will result in failed authentication | |
858877-1 | 2-Critical | SSL Orchestrator config sync issues between HA-pair devices | |
856713-1 | 2-Critical | IPsec crash during rekey | |
854493-3 | 2-Critical | Kernel page allocation failures messages in kern.log | |
845629-1 | 2-Critical | Hv_netvsc vmbus_17 timeout at boot causes reduced NIC performance | |
842865-1 | 2-Critical | Add support for Auto MAC configuration (ixlv) | |
841953-5 | 2-Critical | A tunnel can be expired when going offline, causing tmm crash | |
841333-5 | 2-Critical | TMM may crash when tunnel used after returning from offline | |
837637-2 | 2-Critical | Orphaned bigip_gtm.conf can cause config load failure after upgrading★ | |
831821-3 | 2-Critical | Corrupted DAG packets causes bcm56xxd core on VCMP host | |
829677-1 | 2-Critical | .tmp files in /var/config/rest/ may cause /var directory exhaustion | |
829661-2 | 2-Critical | TCP connection fails to establish when an SFC policy is enabled | |
817709-2 | 2-Critical | IPsec: TMM cored with SIGFPE in racoon2 | |
817085-4 | 2-Critical | Multicast Flood Can Cause the Host TMM to Restart | |
811701-1 | 2-Critical | AWS instance using xnet driver not receiving packets on an interface. | |
811149-1 | 2-Critical | Remote users are unable to authenticate via serial console. | |
810593-2 | 2-Critical | K10963690 | Unencoded sym-unit-key causes guests to go 'INOPERATIVE' after upgrade★ |
807453-1 | 2-Critical | IPsec works inefficiently with a second blade in one chassis | |
805417-1 | 2-Critical | Unable to enable LDAP system auth profile debug logging | |
797221-1 | 2-Critical | BCM daemon can be killed by watchdog timeout during blade-to-blade failover | |
796601-4 | 2-Critical | Invalid parameter in errdefsd while processing hostname db_variable | |
787285 | 2-Critical | Configuration fails to load after install of v14.1.0 on BIG-IP 800★ | |
785017-1 | 2-Critical | Secondary blades go offline after new primary is elected | |
780437-2 | 2-Critical | Upon rebooting a VIPRION chassis provisioned as a vCMP host, some vCMP guests can return online with no configuration. | |
777229-1 | 2-Critical | IPsec improvements to internal pfkey messaging between TMMs on multi-blade | |
776393-2 | 2-Critical | Memory leak in restjavad causing restjavad to restart frequently with OOM | |
774361-2 | 2-Critical | IPsec High Availability sync during multiple failover via RFC6311 messages | |
770989 | 2-Critical | Observed '/shared/lib/rpm' RPM database corruption on B4450 blades and iSeries platforms installing 14.1.x.★ | |
769817-3 | 2-Critical | BFD fails to propagate sessions state change during blade restart | |
769581-1 | 2-Critical | Timeout when sending many large requests iControl Rest requests | |
769341-1 | 2-Critical | HA failover deletes outstanding IKEv2 SAs along with IKEv1 SAs | |
767013-3 | 2-Critical | Reboot when B2150 and B2250 blades' HSB is in a bad state observed through HSB sending continuous pause frames to the Broadcom Switch | |
758929-2 | 2-Critical | Bcm56xxd MIIM bus access failure after TMM crash | |
758604-2 | 2-Critical | Deleting a port from a single-port trunk does not work. | |
756830-1 | 2-Critical | BIG-IP may fail source translation for connections when connection mirroring is enabled on a virtual server that also has source port set to 'preserve strict' | |
755716-1 | 2-Critical | IPsec connection can fail if connflow expiration happens before IKE encryption | |
751991-1 | 2-Critical | BIOS update fails with "flashrom not safe for BIOS updates yet" log message | |
751924-2 | 2-Critical | TSO packet bit fails IPsec during ESP encryption | |
750588-1 | 2-Critical | While loading large configurations on BIG-IP systems, some daemons may core intermittently. | |
749332 | 2-Critical | Client-SSL Object's description can be updated using CLI but not REST | |
749249-1 | 2-Critical | IPsec tunnels fail to establish and 100% cpu on multi-blade BIG-IP | |
747203-2 | 2-Critical | Fragile NATT IKEv2 interface mode tunnel suffers RST after flow-not-found after forwarding | |
746464-1 | 2-Critical | MCPD sync errors and restart after multiple modifications to file object in chassis | |
746122-1 | 2-Critical | 'load sys config verify' resets the active master key to the on-disk master key value | |
743946-2 | 2-Critical | Tmsh loads schema versions 12.x and earlier which are no longer supported★ | |
741676-2 | 2-Critical | Intermittent crash switching between tunnel mode and interface mode | |
737322-2 | 2-Critical | tmm may crash at startup if the configuration load fails | |
724556-3 | 2-Critical | icrd_child spawns more than maximum allowed times (zombie processes) | |
721591 | 2-Critical | Java crashes with core during a basic TLS Signature test | |
718573-1 | 2-Critical | Internal SessionDB invalid state | |
717785-2 | 2-Critical | Interface-cos shows no egress stats for CoS configurations | |
593536-7 | 2-Critical | K64445052 | Device Group with incremental ConfigSync enabled might report 'In Sync' when devices have differing configurations |
382363-5 | 2-Critical | K30588577 | min-up-members and using gateway-failsafe-device on the same pool. |
906505-4 | 3-Major | Display of LCD System Menu cannot be configured via GUI on iSeries platforms | |
905749-2 | 3-Major | imish crash while checking for CLI help string in BGP mode | |
904785 | 3-Major | Remotely authenticated users may experience difficulty logging in over the serial console | |
904041-4 | 3-Major | Ephemeral pool members are missing from pool of Common partition when reloading configuration for current partition | |
903265-1 | 3-Major | Single user mode faced sudden reboot | |
901989-4 | 3-Major | Boot_marker writes to /var/log/btmp | |
900933-2 | 3-Major | IPsec interoperability problem with ECP PFS | |
900485-4 | 3-Major | Syslog-ng 'program' filter does not work | |
899933-4 | 3-Major | Listing property groups in TMSH without specifying properties lists the entire object | |
898705-3 | 3-Major | IPv6 static BFD configuration is truncated or missing | |
898577-4 | 3-Major | Executing a command in "mgmt tm" using iControl REST results in tmsh error | |
898461-4 | 3-Major | Several SCTP commands unavailable for some MRF iRule events :: 'command is not valid in current event context' | |
898389-3 | 3-Major | Traffic is not classified when adding port-list to virtual server from GUI | |
896817-4 | 3-Major | iRule priorities error may be seen when merging a configuration using the TMSH 'replace' verb | |
895845-3 | 3-Major | Implement automatic conflict resolution for gossip-conflicts in REST | |
895837-1 | 3-Major | Mcpd crash when a traffic-matching-criteria destination-port-list is modified | |
894545-4 | 3-Major | Creating a virtual server in the GUI with a destination address list and 'All Ports' can erroneously conflict with other virtual servers | |
893885 | 3-Major | The tpm-status command returns: 'System Integrity: Invalid' after HotFix installation | |
893341-1 | 3-Major | BIG-IP VE interface is down after upgrade from v13.x w/ workaround for ID774445 | |
892445-4 | 3-Major | BWC policy names are limited to 128 characters | |
891721-1 | 3-Major | Anti-Fraud Profile URLs with query strings do not load successfully | |
891337-3 | 3-Major | 'save_master_key(master): Not ready to save yet' errors in the logs | |
891221-4 | 3-Major | Router bgp neighbor password CLI help string is not helpful | |
889029-4 | 3-Major | Unable to login if LDAP user does not have search permissions | |
888081-1 | 3-Major | BIG-IP VE Migration feature fails for 1NIC | |
887145 | 3-Major | HSB receive failure in vCMP guest | |
886689-4 | 3-Major | Generic Message profile cannot be used in SCTP virtual | |
886649-3 | 3-Major | Connections stall when dynamic BWC policy is changed via GUI and TMSH | |
886273 | 3-Major | Unanticipated restart of TMM due to heartbeat failure | |
884989-3 | 3-Major | IKE_SA's Not mirrored of on Standby device if it reboots | |
884729-4 | 3-Major | The vCMP CPU usage stats are incorrect | |
884521 | 3-Major | OSPF External AS LSAs not adding into RIB | |
883149-4 | 3-Major | The fix for ID 439539 can cause mcpd to core. | |
882609-3 | 3-Major | ConfigSync status remains 'Disconnected' after setting ConfigSync IP to 'none' and back | |
880625-2 | 3-Major | Check-host-attr enabled in LDAP system-auth creates unusable config | |
880473-3 | 3-Major | Under certain conditions, the virtio driver may core during shutdown | |
880165-1 | 3-Major | Auto classification signature update fails | |
