Applies To:
Show VersionsBIG-IP APM
- 16.1.3
BIG-IP Analytics
- 16.1.3
BIG-IP Link Controller
- 16.1.3
BIG-IP LTM
- 16.1.3
BIG-IP PEM
- 16.1.3
BIG-IP AFM
- 16.1.3
BIG-IP FPS
- 16.1.3
BIG-IP DNS
- 16.1.3
BIG-IP ASM
- 16.1.3
BIG-IP Release Information
Version: 16.1.3.4
Build: 2.0
Note: This content is current as of the software release date
Updates to bug information occur periodically. For the most up-to-date bug data, see Bug Tracker.
The blue background highlights fixes |
Cumulative fixes from BIG-IP v16.1.3.3 that are included in this release
Cumulative fixes from BIG-IP v16.1.3.2 that are included in this release
Cumulative fixes from BIG-IP v16.1.3.1 that are included in this release
Cumulative fixes from BIG-IP v16.1.3 that are included in this release
Cumulative fixes from BIG-IP v16.1.2.2 that are included in this release
Cumulative fixes from BIG-IP v16.1.2.1 that are included in this release
Cumulative fixes from BIG-IP v16.1.2 that are included in this release
Cumulative fixes from BIG-IP v16.1.1 that are included in this release
Known Issues in BIG-IP v16.1.x
Vulnerability Fixes
ID Number | CVE | Links to More Info | Description | Fixed Versions |
1208001-1 | CVE-2023-22374 | K000130415, BT1208001 | iControl SOAP vulnerability CVE-2023-22374 | 17.1.0, 16.1.3.4 |
Functional Change Fixes
None
Local Traffic Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1106989-3 | 2-Critical | Certain configuration settings leads to memory accumulation | 17.1.0, 16.1.3.4 |
Global Traffic Manager (DNS) Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1213305-3 | 3-Major | Improper query string handling on undisclosed pages | 16.1.3.4 | |
1096373-2 | 3-Major | Unexpected parameter handling in BIG3d | 16.1.3.4 |
Application Security Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1208989-3 | 3-Major | Improper value handling in DOS Profile properties page | 17.1.0, 16.1.3.4 |
Application Visibility and Reporting Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1204961-4 | 3-Major | Improper query string handling on undisclosed pages | 16.1.3.4 | |
1204793-4 | 3-Major | Improper query string handling on undisclosed pages | 16.1.3.4 |
Fraud Protection Services Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1207661-4 | 3-Major | Datasafe UI hardening | 17.1.0, 16.1.3.4 | |
1196033-2 | 3-Major | Improper value handling in DataSafe UI | 17.1.0, 16.1.3.4 |
Cumulative fixes from BIG-IP v16.1.3.3 that are included in this release
Vulnerability Fixes
ID Number | CVE | Links to More Info | Description | Fixed Versions |
982785-2 | CVE-2022-25946 | K52322100 | Guided Configuration hardening | 17.0.0, 16.1.3.3, 15.1.8, 14.1.5.3 |
890917-8 | CVE-2023-22323 | K56412001, BT890917 | Performance may be reduced while processing SSL traffic | 17.1.0, 17.0.0.2, 16.1.3.3, 15.1.8.1, 14.1.5.3 |
1143073-4 | CVE-2022-41622 | K94221585, BT1143073 | iControl SOAP vulnerability CVE-2022-41622 | 17.1.0, 17.0.0.2, 16.1.3.3, 15.1.8.1, 14.1.5.3 |
1107437-3 | CVE-2023-22839 | K37708118, BT1107437 | TMM may crash when enable-rapid-response is enabled on a DNS profile | 17.1.0, 17.0.0.2, 16.1.3.3, 15.1.8.1, 14.1.5.3 |
1106161-2 | CVE-2022-41800 | K13325942, BT1106161 | Securing iControlRest API for appliance mode | 17.1.0, 17.0.0.2, 16.1.3.3, 15.1.8.1, 14.1.5.3 |
1105389-4 | CVE-2023-23552 | K17542533, BT1105389 | Incorrect HTTP request handling may lead to resource leak | 17.1.0, 17.0.0.2, 16.1.3.3, 15.1.8, 14.1.5.3 |
1093821-4 | CVE-2023-22422 | K43881487, BT1093821 | TMM may behave unexpectedly while processing HTTP traffic | 17.1.0, 17.0.0.2, 16.1.3.3 |
1085077-4 | CVE-2023-22340 | K34525368, BT1085077 | TMM may crash while processing SIP-ALG traffic | 17.0.0, 16.1.3.3, 15.1.8, 14.1.5.3 |
1083225-2 | CVE-2023-22842 | K08182564, BT1083225 | TMM may crash while processing SIP traffic | 17.0.0, 16.1.3.3, 15.1.8.1, 14.1.5.3 |
1062569-1 | CVE-2023-22664 | K56676554, BT1062569 | HTTP/2 stream bottom filter leaks memory at teardown under certain conditions | 17.1.0, 17.0.0.2, 16.1.3.3 |
1032553-5 | CVE-2023-22281 | K46048342, BT1032553 | Core when virtual server with destination NATing receives multicast | 17.1.0, 17.0.0.2, 16.1.3.3, 15.1.8, 14.1.5.3 |
1112445-2 | CVE-2023-22302 | K58550078, BT1112445 | Fix to avoid zombie node on the chain | 17.1.0, 17.0.0.2, 16.1.3.3 |
1073005-2 | CVE-2023-22326 | K83284425, BT1073005 | iControl REST use of the dig command does not follow security best practices | 17.1.0, 17.0.0.2, 16.1.3.3, 15.1.8.1, 14.1.5.3 |
1065917-2 | CVE-2023-22418 | K95503300, BT1065917 | BIG-IP APM Virtual Server does not follow security best practices | 17.1.0, 17.0.0.2, 16.1.3.3, 15.1.7, 14.1.5.3 |
Functional Change Fixes
None
TMOS Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1113385-4 | 3-Major | BT1113385 | Expired REST tokens are not getting deleted from /var/run/pamcache on standalone BIG-IP | 17.1.0, 17.0.0.2, 16.1.3.3, 15.1.8.1, 14.1.5.3 |
1103369-2 | 3-Major | BT1103369 | DELETE of REST Auth token does not result in deletion of the pamcache token file on a multi-slot VIPRION chassis, vCMP guest, or VELOS tenant | 17.1.0, 17.0.0.2, 16.1.3.3, 15.1.8.1, 14.1.5.3 |
Local Traffic Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1134085-2 | 2-Critical | BT1134085 | Intermittent TMM core when iRule is configured with SSL persistence | 17.1.0, 17.0.0.2, 16.1.3.3, 15.1.8.1 |
Access Policy Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1122473-4 | 2-Critical | BT1122473 | TMM panic while initializing URL DB | 17.1.0, 16.1.3.3 |
1174873-3 | 3-Major | BT1174873 | The location header query string separate is converted from "?" to "%3F" breaking multi-domain | 17.1.0, 17.0.0.2, 16.1.3.3, 15.1.8.1, 14.1.5.3 |
Cumulative fixes from BIG-IP v16.1.3.2 that are included in this release
Vulnerability Fixes
ID Number | CVE | Links to More Info | Description | Fixed Versions |
1106289-2 | CVE-2022-41624 | K43024307, BT1106289 | TMM may leak memory when processing sideband connections. | 17.1.0, 17.0.0.1, 16.1.3.2, 15.1.7, 14.1.5.2, 13.1.5.1 |
1068821 | CVE-2022-41806 | K00721320, BT1068821 | TMM may crash when processing AFM NAT64 policy | 16.1.3.2 |
Functional Change Fixes
None
Local Traffic Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1137037 | 2-Critical | BT1137037 | System boots into an inoperative state after installing engineering hotfix with FIPS 140-2/140-3 license in version 16.1.x★ | 16.1.3.2 |
Cumulative fixes from BIG-IP v16.1.3.1 that are included in this release
Vulnerability Fixes
ID Number | CVE | Links to More Info | Description | Fixed Versions |
1104493-1 | CVE-2022-35272 | K90024104, BT1104493 | Client-side abort during server-side establishment may cause tmm to behave abnormally in HTTP MRF proxy | 17.1.0, 17.0.0.1, 16.1.3.1 |
1093621-2 | CVE-2022-41832 | K10347453 | Some SIP traffic patterns over TCP may cause resource exhaustion on BIG-IP | 17.1.0, 17.0.0.1, 16.1.3.1, 15.1.6.1, 14.1.5.1, 13.1.5.1 |
1085729-2 | CVE-2022-41836 | K47204506, BT1085729 | bd may crash while processing specific request | 17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7 |
1076397-1 | CVE-2022-35735 | K13213418, BT1076397 | TMSH hardening | 17.0.0, 16.1.3.1, 15.1.6.1, 14.1.5.1 |
1073841-1 | CVE-2022-34862 | K66510514, BT1073841 | URI normalization does not function as expected | 17.0.0, 16.1.3.1, 15.1.6.1, 14.1.5 |
1073357-2 | CVE-2022-34862 | K66510514, BT1073357 | TMM may crash while processing HTTP traffic | 17.0.0, 16.1.3.1, 15.1.6.1, 14.1.5 |
1067505-4 | CVE-2022-34651 | K59197053, BT1067505 | TMM may crash while processing TLS traffic with HTTP::respond | 17.0.0, 16.1.3.1, 15.1.6.1 |
1066673-1 | CVE-2022-35728 | K55580033, BT1066673 | BIG-IP Configuration Utility(TMUI) does not follow best practices for managing active sessions | 17.1.0, 17.0.0.1, 16.1.3.1, 15.1.6.1, 14.1.5.1 |
1024029-2 | CVE-2022-35245 | K58235223, BT1024029 | TMM may crash when processing traffic with per-session APM Access Policy | 17.0.0, 16.1.3.1, 15.1.6.1, 14.1.5.1 |
919357-8 | CVE-2022-41770 | K22505850, BT919357 | iControl REST hardening | 17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7, 14.1.5.1 |
881809-8 | CVE-2022-41983 | K31523465, BT881809 | Client SSL and Server SSL profile hardening | 17.0.0, 16.1.3.1, 15.1.7, 14.1.5.1 |
740321-1 | CVE-2022-34851 | K50310001, BT740321 | iControl SOAP API does not follow current best practices | 17.1.0, 17.0.0.1, 16.1.3.1, 15.1.6.1, 14.1.5.1 |
1084013-4 | CVE-2022-36795 | K52494562, BT1084013 | TMM does not follow TCP best practices | 17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7, 14.1.5.1 |
1081153-2 | CVE-2022-41813 | K93723284, BT1081153 | TMM may crash while processing administrative requests | 17.0.0, 16.1.3.1, 15.1.6.1, 14.1.5 |
1073549-1 | CVE-2022-35735 | K13213418, BT1073549 | TMSH hardening | 17.0.0, 16.1.3.1, 15.1.6.1, 14.1.5.1 |
1055925-1 | CVE-2022-34844 | K34511555, BT1055925 | TMM may crash while processing traffic on AWS | 17.0.0, 16.1.3.1, 15.1.6.1 |
1043281-6 | CVE-2021-3712 | K19559038, BT1043281 | OpenSSL vulnerability CVE-2021-3712 | 17.0.0, 16.1.3.1, 15.1.6.1 |
1006921-1 | CVE-2022-33962 | K80970653, BT1006921 | iRules Hardening | 17.1.0, 17.0.0.1, 16.1.3.1, 15.1.6.1, 14.1.5.1 |
1063641-4 | CVE-2022-33968 | K23465404, BT1063641 | NTLM library hardening | 17.1.0, 17.0.0.1, 16.1.3.1, 15.1.6.1, 14.1.5.1 |
1063637-4 | CVE-2022-33968 | K23465404, BT1063637 | NTLM library hardening | 17.1.0, 17.0.0.1, 16.1.3.1, 15.1.6.1, 14.1.5.1 |
Functional Change Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1036057-1 | 3-Major | BT1036057 | Add support for line folding in multipart parser. | 17.1.0, 17.0.0.1, 16.1.3.1, 15.1.6.1, 14.1.5.1 |
1025261-3 | 3-Major | BT1025261 | Restjavad uses more resident memory in control plane after software upgrade | 17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7, 14.1.5.1 |
1071621-1 | 4-Minor | BT1071621 | Increase the number of supported traffic selectors | 17.1.0, 17.0.0.1, 16.1.3.1, 15.1.6.1 |
TMOS Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1120433-2 | 1-Blocking | BT1120433 | Removed gtmd and big3d daemon from the FIPS-compliant list | 17.1.0, 16.1.3.1 |
989517-3 | 2-Critical | BT989517 | Acceleration section of virtual server page not available in DHD | 17.1.0, 17.0.0.1, 16.1.3.1, 15.1.6.1 |
957637-1 | 2-Critical | BT957637 | The pfmand daemon can crash when it starts. | 17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7, 14.1.5.1 |
936501-1 | 2-Critical | BT936501 | Scp to /var/local/ucs or /var/local/scf is not allowed when fips140 or common criteria mode is enabled | 17.1.0, 16.1.3.1 |
1097193-2 | 2-Critical | BT1097193 | Unable to SCP files using WinSCP or relative path name | 17.1.0, 16.1.3.1 |
1076921-1 | 2-Critical | BT1076921 | Hostname in BootMarker logs and /var/log/ltm logs that are sourced from TMM are getting truncated | 17.0.0, 16.1.3.1, 15.1.6.1, 14.1.5.1 |
1048853-1 | 2-Critical | BT1048853 | "IKE VBUF" memory leak debug. | 17.0.0, 16.1.3.1, 15.1.7 |
1041865-4 | 2-Critical | K16392416, BT1041865 | Correctable machine check errors [mce] should be suppressed | 17.0.0, 16.1.3.1, 15.1.7 |
992121-4 | 3-Major | BT992121 | REST "/mgmt/tm/services" endpoint is not accessible | 17.0.0, 16.1.3.1, 15.1.6.1, 14.1.5.1 |
720610-4 | 3-Major | BT720610 | Automatic Update Check logs false 'Update Server unavailable' message on every run | 17.0.0, 16.1.3.1, 15.1.6.1, 14.1.2.7, 13.1.3 |
1123149 | 3-Major | BT1123149 | Sys-icheck fail for /etc/security/opasswd | 17.1.0, 16.1.3.1 |
1120685 | 3-Major | BT1120685 | Unable to update the password in the CLI when password-memory is set to > 0 | 17.1.0, 16.1.3.1 |
1091345-2 | 3-Major | BT1091345 | The /root/.bash_history file is not carried forward by default during installations. | 17.1.0, 17.0.0.1, 16.1.3.1, 15.1.6.1, 14.1.5.1 |
1087621-1 | 3-Major | BT1087621 | IKEv2: IPsec CREATE_CHILD_SA (IKE) fails due to bad ECP payload | 17.1.0, 17.0.0.1, 16.1.3.1, 15.1.6.1 |
1048137-2 | 3-Major | BT1048137 | IPsec IKEv1 intermittent but consistent tunnel setup failures | 17.0.0, 16.1.3.1 |
1042737-4 | 3-Major | BT1042737 | BGP sending malformed update missing Tot-attr-len of '0. | 17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7 |
1024661-3 | 3-Major | BT1024661 | SCTP forwarding flows based on VTAG for bigproto | 17.1.0, 17.0.0.1, 16.1.3.1, 15.1.6.1, 14.1.5.1 |
1090569-1 | 4-Minor | BT1090569 | After enabling a TLS virtual server, TMM crashes with SIGFPE and 1 hour later with SIGSEGV | 17.1.0, 17.0.0.1, 16.1.3.1, 15.1.6.1 |
1080317-3 | 4-Minor | BT1080317 | Hostname is getting truncated on some logs that are sourced from TMM | 17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7, 14.1.5.1 |
1067105-2 | 4-Minor | BT1067105 | Racoon logging shows incorrect SA length. | 17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7 |
Local Traffic Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
944381-2 | 2-Critical | BT944381 | Dynamic CRL checking for client certificate is not working when TLS1.3 is used. | 17.0.0, 16.1.3.1, 15.1.6.1 |
780857-4 | 2-Critical | BT780857 | HA failover network disruption when cluster management IP is not in the list of unicast addresses | 17.0.0, 16.1.3.1, 15.1.6.1, 14.1.5.1 |
1113549-3 | 2-Critical | BT1113549 | System boots into an inoperative state after installing engineering hotfix with FIPS140-2/140-3 License★ | 17.1.0, 16.1.3.1 |
1110205-2 | 2-Critical | BT1110205 | SSL::collect in CLIENTSSL_DATA prevents orderly connection shutdown | 17.1.0, 16.1.3.1 |
1087469-2 | 2-Critical | BT1087469 | iRules are not triggered when an SSL client connects to a BIG-IP system using an empty certificate. | 17.1.0, 16.1.3.1, 15.1.6.1 |
1087217-2 | 2-Critical | BT1087217 | TMM crash as part of the fix made for ID912209 | 17.1.0, 16.1.3.1 |
1086677-4 | 2-Critical | BT1086677 | TMM Crashes in xvprintf() because of NULL Flow Key | 17.0.0, 16.1.3.1, 15.1.7 |
1080581-1 | 2-Critical | BT1080581 | Virtual server creation is not allowed to have TCP, UDP and HTTP together with Client or Server SSL Profiles.★ | 17.0.0, 16.1.3.1, 15.1.5.1 |
1074517-1 | 2-Critical | BT1074517 | Tmm may core while adding/modifying traffic-class attached to a virtual server | 17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7, 14.1.5.1 |
1073609-4 | 2-Critical | BT1073609 | Tmm may core while using reject iRule command in LB_SELECTED event. | 17.0.0, 16.1.3.1, 15.1.6.1, 14.1.5.1 |
1020645 | 2-Critical | BT1020645 | When HTTP CONNECT is sent, iRule event HTTP_RESPONSE_RELEASE is not triggered | 17.1.0, 16.1.3.1, 15.1.4.1 |
999881-6 | 3-Major | BT999881 | Tcl command 'string first' not working if payload contains Unicode characters. | 17.0.0, 16.1.3.1, 15.1.7 |
972517-7 | 3-Major | Appliance mode hardening | 17.0.0, 16.1.3.1, 15.1.6.1, 14.1.5 | |
948985-3 | 3-Major | BT948985 | Workaround to address Nitrox 3 compression engine hang | 17.0.0, 16.1.3.1, 15.1.6.1 |
922413-8 | 3-Major | BT922413 | Excessive memory consumption with ntlmconnpool configured | 17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7 |
748886-4 | 3-Major | BT748886 | Virtual server stops passing traffic after modification | 17.1.0, 17.0.0.1, 16.1.3.1, 15.1.6.1, 14.1.5.1 |
1109833-1 | 3-Major | BT1109833 | HTTP2 monitors not sending request | 17.1.0, 16.1.3.1 |
1091761-1 | 3-Major | BT1091761 | Mqtt_message memory leaks when iRules are used | 17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7, 14.1.5.1 |
1082225-4 | 3-Major | BT1082225 | Tmm may core while Adding/modifying traffic-class attached to a virtual server. | 17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7, 14.1.5.1 |
1070789 | 3-Major | BT1070789 | SSL fwd proxy invalidating certificate even through bundle has valid CA | 17.1.0, 16.1.3.1 |
1068445-1 | 3-Major | BT1068445 | TCP duplicate acks are observed in speed tests for larger requests | 17.0.0, 16.1.3.1, 15.1.6.1, 14.1.5.1 |
1060989 | 3-Major | BT1060989 | Improper handling of HTTP::collect | 17.1.0, 16.1.3.1 |
1053149-1 | 3-Major | BT1053149 | A FastL4 TCP connection which is yet to fully establish fails to update its internal SEQ space when a new SYN is received. | 17.0.0, 16.1.3.1, 15.1.6.1, 14.1.5.1 |
1043805-3 | 3-Major | BT1043805 | ICMP traffic over NAT does not work properly. | 17.0.0, 16.1.3.1, 15.1.7, 14.1.5.1 |
1036169-4 | 3-Major | BT1036169 | VCMPD rsync server max connection limit: guest "Exit flags for PID 17299: 0x500". | 17.0.0, 16.1.3.1, 15.1.6.1, 14.1.5.1 |
1022453-4 | 3-Major | BT1022453 | IPv6 fragments are dropped when packet filtering is enabled. | 17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7 |
1006157-3 | 3-Major | BT1006157 | FQDN nodes not repopulated immediately after 'load sys config' | 17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7, 14.1.5.1 |
987885-6 | 4-Minor | BT987885 | Half-open unclean SSL termination might not close the connection properly | 17.0.0, 16.1.3.1, 15.1.6.1, 14.1.5.1 |
1104073-2 | 4-Minor | BT1104073 | Use of iRules command whereis with "isp" or "org" options may cause TCL object leak. | 17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7 |
Global Traffic Manager (DNS) Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1077701-1 | 2-Critical | BT1077701 | GTM "require M from N" monitor rules do not report when the number of "up" responses change | 17.0.0, 16.1.3.1, 15.1.6.1, 14.1.5.1 |
984749-1 | 3-Major | BT984749 | Discrepancy between DNS cache statistics "Client Summary" and "Client Cache." | 17.0.0, 16.1.3.1, 15.1.7 |
1091249-2 | 3-Major | BT1091249 | BIG-IP DNS and Link Controller systems may use an incorrect IPv6 translation address. | 17.1.0, 17.0.0.1, 16.1.3.1, 15.1.6.1, 14.1.5.1 |
1078669-2 | 3-Major | BT1078669 | iRule command “RESOLVER::name_lookup” returns null for TCP resolver with TC (truncated) flag set. | 17.0.0, 16.1.3.1, 15.1.7 |
1071301-1 | 3-Major | BT1071301 | GTM server does not get updated even when the virtual server status changes. | 17.0.0, 16.1.3.1, 15.1.6.1, 14.1.5.1 |
1071233-1 | 3-Major | BT1071233 | GTM Pool Members may not be updated accurately when multiple identical database monitors are configured | 17.0.0, 16.1.3.1, 15.1.6.1, 14.1.5.1 |
950069-1 | 4-Minor | BT950069 | Zonerunner can't edit TXT records containing a + symbol - "Resolver returned no such record" | 17.0.0, 16.1.3.1, 15.1.6.1 |
1084673-2 | 4-Minor | BT1084673 | GTM Monitor "require M from N" status change log message does not print pool name | 17.1.0, 17.0.0.1, 16.1.3.1, 15.1.6.1, 14.1.5.1 |
Application Security Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1048685-4 | 2-Critical | BT1048685 | Rare TMM crash when using Bot Defense Challenge | 17.0.0, 16.1.3.1, 15.1.7 |
1015881-4 | 2-Critical | BT1015881 | TMM might crash after configuration failure | 17.1.0, 16.1.3.1, 15.1.7 |
886533-5 | 3-Major | BT886533 | Icap server connection adjustments | 17.1.0, 17.0.0.1, 16.1.3.1, 15.1.6.1, 14.1.5.1 |
1083913-2 | 3-Major | BT1083913 | Missing error check in ICAP handling | 17.1.0, 16.1.3.1, 15.1.6.1, 14.1.5.1 |
1082461-2 | 3-Major | BT1082461 | The enforcer cores during a call to 'ASM::raise' from an active iRule | 17.1.0, 17.0.0.1, 16.1.3.1, 15.1.6.1 |
1078765-1 | 3-Major | BT1078765 | Arcsight remote log with 200004390,200004389 signatures in the request may crash the enforcer. | 17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7 |
1062493-1 | 3-Major | BT1062493 | BD crash close to it's startup | 17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7 |
1056957-1 | 3-Major | BT1056957 | An attack signature can be bypassed under some scenarios. | 17.1.0, 17.0.0.1, 16.1.3.1 |
1036305-5 | 3-Major | BT1036305 | "Mandatory request body is missing" violation in staging but request is unexpectedly blocked | 17.0.0, 16.1.3.1, 15.1.6.1 |
1030133-2 | 3-Major | BT1030133 | BD core on XML out of memory | 17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7, 14.1.5.1 |
1014973-5 | 3-Major | BT1014973 | ASM changed cookie value. | 17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7 |
948241-4 | 4-Minor | BT948241 | Count Stateful anomalies based only on Device ID | 17.1.0, 17.0.0.1, 16.1.3.1, 15.1.6.1, 14.1.5.1 |
947333-2 | 4-Minor | BT947333 | Irrelevant content profile diffs in Policy Diff | 17.1.0, 17.0.0.1, 16.1.3.1 |
1079721 | 4-Minor | BT1079721 | OWASP 2017 A2 Category - Login enforcement link is broken | 16.1.3.1 |
1073625-2 | 4-Minor | BT1073625 | Peer (standby) unit's policies after autosync show a need for Apply Policy when the imported policy has learning enabled. | 17.1.0, 17.0.0.1, 16.1.3.1, 15.1.6.1, 14.1.5.1 |
1058297-2 | 4-Minor | BT1058297 | Policy history values for 'max Size Of Saved Versions' and for 'min Retained Files In Dir' is reset during upgrade★ | 17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7 |
1046317-2 | 4-Minor | BT1046317 | Violation details are not populated with staged URLs for some violation types | 17.0.0, 16.1.3.1, 15.1.6.1 |
1040513-5 | 4-Minor | BT1040513 | The counter for "FTP commands" is always 0. | 17.1.0, 17.0.0.1, 16.1.3.1, 15.1.6.1, 14.1.5.1 |
1014573-1 | 4-Minor | BT1014573 | Several large arrays/objects in JSON payload may core the enforcer | 17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7, 14.1.5.1 |
1029689-2 | 5-Cosmetic | BT1029689 | Incosnsitent username "SYSTEM" in Audit Log | 17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7 |
Application Visibility and Reporting Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
926341-5 | 3-Major | BT926341 | RtIntervalSecs parameter in /etc/avr/avrd.cfg file is reset on version upgrade★ | 17.0.0, 16.1.3.1, 15.1.4, 14.1.4.4, 13.1.5 |
Access Policy Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
987341-1 | 2-Critical | BT987341 | BIG-IP OpenID Connect Discovery process does not support strong TLS ciphers. | 17.0.0, 16.1.3.1, 15.1.6.1, 14.1.5 |
1071485-3 | 3-Major | BT1071485 | For IP based bypass, Response Analytics sends RST. | 17.0.0, 16.1.3.1 |
1063345-5 | 3-Major | BT1063345 | Urldbmgrd may crash while downloading the database. | 17.0.0, 16.1.3.1 |
1043217-1 | 3-Major | BT1043217 | NTLM frontend auth fails with the latest Microsoft RDP client on MacOS 14.0.1 platform | 17.0.0, 16.1.3.1, 15.1.6.1, 14.1.5.1 |
1039725-1 | 3-Major | BT1039725 | Reverse proxy traffic fails when a per-request policy is attached to a virtual server. | 17.0.0, 16.1.3.1 |
1024437-6 | 3-Major | BT1024437 | Urldb index building fails to open index temp file | 17.0.0, 16.1.3.1 |
1022493-4 | 3-Major | BT1022493 | Slow file descriptor leak in urldbmgrd (sockets open over time) | 17.0.0, 16.1.3.1 |
1010597-1 | 3-Major | BT1010597 | Traffic disruption when virtual server is assigned to a non-default route domain★ | 17.0.0, 16.1.3.1, 15.1.6.1, 14.1.5.1 |
Service Provider Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
921441-4 | 3-Major | BT921441 | MR_INGRESS iRules that change diameter messages corrupt diam_msg | 17.0.0, 16.1.3.1, 15.1.7 |
1103233-2 | 4-Minor | BT1103233 | Diameter in-tmm monitor is logging disconnect events unnecessarily | 17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7 |
Advanced Firewall Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
977153-3 | 3-Major | BT977153 | Packet with routing header IPv6 as next header in IP layer fails to be forwarded | 17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7 |
Policy Enforcement Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1091565-1 | 2-Critical | BT1091565 | Gy CCR AVP:Requested-Service-Unit is misformatted/NULL | 17.1.0, 16.1.3.1 |
1090649-3 | 3-Major | BT1090649 | PEM errors when configuring IPv6 flow filter via GUI | 17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7, 14.1.5.1 |
1084993 | 3-Major | BT1084993 | [PEM][Gy] e2e ID/h2h ID in RAR / RAA Not Matching | 17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7 |
911585-5 | 4-Minor | BT911585 | PEM VE does not send CCRi when receiving multiple subscriber requests in a short interval | 17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7 |
815901-2 | 4-Minor | BT815901 | Add rule to the disabled pem policy is not allowed | 17.0.0, 16.1.3.1, 15.1.7 |
In-tmm monitors Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
832133-7 | 3-Major | BT832133 | In-TMM monitors fail to match certain binary data in the response from the server | 17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7 |
SSL Orchestrator Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1050273-1 | 3-Major | BT1050273 | ERR_BOUNDS errors observed with HTTP explicit proxy service in SSL Orchestrator. | 17.0.0, 16.1.3.1, 15.1.5 |
Cumulative fixes from BIG-IP v16.1.3 that are included in this release
Vulnerability Fixes
ID Number | CVE | Links to More Info | Description | Fixed Versions |
996233-1 | CVE-2022-33947 | K38893457, BT996233 | Tomcat may crash while processing TMUI requests | 17.0.0, 16.1.3, 15.1.6.1, 14.1.5 |
972489-7 | CVE-2022-35243 | K11010341, BT972489 | BIG-IP Appliance Mode iControl hardening | 17.0.0, 16.1.3, 15.1.5.1, 14.1.5 |
1079505-4 | CVE-2022-33203 | K52534925, BT1079505 | TMM may consume excessive resources while processing SSL Orchestrator traffic | 17.0.0, 16.1.3, 15.1.6.1, 14.1.5 |
1081201-1 | CVE-2022-41694 | K64829234, BT1081201 | MCPD certification import hardening | 17.0.0, 16.1.3, 15.1.6.1, 14.1.5 |
Functional Change Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
435231 | 2-Critical | K79342815, BT435231 | Support RFC7919 Negotiated Finite Field Diffie-Hellman Ephemeral parameters | 17.0.0, 16.1.3 |
1078821-1 | 2-Critical | BT1078821 | Upgrade tomcat with OpenJDK 1.7 32bit to OpenJDK 1.8 32bit | 17.0.0, 16.1.3, 15.1.6.1, 14.1.5 |
1036285-1 | 3-Major | BT1036285 | Enforce password expiry after local user creation | 17.0.0, 16.1.3 |
TMOS Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
947905-4 | 1-Blocking | BT947905 | Upgrade from 13.1.4, 14.1.4, or 15.1.1 to 14.0.x, 15.0.x, 16.0.0 or 16.0.0.1 fails★ | 16.1.3, 16.0.1 |
1101705-2 | 1-Blocking | BT1101705 | RSA-KEX ciphers list are removed from httpd configuration in FIPS mode since these are non-approved ciphers for FIPS 140-3 certification | 17.1.0, 17.0.0.1, 16.1.3 |
1083977-1 | 1-Blocking | BT1083977 | MCPD crashes when changing HTTPD configuration, all secondary blades of clustered system remain offline★ | 17.0.0, 16.1.3 |
943109-4 | 2-Critical | BT943109 | Mcpd crash when bulk deleting Bot Defense profiles | 17.0.0, 16.1.3, 15.1.6.1, 14.1.5 |
940225-4 | 2-Critical | BT940225 | Not able to add more than 6 NICs on VE running in Azure | 17.1.0, 17.0.0.1, 16.1.3, 15.1.6.1, 14.1.5.1 |
1108181-2 | 2-Critical | BT1108181 | iControl REST call with token fails with 401 Unauthorized | 17.1.0, 17.0.0.1, 16.1.3, 15.1.6.1, 14.1.5.1 |
1079817-1 | 2-Critical | BT1079817 | Java null pointer exception when saving UCS with iAppsLX installed★ | 17.0.0, 16.1.3, 15.1.6.1, 14.1.5.1 |
950149 | 3-Major | BT950149 | Add configuration to ccmode for compliance with the Common Criteria STIP PPM. | 17.0.0, 16.1.3 |
896941 | 3-Major | BT896941 | Common Criteria ccmode script updated | 17.0.0, 16.1.3 |
886649-5 | 3-Major | BT886649 | Connections stall when dynamic BWC policy is changed via GUI and TMSH | 17.1.0, 17.0.0.1, 16.1.3, 15.1.6.1, 14.1.5.1 |
724653-5 | 3-Major | BT724653 | In a device-group configuration, a non-empty partition can be deleted by a peer device during a config-sync. | 17.0.0, 16.1.3, 15.1.6.1, 14.1.5 |
1106325 | 3-Major | BT1106325 | Upgrade from BIG-IP 16.1.3 to BIG-IP 17.0 does not work when FIPS mode is enabled★ | 16.1.3 |
1089849 | 3-Major | BT1089849 | NIST SP800-90B compliance | 17.1.0, 17.0.0.1, 16.1.3 |
1064357-1 | 3-Major | BT1064357 | execute_post_install: EPSEC: Installation of EPSEC package failed | 17.0.0, 16.1.3, 15.1.7 |
1061481-1 | 3-Major | BT1061481 | Denied strings were found in the /var/log/ folder after an update or reboot | 17.1.0, 17.0.0.1, 16.1.3 |
1004833 | 3-Major | BT1004833 | NIST SP800-90B compliance | 17.0.0, 16.1.3, 15.1.4, 14.1.4.2 |
1100609 | 4-Minor | BT1100609 | Length Mismatch in DNS/DHCP IPv6 address in logs and pcap | 17.1.0, 16.1.3 |
Local Traffic Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1071689-1 | 2-Critical | BT1071689 | SSL connection not immediately closed with HTTP2 connection and lingers until idle timeout | 17.0.0, 16.1.3 |
987077-3 | 3-Major | BT987077 | TLS1.3 with client authentication handshake failure | 17.0.0, 16.1.3, 15.1.5.1, 14.1.4.6 |
945357 | 3-Major | BT945357 | BIG-IP must be able to set CA=True when creating Certificate Signing Requests from TMSH. | 17.0.0, 16.1.3 |
934697-5 | 3-Major | BT934697 | Route domain is not reachable (strict mode) | 17.0.0, 16.1.3, 15.1.6.1, 14.1.5 |
1082505 | 3-Major | BT1082505 | TLS ciphersuites including RSA-KEX are non-approved ciphers for FIPS 140-3 certification | 17.1.0, 17.0.0.1, 16.1.3 |
1063977-3 | 3-Major | BT1063977 | Tmsh load sys config merge fails with "basic_string::substr" for non-existing key. | 17.1.0, 16.1.3 |
1071269 | 4-Minor | BT1071269 | SSL C3D enhancements introduced in BIG-IP version 16.1.3 will not be available in 17.0.0.★ | 16.1.3 |
Global Traffic Manager (DNS) Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1084173-1 | 3-Major | BT1084173 | Unable to specify "no caching desired" for ephemeral DNS resolvers (i.e. RESOLV::lookup). | 17.0.0, 16.1.3, 15.1.6.1 |
Application Security Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1070833-2 | 3-Major | BT1070833 | False positives on FileUpload parameters due to default signature scanning | 17.1.0, 16.1.3, 15.1.6.1 |
Access Policy Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
