999097-1 : SSL::profile may select profile with outdated configuration

Links to More Info: BT999097

Component: Local Traffic Manager

Symptoms:
Under some circumstances, an iRule-selected SSL profile may a send previously configured certificate to the peer.

Conditions:
iRule command SSL::profile is used to select a profile that is not attached to the virtual server, and changes have been made in the profile's cert-key-chain field.

Impact:
The TLS client may receive an outdated certificate that does not match with the current configuration, potentially leading to handshake failures.

Workaround:
Avoid making changes to a profile that is actively being used by the iRule command.

Fix:
The system now makes sure that SSL profiles are properly reloaded after changes are made.

Fixed Versions:
14.1.4.5, 16.1.2.1

998221-1 : Accessing pool members from configuration utility is slow with large config

Links to More Info: BT998221

Component: TMOS

Symptoms:
Accessing the pool members page from the BIG-IP Configuration Utility/GUI is slow compared with accessing Pool members from TMSH/CLI.

Conditions:
-- Accessing pool member information through the BIG-IP configuration utility.
-- Thousands of pools and pool members in the configuration.

Impact:
In the GUI, it takes approximately 20-30 seconds, whereas the CLI returns results in less than 1 second,

Managing pool members from configuration utility is very slow causing performance impact.

Workaround:
None

Fix:
Optimized the GUI query used for retrieving pool members data.

Fixed Versions:
14.1.4.3, 15.1.4, 16.0.1.2, 16.1.2

997313-2 : Unable to create APM policies in a sync-only folder★

Links to More Info: BT997313

Component: TMOS

Symptoms:
Unable to configure an APM policy in a sync-only folder, or the configuration fails to load after an upgrade, with an error message similar to:

-- err mcpd[mcpd_pid]: 01070734:3: Configuration error: Invalid Devicegroup Reference. The customization_group (/Common/sync-only/example_apm_customization) requires customization_source (/Common/standard) to be syncd to the same devices

Conditions:
-- Multiple BIG-IP devices configured in a sync-only device group, but different/non-overlapping failover device groups
-- APM policy being created in a folder or partition associated with sync-only device group.

Impact:
-- Unable to create the access policy.
-- The configuration fails to load and the device remains inoperative.

Workaround:
You can use either of the following strategies to prevent the issue:

--Do not create APM policies in a sync-only folder.

--Disable MCPD device-group reference validation for the sync-only folder, e.g.:
    tmsh modify sys folder /Common/sync-only no-ref-check true
    tmsh save sys config

Fixed Versions:
15.1.4.1, 16.1.2

996381-1 : ASM attack signature may not match as expected

Component: Application Security Manager

Symptoms:
When processing traffic with ASM, attack signature 200000128 may not match as expected.

Conditions:
- Attack signature 200000128 enabled.

Impact:
Processed traffic may not match all expected attack signatures

Workaround:
N/A

Fix:
Attack signature 200000128 now matches as expected.

Fixed Versions:
13.1.4.1, 14.1.4.4, 15.1.4, 16.0.1.2, 16.1.1

996113-2 : SIP messages with unbalanced escaped quotes in headers are dropped

Links to More Info: BT996113

Component: Service Provider

Symptoms:
Dropped SIP messages.

Conditions:
-- MRF SIP virtual server
-- SIP Header Field has an escaped quote

Impact:
Certain SIP messages are not being passed via MRF.

Workaround:
None

Fixed Versions:
14.1.4.4, 15.1.4, 16.1.1

996001-5 : AVR Inspection Dashboard 'Last Month' does not show all data points

Links to More Info: BT996001

Component: TMOS

Symptoms:
A daily-based report (report with resolution of one day in each data-point) can be provided to only request with up-to 30 days. A request with 31 days shows only 2 entries.

Conditions:
This occurs when generating a 'Last Month' report for a month that contains 31 days of data.

Impact:
AVR Inspection Dashboard displays less data than expected: 2 points instead of 31 points.

Workaround:
None

Fix:
Viewing a 'Last Month' graph now reports ~30 days worth of data, rather than a variable amount of data based on actual calendar periods.

Fixed Versions:
14.1.4.5, 16.1.2.1

995405-1 : After upgrade, the copied SSL vhf/vht profile prevents traffic from passing★

Links to More Info: BT995405

Component: Local Traffic Manager

Symptoms:
After an RPM upgrade, SSL Orchestrator traffic does not pass

Conditions:
Upgrading SSL Orchestrator via RPM

Impact:
Traffic will not pass.

Workaround:
Bigstart restart tmm

Fix:
Fixed an issue that was preventing from passing after an RPM upgrade.

Fixed Versions:
16.1.1

994305-3 : The version of open-vm-tools included with BIG-IP Virtual Edition is 10.1.5

Links to More Info: BT994305

Component: TMOS

Symptoms:
Features supported in newer versions of open-vm-tools are not available.

Conditions:
This issue may be seen when running in VMware environments.

Impact:
Features that require a later version of open-vm-tools are not available.

Workaround:
None.

Fix:
The version of open-vm-tools has been updated to 11.1.5.

Fixed Versions:
16.1.2.1

993913-4 : TMM SIGSEGV core in Message Routing Framework

Links to More Info: BT993913

Component: Service Provider

Symptoms:
TMM crashes on SIGSEGV.

Conditions:
This can occur while passing traffic through the message routing framework.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

Fixed Versions:
14.1.4.4, 15.1.4, 16.1.1

993613-7 : Device fails to request full sync

Links to More Info: BT993613

Component: Application Security Manager

Symptoms:
Devices remain out of sync and ASM REST/GUI becomes unresponsive. asm_config_server may create many unique PIDs

Conditions:
-- A manual sync device group is configured and ASM sync is enabled.
-- Sync pushes are typically performed in one direction, and then a sync attempt is made in the opposite direction.

Impact:
-- The device that is meant to receive the config sync never requests or receives it.
-- The devices become unsynchronized which may cause unexpected traffic enforcement or dropped traffic.
-- ASM GUI becomes unresponsive.
-- Large number of asm_config_server processes increases host memory usage

Workaround:
Halting asm_config_server on the stuck device restores the working state and request a new sync.

Fixed Versions:
14.1.4.5, 16.1.2.1

993489-1 : GTM daemon leaks memory when reading GTM link objects

Links to More Info: BT993489

Component: Global Traffic Manager (DNS)

Symptoms:
The gtmd process memory consumption is higher than expected.

Conditions:
DNS is provisioned and a provisioned GTM link object has been loaded.

Impact:
Increased memory usage of the GTM daemon. This may impact other capabilities, such as starting sync operations.

Workaround:
None

Fixed Versions:
14.1.4.4, 15.1.4, 16.0.1.2, 16.1.1

993457-1 : TMM core with ACCESS::policy evaluate iRule

Links to More Info: BT993457

Component: Access Policy Manager

Symptoms:
TMM segfaults in packtag_literal_pointer_release() during TCLRULE_CLIENT_CLOSED event attempting a session release.

Conditions:
-- The ACCESS::policy evaluate is still in progress when TCLRULE_CLIENT_CLOSED event is triggered.
-- While the TCLRULE_CLIENT_CLOSED is in process, the ACCESS::policy evaluation completes.

Impact:
This triggers a race condition and causes the tmm crash. Traffic disrupted while tmm restarts.

Workaround:
None

Fix:
TMM no longer crashes and generates a core file during the ACCESS::policy evaluate iRule under these conditions.

Fixed Versions:
14.1.4.5, 15.1.4.1, 16.1.2

992213-3 : Protocol Any displayed as HOPTOPT in AFM policy view

Links to More Info: BT992213

Component: Advanced Firewall Manager

Symptoms:
The 'any' option for the AFM policy rule protocol is displayed incorrectly in the GUI.

Conditions:
-- Create a rule and set protocol as 'any'.
-- Navigate to active rules.

Impact:
GUI shows an incorrect value.

Workaround:
None

Fix:
GUI Shows correct value for rule protocol option.

Fixed Versions:
14.1.4.2, 15.1.4, 16.1.1

991421-2 : TMM may crash while processing TLS traffic

Component: Local Traffic Manager

Symptoms:
Under certain conditions, TMM may crash while processing TLS traffic

Conditions:
- Forward proxy configured
- Forward proxy passthrough
- TLS1.3 traffic

Impact:
Traffic disrupted while TMM restarts.

Workaround:
N/A

Fix:
TMM now processes TLS traffic as expected.

Fixed Versions:
15.1.4.1, 16.1.2

989701-8 : CVE-2020-25212 Kernel: A flaw was found in the NFSv4 implementation where when mounting a remote attacker controlled server it could return specially crafted response

Component: TMOS

Symptoms:
A flaw was found in the NFSv4 implementation where when mounting a remote attacker controlled server it could return specially crafted response allow for local memory corruption and possibly privilege escalation.

Conditions:
Mounting an unauthenticated server can cause this flaw

Impact:
Can cause local memory corruption and possibly privilege escalation.

Workaround:
While there is no known mitigation to this flaw, configuring authentication and only mounting authenticated NFSv4 servers will significantly reduce the risk of this flaw being successfully exploited.

Fix:
Kernel patched to resolve CVE-2020-25212

Fixed Versions:
14.1.4.5, 15.1.4.1, 16.1.2

988549-10 : CVE-2020-29573: glibc vulnerability

Links to More Info: K27238230, BT988549

986937-3 : Cannot create child policy when the signature staging setting is not equal in template and parent policy

Links to More Info: BT986937

Component: Application Security Manager

Symptoms:
When trying to create a child policy, you get an error:

FAILURE: "Could not update the Policy policy1. Inherited values may not be changed."

Conditions:
-- Parent policy created with signature staging disabled.
-- Creating a new child policy with that policy as a parent.

Impact:
You are unable to create the child policy and the system presents an error.

Workaround:
Create the policy without assigning it to the parent, and then assign it to the parent policy on the Inheritance Settings page.

Fix:
The error no longer occurs on child policy creation.

Fixed Versions:
15.1.4, 16.0.1.2, 16.1.1

985953-6 : GRE Transparent Ethernet Bridging inner MAC overwrite

Links to More Info: BT985953

Component: TMOS

Symptoms:
Traffic not being collected by virtual server and therefore not being forwarded to the nodes.

Conditions:
Encapsulated dest-mac is not equal to the Generic Routing Encapsulation (GRE) tunnel mac-address.

Impact:
Virtual server is not collecting decapsulated packets from the GRE Transparent Bridge tunnel unless the dest-mac of the encapsulated packet is the same as the mac-address of the GRE tunnel.

Workaround:
None

Fix:
Added a new DB key 'iptunnel.mac_overwrite'. This DB key defaults to 'disable'.

Set the DB key to 'enable' to cause the BIG-IP system to overwrite the destination MAC of the encapsulated traffic:

tmsh modify sys db iptunnel.mac_overwrite value enable
tmsh save sys config

This allows virtual servers on the BIG-IP system to process traffic.

Behavior Change:
Added a new DB key 'iptunnel.mac_overwrite'. This DB key defaults to 'disable'.

To cause the BIG-IP system to overwrite the destination MAC of the encapsulated traffic, set the DB key to 'enable' and save the config:

tmsh modify sys db iptunnel.mac_overwrite value enable
tmsh save sys config

This allows virtual servers on the BIG-IP system to process traffic.

Fixed Versions:
14.1.4.5, 15.1.4.1, 16.1.2

984593-1 : BD crash

Links to More Info: BT984593

Component: Application Security Manager

Symptoms:
BD crashes.

Conditions:
The conditions under which this occurs are unknown.

Impact:
Traffic disrupted while bd restarts.

Workaround:
None.

Fixed Versions:
14.1.4.5, 16.1.2.1

981069-3 : Reset cause: "Internal error ( requested abort (payload release error))"

Links to More Info: BT981069

Component: Application Security Manager

Symptoms:
An unexpected RST occurs on inbound traffic. The RST cause shows "Internal error ( requested abort (payload release error))"

Conditions:
When all the following conditions are met:
- The system was upgraded to a version where ID910253 is fixed
- TS cookie coming from a previous version
- data guard in non blocking (masking)
- response that is not zipped and has a textual content type

Impact:
Traffic is affected.

Workaround:
Any of the following actions can resolve the issue:

1. Turn off data guard or change it to blocking.
2. Make the server reply with zipped responses (perhaps by adding the accept-encoding: gzip using an iRule).
3. Add an additional response related feature.
4. Use the following iRule in case there aren't cookie related enforcement:
when HTTP_REQUEST {
  set cookies [HTTP::cookie names]
  foreach aCookie $cookies {
    if {$aCookie matches_regex {^TS(?:[0-9a-fA-F]{6,8})(?:$|_[0-9]+$)}} {
      HTTP::cookie remove $aCookie
    }
  }
}

Fix:
Fixed an issue that was triggering resets on traffic.

Fixed Versions:
15.1.4, 16.1.1

980617-1 : SNAT iRule is not working with HTTP/2 and HTTP Router profiles

Links to More Info: BT980617

Component: Local Traffic Manager

Symptoms:
On HTTP/2 full-proxy virtual servers, the snatpool command in an iRule is accepted but the source address server-side is not changed.

Conditions:
1.) Basic HTTP profile and HTTP/2 profile is configured on BIG-IP systems
2.) iRule with snatpool <pool_name>, snat <IP> is configured

Impact:
Unable to use snatpool (and possibly snat) in iRule to control the server-side source address.

Workaround:
Configure SNAT under the virtual server configuration, rather than in an iRule.

Fixed Versions:
16.1.1

974341-6 : REST API: File upload

Component: Application Security Manager

Symptoms:
Under certain conditions, the REST API does not process file uploads as expected

Conditions:
- REST API access
- File uploaded

Impact:
File uploads are not processed as expected.

Workaround:
N/A

Fix:
The REST API now handles file uploads as expected

Fixed Versions:
14.1.4.5, 15.1.4.1, 16.1.2

974241-3 : Creation of access policy with modern customization may lead to failover in a VIPRION or vCMP guest with multiple blades

Links to More Info: BT974241

Component: TMOS

Symptoms:
Mcpd exists with error similar to:

01070734:3: Configuration error: Configuration from primary failed validation: 010713cf:3: Configuration group '/Common/test1_end_deny_ag' has invalid source '/Common/standard'

Conditions:
1. VIPRION or vCMP guest with multiple blades in a cluster
2. Create a access policy with modern customization enabled

Impact:
Mcpd restarts leading to failover.

Workaround:
Use standard customization and not modern customization.

Fixed Versions:
15.1.4, 16.1.1

973409-6 : CVE-2020-1971 - openssl: EDIPARTYNAME NULL pointer de-reference

Links to More Info: K42910051, BT973409

970329-1 : ASM hardening

Component: Application Security Manager

Symptoms:
Under certain conditions, ASM does not follow current best practices.

Conditions:
- ASM provisioned

Impact:
Attack detection is not triggered as expected

Workaround:
N/A

Fix:
Attack detection is now triggered as expected

Fixed Versions:
14.1.4.4, 15.1.4, 16.1.1

969317-4 : "Restrict to Single Client IP" option is ignored for vmware VDI

Links to More Info: BT969317

Component: Access Policy Manager

Symptoms:
The Restrict to Single Client IP option in the Access Policy is not being honored for VMware VDI.

Conditions:
- Configure APM Webtop with vmware VDI.
- Set "Restrict to Single Client IP" option in Access Profile.
- Try to launch vmware desktop on one client. Copy the launch URI
- Try to launch vmware desktop from other client using the copied URI.

Impact:
A connection from the second client is allowed, but it should not be allowed.

Fix:
Restrict to Single Client IP is honored for VMware VDI for both PCOIP and Blast protocols.

Fixed Versions:
14.1.4.5, 15.1.4.1, 16.1.2.1

968929-2 : TMM may crash when resetting a connection on an APM virtual server

Links to More Info: BT968929

Component: Local Traffic Manager

Symptoms:
TMM crashes.

Conditions:
- HTTP profile without fallback host.
- iRules.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
Configure fallback host to an HTTP profile that redirects the request to a specified location.

Fixed Versions:
16.1.2.1

968893-3 : TMM crash when processing APM traffic

Component: Access Policy Manager

Symptoms:
Under certain conditions, TMM may crash while processing APM traffic that generates DNS lookups

Conditions:
- APM provisioned
- Undisclosed conditions

Impact:
TMM crash leading to traffic interruption and a failover event

Workaround:
N/A

Fix:
TMM now processes APM traffic as expected

Fixed Versions:
15.1.4.1, 16.1.2

968657-1 : Added support for IMDSv2 on AWS

Links to More Info: BT968657

Component: TMOS

Symptoms:
AWS added a token-based Instance MetaData Service API (IMDSv2). Prior versions of BIG-IP Virtual Edition supported only a request/response method (IMDSv1). This latest version of BIG-IP Virtual Edition now supports instances started with IMDSv2.

Conditions:
AWS instances started with IMDSv2.

Impact:
BIG-IP Virtual Edition cannot license or re-license AWS instances started with IMDSv2 and other metadata-based functionality will not function.