880013-3 | 3-Major | Config load fails after changing the BIG-IP Master key which has an encrypted key in it's configuration | |
879969-3 | 3-Major | FQDN node resolution fails if DNS response latency >5 seconds | |
879001-3 | 3-Major | LDAP data is not updated consistently which might affect authentication. | |
878893-1 | 3-Major | During system shutdown it is possible the for sflow_agent to core | |
878277 | 3-Major | Unexpected Error: Can't display all items, can't get object count from mcpd | |
877145-2 | 3-Major | Unable to log in to iControl REST via /mgmt/toc/, restjavad throwing NullPointerException | |
876937-1 | 3-Major | DNS Cache not functioning | |
876809-1 | 3-Major | GUI cannot delete a cert with a name that starts with * and ends with .crt | |
871705-4 | 3-Major | Restarting bigstart shuts down the system | |
871657-2 | 3-Major | Mcpd crash when adding NAPTR GTM pool member with a flag of uppercase A or S | |
871045-3 | 3-Major | IP fragments are disaggregated to separate TMMs with hardware syncookies enabled | |
867793-3 | 3-Major | BIG-IP sending the wrong trap code for BGP peer state | |
867253-1 | 3-Major | Systemd not deleting user journals | |
867181-3 | 3-Major | ixlv: double tagging is not working | |
867177-1 | 3-Major | Outbound TFTP and Active FTP no longer work by default over the management port | |
867013-1 | 3-Major | Fetching ASM policy list from the GUI (in LTM policy rule creation) occasionally causes REST timeout | |
866073-1 | 3-Major | Add option to exclude stats collection in qkview to avoid very large data files | |
865241-3 | 3-Major | Bgpd might crash when outputting the results of a tmsh show command: "sh bgp ipv6 ::/0" | |
865177-2 | 3-Major | Cert-LDAP returning only first entry in the sequence that matches san-other oid | |
864321-1 | 3-Major | Default Apache testing page is reachable at <mgmt-ip>/noindex | |
862937-2 | 3-Major | Running cpcfg after first boot can result in daemons stuck in restart loop★ | |
862693-2 | 3-Major | PAM_RHOST not set when authenticating BIG-IP using iControl REST | |
862525-3 | 3-Major | GUI Browser Cache Timeout option is not available via tmsh | |
860317-1 | 3-Major | JavaScript Obfuscator can hang indefinitely | |
860181-3 | 3-Major | After sync failure due to lack of local self-IP on the peer, adding in the self-IP does not resolve the sync error | |
858769-4 | 3-Major | Net-snmp library must be upgraded to 5.8 in order to support SHA-2 | |
858197-1 | 3-Major | Merged crash when memory exhausted | |
856953-2 | 3-Major | IPsec: TMM cores after ike-peer switched version from IKEv2 to IKEv1 | |
853617-3 | 3-Major | Validation does not prevent virtual server with UDP, HTTP, SSL, (and OneConnect) profiles | |
853161-1 | 3-Major | Restjavad has different behavior for error responses if the body is over 2k | |
852565-3 | 3-Major | On Device Management::Overview GUI page, device order changes | |
851785-1 | 3-Major | BIG-IP 10350V-F platform reported page allocation failures in N3FIPS driver | |
851021-3 | 3-Major | Under certain conditions, 'load sys config verify file /config/bigip.conf' may result in a 'folder does not exist' error | |
850997-3 | 3-Major | 'SNMPD' no longer shows up in the list of daemons on the high availability (HA) Fail-safe GUI page | |
850777-1 | 3-Major | BIG-IP VE deployed on cloud provider may be unable to reach metadata services with static management interface config | |
850357-3 | 3-Major | LDAP - tmsh cannot add config to nslcd.conf | |
846141-3 | 3-Major | Unable to use Rest API to manage GTM pool members that have an pipe symbol '|' in the server name. | |
846137-3 | 3-Major | The icrd returns incorrect route names in some cases | |
844925-2 | 3-Major | Command 'tmsh save /sys config' fails to save the configuration and hangs | |
844085-3 | 3-Major | GUI gives error when attempting to associate address list as the source address of multiple virtual servers with the same destination address | |
843661-3 | 3-Major | TMSH allows you to specify the 'add-on-keys' option when running the 'revoke sys license' command | |
843597-3 | 3-Major | Ensure the system does not set the VE's MTU higher than the vmxnet3 driver can handle | |
842669-1 | 3-Major | Syslog-ng / systemd-journald cannot handle logs with embedded newlines, write trailing content to /var/log/user.log | |
842189-2 | 3-Major | Tunnels removed when going offline are not restored when going back online | |
841721-3 | 3-Major | BWC::policy detach appears to run, but BWC control is still enabled | |
841649-2 | 3-Major | Hardware accelerated connection mismatch resulting in tmm core | |
841277-5 | 3-Major | C4800 LCD fails to load after annunciator hot-swap | |
839121-1 | 3-Major | A modified default profile that contains SSLv2, COMPAT, or RC2 cipher will cause the configuration to fail to load on upgrade★ | |
838901-2 | 3-Major | TMM receives invalid rx descriptor from HSB hardware | |
838337-3 | 3-Major | The BIG-IP system's time zone database does not reflect recent changes implemented by Brazil in regard to DST. | |
838297-1 | 3-Major | Remote ActiveDirectory users are unable to login to the BIG-IP using remote LDAP authentication | |
837481-5 | 3-Major | SNMPv3 pass phrases should not be synced between high availability (HA) devices as that are based on each devices unique engineID | |
829821-3 | 3-Major | Mcpd may miss its high availability (HA) heartbeat if a very large amount of pool members are configured | |
829317-3 | 3-Major | Memory leak observed when running ICRD child | |
829193-2 | 3-Major | REST system unavailable due to disk corruption | |
828873-2 | 3-Major | Unable to successfully deploy BIG-IP 15.0.0 on Nutanix AHV Hypervisor | |
828789-3 | 3-Major | Display of Certificate Subject Alternative Name (SAN) limited to 1023 characters | |
827209-2 | 3-Major | HSB transmit lockup on i4600 | |
827021-2 | 3-Major | MCP update message may be lost when primary blade changes in chassis | |
826437 | 3-Major | CSR subject fields with comma(,) are truncated during certificate renewal via the GUI. | |
826313-4 | 3-Major | Error: Media type is incompatible with other trunk members★ | |
826265-3 | 3-Major | The SNMPv3 engineBoots value restarts at 1 after an upgrade | |
824809-4 | 3-Major | bcm56xxd watchdog restart | |
821309-3 | 3-Major | After an initial boot, mcpd has a defunct child "systemctl" process | |
820845-2 | 3-Major | Self-IP does not respond to ( ARP / Neighbour Discovery ) when EtherIP tunnels in use. | |
820213-2 | 3-Major | 'Application Service List' empty after UCS restore | |
819457-3 | 3-Major | LTM high availability (HA) sync should not sync GTM zone configuration | |
819261-3 | 3-Major | Log HSB registers when parts of the device becomes unresponsive | |
818505-3 | 3-Major | Modifying a virtual address with an iControl PUT command causes the netmask to always change to IPv6 ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff | |
817089-1 | 3-Major | Incorrect source MAC address with hardware acceleration (ePVA) and asymmetric routing | |
816229-1 | 3-Major | Kernel Log Messages Logged Twice | |
814585-3 | 3-Major | PPTP profile option not available when creating or modifying virtual servers in GUI | |
814353-3 | 3-Major | Pool member silently changed to user-disabled from monitor-disabled | |
814273-3 | 3-Major | Multicast route entries are not populating to tmm after failover | |
814053-2 | 3-Major | Under heavy load, bcm56xxd can be killed by the watchdog | |
812929-2 | 3-Major | mcpd may core when resetting a DSC connection | |
812493-2 | 3-Major | When engineID is reconfigured, snmp and alert daemons must be restarted★ | |
811053-2 | 3-Major | REBOOT REQUIRED prompt appears after failover and clsh reboot | |
811041-5 | 3-Major | Out of shmem, increment amount in /etc/ha_table/ha_table.conf | |
810613-2 | 3-Major | GUI Login History hides informative message about max number of lines exceeded | |
810381-4 | 3-Major | The SNMP max message size check is being incorrectly applied. | |
810373-1 | 3-Major | Errors running 'config' command | |
809657-2 | 3-Major | HA Group score not computed correctly for an unmonitored pool when mcpd starts | |
809509-1 | 3-Major | Resource Admin User unable to download UCS using Rest API. | |
808485-2 | 3-Major | Add 'virtual-server' argument to 'tmsh help sys connection' for version 14.x | |
808277-4 | 3-Major | Root's crontab file may become empty | |
807945-2 | 3-Major | Loading UCS file for the first time not updating MCP DB | |