849029-7 | 3-Major | BT849029 | No configurable setting for maximum entries in CRLDP cache | 17.0.0, 16.1.3, 15.1.6.1, 14.1.4.4 |
1097821-2 | 3-Major | BT1097821 | Unable to create apm policy customization image using tmsh or VPE in the configuration utility command when source-path is specified | 17.1.0, 17.0.0.1, 16.1.3, 15.1.6.1, 14.1.5 |
1053309-1 | 3-Major | BT1053309 | Localdbmgr leaks memory while syncing data to sessiondb and mysql. | 17.0.0, 16.1.3, 15.1.6.1, 14.1.5 |
Advanced Firewall Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
945853-4 | 2-Critical | BT945853 | Tmm crash when multiple virtual servers are created, modified, or deleted in quick succession | 16.1.3, 15.1.3 |
990461-5 | 3-Major | BT990461 | Per virtual server SYN cookie threshold is not preserved or converted during a software upgrade★ | 17.1.0, 16.1.3, 15.1.6.1, 14.1.4.4 |
1079637-1 | 3-Major | BT1079637 | Incorrect Neuron rule order | 17.0.0, 16.1.3, 15.1.5.1 |
1012581-1 | 3-Major | BT1012581 | Evidence of hardware syncookies triggered but no stats after tcp half-open is triggered | 17.0.0, 16.1.3, 15.1.6.1, 14.1.5 |
iApp Technology Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1094177-4 | 1-Blocking | BT1094177 | Analytics iApp installation fails | 17.0.0, 16.1.3, 15.1.6.1, 14.1.5.1 |
1023721 | 3-Major | BT1023721 | iapp_restricted_key not available on fresh installation and overwrites the peer device's master key during config sync | 17.0.0, 16.1.3 |
1004665 | 3-Major | BT1004665 | Secure iAppsLX Restricted Storage issues. | 17.0.0, 16.1.3 |
Cumulative fixes from BIG-IP v16.1.2.2 that are included in this release
Vulnerability Fixes
ID Number | CVE | Links to More Info | Description | Fixed Versions |
965853-6 | CVE-2022-28695 | K08510472, BT965853 | IM package file hardening★ | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
964489-7 | CVE-2022-28695 | K08510472, BT964489 | Protocol Inspection IM package hardening | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6 |
1051561-7 | CVE-2022-1388 | K23605346, BT1051561 | BIG-IP iControl REST vulnerability CVE-2022-1388 | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
993981-3 | CVE-2022-28705 | K52340447, BT993981 | TMM may crash when ePVA is enabled | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
982697-7 | CVE-2022-26071 | K41440465, BT982697 | ICMP hardening | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
951257-5 | CVE-2022-26130 | K82034427, BT951257 | FTP active data channels are not established | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
946325-7 | CVE-2022-28716 | K25451853, BT946325 | PEM subscriber GUI hardening | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
830361-9 | CVE-2012-6711 | K05122252, BT830361 | CVE-2012-6711 Bash Vulnerability | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6 |
1087201-6 | CVE-2022-0778 | K31323265, BT1087201 | OpenSSL Vulnerability: CVE-2022-0778 | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1078721-1 | CVE-2022-27189 | K16187341, BT1078721 | TMM may consume excessive resources while processing ICAP traffic | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1078053-1 | CVE-2022-28701 | K99123750, BT1078053 | TMM may consume excessive resources while processing STREAM traffic | 17.0.0, 16.1.2.2 |
1071593-4 | CVE-2022-32455 | K16852653, BT1071593 | TMM may crash while processing TLS traffic | 17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5 |
1069629-4 | CVE-2022-32455 | K16852653, BT1069629 | TMM may crash while processing TLS traffic | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.5 |
1067993-4 | CVE-2022-28714 | K54460845, BT1067993 | APM Windows Client installer hardening | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1059185-1 | CVE-2022-26415 | K81952114, BT1059185 | iControl REST Hardening | 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1057801-6 | CVE-2022-28707 | K70300233, BT1057801 | TMUI does not follow current best practices | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6 |
1056933-3 | CVE-2022-26370 | K51539421, BT1056933 | TMM may crash while processing SIP traffic | 17.0.0, 16.1.2.2, 15.1.5, 14.1.4.6 |
1055737-1 | CVE-2022-35236 | K79933541, BT1055737 | TMM may consume excessive resources while processing HTTP/2 traffic | 17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5 |
1051797 | CVE-2018-18281 | K36462841, BT1051797 | Linux kernel vulnerability: CVE-2018-18281 | 17.1.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1047053-3 | CVE-2022-28691 | K37155600, BT1047053 | TMM may consume excessive resources while processing RTSP traffic | 17.0.0, 16.1.2.2, 15.1.5, 14.1.4.6, 13.1.5 |
1032513-3 | CVE-2022-35240 | K28405643, BT1032513 | TMM may consume excessive resources while processing MRF traffic | 17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5 |
1002565-1 | CVE-2021-23840 | K24624116, BT1002565 | OpenSSL vulnerability CVE-2021-23840 | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6 |
992073-2 | CVE-2022-27181 | K93543114, BT992073 | APM NTLM Front End Authentication errors ECA_ERR_INPROGRESS | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
982757-3 | CVE-2022-26835 | K53197140 | APM Access Guided Configuration hardening | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
982341-7 | CVE-2022-26835 | K53197140, BT982341 | iControl REST endpoint hardening | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
915981-4 | CVE-2022-26340 | K38271531, BT915981 | BIG-IP SCP hardening | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
823877-7 | CVE-2019-10098 CVE-2020-1927 |
K25126370, BT823877 | CVE-2019-10098 and CVE-2020-1927 apache mod_rewrite vulnerability | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.5 |
1071365-5 | CVE-2022-29474 | K59904248, BT1071365 | iControl SOAP WSDL hardening | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1066729-1 | CVE-2022-28708 | K85054496, BT1066729 | TMM may crash while processing DNS traffic | 17.0.0, 16.1.2.2, 15.1.5.1 |
1057809-6 | CVE-2022-27659 | K41877405, BT1057809 | Saved dashboard hardening | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6 |
1047089-2 | CVE-2022-29491 | K14229426, BT1047089 | TMM may terminate while processing TLS/DTLS traffic | 17.0.0, 16.1.2.2, 15.1.5, 14.1.4.6 |
1001937-1 | CVE-2022-27634 | K57555833, BT1001937 | APM configuration hardening | 17.0.0, 16.1.2.2, 15.1.5.1 |
1000021-7 | CVE-2022-27182 | K31856317, BT1000021 | TMM may consume excessive resources while processing packet filters | 17.0.0, 16.1.2.2, 15.1.5, 14.1.4.6 |
713754-3 | CVE-2017-15715 | K27757011 | Apache vulnerability: CVE-2017-15715 | 16.1.2.2, 15.1.5.1, 14.1.4.5 |
Functional Change Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1050537-1 | 2-Critical | BT1050537 | GTM pool member with none monitor will be part of load balancing decisions. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
882709-6 | 3-Major | BT882709 | Traffic does not pass on tagged VLANs on VE configured on Hyper-V hypervisors★ | 17.0.0, 16.1.2.2, 15.1.6.1 |
874941-4 | 3-Major | BT874941 | HTTP authentication in the access policy times out after 60 seconds | 16.1.2.2, 15.1.6.1, 14.1.5 |
669046-7 | 3-Major | BT669046 | Handling large replies to MCP audit_request messages | 17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5 |
1046669-1 | 3-Major | BT1046669 | The audit forwarders may prematurely time out waiting for TACACS responses | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1033837-1 | 4-Minor | K23605346, BT1033837 | REST authentication tokens persist on reboot★ | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
TMOS Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1070009 | 1-Blocking | BT1070009 | iprepd, icr_eventd and tmipsecd restarts continuously after installing FIPS 140-3 license in BIG-IP cloud platform | 17.0.0, 16.1.2.2 |
976669-5 | 2-Critical | BT976669 | FIPS Integrity check fails for other secondary blades after rebooting/replacing secondary blade | 17.0.0, 16.1.2.2, 16.1.0, 15.1.5.1, 14.1.4.6 |
935177-3 | 2-Critical | BT935177 | IPsec: Changing MTU or PMTU settings on interface mode tunnel cores tmm | 17.0.0, 16.1.2.2, 15.1.6.1 |
1059165-1 | 2-Critical | BT1059165 | Multiple virtual server pages fail to load. | 17.0.0, 16.1.2.2 |
1048141-3 | 2-Critical | BT1048141 | Sorting pool members by 'Member' causes 'General database error' | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6 |
1047213-1 | 2-Critical | BT1047213 | VPN Client to Client communication fails when clients are connected to different TMMs. | 17.0.0, 16.1.2.2 |
1007901-1 | 2-Critical | BT1007901 | Support for FIPS 140-3 Module identifier service. | 17.0.0, 16.1.2.2 |
999125-1 | 3-Major | BT999125 | After changing management IP addresses, devices can be stuck indefinitely in improper Active/Active or Standby/Standby states. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
992865-3 | 3-Major | BT992865 | Virtual server may not enter hardware SYN cookie mode on BIG-IP i11000 and i15000 series appliances | 17.1.0, 16.1.2.2, 15.1.4 |
988165-3 | 3-Major | BT988165 | VMware CPU reservation is now enforced. | 17.0.0, 16.1.2.2, 15.1.5.1 |
984585-3 | 3-Major | BT984585 | IP Reputation option not shown in GUI. | 17.0.0, 16.1.2.2, 15.1.5.1 |
963541-1 | 3-Major | BT963541 | Net-snmp5.8 crash | 17.0.0, 16.1.2.2, 15.1.5.1 |
959985-3 | 3-Major | BT959985 | Update VMware hardware version templates for BIG-IP Virtual Edition (VE) from v10 to v13 in order to support VMs deployed in more versions of vSphere ESXi. | 17.0.0, 16.1.2.2, 15.1.6.1 |
943669-4 | 3-Major | BT943669 | B4450 blade reboot | 16.1.2.2, 15.1.2 |
943577-1 | 3-Major | BT943577 | Full sync failure for traffic-matching-criteria with port list under certain conditions | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6 |
912253-2 | 3-Major | BT912253 | Non-admin users cannot run show running-config or list sys | 17.0.0, 16.1.2.2, 15.1.5.1 |
907549-6 | 3-Major | BT907549 | Memory leak in BWC::Measure | 17.0.0, 16.1.2.2, 15.1.0.5, 14.1.5 |
901669-6 | 3-Major | BT901669 | Error status in 'tmsh show cm failover-status', and stale data in some tmstat tables, after management IP address change. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6 |
755976-9 | 3-Major | BT755976 | ZebOS might miss kernel routes after mcpd deamon restart | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1083537 | 3-Major | BT1083537 | FIPS 140-3 Certification | 17.1.0, 17.0.0.1, 16.1.2.2 |
1076377-3 | 3-Major | BT1076377 | OSPF path calculation for IA and E routes is incorrect. | 17.0.0, 16.1.2.2 |
1074113-1 | 3-Major | BT1074113 | IPsec IKEv2: Selectors incorrectly marked up after disable ike-peer | 17.0.0, 16.1.2.2 |
1071609-2 | 3-Major | BT1071609 | IPsec IKEv1: Log Key Exchange payload in racoon.log. | 17.0.0, 16.1.2.2, 15.1.6.1 |
1066285-4 | 3-Major | BT1066285 | Master Key decrypt failure - decrypt failure. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1065585-1 | 3-Major | BT1065585 | System does not halt on on FIPS/entropy error threshold for BIG-IP Virtual Edition | 17.0.0, 16.1.2.2 |
1064461-4 | 3-Major | BT1064461 | PIM-SM will not complete RP registration over tunnel interface when floating IP address is used. | 17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5 |
1060625-1 | 3-Major | BT1060625 | Wrong INTERNAL_IP6_DNS length. | 17.1.0, 17.0.0, 16.1.2.2 |
1060149-2 | 3-Major | BT1060149 | BIG-IP vCMP guest data-plane failure with turboflex-adc selected on the host. | 17.0.0, 16.1.2.2, 15.1.5.1 |
1059853 | 3-Major | BT1059853 | Long loading configuration time after upgrade from 15.1.3.1 to 16.1.2.★ | 17.0.0, 16.1.2.2 |
1056993-2 | 3-Major | BT1056993 | 404 error is raised on GUI when clicking "App IQ." | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6 |
1056741-2 | 3-Major | BT1056741 | ECDSA certificates signed by RSA CA are not selected based by SNI. | 17.0.0, 16.1.2.2, 15.1.5.1 |
1052893-4 | 3-Major | Configuration option to delay reboot if dataplane becomes inoperable | 16.1.2.2 | |
1048541-1 | 3-Major | BT1048541 | Certificate Order Manager: renew requests to the Comodo (now Sectigo) CA are unsuccessful. | 17.0.0, 16.1.2.2, 15.1.5.1 |
1047169-1 | 3-Major | BT1047169 | GTM AAAA pool can be deleted from the configuration despite being in use by an iRule. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1042009-1 | 3-Major | BT1042009 | Mcpd fails to reply if a request is proxied to another daemon and the connection to that daemon closes | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1022637-1 | 3-Major | BT1022637 | A partition other than /Common may fail to save the configuration to disk | 17.0.0, 16.1.2.2, 15.1.5, 14.1.4.6, 13.1.5 |
1020789-4 | 3-Major | BT1020789 | Cannot deploy a four-core vCMP guest if the remaining cores are in use. | 17.0.0, 16.1.2.2, 15.1.6.1, 14.1.4.6, 13.1.5 |
1019357-2 | 3-Major | BT1019357 | Active fails to resend ipsec ikev2_message_id_sync if no response received | 17.0.0, 16.1.2.2, 15.1.6.1 |
1008837-1 | 3-Major | BT1008837 | Control plane is sluggish when mcpd processes a query for virtual server and address statistics | 17.0.0, 16.1.2.2, 15.1.4, 14.1.4.4 |
1008269-1 | 3-Major | BT1008269 | Error: out of stack space | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
976337-2 | 4-Minor | BT976337 | i40evf Requested 4 queues, but PF only gave us 16. | 16.1.2.2, 15.1.5.1 |
742753-8 | 4-Minor | BT742753 | Accessing the BIG-IP system's WebUI via special proxy solutions may fail | 17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5 |
528894-5 | 4-Minor | BT528894 | Config-Sync after non-Common partition config changes results in extraneous config stanzas in the config files of the non-Common partition | 17.0.0, 16.1.2.2, 15.1.5, 14.1.4.6, 13.1.5 |
1072237-1 | 4-Minor | BT1072237 | Retrieval of policy action stats causes memory leak | 17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5 |
1067617-4 | 4-Minor | BT1067617 | BGP default route not advertised after mid-session OPEN. | 17.0.0, 16.1.2.2, 15.1.6.1 |
1062333-6 | 4-Minor | Linux kernel vulnerability: CVE-2019-19523 | 17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5 | |
1061797-1 | 4-Minor | BT1061797 | Upgraded AWS CloudFormation Helper Scripts which now support IMDSv2 | 17.0.0, 16.1.2.2, 15.1.5.1 |
1058677-2 | 4-Minor | BT1058677 | Not all SCTP connections are mirrored on the standby device when auto-init is enabled. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6 |
1046693-4 | 4-Minor | BT1046693 | TMM with BFD confgured might crash under significant memory pressure | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1045549-4 | 4-Minor | BT1045549 | BFD sessions remain DOWN after graceful TMM restart | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1040821-4 | 4-Minor | BT1040821 | Enabling an iRule or selecting a pool re-checks the "Address Translation" and "Port Translation" checkboxes | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1034589-1 | 4-Minor | BT1034589 | No warning is given when a pool or trunk that was in use by an high availability (HA) Group is deleted from the configuration. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1034329-1 | 4-Minor | BT1034329 | SHA-512 checksums for BIG-IP Virtual Edition (VE) images available on downloads.f5.com | 17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5 |
1031425-3 | 4-Minor | BT1031425 | Provide a configuration flag to disable BGP peer-id check. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6 |
1030645-4 | 4-Minor | BT1030645 | BGP session resets during traffic-group failover | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6 |
1024621-4 | 4-Minor | BT1024621 | Re-establishing BFD session might take longer than expected. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1011217-5 | 4-Minor | BT1011217 | TurboFlex Profile setting reverts to turboflex-base after upgrade★ | 17.0.0, 16.1.2.2, 15.1.6.1 |
1002809-4 | 4-Minor | BT1002809 | OSPF vertex-threshold should be at least 100 | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
Local Traffic Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
968929-2 | 2-Critical | BT968929 | TMM may crash when resetting a connection on an APM virtual server | 17.0.0, 16.1.2.2 |
910213-7 | 2-Critical | BT910213 | LB::down iRule command is ineffective, and can lead to inconsistent pool member status | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1071449-4 | 2-Critical | BT1071449 | The statsd memory leak on platforms with license disabled processors. | 17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5 |
1064617-1 | 2-Critical | BT1064617 | DBDaemon process may write to monitor log file indefinitely | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1059053-2 | 2-Critical | BT1059053 | Tmm crash when passing traffic over some configurations with L2 virtual wire | 17.0.0, 16.1.2.2, 15.1.5.1 |
1047581-3 | 2-Critical | BT1047581 | Ramcache can crash when serving files from the hot cache | 17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5 |
999901-1 | 3-Major | K68816502, BT999901 | Certain LTM policies may not execute correctly after a system reboot or TMM restart. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6 |
993517-1 | 3-Major | BT993517 | Loading an upgraded config can result in a file object error in some cases | 17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5 |
977761 | 3-Major | BT977761 | Connections are dropped if a certificate is revoked. | 17.1.0, 16.1.2.2 |
967101-1 | 3-Major | BT967101 | When all of the interfaces in the trunk are brought up, Gratuitous ARP is not being sent out. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6 |
955617-8 | 3-Major | BT955617 | Cannot modify properties of a monitor that is already in use by a pool | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
953601-4 | 3-Major | BT953601 | HTTPS monitors marking pool member offline when restrictive ciphers are configured for all TLS protocol versions | 17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5 |
936441-7 | 3-Major | BT936441 | Nitrox5 SDK driver logging messages | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.5 |
912517-7 | 3-Major | BT912517 | Database monitor marks pool member down if 'send' is configured but no 'receive' strings are configured | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
902377-4 | 3-Major | BT902377 | HTML profile forces re-chunk even though HTML::disable | 17.0.0, 16.1.2.2, 15.1.5.1 |
883049-9 | 3-Major | BT883049 | Statsd can deadlock with rrdshim if an rrd file is invalid | 17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5 |
803109-4 | 3-Major | BT803109 | Certain configuration may result in zombie forwarding flows | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6 |
794385-6 | 3-Major | BT794385 | BGP sessions may be reset after CMP state change | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.5 |
672963-1 | 3-Major | BT672963 | MSSQL monitor fails against databases using non-native charset | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1083989-1 | 3-Major | BT1083989 | TMM may restart if abort arrives during MBLB iRule execution | 17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5 |
1073973-1 | 3-Major | BT1073973 | Gateway HTTP/2, response payload intermittently not forwarded to client. | 17.0.0, 16.1.2.2 |
1072953-2 | 3-Major | BT1072953 | Memory leak in traffic management interface. | 17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5 |
1071585-1 | 3-Major | BT1071585 | BIG-IP system does not respond to an arp from a SelfIP configured in virtual wire mode | 17.0.0, 16.1.2.2 |
1068561-1 | 3-Major | BT1068561 | Can't create key on the second netHSM partition. | 17.0.0, 16.1.2.2, 15.1.5.1 |
1068353-1 | 3-Major | BT1068353 | Unexpected event sequence may cause HTTP/2 flow stall during shutdown | 16.1.2.2 |
1064157-1 | 3-Major | BT1064157 | Http_proxy_opaque_get should constrain search to local/spawn flows, not looped flows | 17.0.0, 16.1.2.2, 15.1.6.1 |
1063453-1 | 3-Major | BT1063453 | FastL4 virtual servers translating between IPv4 and IPv6 may crash on fragmented packets. | 17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5 |
1058469-1 | 3-Major | BT1058469 | Disabling strict-updates for an iApp service which includes a non-default NTLM profile will cause virtual servers using that profile to stop working. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6 |
1056401-4 | 3-Major | BT1056401 | Valid clients connecting under active syncookie mode might experience latency. | 17.0.0, 16.1.2.2, 15.1.5.1 |
1055097-1 | 3-Major | BT1055097 | TCP proxy with ramcache and OneConnect can result in out-of-order events, which stalls the flow. | 17.0.0, 16.1.2.2 |
1052929-4 | 3-Major | BT1052929 | MCPD logs "An internal login failure is being experienced on the FIPS card" when FIPS HSM is uninitialized. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1043357-4 | 3-Major | BT1043357 | SSL handshake may fail when using remote crypto client | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6 |
1043017-4 | 3-Major | BT1043017 | Virtual-wire with standard-virtual fragmentation | 17.0.0, 16.1.2.2, 15.1.6.1, 14.1.4.6 |
1042913-2 | 3-Major | BT1042913 | Pkcs11d CPU utilization jumps to 100% | 17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5 |
1042509-1 | 3-Major | BT1042509 | On an HTTP2 gateway virtual server, TMM does not ever update the stream's window for a large POST request | 17.0.0, 16.1.2.2 |
1029897-1 | 3-Major | K63312282, BT1029897 | Malformed HTTP2 requests can be passed to HTTP/1.1 server-side pool members. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1024841-2 | 3-Major | BT1024841 | SSL connection mirroring with ocsp connection failure on standby | 17.0.0, 16.1.2.2, 15.1.5.1 |
1024225-3 | 3-Major | BT1024225 | BIG-IP sends "Transfer-Encoding: chunked" to http/2 client after HEAD request | 17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5 |
1020549-1 | 3-Major | BT1020549 | Server-side connections stall with zero window with OneConnect profile | 17.0.0, 16.1.2.2 |
1017721-5 | 3-Major | BT1017721 | WebSocket does not close cleanly when SSL enabled. | 17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5.1 |
1017533-3 | 3-Major | BT1017533 | Using TMC might cause virtual server vlans-enabled configuration to be ignored | 17.0.0, 16.1.2.2, 15.1.6.1, 14.1.4.6 |
1016449-3 | 3-Major | BT1016449 | After certain configuration tasks are performed, TMM may run with stale Self IP parameters. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6 |
1008501-1 | 3-Major | BT1008501 | TMM core | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6 |
1008009-3 | 3-Major | BT1008009 | SSL mirroring null hs during session sync state | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.5 |
1006781-2 | 3-Major | BT1006781 | Server SYN is sent on VLAN 0 when destination MAC is multicast | 17.0.0, 16.1.2.2, 15.1.4.1 |
1004897-5 | 3-Major | BT1004897 | 'Decompression' is logged instead of 'Max Headers Exceeded' GoAway reason | 17.0.0, 16.1.2.2, 15.1.6.1, 14.1.4.4 |
1004689-4 | 3-Major | BT1004689 | TMM might crash when pool routes with recursive nexthops and reselect option are used. | 17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5 |
838305-9 | 4-Minor | BT838305 | BIG-IP may create multiple connections for packets that should belong to a single flow. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6 |
717806-8 | 4-Minor | BT717806 | In the case of 'n' bigd instances, uneven CPU load distribution is seen when a high number of monitors are configured | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1080341-4 | 4-Minor | BT1080341 | Changing an L2-forward virtual to any other virtual type might not update the configuration. | 17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5 |
1075205-1 | 4-Minor | BT1075205 | Using TCP::close after HTTP::redirect/HTTP::respond causes HTTP response not to be delivered to the client. | 17.0.0, 16.1.2.2 |
1064669-1 | 4-Minor | BT1064669 | Using HTTP::enable iRule command in RULE_INIT event might cause TMM to crash. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.5 |
1026605-6 | 4-Minor | BT1026605 | When bigd.mgmtroutecheck is enabled monitor probes may be denied for non-mgmt routes | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1026005-1 | 4-Minor | BT1026005 | BIG-IP Virtual Edition (VE) does NOT preserve the order of NICs 5-10 defined in the VMware ESXi hypervisor and NSXT platforms. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.5 |
1016441-4 | 4-Minor | RFC Enforcement Hardening | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6 | |
1016049-6 | 4-Minor | BT1016049 | EDNS query with CSUBNET dropped by protocol inspection | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6 |
968581-4 | 5-Cosmetic | BT968581 | TMSH option max-response for "show /ltm profile ramcache" command may not comply with its description | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.5 |
Global Traffic Manager (DNS) Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1062513-4 | 2-Critical | BT1062513 | GUI returns 'no access' error message when modifying a GTM pool property. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1030881-1 | 2-Critical | BT1030881 | [GTM] Upgrade failure - 01070022:3: The monitor template min was not found.★ | 17.0.0, 16.1.2.2 |
1027657-4 | 2-Critical | BT1027657 | Monitor scheduling is sometimes inconsistent for "require M from N" monitor rules. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.5 |
1011433-1 | 2-Critical | BT1011433 | TMM may crash under memory pressure when performing DNS resolution | 17.0.0, 16.1.2.2, 15.1.6.1 |
1010617-1 | 2-Critical | BT1010617 | String operation against DNS resource records cause tmm memory corruption | 17.0.0, 16.1.2.2, 15.1.5.1 |
876677-2 | 3-Major | BT876677 | When running the debug version of TMM, an assertion may be triggered due to an expired DNS lookup. | 17.0.0, 16.1.2.2, 15.1.6.1 |
1076401-5 | 3-Major | BT1076401 | Memory leak in TMM (ldns) when exceeding dnssec.maxnsec3persec. | 17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5 |
1064189-1 | 3-Major | BT1064189 | DoH proxy and server listeners from GUI with client-ssl profile and server-ssl profile set to None produces undefined warning | 17.0.0, 16.1.2.2 |
1046785-1 | 3-Major | BT1046785 | Missing GTM probes when max synchronous probes are exceeded. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.5, 13.1.5 |
1044425-1 | 3-Major | K85021277, BT1044425 | NSEC3 record improvements for NXDOMAIN | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1020337-2 | 3-Major | BT1020337 | DNS msg_ObjType can cause buffer overrun due to lack of NUL terminator | 17.0.0, 16.1.2.2, 15.1.5.1 |
1018613-1 | 3-Major | BT1018613 | Modify wideip pools with replace-all-with results pools with same order 0 | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
Application Security Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1079909-1 | 2-Critical | K82724554, BT1079909 | The bd generates a core file | 17.0.0, 16.1.2.2, 15.1.6.1, 14.1.4.6, 13.1.5 |
1069501-1 | 2-Critical | K22251611, BT1069501 | ASM may not match certain signatures | 17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5 |
1069449-1 | 2-Critical | K39002226, BT1069449 | ASM attack signatures may not match cookies as expected | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1068237-1 | 2-Critical | BT1068237 | Some attack signatures added to policies are not used. | 17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5 |
1000789-1 | 2-Critical | BT1000789 | ASM-related iRule keywords may not work as expected | 17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5 |
965785-4 | 3-Major | BT965785 | Active/Standby sync process fails to populate table DCC.HSL_DATA_PROFILES on standby machine | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6 |
961509-5 | 3-Major | BT961509 | ASM blocks WebSocket frames with signature matched but Transparent policy | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6 |
926845-7 | 3-Major | BT926845 | Inactive ASM policies are deleted upon upgrade | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
923221-8 | 3-Major | BT923221 | BD does not use all the CPU cores | 17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5 |
818889-1 | 3-Major | BT818889 | False positive malformed json or xml violation. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1077281-2 | 3-Major | BT1077281 | Import xml policy fails with “Malformed xml” error when session awareness configuration contains login pages | 17.1.0, 16.1.2.2, 15.1.6.1 |
1072197-1 | 3-Major | K94142349, BT1072197 | Issue with input normalization in WebSocket. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1070273-1 | 3-Major | BT1070273 | OWASP Dashboard does not calculate Disallow DTDs in XML content profile protection properly. | 17.0.0, 16.1.2.2, 15.1.6.1 |
1069133-4 | 3-Major | BT1069133 | ASMConfig memory leak | 17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5 |
1067285-1 | 3-Major | BT1067285 | Re-branding - Change 'F5 Networks, Inc.' to 'F5, Inc.' | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1066829-1 | 3-Major | BT1066829 | Memory leak for xml/json auto-detected parameter with signature patterns. | 17.0.0, 16.1.2.2, 15.1.5.1 |
1061617-4 | 3-Major | BT1061617 | Some of the URL Attack signatures are not detected in the URL if "Handle Path Parameters" is configured "As Parameters". | 17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5 |