Fix:
With the latest version of BIG-IP VE, you can now initialize "IMDSv2 only" instances in AWS and migrate your existing instances to "IMDSv2 only" using aws-cli commands. For details, consult documentation: https://clouddocs.f5.com/cloud/public/v1/shared/aws-ha-IAM.html#check-the-metadata-service-for-iam-role
 
IMDSv2 documentation from AWS: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html

Fixed Versions:
16.1.2.1

965229-5 : ASM Load hangs after upgrade★

Links to More Info: BT965229

Component: Application Security Manager

Symptoms:
ASM upgrade hangs, and you see the following in
var/log/ts/asm_start.log:
-------------------------
asm_start|DEBUG|Nov 15 07:04:41.751|25365|F5::ConfigSync::restore_active_policies,,Restoring active policy - policy /Common/my_portal (id = 603)
... END OF FILE ...
-------------------------

In /var/log/asm:
-----------------------------
2020-11-15T06:01:23+00:00 localhost notice boot_marker : ---===[ HD1.cm6250 - BIG-IP 13.1.3.4 Build 0.255.5 <HD1.cm6250> ]===---
 info set_ibdata1_size.pl[20499]: Setting ibdata1 size finished successfully, a new size is: 9216M
 info tsconfig.pl[24675]: ASM initial configration script launched
 info tsconfig.pl[24675]: ASM initial configration script finished
 info asm_start[25365]: ASM config loaded
 err asm_tables_dump.pl[31430]: gave up waiting for ASM to start, please try again later
-----------------------------

Conditions:
-- ASM provisioned
-- 600 or more security policies
-- Performing an upgrade

Impact:
ASM post upgrade config load hangs and there are no logs or errors

Workaround:
None

Fixed Versions:
14.1.4.4, 15.1.4, 16.1.1

962589-4 : Full Sync Requests Caused By Failed Relayed Call to delete_suggestion

Links to More Info: BT962589

Component: Application Security Manager

Symptoms:
When using parent policies with learning enabled in an auto-sync device group, in some use cases deleting an ignored suggestion on a parent policy will cause a full sync to occur.
This can cause unexpected delays in configuration being synchronized between peers, and in the event of repeated instances in quick succession could fill the /var partition

Conditions:
1) Device Group with ASM and auto-sync enabled
2) Parent Policies with learning are in use.
3) Ignored Suggestions are deleted on the parent policy after they have 0 suggesting children left.

Impact:
ASM configuration requests a full sync which can cause unexpected slowness in config synchronization and may fill the /var partition if done multiple times in quick succession.
A full /var partition can lead to bd cores.

Fixed Versions:
14.1.4.4, 15.1.4, 16.1.1

956013-4 : System reports{{validation_errors}}

Links to More Info: BT956013

Component: Policy Enforcement Manager

Symptoms:
A {{validation_errors}} at Subscriber Management :: Control Plane Listeners and Data Plane Listeners with ipv6 addresses

Conditions:
Specifying an IPv6 address in the expression in Subscriber Management :: Control Plane Listeners and Policy Enforcement :: Data Plane Listeners.

Impact:
Cannot access the BIG-IP GUI through IPv6 address from any web browser. Admin/User cannot enter input through GUI.

Workaround:
None.

Fixed Versions:
14.1.4.5, 16.1.2.1

954425-4 : Hardening of Live-Update

Component: Application Security Manager

Symptoms:
Under certain conditions, the Live-Update process does not follow current best practices.

Conditions:
- Live-Update in use
- Specially-crafted update files

Impact:
The Live-Update process does not follow current best practices.

Workaround:
N/A

Fix:
The Live-Update process now follows current best practices.

Fixed Versions:
14.1.4.4, 15.1.4, 16.1.1

951133-4 : Live Update does not work properly after upgrade★

Links to More Info: BT951133

Component: Application Security Manager

Symptoms:
After upgrading BIG-IP version the Live Update "Check for Update" button does not respond.

Conditions:
Upgrading from a version that did not have Live Update to a new version which includes Live Update

Impact:
Live Update can't query for new updates.

Workaround:
Restart tomcat process:
> bigstart restart tomcat

Fixed Versions:
14.1.4.4, 15.1.4, 16.0.1.2, 16.1.1

948113-1 : User-defined report scheduling fails

Links to More Info: BT948113

Component: Application Visibility and Reporting

Symptoms:
A scheduled report fails to be sent.

An error message with the following format may appear on /var/log/avr/monpd.log file (some parts of the error message were replaced with '.....' in here to leave only the common parts):
     DB|ERROR|....... Error (err-code 1054) executing SQL string :
.....
.....
.....
 Because : Unknown column ....... in 'order clause'

Conditions:
1. Using predefined-report in scheduled-report.
2. Predefined-report has more than one measure.
3. Sort-by value is different from the first measure on predefined-report

Impact:
Internal error for AVR report for ASM pre-defined.

Workaround:
First, remount /usr to read-write:
mount -o remount,rw /usr

Next, open file /usr/share/perl5/vendor_perl/F5/AVReporter/Client.pm and change the following line:
push(@measures,@{$base_request->{measures}}[0]);
to this:
push(@measures,@{$base_request->{sort_by}}[0]->{measure});

The above can be achieved with the following script-line (please first backup the Client.pm file and then verify it changed it correctly):
sed -i 's/push(@measures,@{\$base_request->{measures}}\[0\])/push(@measures,@{$base_request->{sort_by}}[0]->{measure})/' /usr/share/perl5/vendor_perl/F5/AVReporter/Client.pm

Lastly, remount /usr back to read-only:
mount -o remount,ro /usr

Fix:
Using 'sort-by' measure when building PDF (instead of the first value on measure-list)

Fixed Versions:
14.1.4.5, 15.1.4.1, 16.1.2

947341-4 : MySQL generates multiple error 24 (too many files open) for PRX.REQUEST_LOG DB tables files.

Links to More Info: BT947341

Component: Application Security Manager

Symptoms:
1) var/lib/mysql/mysqld.err is filled with log entries that contain:
------------
  200824 11:04:43 [ERROR] mysqld: Can't open file: './PRX/REQUEST_LOG.frm' (errno: 24)
  200824 11:18:46 [ERROR] mysqld: Can't open file: './PRX/REQUEST_LOG.frm' (errno: 24)
  200824 11:35:58 [ERROR] mysqld: Can't open file: './PRX/REQUEST_LOG.frm' (errno: 24)
------------

2) There are a lot of PRX.REQUEST_LOG partitions, in some cases up to 1024, many of which are empty.

Conditions:
ASM/AVR provisioned

Impact:
MySQL runs out of resources when opening the file
PRX.REQUEST_LOG and an error message states the file is corrupt.

Workaround:
1. If the /appdata partition is filled to 100% and MySQL restarts continuously, refer to the following Knowledge Articles:
   https://support.f5.com/csp/article/K14956
   https://support.f5.com/csp/article/K42497314

2. To identify the empty partitions, look into:
   mysql -su root -p$(perl -MPassCrypt -nle 'print PassCrypt::decrypt_password($_)' /var/db/mysqlpw) -e "SELECT * FROM INFORMATION_SCHEMA.PARTITIONS WHERE table_name = 'REQUEST_LOG' AND table_schema = 'PRX'\G"

3. For every partition that is empty, manually (or via shell script) execute this sql:
   mysql -su root -p$(perl -MPassCrypt -nle 'print PassCrypt::decrypt_password($_)' /var/db/mysqlpw) -e "ALTER TABLE PRX.REQUEST_LOG DROP PARTITION <empty_partition_name>;"

   Note: <empty_partition_name> must be substituted with the partition name, for example p100001.


4. Increase 'open_files_limit' to '10000'.
--------------------------------

   In the /etc/my.cnf file:
   1. Change the value of the 'open_files_limit' parameter to 10000.
   2. Restart MySQL:
   bigstart restart mysql
--------------------------------

5. pkill asmlogd

Note: This workaround does not survive upgrade. It must be reapplied after every upgrade until the upgraded version contains a fix.

Fix:
This release increases the default 'open_files_limit' to '10000'.

Fixed Versions:
14.1.4.1, 15.1.3, 16.0.1.2, 16.1.2

946185-3 : Unable to view iApp component due to error 'An error has occurred while trying to process your request.'★

Links to More Info: BT946185

Component: TMOS

Symptoms:
When accessing the iApp Components tab, the system presents an error similar to the following:

An error has occurred while trying to process your request.

Conditions:
-- With or without Partitions configured.
-- Navigate to GUI iApps :: Application Services : Applications, to view a custom iApp.
-- More likely to occur after upgrade.

Impact:
Unable to view/modify iApps via GUI iApps :: Application Services : Applications screen.

Workaround:
To reconfigure the iApp, do the following:

1. Navigate to the following location in the GUI:
Local Traffic :: Virtual Server List

2. Click the Application Link :: Reconfigure.

Note: Although this allows you to reconfigure an iApp, it does not provide access to the iApp application details Components page.

Fix:
Viewing Application Service components now reports no errors in the GUI under these conditions.

Fixed Versions:
14.1.4.4, 15.1.4.1, 16.1.2

941649-8 : Local File Inclusion Vulnerability

Links to More Info: K63163637, BT941649

941625-3 : BD sometimes encounters errors related to TS cookie building

Links to More Info: BT941625

Component: Application Security Manager

Symptoms:
BD sometimes print errors related to TS cookie building when receiving ASM cookies with account_id:

-- BEM|ERR |May 19 17:49:55.800|0983|response_header_accumulator.c:0200|Error: CookieMgrBuildCookie failed. ans 1 job 2957561040.

-- IO_PLUGIN|ERR |May 19 17:49:55.800|0983|io_plugin.c:3320|TMEVT_RESPONSE: Cannot build a ts cookie.

Conditions:
-- Cookie protection is enabled.
-- The BIG-IP software is upgraded from a version that was earlier than 15.1.x.

Impact:
The cookie is not built and an error is logged.

Workaround:
None.

Fixed Versions:
15.1.4, 16.1.1

940317-9 : CVE-2020-13692: PostgreSQL JDBC Driver vulnerability

Links to More Info: K23157312, BT940317

940185-7 : icrd_child may consume excessive resources while processing REST requests

Component: TMOS

Symptoms:
Under certain conditions, icrd_child may consume excessive resources while processing REST requests

Conditions:
- Specially-crafted REST requests

Impact:
Increase in ICRD resource usage over time. Eventually host memory will be exhausted potentially leading to a failover event.

Workaround:
N/A

Fix:
icrd_child now processes REST requests as expected.

Fixed Versions:
14.1.4.5, 16.1.2.1

939877-3 : OAuth refresh token not found

Links to More Info: BT939877

Component: Access Policy Manager

Symptoms:
When an OAuth client sends a refresh token to renew the access token, BIG-IP reports an error:

err tmm[13354]: 01990004:3: /Common/my_OAuth_v1:Common: Request Refresh Token from Source ID ... failed. Error Code (id_not_found) Error Description (The refresh token is not found)

Conditions:
-- The refresh token expiration interval is longer than authcode and accesstoken.
-- The Authorization code table entry does not exist because of an internal clearing/purging operation.
-- tmm restarts or failover to standby thus losing refresh-token value from primarydb

Impact:
OAuth APM client end user fails to renew the access token even with a valid refresh token.

Workaround:
Clear/reset the Authorization code column value manually:

As a root user run below BIG-IP shell
(tmos)# list apm oauth db-instance
apm oauth db-instance oauthdb { db-name <db_name> description "Default OAuth DB." }

Copy the value corresponding to <db_name>.

Log into mysql from the bash prompt:
# mysql -u root -p$(perl -MPassCrypt -nle 'print PassCrypt::decrypt_password($_)' /var/db/mysqlpw)

mysql> use <db_name>;

mysql> update master set auth_code = NULL where refresh_token='affected_refresh_token_id';

(Substitute the affected refresh token ID with affected_refresh_token_id in the previous command.)

Fix:
Do not report error if the Authorization code does not exist when a valid refresh-token/access-token exists.

Fixed Versions:
14.1.4.4, 15.1.4, 16.1.2

935249-3 : GTM virtual servers have the wrong status

Links to More Info: BT935249

Component: Global Traffic Manager (DNS)

Symptoms:
GTM virtual servers have the wrong status (up when they should be down, or down when they should be up).

Conditions:
-- The GTM virtual servers are monitored with an HTTP or HTTPS monitor that performs HTTP status matching.

-- The status code (for example, 200) being searched for in the response appears elsewhere than in the first line (for example, in a following header).

Impact:
The system incorrectly matches the status code in a response line which is not the Status-Line. As a result, the availability status reported for a virtual server may be incorrect. This may cause the GTM system to send traffic to unsuitable resources causing application disruptions.

Workaround:
You can work around this issue by not performing HTTP status matching in your HTTP/HTTPS GTM monitors.

Fix:
The HTTP status code is now correctly searched only in the first line of the response.

Fixed Versions:
16.1.2.1

932137-7 : AVR data might be restored from non-relevant files in /shared/avr_afm partition during upgrade

Links to More Info: BT932137

Component: Application Visibility and Reporting

Symptoms:
After upgrade, AFM statistics show non-relevant data.

Conditions:
BIG-IP system upgrade
-- Leftovers files remain in /shared/avr_afm partition from other versions.

Impact:
Non-relevant data are shown in AFM statistics.

Workaround:
Delete the non-relevant data manually from MariaDB/MySQL.

Fixed Versions:
14.1.4.4, 15.1.4.1, 16.1.2

932133-1 : Payloads with large number of elements in XML take a lot of time to process

Links to More Info: BT932133

Component: Application Security Manager

Symptoms:
ASM experiences high CPU and latency usage while processing a large XML request.

Conditions:
-- ASM provisioned
-- HTTP request with a large XML payload (several MB) is sent to the backend server which triggers the XML parser.

Impact:
High CPU and latency occurs while bd processes the payload. This may cause a bottleneck for different requests that arrive concurrently with the large XML payload request.

Workaround:
None

Fix:
This fix includes performance improvements for large XML payloads.

Fixed Versions:
14.1.4.4, 15.1.4.1, 16.1.2

929213-2 : iAppLX packages not rolled forward after BIG-IP upgrade★

Links to More Info: BT929213

Component: Device Management

Symptoms:
Certain iAppLX packages are not rolled forward after a BIG-IP upgrade or restoring a UCS file generated from an affected system, and will be unavailable for use.

1. f5-cloud-failover-1.4.0-0.noarch.rpm
2. f5-service-discovery-1.2.9-2.noarch.rpm
3. f5-telemetry-1.12.0-3.noarch.rpm

Conditions:
-> Installing any of the below iAppLX packages
1. f5-cloud-failover-1.4.0-0.noarch.rpm
2. f5-service-discovery-1.2.9-2.noarch.rpm
3. f5-telemetry-1.12.0-3.noarch.rpm

-> Performing an upgrade

-> Trying to access the LX packages from GUI by navigating to iApps -> Package Management LX

Impact:
After upgrading or restoring a UCS file generated from an affected system, the cloud-failover, service discovery, and telemetry iAppLX apps are not available for use, and will result in 404 error, while accessing them from GUI

Workaround:
The package needs to be uninstalled and installed again for use.

Steps:
-> From GUI, Navigate to iApps -> Package Management LX
-> select the package to uninstall and click on Uninstall
-> click on Import and provide the path of package to install again

Fix:
All installed package management LX such as AS3, DO, telemetry, failover extension, service discovery are available after upgrade

Fixed Versions:
14.1.4.4, 15.1.4.1, 16.1.2

924945-5 : Fail to detach HTTP profile from virtual server

Links to More Info: BT924945

Component: Application Visibility and Reporting

Symptoms:
The virtual server might stay attached to the initial HTTP profile.

Conditions:
Attaching new HTTP profiles or just detaching an existing one.

Impact:
The virtual server stays attached to the former HTTP profile, meaning that the virtual server might be attached to a different HTTP profile than what the GUI displays. Configuration changes to the HTTP profile the GUI shows as attached are not reflected in the virtual server. For example, the new HTTP profile might enable XFF, but if the former attached profile does not enable it, the virtual server does not accept XFF.

Workaround:
Create new similar virtual server and attach it to the correct HTTP profile.

Fixed Versions:
15.1.3, 16.0.1.2, 16.1.1

922185-3 : LDAP referrals not supported for 'cert-ldap system-auth'★

Links to More Info: BT922185

Component: TMOS

Symptoms:
Admin users are unable to log in.

Conditions:
-- Remote LDAP auth enabled.
-- Administrative users are authenticated with the 'cert-ldap' source.
-- The admin user tries to log in.

Impact:
The cert-ldap authentication does not work, so login fails.

Workaround:
Manually edit the /etc/nslcd.conf and set the referrals to no.

Fixed Versions:
14.1.4.5, 15.1.4.1, 16.1.2

922105-1 : Avrd core when connection to BIG-IQ data collection device is not available

Links to More Info: BT922105

Component: Application Visibility and Reporting

Symptoms:
When a BIG-IP system is configured to work with BIG-IQ but cannot connect due to network problems, avrd restarts itself every 10 minutes. During such restarts, a core is sometimes generated.

Conditions:
BIG-IP system is registered on BIG-IQ, but there is no network connectivity for any number of reasons.

Impact:
No impact since there is no network connectivity with BIG-IQ, and the data from the BIG-IP system cannot be sent anywhere.

Workaround:
Attempts to connect to BIG-IQ can be disabled manually by the following command:

tmsh modify analytics global-settings use-offbox disabled

Fix:
Avrd no longer cores when the connection to the BIG-IQ data collection device is not available.