807337-3 | 3-Major | Config utility (web UI) output differs between tmsh and AS3 when the pool monitor is changed. | |
807005-1 | 3-Major | Save-on-auto-sync is not working as expected with large configuration objects | |
806985 | 3-Major | Installation issues when adding new blade v12.1.3 to VPR cluster v14.1.0.1 EHF★ | |
806881-2 | 3-Major | Loading the configuration may not set the virtual server enabled status correctly | |
806073-3 | 3-Major | MySQL monitor fails to connect to MySQL Server v8.0 | |
804537-1 | 3-Major | Check SAs in context callbacks | |
804477-4 | 3-Major | Log HSB registers when parts of the device becomes unresponsive | |
803833-4 | 3-Major | On Upgrade or UCS Restore Decryption of the vCMP Guest sym-unit-key Field Fails on the Host★ | |
803457-2 | 3-Major | SNMP custom stats cannot access iStats | |
803237-4 | 3-Major | PVA does not validate interface MTU when setting MSS | |
803157-1 | 3-Major | LTM log contains shutdown sequence logs after boot_marker as logs are buffered until BIG-IP reboots | |
802889 | 3-Major | Problems establishing HA connections on DAGv2 chassis platforms | |
802685-3 | 3-Major | Unable to configure performance HTTP virtual server via GUI | |
799001-3 | 3-Major | Sflow agent does not handle disconnect from SNMPD manager correctly | |
798885-2 | 3-Major | SNMP response times may be long due to processing burden of requests | |
797953 | 3-Major | Workaround for SSLo deployment failure from BigIQ to BIG-IP | |
797829-5 | 3-Major | The BIG-IP system may fail to deploy new iApps or to reconfigure existing iApps. | |
797609-2 | 3-Major | Creating or modifying some virtual servers to use an address or port list may result in a warning message | |
796985-1 | 3-Major | Default IPv4 IP address is assigned to Alt-Address in isolated vCMP guest; vCMP host or guest are upgraded and guest is 'Inoperative'★ | |
795649-3 | 3-Major | Loading UCS from one iSeries model to another causes FPGA to fail to load | |
793121-3 | 3-Major | Enabling sys httpd redirect-http-to-https prevents vCMP host-to-guest communication | |
791365-2 | 3-Major | Bad encryption password error on UCS save | |
791061-2 | 3-Major | Config load in /Common removes routing protocols from other partitions | |
789181-3 | 3-Major | Link Status traps are not issued on VE based BIG-IP systems | |
788949-3 | 3-Major | MySQL Password Initialization Loses Already Written Password | |
788645-4 | 3-Major | BGP does not function on static interfaces with vlan names longer than 16 characters. | |
786633-1 | 3-Major | Debug-level messages are being logged even when the system is not set up for debug logging | |
784733-3 | 3-Major | GUI LTM Stats page freezes for large number of pools | |
783293-1 | 3-Major | Special chars < > & displayed incorrectly in BIG-IP GUI logon banner window | |
783113-4 | 3-Major | BGP sessions remain down upon new primary slot election | |
782613-5 | 3-Major | Security firewall policy in an iApp not deleted on config sync peer with the rest of a deleted iApp | |
781733-2 | 3-Major | SNMPv3 user name configuration allows illegal names to be entered | |
780745-2 | 3-Major | TMSH allows creation of duplicate community strings for SNMP v1/v2 access | |
778041-1 | 3-Major | tcpdump fails with an unclear message when the 'epva' option is used on non-epva platforms (directly or through 'all' option) | |
777389-1 | 3-Major | In a corner case, for PostgreSQL monitor MCP process restarts | |
776489-2 | 3-Major | Remote authentication attempts to resolve only LDAP host against the first three name servers configured. | |
775797-2 | 3-Major | Previously deleted user account might get authenticated | |
775733-1 | 3-Major | /etc/qkview_obfuscate.conf not synced across blades | |
773577-2 | 3-Major | SNMPv3: When a security-name and a username are the same but have different passwords, traps are not properly crafted | |
773333-2 | 3-Major | IPsec CLI help missing encryption algorithm descriptions | |
773173-1 | 3-Major | LTM Policy GUI is not working properly | |
772497-5 | 3-Major | When BIG-IP is configured to use a proxy server, updatecheck fails | |
771137 | 3-Major | vCMP host reports much larger 'Virtual-disk' usage than du reports on the guest | |
770657-2 | 3-Major | On hardware platforms with ePVA, some valid traffic is blocked when in L2 transparent mode and syn cookies are enabled | |
769029-1 | 3-Major | Non-admin users fail to create tmp dir under /var/system/tmp/tmsh | |
767737-2 | 3-Major | Timing issues during startup may make an HA peer stay in the inoperative state | |
767341-3 | 3-Major | If the size of a filestore file is smaller than the size reported by mcp, tmm can crash while loading the file. | |
767305-2 | 3-Major | If the mcpd daemon is restarted by itself, some SNMP OIDs fail to return data the first time they are queried | |
765969-1 | 3-Major | Not able to get HSB register dump from hsb_snapshot on B4450 blade | |
764873-2 | 3-Major | An accelerated flow transmits packets to a dated, down pool member. | |
762097-1 | 3-Major | No swap memory available after upgrading to v14.1.0 and above★ | |
762073-2 | 3-Major | Continuous TMM restarts when HSB drops off the PCI bus | |
761753-2 | 3-Major | BIG-IP system incorrectly flags UDP checksum as failed on x520 NICs | |
761321-2 | 3-Major | 'Connection Rate Limit' is hidden, but 'Connection Rate Limit Mode' is not | |
760950-4 | 3-Major | Incorrect advertised next-hop in BGP for a traffic group in Active-Active deployment | |
760468 | 3-Major | Route domains cause diskmonitor errors in logs | |
759737-2 | 3-Major | Control and Analysis Plane CPU usage statistics may be inaccurate | |
759564-4 | 3-Major | GUI not available after upgrade | |
759258-2 | 3-Major | Instances shows incorrect pools if the same members are used in other pools | |
758517-1 | 3-Major | Callback for Diffie Hellman crypto is missing defensive coding | |
758516-1 | 3-Major | IKEv2 auth encryption is missing defensive coding that checks object validity | |
757862-1 | 3-Major | IKEv2 debug logging an uninitialized variable leading to core | |
757787-2 | 3-Major | Unable to edit LTM Policies that belong to an Application Service (iApp) using the WebUI. | |
757572 | 3-Major | Virtual Edition doesn't support forging MAC addresses with Mellanox ConnectX-3 virtual functions | |
756820-2 | 3-Major | Non-UTF8 characters returned from /bin/createmanifest | |
756153-3 | 3-Major | Add diskmonitor support for MySQL /var/lib/mysql | |
756139-1 | 3-Major | Inconsistent logging of hostname files when hostname contains periods | |
756088-2 | 3-Major | The BIG-IP might respond incorrectly to ICMP echo requests or incorrectly add/remove dynamic routes to a virtual-address | |
755976-3 | 3-Major | ZebOS might miss kernel routes after mcpd deamon restart | |
755197-3 | 3-Major | UCS creation might fail during frequent config save transactions | |
754971-2 | 3-Major | OSPF inter-process redistribution might break OSPF route redistribution of various types. | |
754460-2 | 3-Major | No failover on HA Dual Chassis setup using HA score | |
754335-1 | 3-Major | Install ISO does not boot on BIG-IP VE★ | |
754132-2 | 3-Major | A NLRI with a default route information is not propagated on 'clear ip bgp <neighbor router-id> soft out' command | |
753860-3 | 3-Major | Virtual server config changes causing incorrect route injection. | |
753423-6 | 3-Major | Disabling and immediately re-enabling the slot resulting interfaces from the slot permanently removed from aggregation | |
753001-1 | 3-Major | mcpd can be killed if the configuration contains a very high number of nested references | |
752994-1 | 3-Major | Many nested client SSL profiles can take a lot of time to process and cause MCP to be killed by sod | |
752228-1 | 3-Major | GUI Network Map to account for objects in a Disabled By Parent state | |
751584-1 | 3-Major | Custom MIB actions can be blocked by SELINUX permissions | |
751581-3 | 3-Major | REST API Timeout while queriying large number of persistence profiles | |
751448-1 | 3-Major | TMM, ZebOS, and Linux routing table may lose dynamic routes on a tmm restart | |
751409-1 | 3-Major | MCP Validation does not detect when virtual servers differ only by overlapping VLANs | |
751024-4 | 3-Major | i5000/i7000/i10000 platforms: SFP/QSFP I2C problems may not be cleared by bcm56xxd | |
751021-1 | 3-Major | One or more TMM instances may be left without dynamic routes. | |