1060933-1 | 3-Major | K49237345 | Issue with input normalization. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1059621-2 | 3-Major | BT1059621 | IP Exceptions feature and SSRF feature do not work as expected if both the entries are configured with the same IP/IPs. | 17.0.0, 16.1.2.2 |
1056365-1 | 3-Major | BT1056365 | Bot Defense injection does not follow best SOP practice. | 17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5 |
1052173-1 | 3-Major | BT1052173 | For wildcard SSRF hosts "Matched Disallowed Address" field is wrong in the SSRF violation. | 17.0.0, 16.1.2.2 |
1052169 | 3-Major | BT1052169 | Traffic is blocked on detection of an SSRF violation even though the URI parameter is in staging mode | 16.1.2.2 |
1051213-1 | 3-Major | BT1051213 | Increase default value for violation 'Check maximum number of headers'. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1051209-1 | 3-Major | K53593534, BT1051209 | BD may not process certain HTTP payloads as expected | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1047389-4 | 3-Major | BT1047389 | Bot Defense challenge hardening | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6 |
1043533-3 | 3-Major | BT1043533 | Unable to pick up the properties of the parameters from audit reports. | 17.0.0, 16.1.2.2, 15.1.5.1 |
1043385-4 | 3-Major | BT1043385 | No Signature detected If Authorization header is missing padding. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1042605-1 | 3-Major | BT1042605 | ASM Critical Warnings during UCS load after upgrade to v15.1.0 or above★ | 17.0.0, 16.1.2.2, 15.1.5.1 |
1041149-1 | 3-Major | BT1041149 | Staging of URL does not affect apply value signatures | 17.0.0, 16.1.2.2, 15.1.5.1 |
1038733-4 | 3-Major | BT1038733 | Attack signature not detected for unsupported authorization types. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1037457-1 | 3-Major | BT1037457 | High CPU during specific dos mitigation | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1033017-1 | 3-Major | BT1033017 | Policy changes learning mode to automatic after upload and sync | 17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5 |
1030853-1 | 3-Major | BT1030853 | Route domain IP exception is being treated as trusted (for learning) after being deleted | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1028473-1 | 3-Major | BT1028473 | URL sent with trailing slash might not be matched in ASM policy | 17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5 |
1023993-4 | 3-Major | BT1023993 | Brute Force is not blocking requests, even when auth failure happens multiple times | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1021521-1 | 3-Major | BT1021521 | JSON Schema is not enforced if OpenAPI media-type is wild card. | 17.0.0, 16.1.2.2 |
1019721-1 | 3-Major | BT1019721 | Wrong representation of JSON/XML validation files in template based (minimal) JSON policy export | 17.0.0, 16.1.2.2 |
1012221-1 | 3-Major | BT1012221 | Message: childInheritanceStatus is not compatible with parentInheritanceStatus★ | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6 |
1011069-1 | 3-Major | BT1011069 | Group/User R/W permissions should be changed for .pid and .cfg files. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1008849-4 | 3-Major | BT1008849 | OWASP "A4 XML External Entities (XXE)" is not reflecting the XXE signatures configuration. | 17.0.0, 16.1.2.2, 15.1.5.1 |
844045-4 | 4-Minor | BT844045 | ASM Response event logging for "Illegal response" violations. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1066377-1 | 4-Minor | BT1066377 | OpenAPI - Content profile is not consistent with wildcard configuration | 17.0.0, 16.1.2.2 |
1050697-4 | 4-Minor | BT1050697 | Traffic learning page counts Disabled signatures when they are ready to be enforced | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1048445-1 | 4-Minor | BT1048445 | Accept Request button is clickable for unlearnable violation illegal host name | 17.1.0, 16.1.2.2, 15.1.6.1 |
1039245-2 | 4-Minor | BT1039245 | Policy Properties screen does not load and display | 17.0.0, 16.1.2.2 |
1038741-4 | 4-Minor | BT1038741 | NTLM type-1 message triggers "Unparsable request content" violation. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1036521-1 | 4-Minor | BT1036521 | TMM crash in certain cases | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1035361-4 | 4-Minor | BT1035361 | Illegal cross-origin after successful CAPTCHA | 17.1.0, 16.1.2.2, 15.1.5.1, 14.1.5 |
1034941-1 | 4-Minor | BT1034941 | Exporting and then re-importing "some" XML policy does not load the XML content-profile properly | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1021637-4 | 4-Minor | BT1021637 | In some cases BD enforces CSRF on all URLs, ignoring CSRF URLs | 17.1.0, 16.1.2.2, 15.1.6.1 |
1020717-4 | 4-Minor | BT1020717 | Policy versions cleanup process sometimes removes newer versions | 17.1.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
Application Visibility and Reporting Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1038913-4 | 3-Major | BT1038913 | The weekly ASM reporting "Security ›› Reporting : Application : Charts" filter "View By" as IP Intelligence shows only the "Safe" category | 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
Access Policy Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
858005-1 | 3-Major | BT858005 | When APM VPE “IP Subnet Match” agent configured with leading/trailing spaces runtime evaluation results in failure with error in /var/log/apm "Rule evaluation failed with error:" | 17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5 |
423519-5 | 3-Major | K74302282, BT423519 | Bypass disabling the redirection controls configuration of APM RDP Resource. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1045229-1 | 3-Major | BT1045229 | APMD leaks Tcl_Objs as part of the fix made for ID 1002557 | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.5 |
1044121-3 | 3-Major | BT1044121 | APM logon page is not rendered if db variable "ipv6.enabled" is set to false | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.5 |
Service Provider Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1029397-4 | 2-Critical | BT1029397 | Tmm may crash with SIP-ALG deployment in a particular race condition | 17.0.0, 16.1.2.2, 15.1.5, 14.1.4.6 |
957905-1 | 3-Major | BT957905 | SIP Requests / Responses over TCP without content_length header are not aborted by BIG-IP. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
1082885-1 | 3-Major | BT1082885 | MR::message route virtual asserts when configuration changes during ongoing traffic | 17.0.0, 16.1.2.2, 15.1.6, 14.1.5 |
Advanced Firewall Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
964625-5 | 3-Major | BT964625 | Improper processing of firewall-rule metadata | 17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5 |
959609-4 | 3-Major | BT959609 | Autodiscd daemon keeps crashing | 17.0.0, 16.1.2.2, 15.1.6.1 |
929909-3 | 3-Major | BT929909 | TCP Packets are not dropped in IP Intelligence | 17.0.0, 16.1.2.2, 15.1.5.1 |
1008265-1 | 3-Major | K92306170, BT1008265 | DoS Flood and Sweep vector states are disabled on an upgrade to BIG-IP software versions 14.x and beyond★ | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6 |
1072057-1 | 4-Minor | BT1072057 | "ANY" appears despite setting an IP address or host as the source in Security->Network Firewall->Policy. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6 |
Policy Enforcement Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1086897-1 | 2-Critical | BT1086897 | PEM subcriber lookup can fail for internet side/subscriber side new connections | 17.0.0, 16.1.2.2 |
Carrier-Grade NAT Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1028269-2 | 2-Critical | BT1028269 | Device using CGNAT + subscriber discovery license shows unknown for pem_subscriber-id. | 17.0.0, 16.1.2.2, 15.1.5.1 |
1019613-5 | 2-Critical | BT1019613 | Unknown subscriber in PBA deployment may cause CPU spike | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6 |
1064217-1 | 3-Major | BT1064217 | Port bit not set correctly in the ipv6 destination address with 1:8 mapping for CGNAT MAP-T. | 17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5 |
Fraud Protection Services Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1038445-1 | 2-Critical | BT1038445 | During upgrade to 16.1, the previous FPS Engine live update remains active★ | 17.0.0, 16.1.2.2 |
873617-1 | 3-Major | BT873617 | DataSafe is not available with AWAF license after BIG-IP startup or MCP restart. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
Anomaly Detection Services Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1071181-2 | 3-Major | BT1071181 | Improving Signature Detection Accuracy | 16.1.2.2, 15.1.6.1, 14.1.5 |
1060409-2 | 4-Minor | BT1060409 | Behavioral DoS enable checkbox is wrong. | 17.1.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
Traffic Classification Engine Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1033829-3 | 2-Critical | BT1033829 | Unable to load Traffic Classification package | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.5 |
1052153-2 | 3-Major | BT1052153 | Signature downloads for traffic classification updates via proxy fail | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6 |
Protocol Inspection Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1072733-4 | 2-Critical | Protocol Inspection IM package hardening | 17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5 | |
1070677-1 | 3-Major | BT1070677 | Learning phase does not take traffic into account - dropping all. | 17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5 |
940261-1 | 4-Minor | BT940261 | Support IPS package downloads via HTTP proxy. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6 |
In-tmm monitors Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
944121-4 | 3-Major | BT944121 | Missing SNI information when using non-default domain https monitor running in TMM mode. | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5 |
854129-6 | 3-Major | BT854129 | SSL monitor continues to send previously configured server SSL configuration after removal | 17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5 |
SSL Orchestrator Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1050969-1 | 1-Blocking | BT1050969 | After running clear-rest-storage you are logged out of the UI with a message - Your login credentials no longer valid | 17.0.0, 16.1.2.2, 15.1.5.1, 14.1.5 |
969297 | 3-Major | BT969297 | Virtual IP configured on a system with SelfIP on vwire becomes unresponsive | 16.1.2.2 |
1058401-1 | 3-Major | BT1058401 | SSL Bypass does not work for inbound traffic | 17.0.0, 16.1.2.2 |
1048033-1 | 3-Major | BT1048033 | Server-speaks-first traffic might not work with SSL Orchestrator | 17.0.0, 16.1.2.2 |
1047377-1 | 3-Major | BT1047377 | "Server-speak-first" traffic might not work with SSL Orchestrator | 17.0.0, 16.1.2.2 |
1029869-1 | 3-Major | BT1029869 | Use of ha-sync script may cause gossip communications to fail | 17.0.0, 16.1.2.2, 15.1.6.1 |
1029585-1 | 3-Major | BT1029585 | Use of ha-sync script may cause platforms in a sync-failover device group to fall out of sync | 17.0.0, 16.1.2.2, 15.1.6.1 |
Cumulative fixes from BIG-IP v16.1.2.1 that are included in this release
Vulnerability Fixes
ID Number | CVE | Links to More Info | Description | Fixed Versions |
1045101-4 | CVE-2022-26890 | K03442392, BT1045101 | Bd may crash while processing ASM traffic | 17.0.0, 16.1.2.1, 15.1.5, 14.1.4.6, 13.1.5 |
940185-7 | CVE-2022-23023 | K11742742, BT940185 | icrd_child may consume excessive resources while processing REST requests | 17.0.0, 16.1.2.1, 15.1.5, 14.1.4.5, 13.1.5 |
1063389-6 | CVE-2015-5191 | K84583382, BT1063389 | open-vm-tools vulnerability: CVE-2015-5191 | 17.0.0, 16.1.2.1, 14.1.5 |
Functional Change Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1015133-5 | 3-Major | BT1015133 | Tail loss can cause TCP TLP to retransmit slowly. | 17.0.0, 16.1.2.1, 15.1.5, 14.1.4.5, 13.1.5 |
TMOS Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
749332-1 | 2-Critical | BT749332 | Client-SSL Object's description can be updated using CLI and with REST PATCH operation | 17.0.0, 16.1.2.1, 15.1.5, 14.1.4.4 |
996001-5 | 3-Major | BT996001 | AVR Inspection Dashboard 'Last Month' does not show all data points | 17.0.0, 16.1.2.1, 15.1.5, 14.1.4.5 |
994305-3 | 3-Major | BT994305 | The version of open-vm-tools included with BIG-IP Virtual Edition is 10.1.5 | 17.0.0, 16.1.2.1, 15.1.5.1 |
968657-1 | 3-Major | BT968657 | Added support for IMDSv2 on AWS | 17.0.0, 16.1.2.1, 15.1.5.1 |
1032949-1 | 3-Major | BT1032949 | Dynamic CRL configured with client authentication profile as "Request" causes connection termination without certificate. | 17.0.0, 16.1.2.1, 15.1.5 |
1041765-2 | 4-Minor | BT1041765 | Racoon may crash in rare cases | 17.0.0, 16.1.2.1 |
Local Traffic Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
999097-1 | 3-Major | BT999097 | SSL::profile may select profile with outdated configuration | 17.0.0, 16.1.2.1, 15.1.5, 14.1.4.5 |
910673-6 | 3-Major | BT910673 | Nethsm-thales-install.sh installation fails with error 'Could not reach Thales HSM' | 17.0.0, 16.1.2.1, 15.1.5.1 |
898929-6 | 3-Major | BT898929 | Tmm might crash when ASM, AVR, and pool connection queuing are in use | 17.0.0, 16.1.2.1, 15.1.5, 14.1.4.5, 13.1.5 |
1065789-1 | 3-Major | TMM may send duplicated alerts while processing SSL connections | 17.0.0, 16.1.2.1, 15.1.5 | |
1038629-4 | 3-Major | BT1038629 | DTLS virtual server not performing clean shutdown upon reception of CLOSE_NOTIFY from client | 17.0.0, 16.1.2.1, 15.1.5, 14.1.4.5, 13.1.5 |
1031609-1 | 3-Major | BT1031609 | Improve nethsm-thales-install.sh and nethsm-thales-rfs-install.sh to be compatible with Entrust Client v12.60.10 package.★ | 17.0.0, 16.1.2.1, 15.1.5.1 |
1019609-1 | 3-Major | BT1019609 | No Error logging when BIG-IP device's IP address is not added in client list on netHSM.★ | 17.0.0, 16.1.2.1, 15.1.5.1 |
1017513-5 | 3-Major | BT1017513 | Config sync fails with error Invalid monitor rule instance identifier or monitors are in a bad state such as checking | 17.0.0, 16.1.2.1, 15.1.5.1, 14.1.4.5, 13.1.5 |
1007749-2 | 3-Major | BT1007749 | URI TCL parse functions fail when there are interior segments with periods and semi-colons | 17.0.0, 16.1.2.1, 15.1.5 |
1048433-1 | 4-Minor | BT1048433 | Improve Extract logic of thales-sync.sh to support VIPRION cluster to support 12.6.10 client installation.★ | 16.1.2.1, 15.1.5.1 |
1024761-1 | 4-Minor | BT1024761 | HTTP adds Transfer-Encoding and terminating chunk to responses that cannot have a body | 17.0.0, 16.1.2.1, 15.1.5 |
1005109-4 | 4-Minor | BT1005109 | TMM crashes when changing traffic-group on IPv6 link-local address | 17.0.0, 16.1.2.1, 15.1.5, 14.1.4.5 |
Global Traffic Manager (DNS) Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
935249-3 | 3-Major | BT935249 | GTM virtual servers have the wrong status | 17.0.0, 16.1.2.1, 15.1.5 |
1039553-1 | 3-Major | BT1039553 | Non-200 HTTP status codes fail to be matched by GTM HTTP(S) monitors | 17.0.0, 16.1.2.1, 15.1.5 |
1021061-4 | 3-Major | BT1021061 | Config fails to load for large config on platform with Platform FIPS license enabled | 17.0.0, 16.1.2.1, 15.1.5, 14.1.4.5, 13.1.5 |
Application Security Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
993613-7 | 2-Critical | BT993613 | Device fails to request full sync | 17.0.0, 16.1.2.1, 15.1.5, 14.1.4.5, 13.1.5 |
984593-1 | 3-Major | BT984593 | BD crash | 17.0.0, 16.1.2.1, 15.1.5, 14.1.4.5, 13.1.5 |
921697-1 | 3-Major | BT921697 | Attack signature updates fail to install with Installation Error.★ | 17.0.0, 16.1.2.1, 15.1.5.1, 14.1.4.6 |
907025-5 | 3-Major | BT907025 | Live update error" 'Try to reload page' | 17.0.0, 16.1.2.1, 15.1.5, 14.1.4.5 |
885765-1 | 3-Major | BT885765 | ASMConfig Handler undergoes frequent restarts | 17.0.0, 16.1.2.1, 15.1.5, 14.1.4.5 |
830341-5 | 3-Major | BT830341 | False positives Mismatched message key on ASM TS cookie | 17.0.0, 16.1.2.1, 16.0.1.2, 15.1.4, 14.1.4.2, 13.1.4.1 |
1043205-1 | 3-Major | BT1043205 | SSRF Violation should be shown as a Parameter Entity Reference. | 16.1.2.1 |
1042069-1 | 3-Major | Some signatures are not matched under specific conditions. | 17.0.0, 16.1.2.1, 15.1.4.1, 14.1.4.5, 13.1.5 | |
1002385-1 | 4-Minor | K67397230, BT1002385 | Fixing issue with input normalization | 17.0.0, 16.1.2.1, 15.1.5, 14.1.4.6 |
Application Visibility and Reporting Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1009093-2 | 2-Critical | BT1009093 | GUI widgets pages are not functioning correctly | 17.0.0, 16.1.2.1, 15.1.5 |
Access Policy Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
969317-4 | 3-Major | BT969317 | "Restrict to Single Client IP" option is ignored for vmware VDI | 17.0.0, 16.1.2.1, 15.1.4.1, 14.1.4.5 |
828761-5 | 3-Major | BT828761 | APM OAuth - Auth Server attached iRule works inconsistently | 17.0.0, 16.1.2.1, 15.1.5, 14.1.4.5 |
827393-5 | 3-Major | BT827393 | In rare cases tmm crash is observed when using APM as RDG proxy. | 17.0.0, 16.1.2.1, 15.1.5.1, 14.1.4.5, 13.1.5 |
738593-3 | 3-Major | BT738593 | Vmware Horizon session collaboration (shadow session) feature does not work through APM. | 17.0.0, 16.1.2.1, 15.1.5, 14.1.4.5 |
1007677-2 | 3-Major | BT1007677 | Artifact resolution on SAML IdP fails with error 'SAML SSO: Cannot find SP connector' | 17.0.0, 16.1.2.1, 15.1.4.1 |
Service Provider Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1039329-2 | 3-Major | BT1039329 | MRF per peer mode is not working in vCMP guest. | 17.0.0, 16.1.2.1, 15.1.5, 14.1.4.5 |
1025529-2 | 3-Major | BT1025529 | TMM generates core when iRule executes a nexthop command and SIP traffic is sent | 17.0.0, 16.1.2.1, 15.1.4.1, 14.1.4.5 |
Policy Enforcement Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
956013-4 | 3-Major | BT956013 | System reports{{validation_errors}} | 16.1.2.1, 15.1.5, 14.1.4.5 |
Anomaly Detection Services Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1023437-1 | 3-Major | Buffer overflow during attack with large HTTP Headers | 17.0.0, 16.1.2.1, 15.1.5, 14.1.4.5, 13.1.5 |
SSL Orchestrator Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1055361-1 | 2-Critical | BT1055361 | Suspending iRule command in L7CHECK_CLIENT_DATA can lead to a tmm crash. | 17.0.0, 16.1.2.1, 15.1.5.1 |
Cumulative fixes from BIG-IP v16.1.2 that are included in this release
Vulnerability Fixes
ID Number | CVE | Links to More Info | Description | Fixed Versions |
991421-2 | CVE-2022-23016 | K91013510, BT991421 | TMM may crash while processing TLS traffic | 17.0.0, 16.1.2, 15.1.4.1 |
989701-8 | CVE-2020-25212 | K42355373, BT989701 | CVE-2020-25212 Kernel: A flaw was found in the NFSv4 implementation where when mounting a remote attacker controlled server it could return specially crafted response | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5 |
988549-10 | CVE-2020-29573 | K27238230, BT988549 | CVE-2020-29573: glibc vulnerability | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5 |
968893-3 | CVE-2022-23014 | K93526903, BT968893 | TMM crash when processing APM traffic | 17.0.0, 16.1.2, 15.1.4.1 |
940317-9 | CVE-2020-13692 | K23157312, BT940317 | CVE-2020-13692: PostgreSQL JDBC Driver vulnerability | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.4, 13.1.5 |
1037181-1 | CVE-2022-23022 | K96924184, BT1037181 | TMM may crash while processing HTTP traffic | 17.0.0, 16.1.2 |
1032405-1 | CVE-2021-23037 | K21435974, BT1032405 | TMUI XSS vulnerability CVE-2021-23037 | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5 |
1031269 | CVE-2022-23020 | K17514331, BT1031269 | TMM may consume excessive resources when processing logging profiles | 17.0.0, 16.1.2 |
1030689-1 | CVE-2022-23019 | K82793463, BT1030689 | TMM may consume excessive resources while processing Diameter traffic | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.4, 13.1.5 |
1029629-1 | CVE-2022-28706 | K03755971, BT1029629 | TMM may crash while processing DNS lookups | 17.0.0, 16.1.2, 15.1.5.1 |
1028669-7 | CVE-2019-9948 | K28622040, BT1028669 | Python vulnerability: CVE-2019-9948 | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5 |
1028573-6 | CVE-2020-10878 | K40508224, BT1028573 | Perl vulnerability: CVE-2020-10878 | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5 |
1028497-7 | CVE-2019-15903 | K05295469, BT1028497 | libexpat vulnerability: CVE-2019-15903 | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5 |
1021713-1 | CVE-2022-41806 | K00721320, BT1021713 | TMM may crash when processing AFM NAT64 policy | 17.0.0, 16.1.2, 15.1.5.1 |
1012365-4 | CVE-2021-20305 | K33101555, BT1012365 | Nettle cryptography library vulnerability CVE-2021-20305 | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5 |
1007489-7 | CVE-2022-23018 | K24358905, BT1007489 | TMM may crash while handling specific HTTP requests★ | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5 |
974341-6 | CVE-2022-23026 | K08402414, BT974341 | REST API: File upload | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5 |
973409-6 | CVE-2020-1971 | K42910051, BT973409 | CVE-2020-1971 - openssl: EDIPARTYNAME NULL pointer de-reference | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.4 |
941649-8 | CVE-2021-23043 | K63163637, BT941649 | Local File Inclusion Vulnerability | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5 |
803965-10 | CVE-2018-20843 | K51011533, BT803965 | Expat Vulnerability: CVE-2018-20843 | 17.0.0, 16.1.2, 15.1.4, 14.1.4.5, 13.1.5 |
1035729-1 | CVE-2022-23021 | K57111075, BT1035729 | TMM may crash while processing traffic http traffic | 17.0.0, 16.1.2 |
1009725-1 | CVE-2022-23030 | K53442005, BT1009725 | Excessive resource usage when ixlv drivers are enabled | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5 |
Functional Change Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
985953-6 | 4-Minor | BT985953 | GRE Transparent Ethernet Bridging inner MAC overwrite | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5 |
TMOS Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1039049-2 | 1-Blocking | BT1039049 | Installing EHF on particular platforms fails with error "RPM transaction failure" | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5 |
997313-2 | 2-Critical | BT997313 | Unable to create APM policies in a sync-only folder★ | 17.0.0, 16.1.2, 15.1.4.1 |
1031357-2 | 2-Critical | BT1031357 | After reboot of standby and terminating peer, some IPsec traffic-selectors are still online | 17.0.0, 16.1.2 |
1029949-2 | 2-Critical | BT1029949 | IPsec traffic selector state may show incorrect state on high availability (HA) standby device | 17.0.0, 16.1.2 |
998221-1 | 3-Major | BT998221 | Accessing pool members from configuration utility is slow with large config | 17.0.0, 16.1.2, 16.0.1.2, 15.1.4, 14.1.4.3 |
946185-3 | 3-Major | BT946185 | Unable to view iApp component due to error 'An error has occurred while trying to process your request.'★ | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.4 |
922185-3 | 3-Major | BT922185 | LDAP referrals not supported for 'cert-ldap system-auth'★ | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5 |
881085-4 | 3-Major | BT881085 | Intermittent auth failures with remote LDAP auth for BIG-IP managment | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5 |
708991-1 | 3-Major | BT708991 | Newly entered password is not remembered. | 17.0.0, 16.1.2 |
1045421-1 | 3-Major | K16107301, BT1045421 | No Access error when performing various actions in the TMOS GUI | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5 |
1032737-2 | 3-Major | BT1032737 | IPsec: tmm SIGSEGV in getlocaladdr in ikev2_initiate | 17.0.0, 16.1.2, 15.1.4.1 |
1032077-1 | 3-Major | BT1032077 | TACACS authentication fails with tac_author_read: short author body | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5 |
1028969-1 | 3-Major | BT1028969 | An unused traffic-selector can prevent an IKEv2 IPsec tunnel from working | 17.0.0, 16.1.2 |
1026549-1 | 3-Major | BT1026549 | Incorrect BIG-IP Virtual Edition interface state changes may be communicated to mcpd | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5 |
1022757-2 | 3-Major | BT1022757 | Tmm core due to corrupt list of ike-sa instances for a connection | 17.0.0, 16.1.2 |
1021773-1 | 3-Major | BT1021773 | Mcpd core. | 17.0.0, 16.1.2, 15.1.7 |
1020377-1 | 3-Major | BT1020377 | Missing IKEv2 listeners can send IKE packets to the IKEv1 racoon daemon | 17.0.0, 16.1.2 |
1015645-2 | 3-Major | BT1015645 | IPSec SA's missing after reboot | 17.0.0, 16.1.2 |
1009949-4 | 3-Major | BT1009949 | High CPU usage when upgrading from previous version★ | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.4 |
1003257-6 | 3-Major | BT1003257 | ZebOS 'set ipv6 next-hop' and 'set ipv6 next-hop local' do not work as expected | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5 |
921365-2 | 4-Minor | BT921365 | IKE-SA on standby deleted due to re-transmit failure when failing over from active to standby | 17.0.0, 16.1.2, 15.1.4 |
1034617-1 | 4-Minor | BT1034617 | Login/Security Banner text not showing in console login. | 17.0.0, 16.1.2 |
1030845-1 | 4-Minor | BT1030845 | Time change from TMSH not logged in /var/log/audit. | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5 |
1022417-1 | 4-Minor | BT1022417 | Ike stops with error ikev2_send_request: [WINDOW] full window | 17.0.0, 16.1.2 |
Local Traffic Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1039041 | 1-Blocking | BT1039041 | Log Message: Clock advanced by <number> ticks | 17.0.0, 16.1.2 |
1040361-1 | 2-Critical | BT1040361 | TMM crashes during its startup when TMC destination port list attached/deleted to virtual server. | 17.0.0, 16.1.2, 15.1.5, 14.1.4.5 |
915773-7 | 3-Major | BT915773 | Restart of TMM after stale interface reference | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.4 |
1023365-2 | 3-Major | BT1023365 | SSL server response could be dropped on immediate client shutdown. | 17.0.0, 16.1.2, 15.1.4.1 |
1021481-1 | 3-Major | BT1021481 | 'http-tunnel' and 'socks-tunnel' (which are internal interfaces) should be hidden. | 17.0.0, 16.1.2 |
1020957-1 | 3-Major | BT1020957 | HTTP response may be truncated by the BIG-IP system | 17.0.0, 16.1.2 |
1018577-4 | 3-Major | BT1018577 | SASP monitor does not mark pool member with same IP Address but different Port from another pool member | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5 |
1016113-1 | 3-Major | BT1016113 | HTTP response-chunking 'sustain' profile option may not rechunk responses when also using a web acceleration profile. | 17.0.0, 16.1.2, 15.1.4 |
1008017-2 | 3-Major | BT1008017 | Validation failure on Enforce TLS Requirements and TLS Renegotiation | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5 |
895557-5 | 4-Minor | BT895557 | NTLM profile logs error when used with profiles that do redirect | 17.0.0, 16.1.2, 16.0.1.2, 15.1.4, 14.1.4.2 |
1031901-2 | 4-Minor | BT1031901 | In HTTP2 deployment, RST_STREAM sent to client if server in CLOSING state is picked | 17.0.0, 16.1.2, 15.1.4.1 |
1018493-1 | 4-Minor | BT1018493 | Response code 304 from TMM Cache always closes TCP connection. | 17.0.0, 16.1.2, 15.1.4, 14.1.4.5, 13.1.5 |
1002945-4 | 4-Minor | BT1002945 | Some connections are dropped on chained IPv6 to IPv4 virtual servers. | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5 |
Global Traffic Manager (DNS) Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1035853-1 | 2-Critical | K41415626, BT1035853 | Transparent DNS Cache can consume excessive resources. | 17.0.0, 16.1.2, 15.1.5, 14.1.4.5, 13.1.5 |
1028773-1 | 2-Critical | BT1028773 | Support for DNS Over TLS | 17.0.0, 16.1.2 |
1009037-1 | 2-Critical | BT1009037 | Tcl resume on invalid connection flow can cause tmm crash | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5 |
1021417-1 | 3-Major | BT1021417 | Modifying GTM pool members with replace-all-with results in pool members with order 0 | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5 |
Application Security Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
912149-7 | 2-Critical | BT912149 | ASM sync failure with Cgc::Channel error 'Failed to send a message, error:15638476' | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5 |
1019853-1 | 2-Critical | K30911244, BT1019853 | Some signatures are not matched under specific conditions | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5 |
1017153-4 | 2-Critical | BT1017153 | Asmlogd suddenly deletes all request log protobuf files and records from the database. | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5 |
1011065-1 | 2-Critical | K39002226, BT1011065 | Certain attack signatures may not match in multipart content | 17.0.0, 16.1.2, 15.1.4.1 |
1011061-4 | 2-Critical | K39002226, BT1011061 | Certain attack signatures may not match in multipart content | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5 |
947341-4 | 3-Major | BT947341 | MySQL generates multiple error 24 (too many files open) for PRX.REQUEST_LOG DB tables files. | 17.0.0, 16.1.2, 16.0.1.2, 15.1.3, 14.1.4.1 |
932133-1 | 3-Major | BT932133 | Payloads with large number of elements in XML take a lot of time to process | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.4, 13.1.5 |
842013-1 | 3-Major | BT842013 | ASM Configuration is Lost on License Reactivation★ | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5 |