Fixed Versions:
14.1.4.4, 15.1.4.1, 16.1.2

921697-1 : Attack signature updates fail to install with Installation Error.★

Links to More Info: BT921697

Component: Application Security Manager

Symptoms:
Installing a new Attack Signature Update (ASU) file on ASM/AWAF device that has large number of active policies can result in a failure due to memory exceptions. The following errors can be observed:

/var/log/ts/asm_config_server.log:
F5::ASMConfig::Handler::handle_error,,Code: 406 , Error message = Process size (232341504) has exceeded max size (200000000)

/var/log/asm
crit perl[19751]: 01310027:2: ASM subsystem error (apply_asm_attack_signatures ,F5::LiveUpdate::PayloadHandler::clean_fail): Fail load update files: TSocket: timed out reading 1024 bytes from n.n.n.n:9781

Conditions:
1. Adding and activating a large number of policies on a BIG-IP system configured with ASM/AWAF. It is not known exactly how many policies are required to encounter this, but it appears to be between 50 and 90 where this becomes a risk.

2. Installing a new ASU file

Impact:
The attack signature update fails.

Workaround:
Impact of workaround:
Performing this workaround requires restarting ASM, so it affects traffic processing briefly; therefore, it is recommended that you perform this during a maintenance window.

Increase 'max memory size' from the default ~200 MB (200000000) to 300 MB:

1. Take a backup of the original file.
# cp /etc/ts/tools/asm_config_server.cfg /var/tmp/asm_config_server.original.cfg

2. Add the following to the end of file /etc/ts/tools/asm_config_server.cfg:
# AsyncMaxMemorySize=314572800

3. Restart ASM.
# bigstart restart asm

Fixed Versions:
16.1.2.1

921365-2 : IKE-SA on standby deleted due to re-transmit failure when failing over from active to standby

Links to More Info: BT921365

Component: TMOS

Symptoms:
IKE-SAs are deleted on standby BIG-IP systems after a failover.

Conditions:
-- High availability (HA) environment
-- Dead-peer detection (DPD) / liveness checks are enabled
-- An HA failover occurs

This is a timing issue and can occur intermittently during a normal failover.

Impact:
Some of the IKE-SAs are missing on the standby device. When a failover happens, IPsec traffic will be dropped for those missing SAs.

Workaround:
Set IKE DPD interval time to ZERO (i.e., disable).

Fix:
When the BIG-IP system is in standby mode, the system no longer retries sending IKE/IPSEC control messages, which prevents this issue from occurring.

Fixed Versions:
15.1.4, 16.1.2

920149-3 : Live Update default factory file for Server Technologies cannot be reinstalled

Links to More Info: BT920149

Component: Application Security Manager

Symptoms:
Live Update default factory file for Server Technologies cannot be reinstalled once it is no longer the currently installed update file.

Conditions:
This occurs:

-- Once another update file for Server Technologies has been installed (most likely, a newer file).
-- If the device has been upgraded from a prior release such that the currently installed Server Technologies file is from the previous release, and is not the default factory file for the current release.

Impact:
Live Update default factory file for Server Technologies cannot be reinstalled.

Workaround:
None.

Fixed Versions:
14.1.4.4, 15.1.4.1, 16.1.1

919301-1 : GTP::ie count does not work with -message option

Links to More Info: BT919301

Component: Service Provider

Symptoms:
The 'GTP::ie count' iRule command does not work with the -message option. The command fails with an error:

wrong # args: should be "-type <ie-path>"

Conditions:
Issue the 'GTP::ie count' command with -message command, for example:

GTP::ie count -message $m -type apn

Impact:
iRules fails and it could cause connection abort.

Workaround:
Swap order of argument by moving -message to the end, for example:

GTP::ie count -type apn -message $m

There is a warning message due to iRules validation, but the command works in runtime.

Fix:
'GTP::ie' count is now working with -message option.

Fixed Versions:
14.1.4.4, 15.1.4, 16.1.1

915773-7 : Restart of TMM after stale interface reference

Links to More Info: BT915773

Component: Local Traffic Manager

Symptoms:
An assert is reported in the logs:
panic: ../net/ifc.c:975: Assertion "ifc ref valid" failed.

Conditions:
The conditions under which this occurs are unknown.

Impact:
Tmm crashes and restarts. Traffic disrupted while tmm restarts.

Workaround:
None.

Fixed Versions:
14.1.4.4, 15.1.4.1, 16.1.2

913413-1 : 'GTP::header extension count' iRule command returns 0

Links to More Info: BT913413

Component: Service Provider

Symptoms:
The 'GTP::header extension count' iRule command always returns 0 (zero).

Conditions:
This is encountered when using 'GTP::header extension count' in an iRule.

Impact:
The command returns false information.

Workaround:
None

Fix:
'GTP::header extension count' command now returns number of header extension correctly.

Fixed Versions:
14.1.4.4, 15.1.4, 16.1.1

913085-6 : Avrd core when avrd process is stopped or restarted

Links to More Info: BT913085

Component: Application Visibility and Reporting

Symptoms:
When the avrd process is stopped or restarted, it fails with core before the exit. A core file with the name starting with SENDER_HTTPS (for example, SENDER_HTTPS.bld0.0.9.core.gz) can be found in /shared/cores/ directory.

Conditions:
A BIG-IP system is registered on BIG-IQ and has established an HTTPS connection with BIG-IQ for sending stats data.

Impact:
Avrd cores while exiting. There is no impact on BIG-IP system functionality.

Workaround:
None.

Fix:
Avrd no longer cores when avrd process is stopped or restarted.

Fixed Versions:
13.1.4.1, 14.1.4.2, 15.1.4, 16.0.1.2, 16.1.1

912945-3 : A virtual server with multiple client SSL profiles, the profile with CN or SAN of the cert matching the SNI is not selected if cert is ECDSA-signed

Links to More Info: BT912945

Component: Local Traffic Manager

Symptoms:
In a virtual configured with multiple client SSL profiles, the profile with ECDSA-signed cert is not selected even though its CN/SAN matching the SNI extension of ClientHello.

Conditions:
-- A virtual server with multiple client SSL profiles.
-- The SNI of,,lientHello does not match the 'server name' of any profile.
-- The cert in the profile is ECDSA-signed and its CN/SAN matches SNI extension of ClientHello.
-- That profile in is not selected.

Impact:
The incorrect client SSL profile is selected.

Workaround:
Configure the 'Server Name' option in the client SSL profile.

Fix:
Fixed an issue with client SSL profile selection.

Fixed Versions:
14.1.4.4, 15.1.4, 16.1.1

912149-7 : ASM sync failure with Cgc::Channel error 'Failed to send a message, error:15638476'

Links to More Info: BT912149

Component: Application Security Manager

Symptoms:
The system exhibits various symptoms related to sync and control plane, and reports errors similar to the following:

/var/log/:

asm:
-- (asm_config_server.pl,F5::Cgc::Channel::send): Failed to send a message, error:15638476.

ts_debug.log:
-- |ZEROMQ|May 21 23:27:31.840|24813|25914|25914|epoll.cpp:0060|~epoll_t()|(zmq_assert) Assertion failed: load.get () == 0

Conditions:
-- Two devices in a sync-failover/sync-only device group.
-- Other conditions required to reproduce this issue are under investigation.

Note: The occurrences of the Cgc::Channel message in the /var/log/ and /var/log/ts/asm_config_server logs are the most reliable indicator of this issue.

Impact:
-- Config-sync does not work, resulting in a different configuration among the devices in a sync group.

-- Security log profile changes are not propagated to other devices.

-- Portions of the GUI hang, e.g.: Security module tab, and 'security' menu under virtual server.

-- Policies with learning enabled do not generate learning suggestions.

Workaround:
Restart asm_config_server on the units in the device group.

# pkill -f asm_config_server

Fixed Versions:
14.1.4.5, 15.1.4.1, 16.1.2

911141-1 : GTP v1 APN is not decoded/encoded properly

Links to More Info: BT911141

Component: Service Provider

Symptoms:
GTP v1 APN element was decoded/encoded as octetstring and Only GTP v2 APN element is decoded/encoded as DNS encoding.

Conditions:
- GTP version 1.
- APN element.

Impact:
iRules become more complex when dealing with GTP v1 APN element, as it may need to convert between octetstring and dotted style domain name value after decoding or before encoding the data.

Workaround:
Use iRules to convert between octetstring and dotted style domain name values.

Fix:
GTP version 1 APN information element is now decoded/encoded as DNS encoding.

Behavior Change:
GTP v1 apn element is now decoded/encoded using DNS-like encoding. Previously, it was decoded/encoded as octetstring.

Fixed Versions:
14.1.4.4, 15.1.4, 16.1.1

910673-6 : Nethsm-thales-install.sh installation fails with error 'Could not reach Thales HSM'

Links to More Info: BT910673

Component: Local Traffic Manager

Symptoms:
Thales installation script fails with error message.

ERROR: Could not reach Thales HSM "<ip>". Make sure the HSM IP address is correct and that the HSM is accessible to the BIG-IP.

Conditions:
This occurs when the ICMP ping is blocked between the BIG-IP system and netHSM.

Impact:
Thales/nCipher NetHSM client software installation fails.

Workaround:
Unblock ICMP ping between the BIG-IP system and netHSM.

Fixed Versions:
16.1.2.1

909161-1 : A core file is generated upon avrd process restart or stop

Links to More Info: BT909161

Component: Application Visibility and Reporting

Symptoms:
Sometime when avrd process is stopped or restarted, a core is generated.

Conditions:
Avrd process is stopped or restarted.

Impact:
Avrd creates a core file but there is no other negative impact to the system.

Workaround:
None

Fixed Versions:
14.1.4.4, 15.1.4, 16.1.1

907025-5 : Live update error" 'Try to reload page'

Links to More Info: BT907025

Component: Application Security Manager

Symptoms:
When trying to update Attack Signatures. the following error message is shown:

Could not communicate with system. Try to reload page.

Conditions:
Insufficient disk space to update the Attack Signature.

Impact:
Live Update unable to restore the database during startup. Device runs out of disk space, which leads to failure in writing live update hsqldb log file. The liveupdatedb.script file, which is based on the .log file, is truncated and missing necessary settings in order to initialize the live update database.

Workaround:
This following procedure restores the database to its default, initial state:

1. Remove the sigfile.tmp.* directories under /var/ts/var/tmp.

2. Delete the script:
delete /var/lib/hsqldb/live-update/liveupdatedb.script

3. Create a new script:
create new /var/lib/hsqldb/live-update/liveupdatedb.script.

4. Add the following lines to create the live update database schema and set the SA user as expected:

 CREATE SCHEMA PUBLIC AUTHORIZATION DBA
 CREATE MEMORY TABLE AVAILABILITY(ID VARCHAR(255) NOT NULL,ERRORMESSAGE VARCHAR(255),LASTCHECKDATETIME BIGINT,LASTCHECKUPDATEFILE VARCHAR(255),STATUS VARCHAR(255),"TYPE" VARCHAR(255),CONSTRAINT AVAILABILITY_PK PRIMARY KEY(ID))
 CREATE MEMORY TABLE INSTALLSCHEDULE(ID VARCHAR(255) NOT NULL,APPLYATALLTIMES BOOLEAN,APPLYONALLDAYS BOOLEAN,APPLYONFRIDAYS BOOLEAN,APPLYONMONDAYS BOOLEAN,APPLYONSATURDAYS BOOLEAN,APPLYONSUNDAYS BOOLEAN,APPLYONTHURSDAYS BOOLEAN,APPLYONTUESDAYS BOOLEAN,APPLYONWEDNESDAYS BOOLEAN,ENDTIME VARCHAR(255),FREQUENCY VARCHAR(255),STARTTIME VARCHAR(255),"TYPE" VARCHAR(255),CONSTRAINT INSTALLSCHEDULE_PK PRIMARY KEY(ID))
 CREATE MEMORY TABLE UPDATEFILE(ID VARCHAR(255) NOT NULL,CREATEDATETIME BIGINT,FILELOCATION VARCHAR(255),FILENAME VARCHAR(255),ISFILEAVAILABLE BOOLEAN,ISFILEMANUALLYUPLOADED BOOLEAN,ISGENESIS BOOLEAN,MD5 VARCHAR(255),"TYPE" VARCHAR(255),CONSTRAINT UPDATEFILE_PK PRIMARY KEY(ID))
 CREATE MEMORY TABLE INSTALLATION(ID VARCHAR(255) NOT NULL,ADDEDENTITIESCOUNT INTEGER,DELETEDENTITIESCOUNT INTEGER,ERRORMESSAGE VARCHAR(255),LASTREADMEFILENAME VARCHAR(255),LASTUPDATEMICROS BIGINT,LOADDATETIME BIGINT,MODIFIEDENTITIESCOUNT INTEGER,README VARCHAR(500000),STATUS VARCHAR(255),"TYPE" VARCHAR(255),UPDATEFILE_ID_OID VARCHAR(255),CONSTRAINT INSTALLATION_PK PRIMARY KEY(ID),CONSTRAINT INSTALLATION_FK1 FOREIGN KEY(UPDATEFILE_ID_OID) REFERENCES UPDATEFILE(ID))
 CREATE INDEX INSTALLATION_N49 ON INSTALLATION(UPDATEFILE_ID_OID)
 CREATE MEMORY TABLE INSTALLATION_DELETEDENTITYLIST(ID_OID VARCHAR(255) NOT NULL,"ELEMENT" LONGVARBINARY,IDX INTEGER NOT NULL,CONSTRAINT INSTALLATION_DELETEDENTITYLIST_PK PRIMARY KEY(ID_OID,IDX),CONSTRAINT INSTALLATION_DELETEDENTITYLIST_FK1 FOREIGN KEY(ID_OID) REFERENCES INSTALLATION(ID))
 CREATE INDEX INSTALLATION_DELETEDENTITYLIST_N49 ON INSTALLATION_DELETEDENTITYLIST(ID_OID)
 CREATE MEMORY TABLE INSTALLATION_MODIFIEDENTITYLIST(ID_OID VARCHAR(255) NOT NULL,"ELEMENT" LONGVARBINARY,IDX INTEGER NOT NULL,CONSTRAINT INSTALLATION_MODIFIEDENTITYLIST_PK PRIMARY KEY(ID_OID,IDX),CONSTRAINT INSTALLATION_MODIFIEDENTITYLIST_FK1 FOREIGN KEY(ID_OID) REFERENCES INSTALLATION(ID))
 CREATE INDEX INSTALLATION_MODIFIEDENTITYLIST_N49 ON INSTALLATION_MODIFIEDENTITYLIST(ID_OID)
 CREATE MEMORY TABLE INSTALLATION_ADDEDENTITYLIST(ID_OID VARCHAR(255) NOT NULL,"ELEMENT" LONGVARBINARY,IDX INTEGER NOT NULL,CONSTRAINT INSTALLATION_ADDEDENTITYLIST_PK PRIMARY KEY(ID_OID,IDX),CONSTRAINT INSTALLATION_ADDEDENTITYLIST_FK1 FOREIGN KEY(ID_OID) REFERENCES INSTALLATION(ID))
 CREATE INDEX INSTALLATION_ADDEDENTITYLIST_N49 ON INSTALLATION_ADDEDENTITYLIST(ID_OID)
 CREATE USER SA PASSWORD ""
 GRANT DBA TO SA
 SET WRITE_DELAY 20
 SET SCHEMA PUBLIC

5. Restart the tomcat process:
bigstart restart tomcat

Fixed Versions:
14.1.4.5, 16.1.2.1

898929-6 : Tmm might crash when ASM, AVR, and pool connection queuing are in use

Links to More Info: BT898929

Component: Local Traffic Manager

Symptoms:
TMM crashes and generates a core file.

Conditions:
-- System is provisioned for at least ASM, AVR, and LTM.
-- An LTM pool is configured to use connection queuing.
-- The LTM pool is used on a virtual server with an analytics profile.

Impact:
Tmm might crash. Traffic disrupted while tmm restarts.

Workaround:
Disable connection queuing on the pool.

Fixed Versions:
14.1.4.5, 16.1.2.1

895557-5 : NTLM profile logs error when used with profiles that do redirect

Links to More Info: BT895557

Component: Local Traffic Manager

Symptoms:
As of BIG-IP version 14.1, HTTP iRule commands that inspect HTTP state after the commands HTTP::respond, HTTP::redirect, and HTTP::retry returns errors instead of returning corrupt data (https://support.f5.com/csp/article/K23237429).

When the NTLM profile is configured, it does the same through a built-in TCL rule where among several things, it tries to check if HTTP::cookie exists. If a profile like HTTP exists wherein a redirect/respond/retry is configured, it results in a TCL error informing the admin that they are accessing an invalid HTTP state.

Conditions:
-- NTLM profile is configured alongside HTTP profile
-- One of the redirect/respond/retry commands has been executed before the NTLM profile accesses the state of HTTP (for ex. HTTP::collect, HTTP::close, HTTP::cookie, etc.).

Impact:
Tcl error is seen in /var/log/ltm informing the admin that the iRule operation executed after HTTP::redirect/retry/respond is not supported.

For example -
TCL error: _plugin_rule_/Common/ntlm_default_iis <HTTP_REQUEST> - ERR_NOT_SUPPORTED (line 1) invoked from within "HTTP::cookie exists [PROFILE::ntlm insert_cookie_name]"

Fixed Versions:
14.1.4.2, 15.1.4, 16.0.1.2, 16.1.2

888289-8 : Add option to skip percent characters during normalization

Links to More Info: BT888289

Component: Application Security Manager

Symptoms:
An attack signature is not detected.