748545-1 | 3-Major | Remove 'sys-unconfig' and 'rhel-configure' binaries and related systemd service | |
748443-1 | 3-Major | Higig MAC recovery mechanism may fail continuously during run time | |
748295-1 | 3-Major | TMM crashes on shutdown when using virtio NICs for dataplane | |
748044 | 3-Major | RAID status in tmsh is not updated when disk is removed or rebuild finishes | |
747676-3 | 3-Major | Remote logging needs 'localip' to set source IP properly | |
746758-3 | 3-Major | Qkview produces core file if interrupted while exiting | |
746704-2 | 3-Major | Syslog-ng Memory Leak | |
745261-2 | 3-Major | The TMM process may crash in some tunnel cases | |
744924-1 | 3-Major | Bladed unit goes offline after UCS install | |
744730-1 | 3-Major | After increasing the disk size on a VE or VCMP guest a manual reboot is required for the increase to go into effect. | |
744520-1 | 3-Major | virtual server with perm profile drops traffic received from Vxlan-GRE tunnel interface | |
744252-2 | 3-Major | BGP route map community value: either component cannot be set to 65535 | |
743234-4 | 3-Major | Configuring EngineID for SNMPv3 requires restart of the SNMP and Alert daemons | |
743132-6 | 3-Major | mcpd might restart on secondary blades after modify sys httpd ssl-certchainfile | |
742753-4 | 3-Major | Accessing the BIG-IP system's WebUI via special proxy solutions may fail | |
742628-3 | 3-Major | K53843889 | Tmsh session initiation adds increased control plane pressure |
742170-2 | 3-Major | REST PUT command fails for data-group internal | |
740589-1 | 3-Major | Mcpd crash with core after 'tmsh edit /sys syslog-all-properties' | |
739820-1 | 3-Major | Validation does not reject IPv6 address for TACACS auth configuration | |
739118-1 | 3-Major | Manually modifying a self IP address in bigip_base.conf file and reloading the configuration results in routing misconfiguration | |
738881-3 | 3-Major | Qkview does not collect any data under certain conditions that cause a timeout | |
737739-1 | 3-Major | Bash shell still accessible for admin even if disabled | |
737346-1 | 3-Major | After entering username and before password, the logging on user's failure count is incremented. | |
737098-2 | 3-Major | ASM Sync does not work when the configsync IP address is an IPv6 address | |
730852-3 | 3-Major | The tmrouted repeatedly crashes and produces core when new peer device is added | |
727191-1 | 3-Major | Invalid arguments to run sys failover do not return an error | |
726416-3 | 3-Major | Physical disk HD1 not found for logical disk create | |
721020-1 | 3-Major | Changes to the master key are reverted after full sync | |
720610-2 | 3-Major | Updatecheck logs bogus 'Update Server unavailable' on every run | |
719555-5 | 3-Major | Interface listed as 'disable' after SFP insertion and enable | |
718230-1 | 3-Major | Attaching a BIG-IP monitor type to a server with already defined virtual servers is not prevented | |
718108-3 | 3-Major | It is not possible to core the icrd_child process if iControl REST requests were sent to the BIG-IP system using non-admin accounts | |
716140-2 | 3-Major | Information in snmpd.conf files may be overwritten causing SNMP v3 queries to recieve 'Unsupported security level' errors | |
715379-3 | 3-Major | IKEv2 accepts asn1dn for peers-id only as file path of certificate file | |
708803-2 | 3-Major | Remote admin user with misconfigured partition fallback to "All" | |
705037-7 | 3-Major | K32332000 | System may exhibit duplicate if_index, which in some cases lead to nsm daemon restart |
703090-5 | 3-Major | With many iApps configured, scriptd may fail to start | |
701529-2 | 3-Major | Configuration may not load or not accept vlan or tunnel names as "default" or "all" | |
701341-4 | 3-Major | K52941103 | If /config/BigDB.dat is empty or the file is corrupt, mcpd continuously restarts |
698933-6 | 3-Major | Setting metric-type via ospf redistribute command may not work correctly | |
692218-3 | 3-Major | Audit log messages sent from the primary blade to the secondaries should not be logged. | |
690928-1 | 3-Major | System posts error message: 01010054:3: tmrouted connection closed | |
688399-2 | 3-Major | HSB failure results in continuous TMM restarts | |
688231-4 | 3-Major | Unable to set VET, AZOT, and AZOST timezones | |
683135-1 | 3-Major | Hardware syncookies number for virtual server stats is unrealistically high | |
680917-5 | 3-Major | Invalid monitor rule instance identifier | |
679901-5 | 3-Major | The iControl REST timeout value is not configurable. | |
671372-5 | 3-Major | K01930721 | When creating a pool and modifying all of its members in a single transaction, the pool will be created but the members will not be modified. |
662301-4 | 3-Major | 'Unlicensed objects' error message appears despite there being no unlicensed config | |
661640-1 | 3-Major | Improve fast failover of PIM-based multicast traffic when BIG-IP is deployed as an Active/Standby high availability (HA) pair. | |
658850-2 | 3-Major | Loading UCS with the platform-migrate parameter could unexpectedly set or unset management DHCP | |
657834-5 | 3-Major | K45005512 | Extraneous OSPF retransmissions and ospfTxRetransmit traps can be sent |
652502-3 | 3-Major | snmpd returns 'No Such Object available' for ltm OIDs | |
615934-4 | 3-Major | Overwrite flag in various iControl key/certificate management functions is ignored and might result in errors. | |
606032-5 | 3-Major | Network Failover-based high availability (HA) in AWS may fail | |
605675-4 | 3-Major | Sync requests can be generated faster than they can be handled | |
601220-3 | 3-Major | Multi-blade trunks seem to leak packets ingressed via one blade to a different blade | |
591305-3 | 3-Major | Audit log messages with "user unknown" appear on install | |
587821-8 | 3-Major | vCMP Guest VLAN traffic failure after MCPD restarts on hypervisor. | |
569859-5 | 3-Major | Password policy enforcement for root user when mcpd is not available | |
499348-9 | 3-Major | System statistics may fail to update, or report negative deltas due to delayed stats merging | |
486712-5 | 3-Major | GUI PVA connection maximum statistic is always zero | |
469724-2 | 3-Major | When evaluation/demonstration features expire, features enabled by both evaluation and perpetual licenses also expire | |
431503-3 | 3-Major | K14838 | TMSH crashes in rare initial tunnel configurations |
409062-1 | 3-Major | K20008325 | ArcSight HSL is not supported for most system daemons |
398683-3 | 3-Major | K12304 | Use of a # in a TACACS secret causes remote auth to fail |
385013-4 | 3-Major | Certain user roles do not trigger a sync for a 'modify auth password' command | |
291256-2 | 3-Major | Changing 'Minimum Length' and 'Required Characters' might result in an error | |
906449-4 | 4-Minor | Node, Pool Member, and Monitor Instance timestamps may be updated by config sync/load | |
902417-4 | 4-Minor | Configuration error caused by Drafts folder in a deleted custom partition★ | |
901669-2 | 4-Minor | Error status in "show cm failover-status" after MGMT-IP change | |
896693-2 | 4-Minor | Patch installation is failing for iControl REST endpoint. | |
896689-2 | 4-Minor | Asynchronous tasks can be managed via unintended endpoints | |
893813-1 | 4-Minor | Modifying pool enables address and port translation in TMUI | |
893093-4 | 4-Minor | An extraneous SSL CSR file in the /config/big3d or /config/gtm directory can prevent certain sections in the WebUI from showing. | |
892677-4 | 4-Minor | Loading config file with imish adds the newline character | |
890277-2 | 4-Minor | Mcpd takes too long on full config sync to a device group when there are large amount of partitions. | |
889813-1 | 4-Minor | show net bwc policy prints bytes-per-second instead of bits-per-second | |
884953-2 | 4-Minor | IKEv1 IPsec daemon racoon goes into an endless restart loop | |
882713-1 | 4-Minor | BGP SNMP trap has the wrong sysUpTime value | |
882709 | 4-Minor | LTM v14.1.x to support tagged VLANs on Hyper-V (as was supported on v12.1.x) | |
879189-3 | 4-Minor | Network map shows 'One or more profiles are inactive due to unprovisioned modules' in Profiles section | |
876249 | 4-Minor | Top command shows tmm 0.0% CPU usage under load | |
869237-3 | 4-Minor | Management interface might become unreachable when alternating between DHCP/static address assignment. | |
865313-2 | 4-Minor | Validation of monitor field fails in transaction | |
864757-2 | 4-Minor | Traps that were disabled are enabled after configuration save | |