1042917-1 | 3-Major | BT1042917 | Using 'Full Export' of security policy should result with no diffs after importing it back to device. | 17.0.0, 16.1.2 |
1028109-1 | 3-Major | BT1028109 | Detected attack signature is reported with the wrong context. | 17.0.0, 16.1.2 |
1022269-1 | 3-Major | BT1022269 | False positive RFC compliant violation | 17.0.0, 16.1.2, 15.1.4, 14.1.4.4, 13.1.5 |
1004069-4 | 3-Major | BT1004069 | Brute force attack is detected too soon | 17.0.0, 16.1.2, 15.1.5, 14.1.4.5, 13.1.5 |
1004537-2 | 4-Minor | BT1004537 | Traffic Learning: Accept actions for multiple suggestions not localized | 17.0.0, 16.1.2, 15.1.4 |
Application Visibility and Reporting Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
932137-7 | 3-Major | BT932137 | AVR data might be restored from non-relevant files in /shared/avr_afm partition during upgrade | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.4, 13.1.5 |
922105-1 | 3-Major | BT922105 | Avrd core when connection to BIG-IQ data collection device is not available | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.4, 13.1.5 |
1035133-4 | 3-Major | BT1035133 | Statistics data are partially missing in various BIG-IQ graphs under "Monitoring" tab | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5 |
948113-1 | 4-Minor | BT948113 | User-defined report scheduling fails | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5 |
1020705-2 | 4-Minor | BT1020705 | tmsh show analytics dos-l3 report view-by attack-id" shows "allowed-requests-per-second" instead "attack_type_name | 17.0.0, 16.1.2, 15.1.3.1, 14.1.4.4 |
Access Policy Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1027217-1 | 1-Blocking | BT1027217 | Script errors in Network Access window using browser. | 17.0.0, 16.1.2, 15.1.4.1 |
1006893-4 | 2-Critical | BT1006893 | Use of ACCESS::oauth after ACCESS::session create/delete may result in TMM core | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5 |
993457-1 | 3-Major | BT993457 | TMM core with ACCESS::policy evaluate iRule | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5 |
1021485-3 | 3-Major | BT1021485 | VDI desktops and apps freeze with Vmware and Citrix intermittently | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5 |
1017233-2 | 3-Major | BT1017233 | APM uses wrong session key when iRule for ActiveSync is used resulting in passwords corruption | 17.0.0, 16.1.2, 15.1.4.1 |
939877-3 | 4-Minor | BT939877 | OAuth refresh token not found | 17.0.0, 16.1.2, 15.1.4, 14.1.4.4 |
Service Provider Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1007113-3 | 2-Critical | BT1007113 | Pool member goes DOWN if the time difference between SCTP INIT and SCTP ABORT is less than two seconds | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5 |
1018285-2 | 4-Minor | BT1018285 | MRF DIAMETER to select automatic removal of a persistence entry on completion of a transaction | 17.0.0, 16.1.2, 15.1.4.1 |
1003633-1 | 4-Minor | BT1003633 | There might be wrong memory handling when message routing feature is used | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5 |
Advanced Firewall Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1049229-1 | 2-Critical | BT1049229 | When you try to create a sub-rule under the Network Firewall rule list, the error: 'No Access' displays. | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5 |
Traffic Classification Engine Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1013629-4 | 3-Major | BT1013629 | URLCAT: Scan finds many Group/User Read/Write (666/664/662) files | 17.0.0, 16.1.2 |
686783-1 | 4-Minor | BT686783 | UlrCat custom database feed list does not work when the URL contains a www prefix or capital letters. | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5 |
1032689 | 4-Minor | BT1032689 | UlrCat Custom db feedlist does not work for some URLs | 16.1.2, 15.1.4.1, 14.1.4.5 |
Device Management Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
929213-2 | 3-Major | BT929213 | iAppLX packages not rolled forward after BIG-IP upgrade★ | 17.0.0, 16.1.2, 15.1.4.1, 14.1.4.4 |
SSL Orchestrator Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1038669-1 | 3-Major | BT1038669 | Antserver keeps restarting. | 17.0.0, 16.1.2, 15.1.5 |
1032797-1 | 3-Major | BT1032797 | Tmm continuously cores when parsing custom category URLs | 17.0.0, 16.1.2, 15.1.5 |
Cumulative fixes from BIG-IP v16.1.1 that are included in this release
Vulnerability Fixes
ID Number | CVE | Links to More Info | Description | Fixed Versions |
979877-9 | CVE-2020-1971 | K42910051, BT979877 | CVE-2020-1971 OpenSSL: EDIPARTYNAME NULL pointer de-reference vulnerability description and available information | 16.1.1, 14.1.5.1 |
954425-4 | CVE-2022-23031 | K61112120, BT954425 | Hardening of Live-Update | 17.0.0, 16.1.1, 15.1.4, 14.1.4.4 |
797797-7 | CVE-2019-11811 | K01512680, BT797797 | CVE-2019-11811 kernel: use-after-free in drivers | 17.0.0, 16.1.1, 16.0.1.2, 15.1.4, 14.1.4.3 |
1013569-1 | CVE-2022-31473 | K34893234, BT1013569 | Hardening of iApps processing | 17.0.0, 16.1.1, 15.1.4 |
1008561-4 | CVE-2022-23025 | K44110411, BT1008561 | In very rare condition, BIG-IP may crash when SIP ALG is deployed | 17.0.0, 16.1.1, 15.1.4, 14.1.4.4, 13.1.5 |
Functional Change Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
911141-1 | 3-Major | BT911141 | GTP v1 APN is not decoded/encoded properly | 17.0.0, 16.1.1, 15.1.4, 14.1.4.4, 13.1.5 |
TMOS Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
974241-3 | 2-Critical | BT974241 | Creation of access policy with modern customization may lead to failover in a VIPRION or vCMP guest with multiple blades | 17.0.0, 16.1.1, 15.1.4 |
887117-4 | 3-Major | BT887117 | Invalid SessionDB messages are sent to Standby | 17.0.0, 16.1.1, 15.1.4.1 |
1019829-2 | 3-Major | BT1019829 | Configsync.copyonswitch variable is not functioning on reboot | 16.1.1 |
1018309-5 | 3-Major | BT1018309 | Loading config file with imish removes the last character | 17.0.0, 16.1.1, 15.1.4.1 |
Local Traffic Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1023341-1 | 1-Blocking | HSM hardening | 17.0.0, 16.1.1, 15.1.5.1, 14.1.4.6, 13.1.5 | |
995405-1 | 2-Critical | BT995405 | After upgrade, the copied SSL vhf/vht profile prevents traffic from passing★ | 17.0.0, 16.1.3, 16.1.1 |
1040677 | 2-Critical | BT1040677 | BIG-IP D120 platform reports page allocation failures in N3FIPS driver | 17.0.0, 16.1.1 |
980617-1 | 3-Major | BT980617 | SNAT iRule is not working with HTTP/2 and HTTP Router profiles | 17.0.0, 16.1.1 |
912945-3 | 4-Minor | BT912945 | A virtual server with multiple client SSL profiles, the profile with CN or SAN of the cert matching the SNI is not selected if cert is ECDSA-signed | 17.0.0, 16.1.1, 15.1.4, 14.1.4.4 |
Global Traffic Manager (DNS) Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1039069-1 | 1-Blocking | BT1039069 | Multiple issues affecting the RESOLV::lookup iRule command following the fix to ID1007049.★ | 17.0.0, 16.1.1, 15.1.4 |
993489-1 | 3-Major | BT993489 | GTM daemon leaks memory when reading GTM link objects | 17.0.0, 16.1.1, 16.0.1.2, 15.1.4, 14.1.4.4, 13.1.5 |
Application Security Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
996381-1 | 2-Critical | K41503304, BT996381 | ASM attack signature may not match as expected | 17.0.0, 16.1.1, 16.0.1.2, 15.1.4, 14.1.4.4, 13.1.4.1 |
970329-1 | 2-Critical | K70134152, BT970329 | ASM hardening | 17.0.0, 16.1.1, 15.1.4, 14.1.4.4, 13.1.5 |
965229-5 | 2-Critical | BT965229 | ASM Load hangs after upgrade★ | 17.0.0, 16.1.1, 15.1.4, 14.1.4.4, 13.1.5 |
986937-3 | 3-Major | BT986937 | Cannot create child policy when the signature staging setting is not equal in template and parent policy | 17.0.0, 16.1.1, 16.0.1.2, 15.1.4 |
981069-3 | 3-Major | BT981069 | Reset cause: "Internal error ( requested abort (payload release error))" | 17.0.0, 16.1.1, 15.1.4 |
962589-4 | 3-Major | BT962589 | Full Sync Requests Caused By Failed Relayed Call to delete_suggestion | 17.0.0, 16.1.1, 15.1.4, 14.1.4.4 |
951133-4 | 3-Major | BT951133 | Live Update does not work properly after upgrade★ | 17.0.0, 16.1.1, 16.0.1.2, 15.1.4, 14.1.4.4 |
920149-3 | 3-Major | BT920149 | Live Update default factory file for Server Technologies cannot be reinstalled | 17.0.0, 16.1.1, 15.1.4.1, 14.1.4.4 |
888289-8 | 3-Major | BT888289 | Add option to skip percent characters during normalization | 17.0.0, 16.1.1, 16.0.1.2, 15.1.4, 14.1.4.2, 13.1.4.1 |
1005105-3 | 3-Major | BT1005105 | Requests are missing on traffic event logging | 17.0.0, 16.1.1, 15.1.4, 14.1.4.5 |
1000741-1 | 3-Major | K67397230, BT1000741 | Fixing issue with input normalization | 17.0.0, 16.1.1, 15.1.4, 14.1.4.4 |
941625-3 | 4-Minor | BT941625 | BD sometimes encounters errors related to TS cookie building | 17.0.0, 16.1.1, 15.1.4 |
Application Visibility and Reporting Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
924945-5 | 3-Major | BT924945 | Fail to detach HTTP profile from virtual server | 17.0.0, 16.1.1, 16.0.1.2, 15.1.3 |
913085-6 | 3-Major | BT913085 | Avrd core when avrd process is stopped or restarted | 17.0.0, 16.1.1, 16.0.1.2, 15.1.4, 14.1.4.2, 13.1.4.1 |
909161-1 | 3-Major | BT909161 | A core file is generated upon avrd process restart or stop | 17.0.0, 16.1.1, 15.1.4, 14.1.4.4, 13.1.5 |
Access Policy Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1024101-1 | 3-Major | BT1024101 | SWG as a Service license improvements | 17.0.0, 16.1.3, 16.1.1 |
1022625-2 | 3-Major | BT1022625 | Profile type 'swg-transparent' should be selected on create page when 'create-new' is selected for SwgAsService in SSL Orchestrator | 17.0.0, 16.1.1 |
Service Provider Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
993913-4 | 2-Critical | BT993913 | TMM SIGSEGV core in Message Routing Framework | 17.0.0, 16.1.1, 15.1.4, 14.1.4.4 |
1012721-4 | 2-Critical | BT1012721 | Tmm may crash with SIP-ALG deployment in a particular race condition | 17.0.0, 16.1.1, 15.1.4.1, 14.1.4.4, 13.1.5 |
1007821-3 | 2-Critical | BT1007821 | SIP message routing may cause tmm crash | 17.0.0, 16.1.1, 15.1.4 |
996113-2 | 3-Major | BT996113 | SIP messages with unbalanced escaped quotes in headers are dropped | 17.0.0, 16.1.1, 15.1.4, 14.1.4.4, 13.1.5 |
805821-1 | 3-Major | BT805821 | GTP log message contains no useful information | 17.0.0, 16.1.1, 15.1.4, 14.1.4.4, 13.1.5 |
919301-1 | 4-Minor | BT919301 | GTP::ie count does not work with -message option | 17.0.0, 16.1.1, 15.1.4, 14.1.4.4, 13.1.5 |
913413-1 | 4-Minor | BT913413 | 'GTP::header extension count' iRule command returns 0 | 17.0.0, 16.1.1, 15.1.4, 14.1.4.4, 13.1.5 |
913409-1 | 4-Minor | BT913409 | GTP::header extension command may abort connection due to unreasonable TCL error | 17.0.0, 16.1.1, 15.1.4, 14.1.4.4, 13.1.5 |
913393-1 | 5-Cosmetic | BT913393 | Tmsh help page for GTP iRule contains incorrect and missing information | 17.0.0, 16.1.1, 15.1.4, 14.1.4.4, 13.1.5 |
Advanced Firewall Manager Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
992213-3 | 3-Major | BT992213 | Protocol Any displayed as HOPTOPT in AFM policy view | 17.0.0, 16.1.1, 15.1.4, 14.1.4.2 |
1000405-1 | 3-Major | BT1000405 | VLAN/Tunnels not listed when creating a new rule via GUI | 17.0.0, 16.1.1, 15.1.4 |
Protocol Inspection Fixes
ID Number | Severity | Links to More Info | Description | Fixed Versions |
1018145 | 3-Major | BT1018145 | Firewall Manager user role is not allowed to configure/view protocol inspection profiles | 16.1.1, 15.1.4 |
Cumulative fix details for BIG-IP v16.1.3.4 that are included in this release
999901-1 : Certain LTM policies may not execute correctly after a system reboot or TMM restart.
Links to More Info: K68816502, BT999901
Component: Local Traffic Manager
Symptoms:
After a system reboot or TMM restart, LTM policies referencing an external data-group may not execute correctly, regardless of a successful matching condition.
This can cause a wide range of issues, including misrouted traffic, unshaped traffic, the bypassing of ASM, or complete traffic failure (based on the policy actions).
Note that if a virtual server references multiple LTM policies, and only some of those policies reference an external data-group, all LTM policies attached to the virtual server will be affected.
Conditions:
-- LTM policy with an external data-group configured on a virtual server.
-- System reboot or TMM restart.
Impact:
LTM policies may be unable to execute the appropriate action on a successful matching condition, leading to a wide range of traffic-impacting consequences.
Workaround:
Remove and re-add the affected policy to the desired virtual-server. Alternatively, to fix a wider number of affected virtual servers in one go, reload the system configuration by executing 'tmsh load sys config'.
Fix:
TMM now loads LTM policies with external data-groups as expected.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6
999881-6 : Tcl command 'string first' not working if payload contains Unicode characters.
Links to More Info: BT999881
Component: Local Traffic Manager
Symptoms:
Tcl command 'string first' returns an incorrect value when Unicode characters are present in the payload.
Conditions:
-- Tcl command 'string first' is used in iRules.
-- Payload contains Unicode characters.
Impact:
Traffic processing with iRules that contains the 'string first' command might not work as expected.
Workaround:
You can use any of the following workarounds:
-- Use iRuleLX.
-- Do not use Unicode characters in the payload.
-- Use a custom Tcl proc to iterate through the string using lindex
Fixed Versions:
17.0.0, 16.1.3.1, 15.1.7
999125-1 : After changing management IP addresses, devices can be stuck indefinitely in improper Active/Active or Standby/Standby states.
Links to More Info: BT999125
Component: TMOS
Symptoms:
After a device (or multiple devices) in a sync-failover device-group undergoes a management IP change, multiple devices in the group can be stuck indefinitely in improper Active/Active or Standby/Standby failover states.
Conditions:
-- One or more devices belonging to a sync-failover device-group undergo a management IP change.
Impact:
-- The affected units are unable to pass traffic, as they are either both Standby or Active (resulting in either no service availability or IP address conflicts in the network).
Workaround:
If you are planning to change management IP addresses on your devices, consider doing so during a maintenance window, in order to account for the eventuality this issue might occur.
Then, if this issue does occur, you can restore correct system functionality by restarting the sod daemon on all units that had their management IP address changed. To do so, run the following command:
tmsh restart sys service sod
Note: This is a one-time workaround, and the issue may re-occur if the devices undergo further management IP address changes in the future.
Fix:
Redundant devices remain in the correct failover state following a management IP address change.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
999097-1 : SSL::profile may select profile with outdated configuration
Links to More Info: BT999097
Component: Local Traffic Manager
Symptoms:
Under some circumstances, an iRule-selected SSL profile may a send previously configured certificate to the peer.
Conditions:
iRule command SSL::profile is used to select a profile that is not attached to the virtual server, and changes have been made in the profile's cert-key-chain field.
Impact:
The TLS client may receive an outdated certificate that does not match with the current configuration, potentially leading to handshake failures.
Workaround:
Avoid making changes to a profile that is actively being used by the iRule command.
Fix:
The system now makes sure that SSL profiles are properly reloaded after changes are made.
Fixed Versions:
17.0.0, 16.1.2.1, 15.1.5, 14.1.4.5
998221-1 : Accessing pool members from configuration utility is slow with large config
Links to More Info: BT998221
Component: TMOS
Symptoms:
Accessing the pool members page from the BIG-IP Configuration Utility/GUI is slow compared with accessing Pool members from TMSH/CLI.
Conditions:
-- Accessing pool member information through the BIG-IP configuration utility.
-- Thousands of pools and pool members in the configuration.
Impact:
In the GUI, it takes approximately 20-30 seconds, whereas the CLI returns results in less than 1 second,
Managing pool members from configuration utility is very slow causing performance impact.
Workaround:
None
Fix:
Optimized the GUI query used for retrieving pool members data.
Fixed Versions:
17.0.0, 16.1.2, 16.0.1.2, 15.1.4, 14.1.4.3
997313-2 : Unable to create APM policies in a sync-only folder★
Links to More Info: BT997313
Component: TMOS
Symptoms:
Unable to configure an APM policy in a sync-only folder, or the configuration fails to load after an upgrade, with an error message similar to:
-- err mcpd[mcpd_pid]: 01070734:3: Configuration error: Invalid Devicegroup Reference. The customization_group (/Common/sync-only/example_apm_customization) requires customization_source (/Common/standard) to be syncd to the same devices
Conditions:
-- Multiple BIG-IP devices configured in a sync-only device group, but different/non-overlapping failover device groups
-- APM policy being created in a folder or partition associated with sync-only device group.
Impact:
-- Unable to create the access policy.
-- The configuration fails to load and the device remains inoperative.
Workaround:
You can use either of the following strategies to prevent the issue:
--Do not create APM policies in a sync-only folder.
--Disable MCPD device-group reference validation for the sync-only folder, e.g.:
tmsh modify sys folder /Common/sync-only no-ref-check true
tmsh save sys config
Fixed Versions:
17.0.0, 16.1.2, 15.1.4.1
996381-1 : ASM attack signature may not match as expected
Links to More Info: K41503304, BT996381
Component: Application Security Manager
Symptoms:
When processing traffic with ASM, attack signature 200000128 may not match as expected.
Conditions:
- Attack signature 200000128 enabled.
Impact:
Processed traffic may not match all expected attack signatures
Workaround:
N/A
Fix:
Attack signature 200000128 now matches as expected.
Fixed Versions:
17.0.0, 16.1.1, 16.0.1.2, 15.1.4, 14.1.4.4, 13.1.4.1
996113-2 : SIP messages with unbalanced escaped quotes in headers are dropped
Links to More Info: BT996113
Component: Service Provider
Symptoms:
Dropped SIP messages.
Conditions:
-- MRF SIP virtual server
-- SIP Header Field has an escaped quote
Impact:
Certain SIP messages are not being passed via MRF.
Workaround:
None
Fixed Versions:
17.0.0, 16.1.1, 15.1.4, 14.1.4.4, 13.1.5
996001-5 : AVR Inspection Dashboard 'Last Month' does not show all data points
Links to More Info: BT996001
Component: TMOS
Symptoms:
A daily-based report (report with resolution of one day in each data-point) can be provided to only request with up-to 30 days. A request with 31 days shows only 2 entries.
Conditions:
This occurs when generating a 'Last Month' report for a month that contains 31 days of data.
Impact:
AVR Inspection Dashboard displays less data than expected: 2 points instead of 31 points.
Workaround:
None
Fix:
Viewing a 'Last Month' graph now reports ~30 days worth of data, rather than a variable amount of data based on actual calendar periods.
Fixed Versions:
17.0.0, 16.1.2.1, 15.1.5, 14.1.4.5
995405-1 : After upgrade, the copied SSL vhf/vht profile prevents traffic from passing★
Links to More Info: BT995405
Component: Local Traffic Manager
Symptoms:
After an RPM upgrade, SSL Orchestrator traffic does not pass
Conditions:
Upgrading SSL Orchestrator via RPM
Impact:
Traffic will not pass.
Workaround:
Bigstart restart tmm
Fix:
Fixed an issue that was preventing from passing after an RPM upgrade.
Fixed Versions:
17.0.0, 16.1.3, 16.1.1
994305-3 : The version of open-vm-tools included with BIG-IP Virtual Edition is 10.1.5
Links to More Info: BT994305
Component: TMOS
Symptoms:
Features supported in newer versions of open-vm-tools are not available.
Conditions:
This issue may be seen when running in VMware environments.
Impact:
Features that require a later version of open-vm-tools are not available.
Workaround:
None.
Fix:
The version of open-vm-tools has been updated to 11.1.5.
Fixed Versions:
17.0.0, 16.1.2.1, 15.1.5.1
993913-4 : TMM SIGSEGV core in Message Routing Framework
Links to More Info: BT993913
Component: Service Provider
Symptoms:
TMM crashes on SIGSEGV.
Conditions:
This can occur while passing traffic through the message routing framework.
Impact:
Traffic disrupted while tmm restarts.
Workaround:
None
Fixed Versions:
17.0.0, 16.1.1, 15.1.4, 14.1.4.4
993613-7 : Device fails to request full sync
Links to More Info: BT993613
Component: Application Security Manager
Symptoms:
Devices remain out of sync and ASM REST/GUI becomes unresponsive. asm_config_server may create many unique PIDs
Conditions:
-- A manual sync device group is configured and ASM sync is enabled.
-- Sync pushes are typically performed in one direction, and then a sync attempt is made in the opposite direction.
Impact:
-- The device that is meant to receive the config sync never requests or receives it.
-- The devices become unsynchronized which may cause unexpected traffic enforcement or dropped traffic.
-- ASM GUI becomes unresponsive.
-- Large number of asm_config_server processes increases host memory usage
Workaround:
Halting asm_config_server on the stuck device restores the working state and request a new sync.
Fixed Versions:
17.0.0, 16.1.2.1, 15.1.5, 14.1.4.5, 13.1.5
993517-1 : Loading an upgraded config can result in a file object error in some cases
Links to More Info: BT993517
Component: Local Traffic Manager
Symptoms:
After an upgrade from a version prior to 13.1.0, when loading a configuration that has had an HTTPS monitor in it, if that configuration has not yet been saved, you may see errors like this in the LTM log:
-- 0107134a:3: File object by name (DEFAULT) is missing.
If you run 'tmsh load sys config verify' on this configuration, the system also posts the error on the screen.
Conditions:
-- Upgrading from a version prior to 13.1.0.
-- At least one HTTPS monitor that has the kEDH cipher in its cipherlist.
-- Upgrading to version 13.1.1.4 or later.
-- Loading the configuration (either automatically on startup, or manually).
Impact:
Other than the error message, there is no impact.
Workaround:
After the initial reboot, save the configuration.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5
993489-1 : GTM daemon leaks memory when reading GTM link objects
Links to More Info: BT993489
Component: Global Traffic Manager (DNS)
Symptoms:
The gtmd process memory consumption is higher than expected.
Conditions:
DNS is provisioned and a provisioned GTM link object has been loaded.
Impact:
Increased memory usage of the GTM daemon. This may impact other capabilities, such as starting sync operations.
Workaround:
None
Fixed Versions:
17.0.0, 16.1.1, 16.0.1.2, 15.1.4, 14.1.4.4, 13.1.5
993457-1 : TMM core with ACCESS::policy evaluate iRule
Links to More Info: BT993457
Component: Access Policy Manager
Symptoms:
TMM segfaults in packtag_literal_pointer_release() during TCLRULE_CLIENT_CLOSED event attempting a session release.
Conditions:
-- The ACCESS::policy evaluate is still in progress when TCLRULE_CLIENT_CLOSED event is triggered.
-- While the TCLRULE_CLIENT_CLOSED is in process, the ACCESS::policy evaluation completes.
Impact:
This triggers a race condition and causes the tmm crash. Traffic disrupted while tmm restarts.
Workaround:
None
Fix:
TMM no longer crashes and generates a core file during the ACCESS::policy evaluate iRule under these conditions.
Fixed Versions:
17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5
992865-3 : Virtual server may not enter hardware SYN cookie mode on BIG-IP i11000 and i15000 series appliances
Links to More Info: BT992865
Component: TMOS
Symptoms:
On particular platforms, virtual servers do not correctly enter hardware SYN cookie mode. Software SYN cookie mode still functions correctly.
Conditions:
-- Virtual server under SYN flood attack.
-- One of the following platforms
+ BIG-IP i11000 series (C123)
+ BIG-IP i15000 series (D116)
Impact:
Software SYN cookies are enabled, this has a performance impact compared to the hardware mode.
Workaround:
None
Fix:
Virtual servers correctly enter hardware SYN cookie mode on all platforms.
Fixed Versions:
17.1.0, 16.1.2.2, 15.1.4
992213-3 : Protocol Any displayed as HOPTOPT in AFM policy view
Links to More Info: BT992213
Component: Advanced Firewall Manager
Symptoms:
The 'any' option for the AFM policy rule protocol is displayed incorrectly in the GUI.
Conditions:
-- Create a rule and set protocol as 'any'.
-- Navigate to active rules.
Impact:
GUI shows an incorrect value.
Workaround:
None
Fix:
GUI Shows correct value for rule protocol option.
Fixed Versions:
17.0.0, 16.1.1, 15.1.4, 14.1.4.2
992121-4 : REST "/mgmt/tm/services" endpoint is not accessible
Links to More Info: BT992121
Component: TMOS
Symptoms:
Accessing "/mgmt/tm/services" failed with a null exception and returned 400 response.
Conditions:
When accessing /mgmt/tm/services through REST API
Impact:
Unable to get services through REST API, BIG-IQ needs that call for monitoring.
Fix:
/mgmt/tm/services through REST API is accessible and return the services successfully.
Fixed Versions:
17.0.0, 16.1.3.1, 15.1.6.1, 14.1.5.1
990461-5 : Per virtual server SYN cookie threshold is not preserved or converted during a software upgrade★
Links to More Info: BT990461
Component: Advanced Firewall Manager
Symptoms:
If the original per virtual server SYN cookie threshold value was greater than 4095, the value is not preserved or converted correctly after a software upgrade from v12.x to a later version.
Conditions:
-- Per virtual server SYN cookie threshold is set.
-- SYN cookie threshold is set to a value higher than 4095.
Impact:
A change in the SYN cookie threshold value in the virtual server context may result in a change in DoS behavior, depending on your configuration.
Workaround:
Manually update the SYN cookie threshold values after an upgrade.
Fixed Versions:
17.1.0, 16.1.3, 15.1.6.1, 14.1.4.4
989701-8 : CVE-2020-25212 Kernel: A flaw was found in the NFSv4 implementation where when mounting a remote attacker controlled server it could return specially crafted response
989517-3 : Acceleration section of virtual server page not available in DHD
Links to More Info: BT989517
Component: TMOS
Symptoms:
Cannot use Advanced Menu to create a virtual server for HTTP/2 on systems with DHD licenses. This occurs because the Acceleration section is not available.
You can via TMSH then it works, but at as soon as you use the GUI to modify the virtual server, it loses the HTTP/2 configuration.
Conditions:
The Acceleration section is not visible in case 'DoS' is provisioned (available with the DHD license).
Impact:
1) You are unable to use the GUI to modify any parameters of the Acceleration table in the virtual server page.
2) Loss of configuration items if making changes via the GUI.
Workaround:
A virtual server with parameters present in the Acceleration table can still be created using TMSH. However, do not edit that virtual server in the GUI, or the Acceleration parameters will be lost.
Fix:
The Acceleration table is now visible, and there is no loss of configuration items if making changes via the GUI.
Fixed Versions:
17.1.0, 17.0.0.1, 16.1.3.1, 15.1.6.1
988165-3 : VMware CPU reservation is now enforced.
Links to More Info: BT988165
Component: TMOS
Symptoms:
CPU reservation is not enabled which can result in insufficient CPU resource for virtual edition guest.
Conditions:
BIG-IP Virtual Edition running in VMware.
Impact:
Performance may be lower than expected particularly if ESXi is over subscribed and traffic volume is high.
Workaround:
Manually enforce the 2GHz per core rule when provisioning VMware instances to ensure that your VMware hosts are not oversubscribed.
Fix:
The VMware CPU reservation of 2GHz per core is now automatically enabled in the OVF file. The CPU reservation can be up to 100 percent of the defined virtual machine hardware. For example, if the hypervisor has 2.0 GHz cores, and the VE is set to 4 cores, you will see 4 x 2.0 GHz reserved for 8GHz (or 8000 MHz).
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1
987885-6 : Half-open unclean SSL termination might not close the connection properly
Links to More Info: BT987885
Component: Local Traffic Manager
Symptoms:
Upon receiving TCP FIN from the client in the middle of the SSL Application Data, the BIG-IP system does not close the connection on either client- or server-side (i.e., it does not 'forward' the FIN on the server-side as it normally does) causing the connection to go stale until the timeout is reached.
Conditions:
-- TCP and SSL profiles configured on a virtual server.
-- Client terminates the connection in the middle of an SSL record.
Impact:
Connection termination does not happen. Connection remains in the connection table until idle timeout is reached.
Workaround:
None.
Fixed Versions:
17.0.0, 16.1.3.1, 15.1.6.1, 14.1.5.1
987341-1 : BIG-IP OpenID Connect Discovery process does not support strong TLS ciphers.
Links to More Info: BT987341
Component: Access Policy Manager
Symptoms:
BIG-IP discovers and updates JSON Web Keys (JWK) in OpenID Connect (OIDC) deployments using a Java Runtime Environment (JRE). The JRE in BIG-IP does not support strong TLS ciphers, so the discovery/update process can fail against OIDC providers that enforce strong encryption requirements.