Conditions:
-- The payload is filled with the percent character in between every other character.
-- The bad unescape violation is turned off.
-- The illegal metacharacter violation is turned off.

Impact:
An attack goes undetected.

Workaround:
Turn on the bad unescape violation or the metacharacter violation.

Fix:
Added an internal parameter, normalization_remove_percents. Its default is 0 (zero), meaning that the previous behavior is maintained. When enabled, the normalization of the data before running the signature removes the percent characters (as it does to high ASCII and space characters).

Fixed Versions:
13.1.4.1, 14.1.4.2, 15.1.4, 16.0.1.2, 16.1.1

887117-4 : Invalid SessionDB messages are sent to Standby

Links to More Info: BT887117

Component: TMOS

Symptoms:
SessionDB messages sent from Active to Standby are dropped due to inconsistencies detected in the message. You see logs in /var/log/ltm:

SessionDB ERROR: received invalid or corrupt HA message; dropped message.

Conditions:
-- High availability (HA) pair configuration.
-- SessionDB messages sent from Active to Standby.

Impact:
Standby drops these messages

Workaround:
None.

Fixed Versions:
15.1.4.1, 16.1.1

885765-1 : ASMConfig Handler undergoes frequent restarts

Links to More Info: BT885765

Component: Application Security Manager

Symptoms:
Under some settings and load the RPC handler for the tsconfd process restarts frequently.

Conditions:
When processing a large number of configuration updates.

Impact:
The RPC handler for the tsconfd process restarts frequently, causing unnecessary churn and noisy logs

Workaround:
None

Fixed Versions:
14.1.4.5, 16.1.2.1

881085-4 : Intermittent auth failures with remote LDAP auth for BIG-IP managment

Links to More Info: BT881085

Component: TMOS

Symptoms:
There are intermittent auth failures when accessing the BIG-IP administration interfaces via SSH or the GUI.

Conditions:
-- Remote LDAP auth is configured.
-- An idle timeout RST is received on the LDAP connection before the configured auth LDAP idle-timeout expires. This RST might be generated by tmm (if the connection to the LDAP server is via a defined VLAN), some other intervening device on the network, or from the LDAP server itself (depending on its connection time limit).

Impact:
There might be intermittent remote-auth failures.

Workaround:
Set the auth ldap idle-timeout to a smaller value, for example, via tmsh:
modify auth ldap system-auth idle-timeout 299

Fixed Versions:
14.1.4.5, 15.1.4.1, 16.1.2

842013-1 : ASM Configuration is Lost on License Reactivation★

Links to More Info: BT842013

Component: Application Security Manager

Symptoms:
After re-activating a BIG-IP license, if the configuration fails to load and reverts to a base config load, the ASM policy config contains 'default' or 'stub' policies, even after fixing the error that caused the configuration to fail to load.

Conditions:
1) A parsing error exists in the BIG-IP config such that 'tmsh load sys config verify' would fail
2) There is a license reactivation or the configuration is reloaded

Impact:
ASM policy configuration is lost and all policies are reverted to empty 'stubs'

Workaround:
In the case of license re-activation/before upgrade:

   Run the command "tmsh load sys config verify" prior to license activation on ASM units to be sure that the config will pass parsing and avoid the fallback to base configuration load.

   In a case of booting the system into the new version:

   Option 1:

      1. Using the steps in either K4423 or K8465, fix the issue that was preventing the config to load.
      2. Reload the config from the fixed UCS file using the command in K13132.

   Option 2:

      1. Roll back to the old version.
      2. Fix the issue that was preventing the config to load.
      3. Before activating the Boot Location of the new version at System >> Software Management : Boot Locations, make sure to set the option Install Configuration to Yes. see: K64400324

   Option 3: If one of the high availability (HA) units successfully upgraded, then use config-sync to push the working config to the failing unit.

Fixed Versions:
14.1.4.5, 15.1.4.1, 16.1.2

830341-5 : False positives Mismatched message key on ASM TS cookie

Links to More Info: BT830341

Component: Application Security Manager

Symptoms:
ASM system triggers false positives for ASM Cookie Hijacking violation with reason "Mismatched message key"

Conditions:
-- An HTTP request containing an old frame cookie with a different message key from the main ts cookie is rejected
-- The cookie is left intact

Impact:
All subsequent requests are rejected on ASM Cookie Hijacking violation

Workaround:
1. Disable "Learn Host Names" flag all policies. If the policy builder is on manual mode, they need to change it back to Auto mode, disable "Learn Host Names", then change to manual mode.

OR

2. Delete the mismatched cookie. This will cause the violations to stop occurring if the request comes from a legit endpoint

Fix:
ASM system does not trigger false positives

Fixed Versions:
13.1.4.1, 14.1.4.2, 15.1.4, 16.0.1.2, 16.1.2.1

828761-5 : APM OAuth - Auth Server attached iRule works inconsistently

Links to More Info: BT828761

Component: Access Policy Manager

Symptoms:
The iRule attached to the OAuth Resource Server (RS) is not triggered when the traffic hits the virtual server.

Conditions:
The issue occurs during a reboot of the BIG-IP device containing an OAuth server config and an attached iRule, or when the iRule is initially assigned to the OAuth Server.

Impact:
OAuth scope check agent fails with 'HTTP error 503': as the iRule attached to the RS virtual server is not triggered.

Workaround:
For existing OAuth servers with the iRule attached, modify the iRule, for example, adding a log. This makes the iRule trigger when it is initially attached or loaded.

Fix:
The iRule is triggered when a request comes to the OAuth RS virtual server.

Fixed Versions:
14.1.4.5, 16.1.2.1

827393-5 : In rare cases tmm crash is observed when using APM as RDG proxy.

Links to More Info: BT827393

Component: Access Policy Manager

Symptoms:
Tmm may crash when APM is configured as an RDG proxy to access Microsoft remote desktops and applications.

Conditions:
APM is used as RDG proxy

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

Fix:
Tmm does not crash when APM is configured as RDG proxy.

Fixed Versions:
14.1.4.5, 16.1.2.1

805821-1 : GTP log message contains no useful information

Links to More Info: BT805821

Component: Service Provider

Symptoms:
GTP profile and GTP iRules provide no useful information in order to proceed with troubleshooting.

Conditions:
GTP profile or iRules fails to process message

Impact:
User lacks of information for troubleshooting

Workaround:
N/A

Fix:
GTP error log has been replaced with a more useful message. The new log message provides more intuitive information including the reason and, in some messages, location of data that causes the failure.

Fixed Versions:
14.1.4.4, 15.1.4, 16.1.1

803965-10 : Expat Vulnerability: CVE-2018-20843

Links to More Info: K51011533, BT803965

797797-7 : CVE-2019-11811 kernel: use-after-free in drivers

Links to More Info: K01512680, BT797797

749332-1 : Client-SSL Object's description can be updated using CLI and with REST PATCH operation

Links to More Info: BT749332

Component: TMOS

Symptoms:
REST PUT fails to update the object description when proxy-ca-cert and proxy-ca-key are not configured, and triggers an error:
SSL forward proxy RSA CA key is missing.

Conditions:
Issue is seen only with REST PUT operation, and when proxy-ca-cert and proxy-ca-key are not configured.

Impact:
REST PUT operation cannot be used to update/modify the description.

Workaround:
You can use either of the following:

-- You can use TMSH to update/modify the description, even if proxy-ca-cert and proxy-ca-key are not configured.

-- You can also use PATCH operation and send only the required field which need modification.

Fixed Versions:
14.1.4.4, 16.1.2.1

738593-3 : Vmware Horizon session collaboration (shadow session) feature does not work through APM

Links to More Info: BT738593

Component: Access Policy Manager

Symptoms:
When the VMware virtual desktop interface (VDI) is configured, session collaboration or shadow session does not work.

Conditions:
-- VMware VDI configured and Desktop resource is accessed with native client or browser.
-- Shadow session is enabled in desktop

Impact:
Desktop's Shadow session resource icon is not showed on webtop or native client.

Workaround:
None

Fix:
Users should see Desktop's shadow session icon when resources are loaded on to webtop or native client.

Fixed Versions:
14.1.4.5, 16.1.2.1

708991-1 : Newly entered password is not remembered

Links to More Info: BT708991

Component: TMOS

Symptoms:
- Upon enabling password remember feature and running 'tmsh load sys config default', the password history fails to verify and save the newly entered password.
- Upon installing a BIG-IP image for the first time, the default password is not updated.

Conditions:
- Installing first time BIG-IP image.
- Resetting the configuration using 'tmsh load sys config default'.

Impact:
The password is not remembered

Fix:
Corrected selinux policy script of the file /etc/security/opasswd for access permission.

Fixed Versions:
16.1.2

686783-1 : UlrCat custom database feed list does not work when the URL contains a www prefix or capital letters.

Links to More Info: BT686783

Component: Traffic Classification Engine

Symptoms:
If a UrlCat custom database feed list has URLs containing a www prefix or capital letters, the URLs are not categorized when queried.

Conditions:
The UrlCat custom database feed list with URL containing www prefix or capital letters,

Impact:
Improper classification

Workaround:
Using an iRule can help classify the URL.

Fix:
Normalized the URL before putting in the custom database.

Fixed Versions:
14.1.4.5, 15.1.4.1, 16.1.2

1065789-1 : TMM may send duplicated alerts while processing SSL connections

Component: Local Traffic Manager

Symptoms:
Under certain conditions, TMM may send duplicated SSL alerts while processing encrypted connections.

Conditions:
- Fatal SSL error

Impact:
Increased resource usage, potentially leading to degraded performance.

Workaround:
N/A

Fix:
SSL alerts are now processed as expected.

Fixed Versions:
16.1.2.1

1055361-1 : Suspending iRule command in L7CHECK_CLIENT_DATA can lead to a tmm crash

Links to More Info: BT1055361

Component: SSL Orchestrator

Symptoms:
Suspending iRule command in L7CHECK_CLIENT_DATA can lead to a tmm crash

Conditions:
Suspending iRule command in L7CHECK_CLIENT_DATA

Example:

ltm rule /Common/rule-a {
when L7CHECK_CLIENT_DATA {
        after 10000
        }
}

Impact:
Traffic disrupted while tmm restarts.

Workaround:
Do not use Suspending iRule command in L7CHECK_CLIENT_DATA

Fix:
Fixed a tmm crash.

Fixed Versions:
16.1.2.1

1049229-1 : When you try to create a sub-rule under the Network Firewall rule list, the error: 'No Access' displays.

Links to More Info: BT1049229

Component: Advanced Firewall Manager

Symptoms:
An authenticated administrative user tries to create a sub-rule under the Network Firewall rule list from the GUI and is redirected to a 'No Access' error page.

Conditions:
This error can occur when you create a sub-rule under the Network Firewall rule list in the TMOS GUI on a version of BIG-IP (including engineering hotfixes) that include the fixes for BIG-IP bugs ID1032405 and ID941649.

Impact:
The user cannot create a sub-rule under the Network Firewall rule list in the TMOS GUI.

Workaround:
Use the TMOS Shell (tmsh) command-line interface to perform the equivalent action.

Fix:
After the fixes for ID1032405 and ID941649 are installed, the "No Access" errors no longer occur when you create a sub-rule under the Network Firewall rule list in the TMOS GUI.

Fixed Versions:
14.1.4.5, 15.1.4.1, 16.1.2

1048433-1 : Improve Extract logic of thales-sync.sh to support VIPRION cluster to support 12.6.10 client installation★

Component: Local Traffic Manager

Symptoms:
The thales-sync.sh script tries to install on the second blade eventually The packages provided by formerly Thales now nShield/Entrust are increasing version to version, The extract logic is not compatible with to latest versions.

Conditions:
While upgrading lower versions to 12.60

Impact:
The installation script will fail to find to extract packages

Workaround:
None

Fix:
Extract all the tarballs in the target directory to resolve the issue.

Fixed Versions:
16.1.2.1

1045421-1 : No Access error when performing various actions in the TMOS GUI

Links to More Info: K16107301, BT1045421

Component: TMOS

Symptoms:
An authenticated administrative user is redirected to a 'No Access' error page while performing various actions in the TMOS GUI, including when trying to:
-- Apply a policy to a virtual server
-- Import images (TMOS images / hotfixes / apmclients)
-- Export/apply an APM policy
-- Run the high availability (HA) setup wizard
-- Export a certificate/key through one of the following paths:
    ---- System / Certificate Management : Traffic Certificate Management : SSL Certificate List / test-renew-self-sign / Renew
    ---- DNS / GSLB : Pools : Pool List / Click Testpool / Click Members / Click Manage
    ---- System / Software Management : APM Clients / Import
    ---- System / Certificate Management : Traffic Certificate Management : SSL Certificate List / NewSSLCert / Certificate / Export / Click Download

Conditions:
This may occur when performing various actions in the TMOS GUI on a version of BIG-IP software (including Engineering Hotfixes) that includes fixes for ID1032405 :: https://cdn.f5.com/product/bugtracker/ID1032405.html and ID941649 :: https://cdn.f5.com/product/bugtracker/ID941649.html .

Impact:
Cannot perform various actions in the TMOS GUI.

Workaround:
Use the TMOS Shell (tmsh) command-line interface to perform the equivalent action.

Fix:
'No Access' errors no longer occur when performing various actions in the TMOS GUI under these conditions.

Fixed Versions:
14.1.4.5, 15.1.4.1, 16.1.2

1045101-4 : Bd may crash while processing ASM traffic

Component: Application Security Manager

Symptoms:
Bd may crash when handling HTTP requests with APM and ASM.

Conditions:
- ASM and APM are provisioned
- Session awareness is enabled and "Use APM Username and Session ID" is selected in "Application Username" configuration
- Specially crafted HTTP request

Impact:
Bd crash leading to a traffic disruption and failover event.

Workaround:
N/A

Fix:
Bd now process ASM and APM traffic as expected.

Fixed Versions:
16.1.2.1

1043205-1 : SSRF Violation should be shown as a Parameter Entity Reference

Links to More Info: BT1043205

Component: Application Security Manager

Symptoms:
SSRF Violation is shown as a URL Entity Reference instead of a Parameter Entity Reference

Conditions:
- Create a URI data type parameter
- Add a host to the SSRF Host List
- Send traffic which contains the URI parameter with the value configured in the SSRF Host List

Impact:
Wrong Entity Reference in the SSRF violation is misleading.

Fix:
Corrected the Entity reference as a parameter instead of a URL in the SSRF violation

Fixed Versions:
16.1.2.1

1042917-1 : Using 'Full Export' of security policy should result with no diffs after importing it back to device

Links to More Info: BT1042917

Component: Application Security Manager

Symptoms:
'Declarative policy import' is adding entities into the policy according what it has in the JSON file.

When it imports the policy builder settings, some automatic changes are created in the policy, and it may override other entities which were added before.

Conditions:
Policy builder settings are added in import after other affected entities were added before.

Impact:
The resulted policy will be different from the exported policy.

Fix:
'Declarative Policy import' first adds the policy builder settings, and all other affected entities are imported only after it, and in this way the resulted policy is the same as the exported one.

Fixed Versions:
16.1.2

1042069-1 : Some signatures are not matched under specific conditions

Component: Application Security Manager

Symptoms:
Some signatures are not matched and attack traffic can pass through.

Conditions:
There are more than 20 signatures that has a common keyword with a signature that does not match (which has a common keyword and new keyword).

Impact:
Attacking traffic can bypass the WAF.

Workaround:
None

Fix:
Attack signatures that share words with other attack signatures will be matched correctly now.

Fixed Versions:
14.1.4.5, 15.1.4.1, 16.1.2.1

1041765-2 : Racoon may crash in rare cases

Links to More Info: BT1041765

Component: TMOS

Symptoms:
Racoon may crash when NAT Traversal is on and passing IPsec traffic in IKEv1.

Conditions:
-- IKEv1 IPsec tunnel configured
-- NAT Traversal is on in ike-peer configuration.

Impact:
Racoon will crash and any IKEv1 tunnels will restart

Workaround:
Use IKEv2 only.

Fix:
This racoon crash has been stopped.

Fixed Versions:
16.1.2.1

1040677 : BIG-IP D120 platform reports page allocation failures in N3FIPS driver

Links to More Info: BT1040677

Component: Local Traffic Manager

Symptoms:
Despite having free memory, the BIG-IP system logs kernel page allocation failures to the /var/log/kern.log file. The first line of the output appears similar to the following example:

swapper/6: page allocation failure: order:2, mode:0x204020

After that, a stack trace follows. The process name in the line ('swapper/16', in this example). You may see generic Linux processes or processes specific to F5 in that line.

Conditions:
This issue is known to occur on the appliance D120 (iSeries i15820-DF).

Impact:
As different processes can experience this issue, and the system may behave unpredictably. Software installation may fail.

Workaround:
You can work around this issue by increasing the value of the min_free_kbytes kernel parameter. This controls the amount of memory that is kept free for use by special reserves.

It is recommend to increase this to 128 MB (131072 KB).

When instantiating this workaround, consider whether you want the workaround to survive only reboots, or to survive reboots, upgrades, RMAs, etc. This is an important consideration to make, as you should stop using this workaround when this issue is fixed in a future version of BIG-IP software. So consider the pros and cons of each approach before choosing one.

-- If you want the workaround to survive reboots only, perform the following procedure:

1) Log on to the advanced shell (BASH) of the primary blade of the affected system.