860573-2 | 4-Minor | LTM iRule validation performance improvement by tracking procedure/event that have been validated | |
858549-4 | 4-Minor | GUI does not allow IPv4-Mapped IPv6 Address to be assigned to self IPs | |
857045-3 | 4-Minor | LDAP system authentication may stop working | |
851393-3 | 4-Minor | Tmipsecd leaves a zombie rm process running after starting up | |
848681-5 | 4-Minor | Disabling the LCD on a VIPRION causes blade status lights to turn amber | |
846521-5 | 4-Minor | Config script does not refresh management address entry properly when alternating between dynamic and static | |
838925-5 | 4-Minor | Rewrite URI translation profile can cause connection reset while processing malformed CSS content | |
832665-2 | 4-Minor | The version of open-vm-tools included with BIG-IP Virtual Edition is 10.0.5 | |
832653 | 4-Minor | Azure scan table warnings can be ignored. | |
831293-3 | 4-Minor | SNMP address-related GET requests slow to respond. | |
828625-1 | 4-Minor | User shouldn't be able to configure two identical traffic selectors | |
826297-1 | 4-Minor | Address list as source/destination for virtual server cannot be changed from tmsh | |
826189-2 | 4-Minor | The WebUI incorrectly allows the dns64-prefix option found in DNS profiles to include a subnet mask. | |
824205-1 | 4-Minor | GUI displays error when a virtual server is modified if it is using an address-list | |
822253-3 | 4-Minor | After starting up, mcpd may have defunct child "run" and "xargs" processes | |
819429-3 | 4-Minor | Unable to scp to device after upgrade: path not allowed | |
819421-3 | 4-Minor | Unable to scp/sftp to device after upgrade★ | |
818737-1 | 4-Minor | Improve error message if user did not select a address-list or port list in the GUI | |
818417-2 | 4-Minor | Flowspecd starts with message: Shm segment not found in /etc/ha_table/ha_table.conf. | |
818297 | 4-Minor | OVSDB-server daemon lost permission to certs due to SELinux issue, causing SSL connection failure | |
816353-1 | 4-Minor | Unknown trap OID 1.3.6.1.2.1.47.2.0.1.0.1 | |
807309-2 | 4-Minor | Incorrect Active/Standby status in CLI Prompt after failover test | |
805325-2 | 4-Minor | tmsh help text contains a reference to bigpipe, which is no longer supported | |
804309-2 | 4-Minor | [api-status-warning] are generated at stderr and /var/log/ltm when listing config with all-properties argument | |
800189-1 | 4-Minor | Changing log level may not increase logging to the verbosity expected | |
795429-3 | 4-Minor | Unrelated iControl REST transaction error message is returned when committing a transaction without any tasks. | |
793077 | 4-Minor | Failed SSH logins no longer log entries into the audit log file | |
779857-1 | 4-Minor | Misleading GUI error when installing a new version in another partition★ | |
774617-1 | 4-Minor | SNMP daemon reports integer truncation error for values greater than 32 bits | |
761084-3 | 4-Minor | Custom monitor fields appear editable for Auditor, Operator, or Guest | |
760570 | 4-Minor | The BIG-IP installer fails to automatically detect installation media.★ | |
759852-1 | 4-Minor | SNMP configuration for trap destinations can cause a warning in the log | |
759606-2 | 4-Minor | REST error message is logged every five minutes on vCMP Guest | |
758348-1 | 4-Minor | Cannot access GUI via hostname when it contains _ (underscore character) | |
758105-3 | 4-Minor | Drive model WDC WD1005FBYZ-01YCBB2 must be added to pendsect drives.xml | |
757167-1 | 4-Minor | TMM logs 'MSIX is not supported' error on vCMP guests | |
756401-2 | 4-Minor | IKEv2 debug logging often omits SPI values that would identify the SAs involved | |
755450-1 | 4-Minor | Memory leak when using lots of iApps | |
755018-2 | 4-Minor | Egress traffic processing may be stopped on one or more VE trunk interfaces | |
753536-2 | 4-Minor | REST no longer requires a token to login for TACACS use | |
751103-4 | 4-Minor | TMSH: 'tmsh save sys config' prompts question when display threshold is configured which is causing scripts to stop | |
746152-1 | 4-Minor | Bogus numbers in hsbe2_internal_pde_ring table's rqm_dma_drp_pkts column | |
745465-1 | 4-Minor | The tcpdump file does not provide the correct extension | |
743815-2 | 4-Minor | vCMP guest observes connflow reset when a CMP state change occurs. | |
742105-2 | 4-Minor | Displaying network map with virtual servers is slow | |
724994-4 | 4-Minor | API requests with 'expandSubcollections=true' are very slow | |
723833-2 | 4-Minor | IPsec related routing changes can misfire, like changing tunnel mode to interface mode | |
722647-4 | 4-Minor | The configuration of some of the Nokia alerts is incorrect | |
722230-3 | 4-Minor | Cannot delete FQDN template node if another FQDN node resolves to same IP address | |
713614-4 | 4-Minor | Virtual address (/Common/10.10.10.10) shares address with floating self IP (/Common/10.10.10.10), so traffic-group is being kept at (/Common/traffic-group-local-only) | |
713183-3 | 4-Minor | Malformed JSON files may be present on vCMP host | |
712241-2 | 4-Minor | A vCMP guest may not provide guest health stats to the vCMP host | |
706685-3 | 4-Minor | Unable to log into BIG-IP GUI after partition is deleted | |
689147-2 | 4-Minor | Confusing log messages on certain user/role/partition misconfiguration when using remote role groups | |
675911-6 | 4-Minor | K13272442 | Different sections of the WebUI can report incorrect CPU utilization |
673573-3 | 4-Minor | tmsh logs boost assertion when running child process and reaches idle-timeout | |
671025-3 | 4-Minor | File descriptor exhaustion can occur when state-mirroring peer-address is misconfigured | |
658943-2 | 4-Minor | Errors when platform-migrate loading UCS using trunks on vCMP guest | |
646768-2 | 4-Minor | K71255118 | VCMP Guest CM device name not set to hostname when deployed |
617636-2 | 4-Minor | K15009669 | LTM v11.6.x Errors in F5-BIGIP-LOCAL-MIB.txt prevent its compilation in NMS (Network Management System) |
591732-5 | 4-Minor | Local password policy not enforced when auth source is set to a remote type. | |
583084-8 | 4-Minor | K15101680 | iControl produces 404 error while creating records successfully |
484683-2 | 4-Minor | Certificate_summary is not created at peer when the chain certificate is synced to high availability (HA) peer. | |
849085-3 | 5-Cosmetic | Lines with only asterisks filling message and user.log file | |
769145-2 | 5-Cosmetic | Syncookie threshold warning is logged when the threshold is disabled | |
761621-2 | 5-Cosmetic | Ephemeral FQDN pool members in Partition shown as Common under Local Traffic > Pools > "Members" | |
714176-3 | 5-Cosmetic | UCS restore may fail with: Decryption of the field (privatekey) for object (9717) failed | |
679431-4 | 5-Cosmetic | In routing module the 'sh ipv6 interface <interface> brief' command may not show header |
Local Traffic Manager Issues
ID Number | Severity | Solution Article(s) | Description |
901033-1 | 2-Critical | TCP::respond causing memory exhaustion issue when send buffer overwhelmed available TCP window | |
879409-2 | 2-Critical | TMM core with mirroring traffic due to unexpected interface name length | |
876801-3 | 2-Critical | Tmm crash: invalid route type | |
864897-1 | 2-Critical | TMM may crash when using "SSL::extensions insert" | |
858429 | 2-Critical | BIG-IP system sending ICMP packets on both virtual wire interface | |
851857-3 | 2-Critical | HTTP 100 Continue handling does not work when it arrives in multiple packets | |
851581-1 | 2-Critical | Server-side detach may crash TMM | |
851385-4 | 2-Critical | Failover takes too long when traffic blade failure occurs | |
846217-1 | 2-Critical | Translucent vlan-groups set local bit in destination MAC address | |
842937-4 | 2-Critical | TMM crash due to failed assertion 'valid node' | |
841469-4 | 2-Critical | Application traffic may fail after an internal interface failure on a VIPRION system. | |
837617-3 | 2-Critical | Tmm may crash while processing a compression context | |
835505-2 | 2-Critical | Tmsh crash possibly related to NGFIPS SDK | |
824881-2 | 2-Critical | A rare TMM crash cause by the fix for ID 816625 | |
824437-2 | 2-Critical | Chaining a standard virtual server and an ipother virtual server together can crash TMM. | |
813561-3 | 2-Critical | MCPD crashes when assigning an iRule that uses a proc | |
811161-1 | 2-Critical | Tmm crash SIGSEGV - virtual_address_update() in ../mcp/db_vip.c:1992 | |
788813-1 | 2-Critical | TMM crash when deleting virtual-wire config | |