Conditions:
Using an OpenID Connect provider that allows only strong TLS ciphers. and using an APM configuration that validates incoming JWTs against a dynamic JWK list in Internal Validation Mode.
Impact:
This might cause discovery to fail against certain OpenID Connect auth providers that enforce strong cipher requirements. It could lead to JWT validation failure as the JWK expire and cannot be updated by BIG-IP.
Workaround:
N/A
Fix:
N/A
Fixed Versions:
17.0.0, 16.1.3.1, 15.1.6.1, 14.1.5
987077-3 : TLS1.3 with client authentication handshake failure
Links to More Info: BT987077
Component: Local Traffic Manager
Symptoms:
SSL handshakes fail, and TLS clients send 'Bad Record MAC' errors.
Conditions:
-- LTM authentication profile using OCSP and TLS1.3.
-- Client application data arrives during LTM client authentication iRule.
Impact:
-- A handshake failure occurs.
-- Client certificate authentication may pass without checking its validity via OCSP.
Workaround:
Use TLS1.2 or use TLS1.3 without the LTM authentication profile.
Fix:
Handshake completes if using TLS1.3 with client authentication and LTM auth profile.
Fixed Versions:
17.0.0, 16.1.3, 15.1.5.1, 14.1.4.6
986937-3 : Cannot create child policy when the signature staging setting is not equal in template and parent policy
Links to More Info: BT986937
Component: Application Security Manager
Symptoms:
When trying to create a child policy, you get an error:
FAILURE: "Could not update the Policy policy1. Inherited values may not be changed."
Conditions:
-- Parent policy created with signature staging disabled.
-- Creating a new child policy with that policy as a parent.
Impact:
You are unable to create the child policy and the system presents an error.
Workaround:
Create the policy without assigning it to the parent, and then assign it to the parent policy on the Inheritance Settings page.
Fix:
The error no longer occurs on child policy creation.
Fixed Versions:
17.0.0, 16.1.1, 16.0.1.2, 15.1.4
985953-6 : GRE Transparent Ethernet Bridging inner MAC overwrite
Links to More Info: BT985953
Component: TMOS
Symptoms:
Traffic not being collected by virtual server and therefore not being forwarded to the nodes.
Conditions:
Encapsulated dest-mac is not equal to the Generic Routing Encapsulation (GRE) tunnel mac-address.
Impact:
Virtual server is not collecting decapsulated packets from the GRE Transparent Bridge tunnel unless the dest-mac of the encapsulated packet is the same as the mac-address of the GRE tunnel.
Workaround:
None
Fix:
Added a new DB key 'iptunnel.mac_overwrite'. This DB key defaults to 'disable'.
Set the DB key to 'enable' to cause the BIG-IP system to overwrite the destination MAC of the encapsulated traffic:
tmsh modify sys db iptunnel.mac_overwrite value enable
tmsh save sys config
This allows virtual servers on the BIG-IP system to process traffic.
Behavior Change:
Added a new DB key 'iptunnel.mac_overwrite'. This DB key defaults to 'disable'.
To cause the BIG-IP system to overwrite the destination MAC of the encapsulated traffic, set the DB key to 'enable' and save the config:
tmsh modify sys db iptunnel.mac_overwrite value enable
tmsh save sys config
This allows virtual servers on the BIG-IP system to process traffic.
Fixed Versions:
17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5
984749-1 : Discrepancy between DNS cache statistics "Client Summary" and "Client Cache."
Links to More Info: BT984749
Component: Global Traffic Manager (DNS)
Symptoms:
"show ltm dns cache", shows difference between "Client Summary" and "Client Cache".
Conditions:
Create a resolver type DNS cache, attach to a DNS profile, and attach to a virtual server. Send queries to virtual server. Compare/review result of "show ltm dns cache."
Impact:
Client Cache Hit/Miss Statistics ratio affected.
Workaround:
N/A
Fix:
N/A
Fixed Versions:
17.0.0, 16.1.3.1, 15.1.7
984593-1 : BD crash
Links to More Info: BT984593
Component: Application Security Manager
Symptoms:
BD crashes.
Conditions:
The conditions under which this occurs are unknown.
Impact:
Traffic disrupted while bd restarts.
Workaround:
None.
Fixed Versions:
17.0.0, 16.1.2.1, 15.1.5, 14.1.4.5, 13.1.5
984585-3 : IP Reputation option not shown in GUI.
Links to More Info: BT984585
Component: TMOS
Symptoms:
Cannot configure IP Reputation option from the GUI.
Conditions:
Configuring the LTM policy type 'IP Reputation' using the GUI, when the 'IP Intelligence' module is licensed in time-limited modules.
Impact:
The IP Reputation option is not shown in GUI configuration list. Cannot create LTM policies with IP Reputation.
Workaround:
Use tmsh to configure IP Reputation.
Fix:
The IP Reputation option is now shown in the GUI.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1
982785-2 : Guided Configuration hardening
Links to More Info: K52322100
982757-3 : APM Access Guided Configuration hardening
Links to More Info: K53197140
981069-3 : Reset cause: "Internal error ( requested abort (payload release error))"
Links to More Info: BT981069
Component: Application Security Manager
Symptoms:
An unexpected RST occurs on inbound traffic. The RST cause shows "Internal error ( requested abort (payload release error))"
Conditions:
When all the following conditions are met:
- The system was upgraded to a version where ID910253 is fixed
- TS cookie coming from a previous version
- data guard in non blocking (masking)
- response that is not zipped and has a textual content type
Impact:
Traffic is affected.
Workaround:
Any of the following actions can resolve the issue:
1. Turn off data guard or change it to blocking.
2. Make the server reply with zipped responses (perhaps by adding the accept-encoding: gzip using an iRule).
3. Add an additional response related feature.
4. Use the following iRule in case there aren't cookie related enforcement:
when HTTP_REQUEST {
set cookies [HTTP::cookie names]
foreach aCookie $cookies {
if {$aCookie matches_regex {^TS(?:[0-9a-fA-F]{6,8})(?:$|_[0-9]+$)}} {
HTTP::cookie remove $aCookie
}
}
}
Fix:
Fixed an issue that was triggering resets on traffic.
Fixed Versions:
17.0.0, 16.1.1, 15.1.4
980617-1 : SNAT iRule is not working with HTTP/2 and HTTP Router profiles
Links to More Info: BT980617
Component: Local Traffic Manager
Symptoms:
On HTTP/2 full-proxy virtual servers, the snatpool command in an iRule is accepted but the source address server-side is not changed.
Conditions:
1.) Basic HTTP profile and HTTP/2 profile is configured on BIG-IP systems
2.) iRule with snatpool <pool_name>, snat <IP> is configured
Impact:
Unable to use snatpool (and possibly snat) in iRule to control the server-side source address.
Workaround:
Configure SNAT under the virtual server configuration, rather than in an iRule.
Fixed Versions:
17.0.0, 16.1.1
979877-9 : CVE-2020-1971 OpenSSL: EDIPARTYNAME NULL pointer de-reference vulnerability description and available information
977761 : Connections are dropped if a certificate is revoked.
Links to More Info: BT977761
Component: Local Traffic Manager
Symptoms:
SSL handshake failures occur with the backend server revoked certificate in case of reverse proxy.
Conditions:
1. BIG-IP LTM configured as SSL reverse proxy.
2. revoked-cert-status-response-control set to ignore in the server ssl profile.
3. server certificate authentication set to "require" in the server ssl profile.
Impact:
Ssl handshake failures due to revoked server certificate
Workaround:
1. Set the server certificate authentication to ignore in the server ssl profile.
Fix:
Added checks to validate the certificate as well as the flags set (ignore/drop) for the revoked certificate.
Fixed Versions:
17.1.0, 16.1.2.2
977153-3 : Packet with routing header IPv6 as next header in IP layer fails to be forwarded
Links to More Info: BT977153
Component: Advanced Firewall Manager
Symptoms:
BIG-IP systems fail to follow RFC 5095, which specifies the traffic should be forwarded.
Conditions:
This symptom is found when the following conditions are met:
-- An IPv6 packet whose Next Header in IP header is Routing Header IPv6.
-- In the Routing Header IPv6 header, the Type field is 0.
-- In the Routing Header IPv6 header, the Segment Left field is 0.
Impact:
This failure in forwarding ICMP error message prevents the BIG-IP AFM product from completing certification.
Workaround:
None.
Fixed Versions:
17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7
976669-5 : FIPS Integrity check fails for other secondary blades after rebooting/replacing secondary blade
Links to More Info: BT976669
Component: TMOS
Symptoms:
After rebooting or replacing a secondary blade, the FIPS integrity check fails for other secondary blades and they fail to fully boot.
Conditions:
This can occur after rebooting or replacing a secondary blade.
Impact:
When the FIPS integrity checks fail the blades won't fully boot.
Workaround:
On the secondary blade reboot, the following critical files are deleted from other secondary blades which leads to FIPS integrity check failure:
/root/.ssh/authorized_keys
/root/.ssh/known_hosts
To mitigate, copy the missing files from the primary blade to the secondary blade.
From the primary blade, issue the following command towards the secondary blade(s).
rsync -avz -e ssh /root/.ssh/* root@<Secondary Blade>:/root/.ssh/
Fix:
Critical files are not deleted during secondary blade reboot.
Fixed Versions:
17.0.0, 16.1.2.2, 16.1.0, 15.1.5.1, 14.1.4.6
976337-2 : i40evf Requested 4 queues, but PF only gave us 16.
Links to More Info: BT976337
Component: TMOS
Symptoms:
During BIG-IP system boot, a message is logged:
i40evf 0000:05:00.0: Requested 4 queues, but PF only gave us 16.
Conditions:
-- BIG-IP Virtual Edition configured for SR-IOV
-- E810 virtual functions (VFs)
Impact:
A message is logged but it is benign and can be ignored.
Fixed Versions:
16.1.2.2, 15.1.5.1
974241-3 : Creation of access policy with modern customization may lead to failover in a VIPRION or vCMP guest with multiple blades
Links to More Info: BT974241
Component: TMOS
Symptoms:
Mcpd exists with error similar to:
01070734:3: Configuration error: Configuration from primary failed validation: 010713cf:3: Configuration group '/Common/test1_end_deny_ag' has invalid source '/Common/standard'
Conditions:
1. VIPRION or vCMP guest with multiple blades in a cluster
2. Create a access policy with modern customization enabled
Impact:
Mcpd restarts leading to failover.
Workaround:
Use standard customization and not modern customization.
Fixed Versions:
17.0.0, 16.1.1, 15.1.4
972517-7 : Appliance mode hardening
Component: Local Traffic Manager
Symptoms:
Appliance mode license restrictions do not follow current best practices.
Conditions:
- Appliance-mode license
- Authenticated administrative user
- Monitors in use
Impact:
Appliance mode does not follow current best practices.
Workaround:
N/A
Fix:
Appliance mode now follows current best practices.
Fixed Versions:
17.0.0, 16.1.3.1, 15.1.6.1, 14.1.5
970329-1 : ASM hardening
Links to More Info: K70134152, BT970329
Component: Application Security Manager
Symptoms:
Under certain conditions, ASM does not follow current best practices.
Conditions:
- ASM provisioned
Impact:
Attack detection is not triggered as expected
Workaround:
N/A
Fix:
Attack detection is now triggered as expected
Fixed Versions:
17.0.0, 16.1.1, 15.1.4, 14.1.4.4, 13.1.5
969317-4 : "Restrict to Single Client IP" option is ignored for vmware VDI
Links to More Info: BT969317
Component: Access Policy Manager
Symptoms:
The Restrict to Single Client IP option in the Access Policy is not being honored for VMware VDI.
Conditions:
- Configure APM Webtop with vmware VDI.
- Set "Restrict to Single Client IP" option in Access Profile.
- Try to launch vmware desktop on one client. Copy the launch URI
- Try to launch vmware desktop from other client using the copied URI.
Impact:
A connection from the second client is allowed, but it should not be allowed.
Fix:
Restrict to Single Client IP is honored for VMware VDI for both PCOIP and Blast protocols.
Fixed Versions:
17.0.0, 16.1.2.1, 15.1.4.1, 14.1.4.5
969297 : Virtual IP configured on a system with SelfIP on vwire becomes unresponsive
Links to More Info: BT969297
Component: SSL Orchestrator
Symptoms:
Virtual IP ARP does not get resolved when a SelfIP is configured on a virtual-wire.
Conditions:
Issue happens when a SelfIP address is configured and a Virtual IP address is configured for a Virtual Server.
Impact:
The virtual server is unreachable.
Workaround:
None
Fix:
ARP forwarding to peer is decided based on whether Virtual IP and self-IP is configured or not.
Fixed Versions:
16.1.2.2
968929-2 : TMM may crash when resetting a connection on an APM virtual server
Links to More Info: BT968929
Component: Local Traffic Manager
Symptoms:
TMM crashes.
Conditions:
- HTTP profile without fallback host.
- iRules.
Impact:
Traffic disrupted while tmm restarts.
Workaround:
Configure fallback host to an HTTP profile that redirects the request to a specified location.
Fixed Versions:
17.0.0, 16.1.2.2
968657-1 : Added support for IMDSv2 on AWS
Links to More Info: BT968657
Component: TMOS
Symptoms:
AWS added a token-based Instance MetaData Service API (IMDSv2). Prior versions of BIG-IP Virtual Edition supported only a request/response method (IMDSv1). When the AWS API is starting with IMDSv2, you will receive the following error message:
get_dossier call on the command line fails with:
01170003:3: halGetDossier returned error (1): Dossier generation failed.
This latest version of BIG-IP Virtual Edition now supports instances started with IMDSv2.
Conditions:
AWS instances started with IMDSv2.
Impact:
BIG-IP Virtual Edition cannot license or re-license AWS instances started with IMDSv2 and other metadata-based functionality will not function.
Fix:
With the latest version of BIG-IP VE, you can now initialize "IMDSv2 only" instances in AWS and migrate your existing instances to "IMDSv2 only" using aws-cli commands. For details, consult documentation: https://clouddocs.f5.com/cloud/public/v1/shared/aws-ha-IAM.html#check-the-metadata-service-for-iam-role
IMDSv2 documentation from AWS: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html
Fixed Versions:
17.0.0, 16.1.2.1, 15.1.5.1
968581-4 : TMSH option max-response for "show /ltm profile ramcache" command may not comply with its description
Links to More Info: BT968581
Component: Local Traffic Manager
Symptoms:
The TMSH command "show /ltm profile ramcache" has a max-response option to output a number of records designated in this parameter. Due to calculation algorithm, the command may output less records than RAMCACHE stores or more records than the limit prescribes.
Conditions:
-- A virtual server is configured on BIG-IP.
-- A webacceleration profile with no web application is attached to the virtual server.
-- Traffic is sent over the virtual server with a number of unique cacheable documents that exceed a designated limit.
Impact:
Output of the command may not match to actual list of stored documents in RAMCACHE.
Fix:
Command "show /ltm /profile ramcache" respects a limit defined as "max-response" parameter.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.5
967101-1 : When all of the interfaces in the trunk are brought up, Gratuitous ARP is not being sent out.
Links to More Info: BT967101
Component: Local Traffic Manager
Symptoms:
Gratuitous ARP (GARP) messages are dropped at the time of sending GARP because the number of links up in the trunk is 0 (which returns "error 18" ... ERR_NOT_FOUND)
Conditions:
-- Two BIG-IP systems with switchless configuration, such as i2xxx and i4xxx.
-- Bring down and up the interfaces at the same time in the trunk.
Impact:
Neighboring device arp table is not updated about the BIG-IP interface status, because no gratuitous ARP message is sent out.
Workaround:
N/A
Fix:
N/A
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6
965785-4 : Active/Standby sync process fails to populate table DCC.HSL_DATA_PROFILES on standby machine
Links to More Info: BT965785
Component: Application Security Manager
Symptoms:
DCC.HSL_DATA_PROFILES table on standby machine stay empty after sync process. Error for DB insert failure into table DCC.HSL_DATA_PROFILES thrown in asm_config_server.log.
Conditions:
There is no specific condition, the problem occurs rarely.
Impact:
Sync process requires an additional ASM restart
Workaround:
Restart ASM after sync process finished
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6
965229-5 : ASM Load hangs after upgrade★
Links to More Info: BT965229
Component: Application Security Manager
Symptoms:
ASM upgrade hangs, and you see the following in
var/log/ts/asm_start.log:
-------------------------
asm_start|DEBUG|Nov 15 07:04:41.751|25365|F5::ConfigSync::restore_active_policies,,Restoring active policy - policy /Common/my_portal (id = 603)
... END OF FILE ...
-------------------------
In /var/log/asm:
-----------------------------
2020-11-15T06:01:23+00:00 localhost notice boot_marker : ---===[ HD1.cm6250 - BIG-IP 13.1.3.4 Build 0.255.5 <HD1.cm6250> ]===---
info set_ibdata1_size.pl[20499]: Setting ibdata1 size finished successfully, a new size is: 9216M
info tsconfig.pl[24675]: ASM initial configration script launched
info tsconfig.pl[24675]: ASM initial configration script finished
info asm_start[25365]: ASM config loaded
err asm_tables_dump.pl[31430]: gave up waiting for ASM to start, please try again later
-----------------------------
Conditions:
-- ASM provisioned
-- 600 or more security policies
-- Performing an upgrade
Impact:
ASM post upgrade config load hangs and there are no logs or errors
Workaround:
None
Fixed Versions:
17.0.0, 16.1.1, 15.1.4, 14.1.4.4, 13.1.5
964625-5 : Improper processing of firewall-rule metadata
Links to More Info: BT964625
Component: Advanced Firewall Manager
Symptoms:
The 'mcpd' process may suffer a failure and be restarted.
Conditions:
Adding very large firewall-policy rules, whether manually, or from config-sync, or from BIG-IQ.
Impact:
-- MCPD crashes, which disrupts both control-plane and data-plane processing while services restart.
-- Inability to configure firewall policy.
Workaround:
Reduce the number of firewall policy rules.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5
963541-1 : Net-snmp5.8 crash
Links to More Info: BT963541
Component: TMOS
Symptoms:
Snmpd crashes.
Conditions:
This does not always occur, but it may occur after a subagent (bgpd) is disconnected.
Impact:
Snmpd crashes.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1
962589-4 : Full Sync Requests Caused By Failed Relayed Call to delete_suggestion
Links to More Info: BT962589
Component: Application Security Manager
Symptoms:
When using parent policies with learning enabled in an auto-sync device group, in some use cases deleting an ignored suggestion on a parent policy will cause a full sync to occur.
This can cause unexpected delays in configuration being synchronized between peers, and in the event of repeated instances in quick succession could fill the /var partition
Conditions:
1) Device Group with ASM and auto-sync enabled
2) Parent Policies with learning are in use.
3) Ignored Suggestions are deleted on the parent policy after they have 0 suggesting children left.
Impact:
ASM configuration requests a full sync which can cause unexpected slowness in config synchronization and may fill the /var partition if done multiple times in quick succession.
A full /var partition can lead to bd cores.
Fixed Versions:
17.0.0, 16.1.1, 15.1.4, 14.1.4.4
961509-5 : ASM blocks WebSocket frames with signature matched but Transparent policy
Links to More Info: BT961509
Component: Application Security Manager
Symptoms:
WebSocket frames receive a close frame
Conditions:
-- ASM provisioned
-- ASM policy attached to a virtual server
-- WebSocket profile attached to a virtual server
-- ASM policy transparent mode enabled
Impact:
WebSocket frame blocked in transparent mode
Workaround:
Change signatures blocking settings to Learn = Yes, Alarm = Yes, Block = No
Fix:
WebSocket frame blocking condition now takes into account global transparent mode setting.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6
959985-3 : Update VMware hardware version templates for BIG-IP Virtual Edition (VE) from v10 to v13 in order to support VMs deployed in more versions of vSphere ESXi.
Links to More Info: BT959985
Component: TMOS
Symptoms:
Virtual hardware version setting for BIG-IP VE VMware templates (virtualHW.version) are set to version 10 and must change to version 13, so more versions of vSphere ESXi (for example, ESXi v6.0 and later) can support deploying BIG-IP Virtual Edition.
Conditions:
Using BIG-IP Virtual Edition VMware hardware templates set to v10 running in most, later versions of VMware ESXi.
Impact:
BIG-IP Virtual Edition VMware hardware templates result in performance issues and deployment errors/failures.
Workaround:
None
Fix:
Changed the BIG-IP Virtual Edition VMware hardware template version setting (virtualHW.version) to 13 and deployed them successfully using later versions of VMware ESXi.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1
959609-4 : Autodiscd daemon keeps crashing
Links to More Info: BT959609
Component: Advanced Firewall Manager
Symptoms:
Autodiscd daemon keeps crashing.
Conditions:
Issue is happening when high speed logging and auto discovery configuration are configured and send the traffic.
Impact:
Auto discovery feature is not working as expected
Workaround:
None.
Fix:
Auto discovery feature now works as expected.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1
957905-1 : SIP Requests / Responses over TCP without content_length header are not aborted by BIG-IP.
Links to More Info: BT957905
Component: Service Provider
Symptoms:
SIP Requests that don't contain a content_length header are accepted and forwarded by the BIG-IP to the server.
SIP Responses that don't contain a content_length header are accepted and forwarded to the client.
The sipmsg parser does not treats the content_length header as a required header as part of the SIP Request / Response.
Conditions:
SIP request / response without content_length header.
Impact:
RFC 6731 non compliance.
Workaround:
N/A
Fix:
BIG-IP now aborts the connection of any TCP SIP request / response that does not contain a content_length header.
content_length header is treated as optional for UDP and SCTP.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
957637-1 : The pfmand daemon can crash when it starts.
Links to More Info: BT957637
Component: TMOS
Symptoms:
The pfmand process crashes and writes out a core file during bootup (or if the process is manually restarted by an Administrator for any reason) on certain platforms.
The crash may happen more than once, until the process finally settles and is able to start correctly.
Conditions:
-- Platforms i4000/i2000/i4800/i2800/i4600/i2600/i850.
Impact:
Network connection lost while pfmand restarts.
Workaround:
None
Fix:
The issue causing the pfmand daemon to occasionally crash has been resolved.
Fixed Versions:
17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7, 14.1.5.1
956013-4 : System reports{{validation_errors}}
Links to More Info: BT956013
Component: Policy Enforcement Manager
Symptoms:
A {{validation_errors}} at Subscriber Management :: Control Plane Listeners and Data Plane Listeners with ipv6 addresses
Conditions:
Specifying an IPv6 address in the expression in Subscriber Management :: Control Plane Listeners and Policy Enforcement :: Data Plane Listeners.
Impact:
Cannot access the BIG-IP GUI through IPv6 address from any web browser. Admin/User cannot enter input through GUI.
Workaround:
None.
Fixed Versions:
16.1.2.1, 15.1.5, 14.1.4.5
955617-8 : Cannot modify properties of a monitor that is already in use by a pool
Links to More Info: BT955617
Component: Local Traffic Manager
Symptoms:
Modifying monitor properties gives error, if it is attached to a pool with Node/Pool member instance.
0107082c:3: Cannot modify the destination address of monitor /Common/my_monitor
Conditions:
-- Monitor with alias address field as default properties.
-- Pool containing a node or pool member.
-- Monitor is attached to the pool.
Impact:
Monitor properties can't be modified if they are in use by a pool.
Workaround:
Remove monitor, modify it, and then add it back.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
953601-4 : HTTPS monitors marking pool member offline when restrictive ciphers are configured for all TLS protocol versions
Links to More Info: BT953601
Component: Local Traffic Manager
Symptoms:
HTTPS monitor marks pool member/nodes as down and they remain down until bigd is restarted or the monitor instance is removed and created again.
Conditions:
BIG-IP is configured with restrictive ciphers that are only compatible with TLS 1.2 (ECDH+AESGCM) but all of the TLS protocol versions are allowed. When HTTPS monitor TLS 1.0 handshake fails, due to incompatible ciphers with the server being monitored. It does not try TLS 1.2 version and marks pool members or nodes as down.
Impact:
HTTPS monitor shows pool members or nodes down when they are up.
Workaround:
Restart bigd or remove and add monitors.
Fix:
In case of handshake failure, BIG-IP will try TLS 1.2 version.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5
951133-4 : Live Update does not work properly after upgrade★
Links to More Info: BT951133
Component: Application Security Manager
Symptoms:
After upgrading BIG-IP version the Live Update "Check for Update" button does not respond.
Conditions:
Upgrading from a version that did not have Live Update to a new version which includes Live Update
Impact:
Live Update can't query for new updates.
Workaround:
Restart tomcat process:
> bigstart restart tomcat
Fixed Versions:
17.0.0, 16.1.1, 16.0.1.2, 15.1.4, 14.1.4.4
950149 : Add configuration to ccmode for compliance with the Common Criteria STIP PPM.
Links to More Info: BT950149
Component: TMOS
Symptoms:
To comply with configuration requirements for the Common Criteria STIP PPM, the ccmode script must be updated.
Conditions:
Required compliance with Common Criteria STIP PPM configuration.
Impact:
Without these updates, the BIG-IP will not be compliant with the Common Criteria STIP requirements.
Workaround:
Follow the instructions in the Common Criteria Guidance document.
Fix:
This fix added configuration elements for compliance to Common Criteria STIP PPM requirements.
Fixed Versions:
17.0.0, 16.1.3
950069-1 : Zonerunner can't edit TXT records containing a + symbol - "Resolver returned no such record"
Links to More Info: BT950069
Component: Global Traffic Manager (DNS)
Symptoms:
When attempting to use zonerunner to edit a TXT record that contains a plus character, BIG-IP DNS presents the error message 'Resolver returned no such record'.
Conditions:
A TXT record exists with RDATA (the value of the TXT record) containing one or more + symbols
Impact:
Unable to edit the record.
Workaround:
Two workarounds available:
1. Use zonerunner to delete the record and then recreate it with the desired RDATA value
2. Manually edit the bind zone file (see K7032)
Fixed Versions:
17.0.0, 16.1.3.1, 15.1.6.1
948985-3 : Workaround to address Nitrox 3 compression engine hang
Links to More Info: BT948985
Component: Local Traffic Manager
Symptoms:
Occasionally the Nitrox3 compression engine hangs.
In /var/log/ltm:
crit tmm[12404]: 01010025:2: Device error: n3-compress0 Nitrox 3, Hang Detected: compression device was reset (pci 02:00.1, discarded 1).
crit tmm[12404]: 01010025:2: Device error: n3-compress0 Zip engine ctx eviction (comp_code=0): ctx dropped.
Conditions:
The BIG-IP system uses Nitrox 3 hardware compression chips: 5xxx, 7xxx, 12250, and B2250.
You can check if your platform has nitrox3 by running the following command:
tmctl -w 200 compress -s provider
provider
--------
bzip2
lzo
nitrox3 <--------
zlib
Impact:
The Nitrox3 hardware compression system becomes unavailable, and the compression mode switches to software compression. This can lead to high CPU usage.
Workaround:
Disable HTTP compression or use software compression.
Fix:
Added db key compression.nitrox3.dispatchsize to control the request size.
Fixed Versions:
17.0.0, 16.1.3.1, 15.1.6.1
948241-4 : Count Stateful anomalies based only on Device ID
Links to More Info: BT948241
Component: Application Security Manager
Symptoms:
Currently when Device ID is enabled, the BIG-IP system counts stateful anomalies on both IP and Device ID. When a client has a proxy (without XFF), and many requests arrive with the same IP, this can cause false positives
Conditions:
- Bot Defense profile is attached to a virtual server.
- Bot Defense profile has "Browser Verification" set to "Verify After Access" or "Device ID Mode" set to "Generate After Access".
Impact:
False positives may occur in case of a proxy without XFF
Workaround:
None
Fix:
Stateful anomalies are no longer counted on IP when Device ID is enabled
Fixed Versions:
17.1.0, 17.0.0.1, 16.1.3.1, 15.1.6.1, 14.1.5.1
948113-1 : User-defined report scheduling fails
Links to More Info: BT948113
Component: Application Visibility and Reporting
Symptoms:
A scheduled report fails to be sent.
An error message with the following format may appear on /var/log/avr/monpd.log file (some parts of the error message were replaced with '.....' in here to leave only the common parts):
DB|ERROR|....... Error (err-code 1054) executing SQL string :
.....
.....
.....
Because : Unknown column ....... in 'order clause'
Conditions:
1. Using predefined-report in scheduled-report.
2. Predefined-report has more than one measure.
3. Sort-by value is different from the first measure on predefined-report
Impact:
Internal error for AVR report for ASM pre-defined.
Workaround:
First, remount /usr to read-write:
mount -o remount,rw /usr
Next, open file /usr/share/perl5/vendor_perl/F5/AVReporter/Client.pm and change the following line:
push(@measures,@{$base_request->{measures}}[0]);
to this:
push(@measures,@{$base_request->{sort_by}}[0]->{measure});
The above can be achieved with the following script-line (please first backup the Client.pm file and then verify it changed it correctly):
sed -i 's/push(@measures,@{\$base_request->{measures}}\[0\])/push(@measures,@{$base_request->{sort_by}}[0]->{measure})/' /usr/share/perl5/vendor_perl/F5/AVReporter/Client.pm
Lastly, remount /usr back to read-only:
mount -o remount,ro /usr
Fix:
Using 'sort-by' measure when building PDF (instead of the first value on measure-list)
Fixed Versions:
17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5
947905-4 : Upgrade from 13.1.4, 14.1.4, or 15.1.1 to 14.0.x, 15.0.x, 16.0.0 or 16.0.0.1 fails★
Links to More Info: BT947905
Component: TMOS
Symptoms:
Loading configuration process fails after an upgrade from 13.1.4, 14.1.4, or 15.1.1 to release 14.0.0, 15.0.0, 16.0.0 or 16.0.0.1.
The system posts errors similar to the following:
-- info tmsh[xxxx]: cli schema (15.1.1) has been loaded from schema data files.
-- crit tmsh[xxxx]: 01420001:2: Can't load keyword definition (user-account.session_limit) : framework/SchemaCmd.cpp, line 825.
-- crit tmsh[xxxx]: 01420001:2: Can't load keyword definition (system-settings.ssh_max_session_limit) : framework/SchemaCmd.cpp, line 825
-- emerg load_config_files[xxxx]: "/usr/bin/tmsh -n -g -a load sys config partitions all base " - failed. -- Loading schema version: 15.1.1.
-- err mcpd[xxxx]: 01070422:3: Base configuration load failed.
-- Unexpected Error: "Can't load keyword definition (user-account.session_limit)".
-- Unexpected Error: "Can't load keyword definition (system-settings.ssh_max_session_limit)"
-- Syntax Error:(/config/bigip_user.conf at line: 10) "session-limit" unknown property
Conditions:
Upgrade from one of the following release:
-- v13.1.4 or later within the v13.1.x branch
-- v14.1.4 or later within the v14.1.x branch
-- v15.1.1 or later within the v15.1.x branch
to one of the following releases:
-- v14.0 through v14.1.3.1
-- v15.0 through v15.1.0.5
-- v16.0.0 and v16.0.0.1
Impact:
After upgrade, config does not load. The system hangs at the base configuration load failure status.