2) Run the following commands (with the desired amount in KB):

# clsh "sysctl -w vm.min_free_kbytes=131072"
# clsh "echo -e '\n# Workaround for ID 851785' >> /etc/sysctl.conf"
# clsh "echo 'vm.min_free_kbytes = 131072' >> /etc/sysctl.conf"

-- If you want the workaround to survive reboots, upgrades, RMAs, etc., perform the following procedure:

1) Log on to the advanced shell (BASH) of the primary blade of the affected system.

2) Run the following commands (with the desired amount in KB):

# clsh "sysctl -w vm.min_free_kbytes=131072"
# echo -e '\n# Workaround for ID851785' >> /config/startup
# echo 'sysctl -w vm.min_free_kbytes=131072' >> /config/startup

Note that the last two commands are not wrapped inside 'clsh' because the /config/startup file is already automatically synchronized across all blades.

Once the issue is fixed in a future BIG-IP version, remove the workarounds:

-- To remove the first workaround:

1) Edit the /etc/sysctl.conf file on the BIG-IP appliance and remove the added lines at the bottom.

2) Reboot the system by running 'clsh reboot'. This will restore the min_free_kbytes kernel parameter to its default value for the BIG-IP version you are running.

-- To remove the second workaround:

1) Edit the /config/startup file on the BIG-IP appliance and remove the extra lines at the bottom.

2) Reboot the system by running 'clsh reboot'. This restores the min_free_kbytes kernel parameter to its default value for the BIG-IP version you are running.

To verify the workaround is in place, run the following command (this should return the desired amount in KB):

# clsh "cat /proc/sys/vm/min_free_kbytes"

Fix:
The BIG-IP system no longer experiences excessive kernel page allocation failures.

Fixed Versions:
16.1.1

1040361-1 : TMM crashes during its startup when TMC destination port list attached/deleted to virtual server

Links to More Info: BT1040361

Component: Local Traffic Manager

Symptoms:
-- Log message written to TMM log file:
   panic: ../kern/page_alloc.c:736: Assertion "vmem_hashlist_remove not found" failed.

Conditions:
-- Virtual Server using a traffic-matching-criteria (TMC) with a destination-port-list, with multiple distinct ranges of ports.

-- Config changes to virtual server with traffic-matching criteria can cause memory corruption which can lead to delayed TMM crashes.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
Do not use Traffic Matching Criteria with destination port lists.
TMM restart is required in case the virtual server is modified with traffic-matching-criteria related config.

Fix:
TMM no longer crashes under these conditions.

Fixed Versions:
14.1.4.5, 16.1.2

1039553-1 : Non-200 HTTP status codes fail to be matched by GTM HTTP(S) monitors

Links to More Info: BT1039553

Component: Global Traffic Manager (DNS)

Symptoms:
GTM virtual servers have the wrong status (up when they should be down, or down when they should be up, depending on the monitor's configuration).

Conditions:
-- The GTM virtual servers are monitored with an HTTP or HTTPS monitor that performs HTTP status matching.

-- The monitor tries to match an HTTP status code other than 200 (for example, 301).

-- The monitor uses HTTP version 1.0 or 1.1 for the request (the default is 0.9).

Impact:
The system incorrectly considers all non-200 responses a failed monitor attempt, despite what the user specified as acceptable status codes in the monitor's configuration. As a result, the availability status reported for a virtual server may be incorrect. This may cause the GTM system to send traffic to unsuitable resources causing application disruptions.

Workaround:
You can work around this issue in any of the following ways:

-- Use HTTP version 0.9 for the monitor requests.

-- Match on the 200 HTTP status code.

-- Do not use HTTP status matching altogether.

Fix:
GTM HTTP(S) monitors using HTTP version 1.0 or 1.1 can now successfully match status codes other than 200 in the response.

Fixed Versions:
16.1.2.1

1039329-2 : MRF per peer mode is not working in vCMP guest.

Links to More Info: BT1039329

Component: Service Provider

Symptoms:
MRF diameter setup, in peer profile "auto-initialization" and "per peer" mode are enabled, but no connection attempts towards the pool member occur.

When the mode is switched to "per tmm" or "per blade", connections are established.

Conditions:
The peer connection mode in the peer profile is set to "per peer".

Impact:
The "per peer" setting does not work.

Workaround:
Switch the connection mode to "per tmm" or "per blade"

Fixed Versions:
14.1.4.5, 16.1.2.1

1039069-1 : Multiple issues affecting the RESOLV::lookup iRule command following the fix to ID1007049.★

Links to More Info: BT1039069

Component: Global Traffic Manager (DNS)

Symptoms:
For more information on the specific issues fixed, please refer to:

https://cdn.f5.com/product/bugtracker/ID1010697.html
https://cdn.f5.com/product/bugtracker/ID1037005.html
https://cdn.f5.com/product/bugtracker/ID1038921.html

Please note the only versions 15.1.3.1 and 16.1.0 are affected.

Conditions:
-- Running BIG-IP version 15.1.3.1 or 16.1.0
-- RESOLV::lookup iRule is used

Impact:
Multiple issues can occur with the RESOLV::lookup command, such as DNS resolutions failing or incorrect DNS responses being received.

Workaround:
None

Fix:
-

Fixed Versions:
15.1.4, 16.1.1

1039049-2 : Installing EHF on particular platforms fails with error "RPM transaction failure"

Links to More Info: BT1039049

Component: TMOS

Symptoms:
-- Installing an EHF fails with the error "RPM transaction failure"

-- Errors similar to the following are seen in the liveinstall.log file:

info: RPM: /var/tmp/rpm-tmp.LooFVF: line 11: syntax error: unexpected end of file
info: RPM: error: %preun(fpga-tools-atlantis-15.1.3-0.0.11.i686) scriptlet failed, exit status 2

Conditions:
-- Installing an EHF that contains an updated version of the 'fpga-tools-atlantis' package
-- Using the following platforms:
  + BIG-IP i4600 / i4800
  + BIG-IP i2600 / i2800
  + BIG-IP i850

Impact:
EHF installation fails.

Workaround:
None

Fixed Versions:
14.1.4.5, 15.1.4.1, 16.1.2

1039041 : Log Message: Clock advanced by <number> ticks

Links to More Info: BT1039041

Component: Local Traffic Manager

Symptoms:
<ticks> is the number of milliseconds the Traffic Management Microkernel (TMM) clock is out of sync (behind) the system clock because the TMM thread is waiting for a response.

Logs are similar to below.

bigip1 notice tmm15[46856]: 01010029:5: Clock advanced by 103 ticks
bigip1 notice tmm7[46855]: 01010029:5: Clock advanced by 106 ticks
bigip1 notice tmm10[46855]: 01010029:5: Clock advanced by 107 ticks
bigip1 notice tmm25[46856]: 01010029:5: Clock advanced by 113 ticks
bigip1 notice tmm15[46856]: 01010029:5: Clock advanced by 121 ticks
bigip1 notice tmm5[46855]: 01010029:5: Clock advanced by 106 ticks

Conditions:
These logs are seen more frequently in i15820-DF platforms with FIPS enabled, in comparison to other FIPS platforms. The messages are observed during FIPS key lookup in the HSM. These lookups occur either during TMM start/restart or during SSL profile configuration modification.

Impact:
This message may appear intermittently depending on system load and conditions mentioned above, and it does not necessarily indicate system instability or a cause for concern unless accompanied by another error message or at the time of a serious event.

In all the above conditions, clock advance ticks are in the range of 100 - 170.

Fixed Versions:
16.1.2

1038669-1 : Antserver keeps restarting

Links to More Info: BT1038669

Component: SSL Orchestrator

Symptoms:
Antserver keeps restarting, as indicated in /var/log/ecm:

notice ant_server.sh[5898]: starting ant_server on 057caae1e95a11d7ecd1118861fb49f30ce1c22d
notice ant_server.sh[6311]: no ant_server process
notice ant_server.sh[6312]: check: no running ant_server

Conditions:
The Secure Web Gateway is provisioned on i15800 or i15820 platform.

Impact:
User connection will be reset if request or response analytics agent is deployed with per-request policy.

Fix:
N/A

Fixed Versions:
16.1.2

1038629-4 : DTLS virtual server not performing clean shutdown upon reception of CLOSE_NOTIFY from client

Links to More Info: BT1038629

Component: Local Traffic Manager

Symptoms:
With the DTLS virtual server, when client sends the CLOSE_NOTIFY alert, BIG-IP is simply closing the connection without sending the CLOSE_NOTIFY back to client as well as the backend server. This causes the backend server to not close/shutdown the connection completely.

Conditions:
This issue occurs with all DTLS virtual servers which has associated client-ssl and server-ssl profiles.

Impact:
Backend server and client will have a dangling connection for certain period of time (Based on the timeout implementation at the respective ends).

Fixed Versions:
14.1.4.5, 16.1.2.1

1037181-1 : TMM may crash while processing HTTP traffic

Component: Local Traffic Manager

Symptoms:
Under certain conditions, TMM may crash while processing HTTP traffic

Conditions:
- HTTP profile enabled

Impact:
TMM may crashing leading to a traffic interruption and failover event.

Workaround:
N/A

Fix:
TMM now processes HTTP traffic as expected.

Fixed Versions:
16.1.2

1035853-1 : Transparent DNS Cache can consume excessive resources.

Component: Global Traffic Manager (DNS)

Symptoms:
Under certain conditions, the Transparent DNS Cache can consume excessive resources.

Conditions:
- Transparent DNS Cache enabled
- EDNS enabled

Impact:
Excessive resource consumption, which can lead to increased server-side load.

Workaround:
N/A

Fix:
The Transparent DNS Cache now consumes resources as expected.

Fixed Versions:
14.1.4.5, 16.1.2

1035729-1 : TMM may crash while processing traffic http traffic

Component: Local Traffic Manager

Symptoms:
TMM may crash while processing traffic on virtual with a redirect policy, APM, or Explicit HTTP proxy

Conditions:
A virtual configured with :
a) HTTP redirect policy [or]
b) APM Virtual server [or]
c) Explicity HTTP Proxy

Impact:
Traffic disrupted while tmm restarts.

Workaround:
N/A

Fix:
TMM now processed HTTP traffic as expected.

Fixed Versions:
16.1.2

1035133-4 : Statistics data are partially missing in various BIG-IQ graphs under "Monitoring" tab

Links to More Info: BT1035133

Component: Application Visibility and Reporting

Symptoms:
In various BIG-IQ GUI forms under the "Monitoring" tab (for example Monitoring -> Local Traffic -> HTTP), data for some time periods are missing.

Multiple "Unexpected end of ZLIB input stream" errors appear in BIG-IQ DCD logs under /var/log/appiq/gc_agent-manager.log

Conditions:
BIG-IP is attached to BIG-IQ, traffic volume is high

Impact:
Data in BIG-IQ are missing therefore some graphs show incorrect information

Workaround:
None

Fix:
Fixed an issue with missing statistics.

Fixed Versions:
14.1.4.5, 15.1.4.1, 16.1.2

1034617-1 : Login/Security Banner text not showing in console login

Links to More Info: BT1034617

Component: TMOS

Symptoms:
Setting the Login/Security Banner causes the banner to appear when connecting via the management port and not when connecting via the console.

Conditions:
-- The login banner is configured
-- You log into the command line

Impact:
Mismatch in displaying banner text with management and console logins.

Workaround:
Configure an identical banner for ssh sessions by following https://support.f5.com/csp/article/K6068

Fix:
The banner text now displays for both management and console logins.

Fixed Versions:
16.1.2

1032949-1 : Dynamic CRL configured with client authentication profile as "Request" causes connection termination without certificate

Links to More Info: BT1032949

Component: TMOS

Symptoms:
When you configure Dynamic CRL and set the client authentication as "Request", the handshake fails when clients do not supply a certificate.

Conditions:
Clientssl profile configured with the following:

1. Dynamic CRL
2. Client Authentication enabled with "Request" option

Impact:
SSL handshake fails

Workaround:
Workaround 1:
Use Static CRL

Workaround2:
Use Client authentication with either "Require" or "Ignore"

Workaround3:
Disable TLS1.2 and below versions in the Client SSL profile.
Which means allow only TLS1.3 traffic.

Fixed Versions:
16.1.2.1

1032797-1 : Tmm continuously cores when parsing custom category URLs

Links to More Info: BT1032797

Component: SSL Orchestrator

Symptoms:
Tmm crashes when trying to parse more than 256 custom category URLs.

Conditions:
-- More than 256 URLs defined in custom url-category.

Impact:
Traffic disrupted while tmm restarts.

Fix:
TMM no longer crashes and it can parse more than 256 custom category URLs.

Fixed Versions:
16.1.2

1032737-2 : IPsec: tmm SIGSEGV in getlocaladdr in ikev2_initiate

Links to More Info: BT1032737

Component: TMOS

Symptoms:
Tmm crashes while passing IPsec traffic

Conditions:
Wildcard selectors are used.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

Fix:
Avoid the core dump by adding checks.

Fixed Versions:
15.1.4.1, 16.1.2

1032689 : UlrCat Custom db feedlist is not working for www.croupiest.com with attached feedlist file

Links to More Info: BT1032689

Component: Traffic Classification Engine

Symptoms:
The first URL getting normalized is not classified.

Conditions:
The URL contains caps or 'www' is not getting categorized in few cases.

Impact:
The 'custom' category is not displayed for all the apps available in the feedlist file.

Workaround:
None

Fix:
Starting normalized lines with \n

Fixed Versions:
14.1.4.5, 15.1.4.1, 16.1.2

1032405-1 : TMUI XSS vulnerability CVE-2021-23037

Links to More Info: K21435974, BT1032405

1032077-1 : TACACS authentication fails with tac_author_read: short author body

Links to More Info: BT1032077

Component: TMOS

Symptoms:
If a TACACS user is part of a group with 10s of attribute value pairs (AVPs) were the length of all the avp's combined is such that the authorization reply message from the TACACS server is segmented, the login will fail.

The error message that is logged when the login fails is
"tac_author_read: short author body, 4468 of 6920: Operation now in progress" Where the numbers 4468 and 6920 will vary.

Conditions:
- TACACS authentication
- TACACS user that is part of a group where the combined length of the AVPs is greater then the largest TCP segment the TACACS server is able to send.

Impact:
User is unable to login.

Workaround:
If possible, reduce the number of attributes of the TACACS group or user.

Fixed Versions:
14.1.4.5, 15.1.4.1, 16.1.2

1031901-2 : In HTTP2 deployment, RST_STREAM sent to client if server in CLOSING state is picked

Links to More Info: BT1031901

Component: Local Traffic Manager

Symptoms:
When request from client is forwarded to server which is in CLOSING state due to server sent GOAWAY but not yet close the connection, request will be failed to be forwarded to server and RST_STREAM will be sent to client

Conditions:
-- Virtual Server with HTTP2 profile
-- There is an open connection from BIG-IP to the server.
-- The server sends a GOAWAY message to the BIG-IP and the connection is kept open.
-- The client sends a request to BIG-IP, BIG-IP picks the connection mentioned above to forward the request to

Impact:
Traffic from the specific client is interrupted

Workaround:
N/A

Fix:
In HTTP2 deployment, RST_STREAM is no longer sent to client if server in CLOSING state is picked

Fixed Versions:
15.1.4.1, 16.1.2

1031609-1 : Improve nethsm-thales-install.sh and nethsm-thales-rfs-install.sh to be compatible with Entrust Client v12.60.10 package★

Component: Local Traffic Manager

Symptoms:
Formerly Thales now nShield/Entrust has changed the directory structure of their client package and also added new libraries. Due to which install script will be incompatible with v12.60.10 onwards.

Conditions:
Upgrading to PKCS11 client package v12.60.10

Impact:
The installation script will fail while extracting the package

Workaround:
None

Fix:
Extract all the tarballs in the target directory to resolve the issue.

Fixed Versions:
16.1.2.1

1031357-2 : After reboot of standby and terminating peer, some IPsec traffic-selectors are still online

Links to More Info: BT1031357

Component: TMOS

Symptoms:
HA Standby marks traffic selectors up when they are actually down on the Active device.

Conditions:
-- High availability (HA) configured and mirroring configured
-- IPsec tunnels up on Active
-- Reboot Standby
-- Standby starts correctly and all SAs are mirrored
-- Tunnel(s) go down on Active

Impact:
-- Traffic Selector is incorrectly marked up on the Standby when it is actually down on the Active.
-- While this is cosmetic, the information is misleading.

Workaround:
None

Fix:
After Standby reboot and deleting IPsec tunnels, the
traffic selectors on the Standby are marked in down state.

Fixed Versions:
16.1.2

1031269 : TMM may consume excessive resources when processing logging profiles

Component: Local Traffic Manager

Symptoms:
Under certain conditions, TMM may consume excessive memory resources when using request logging profile with Respond On Error enabled.

Conditions:
- HTTP profile
- Request logging profile
- sys log server

Impact:
Under certain conditions, TMM may consume excessive memory resources potentially leading to performance degradation or a crash and failover event.

Workaround:
N/A

Fix:
TMM now processes log profiles as expected.

Fixed Versions:
16.1.2

1030845-1 : Time change from TMSH not logged in /var/log/audit

Links to More Info: BT1030845

Component: TMOS

Symptoms:
Whenever time is changed, the message is not logged in /var/log/audit

Conditions:
This occurs when the system time is changed manually using either the 'date' command or 'tmsh modify sys clock'.