766509-1 | 2-Critical | Strict internal checking might cause tmm crash | |
763145-1 | 2-Critical | TMM Crash when using certain HTTP iRules with HTTP Security Profile | |
758491-1 | 2-Critical | When using Thales NetHSM integration, after upgrade to 14.1.0 or later (or creating keys using fipskey.nethsm), the BIG-IP will not be able to use the keys | |
751589-1 | 2-Critical | In BIG-IP VE, some IP rules may not be created during the first boot up. | |
750702-1 | 2-Critical | TMM crashes while making changes to virtual wire configuration | |
745589-6 | 2-Critical | In very rare situations, some filters may cause data-corruption. | |
726900-1 | 2-Critical | Switching from FastL4 or TCP profiles to an ipother profile may leave a virtual server with stale TCP syncookie parameters | |
726518-3 | 2-Critical | Tmsh show command terminated with CTRL-C can cause TMM to crash. | |
712534 | 2-Critical | DNSSEC keys are not generated when configured to use an external FIPS device | |
705768-1 | 2-Critical | dynconfd may core and restart with multiple DNS name servers configured | |
663925-3 | 2-Critical | Virtual server state not updated with pool- or node-based connection limiting | |
632553-4 | 2-Critical | K14947100 | DHCP: OFFER packets from server are intermittently dropped |
625807-1 | 2-Critical | tmm cored in bigproto_cookie_buffer_to_server | |
474797-4 | 2-Critical | Nitrox crypto hardware may attempt soft reset while currently resetting | |
905477-4 | 3-Major | The sdmd daemon cores during config sync when multiple devices configured for iRules LX | |
904625-4 | 3-Major | Changes to SSL.CertRequest.* DB variables cause HA devices go out of sync | |
903581-2 | 3-Major | The pkcs11d process cannot recover under certain error condition | |
901929-4 | 3-Major | GARPs not sent on virtual server creation | |
901589 | 3-Major | TMM crash occurred while generating cookie for TCP Fast Open | |
898733-1 | 3-Major | SSL handshakes fail on secondary blades for Thales keys created with fipskey.nethsm after upgrade to 14.1.x and re-import of the keys from HSM | |
898685-2 | 3-Major | Order of ciphers changes after updating cipher group | |
897185-1 | 3-Major | Resolver cache not using random port distribution | |
896245-1 | 3-Major | Inconsistency is observed in ARP behavior across releases | |
895205-4 | 3-Major | A circular reference in rewrite profiles causes MCP to crash | |
895165-4 | 3-Major | Traffic-matching-criteria with "any" protocol overlaps with explicit protocols | |
893281-1 | 3-Major | Possible ssl stall on closed client handshake | |
892801-4 | 3-Major | When an Internal Virtual Server is created without an existing 0.0.0.0 virtual address, it will have the state "disabled-by-parent" | |
892485-1 | 3-Major | A wrong OCSP status cache may be looked up and re-used during SSL handshake. | |
892385-2 | 3-Major | HTTP does not process WebSocket payload when received with server HTTP response | |
892073-1 | 3-Major | TLS1.3 LTM policy rule based on SSL SNI is not triggered | |
891373-4 | 3-Major | BIG-IP does not shut a connection for a HEAD request | |
890229-3 | 3-Major | Source port preserve setting is not honoured | |
889245-1 | 3-Major | Ndal ixvf driver can lock up | |
889209-1 | 3-Major | Sflow receiver configuration may lead to egress traffic dropped after TMM starts. | |
889165-1 | 3-Major | "http_process_state_cx_wait" errors in log and connection reset | |
888113-1 | 3-Major | HUDEVT_CALLBACK is queued after HUDCTL_ABORT in HTTP-MR proxy | |
887181 | 3-Major | BIG-IP is trying to establish the server side connection without VLAN tag info | |
887045-4 | 3-Major | The session key does not get mirrored to standby. | |
885325-4 | 3-Major | Stats might be incorrect for iRules that get executed a large number of times | |
883049-4 | 3-Major | Statsd can deadlock with rrdshim if an rrd file is invalid | |
882725-3 | 3-Major | Mirroring not working properly when default route vlan names not match. | |
881065-2 | 3-Major | Adding port-list to Virtual Server changes the route domain to 0 | |
881041-1 | 3-Major | BIG-IP system may forward IP broadcast packets back to the incoming VLAN interface via a forwarding virtual server. | |
879413-3 | 3-Major | Statsd fails to start if one or more of its *.info files becomes corrupted | |
878925-3 | 3-Major | SSL connection mirroring failover at end of TLS handshake | |
878253-3 | 3-Major | LB::down no longer sends an immediate monitor probe | |
876145-2 | 3-Major | Nitrox5 failure on vCMP guest results in all crypto requests failing. | |
874877-3 | 3-Major | Bigd http monitor shows misleading 'down' reason when recv does not match | |
874317-3 | 3-Major | Client-side asymmetric routing could lead to SYN and SYN-ACK on different VLAN | |
873677-5 | 3-Major | LTM policy matching does not work as expected | |
872981-3 | 3-Major | MCP crashes when deleting a virtual server and its traffic-matching-criteria in the same transaction | |
872721-1 | 3-Major | SSL connection mirroring intermittent failure with TLS1.3 | |
870309-1 | 3-Major | Ephemeral pool member not created when FQDN resolves to new IP address | |
868209-1 | 3-Major | Transparent vlan-group with standard virtual-server does L2 forwarding instead of pool selection | |
868033-3 | 3-Major | SSL option "passive-close" option is unused and should be removed | |
864649-1 | 3-Major | The client-side connection of a dhcpv4_fwd profile on Broadcast DHCP-Relay Virtual Server never expires from the connection table | |
863165-1 | 3-Major | Unbalanced trunk distribution on i4x00 and 4000 platforms with odd number of members. | |
862597-5 | 3-Major | Improve MPTCP's SYN/ACK retransmission handling | |
862069-3 | 3-Major | Using non-standard HTTPS and SSH ports will fail under certain conditions | |
862001-3 | 3-Major | Improperly configured NTP server can result in an undisciplined clock stanza | |
860277-2 | 3-Major | Default value of TCP Profile Proxy Buffer High Low changed in 14.1 | |
860005-3 | 3-Major | Ephemeral nodes/pool members may be created for wrong FQDN name | |
858701-3 | 3-Major | Running config and saved config are having different route-advertisement values after upgrading from v12.1.x★ | |
857845-6 | 3-Major | ASSERTs in hudproxy_tcp_repick() converted into an OOPS | |
852873 | 3-Major | Proprietary Multicast PVST+ packets are forwarded instead of dropped | |
852325-3 | 3-Major | HTTP2 does not support Global SNAT | |
851477-3 | 3-Major | Memory allocation failures during proxy initialization are ignored leading to TMM cores | |
851101-2 | 3-Major | Unable to establish active FTP connection with custom FTP filter | |
851045-3 | 3-Major | LTM database monitor may hang when monitored DB server goes down | |
850873-1 | 3-Major | LTM global SNAT sets TTL to 255 on egress. | |
850349-3 | 3-Major | Incorrect MAC when virtual wire is configured with FastL4 | |
850145-3 | 3-Major | Connection hangs since pipelined HTTP requests are incorrectly queued in the proxy and not processed | |
848777-1 | 3-Major | Configuration for virtual server using shared object address-list in non-default partition in non-default route-domain does not sync to peer node. | |
846977-3 | 3-Major | TCP:collect validation changed in 12.0.0: the first argument can no longer be zero★ | |
846873-3 | 3-Major | Deleting and re-adding the last virtual server that references a plugin profile in a single transaction causes traffic failure | |
846441-1 | 3-Major | Flow-control is reset to default for secondary blade's interface | |
845333-3 | 3-Major | An iRule with a proc referencing a datagroup cannot be assigned to Transport Config | |
844421 | 3-Major | Cipher ordering in cipher rules can be wrong | |
843317-1 | 3-Major | The iRules LX workspace imported with incorrect SELinux contexts | |
842425-3 | 3-Major | Mirrored connections on standby are never removed in certain configurations | |
842137-5 | 3-Major | Keys cannot be created on module protected partitions when strict FIPS mode is set | |
841369-1 | 3-Major | HTTP monitor GUI displays incorrect green status information | |
841341-4 | 3-Major | IP forwarding virtual server does not pick up any traffic if destination address is shared. | |
840785-3 | 3-Major | Update documented examples for REST::send to use valid REST endpoints | |
838353-3 | 3-Major | MQTT monitor is not working in route domain. | |
832133-3 | 3-Major | In-TMM monitors fail to match certain binary data in the response from the server. | |