Workaround:
Although there is no workaround, you can avoid this issue by upgrading to the most recent maintenance or point release in v14.1.x, v15.1.x, or v16.x.
You can find a list of most current software releases in K5903: BIG-IP software support policy :: https://support.f5.com/csp/article/K5903
Fixed Versions:
16.1.3, 16.0.1
947341-4 : MySQL generates multiple error 24 (too many files open) for PRX.REQUEST_LOG DB tables files.
Links to More Info: BT947341
Component: Application Security Manager
Symptoms:
1) var/lib/mysql/mysqld.err is filled with log entries that contain:
------------
200824 11:04:43 [ERROR] mysqld: Can't open file: './PRX/REQUEST_LOG.frm' (errno: 24)
200824 11:18:46 [ERROR] mysqld: Can't open file: './PRX/REQUEST_LOG.frm' (errno: 24)
200824 11:35:58 [ERROR] mysqld: Can't open file: './PRX/REQUEST_LOG.frm' (errno: 24)
------------
2) There are a lot of PRX.REQUEST_LOG partitions, in some cases up to 1024, many of which are empty.
Conditions:
ASM/AVR provisioned
Impact:
MySQL runs out of resources when opening the file
PRX.REQUEST_LOG and an error message states the file is corrupt.
Workaround:
1. If the /appdata partition is filled to 100% and MySQL restarts continuously, refer to the following Knowledge Articles:
https://support.f5.com/csp/article/K14956
https://support.f5.com/csp/article/K42497314
2. To identify the empty partitions, look into:
mysql -su root -p$(perl -MPassCrypt -nle 'print PassCrypt::decrypt_password($_)' /var/db/mysqlpw) -e "SELECT * FROM INFORMATION_SCHEMA.PARTITIONS WHERE table_name = 'REQUEST_LOG' AND table_schema = 'PRX'\G"
3. For every partition that is empty, manually (or via shell script) execute this sql:
mysql -su root -p$(perl -MPassCrypt -nle 'print PassCrypt::decrypt_password($_)' /var/db/mysqlpw) -e "ALTER TABLE PRX.REQUEST_LOG DROP PARTITION <empty_partition_name>;"
Note: <empty_partition_name> must be substituted with the partition name, for example p100001.
4. Increase 'open_files_limit' to '10000'.
--------------------------------
In the /etc/my.cnf file:
1. Change the value of the 'open_files_limit' parameter to 10000.
2. Restart MySQL:
bigstart restart mysql
--------------------------------
5. pkill asmlogd
Note: This workaround does not survive upgrade. It must be reapplied after every upgrade until the upgraded version contains a fix.
Fix:
This release increases the default 'open_files_limit' to '10000'.
Fixed Versions:
17.0.0, 16.1.2, 16.0.1.2, 15.1.3, 14.1.4.1
947333-2 : Irrelevant content profile diffs in Policy Diff
Links to More Info: BT947333
Component: Application Security Manager
Symptoms:
Defense attributes' grayed out values are shown in the policy diff even if "any" is selected
Conditions:
-- Import a policy
-- Perform a policy diff
Impact:
Policy diff showing irrelevant diffs
Workaround:
None
Fix:
Removed grayed out diffs from policy diff content profile section
Fixed Versions:
17.1.0, 17.0.0.1, 16.1.3.1
946185-3 : Unable to view iApp component due to error 'An error has occurred while trying to process your request.'★
Links to More Info: BT946185
Component: TMOS
Symptoms:
When accessing the iApp Components tab, the system presents an error similar to the following:
An error has occurred while trying to process your request.
Conditions:
-- With or without Partitions configured.
-- Navigate to GUI iApps :: Application Services : Applications, to view a custom iApp.
-- More likely to occur after upgrade.
Impact:
Unable to view/modify iApps via GUI iApps :: Application Services : Applications screen.
Workaround:
To reconfigure the iApp, do the following:
1. Navigate to the following location in the GUI:
Local Traffic :: Virtual Server List
2. Click the Application Link :: Reconfigure.
Note: Although this allows you to reconfigure an iApp, it does not provide access to the iApp application details Components page.
Fix:
Viewing Application Service components now reports no errors in the GUI under these conditions.
Fixed Versions:
17.0.0, 16.1.2, 15.1.4.1, 14.1.4.4
945853-4 : Tmm crash when multiple virtual servers are created, modified, or deleted in quick succession
Links to More Info: BT945853
Component: Advanced Firewall Manager
Symptoms:
TMM crashes during a configuration change.
Conditions:
This occurs under the following conditions:
-- Create/modify/delete multiple virtual servers in quick succession.
-- Perform back-to-back config loads / UCS loads containing a large number of virtual server configurations.
Impact:
Traffic disrupted while tmm restarts.
Workaround:
None.
Fix:
TMM no longer crashes during a configuration change.
Fixed Versions:
16.1.3, 15.1.3
945357 : BIG-IP must be able to set CA=True when creating Certificate Signing Requests from TMSH.
Links to More Info: BT945357
Component: Local Traffic Manager
Symptoms:
A Certificate Signing Request (CSR) is generated on the BIG-IP device to be used to create a certificate. It is possible for the entity owning the just-created certificate to serve as a Certificate Authority (CA) and be able to issue certificates and private keys to other parties. However, that ability does not exist unless the certificate has the CA field set to True (by default it is set to False).
Conditions:
In the TMSH prompt on the Command Line Interface (CLI), an attempt is made to generate a Certificate Signing Request (CSR) to be used to eventually create a certificate and corresponding private key.
Impact:
Without this change, certificates and private keys generated on the BIG-IP device cannot be directly provided to certification authorities so they can be used to sign certificates they would issue to other parties.
Workaround:
This is a new facility, not provided before, and overcomes a limitation. Without this facility, existing users of the BIG-IP are not impacted at all. As such, there is no workaround applicable.
Fix:
This fix enables certificates and private keys generated on the BIG-IP device via CSR's to be directly provided to certification authorities for their use. Because the CA field is set to now True, this fix adds convenience for certification authorities.
Fixed Versions:
17.0.0, 16.1.3
944381-2 : Dynamic CRL checking for client certificate is not working when TLS1.3 is used.
Links to More Info: BT944381
Component: Local Traffic Manager
Symptoms:
In SSL reverse proxy, dynamic CRL checking for client certificate is not working when TLS 1.3 handshake is used.
The SSL handshake successfully completed even though the client certificate is revoked.
Conditions:
-- Dynamic CRL checking enabled on a client-ssl profile
-- The client-side SSL handshake uses TLS1.3.
Impact:
The handshake should fail but complete successfully
Fix:
The issue was due to Dynamic CRL revocation check has not been integrated to TLS 1.3.
After the Dynamic CRL checking is integrated to TLS 1.3, the TLS handshake will work as expected.
Fixed Versions:
17.0.0, 16.1.3.1, 15.1.6.1
944121-4 : Missing SNI information when using non-default domain https monitor running in TMM mode.
Links to More Info: BT944121
Component: In-tmm monitors
Symptoms:
In-TMM https monitors do not send the SNI (Server Name Indication) information for non-default route domain pool members.
In-TMM monitors do not send any packet when TLS1.3 monitor is used.
Conditions:
-- SNI is configured in serverssl profile
-- serverssl profile is assigned to in-tmm https monitors
-- https monitors are monitoring pool members that are in a non-default route domain.
- Another Condition :
TLS1.3 Monitor is used
Impact:
The TLS connection might fail in case of SNI
No SYN packet is sent in case of TLS1.3 monitor
Workaround:
N/A
Fix:
N/A
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
943669-4 : B4450 blade reboot
Links to More Info: BT943669
Component: TMOS
Symptoms:
In a rare scenario, a B4450 blade suddenly reboots.
Conditions:
This occurs when there is heavy traffic load on VIPRION B4450 blades. The root cause is unknown. It happens extremely rarely.
Impact:
Traffic disrupted while the blade reboots.
Workaround:
None.
Fix:
The system now monitors the pause frames and reboots when needed.
Fixed Versions:
16.1.2.2, 15.1.2
943577-1 : Full sync failure for traffic-matching-criteria with port list under certain conditions
Links to More Info: BT943577
Component: TMOS
Symptoms:
Performing a full configuration sync with traffic-matching-criteria (TMC) under specific conditions fails with errors similar to:
err mcpd[6489]: 01070710:3: Database error (13), Cannot update_indexes/checkpoint DB object, class:traffic_matching_criteria_port_update status:13 - EdbCfgObj.cpp, line 127.
err mcpd[6489]: 01071488:3: Remote transaction for device group /Common/Failover to commit id 245 6869100131892804717 /Common/tmc-sync-2-bigip1.test 0 failed with error 01070710:3: Database error (13), Cannot update_indexes/checkpoint DB object, class:traffic_matching_criteria_port_update status:13 - EdbCfgObj.cpp, line 127..
Conditions:
This may occur on a full-load config sync (not an incremental sync)
On the device receiving the ConfigSync:
- a traffic-matching-criteria is attached to a virtual server
- the traffic-matching-criteria is using a port-list
On the device sourcing the ConfigSync:
- the same traffic-matching-criteria is attached to the same virtual server
- the original port-list is modified (e.g. a description is changed)
- the TMC is changed to reference a _different_ port-list
Impact:
Unable to sync configurations.
Workaround:
Copy the "net port-list" and "ltm traffic-matching-criteria" objects from the source to target system, merge them with "tmsh load sys config merge", and then perform a force-full-load-push sync from source to target.
If the BIG-IP systems are using device groups with auto-sync enabled, disable auto-sync temporarily while performing this workaround.
1. On the source system (the system whose configuration you want to sync to peer), save the configuration and extract the ltm traffic-matching-criteria and port-lists:
tmsh save sys config
(shopt -s nullglob; echo "#"; echo "# $HOSTNAME"; echo "# generated $(date +"%F %T %z")"
cat /config{/partitions/*,}/bigip{_base,}.conf |
awk '
BEGIN { p=0 }
/^(ltm traffic-matching-criteria|net port-list) / { p=1 }
/^}/ { if (p) { p=0; print } }
{ if (p) print; }
' ) > /var/tmp/portlists-and-tmcs.txt
2. Copy /var/tmp/portlists-and-tmcs.txt to the target system
3. On the target system, load that file:
tmsh load sys config replace file /var/tmp/portlists-and-tmcs.txt
3a. If loading the config file on the target system fails with the same error message seen during a ConfigSync, follow the procedure in
K13030: Forcing the mcpd process to reload the BIG-IP configuration :: https://support.f5.com/csp/article/K13030.
tmsh save sys config
clsh touch /service/mcpd/forceload
clsh reboot
4. On the source system, force a full-load sync to the device-group:
tmsh run cm config-sync force-full-load-push to-group <name of sync-group>
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6
943109-4 : Mcpd crash when bulk deleting Bot Defense profiles
Links to More Info: BT943109
Component: TMOS
Symptoms:
When bulk deleting a large number of Bot Defense profiles (around 450 profiles) using TMSH, mcpd could crash.
Conditions:
This can be encountered during bulk delete of Bot Defenese profiles via tmsh.
Impact:
Crash of mcpd causing failover.
Workaround:
Delete the Bot Defense profiles in smaller batches to avoid the possible crash.
Fix:
There is no longer a crash of mcpd when deleting a large number of Bot Defense in a bulk using TMSH.
Fixed Versions:
17.0.0, 16.1.3, 15.1.6.1, 14.1.5
941625-3 : BD sometimes encounters errors related to TS cookie building
Links to More Info: BT941625
Component: Application Security Manager
Symptoms:
BD sometimes print errors related to TS cookie building when receiving ASM cookies with account_id:
-- BEM|ERR |May 19 17:49:55.800|0983|response_header_accumulator.c:0200|Error: CookieMgrBuildCookie failed. ans 1 job 2957561040.
-- IO_PLUGIN|ERR |May 19 17:49:55.800|0983|io_plugin.c:3320|TMEVT_RESPONSE: Cannot build a ts cookie.
Conditions:
-- Cookie protection is enabled.
-- The BIG-IP software is upgraded from a version that was earlier than 15.1.x.
Impact:
The cookie is not built and an error is logged.
Workaround:
None.
Fixed Versions:
17.0.0, 16.1.1, 15.1.4
940261-1 : Support IPS package downloads via HTTP proxy.
Links to More Info: BT940261
Component: Protocol Inspection
Symptoms:
IPS package download via HTTP proxy does not work.
2021-08-31 16:59:59,793 WARNING Download file failed. Retrying.
--
The error repeats continuously.
Conditions:
-- The global db key 'sys management-proxy-config' is configured
-- An IPS download is triggered
Impact:
The IPS IM package fails to download.
Workaround:
No workaround.
Fix:
IPS package downloads can now be successfully performed through an HTTP proxy.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6
940225-4 : Not able to add more than 6 NICs on VE running in Azure
Links to More Info: BT940225
Component: TMOS
Symptoms:
Azure BIG-IP Virtual Edition (VE) with more than 6 NICs fails to boot.
Conditions:
-- Standard_DS4_v2 Azure instance type.
-- Mellanox ConnectX-3 ethernet controller.
-- A greater-than-2-NIC template is used, for example https://github.com/F5Networks/f5-azure-arm-templates/tree/master/supported/standalone/n-nic/existing-stack/byol with "numberOfAdditionalNics" set.
-- Accelerated networking is enabled on two or more NICs.
Impact:
Not able to boot BIG-IP VM with 8 NICs, which should be supported for Standard_DS4_v2 instance type:
8 vCPU
28 GiB
8 Max NICs
Adding more NICs to the instance makes the device fail to boot.
Workaround:
None
Fixed Versions:
17.1.0, 17.0.0.1, 16.1.3, 15.1.6.1, 14.1.5.1
939877-3 : OAuth refresh token not found
Links to More Info: BT939877
Component: Access Policy Manager
Symptoms:
When an OAuth client sends a refresh token to renew the access token, BIG-IP reports an error:
err tmm[13354]: 01990004:3: /Common/my_OAuth_v1:Common: Request Refresh Token from Source ID ... failed. Error Code (id_not_found) Error Description (The refresh token is not found)
Conditions:
-- The refresh token expiration interval is longer than authcode and accesstoken.
-- The Authorization code table entry does not exist because of an internal clearing/purging operation.
-- tmm restarts or failover to standby thus losing refresh-token value from primarydb
Impact:
OAuth APM client end user fails to renew the access token even with a valid refresh token.
Workaround:
Clear/reset the Authorization code column value manually:
As a root user run below BIG-IP shell
(tmos)# list apm oauth db-instance
apm oauth db-instance oauthdb { db-name <db_name> description "Default OAuth DB." }
Copy the value corresponding to <db_name>.
Log into mysql from the bash prompt:
# mysql -u root -p$(perl -MPassCrypt -nle 'print PassCrypt::decrypt_password($_)' /var/db/mysqlpw)
mysql> use <db_name>;
mysql> update master set auth_code = NULL where refresh_token='affected_refresh_token_id';
(Substitute the affected refresh token ID with affected_refresh_token_id in the previous command.)
Fix:
Do not report error if the Authorization code does not exist when a valid refresh-token/access-token exists.
Fixed Versions:
17.0.0, 16.1.2, 15.1.4, 14.1.4.4
936501-1 : Scp to /var/local/ucs or /var/local/scf is not allowed when fips140 or common criteria mode is enabled
Links to More Info: BT936501
Component: TMOS
Symptoms:
When attempting to Export/Import a file from the BIG-IP file path(s) /var/local/ucs or /var/local/scf via SCP, you receive an error dialog:
"file not allowed"
Conditions:
-- fips140 or common criteria mode enabled
-- Export/Import file from the BIG-IP file path(s) /var/local/ucs or /var/local/scf
Impact:
Import/Export file using scp tool from/to the BIG-IP file path(s) /var/local/ucs or /var/local/scf not allowed when fips140 or cc mode enabled even if the file is encrypted.
Workaround:
None
Fixed Versions:
17.1.0, 16.1.3.1
936441-7 : Nitrox5 SDK driver logging messages
Links to More Info: BT936441
Component: Local Traffic Manager
Symptoms:
The system kernel started spontaneously logging messages at an extremely high rate (~3000 per second):
Warning kernel: EMU(3)_INT: 0x0000000000000020
warning kernel: sum_sbe: 0
warning kernel: sum_dbe: 0
warning kernel: sum_wd: 0
warning kernel: sum_gi: 0
warning kernel: sum_ge: 0
warning kernel: sum_uc: 1
The above set of messages seems to be logged at about 2900-3000 times a second.
These messages continue after TMM fails its heartbeat and is killed. The system is rebooted by the host watchdog.
Conditions:
These messages are triggered by Nitrox5 driver when EMU microcode cache errors corrected by hardware.
Impact:
High rate of logging messages. The tmm heartbeat eventually fails, and tmm is restarted. Traffic disrupted while tmm restarts.
Workaround:
None.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.5
935249-3 : GTM virtual servers have the wrong status
Links to More Info: BT935249
Component: Global Traffic Manager (DNS)
Symptoms:
GTM virtual servers have the wrong status (up when they should be down, or down when they should be up).
Conditions:
-- The GTM virtual servers are monitored with an HTTP or HTTPS monitor that performs HTTP status matching.
-- The status code (for example, 200) being searched for in the response appears elsewhere than in the first line (for example, in a following header).
Impact:
The system incorrectly matches the status code in a response line which is not the Status-Line. As a result, the availability status reported for a virtual server may be incorrect. This may cause the GTM system to send traffic to unsuitable resources causing application disruptions.
Workaround:
You can work around this issue by not performing HTTP status matching in your HTTP/HTTPS GTM monitors.
Fix:
The HTTP status code is now correctly searched only in the first line of the response.
Fixed Versions:
17.0.0, 16.1.2.1, 15.1.5
935177-3 : IPsec: Changing MTU or PMTU settings on interface mode tunnel cores tmm
Links to More Info: BT935177
Component: TMOS
Symptoms:
TMM crashes when the maximum transmission unit (MTU) or 'Use PMTU' setting is changed while passing IPsec traffic.
Conditions:
-- IPsec tunnel configured and passing traffic.
-- The MTU or 'Use PMTU' setting for the IPsec tunnel (in interface mode) is changed.
Impact:
Traffic disrupted while tmm restarts.
Workaround:
Do not change MTU or PMTU settings for the tunnel while it is passing traffic.
The settings can be changed while passing traffic, but TMM may crash very soon after the change. If the settings are changed and TMM does not crash soon after, then it will not spontaneously crash at some later point.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1
934697-5 : Route domain is not reachable (strict mode)
Links to More Info: BT934697
Component: Local Traffic Manager
Symptoms:
Network flows are reset and following errors are found in /var/log/ltm:
Route domain not reachable (strict mode).
Conditions:
This might occur in either one of the following scenarios:
Scenario 1
==========
-- LTM with iRules configured.
-- The iRule directs traffic to a node that is in a route domain.
or
Scenario 2
==========
-- LTM with an LTM policy configured.
-- The policy directs traffic to a node that is in a route domain.
Other
=====
Tunnel scenario's such as IPSec where client and encrypted traffic are in different route domains.
Impact:
Traffic is not sent to the node that is in a route domain.
The iRule 'node' method and/or LTM policy 'node' specification require a route_domain to be specified in order for the traffic to be sent to a node that is assigned to a route domain.
Workaround:
Specify the node along with Route Domain ID.
-- For iRules, change from this:
when HTTP_REQUEST {
node 10.10.10.10 80
}
To this (assuming route domain 1):
when HTTP_REQUEST {
node 10.10.10.10%1 80
}
-- For LTM policies, change from this:
actions {
0 {
forward
select
node 10.2.35.20
}
}
To this (assuming route domain 1):
actions {
0 {
forward
select
node 10.2.35.20%1
}
}
Fixed Versions:
17.0.0, 16.1.3, 15.1.6.1, 14.1.5
932137-7 : AVR data might be restored from non-relevant files in /shared/avr_afm partition during upgrade
Links to More Info: BT932137
Component: Application Visibility and Reporting
Symptoms:
After upgrade, AFM statistics show non-relevant data.
Conditions:
BIG-IP system upgrade
-- Leftovers files remain in /shared/avr_afm partition from other versions.
Impact:
Non-relevant data are shown in AFM statistics.
Workaround:
Delete the non-relevant data manually from MariaDB/MySQL.
Fixed Versions:
17.0.0, 16.1.2, 15.1.4.1, 14.1.4.4, 13.1.5
932133-1 : Payloads with large number of elements in XML take a lot of time to process
Links to More Info: BT932133
Component: Application Security Manager
Symptoms:
ASM experiences high CPU and latency usage while processing a large XML request.
Conditions:
-- ASM provisioned
-- HTTP request with a large XML payload (several MB) is sent to the backend server which triggers the XML parser.
Impact:
High CPU and latency occurs while bd processes the payload. This may cause a bottleneck for different requests that arrive concurrently with the large XML payload request.
Workaround:
None
Fix:
This fix includes performance improvements for large XML payloads.
Fixed Versions:
17.0.0, 16.1.2, 15.1.4.1, 14.1.4.4, 13.1.5
929909-3 : TCP Packets are not dropped in IP Intelligence
Links to More Info: BT929909
Component: Advanced Firewall Manager
Symptoms:
When an IP address is added to IP Intelligence under Denial-Of_service Category at a global level, and a TCP flood with that IP address occurs, IP Intelligence does not drop those packets
Conditions:
TCP traffic on BIG-IP with IP Intelligence enabled and provisioned
Impact:
When adding an IP address to an IP Intelligence category, UDP traffic from that IP address is dropped, but TCP traffic is not dropped.
Fix:
When adding an IP address to an IP Intelligence category, both TCP and UDP traffic from that IP address is dropped.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1
929213-2 : iAppLX packages not rolled forward after BIG-IP upgrade★
Links to More Info: BT929213
Component: Device Management
Symptoms:
Certain iAppLX packages are not rolled forward after a BIG-IP upgrade or restoring a UCS file generated from an affected system, and will be unavailable for use.
1. f5-cloud-failover-1.4.0-0.noarch.rpm
2. f5-service-discovery-1.2.9-2.noarch.rpm
3. f5-telemetry-1.12.0-3.noarch.rpm
Conditions:
-> Installing any of the below iAppLX packages
1. f5-cloud-failover-1.4.0-0.noarch.rpm
2. f5-service-discovery-1.2.9-2.noarch.rpm
3. f5-telemetry-1.12.0-3.noarch.rpm
-> Performing an upgrade
-> Trying to access the LX packages from GUI by navigating to iApps -> Package Management LX
Impact:
After upgrading or restoring a UCS file generated from an affected system, the cloud-failover, service discovery, and telemetry iAppLX apps are not available for use, and will result in 404 error, while accessing them from GUI
Workaround:
The package needs to be uninstalled and installed again for use.
Steps:
-> From GUI, Navigate to iApps -> Package Management LX
-> select the package to uninstall and click on Uninstall
-> click on Import and provide the path of package to install again
Fix:
A new database key has been added, 'sys db iapplxrpm.timeout', which allows the RPM build timeout value to be increased.
sys db iapplxrpm.timeout {
default-value "60"
scf-config "true"
value "60"
value-range "integer min:30 max:600"
}
For example:
tmsh modify sys db iapplxrpm.timeout value 300
tmsh restart sys service restjavad
Increasing the db key and restarting restjavad should not be traffic impacting.
After increasing the timeout, the RPM build process that runs during a UCS save should be successful, and the resulting UCS should include the iAppsLX packages as expected.
Note: The maximum db key value of 600 may be needed in some cases.
Fixed Versions:
17.0.0, 16.1.2, 15.1.4.1, 14.1.4.4
926845-7 : Inactive ASM policies are deleted upon upgrade
Links to More Info: BT926845
Component: Application Security Manager
Symptoms:
Upon upgrade, active ASM policies are preserved, and inactive policies are deleted.
Conditions:
-- Configuration contains active and inactive ASM policies.
-- Upgrade the BIG-IP system to any later version.
-- You can check existing ASM policies in tmsh:
tmsh list asm policy
Impact:
Only the active ASM policies are preserved; the inactive policies are deleted.
Workaround:
None.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
926341-5 : RtIntervalSecs parameter in /etc/avr/avrd.cfg file is reset on version upgrade★
Links to More Info: BT926341
Component: Application Visibility and Reporting
Symptoms:
Unusually high AVR CPU utilization occurs following an upgrade.
Conditions:
-- BIG-IP software upgrade to v13.0.x or later.
-- Running AVR.
Impact:
AVR CPU utilization can be unusually high for an unusually long period of time.
Workaround:
After upgrade manually edit /etc/avr/avrd.cfg to decrease AVR CPU usage is high by increasing the time period of real-time statistics collection. In order to do so:
1. Change value of RtIntervalSecs in /etc/avr/avrd.cfg file to 30 or 60 seconds.
2. Restart the system by running the following command at the command prompt:
bigstart restart.
When changing RtIntervalSecs please take into consideration two important limitations:
-- Value of RtIntervalSecs cannot be less than 10.
-- Value of RtIntervalSecs must be 10 on BIG-IP devices that are registered on BIG-IQ DCD nodes.
Fixed Versions:
17.0.0, 16.1.3.1, 15.1.4, 14.1.4.4, 13.1.5
924945-5 : Fail to detach HTTP profile from virtual server
Links to More Info: BT924945
Component: Application Visibility and Reporting
Symptoms:
The virtual server might stay attached to the initial HTTP profile.
Conditions:
Attaching new HTTP profiles or just detaching an existing one.
Impact:
The virtual server stays attached to the former HTTP profile, meaning that the virtual server might be attached to a different HTTP profile than what the GUI displays. Configuration changes to the HTTP profile the GUI shows as attached are not reflected in the virtual server. For example, the new HTTP profile might enable XFF, but if the former attached profile does not enable it, the virtual server does not accept XFF.
Workaround:
Create new similar virtual server and attach it to the correct HTTP profile.
Fixed Versions:
17.0.0, 16.1.1, 16.0.1.2, 15.1.3
923221-8 : BD does not use all the CPU cores
Links to More Info: BT923221
Component: Application Security Manager
Symptoms:
Not all CPUs are utilized. The CPUs that are not loaded are those with ID greater than 31.
Conditions:
BIG-IP software is installed on a device with more than 32 cores.
Impact:
ASM does not use all of the available CPU cores.
Workaround:
Run the following commands from bash shell.
1. # mount -o remount,rw /usr
2. Modify the following file on the BIG-IP system:
/usr/local/share/perl5/F5/ProcessHandler.pm
Important: Make a backup of the file before editing.
3. Change this:
ALL_CPUS_AFFINITY => '0xFFFFFFFF',
To this:
ALL_CPUS_AFFINITY => '0xFFFFFFFFFFFF',
4. # mount -o remount,ro /usr
5. Restart the asm process:
# bigstart restart asm.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5
922413-8 : Excessive memory consumption with ntlmconnpool configured
Links to More Info: BT922413
Component: Local Traffic Manager
Symptoms:
OneConnect allows load balancing of HTTP requests from the same client connection over a pool of server side connections. When NTLM authentication is used, the NTLM Conn Pool allows reuse of server-side connections for authenticated client side connections. It holds HTTP authentication headers which is no longer necessary once a client is authenticated.
Conditions:
-- The virtual server is configured with both OneConnect and NTLM Conn Pool profiles.
-- A large number of client systems with NTLM authentication are load balanced via the virtual server with long-lived connections.
Impact:
The BIG-IP system experiences memory pressure, which may result in an out-of-memory condition and a process crash, and potentially cause failover and interruption of traffic processing.
Workaround:
None.
Fix:
When an NTLM Conn Pool profile is attached to a virtual server, it no longer causes memory pressure on a large number connections with NTLM authentication.
Fixed Versions:
17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7
922185-3 : LDAP referrals not supported for 'cert-ldap system-auth'★
Links to More Info: BT922185
Component: TMOS
Symptoms:
Admin users are unable to log in.
Conditions:
-- Remote LDAP auth enabled.
-- Administrative users are authenticated with the 'cert-ldap' source.
-- The admin user tries to log in.
Impact:
The cert-ldap authentication does not work, so login fails.
Workaround:
Manually edit the /etc/nslcd.conf and set the referrals to no.
Fixed Versions:
17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5
922105-1 : Avrd core when connection to BIG-IQ data collection device is not available
Links to More Info: BT922105
Component: Application Visibility and Reporting
Symptoms:
When a BIG-IP system is configured to work with BIG-IQ but cannot connect due to network problems, avrd restarts itself every 10 minutes. During such restarts, a core is sometimes generated.
Conditions:
BIG-IP system is registered on BIG-IQ, but there is no network connectivity for any number of reasons.
Impact:
No impact since there is no network connectivity with BIG-IQ, and the data from the BIG-IP system cannot be sent anywhere.
Workaround:
Attempts to connect to BIG-IQ can be disabled manually by the following command:
tmsh modify analytics global-settings use-offbox disabled
Fix:
Avrd no longer cores when the connection to the BIG-IQ data collection device is not available.
Fixed Versions:
17.0.0, 16.1.2, 15.1.4.1, 14.1.4.4, 13.1.5
921697-1 : Attack signature updates fail to install with Installation Error.★
Links to More Info: BT921697
Component: Application Security Manager
Symptoms:
Installing a new Attack Signature Update (ASU) file on ASM/AWAF device that has large number of active policies can result in a failure due to memory exceptions. The following errors can be observed:
/var/log/ts/asm_config_server.log:
F5::ASMConfig::Handler::handle_error,,Code: 406 , Error message = Process size (232341504) has exceeded max size (200000000)
/var/log/asm
crit perl[19751]: 01310027:2: ASM subsystem error (apply_asm_attack_signatures ,F5::LiveUpdate::PayloadHandler::clean_fail): Fail load update files: TSocket: timed out reading 1024 bytes from n.n.n.n:9781
Conditions:
1. Adding and activating a large number of policies on a BIG-IP system configured with ASM/AWAF. It is not known exactly how many policies are required to encounter this, but it appears to be between 50 and 90 where this becomes a risk.
2. Installing a new ASU file
Impact:
The attack signature update fails.
Workaround:
Impact of workaround:
Performing this workaround requires restarting ASM, so it affects traffic processing briefly; therefore, it is recommended that you perform this during a maintenance window.
Increase 'max memory size' from the default ~200 MB (200000000) to 300 MB:
1. Take a backup of the original file.
# cp /etc/ts/tools/asm_config_server.cfg /var/tmp/asm_config_server.original.cfg
2. Add the following to the end of file /etc/ts/tools/asm_config_server.cfg:
# AsyncMaxMemorySize=314572800
3. Restart ASM.
# bigstart restart asm
Fixed Versions:
17.0.0, 16.1.2.1, 15.1.5.1, 14.1.4.6
921441-4 : MR_INGRESS iRules that change diameter messages corrupt diam_msg
Links to More Info: BT921441
Component: Service Provider
Symptoms:
-- 'DIAMETER::host origin' command may not be set correctly.