Impact:
The time change is not logged to the audit log.

Workaround:
None

Fix:
Time changes are now logged to the audit log.

Fixed Versions:
14.1.4.5, 15.1.4.1, 16.1.2

1030689-1 : TMM may consume excessive resources while processing Diameter traffic

Component: Service Provider

Symptoms:
Under certain conditions, TMM may consume excessive resources while processing Diameter traffic

Conditions:
- Diameter/MRF is deployed
- Peer uses TCP or SCTP as a transport
- Peer sends slow response

Impact:
Excessive resource consumption potentially leading to performance degradation or a traffic interruption and failover event.

Workaround:
None

Fix:
Diameter traffic is now processed as expected.

Fixed Versions:
14.1.4.4, 15.1.4.1, 16.1.2

1029949-2 : IPsec traffic selector state may show incorrect state on high availability (HA) standby device

Links to More Info: BT1029949

Component: TMOS

Symptoms:
IPsec traffic selector state can be viewed in the config utility or by tmsh with the "tmsh show net ipsec traffic-selector" command. On an high availability (HA) standby device, some selector states may be incorrect.

Conditions:
-- High availability (HA) environment
-- Standby reboots or in some way, such as a tmm restart, is forced to re-learn all the mirrored IPsec security associations (SAs).

Impact:
There is no functional impact. The issue is that a selector may incorrectly appear down in one or both directions.

Workaround:
When the tunnel re-keys on the high availability (HA) active device, the selector state shows the correct value.

Fix:
IPsec traffic selectors show the correct state after the high availability (HA) standby device reboots.

Fixed Versions:
16.1.2

1029629-1 : TMM may crash while processing DNS lookups

Component: Global Traffic Manager (DNS)

Symptoms:
Under certain conditions, TMM may crash while processing DNS lookups.

Conditions:
TMM processing DNS lookups.

Impact:
TMM crash leading to a failover event.

Workaround:
N/A

Fix:
TMM now processes DNS lookups as expected.

Fixed Versions:
16.1.2

1028969-1 : An unused traffic-selector can prevent an IKEv2 IPsec tunnel from working

Links to More Info: BT1028969

Component: TMOS

Symptoms:
If both IKEv1 and IKEv2 try to listen to the same self IP address on the BIG-IP for a local tunnel IP address, only one can win, and previously a v2 ike-peer would be blocked if a v1 listener managed to get installed first.

If a partial tunnel config exists, with no ike-peer and only ipsec-policy and traffic-selector definitoins, this is understood to be IKEv1 implicitly, by default, and will install a v1 listener for the IP address and port.

Then if a fully configured ike-peer is added using IKEv2, it can fail to establish the required listener for v2 when an existing v1 listener is squatting on that IP address.

Conditions:
Conflict between IKEv2 and IKEv1 on the same IP address when:

-- a v2 ike-peer has local tunnel IP address X

-- a v1 ike-peer, or a traffic-selector with no peer at all, has the same local IP address X

Impact:
An IKEv2 tunnel can fail to negotiate when v2 packets cannot be received on a local IP address because a listener for IPsec cannot be established on that IP address.

Workaround:
You can avoid conflict between v1 and v2 by:

-- removing a traffic-selector not in use (which is v1)

-- avoiding use of the same local IP in both v1 and v2 definitions of ike-peer

Fix:
The fix gives precedence to IKEv2, so any pre-existing IKEv1 listener is simply removed from an IP address whenever a v2 listener is desired for that IP address.

This means IKEv1 can never be negotiated on a local IP address which is also in use by an IKEv2 ike-peer.

Importantly, this fix may cause tunnels to be permanently down after an upgrade. Prior to this change it was possible to have IKEv1 and IKEv2 tunnels working on the same self IP, but in that scenario some tunnels would intermittently fail to establish and the success of the tunnel establishment depended on whether the BIG-IP was the Initiator. IKEv1 and IKEv2 tunnels on the same self IP may still work after this change, but are not considered a valid or supported config by F5.

Fixed Versions:
16.1.2

1028773-1 : Support for DNS Over TLS

Links to More Info: BT1028773

Component: Global Traffic Manager (DNS)

Symptoms:
The BIG-IP system does not have support for DNS over TLS (DoT).

Conditions:
This is encountered if you wish to combine a clientssl profile with the dns profile on a virtual server.

Impact:
Performance is degraded.

Workaround:
None

Fix:
Clients can now initiate DNS over TLS requests to virtual servers that have the clientssl and dns profiles attached.

Fixed Versions:
16.1.2

1028669-7 : Python vulnerability: CVE-2019-9948

Component: TMOS

Symptoms:
Urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it

Conditions:
Use of urllib in affected versions of python

Impact:
Easier to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.

Workaround:
N/A

Fix:
Updated python to resolve CVE-2019-9948

Fixed Versions:
14.1.4.5, 15.1.4.1, 16.1.2

1028573-6 : Perl vulnerability: CVE-2020-10878

Component: TMOS

Symptoms:
Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation.

Conditions:
Crafted regular expression

Impact:
A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.

Workaround:
N/A

Fix:
Perl updated to address CVE-2020-10878

Fixed Versions:
14.1.4.5, 15.1.4.1, 16.1.2

1028497-7 : libexpat vulnerability: CVE-2019-15903

Component: TMOS

Symptoms:
In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read.

Conditions:
Crafted XML input

Impact:
Heap-based buffer over-read

Workaround:
N/A

Fix:
libexpat updated to address CVE-2019-15903

Fixed Versions:
14.1.4.5, 15.1.4.1, 16.1.2

1028109-1 : Detected attack signature is reported with the wrong context

Links to More Info: BT1028109

Component: Application Security Manager

Symptoms:
A detected attack signature on a multipart request may be reported with the wrong context.

Conditions:
Attack signature is detected in a multipart request.

Impact:
Reporting of the signature may contain the wrong context

Workaround:
None

Fix:
All detected signatures on multipart requests are reported with the correct context

Fixed Versions:
16.1.2

1027217-1 : Script errors in Network Access window using browser

Links to More Info: BT1027217

Component: Access Policy Manager

Symptoms:
1. Users may receive JavaScript errors in their browser when starting Network Access resources
2. User resources may fail to display when accessing a Full webtop
3. When logging out, users may be redirected to https://apm-virtual-server/vdesk/undefined and get a blank page
4. Logon Page from SWG Policies may fail to display inside a browser

Conditions:
The issue can be observed with at least one of these conditions.

1. Accessing APM virtual server using a browser
2. Accessing APM resources via a Full webtop
3. Starting APM resources via a Full webtop
4. Accessing Logon Page in SWG deployment

Impact:
1. Users cannot start Network Access resources
2. Users are unable to logout properly from full webtop
3. Logon page is not rendered and users will not be able to access resources.

Workaround:
1. Log into BIG-IP
2. mount -o remount,rw /usr/
3. Add "response_chunking 2" to _tmm_apm_portal_http in "/usr/lib/tmm/tmm_base.tcl" Example:

profile http _tmm_apm_portal_http {
    max_header_size 32768
    max_header_count 64
    known_methods "CONNECT DELETE GET HEAD LOCK OPTIONS POST PROPFIND PUT TRACE UNLOCK"
    response_chunking 2
}

4. Restart tmm once the above param is added.
5. Garbage values in JavaScript aren’t inserted after this change.
6. Remount the /usr directory as read-only.
  mount -o remount,ro /usr/
-------------------------

Fix:
Logon page is now rendered correctly, resources are properly displayed on webtop, users can start resources without JavaScript errors and users are no longer receiving blank pages upon logging out.

Fixed Versions:
15.1.4.1, 16.1.2

1026549-1 : Incorrect BIG-IP Virtual Edition interface state changes may be communicated to mcpd

Links to More Info: BT1026549

Component: TMOS

Symptoms:
For some BIG-IP Virtual Edition drivers, TMM may occasionally communicate an incorrect interface state change that might cause the interface to flap.

Conditions:
-- BIG-IP Virtual Edition using ixlv, ixvf, mlx5, or xnet drivers.
-- More TMMs and interfaces configured make this issue more likely to happen, but it happens randomly.

Impact:
In the case where the interface is part of a trunk a flap will occur when this happens.

There may be other as-yet unknown impacts for this issue.

Workaround:
Use a different VE driver than one of the ones listed above.

Fix:
BIG-IP Virtual Edition drivers no longer communicate incorrect interface states to mcpd.

Fixed Versions:
14.1.4.5, 15.1.4.1, 16.1.2

1025529-2 : TMM generates core when iRule executes a nexthop command and SIP traffic is sent

Links to More Info: BT1025529

Component: Service Provider

Symptoms:
If an iRule uses the 'nexthop' command to select a VLAN for a virtual server, TMM may crash.

Conditions:
-- Virtual server with SIP profile and iRule that executes a 'nexthop' command
-- SIP network traffic occurs

Impact:
Traffic disrupted while TMM restarts.

Workaround:
Avoid using 'nexthop vlan' in an iRule in a SIP environment.

Fix:
iRule creation does not cause any TMM core.

Fixed Versions:
14.1.4.5, 15.1.4.1, 16.1.2.1

1024761-1 : HTTP adds Transfer-Encoding and terminating chunk to responses that cannot have a body

Links to More Info: BT1024761

Component: Local Traffic Manager

Symptoms:
When rechunking is requested, HTTP responses with methods or status codes indicating that no body be present (like HEAD or 304) are receiving a Transfer-Encoding header and a terminating chunk. These responses should not have a body of any sort.

Conditions:
HTTP virtual server with rewrite profile present with the server that does HTTP caching.

Impact:
HTTP clients are unable to connect.

Workaround:
Remove the rewrite profile.

Possibly change http profile response-chunking from sustain to unchunk. This resolves the issue for the 304, but means that all other requests are changed from either chunking or unchunked with Content-Length header to unchunked without Content-Length and with "Connection: Close".

Fixed Versions:
16.1.2.1

1024101-1 : SWG as a Service license improvements

Links to More Info: BT1024101

Component: Access Policy Manager

Symptoms:
SWG sessions maxed out and the SWG license is not released until the APM session is ended.

Conditions:
SWG and APM are in use.

Impact:
SWG sessions are tied to APM sessions and can reach the limit and not be recycled even if the APM session is not actively using SWG.

Workaround:
None

Fix:
Fixed an issue with SWG session tracking.

Fixed Versions:
16.1.1

1023437-1 : Buffer overflow during attack with large HTTP Headers

Component: Anomaly Detection Services

Symptoms:
When the HTTP Headers are larger than 1024 characters and one of the anomalous textual headers is located after 1024, a buffer overflow might occur.

Conditions:
HTTP or TLS Signature protection is activated and during attack anomalous request arrives.

Impact:
Most of the time results in bad characters in the signature name, more rarely results in Memory Access Violation which could be exploited as buffer overflow attack.

Fix:
Enforce HTTP metadata size limit to be within the first 1024 characters of the HTTP Headers payload.

Fixed Versions:
14.1.4.5, 16.1.2.1

1023365-2 : SSL server response could be dropped on immediate client shutdown

Links to More Info: BT1023365

Component: Local Traffic Manager

Symptoms:
SSL server response might be dropped if peer shutdown arrives before the server response

Conditions:
-- the virtual server is using a Server SSL profile
-- the client sends FIN/ACK before the server responds

Impact:
The response from the pool member may be dropped.

Workaround:
None.

Fix:
Serverssl response now received after peer shutdown

Fixed Versions:
15.1.4.1, 16.1.2

1023341-1 : HSM hardening

Component: Local Traffic Manager

Symptoms:
Under certain conditions, HSM interactions do not follow current best practices.

Conditions:
- HSM in use

Impact:
Certain HSM interactions do not follow current best practices.

Workaround:
N/A

Fix:
HSM interactions now follow current best practices.

Fixed Versions:
16.1.1

1022757-2 : Tmm core due to corrupt list of ike-sa instances for a connection

Links to More Info: BT1022757

Component: TMOS

Symptoms:
Tmm generates a core when a corrupt list of ike-sa instances is processed.

Conditions:
Deletion of an expired ike-sa.

Impact:
Restart of tmm and re-negotiation of IPsec tunnels. Traffic disrupted while tmm restarts.

Workaround:
None

Fix:
The internal list data structure has been reorganized to use fewer entities in less-complex relationships. This makes it less likely for a corrupted list to occur, so this issue is less likely to occur.

Fixed Versions:
16.1.2

1022625-2 : Profile type 'swg-transparent' should be selected on create page when 'create-new' is selected for SwgAsService in SSL Orchestrator

Links to More Info: BT1022625

Component: Access Policy Manager

Symptoms:
When creating a new service, certain default access profiles are not automatically selected.

Conditions:
1. SSL Orchestrator + APM + SWG provisioned
2. Select 'create-new' for access profile drop-down when adding a SwgAsService in SSL Orchestrator

A new tab opens with the profile creation page, but the access profile type drop-down does not have any type selected.

Impact:
When adding a SwgAsService in SSL Orchestrator, the only supported access profile type is SWG-Transparent, hence it should be automatically selected.

Workaround:
None

Fix:
Fixed an issue with automatic profile selection.

Fixed Versions:
16.1.1

1022417-1 : Ike stops with error ikev2_send_request: [WINDOW] full window

Links to More Info: BT1022417

Component: TMOS

Symptoms:
IKE SAs will be lost.

Conditions:
A failover occurs while IKE is sending DPD to the peer, and the reply is received by the newly active BIG-IP.

Multiple failovers can increase the likelihood that this occurs.

Impact:
IKE SAs may be deleted and there will be traffic loss.

Workaround:
Increase in DPD interval to reduce the probability of occurrence of the issue.

Fix:
Fixed an issue where IKE SAs were being lost during failover events.

Fixed Versions:
16.1.2

1022269-1 : False positive RFC compliant violation

Links to More Info: BT1022269

Component: Application Security Manager

Symptoms:
False positive RFC compliant violation.

Conditions:
Authorization header with specific types.

Impact:
False positive violations.

Workaround:
Turn on an internal parameter:
 
/usr/share/ts/bin/add_del_internal add ignore_authorization_header_decode_failure 1

Fix:
Added tolerance to the authorization headers parser.

Fixed Versions:
14.1.4.4, 15.1.4, 16.1.2

1021773-1 : Mcpd core

Links to More Info: BT1021773

Component: TMOS

Symptoms:
Mcpd crashes and leaves a core file.

Conditions:
This can occur if BIG-IP fails to allocate huge pages, which can occur during module provisioning.

Impact:
Mcpd crashes and the system goes into an inoperative state.

Fixed Versions:
16.1.2

1021713-1 : TMM may crash when processing AFM NAT64 policy

Component: Local Traffic Manager

Symptoms:
TMM may crash or become unstable after producing the error:

Enabling NAT64 for virtual server (/Common/test) with security NAT policy configured is redundant/not required.

Conditions:
Either of the following configurations:

-- NAT64 enabled and AFM NAT64 policy attached.
-- security-nat-policy attached and NAT64 disabled.

Impact:
TMM may crash, leading to a traffic interruption and failover event.

Workaround:
N/A

Fix:
The system now handles these configurations.

Fixed Versions:
16.1.2

1021485-3 : VDI desktops and apps freeze with Vmware and Citrix intermittently

Links to More Info: BT1021485

Component: Access Policy Manager

Symptoms:
VMware VDI:
Blank screen is seen while opening remote desktop when VDI is configured with VMware.

Citrix:
Desktop freezes immediately after opening remote desktop when VDI is configured with Citrix.

Conditions:
VMware VDI:
-- VDI is configured with VMware
-- Desktop or App is launched using native client from Webtop.
wait till 2X inactivity timeout if inactivity timeout

Citrix:
-- VDI is configured with Citrix
-- Desktop or App is launched using native client from Webtop.
-- Configure Inactivity timeout to 0.

Impact:
VDI desktops freeze while opening or immediately after opening.
The following error is seen in APM logs:
"Session stats update failed: ERR_NOT_FOUND"

Workaround:
No

Fix:
Users should not experience any intermittent desktop freeze.

Fixed Versions:
14.1.4.5, 15.1.4.1, 16.1.2

1021481-1 : 'http-tunnel' and 'socks-tunnel' which are internal interfaces should be hidden

Links to More Info: BT1021481

Component: Local Traffic Manager

Symptoms:
The Linux command 'ifconfig' or 'ip a' shows two devices 'http-tunnel' and 'socks-tunnel' that are for TMM internal use only.

Conditions:
These interfaces show up regardless of the BIG-IP configuration.

Impact:
As long as these devices are not used there is no impact aside from possibly causing confusion. Any attempt to use those devices from a host process fails or produces unpredictable results. These devices should not be exposed on the Linux host.

Workaround:
None.

Fix:
The devices 'http-tunnel' and 'sock-tunnel' no longer show up on the Linux host.

Fixed Versions:
16.1.2

1021417-1 : Modifying GTM pool members with replace-all-with results in pool members with order 0

Links to More Info: BT1021417

Component: Global Traffic Manager (DNS)

Symptoms:
GTMpool has multiple members with order 0.

Conditions:
There is an overlap for the pool members for the command replace-all-with and the pool members to be replaced.

Impact:
Multiple pool members have the same order.

Workaround:
Perform this procedure:
1. Delete all pool members from the GTM pool.
2. Use replace-all-with.