828601-3 | 3-Major | IPv6 Management route is preferred over IPv6 tmm route | |
827441-1 | 3-Major | Changing a UDP virtual server with an immediate timeout to a TCP virtual server can cause connections to fail | |
826349-2 | 3-Major | VXLAN tunnel might fail due to misbehaving NIC checksum offload | |
825245-2 | 3-Major | SSL::enable does not work for server side ssl | |
824433-1 | 3-Major | Added HTTP2 and HTTP3 request/response statistic fields to the HTTP profile | |
823921-2 | 3-Major | FTP profile causes memory leak | |
823825-5 | 3-Major | Renaming HA VLAN can disrupt state-mirror connection | |
820333-3 | 3-Major | LACP working member state may be inconsistent when blade is forced offline | |
819329-2 | 3-Major | Specific FIPS device errors will not trigger failover | |
818853-3 | 3-Major | Duplicate MAC entries in FDB | |
818833-3 | 3-Major | TCP re-transmission during SYN Cookie activation results in high latency | |
818789-5 | 3-Major | Setting ssl profile to none in https monitor, not setting Ciphers to DEFAULT as in serverssl Profile | |
818097-4 | 3-Major | Plane CPU stats too high after primary blade failover in multi-blade chassis | |
816881-1 | 3-Major | Serverside conection may use wrong VLAN when virtual wire is configured | |
816205-3 | 3-Major | IPsec passthrough scenario may not forward ICMP unreachable messages from the server-side | |
815405-4 | 3-Major | GUI update of Child FastL4 profile overwrites CLI-only customized settings (options that are not available in GUI) | |
815089-3 | 3-Major | On a system with no VLANs, you can create virtual servers or SNATs that have identical address/port combinations | |
814761-2 | 3-Major | PostgreSQL monitor fails on second ping with count != 1 | |
813701-3 | 3-Major | Proxy ARP failure | |
812497-1 | 3-Major | VE rate limit should not count packet that does not have a matched vlan or matched MAC address | |
810821-1 | 3-Major | Management interface flaps after rebooting the device | |
810533-4 | 3-Major | SSL Handshakes may fail with valid SNI when SNI required is true but no Server Name is specified in the profile | |
810445-2 | 3-Major | PEM: ftp-data not classified or reported | |
809597-3 | 3-Major | Memory leak observed when running ICRD child | |
808017-2 | 3-Major | When using a variable as the only parameter to the iRule persist command, the iRule validation fails | |
807821-4 | 3-Major | ICMP echo requests occasionally go unanswered | |
805017-2 | 3-Major | DB monitor marks pool member down if no send/recv strings are configured | |
803629-2 | 3-Major | SQL monitor fails with 'Analyze Response failure' message even if recv string is correct | |
803233-3 | 3-Major | Pool may temporarily become empty and any virtual server that uses that pool may temporarily become unavailable | |
803109-2 | 3-Major | Source-port preserve-strict configured along with OneConnect may result in zombie forwarding flows | |
802245-1 | 3-Major | When HTTP/2 is negotiated, if the provided cipher suite list cannot be matched, then the last one will be selected. | |
801541-2 | 3-Major | tmm memory growth if high availability (HA) peer is unavailable | |
800101-1 | 3-Major | BIG-IP chassis system may send out duplicated UDP packets to the server side | |
796993-1 | 3-Major | Ephemeral FQDN pool members status changes are not logged in /var/log/ltm logs | |
795933-2 | 3-Major | A pool member's cur_sessions stat may incorrectly not decrease for certain configurations | |
795501-3 | 3-Major | Possible SSL crash during config sync | |
795285 | 3-Major | Key creation on non-existing NetHSM partition stays in create-fail loop for CloudHSM | |
794505-3 | 3-Major | OSPFv3 IPv4 address family route-map filtering does not work | |
794417-1 | 3-Major | Modifying enforce-tls-requirements to enabled on the HTTP/2 profile when renegotiation is enabled on the client-ssl profile should cause validation failure but does not | |
794385-2 | 3-Major | BGP sessions may be reset after CMP state change | |
793929-1 | 3-Major | In-TMM monitor agent might crash during TMM shutdown | |
793669-1 | 3-Major | FQDN ephemeral pool members on high availability (HA) pair does not get properly synced of the new session value | |
790845-2 | 3-Major | An In-TMM monitor may be incorrectly marked down when CMP-hash setting is not default | |
790205-3 | 3-Major | Adding a more-specific route to a child route domain that overrides the default route in the default route domain can cause TMM to core | |
788753-4 | 3-Major | GATEWAY_ICMP monitor marks node down with wrong error code | |
787973-3 | 3-Major | Potential memory leak when software crypto request is canceled. | |
787853-2 | 3-Major | BIG-IP responds incorrectly to ICMP echo requests when virtual server flaps. | |
786517-3 | 3-Major | Modifying a monitor Alias Address from the TMUI might cause failed config loads and send monitors to an incorrect address | |
785877-2 | 3-Major | VLAN groups do not bridge non-link-local multicast traffic. | |
785701-1 | 3-Major | Changes to a Web Acceleration profile are not instantly applied to virtual servers using the profile | |
785481-2 | 3-Major | A tm.rejectunmatched value of 'false' will prevent connection resets in cases where the connection limit has been reached | |
785361-1 | 3-Major | In L2wire mode packets from srcIP 0.0.0.0 will be silently dropped | |
784565-2 | 3-Major | VLAN groups are incompatible with fast-forwarded flows | |
783617-1 | 3-Major | Virtual Server resets connections when all pool members are marked disabled | |
783145-4 | 3-Major | Pool gets disabled when one of its pool member with monitor session is disabled | |
781753-3 | 3-Major | WebSocket traffic is transmitted with unknown opcodes | |
781041-1 | 3-Major | SIP monitor in non default route domain is not working. | |
779633-1 | 3-Major | BIG-IP system reuses serverside TIME_WAIT connections irrespective of TMMs used | |
779137-2 | 3-Major | Using a source address list for a virtual server does not preserve the destination address prefix | |
778517-1 | 3-Major | Large number of in-TMM monitors results in delayed processing | |
776229-2 | 3-Major | iRule 'pool' command no longer accepts pool members with ports that have a value of zero | |
773229-2 | 3-Major | Replacing a virtual server's FastL4 profile can cause traffic to fail in specific circumstances | |
767217-2 | 3-Major | Under certain conditions when deleting an iRule, an incorrect dependency error is seen | |
766601 | 3-Major | SSL statistics are updated even in forward proxy bypass | |
766593-1 | 3-Major | RESOLV::lookup with bytes array input does not work when length is exactly 4, 16, or 20 | |
766169-2 | 3-Major | Replacing all VALN interfaces resets VLAN MTU to a default value | |
764969-3 | 3-Major | ILX no longer supports symlinks in workspaces as of v14.1.0 | |
763093-3 | 3-Major | LRO packets are not taken into account for ifc_stats (VLAN stats) | |
762137-2 | 3-Major | Ping6 with correctly populated NDP entry fails | |
761389-1 | 3-Major | Disabled Virtual Server Dropping the Virtual Wire traffic | |
760406-3 | 3-Major | HA connection might stall on Active device when the SSL session cache becomes out-of-sync | |
760050-2 | 3-Major | cwnd warning message in log | |
759056-2 | 3-Major | stpd memory leak on secondary blades in a multi-blade system | |
758599-1 | 3-Major | IPv6 Management route is preferred over IPv6 tmm route | |
758596-2 | 3-Major | Unable to associate cipher group with long name profile | |
758437-6 | 3-Major | SYN w/ data disrupts stat collection in Fast L4 | |
758436-4 | 3-Major | Optimistic ACKs degrade Fast L4 statistics | |
758041-3 | 3-Major | Pool Members may not be updated accurately when multiple identical DB monitors configured | |
757505-3 | 3-Major | peer-cert-mode set to 'always' does not work when client-ssl is enabled with session-ticket | |
757446-2 | 3-Major | Invoking the HTTP::respond iRule command when the HTTP2 profile is present can cause stalled or malformed responses. | |
757431-1 | 3-Major | mcpd process killed after upgrade from 12.1.3★ | |
757029-2 | 3-Major | Ephemeral pool members may not be created after config load or reboot | |
756812-2 | 3-Major | Nitrox 3 instruction/request logger may fail due to SELinux permission error | |
756494-3 | 3-Major | For in-tmm monitoring: multiple instances of the same agent are running on the Standby device | |
756313-2 | 3-Major | SSL monitor continues to mark pool member down after restoring services | |