There are errors in ltm/log:
err tmm[18562]: 014c0001:3: DIAMETER: hud_diam_handle error: Not found
Conditions:
-- Virtual server is configured with a diameter profile enabled with an ingress iRule, for example:
ltm rule Diameter - iRule {
when MR_INGRESS {
DIAMETER:: host origin "hostname.realm.example"
}
}
-- Traffic arrives containing CER and ULR messages.
Impact:
Using the iRule to change the host origin corrupts the diameter message.
Workaround:
None.
Fixed Versions:
17.0.0, 16.1.3.1, 15.1.7
921365-2 : IKE-SA on standby deleted due to re-transmit failure when failing over from active to standby
Links to More Info: BT921365
Component: TMOS
Symptoms:
IKE-SAs are deleted on standby BIG-IP systems after a failover.
Conditions:
-- High availability (HA) environment
-- Dead-peer detection (DPD) / liveness checks are enabled
-- An HA failover occurs
This is a timing issue and can occur intermittently during a normal failover.
Impact:
Some of the IKE-SAs are missing on the standby device. When a failover happens, IPsec traffic will be dropped for those missing SAs.
Workaround:
Set IKE DPD interval time to ZERO (i.e., disable).
Fix:
When the BIG-IP system is in standby mode, the system no longer retries sending IKE/IPSEC control messages, which prevents this issue from occurring.
Fixed Versions:
17.0.0, 16.1.2, 15.1.4
920149-3 : Live Update default factory file for Server Technologies cannot be reinstalled
Links to More Info: BT920149
Component: Application Security Manager
Symptoms:
Live Update default factory file for Server Technologies cannot be reinstalled once it is no longer the currently installed update file.
Conditions:
This occurs:
-- Once another update file for Server Technologies has been installed (most likely, a newer file).
-- If the device has been upgraded from a prior release such that the currently installed Server Technologies file is from the previous release, and is not the default factory file for the current release.
Impact:
Live Update default factory file for Server Technologies cannot be reinstalled.
Workaround:
None.
Fixed Versions:
17.0.0, 16.1.1, 15.1.4.1, 14.1.4.4
919301-1 : GTP::ie count does not work with -message option
Links to More Info: BT919301
Component: Service Provider
Symptoms:
The 'GTP::ie count' iRule command does not work with the -message option. The command fails with an error:
wrong # args: should be "-type <ie-path>"
Conditions:
Issue the 'GTP::ie count' command with -message command, for example:
GTP::ie count -message $m -type apn
Impact:
iRules fails and it could cause connection abort.
Workaround:
Swap order of argument by moving -message to the end, for example:
GTP::ie count -type apn -message $m
There is a warning message due to iRules validation, but the command works in runtime.
Fix:
'GTP::ie' count is now working with -message option.
Fixed Versions:
17.0.0, 16.1.1, 15.1.4, 14.1.4.4, 13.1.5
915773-7 : Restart of TMM after stale interface reference
Links to More Info: BT915773
Component: Local Traffic Manager
Symptoms:
An assert is reported in the logs:
panic: ../net/ifc.c:975: Assertion "ifc ref valid" failed.
Conditions:
The conditions under which this occurs are unknown.
Impact:
Tmm crashes and restarts. Traffic disrupted while tmm restarts.
Workaround:
None.
Fixed Versions:
17.0.0, 16.1.2, 15.1.4.1, 14.1.4.4
913413-1 : 'GTP::header extension count' iRule command returns 0
Links to More Info: BT913413
Component: Service Provider
Symptoms:
The 'GTP::header extension count' iRule command always returns 0 (zero).
Conditions:
This is encountered when using 'GTP::header extension count' in an iRule.
Impact:
The command returns false information.
Workaround:
None
Fix:
'GTP::header extension count' command now returns number of header extension correctly.
Fixed Versions:
17.0.0, 16.1.1, 15.1.4, 14.1.4.4, 13.1.5
913409-1 : GTP::header extension command may abort connection due to unreasonable TCL error
Links to More Info: BT913409
Component: Service Provider
Symptoms:
When running "GTP::header extension" iRule command with some conditions, it may cause a TCL error and abort the connection.
Conditions:
Running "GTP::header extension" iRule command is used with some specific arguments and/or specific condition of GTP message
Impact:
TCL error log is shown and connection is aborted
Workaround:
None
Fix:
GTP::header extension command no longer abort connection due to unreasonable TCL error
Fixed Versions:
17.0.0, 16.1.1, 15.1.4, 14.1.4.4, 13.1.5
913393-1 : Tmsh help page for GTP iRule contains incorrect and missing information
Links to More Info: BT913393
Component: Service Provider
Symptoms:
In the tmsh help page for the GTP iRule command, it contains incorrect and missing information for GTP::header and GTP::respond command.
Conditions:
When running "tmsh help ltm rule command GTP::header", information regarding GTP::header and GTP::respond iRule command may be incorrect or missing.
Impact:
User may not be able to use related iRule command properly.
Workaround:
None
Fix:
Tmsh help page for GTP iRule is updated
Fixed Versions:
17.0.0, 16.1.1, 15.1.4, 14.1.4.4, 13.1.5
913085-6 : Avrd core when avrd process is stopped or restarted
Links to More Info: BT913085
Component: Application Visibility and Reporting
Symptoms:
When the avrd process is stopped or restarted, it fails with core before the exit. A core file with the name starting with SENDER_HTTPS (for example, SENDER_HTTPS.bld0.0.9.core.gz) can be found in /shared/cores/ directory.
Conditions:
A BIG-IP system is registered on BIG-IQ and has established an HTTPS connection with BIG-IQ for sending stats data.
Impact:
Avrd cores while exiting. There is no impact on BIG-IP system functionality.
Workaround:
None.
Fix:
Avrd no longer cores when avrd process is stopped or restarted.
Fixed Versions:
17.0.0, 16.1.1, 16.0.1.2, 15.1.4, 14.1.4.2, 13.1.4.1
912945-3 : A virtual server with multiple client SSL profiles, the profile with CN or SAN of the cert matching the SNI is not selected if cert is ECDSA-signed
Links to More Info: BT912945
Component: Local Traffic Manager
Symptoms:
In a virtual configured with multiple client SSL profiles, the profile with ECDSA-signed cert is not selected even though its CN/SAN matching the SNI extension of ClientHello.
Conditions:
-- A virtual server with multiple client SSL profiles.
-- The SNI of,,lientHello does not match the 'server name' of any profile.
-- The cert in the profile is ECDSA-signed and its CN/SAN matches SNI extension of ClientHello.
-- That profile in is not selected.
Impact:
The incorrect client SSL profile is selected.
Workaround:
Configure the 'Server Name' option in the client SSL profile.
Fix:
Fixed an issue with client SSL profile selection.
Fixed Versions:
17.0.0, 16.1.1, 15.1.4, 14.1.4.4
912517-7 : Database monitor marks pool member down if 'send' is configured but no 'receive' strings are configured
Links to More Info: BT912517
Component: Local Traffic Manager
Symptoms:
If an LTM database monitor type (MySQL, MSSQL, Oracle, or PostgreSQL database monitor type) is configured with a 'send' string but with no 'receive' string to issue a user-specified database query, pool members using this monitor are marked DOWN, even though a connection to the configured database completed successfully.
Conditions:
-- An LTM pool or pool members is configured to use an LTM database (MySQL, MSSQL, Oracle or PostgreSQL) monitor type.
-- A 'send' string is configured for the monitor.
-- A 'receive' string is not configured.
Impact:
The database monitor marks the pool member down, even in cases where the pool member is actually pingable.
Workaround:
To work around this issue, configure 'send' and 'recv' strings for the database monitor that will always succeed when successfully connected to the specified database (with the configured username and password, if applicable).
Fix:
For BIG-IP versions 17.0.0 and earlier, a database monitor no longer marks pool member down if 'send' is configured but no 'receive' strings are configured.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
912253-2 : Non-admin users cannot run show running-config or list sys
Links to More Info: BT912253
Component: TMOS
Symptoms:
Lower-privileged users, for instance guests or operators, are unable to list the configuration in tmsh, and get an error:
Unexpected Error: Can't display all items, can't get object count from mcpd.
The list /sys or list /sys telemd commands trigger the following error:
01070823:3: Read Access Denied: user (oper) type (Telemd configuration).
Conditions:
User account with a role of guest, operator, or any role other than admin.
Impact:
You are unable to show the running config, or use list or list sys commands.
Workaround:
Logon with an account with admin access.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1
912149-7 : ASM sync failure with Cgc::Channel error 'Failed to send a message, error:15638476'
Links to More Info: BT912149
Component: Application Security Manager
Symptoms:
The system exhibits various symptoms related to sync and control plane, and reports errors similar to the following:
/var/log/:
asm:
-- (asm_config_server.pl,F5::Cgc::Channel::send): Failed to send a message, error:15638476.
ts_debug.log:
-- |ZEROMQ|May 21 23:27:31.840|24813|25914|25914|epoll.cpp:0060|~epoll_t()|(zmq_assert) Assertion failed: load.get () == 0
Conditions:
-- Two devices in a sync-failover/sync-only device group.
-- Other conditions required to reproduce this issue are under investigation.
Note: The occurrences of the Cgc::Channel message in the /var/log/ and /var/log/ts/asm_config_server logs are the most reliable indicator of this issue.
Impact:
-- Config-sync does not work, resulting in a different configuration among the devices in a sync group.
-- Security log profile changes are not propagated to other devices.
-- Portions of the GUI hang, e.g.: Security module tab, and 'security' menu under virtual server.
-- Policies with learning enabled do not generate learning suggestions.
Workaround:
Restart asm_config_server on the units in the device group.
# pkill -f asm_config_server
Fixed Versions:
17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5
911585-5 : PEM VE does not send CCRi when receiving multiple subscriber requests in a short interval
Links to More Info: BT911585
Component: Policy Enforcement Manager
Symptoms:
PEM sessions go to a stale state and the Credit Control Request (CCRi) is not sent.
Conditions:
-- PEM is configured and passing normal PEM traffic.
-- Using BIG-IP Virtual Edition (VE)
Impact:
Session is not established.
Workaround:
None.
Fix:
Enhanced application to accept new sessions under problem conditions.
Fixed Versions:
17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7
911141-1 : GTP v1 APN is not decoded/encoded properly
Links to More Info: BT911141
Component: Service Provider
Symptoms:
GTP v1 APN element was decoded/encoded as octetstring and Only GTP v2 APN element is decoded/encoded as DNS encoding.
Conditions:
- GTP version 1.
- APN element.
Impact:
iRules become more complex when dealing with GTP v1 APN element, as it may need to convert between octetstring and dotted style domain name value after decoding or before encoding the data.
Workaround:
Use iRules to convert between octetstring and dotted style domain name values.
Fix:
GTP version 1 APN information element is now decoded/encoded as DNS encoding.
Behavior Change:
GTP v1 apn element is now decoded/encoded using DNS-like encoding. Previously, it was decoded/encoded as octetstring.
Fixed Versions:
17.0.0, 16.1.1, 15.1.4, 14.1.4.4, 13.1.5
910673-6 : Nethsm-thales-install.sh installation fails with error 'Could not reach Thales HSM'
Links to More Info: BT910673
Component: Local Traffic Manager
Symptoms:
Thales installation script fails with error message.
ERROR: Could not reach Thales HSM "<ip>". Make sure the HSM IP address is correct and that the HSM is accessible to the BIG-IP.
Conditions:
This occurs when the ICMP ping is blocked between the BIG-IP system and netHSM.
Impact:
Thales/nCipher NetHSM client software installation fails.
Workaround:
Unblock ICMP ping between the BIG-IP system and netHSM.
Fixed Versions:
17.0.0, 16.1.2.1, 15.1.5.1
910213-7 : LB::down iRule command is ineffective, and can lead to inconsistent pool member status
Links to More Info: BT910213
Component: Local Traffic Manager
Symptoms:
Use of the LB::down command in an iRule may not have the desired effect, or may result in pool members that are down for load balancing, but indicate up/available in the GUI and CLI.
Specifically, the pool member is marked down within the tmm instance executing the iRule, but the status change is not updated to mcpd, or to other tmm instances.
As a result, the message 'Pool /Common/mypool member /Common/1.1.1.1:80 monitor status iRule down' does not appear in the log, and the status of the pool member is not updated when viewed in the GUI or via 'tmsh show ltm pool xxxx members'.
Note: If [event info] is logged in the LB_FAILED event, it will indicate that the load balancing decision failed due to "connection limit"
Conditions:
Using the LB::down command in an iRule.
Impact:
Because mcpd believes the pool member to be up, it does not update tmm's status, so tmm continues to regard it as down indefinitely, or until a monitor state change occurs.
If the LB::down command is used on all members of a pool, the affected tmms cannot load balance to that pool, even though the GUI/tmsh indicate that the pool has available members.
Because pool member status is stored on per-tmm basis and incoming connections are distributed across tmms using a hash, this can lead to apparently inconsistent results, where some traffic (traffic hitting a particular tmm) is rejected with an RST cause of 'No pool member available'.
Workaround:
- Delete and recreate affected pool members
(or) Restart tmm
(or) Restart the BIG-IP.
There is no direct workaround, but the use of an inband monitor instead of the LB::down command may be effective. You must tune the inband monitor's settings to values consistent with the desired behavior.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
909161-1 : A core file is generated upon avrd process restart or stop
Links to More Info: BT909161
Component: Application Visibility and Reporting
Symptoms:
Sometime when avrd process is stopped or restarted, a core is generated.
Conditions:
Avrd process is stopped or restarted.
Impact:
Avrd creates a core file but there is no other negative impact to the system.
Workaround:
None
Fixed Versions:
17.0.0, 16.1.1, 15.1.4, 14.1.4.4, 13.1.5
907549-6 : Memory leak in BWC::Measure
Links to More Info: BT907549
Component: TMOS
Symptoms:
Memory leak in BWC calculator.
Conditions:
When the HSL log publisher is attached to the BWC::Measure instance in the Bandwidth policy.
Impact:
A memory leak occurs.
Workaround:
None.
Fix:
Memory is not leaked.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.0.5, 14.1.5
907025-5 : Live update error" 'Try to reload page'
Links to More Info: BT907025
Component: Application Security Manager
Symptoms:
When trying to update Attack Signatures. the following error message is shown:
Could not communicate with system. Try to reload page.
Conditions:
Insufficient disk space to update the Attack Signature.
Impact:
Live Update unable to restore the database during startup. Device runs out of disk space, which leads to failure in writing live update hsqldb log file. The liveupdatedb.script file, which is based on the .log file, is truncated and missing necessary settings in order to initialize the live update database.
Workaround:
This following procedure restores the database to its default, initial state:
1. Remove the sigfile.tmp.* directories under /var/ts/var/tmp.
2. Delete the script:
delete /var/lib/hsqldb/live-update/liveupdatedb.script
3. Create a new script:
create new /var/lib/hsqldb/live-update/liveupdatedb.script.
4. Add the following lines to create the live update database schema and set the SA user as expected:
CREATE SCHEMA PUBLIC AUTHORIZATION DBA
CREATE MEMORY TABLE AVAILABILITY(ID VARCHAR(255) NOT NULL,ERRORMESSAGE VARCHAR(255),LASTCHECKDATETIME BIGINT,LASTCHECKUPDATEFILE VARCHAR(255),STATUS VARCHAR(255),"TYPE" VARCHAR(255),CONSTRAINT AVAILABILITY_PK PRIMARY KEY(ID))
CREATE MEMORY TABLE INSTALLSCHEDULE(ID VARCHAR(255) NOT NULL,APPLYATALLTIMES BOOLEAN,APPLYONALLDAYS BOOLEAN,APPLYONFRIDAYS BOOLEAN,APPLYONMONDAYS BOOLEAN,APPLYONSATURDAYS BOOLEAN,APPLYONSUNDAYS BOOLEAN,APPLYONTHURSDAYS BOOLEAN,APPLYONTUESDAYS BOOLEAN,APPLYONWEDNESDAYS BOOLEAN,ENDTIME VARCHAR(255),FREQUENCY VARCHAR(255),STARTTIME VARCHAR(255),"TYPE" VARCHAR(255),CONSTRAINT INSTALLSCHEDULE_PK PRIMARY KEY(ID))
CREATE MEMORY TABLE UPDATEFILE(ID VARCHAR(255) NOT NULL,CREATEDATETIME BIGINT,FILELOCATION VARCHAR(255),FILENAME VARCHAR(255),ISFILEAVAILABLE BOOLEAN,ISFILEMANUALLYUPLOADED BOOLEAN,ISGENESIS BOOLEAN,MD5 VARCHAR(255),"TYPE" VARCHAR(255),CONSTRAINT UPDATEFILE_PK PRIMARY KEY(ID))
CREATE MEMORY TABLE INSTALLATION(ID VARCHAR(255) NOT NULL,ADDEDENTITIESCOUNT INTEGER,DELETEDENTITIESCOUNT INTEGER,ERRORMESSAGE VARCHAR(255),LASTREADMEFILENAME VARCHAR(255),LASTUPDATEMICROS BIGINT,LOADDATETIME BIGINT,MODIFIEDENTITIESCOUNT INTEGER,README VARCHAR(500000),STATUS VARCHAR(255),"TYPE" VARCHAR(255),UPDATEFILE_ID_OID VARCHAR(255),CONSTRAINT INSTALLATION_PK PRIMARY KEY(ID),CONSTRAINT INSTALLATION_FK1 FOREIGN KEY(UPDATEFILE_ID_OID) REFERENCES UPDATEFILE(ID))
CREATE INDEX INSTALLATION_N49 ON INSTALLATION(UPDATEFILE_ID_OID)
CREATE MEMORY TABLE INSTALLATION_DELETEDENTITYLIST(ID_OID VARCHAR(255) NOT NULL,"ELEMENT" LONGVARBINARY,IDX INTEGER NOT NULL,CONSTRAINT INSTALLATION_DELETEDENTITYLIST_PK PRIMARY KEY(ID_OID,IDX),CONSTRAINT INSTALLATION_DELETEDENTITYLIST_FK1 FOREIGN KEY(ID_OID) REFERENCES INSTALLATION(ID))
CREATE INDEX INSTALLATION_DELETEDENTITYLIST_N49 ON INSTALLATION_DELETEDENTITYLIST(ID_OID)
CREATE MEMORY TABLE INSTALLATION_MODIFIEDENTITYLIST(ID_OID VARCHAR(255) NOT NULL,"ELEMENT" LONGVARBINARY,IDX INTEGER NOT NULL,CONSTRAINT INSTALLATION_MODIFIEDENTITYLIST_PK PRIMARY KEY(ID_OID,IDX),CONSTRAINT INSTALLATION_MODIFIEDENTITYLIST_FK1 FOREIGN KEY(ID_OID) REFERENCES INSTALLATION(ID))
CREATE INDEX INSTALLATION_MODIFIEDENTITYLIST_N49 ON INSTALLATION_MODIFIEDENTITYLIST(ID_OID)
CREATE MEMORY TABLE INSTALLATION_ADDEDENTITYLIST(ID_OID VARCHAR(255) NOT NULL,"ELEMENT" LONGVARBINARY,IDX INTEGER NOT NULL,CONSTRAINT INSTALLATION_ADDEDENTITYLIST_PK PRIMARY KEY(ID_OID,IDX),CONSTRAINT INSTALLATION_ADDEDENTITYLIST_FK1 FOREIGN KEY(ID_OID) REFERENCES INSTALLATION(ID))
CREATE INDEX INSTALLATION_ADDEDENTITYLIST_N49 ON INSTALLATION_ADDEDENTITYLIST(ID_OID)
CREATE USER SA PASSWORD ""
GRANT DBA TO SA
SET WRITE_DELAY 20
SET SCHEMA PUBLIC
5. Restart the tomcat process:
bigstart restart tomcat
Fixed Versions:
17.0.0, 16.1.2.1, 15.1.5, 14.1.4.5
902377-4 : HTML profile forces re-chunk even though HTML::disable
Links to More Info: BT902377
Component: Local Traffic Manager
Symptoms:
HTML profile performs a re-chunk even though HTML::disable has been executed in the HTTP_RESPONSE event.
Conditions:
Using HTML::disable in an HTTP_RESPONSE event.
Impact:
The HTML profile still performs a re-chunk.
Workaround:
None.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1
901669-6 : Error status in 'tmsh show cm failover-status', and stale data in some tmstat tables, after management IP address change.
Links to More Info: BT901669
Component: TMOS
Symptoms:
-- The 'tmsh show cm failover-status' command shows a status of 'Error' when the command is run on a peer of a device that underwent a management IP address change.
-- Should the sod_tg_conn_stat or sod_tg_msg_stat tmstat tables be inspected using the tmctl command, the tables show stale information in the entry_key column.
Note: Additionally, in certain cases, it is possible for failover functionality to be broken after the management IP address change, meaning devices remain stuck in an improper Active/Active or Standby/Standby state. This further aspect of the issue is tracked under ID999125. This ID tracks only the cosmetic defect.
Conditions:
-- Two or more devices in a sync-failover device-group.
-- The management IP address is changed on one of the devices.
The error appears under either of these conditions:
-- The 'tmsh show cm failover-status' is run on a peer of the device that underwent the management IP address change.
-- The sod_tg_conn_stat or sod_tg_msg_stat tmstat tables are inspected using the tmctl command.
Impact:
The 'tmsh show cm failover-status' command indicates an error.
Workaround:
You can work around this issue by running the following command on the peers of the device which underwent a management IP address change:
tmsh restart sys service sod
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6
898929-6 : Tmm might crash when ASM, AVR, and pool connection queuing are in use
Links to More Info: BT898929
Component: Local Traffic Manager
Symptoms:
TMM crashes and generates a core file.
Conditions:
-- System is provisioned for at least ASM, AVR, and LTM.
-- An LTM pool is configured to use connection queuing.
-- The LTM pool is used on a virtual server with an analytics profile.
Impact:
Tmm might crash. Traffic disrupted while tmm restarts.
Workaround:
Disable connection queuing on the pool.
Fixed Versions:
17.0.0, 16.1.2.1, 15.1.5, 14.1.4.5, 13.1.5
896941 : Common Criteria ccmode script updated
Links to More Info: BT896941
Component: TMOS
Symptoms:
Configuration of SSH must be done to support Common Criteria compliance. This is currently done by following instructions in the Common Criteria Guidance Document.
Conditions:
Common Criteria compliance configuration.
Impact:
This update automates the SSH configuration.
Workaround:
Continue to follow Common Criteria Guidance document instructions for SSH configuration.
Fix:
Added SSH configuration to meet Common Criteria requirements.
Fixed Versions:
17.0.0, 16.1.3
895557-5 : NTLM profile logs error when used with profiles that do redirect
Links to More Info: BT895557
Component: Local Traffic Manager
Symptoms:
As of BIG-IP version 14.1, HTTP iRule commands that inspect HTTP state after the commands HTTP::respond, HTTP::redirect, and HTTP::retry returns errors instead of returning corrupt data (https://support.f5.com/csp/article/K23237429).
When the NTLM profile is configured, it does the same through a built-in TCL rule where among several things, it tries to check if HTTP::cookie exists. If a profile like HTTP exists wherein a redirect/respond/retry is configured, it results in a TCL error informing the admin that they are accessing an invalid HTTP state.
Conditions:
-- NTLM profile is configured alongside HTTP profile
-- One of the redirect/respond/retry commands has been executed before the NTLM profile accesses the state of HTTP (for ex. HTTP::collect, HTTP::close, HTTP::cookie, etc.).
Impact:
Tcl error is seen in /var/log/ltm informing the admin that the iRule operation executed after HTTP::redirect/retry/respond is not supported.
For example -
TCL error: _plugin_rule_/Common/ntlm_default_iis <HTTP_REQUEST> - ERR_NOT_SUPPORTED (line 1) invoked from within "HTTP::cookie exists [PROFILE::ntlm insert_cookie_name]"
Fixed Versions:
17.0.0, 16.1.2, 16.0.1.2, 15.1.4, 14.1.4.2
888289-8 : Add option to skip percent characters during normalization
Links to More Info: BT888289
Component: Application Security Manager
Symptoms:
An attack signature is not detected.
Conditions:
-- The payload is filled with the percent character in between every other character.
-- The bad unescape violation is turned off.
-- The illegal metacharacter violation is turned off.
Impact:
An attack goes undetected.
Workaround:
Turn on the bad unescape violation or the metacharacter violation.
Fix:
Added an internal parameter, normalization_remove_percents. Its default is 0 (zero), meaning that the previous behavior is maintained. When enabled, the normalization of the data before running the signature removes the percent characters (as it does to high ASCII and space characters).
Fixed Versions:
17.0.0, 16.1.1, 16.0.1.2, 15.1.4, 14.1.4.2, 13.1.4.1
887117-4 : Invalid SessionDB messages are sent to Standby
Links to More Info: BT887117
Component: TMOS
Symptoms:
SessionDB messages sent from Active to Standby are dropped due to inconsistencies detected in the message. You see logs in /var/log/ltm:
SessionDB ERROR: received invalid or corrupt HA message; dropped message.
Conditions:
-- High availability (HA) pair configuration.
-- SessionDB messages sent from Active to Standby.
Impact:
Standby drops these messages
Workaround:
None.
Fixed Versions:
17.0.0, 16.1.1, 15.1.4.1
886649-5 : Connections stall when dynamic BWC policy is changed via GUI and TMSH
Links to More Info: BT886649
Component: TMOS
Symptoms:
Connections stall when dynamic BWC policy is changed via GUI and TMSH.
Conditions:
Issue is seen when you have a dynamic bandwidth control policy configured, and you make a change to the policy via the GUI and TMSH.
Impact:
Connection does not transfer data.
Workaround:
Restart TMM. Delete the relevant configuration, create a new configuration, and apply it.
Fixed Versions:
17.1.0, 17.0.0.1, 16.1.3, 15.1.6.1, 14.1.5.1
886533-5 : Icap server connection adjustments
Links to More Info: BT886533
Component: Application Security Manager
Symptoms:
Request getting to the ICAP server takes a long time to process (several seconds), which makes the whole transaction slower than expected. When testing the connection to the ICAP server itself, you determine that it is fast.
Conditions:
This happens especially with large file uploads that are mixed with smaller file uploads. The smaller uploads are waiting for the bigger upload.
Impact:
Slow responses to specific requests.
Workaround:
None.
Fix:
This release provides greater responsiveness of the internal queue to the ICAP thread.
Fixed Versions:
17.1.0, 17.0.0.1, 16.1.3.1, 15.1.6.1, 14.1.5.1
885765-1 : ASMConfig Handler undergoes frequent restarts
Links to More Info: BT885765
Component: Application Security Manager
Symptoms:
Under some settings and load the RPC handler for the tsconfd process restarts frequently.
Conditions:
When processing a large number of configuration updates.
Impact:
The RPC handler for the tsconfd process restarts frequently, causing unnecessary churn and noisy logs
Workaround:
None
Fixed Versions:
17.0.0, 16.1.2.1, 15.1.5, 14.1.4.5
883049-9 : Statsd can deadlock with rrdshim if an rrd file is invalid
Links to More Info: BT883049
Component: Local Traffic Manager
Symptoms:
-- RRD graphs are not updated.
-- System statistics are stale.
-- Commands such as 'tmsh show sys memory' may not complete.
-- qkview does not complete, as it runs "tmsh show sys memory'.
You may see errors:
-- err statsd[5005]: 011b0600:3: Error ''/var/rrd/endpisession' is too small (should be 15923224 bytes)' during rrd_update for rrd file '/var/rrd/endpisession'.
-- err statsd[5005]: 011b0600:3: Error '-1' during rrd_update for rrd file '/var/rrd/endpisession'.
Conditions:
Truncation of a binary file in /var/rrd.
Impact:
Stats are no longer collected. Statsd and rrdshim deadlock.
Workaround:
Remove the truncated file and restart statsd:
bigstart restart statsd
Fix:
Now detecting and rectifying truncation of RRD files.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5
882709-6 : Traffic does not pass on tagged VLANs on VE configured on Hyper-V hypervisors★
Links to More Info: BT882709
Component: TMOS
Symptoms:
Traffic does not pass on tagged VLANs when a BIG-IP Virtual Edition (VE) is deployed on a Hyper-V hypervisor.
This may manifest as traffic failing after an upgrade from earlier (unaffected) software versions.
Note: This functionality worked as expected in v13.x and earlier, and if the same VE is downgraded to v13.x, VLAN tagging functionality is restored.
This is due to an interoperability issue between RedHat Enterprise Linux (RHEL) and Microsoft Hyper-V, which seems to affect RHEL v7.3 and RHEL v7.5.
Hyper-V on Windows Server 2016 and Windows Server 2012 do not seem to identify the version of the built-in LIS correctly on Centos 7.3 or Centos 7.5 (which are built on RHEL 7.3 and RHEL 7.5 respectively).
Although there is a statement of support by Microsoft for VLAN tagging on RHEL 7.3 and 7.5 when running on Hyper-V, that functionality does not appear to work at present: Supported CentOS and Red Hat Enterprise Linux virtual machines on Hyper-V :: https://docs.microsoft.com/en-us/windows-server/virtualization/hyper-v/Supported-CentOS-and-Red-Hat-Enterprise-Linux-virtual-machines-on-Hyper-V.
Conditions:
-- BIG-IP VE is deployed on a Hyper-V hypervisor.
-- VLAN configured in BIG-IP VE with tagged interfaces, e.g.:
net vlan external {
interfaces {
1.1 {
tagged
}
}
tag 4000
}
-- At present, VLAN tagging on the v14.x and v15.x releases does not work because those releases are running on CentOS 7.3 and 7.5 respectively, which both are affected by the MS/RHEL interoperability issue.
-- BIG-IP v12.x and v13.x use a different (older) CentOS version, so VLAN tagging works without issue on those releases.
Impact:
-- The system does not prevent you from configuring tagged VLANs, even though they do not pass traffic.
-- Although upgrades complete and you can reboot into the new boot location (or you can set up on Hyper-V from scratch), traffic does not pass (into the guest) across VLANs that are tagged.
Important: If using tagged VLANs on VE setups on Hyper-V is critical to your configuration, you might want to elect to postpone upgrading from a working, v12.x and v13.x release.
Workaround:
Essentially, there is no workaround in this release; you must reconfigure the virtual machine to use separate, untagged interfaces for each VLAN.
Note: Although this is technically a problem between Hyper-V and the built-in LIS on RHEL 7.3/7.5, this issue is being tracked internally in this bug.
Behavior Change:
In this release, traffic does not pass on tagged VLANs when a BIG-IP Virtual Edition (VE) is deployed on a Hyper-V hypervisor.