Fixed Versions:
14.1.4.5, 15.1.4.1, 16.1.2

1021061-4 : Config fails to load for large config on platform with Platform FIPS license enabled

Links to More Info: BT1021061

Component: Global Traffic Manager (DNS)

Symptoms:
Config fails to load.

Conditions:
-- Platforms with Platform FIPS license enabled.
-- There are several ways to encounter this. One is with a large GTM (DNS) configuration that requires extending the gtmd stats file.

Impact:
Config file fails to load. For the gtmd configuration, gtmd repeatedly logs error messages similar to:

err gtmd[14954]: 011af002:3: TMSTAT error 'Invalid argument' creating row '/Common/vs_45_53' in table 'gtm_vs_stat'

For merged daemon, reports messages similar to:
err merged[9166]: 011b0900:3: TMSTAT error tmstat_row_create: Invalid argument.

Workaround:
None

Fixed Versions:
14.1.4.5, 16.1.2.1

1020957-1 : HTTP response may be truncated by the BIG-IP system

Links to More Info: BT1020957

Component: Local Traffic Manager

Symptoms:
Web pages are not rendered properly; HTTP responses are truncated when traversing the BIG-IP system.

Conditions:
-- Virtual server with an HTTP profile
-- HTTP server generates a compressed response
-- BIG-IP system determines that it must decompress the payload, e.g., a rewrite profile attached to the virtual server

Impact:
HTTP responses are truncated when passing through the BIG-IP system.

Workaround:
One of the following:

-- Add an HTTP Compression profile to the virtual server, and ensure that 'Keep Accept-Encoding' is not selected.
-- Use an iRule to remove the Accept-Encoding header from requests, e.g.:

ltm rule workaround {
    when HTTP_REQUEST {
        HTTP::header remove Accept-Encoding
    }
}

Fixed Versions:
16.1.2

1020705-2 : tmsh show analytics dos-l3 report view-by attack-id" shows "allowed-requests-per-second" instead "attack_type_name

Links to More Info: BT1020705

Component: Application Visibility and Reporting

Symptoms:
Output of "tmsh show analytics dos-l3 report view-by attack-id" command has changed from version 13.x to 15.x. "Attack type" was removed from the system, so it was automatically replaced by the first metric "allowed-requests-per-second". For DOS L3 "Attack type" was replaced by "Vector Name" but it currently is not shown in the report along wit "Attack ID"

Conditions:
AFM is provisioned

Impact:
This change might cause scripts to fail if they use the name of the field.

Workaround:
1) edit /etc/avr/monpd/monp_dosl3_entities.cfg file. Change [dosl3_attack_id] section the following way: add 'vector_name' to measures list and add an additional parameter 'default_measure' as specified below :

[dosl3_attack_id]
...
measures=allowed_requests_per_sec,count,drop_per_sec,drop_count,total_per_sec,total_count,attacks_count,attack_type_name,category_name,vip_name,period,vector_name
default_measure=vector_name
...

2) edit /etc/avr/monpd/monp_dosl3_measures.cfg file. Add in the end the following section:

[vector_name]
id=vector_crc
formula=IF(count(distinct FACT.vector_crc)>1,'Aggregated',attack_vector_str)
merge_formula=IF(count(distinct vector_name)>1,'Aggregated',vector_name)
dim=AVR_DIM_DOS_VIS_ATTACKS_VECTOR
dim_id=attack_vector_crc
tmsh_display_name=vector-name
display_name=Vector
comulative=false
priority=65

3) restart the BIG-IP system: bigstart restart

After the system is up you can apply the same tmsh command: "tmsh show analytics dos-l3 report view-by attack-id"
You will get a result similar to 13.x. Note that "attack_type_name" is replaced by "vector-name"

Fix:
Workaround applied as fix.

Fixed Versions:
14.1.4.4, 15.1.3.1, 16.1.2

1020377-1 : Missing IKEv2 listeners can send IKE packets to the IKEv1 racoon daemon

Links to More Info: BT1020377

Component: TMOS

Symptoms:
If an IKEv2 tunnel terminates with an error condition, afterward it is possible for IKE packets to be received by the IKEv1 racoon daemon, which is listening to local host (i.e 127.0.0.1) on ports 500 and 4500.

Conditions:
To get the problem to occur, you may need these details:

-- an IKEv2 config where traffic selector narrowing happens
-- termination of an IKEv2 tunnel with an error condition
-- some other BIG-IP service using the same local self IP

Packets can reach the IKEv1 racoon daemon only when some BIG-IP service uses bigself as the proxy, which forwards packets to localhost (127.0.0.1) with the same port number. So even if no IKEv1 config is present for a local self IP, if some other BIG-IP service also uses bigself as a proxy, this can forward IKE packets to localhost as well.

Impact:
The IKEv2 tunnel does not get renegotiated, because IKE packets reach the IKEv1 daemon, which ignores them, because the proper listener to handle IKEv2 is missing. As a result, tunnel service is interrupted.

Workaround:
Deleting and re-adding the problematic ike-peer and traffic-selector should bring back IPsec support for that tunnel.

If the initiating and responding sides of the tunnel have identical traffic-selector proposals, then narrowing should not happen, and this would also prevent the problem in the first place.

Fix:
BIG-IP systems now manage and handle multiple references to the same listener in a more rigorous way, so the IKEv2 listener cannot go away while it is still needed.

Fixed Versions:
16.1.2

1019853-1 : Some signatures are not matched under specific conditions

Component: Application Security Manager

Symptoms:
Some signatures are not matched, attacking traffic may pass through.

Conditions:
- Undisclosed signature conditions

Impact:
Attacking traffic can bypass the WAF.

Workaround:
N/A

Fix:
Signatures are now matched as expected.

Fixed Versions:
14.1.4.5, 15.1.4.1, 16.1.2

1019829-2 : Configsync.copyonswitch variable is not functioning on reboot

Links to More Info: BT1019829

Component: TMOS

Symptoms:
Configsync.copyonswitch variable is not functioning properly during reboot to another partition

Conditions:
-- db variable configsync.copyonswitch modified
-- hostname is changed in global-settings
-- reboot to another partition

Impact:
The hostname will be changed back to the default hostname after reboot

Fixed Versions:
16.1.1

1019609-1 : No Error logging when BIG-IP's IP address is not added in client list on netHSM★

Component: Local Traffic Manager

Symptoms:
"Ensure BIG-IP's IP address is added to the client list"
error log is not displayed, despite the BIG-IP not being added to the client list in Thales/nShield/Entrust HSM

Conditions:
BIG-IP is not added to the client list in Thales/nShield/Entrust HSM

Impact:
Difficult to debug the error condition to due lack of error message

Workaround:
None

Fix:
Grep error text information on stderror stream to work.

Fixed Versions:
16.1.2.1

1018577-4 : SASP monitor does not mark pool member with same IP Address but different Port from another pool member

Links to More Info: BT1018577

Component: Local Traffic Manager

Symptoms:
When the LTM SASP monitor is applied to a pool with multiple members having the same IP Address but different Ports, only one of the pool members with the duplicated IP Address will be monitored (marked UP or DOWN as appropriate). Other pool members sharing the same IP Address will remain in a 'checking' state.

Conditions:
This occurs when using the SASP monitor in a pool with multiple members having the same IP Address but different Ports.
For example:
ltm pool sasp_test_pool {
    members {
        sasp_1:80 {
            address 10.10.10.1
        }
        sasp_1:8080 {
            address 10.10.10.1
        }
        sasp_2:80 {
            address 10.10.10.2
        }
        sasp_2:8080 {
            address 10.10.10.2
        }
    }
    monitor sasp_test
}

In this case, only one pool member with a given IP Address will be correctly monitored by the sasp monitor.
Any additional pool members with the same IP Address but different port will not be monitored by the SASP monitor and will remain in a 'checking' state.

Impact:
Not all pool members may be effectively/accurately monitored by the SASP monitor.

Fix:
The ltm sasp monitor correctly monitors members of a pool which share the same IP Address but different Ports.

Fixed Versions:
14.1.4.5, 15.1.4.1, 16.1.2

1018493-1 : Response code 304 from TMM Cache always closes TCP connection.

Links to More Info: BT1018493

Component: Local Traffic Manager

Symptoms:
When a virtual server is configured to accelerate HTTP traffic, it caches responses with 200 and 304 response codes. Serving a response with "304 Not Modified" code, TMM may close a connection to a client.

Conditions:
-- A virtual server has a web-acceleration profile (without a web application for versions prior 16.0.0).
-- A response with code 304, stored in TMM cache, is served to a request.

Impact:
A client needs to open a new TCP connection every time when a response with "304 Not Modified" code is served.

Fix:
TMM correctly serves a response with "304 Not Modified" code, allowing to correctly handle TCP connection status.

Fixed Versions:
14.1.4.5, 15.1.4, 16.1.2

1018309-5 : Loading config file with imish removes the last character

Links to More Info: BT1018309

Component: TMOS

Symptoms:
While loading a configuration from the file with IMISH ('imish -f <f_name>'),truncating the last line.

printf 'log file /var/log/zebos.log1' >/shared/tmp/new.cfg
Running imish -r 0 -f /shared/tmp/new.cfg have the last character missing like below:
log file /var/log/zebos.log

Conditions:
Loading a config with 'imish -f <f_name>' commands.

Note: This command is used with the bigip_imish_config Ansible module.

Impact:
Configuration commands cannot be created properly.

Workaround:
For CLI, use extra control char at the end or \n.

Fixed Versions:
15.1.4.1, 16.1.1

1018285-2 : MRF DIAMETER to select automatic removal of a persistence entry on completion of a transaction

Links to More Info: BT1018285

Component: Service Provider

Symptoms:
MRF DIAMETER is not DIAMETER-application aware. It does not have application-specific business logic. When creating a DIAMETER solution, BIG-IP operators often need to write iRule scripts that remove a session persistence entry at the end of a transaction.

Conditions:
Some applications require removal of the persistence entry upon successful and unsuccessful completion of a transaction.

root@(bigip1)(cfg-sync Standalone)(Active)(/Common)(tmos)# list ltm rule log_dia_error
ltm rule log_dia_error {
when DIAMETER_INGRESS {
set cmd_code [DIAMETER::command]
if { $cmd_code == 272 } {
    set cc_req_type [DIAMETER::avp data get 416 integer32]
    if {[DIAMETER::is_response] && $cc_req_type == 3 } {
       log local0. "Persistence record delete-on-any"
       DIAMETER::persist delete-on-any
    }
 }
}

Impact:
iRule script is required.

Fix:
DIAMETER::persist irule are supported to remove a persistence entry based on the result status of a answer message.
below irule commands are supported.
DIAMETER::persist delete-on-any
DIAMETER::persist delete-on-success
DIAMETER::persist delete-on-failure
DIAMETER::persist delete-none

Fixed Versions:
15.1.4.1, 16.1.2

1018145 : Firewall Manager user role is not allowed to configure/view protocol inspection profiles

Links to More Info: BT1018145

Component: Protocol Inspection

Symptoms:
A user account with the "firewall-manager" role that is assigned permissions only to custom partitions will not be able to configure protocol inspection profiles.

Conditions:
-- A user account is created with the role firewall-manager.
-- A custom partition is created.
-- The newly created user is given access to the newly created partition.

Impact:
Any user account without access to "/Common" partition is not allowed to configure protocol inspection profiles.

Workaround:
- If the user account is provided access to "/Common" partition as well, the user should be able to configure protocol-inspection profiles in the newly created custom partitions.

Fix:
The permissions are granted for any non-admin user to configure protocol inspection profiles in a custom partition as long as they have access to "/Common" partition as well.

Fixed Versions:
15.1.4, 16.1.1

1017513-5 : Config sync fails with error Invalid monitor rule instance identifier

Links to More Info: BT1017513

Component: Local Traffic Manager

Symptoms:
If you remove or attach a different monitor to an fqdn pool, then perform a full config-sync, an error occurs:

Load failed from /Common/bigip1 01070712:3: Caught configuration exception (0), Invalid monitor rule instance identifier: 58.

Conditions:
-- BIG-IP device is configured with fqdn nodes/pools with monitors.
-- Modify an fqdn pool to remove or attach a different monitor.
-- Run the command: run cm config-sync to-group Failover
-- Perform a full config-sync.

Impact:
Sync to the peer device(s) fails.

Workaround:
Use incremental-sync.

Fixed Versions:
14.1.4.5, 16.1.2.1

1017233-2 : APM uses wrong session key when iRule for ActiveSync is used resulting in passwords corruption

Links to More Info: BT1017233

Component: Access Policy Manager

Symptoms:
A corrupted password is sent as part of the "Authorization" header to the backend device and as a result, http 404 is returned

Conditions:
-- iRule for ActiveSync is used
-- The BIG-IP system has multiple tmms running

Impact:
User Authentication is failed by the backed server

Fixed Versions:
15.1.4.1, 16.1.2

1017153-4 : Asmlogd suddenly deletes all request log protobuf files and records from the database.

Links to More Info: BT1017153

Component: Application Security Manager

Symptoms:
Asmlogd suddenly deletes all request log protobuf files and records from the database.

Additionally, after the deletion happens, newly generated event logs seen in database do not show up in TMUI.

Conditions:
-- ASM provisioned
-- Config-sync setup, with frequent sync recovery and/or with a manual-sync device-group with ASM sync enabled.

Impact:
Sudden loss of request logs.

Workaround:
Delete all empty partitions and restart asmlogd.

1) View all the partitions:

   # perl -MF5::Db::Partition -MData::Dumper -MF5::DbUtils -e 'print Dumper(F5::Db::Partition::retrieve_partitions_info(dbh => F5::DbUtils::get_dbh(), table_name => "PRX.REQUEST_LOG"))'

Take note of the 'PARTITION_NAME' and 'TABLE_ROWS' for each partition.

2) For every partition_X (in PARTITION_NAME) with '0' in TABLE_ROWS, delete it by:

   # perl -MF5::Db::Partition -MF5::DbUtils -e 'F5::Db::Partition::delete_partition(dbh => F5::DbUtils::get_dbh(), table_name => "PRX.REQUEST_LOG", partition_name => "partition_X")'

3) restart asmlogd if and after done all deletes:

   # pkill -f asmlogd

NOTE: this workaround is temporary. Meaning, that the number of empty partitions will again accumulate and the same issue will happen again. The MAX number of partitions is - 100. Thus, it is advised to monitor the total number of *empty* partitions and repeat the workaround periodically. A cron script should work well. Normally, empty partitions should NOT accumulate. Thus, it is safe to run this script once an hour and remove all empty partitions.


Optionally, if you are having TMUI issue with newly generated event logs, perform the additional command below to delete rows from PRX.REQUEST_LOG_PROPERTIES for which no corresponding rows exist in PRX.REQUEST_LOG.

# mysql -t -u root -p$(perl -MPassCrypt -nle 'print PassCrypt::decrypt_password($_)' /var/db/mysqlpw) -e 'delete from PRX.REQUEST_LOG_PROPERTIES where request_log_id > (select id from PRX.REQUEST_LOG order by id desc limit 1)'

Fix:
Upgrading to a fixed software version will not delete accumulated partitions and will not clear the symptom away. The fix will prevent ASM from accumulating partitions unnecessarily in the scenarios.

If your ASM system is experiencing this and partitions are accumulated, perform the workaround to clear the symptom. Using a fixed software version, you only need to perform the workaround once. You no longer have to perform it periodically.

Fixed Versions:
14.1.4.5, 15.1.4.1, 16.1.2

1016113-1 : HTTP response-chunking 'sustain' profile option may not rechunk responses when also using a web acceleration profile.

Links to More Info: BT1016113

Component: Local Traffic Manager

Symptoms:
Configurations containing HTTP response-chunking 'sustain' and a Web Acceleration profile do not rechunk payload regardless of whether the web server responds with a chunked response.

Conditions:
-- Incoming response payload to the BIG-IP system is chunked.
-- HTTP profile is configured with response-chunking 'sustain'.
-- Web Acceleration profile also configured on the same virtual server.

Impact:
The BIG-IP response is not chunked, regardless of whether the associated web server responds with a chunked payload when the Web Acceleration is utilized.

Workaround:
For a chunked response to be delivered to the client, apply the iRule command 'HTTP::rechunk' to responses when a Web Acceleration profile is used.

Fix:
The BIG-IP response is chunked appropriately when a Web Acceleration profile is used.

Fixed Versions:
15.1.4, 16.1.2

1015645-2 : IPSec SA's missing after reboot

Links to More Info: BT1015645

Component: TMOS

Symptoms:
Some IPSec SA's created after Tunnel migration may be missing after a reboot.

Conditions:
- IPSec tunnels
- Load balancing continues through tunnel migration
- The active BIG-IP system is rebooted

Impact:
Some IPSec SA's may be missing after the reboot

Workaround:
None

Fix:
During reboot, Load balancing information is loaded based on creation time instead of arrival time.

Fixed Versions:
16.1.2

1015133-5 : Tail loss can cause TCP TLP to retransmit slowly.

Links to More Info: BT1015133

Component: Local Traffic Manager

Symptoms:
If a long tail loss occurs during transmission, TCP might be slow to recover.

Conditions:
-- A virtual server is configured with the TCP profile attached.
-- SACK and TLP are enabled.
-- A tail loss of multiple packets sent by the BIG-IP occurs.

Impact:
BIG-IP retransmits one packet per RTT, causing a long recovery. The impact is more pronounced if an entire window is lost.