755791-2 | 3-Major | UDP monitor not behaving properly on different ICMP reject codes. | |
755631-1 | 3-Major | UDP / DNS monitor marking node down | |
754604-2 | 3-Major | iRule : [string first] returns incorrect results when string2 contains null | |
753805-3 | 3-Major | BIG-IP system failed to advertise virtual address even after the virtual address was in Available state. | |
753594-2 | 3-Major | In-TMM monitors may have duplicate instances or stop monitoring | |
753526-1 | 3-Major | IP::addr iRule command does not allow single digit mask | |
753159-1 | 3-Major | Pool IP ToS/QoS settings are not preserved on mirrored FastL4 connections | |
752766-1 | 3-Major | The BIG-IP system might fail to read SFPs after a reboot | |
752530-1 | 3-Major | TCP Analytics: Fast L4 TCP Analytics reports incorrect goodput. | |
752334-1 | 3-Major | Out-of-order packet arrival may cause incorrect Fast L4 goodput calculation | |
751036-1 | 3-Major | Virtual server status stays unavailable even after all the over-the-rate-limit connections are gone | |
750705-2 | 3-Major | LTM logs are filled with error messages while creating/deleting virtual wire configuration | |
750473-4 | 3-Major | VA status change while 'disabled' are not taken into account after being 'enabled' again | |
750204-3 | 3-Major | Add support for P-521 curve in the X.509 chain to SSL LTM | |
749519-1 | 3-Major | Error messages seen while running "run sys crypto nethsm-test" tool | |
748529-1 | 3-Major | BIG-IP Virtual Edition with cloudhsm integration needs to restart tmm after a fresh install | |
748052-1 | 3-Major | pkcs11 test utility is failing when running nethsm-test on BIG-IP systems configured for AWS CloudHSM | |
746922-6 | 3-Major | When there is more than one route domain in a parent-child relationship, outdated routing entry selected from the parent route domain may not be invalidated on routing table changes in child route domain. | |
745682-1 | 3-Major | Failed to parse X-Forwarded-For header in HTTP requests | |
745663-3 | 3-Major | During traffic forwarding, nexthop data may be missed at large packet split | |
745545-1 | 3-Major | CMP forwarded LRO host packets do not restore LRO flag | |
745291-2 | 3-Major | The BIG-IP HTTP2 filter makes inappropriate assumptions about requests and responses without content lengths | |
745285 | 3-Major | Virtual server configured with destination address list may not respond to ARP and ICMP echo | |
742838-1 | 3-Major | A draft policy of an existing published policy cannot be modified if it is in /Common and an used by a virtual server in a different partition | |
740977-1 | 3-Major | Tracert and traceroute from client does not display route path | |
738450-1 | 3-Major | Parsing pool members as variables with IP tuple syntax | |
726734-4 | 3-Major | DAGv2 port lookup stringent may fail | |
724824-3 | 3-Major | Ephemeral nodes on peer devices report as unknown and unchecked after full config sync | |
723306-1 | 3-Major | Error in creating internal virtual servers, when address 0.0.0.0 exists on different partition | |
723112-5 | 3-Major | LTM policies does not work if a condition has more than 127 matches | |
722707-2 | 3-Major | mysql monitor debug logs incorrectly report responses from 'DB' when packets dropped by firewall | |
720440-4 | 3-Major | Radius monitor marks pool members down after 6 seconds | |
719304-1 | 3-Major | Inconsistent node ICMP monitor operation for IPv6 nodes | |
718790-1 | 3-Major | Traffic does not forward to fallback host when all pool members are marked down | |
718288-2 | 3-Major | MCPD might crash on secondary blades when DNSSEC client-facing SOA zone serial not updated | |
714642-4 | 3-Major | Ephemeral pool-member state on the standby is down | |
714502-2 | 3-Major | bigd restarts after loading a UCS for the first time | |
714372-3 | 3-Major | Non-standard HTTP header Keep-Alive causes RST_STREAM in Safari | |
710930-3 | 3-Major | Enabling BigDB key bigd.tmm may cause SSL monitors to fail | |
709952-2 | 3-Major | Disallow DHCP relay traffic to traverse between route domains | |
709381-2 | 3-Major | iRules LX plugin imported from a system with a different version does not properly run, and the associated iRule times out. | |
700639-4 | 3-Major | The default value for the syncookie threshold is not set to the correct value | |
686059-4 | 3-Major | FDB entries for existing VLANs may be flushed when creating a new VLAN. | |
646440-1 | 3-Major | TMSH allows mirror for persistence even when no mirroring configuration exists | |
617929-2 | 3-Major | Support non-default route domains | |
608952-3 | 3-Major | MSSQL health monitors fail when SQL server requires TLSv1.1 or TLSv1.2 | |
512490-12 | 3-Major | Increased latency during connection setup when using FastL4 profile and connection mirroring. | |
505037-5 | 3-Major | K01993279 | Modifying a monitored pool with a gateway failsafe device can put secondary into restart loop |
898753-3 | 4-Minor | Multicast control-plane traffic requires handling with AFM policies | |
895141 | 4-Minor | HTTP::has_responded returns incorrect values when using HTTP/2 | |
880697-3 | 4-Minor | URI::query command returning fragment part, instead of query part | |
858309-1 | 4-Minor | Setting a self IP with an IPv6 Address with an embedded IPv4 address causes tmm to continually restart | |
844337-2 | 4-Minor | Tcl error log improvement for node command | |
839245-1 | 4-Minor | IPother profile with SNAT sets egress TTL to 255 | |
838405-1 | 4-Minor | Listener traffic-group may not be updated properly when spanning is in use. | |
838305-4 | 4-Minor | BIG-IP may create multiple connections for packets that should belong to a single flow. | |
834217-5 | 4-Minor | Some init-rwnd and client-mss combinations may result in sub-optimal advertised TCP window. | |
832233-3 | 4-Minor | The iRule regexp command issues an incorrect warning | |
822245-4 | 4-Minor | Large number of in-TMM monitors results in some monitors being marked down | |
822025-2 | 4-Minor | HTTP response not forwarded to client during an early response | |
818721-1 | 4-Minor | Virtual address can be deleted while it is in use by an address-list. | |
814037-4 | 4-Minor | No virtual server name in Hardware Syncookie activation logs. | |
808409-3 | 4-Minor | Unable to specify if giaddr will be modified in DHCP relay chain | |
804157-1 | 4-Minor | ICMP replies are forwarded with incorrect checksums causing them to be dropped | |
802721-2 | 4-Minor | Virtual Server iRule does not match an External Data Group key that's 128 characters long | |
801705-4 | 4-Minor | When inserting a cookie or a cookie attribute, BIG-IP does not add a leading space, required by RFC | |
787905-4 | 4-Minor | Improve initializing TCP analytics for FastL4 | |
783969 | 4-Minor | An invalid SSL close_notify might be sent in some cases. | |
783073 | 4-Minor | Cookie Persistence profile is not showing up in the GUI | |
781113-1 | 4-Minor | Support to enable/disable reusing serverside TIME_WAIT connections | |
774261-1 | 4-Minor | PVA client-side current connections stat does not decrease properly | |
774173-2 | 4-Minor | WebUI - Cipher Group preview causes high availability (HA) sync state to become Changes Pending | |
773253-3 | 4-Minor | The BIG-IP may send VLAN failsafe probes from a disabled blade | |
772297-2 | 4-Minor | LLDP-related option is reset to default for secondary blade's interface when the secondary blade is booted without a binary db or is a new blade | |
758704 | 4-Minor | Excessive 'GuestInfoAddNicEntry: NIC limit (16) reached' logging | |
742603-1 | 4-Minor | WebSocket Statistics are updated to differentiate between client and server sides | |
738045-5 | 4-Minor | HTTP filter complains about invalid action in the LTM log file. | |
738032-1 | 4-Minor | BIG-IP system reuses cached session-id after SSL properties of the monitor has been changed. | |
722534-1 | 4-Minor | load sys config merge not supported for iRulesLX | |
688397-1 | 4-Minor | Reset causes for HTTP/2 streams are not recorded | |
640374-1 | 4-Minor | DHCP statistics are incorrect | |
544958-1 | 4-Minor | Monitors packets are sent even when pool member is 'Forced Offline'. | |
898929-2 | 5-Cosmetic | Tmm might crash when ASM, AVR, and pool connection queuing are in use | |
873249-3 | 5-Cosmetic | Switching from fast_merge to slow_merge can result in incorrect tmm stats | |
666378-1 | 5-Cosmetic | A virtual server's connections per second (precision.last_value) is confusingly named. |
Performance Issues