Workaround:
Disabling TLP may improve performance in this particular case, but may degrade performance in other situations.

Fix:
A new sys db key was added: tm.tcpaggressivepartialack (disabled by default). When enabled, more data is retransmitted every RTT, similar to slow-start.

Behavior Change:
A new sys db key was added: tm.tcpaggressivepartialack (disabled by default). When enabled, more data is retransmitted every RTT, similar to slow-start.

Fixed Versions:
14.1.4.5, 16.1.2.1

1013629-4 : URLCAT: Vulnerability Scan finds many Group/User Read/Write (666/664/662) files

Links to More Info: BT1013629

Component: Traffic Classification Engine

Symptoms:
Shared memory files in relation with URLCAT have file permissions set to (-rwxrwxrwx), which is not necessary and needs to be restricted to (-rw-rw-r--).

Conditions:
Performing a Vulnerability Scan on shared memory files in relation with URLCAT.

Impact:
Full permission can result in unintentional/unauthorized access, which could result in unexpected behavior of the URLCAT feature.

Workaround:
Manually change permissions from (-rwxrwxrwx) to (-rw-rw-r--) using the chmod command.

Fix:
Shared Memory file permissions are now set to (-rw-rw-r--).

Fixed Versions:
16.1.2

1013569-1 : Hardening of iApps processing

Component: Guided Configuration

Symptoms:
Under certain conditions, iApps do not follow current best practices.

Conditions:
- iApps in use

Impact:
iApps do not follow current best practices.

Workaround:
N/A

Fix:
iApps now follow current best practices.

Fixed Versions:
15.1.4, 16.1.1

1012721-4 : Tmm may crash with SIP-ALG deployment in a particular race condition

Links to More Info: BT1012721

Component: Service Provider

Symptoms:
Tmm crashes in SIP-ALG deployment

Conditions:
--- SIP-ALG is deployed
--- While processing first SIP REGISTER at server-side

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

Fix:
Tmm no longer crashes in this race condition

Fixed Versions:
14.1.4.4, 15.1.4.1, 16.1.1

1012365-4 : Nettle cryptography library vulnerability CVE-2021-20305

Links to More Info: K33101555, BT1012365

1011065-1 : Certain attack signatures may not match in multipart content

Component: Application Security Manager

Symptoms:
Under certain conditions, ASM may not correctly detect attack signatures.

Conditions:
- ASM provisioned
- Request contains multipart body that matches specific attack signatures.

Impact:
Attack detection is not triggered as expected.

Workaround:
None

Fix:
Attack detection is now triggered as expected.

Fixed Versions:
15.1.4.1, 16.1.2

1011061-4 : Certain attack signatures may not match in multipart content

Component: Application Security Manager

Symptoms:
Under certain conditions, ASM may not correctly detect attack signatures.

Conditions:
- ASM provisioned
- Request contains a specially-crafted multipart body

Impact:
Attack detection is not triggered as expected.

Workaround:
None

Fix:
Attack detection is now triggered as expected.

Fixed Versions:
14.1.4.5, 15.1.4.1, 16.1.2

1009949-4 : High CPU usage when upgrading from previous version★

Links to More Info: BT1009949

Component: TMOS

Symptoms:
When upgrading version from 12.x to 14.1.4, ospfd has high cpu utilization.

Conditions:
-- OSPF is enabled.
-- The BIG-IP system is upgraded from 12.x to 14.1.4.

Impact:
Performance Impact.

Fixed Versions:
14.1.4.4, 15.1.4.1, 16.1.2

1009725-1 : Excessive resource usage when ixlv drivers are enabled

Component: TMOS

Symptoms:
TMM may consume excessive resources while processing traffic on VE deployments with ixlv drivers.

Conditions:
- BIG-IP VE
- ixlv drivers.

Impact:
Excessive resource consumption, potentially leading to delayed traffic processing.

Workaround:
Disable TCP Segmentation Offload:

tmsh modify sys db tm.tcpsegmentationoffload value disable

Then restart TMM:

bigstart restart TMM

Note that restarting TMM will cause the BIG-IP to stop processing traffic (and failover, if it is in a device cluster).

Fix:
TMM now processes VE traffic as expected

Fixed Versions:
14.1.4.5, 15.1.4.1, 16.1.2

1009093-2 : GUI widgets pages are not functioning correctly

Links to More Info: BT1009093

Component: Application Visibility and Reporting

Symptoms:
Some links and drop-down fields are not available for 'pressing/clicking' on AVR-GUI widgets pages

Conditions:
AVR/ASM is provisioned

Impact:
Cannot use AVR GUI pages correctly

Workaround:
1. Back up the following file, and then edit it:
/var/ts/dms/amm/templates/overview.tpl

1.a. Remove the following line:
<script type="text/javascript" src="script/analytics_stats.js{{BIGIP_BUILD_VERSION_JS}}"></script>

1.b. Add the following lines after the 'var _default_smtp = '{{smtp_mailer}}';' line:
$(document).ready(function() {
        if(!window.AVR_LOCALIZATION) return;
        $('.need-localization-avr').each(function() {
            var item = $(this);
            if (item.is("input")) {
                var key = "avr." + item.val().replace(/\s/g, '');
                item.val(window.AVR_LOCALIZATION[key] || item.val());
            } else {
                var key = "avr." + item.text().replace(/\s/g, '');
                item.text(window.AVR_LOCALIZATION[key] || item.text());
            }
        }).removeClass('need-localization-avr');
    });

1.c. Save and exit (might require the 'force' save with root user).

2. Log out of the GUI.
3. Log back in.

Fix:
GUI widgets pages now function correctly.

Fixed Versions:
16.1.2.1

1009037-1 : Tcl resume on invalid connection flow can cause tmm crash

Links to More Info: BT1009037

Component: Global Traffic Manager (DNS)

Symptoms:
Tmm crashes.
Tmm logs contain a line that looks like: "Oops @ 0x2bbd463:139: Unallocated flow while polling for rule work. Skipping."

Conditions:
1) iRule uses a function that may suspend iRule processing (see https://support.f5.com/csp/article/K12962 for more about this).
2) The connflow associated with the iRule is being torn down by tmm.
3) Depending upon the exact timing there is a rare chance that the iRule will resume on the wrong connflow which can cause a core.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

Fixed Versions:
14.1.4.5, 15.1.4.1, 16.1.2

1008561-4 : In very rare condition, BIG-IP may crash when SIP ALG is deployed

Component: Service Provider

Symptoms:
Under certain conditions, BIG-IP may crashes while processing SIP ALG traffic

Conditions:
- SIP ALG is deployed
- Inbound call received

Impact:
TMM crash leading to a failover event. Traffic is interrupted during BIG-IP restart

Workaround:
N/A

Fix:
BIG-IP now processes SIP ALG traffic as expected

Fixed Versions:
14.1.4.4, 15.1.4, 16.1.1

1008017-2 : Validation failure on Enforce TLS Requirements and TLS Renegotiation

Links to More Info: BT1008017

Component: Local Traffic Manager

Symptoms:
The configuration load fails with an error:

err mcpd[4182]: 0107186b:3: Invalid "enforce-tls-requirements" value for profile /prod/my_profile. In Virtual Server (/common/my_virtual_server) an http2 profile with enforce-tls-requirements enabled is incompatible with client-ssl/server-ssl profile with renegotiation enabled. Value must be disabled.

Conditions:
BIG-IP system allows this configuration and fails later:

-- Virtual server with HTTP/2, HTTP, and client SSL profiles (with renegotiation disabled).

1. Enable the 'Enforce TLS Requirements' option in the HTTP/2 profile (by default it is enabled).
2. Add server SSL profile with 'TLS Renegotiation' enabled.
3. Save the configuration.
4. Load the configuration.

Impact:
The configuration will not load if saved.

Workaround:
If enabling 'Enforce TLS Requirements' in a HTTP/2 profile configured on a virtual server, ensure that 'TLS Renegotiation' is disabled in the Server SSL profiles on that virtual server.

Fix:
There is now a validation check to prevent this configuration, which is the correct functionality.

Fixed Versions:
14.1.4.5, 15.1.4.1, 16.1.2

1007821-3 : SIP message routing may cause tmm crash

Links to More Info: BT1007821

Component: Service Provider

Symptoms:
In very rare circumstances, tmm may core while performing SIP message routing.

Conditions:
This can occur while passing traffic when SIP message routing is enabled.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

Fix:
SIP message routing no longer results in a core due to internal memory errors in message parsing.

Fixed Versions:
15.1.4, 16.1.1

1007749-2 : URI TCL parse functions fail when there are interior segments with periods and semi-colons

Links to More Info: BT1007749

Component: Local Traffic Manager

Symptoms:
URI::path, URI::basename, etc., return the wrong strings, e.g., URI::path can return a subset of what it should return.

Conditions:
This happens for URIs like these:
   /alpha/beta/Sample.text;param/trailer/
   /alpha/beta/Sample.text;param/file.txt

Impact:
iRules fail to work as expected for these types of URIs.

This occurs because the combination of the period and semi-colon in 'Some.thing;param' confuses the BIG-IP system parser, causing incorrect results to be returned.

Workaround:
If this is happening for known URIs, then it should be possible to process those URIs in a special way within iRules to do things like temporarily replacing interior periods with another character, like a plus sign.

Fixed Versions:
16.1.2.1

1007677-2 : Artifact resolution on SAML IdP fails with error 'SAML SSO: Cannot find SP connector'

Links to More Info: BT1007677

Component: Access Policy Manager

Symptoms:
SAML fails on APM SAML IdP after receiving the SAML ArtifactResolve Request, and needs to extract Artifact data from sessionDB to build the assertion. An error is logged:

-- err tmm[24421]: 014d1211:3: ::ee23458f:SAML SSO: Cannot find SP connector (/Common/example_idp)
-- err tmm[24421]: 014d0002:3: SSOv2 plugin error(12) in sso/saml.c:11864

Conditions:
The 'session-key' in the sessiondb includes a colon ':' in its value.

Impact:
SAML may fail on APM SAML IdP using artifact binding.

Fix:
The system now handles this occurrence of 'session-key'.

Fixed Versions:
15.1.4.1, 16.1.2.1

1007489-7 : TMM may crash while handling specific HTTP requests★

Component: Local Traffic Manager

Symptoms:
BIG-IP system crashes while handling some HTTP requests

Conditions:
-- HTTP Security profile is added
-- HTTP Proxy Connect profile is added
-- HTTP Virtual Server

Impact:
Traffic disrupted while TMM restarts.

Workaround:
N/A

Fix:
TMM no longer crashes when handling some HTTP requests.

Fixed Versions:
14.1.4.5, 15.1.4.1, 16.1.2

1007113-3 : Pool member goes DOWN if the time difference between SCTP INIT and SCTP ABORT is less than two seconds

Links to More Info: BT1007113

Component: Service Provider

Symptoms:
In case of diameter over SCTP, while aborting the connection of the pool member, if SCTP INIT is sent by the BIG-IP system before the SCTP ABORT is processed, the pool member is marked UP (provided the SCTP connection is established successfully), and then goes down later, immediately after ABORT is fully processed.

Conditions:
The time difference between SCTP ABORT and SCTP INIT is very small, i.e., 2 seconds or less

Impact:
Pool member is marked DOWN even though it is active

Workaround:
If the watchdog is configured in the diameter session profile (i.e., watchdog-timeout is greater than 0), the pool member is marked UP after DWA is received from the pool member.

Fix:
The system now marks the pool member as UP if DWA is received from the pool member.

Fixed Versions:
14.1.4.5, 15.1.4.1, 16.1.2

1006893-4 : Use of ACCESS::oauth after ACCESS::session create/delete may result in TMM core

Links to More Info: BT1006893

Component: Access Policy Manager

Symptoms:
When ACCESS::oauth is used after ACCESS::session create/delete in an iRule event, TMM may core.

Conditions:
ACCESS::oauth is used after ACCESS::session create/delete in an iRule event.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
No workaround

Fix:
TMM does not core and functionality works as expected.

Fixed Versions:
14.1.4.5, 15.1.4.1, 16.1.2

1005109-4 : TMM crashes when changing traffic-group on IPv6 link-local address

Links to More Info: BT1005109

Component: Local Traffic Manager

Symptoms:
TMM crashes when changing the traffic-group on an IPv6 link-local address.

Conditions:
Changing the traffic-group on an IPv6 link-local address.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

Fixed Versions:
14.1.4.5, 16.1.2.1

1005105-3 : Requests are missing on traffic event logging

Links to More Info: BT1005105

Component: Application Security Manager

Symptoms:
Some traffic requests are missing in Security :: Event Logs.

Conditions:
-- Local logging enabled
-- Two or more virtual servers passing heavy traffic

Impact:
High CPU load prevents the Policy Builder from analyzing and sending all traffic requests to the request log.

Workaround:
None

Fix:
The Policy Builder now attempts to send traffic requests to the request log, even when learning analysis is limited due to high CPU load.

Fixed Versions:
14.1.4.5, 15.1.4, 16.1.1

1004537-2 : Traffic Learning: Accept actions for multiple suggestions not localized

Links to More Info: BT1004537

Component: Application Security Manager

Symptoms:
When you open the accept suggestions actions list, the actions are not localized. Labels are shown instead of text, for example asm.button.Accept instead of Accept.

Conditions:
This occurs after selecting several suggestions and opening the Accept suggestions actions list.

Impact:
Actions not localized.

Workaround:
None

Fix:
Fixed localization for Accept suggestions actions list.

Fixed Versions:
15.1.4, 16.1.2

1004069-4 : Brute force attack is detected too soon

Links to More Info: BT1004069

Component: Application Security Manager

Symptoms:
A Brute force attack is detected too soon.

Conditions:
The login page has the expected header validation criteria.

Impact:
The attack is detected earlier than the setpoint.

Workaround:
N/A

Fixed Versions:
14.1.4.5, 16.1.2

1003633-1 : There might be wrong memory handling when message routing feature is used

Links to More Info: BT1003633

Component: Service Provider

Symptoms:
The following log is observed from /var/log/ltm
Oops @ 0x28c3060:232: buf->ref == 0

Conditions:
Message routing is used either by
- Generic message (ltm message-routing generic) or
- HTTP2 with Message router option enabled

Impact:
For most cases, this kind of incorrect memory handling may only generate warning log message. In rare case, it might lead to a tmm crash.

Workaround:
N/A

Fix:
Wrong memory handling in message routing is fixed.

Fixed Versions:
14.1.4.5, 15.1.4.1, 16.1.2

1003317-1 : ASM signatures do not match as expected

Component: Application Security Manager

Symptoms:
Under certain conditions, ASM signatures may not matched as expected.

Conditions:
- ASM enabled
- HTTP protocol compliance check disabled

Impact:
Signatures may not match as expected.

Workaround:
N/A

Fix:
ASM signatures are now matched as expected.

Fixed Versions:
14.1.4.5, 16.1.2.1

1003257-6 : ZebOS 'set ipv6 next-hop' and 'set ipv6 next-hop local' do not work as expected

Links to More Info: BT1003257

Component: TMOS

Symptoms:
ZebOS 'set ipv6 next-hop' and 'set ipv6 next-hop local' commands are not working properly. The address is always set to interface-configured global/local addresses respectively.

Conditions:
Using BGPv4 with IPv6 capability extension and a route-map with 'set ipv6 next-hop' and/or 'set ipv6 next-hop local' configuration.

Impact:
Wrong next-hop is advertised.

Workaround:
None.

Fixed Versions:
14.1.4.5, 15.1.4.1, 16.1.2

1002945-4 : Some connections are dropped on chained IPv6 to IPv4 virtual servers.

Links to More Info: BT1002945

Component: Local Traffic Manager

Symptoms:
IPv6 virtual servers targeting IPv4 virtual servers (for example, using the 'virtual' iRule command) might drop traffic coming from some clients unexpectedly.

Conditions:
- IPv6 to IPv4 virtual server chaining.

Impact:
Traffic is dropped.

Workaround:
None

Fixed Versions:
14.1.4.5, 15.1.4.1, 16.1.2

1002385-1 : Fixing issue with input normalization

Component: Application Security Manager

Symptoms:
Under certain conditions, ASM does not follow current best practices.

Conditions:
- ASM provisioned

Impact:
Attack detection is not triggered as expected

Workaround:
N/A

Fix:
Attack detection is now triggered as expected

Fixed Versions:
16.1.2.1

1000741-1 : Fixing issue with input normalization

Component: Application Security Manager

Symptoms:
Under certain conditions, ASM does not follow current best practices.

Conditions:
- ASM provisioned

Impact:
Attack detection is not triggered as expected

Workaround:
N/A

Fix:
Attack detection is now triggered as expected

Fixed Versions:
14.1.4.4, 15.1.4, 16.1.1

1000405-1 : VLAN/Tunnels not listed when creating a new rule via GUI

Links to More Info: BT1000405

Component: Advanced Firewall Manager

Symptoms:
Available tunnels are not displayed on the AFM rules-creation page in the GUI.

Conditions:
-- Navigate to the firewall network rules creation page in the GUI.
-- In the rules source section, under the VLAN/Tunnel dropdown, select the 'specify' option.

Impact:
Available tunnels do not display in the select box. Cannot specify tunnels for firewall rules from the GUI.

Workaround:
Use tmsh to specify tunnels for firewall rules.

Fix:
The available tunnels now display in the VLAN/Tunnels dropdown.

Fixed Versions:
15.1.4, 16.1.1