This functionality worked as expected in v13.x and earlier, and if the same VE is downgraded to v13.x, VLAN tagging functionality is restored.
Important: If using tagged VLANs on VE setups on Hyper-V is critical to your configuration, you might want to elect to postpone upgrading from a working, v12.x and v13.x release.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1
881085-4 : Intermittent auth failures with remote LDAP auth for BIG-IP managment
Links to More Info: BT881085
Component: TMOS
Symptoms:
There are intermittent auth failures when accessing the BIG-IP administration interfaces via SSH or the GUI.
Conditions:
-- Remote LDAP auth is configured.
-- An idle timeout RST is received on the LDAP connection before the configured auth LDAP idle-timeout expires. This RST might be generated by tmm (if the connection to the LDAP server is via a defined VLAN), some other intervening device on the network, or from the LDAP server itself (depending on its connection time limit).
Impact:
There might be intermittent remote-auth failures.
Workaround:
Set the auth ldap idle-timeout to a smaller value, for example, via tmsh:
modify auth ldap system-auth idle-timeout 299
Fixed Versions:
17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5
876677-2 : When running the debug version of TMM, an assertion may be triggered due to an expired DNS lookup.
Links to More Info: BT876677
Component: Global Traffic Manager (DNS)
Symptoms:
When running the debug version of TMM, if a particular DNS lookup takes more than 30 seconds, TMM may assert with a message in the /var/log/tmm file similar to the following example:
notice panic: ../modules/hudfilter/3dns/cache_resolver.c:2343: Assertion "standalone refcnt must be one" failed.
Conditions:
-- Using the debug TMM
-- Using the RESOLV::lookup iRule command
-- The DNS server targeted by the aforementioned command is running slowly or malfunctioning
Impact:
TMM crashes and, in redundant configurations, the unit fails over.
Workaround:
Do not use the debug TMM.
Fix:
The debug assert was removed and replaced by a debug log.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1
874941-4 : HTTP authentication in the access policy times out after 60 seconds
Links to More Info: BT874941
Component: Access Policy Manager
Symptoms:
HTTP authentication in the access policy times out after 60 seconds, where previously, the timeout was 90 seconds.
Conditions:
Encountering the timeout of HTTP authentication in the access policy in this version of the software.
Impact:
HTTP authentication times out 30 seconds earlier than it did in previous versions. There is no way to configure this timeout value, so authentication fails for operations that require greater than 60 seconds to complete.
Workaround:
None.
Fix:
Added options to configure the HTTP connection and request timeouts in HTTP authentication.
1. A db key to configure Connection Timeout for HTTP Server configuration:
+[APM.HTTP.ConnectionTimeout]
+default=10
+type=integer
+min=0
+max=300
+realm=common
+scf_config=true
+display_name=APM.HTTP.ConnectionTimeout
2. A db key to configure Request Timeout for HTTP Server configuration:
+[APM.HTTP.RequestTimeout]
+default=60
+type=integer
+min=0
+max=600
+realm=common
+scf_config=true
+display_name=APM.HTTP.RequestTimeout
Behavior Change:
Added db variables APM.HTTP.ConnectionTimeout and APM.HTTP.RequestTimeout as options to configure the HTTP connection and request timeouts in HTTP authentication.
The APM.HTTP.ConnectionTimeout defaults to 10 seconds, and the APM.HTTP.RequestTimeout defaults to 60 seconds.
Note: These defaults are the same as the values in earlier releases, so there is no effective functional change in behavior.
Fixed Versions:
16.1.2.2, 15.1.6.1, 14.1.5
873617-1 : DataSafe is not available with AWAF license after BIG-IP startup or MCP restart.
Links to More Info: BT873617
Component: Fraud Protection Services
Symptoms:
DataSafe is not available with an AWAF license.
Conditions:
-- AWAF license
-- BIG-IP startup or MCP restart
Impact:
DataSafe is not available.
Workaround:
Reset to default license.antifraud.id variable.
tmsh modify sys db license.antifraud.id reset-to-default.
Fix:
Additional DataSafe license validation during MCP startup after license information is loaded.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
858005-1 : When APM VPE “IP Subnet Match” agent configured with leading/trailing spaces runtime evaluation results in failure with error in /var/log/apm "Rule evaluation failed with error:"
Links to More Info: BT858005
Component: Access Policy Manager
Symptoms:
APM Access Policy evaluation failed.
Conditions:
When APM VPE “IP Subnet Match” agent configured with leading/trailing spaces there is no configuration error but runtime evaluation results in failure with error message in /var/log/apm:
"Rule evaluation failed with error:"
Impact:
APM end user’s session cannot be established.
Workaround:
Using APM VPE remove all leading/trailing spaces from config of “IP Subnet Match” agent
Fix:
This issue is fixed by trimming spaces from IP Subnet Match agent config in VPE
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5
854129-6 : SSL monitor continues to send previously configured server SSL configuration after removal
Links to More Info: BT854129
Component: In-tmm monitors
Symptoms:
After an SSL profile has been removed from a monitor, a monitor instance continues to use settings from the previously-configured server SSL profile, such as client certificate or ciphers or supported TLS versions.
Conditions:
-- In-TMM monitors enabled.
-- SSL monitor configured with a server SSL profile.
-- Setting the monitor's 'SSL Profile' parameter to 'none'.
Impact:
The previously configured settings, such as certificate or cipher, continue to be used for monitoring pool members, which may result in unexpected health check behavior/pool member status.
Workaround:
An administrator can avoid this issue by ensuring the monitor's 'SSL Profile' parameter specifies a profile (i.e., is not 'none').
Note: In some software versions, changing a monitor's SSL profile from one profile to a different profile may not take effect. For information about this behavior, see https://cdn.f5.com/product/bugtracker/ID912425.html
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5
849029-7 : No configurable setting for maximum entries in CRLDP cache
Links to More Info: BT849029
Component: Access Policy Manager
Symptoms:
There is no setting provided to configure maximum entries the in CRLDP cache.
Conditions:
In a configuration with tens of thousands of CRLDP and hundreds of thousands or millions of certificates, certain operations might encounter an internal limit, resulting in a number of revoked certificates.
Impact:
No settings exist. Cannot set maximum entries in CRLDP cache.
Workaround:
None.
Fix:
There is now a setting for configuring maximum entries in CRLDP cache.
Fixed Versions:
17.0.0, 16.1.3, 15.1.6.1, 14.1.4.4
844045-4 : ASM Response event logging for "Illegal response" violations.
Links to More Info: BT844045
Component: Application Security Manager
Symptoms:
Response log is not available when the request is legal but returns an illegal response status code.
In ASM, logging profiles allow the logging of all blocked responses. The existing response logging allows either all requests or illegal requests only which does not contain response logging data.
Conditions:
-- Response logging is enabled
-- An illegal response occurs
Impact:
Response logging does not occur.
Workaround:
N/A
Fix:
When a response has ASM response violations and response logging is enabled only for when there was a violation, ASM includes the response in the log.
Added an internal variable:
disable_illegal_response_logging -- default value 0.
If the response logging is enabled in the GUI, only the response logs are captured.
If the variable disable_illegal_response_logging is set to 1, then response logging is disabled(even if enabled in GUI).
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
842013-1 : ASM Configuration is Lost on License Reactivation★
Links to More Info: BT842013
Component: Application Security Manager
Symptoms:
After re-activating a BIG-IP license, if the configuration fails to load and reverts to a base config load, the ASM policy config contains 'default' or 'stub' policies, even after fixing the error that caused the configuration to fail to load.
Conditions:
1) A parsing error exists in the BIG-IP config such that 'tmsh load sys config verify' would fail
2) There is a license reactivation or the configuration is reloaded
Impact:
ASM policy configuration is lost and all policies are reverted to empty 'stubs'
Workaround:
In the case of license re-activation/before upgrade:
Run the command "tmsh load sys config verify" prior to license activation on ASM units to be sure that the config will pass parsing and avoid the fallback to base configuration load.
In a case of booting the system into the new version:
Option 1:
1. Using the steps in either K4423 or K8465, fix the issue that was preventing the config to load.
2. Reload the config from the fixed UCS file using the command in K13132.
Option 2:
1. Roll back to the old version.
2. Fix the issue that was preventing the config to load.
3. Before activating the Boot Location of the new version at System >> Software Management : Boot Locations, make sure to set the option Install Configuration to Yes. see: K64400324
Option 3: If one of the high availability (HA) units successfully upgraded, then use config-sync to push the working config to the failing unit.
Fixed Versions:
17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5
838305-9 : BIG-IP may create multiple connections for packets that should belong to a single flow.
Links to More Info: BT838305
Component: Local Traffic Manager
Symptoms:
Due to a known issue, BIG-IP may create multiple connections for packets that should belong to a single flow. These connections will stay in the connection table until the idle timeout is reached. These connections can be used for forwarding the traffic.
Conditions:
BIG-IP may create multiple connections for packets that should belong to a single flow when both following conditions are true:
- Packets are coming at a very high rate from the network.
- Flow handling these packets is torn down.
Impact:
This might result in packets from the client being handled by one flow and packets from the server being handled by a different flow.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6
832133-7 : In-TMM monitors fail to match certain binary data in the response from the server
Links to More Info: BT832133
Component: In-tmm monitors
Symptoms:
Pool members are incorrectly marked DOWN by a monitor. The pool members send the expected response to the probe, but the BIG-IP system marks them DOWN.
Conditions:
This issue occurs when all of the following conditions are met:
- In-TMM monitoring is enabled on the system (the 'bigd.tmm' db key is set to 'enable'; note this is set to 'disable' by default).
- One or more TCP or HTTP monitors specify a receive string using HEX encoding, in order to match binary data in the server's response.
- Depending on the HEX values specified (currently values in the range of 0x80-0xBF are believed to be affected), response matching fails.
Impact:
Objects that are meant to be marked UP are marked DOWN. As a result, no load balancing occurs to affected resources.
Workaround:
Either one of the following workarounds can be used:
- Disable in-TMM monitoring by setting 'bigd.tmm' to 'disable'.
- Do not monitor the application through a binary response (if the application allows it).
Fix:
The monitor finds the recv string and shows the pool or member as available.
Fixed Versions:
17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7
830341-5 : False positives Mismatched message key on ASM TS cookie
Links to More Info: BT830341
Component: Application Security Manager
Symptoms:
ASM system triggers false positives for ASM Cookie Hijacking violation with reason "Mismatched message key"
Conditions:
-- An HTTP request containing an old frame cookie with a different message key from the main ts cookie is rejected
-- The cookie is left intact
Impact:
All subsequent requests are rejected on ASM Cookie Hijacking violation
Workaround:
1. Disable "Learn Host Names" flag all policies. If the policy builder is on manual mode, they need to change it back to Auto mode, disable "Learn Host Names", then change to manual mode.
OR
2. Delete the mismatched cookie. This will cause the violations to stop occurring if the request comes from a legit endpoint
Fix:
In order to activate the changed functionality, set internal parameter ignore_cookies_msg_key to 1 and restart asm by executing following commands in CLI:
/usr/share/ts/bin/add_del_internal add ignore_cookies_msg_key 1
bigstart restart asm
Once enabled, ASM system does not trigger false positives.
Fixed Versions:
17.0.0, 16.1.2.1, 16.0.1.2, 15.1.4, 14.1.4.2, 13.1.4.1
828761-5 : APM OAuth - Auth Server attached iRule works inconsistently
Links to More Info: BT828761
Component: Access Policy Manager
Symptoms:
The iRule attached to the OAuth Resource Server (RS) is not triggered when the traffic hits the virtual server.
Conditions:
The issue occurs during a reboot of the BIG-IP device containing an OAuth server config and an attached iRule, or when the iRule is initially assigned to the OAuth Server.
Impact:
OAuth scope check agent fails with 'HTTP error 503': as the iRule attached to the RS virtual server is not triggered.
Workaround:
For existing OAuth servers with the iRule attached, modify the iRule, for example, adding a log. This makes the iRule trigger when it is initially attached or loaded.
Fix:
The iRule is triggered when a request comes to the OAuth RS virtual server.
Fixed Versions:
17.0.0, 16.1.2.1, 15.1.5, 14.1.4.5
827393-5 : In rare cases tmm crash is observed when using APM as RDG proxy.
Links to More Info: BT827393
Component: Access Policy Manager
Symptoms:
Tmm may crash when APM is configured as an RDG proxy to access Microsoft remote desktops and applications.
Conditions:
APM is used as RDG proxy
Impact:
Traffic disrupted while tmm restarts.
Workaround:
None
Fix:
Tmm does not crash when APM is configured as RDG proxy.
Fixed Versions:
17.0.0, 16.1.2.1, 15.1.5.1, 14.1.4.5, 13.1.5
818889-1 : False positive malformed json or xml violation.
Links to More Info: BT818889
Component: Application Security Manager
Symptoms:
A false positive malformed XML or JSON violation occurs.
Conditions:
-- A stream profile is attached (or the http profile is set to rechunk on the request side).
-- A json/XML profile attached to the virtual.
Impact:
A false positive violation.
Workaround:
Modify the http profile to work in preserve mode for request chunking (this workaround is not possible in 16.1).
Fix:
N/A
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
815901-2 : Add rule to the disabled pem policy is not allowed
Links to More Info: BT815901
Component: Policy Enforcement Manager
Symptoms:
Adding rule to PEM policy is not allowed
Conditions:
A PEM policy is disabled
Impact:
You are unable to add rules to a PEM policy if it is disabled.
Fix:
Allow adding rules to disabled PEM policy
Fixed Versions:
17.0.0, 16.1.3.1, 15.1.7
805821-1 : GTP log message contains no useful information
Links to More Info: BT805821
Component: Service Provider
Symptoms:
GTP profile and GTP iRules provide no useful information in order to proceed with troubleshooting.
Conditions:
GTP profile or iRules fails to process message
Impact:
User lacks of information for troubleshooting
Workaround:
N/A
Fix:
GTP error log has been replaced with a more useful message. The new log message provides more intuitive information including the reason and, in some messages, location of data that causes the failure.
Fixed Versions:
17.0.0, 16.1.1, 15.1.4, 14.1.4.4, 13.1.5
803109-4 : Certain configuration may result in zombie forwarding flows
Links to More Info: BT803109
Component: Local Traffic Manager
Symptoms:
OneConnect profile in conjunction with 'Source-port preserve-strict' or cmp-hash setting of 'dst-ip' or 'src-ip' on the server-side VLAN may result in zombie forwarding flows.
On the server-side the incoming traffic hits a different TMM from the one that handles the outgoing traffic.
Unexpected 'Inet port exhaustion' messages may be logged in the LTM log file.
Conditions:
-- OneConnect configured.
And one of the following:
-- Source-port is set to preserve-strict.
-- The cmp-hash setting on the server-side VLAN is set to 'dst-ip' or 'src-ip'.
Impact:
Zombie forwarding flows. Over time, the current allocation count grows and does not return to its prior level when traffic stops.
The current allocation can be checked with this command:
# tmctl memory_usage_stat name=connflow -s name,cur_allocs
Workaround:
You can use any of the following workarounds:
-- Remove the OneConnect profile from the Virtual Server.
-- Do not use 'source-port preserve-strict' setting on the Virtual Server.
-- Set the 'cmp-hash default' on the server-side VLAN if it is set to 'cmp-hash src-ip' or 'cmp-hash dst-ip'.
Note: After making this change, it may be necessary to run the command 'tmsh restart sys service tmm', which will clear the old flows but also impact traffic. Traffic interrupted while tmm restarts.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6
794385-6 : BGP sessions may be reset after CMP state change
Links to More Info: BT794385
Component: Local Traffic Manager
Symptoms:
A CMP (Clustered Multiprocessing) state change occurs when the state of the BIG-IP system changes.
This happens in the following instances:
- Blade reset.
- Booting up or shutting down.
- Running 'bigstart restart'.
- Setting a blade state from/to primary/secondary.
During these events, there is a small chance that ingress ACK packet of previously established BGP connection is going to be disaggregated to the new processing group(TMMs) and selected TMM is ready to process traffic, but is not ready yet to process traffic for existing connection. In this case, connection isn't processed and reset instead.
Conditions:
-- VIPRION chassis with more than one blade.
-- CMP hash of affected VLAN is changed from the Default value, for example, to Source Address.
-- BGP peering is configured.
-- CMP state change is occurred on one of the blades.
-- BGP ingress ACK packet is disaggregated to TMM, which either wrong TMM or not ready to process the packet of already established connection
Impact:
Affected BGP peering is reset and dynamic routes learnt by the configured protocol are withdrawn, making it impossible to advertise dynamic routes of affected routing protocols from the BIG-IP system to the configured peers. This can lead to unexpected routing decisions on the BIG-IP system or other devices in the routing mesh.
In most cases, unexpected routing decisions are from networks learnt by affected routing protocols when the routing process on the BIG-IP system becomes unreachable. However, this state is short-lived, because the peering is recreated shortly after the routing protocol restarts. The peering time depends on the routing configuration and responsiveness of other routing devices connected to the BIG-IP system. It's the usual routing convergence period, which includes setting the peering and exchanging routing information and routes.
Workaround:
There is no workaround, but the issue was never seen with a configuration where CMP hash of affected VLAN is changed back to Default value.
Fix:
BGP session is no longer reset during CMP state change.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.5
780857-4 : HA failover network disruption when cluster management IP is not in the list of unicast addresses
Links to More Info: BT780857
Component: Local Traffic Manager
Symptoms:
If the cluster management IP address is not in the list of failover network unicast addresses, the blade management IP addresses in the unicast mesh will not be able to receive failover messages from peer devices.
Conditions:
-- VIPRION chassis or vCMP guest on a VIPRION chassis.
-- Per-blade management IP addresses listed in the failover network unicast mesh.
-- No cluster management IP address listed.
Impact:
The blade management IP addresses in the failover network unicast mesh stop functioning:
[root@VIP2200-R75-S5:/S1-green-P::Standby:In Sync] config # tmctl -w 200 -S sod_tg_conn_stat
entry_key local_failover_addr remote_device_name pkts_received transitions last_msg status
----------------------------- ------------------- ------------------------------ ------------- ----------- ---------- ------
10.200.75.8->10.10.10.1:1026 10.10.10.1:1026 VIP2200-R75-S8.sin.pslab.local 3249 3 1555399271 1
10.200.75.8->10.200.75.3:1026 10.200.75.3:1026 VIP2200-R75-S8.sin.pslab.local 0 1 0 0 <--
10.200.75.8->10.200.75.4:1026 10.200.75.4:1026 VIP2200-R75-S8.sin.pslab.local 0 1 0 0 <--
Workaround:
You can add an explicit management IP firewall rule to allow this traffic:
tmsh modify security firewall management-ip-rules rules add { accept_udp_1026 { place-before first ip-protocol udp destination { ports add { 1026 } } action accept } }
This will add a firewall policy so port 1026 is no longer locked down, and the blade management IP addresses in the unicast mesh should begin to function properly.
Fixed Versions:
17.0.0, 16.1.3.1, 15.1.6.1, 14.1.5.1
755976-9 : ZebOS might miss kernel routes after mcpd deamon restart
Links to More Info: BT755976
Component: TMOS
Symptoms:
After an mcpd daemon restart, sometimes (in ~30% of cases) ZebOS is missing some of kernel routes (virtual addresses).
One of the most common scenario is a device reboot.
Conditions:
-- Dynamic routing is configured.
-- Virtual address is created and Route Advertisement is configured:
imish -e 'sh ip route kernel'
-- mcpd daemon is restarted or device is rebooted.
Impact:
The kernel route (virtual address) is not added to the ZebOS routing table and cannot be advertised.
Workaround:
There are several workarounds; here are two:
-- Restart the tmrouted daemon:
bigstart restart tmrouted
-- Recreate the affected virtual address.
Fix:
The kernel route is now present in the ZebOS routing table after mcpd daemon restart.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
749332-1 : Client-SSL Object's description can be updated using CLI and with REST PATCH operation
Links to More Info: BT749332
Component: TMOS
Symptoms:
REST PUT fails to update the object description when proxy-ca-cert and proxy-ca-key are not configured, and triggers an error:
SSL forward proxy RSA CA key is missing.
Conditions:
Issue is seen only with REST PUT operation, and when proxy-ca-cert and proxy-ca-key are not configured.
Impact:
REST PUT operation cannot be used to update/modify the description.
Workaround:
You can use either of the following:
-- You can use TMSH to update/modify the description, even if proxy-ca-cert and proxy-ca-key are not configured.
-- You can also use PATCH operation and send only the required field which need modification.
Fixed Versions:
17.0.0, 16.1.2.1, 15.1.5, 14.1.4.4
748886-4 : Virtual server stops passing traffic after modification
Links to More Info: BT748886
Component: Local Traffic Manager
Symptoms:
A virtual server stops passing traffic after changes are made to it.
Conditions:
-- Virtual server is using a port-list or address-list
-- High availability (HA) environment with multiple traffic groups
-- A change is made to the virtual server
Impact:
Every time you make changes to the virtual server, the traffic-group for the virtual address is changed, and traffic goes down.
Fixed Versions:
17.1.0, 17.0.0.1, 16.1.3.1, 15.1.6.1, 14.1.5.1
742753-8 : Accessing the BIG-IP system's WebUI via special proxy solutions may fail
Links to More Info: BT742753
Component: TMOS
Symptoms:
If the BIG-IP system's WebUI is accessed via certain special proxy solutions, logging on to the system may fail.
Conditions:
This issue is known to happen with special proxy solutions that do one of the following things:
- Remove the Referer header.
- Modify the HTTP request in such a way that the Referer and Host headers no longer tally with one another.
Impact:
Users cannot log on to the BIG-IP system's WebUI.
Workaround:
As a workaround, you can do any of the following things:
- Access the BIG-IP system's WebUI directly (i.e., bypassing the problematic proxy solution).
- Modify the proxy solution so that it does not remove the Referer header (this is only viable if the proxy does not alter the Host header).
- Modify the proxy solution so that it inserts compatible Referer and Host headers.
Fix:
CSRF checks based on HTTP headers pre-logon have been improved.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5
738593-3 : Vmware Horizon session collaboration (shadow session) feature does not work through APM.
Links to More Info: BT738593
Component: Access Policy Manager
Symptoms:
When the VMware virtual desktop interface (VDI) is configured, session collaboration or shadow session does not work.
Conditions:
-- VMware VDI configured and Desktop resource is accessed with native client only.
-- Launch resources and VMware Horizon Client will use Blast protocol to display VMware sessions.
-- Shadow session is enabled in desktop.
Impact:
Desktop's Shadow session resource icon is not showed on webtop of native client.
Workaround:
None
Fix:
Users should see Desktop's shadow session icon when resources are loaded on to webtop of native client.
Fixed Versions:
17.0.0, 16.1.2.1, 15.1.5, 14.1.4.5
724653-5 : In a device-group configuration, a non-empty partition can be deleted by a peer device during a config-sync.
Links to More Info: BT724653
Component: TMOS
Symptoms:
In a device-group configuration, a BIG-IP administrator can add a non-synced object to a partition on one device, then delete that partition on a peer device, syncing the delete (this is assuming the partition is empty on the peer).
Although the config-sync operation will report as having completed successfully on both devices, and no errors will be visible in the /var/log/ltm file of either device, a number of issues can manifest at a later time.
For instance, assuming the non-synced object was a VLAN, listing all VLANs across all partitions will return the following error:
root@(bigip-ntr-d)(cfg-sync In Sync)(Active)(/)(tmos)# list net vlan recursive
01070712:3: Internal error, can't load folder or nested folder for: /test/my_vlan
And reloading the config will return the following error (as the partition has been deleted, including its flat config files):
root@(bigip-ntr-d)(cfg-sync In Sync)(Active)(/Common)(tmos)# load sys config
Loading system configuration...
/defaults/asm_base.conf
/defaults/config_base.conf
/defaults/ipfix_ie_base.conf
/defaults/ipfix_ie_f5base.conf
/defaults/low_profile_base.conf
/defaults/low_security_base.conf
/defaults/policy_base.conf
/defaults/wam_base.conf
/defaults/analytics_base.conf
/defaults/apm_base.conf
/defaults/apm_saml_base.conf
/defaults/app_template_base.conf
/defaults/classification_base.conf
/var/libdata/dpi/conf/classification_update.conf
/defaults/urlcat_base.conf
/defaults/daemon.conf
/defaults/pem_base.conf
/defaults/profile_base.conf
/defaults/sandbox_base.conf
/defaults/security_base.conf
/defaults/urldb_base.conf
/usr/share/monitors/base_monitors.conf
Loading configuration...
/config/bigip_base.conf
/config/bigip_user.conf
/config/bigip.conf
01070523:3: No Vlan association for STP Interface Member 1.2.
Unexpected Error: Loading configuration process failed.
These are just examples, and the exact failures will depend on the type of non-synced object and its use within your configuration.
Conditions:
-- Two or more devices in a device-group configuration.
-- Using partitions that contain non-synced objects.
-- Deleting the partition on a device and syncing the changes to the other devices.
Impact:
The partition is deleted on the peer device, even though it still contains non-synced objects. A number of config issues can arise at a later time as a result of this.
Workaround:
In some cases, if you need to define non-synced objects, you can do so in partitions or folders that are associated with 'device-group none' and 'traffic-group none'. This would prevent the partition or folder from synchronizing to other devices in the first place.
Fix:
Validation has been added that will make a config-sync receiver reject the operation if this includes the deletion of a non-empty partition. In this case, the config-sync will fail and report an error message similar to the following example:
0107082a:3: All objects from local device and all HA peer devices must be removed from a partition (test) before the partition may be removed, type ID (467), text ID (60706)
Fixed Versions:
17.0.0, 16.1.3, 15.1.6.1, 14.1.5
720610-4 : Automatic Update Check logs false 'Update Server unavailable' message on every run
Links to More Info: BT720610
Component: TMOS
Symptoms:
The Automatic Update Check operation erroneously logs a message indicating that the Update Server is unavailable on every run, successful or not.
Conditions:
The BIG-IP system is configured to run the Automatic Update Check feature.
Impact:
Misleading 'PHONEHOME: Update Server unavailable' messages in the log file, implying that the update server is not available.
Workaround:
None.
Fix:
The Automatic Update Check operation no longer logs false messages.
Fixed Versions:
17.0.0, 16.1.3.1, 15.1.6.1, 14.1.2.7, 13.1.3
717806-8 : In the case of 'n' bigd instances, uneven CPU load distribution is seen when a high number of monitors are configured
Links to More Info: BT717806
Component: Local Traffic Manager
Symptoms:
Load average peaks are observed when a high number of monitors (>= 200) are configured across 'n' bigd instances.
Conditions:
When a high number of monitors are configured across 'n' bigd instances. CPU load peaks appear and disappear periodically.
Impact:
No performance impact
Workaround:
None
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
713754-3 : Apache vulnerability: CVE-2017-15715
Links to More Info: K27757011
708991-1 : Newly entered password is not remembered.
Links to More Info: BT708991
Component: TMOS
Symptoms:
- Upon enabling password remember feature and running 'tmsh load sys config default', the password history fails to verify and save the newly entered password.
- Upon installing a BIG-IP image for the first time, the default password is not updated.
Conditions:
- Installing first time BIG-IP image.
- Resetting the configuration using 'tmsh load sys config default'.
Impact:
The password is not remembered.
Workaround:
N/A
Fix:
Corrected selinux policy script of the file /etc/security/opasswd for access permission.
Fixed Versions:
17.0.0, 16.1.2
686783-1 : UlrCat custom database feed list does not work when the URL contains a www prefix or capital letters.
Links to More Info: BT686783
Component: Traffic Classification Engine
Symptoms:
If a UrlCat custom database feed list has URLs containing a www prefix or capital letters, the URLs are not categorized when queried.
Conditions:
The UrlCat custom database feed list with URL containing www prefix or capital letters,
Impact:
Improper classification
Workaround:
Using an iRule can help classify the URL.
Fix:
Normalized the URL before putting in the custom database.
Fixed Versions:
17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5
672963-1 : MSSQL monitor fails against databases using non-native charset
Links to More Info: BT672963
Component: Local Traffic Manager
Symptoms:
MSSQL monitor is fails against databases using non-native charset.
Conditions:
MSSQL monitor configured to monitor a database that is using non-native charset (ISO-8859-1).
Impact:
MSSQL monitoring always marks node / member down.
Workaround:
On BIG-IP v13.x and v14.0.x, you can work around this issue using the following steps:
1. Log in to the BIG-IP console into a bash prompt.
2. Run the following command:
mount -o remount,rw /usr; ln -s /usr/java-64/openjdk/lib/charsets.jar /usr/java/openjdk/lib/charsets.jar; mount -o remount,ro /usr
3. Restart bigd:
bigstart restart bigd
Fix:
MSSQL monitor can be used effectively against a database using a non-native charset.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
669046-7 : Handling large replies to MCP audit_request messages
Links to More Info: BT669046
Component: TMOS
Symptoms:
When receiving very large replies to MCP messages (e.g., when viewing audit logs from the GUI), MCP can run out of memory and produce a core file. This is due in part to the amount of data returned, and also due in part to memory handling.
In a production environment, fragmentation naturally occurs over the lifetime of MCP, thus increasing the odds of this happening. In addition, larger configurations cause more space to be consumed in MCPD and might more easily lead to the fragmentation, resulting in this issue.
Conditions:
Receiving very large replies to MCP messages (e.g., from audit_request messages, which occurs when you view audit logs from the GUI).
Memory usage is already high.
Impact:
Allocation of memory for viewing the audit logs fails. MCP can run out of memory and produce a core file.
Workaround:
Use tmsh/bash to view the audit logs instead of the GUI when audit logs are extremely large and memory usage is already high.
Fix:
Viewing audit logs in the GUI is now limited to 10,000 lines, so this issue no longer occurs.
Behavior Change:
The GUI is limited to viewing no more than 10,000 lines of the audit log.
You can use tmsh/bash to view audit logs larger than 10,000 lines.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5
528894-5 : Config-Sync after non-Common partition config changes results in extraneous config stanzas in the config files of the non-Common partition
Links to More Info: BT528894
Component: TMOS
Symptoms:
Configuration stanzas that do not belong in the files of a non-Common partition appear there. These stanzas could include, for example, 'net trunk' or 'sys ha-group' objects.
Conditions:
-- The system includes partitions other than Common.
-- Configuration in a partition other than Common is modified.
-- A Config-Sync operation not involving an overwrite takes place (it is also possible to reproduce this issue on a standalone BIG-IP system by doing a save operation like the following: "tmsh save sys config partitions { Common other }").
Impact:
/config/partitions/<partition_name>/bigip_base.conf will contain extraneous config stanzas (such as the ones mentioned in Symptoms).
/config/bigip_base.conf will no longer contain config stanzas that belong there.
Note that the impact is mostly cosmetic. An affected device will still be able to correctly load its configuration even if some config stanzas appear in the wrong flat config file.
However, Administrators performing audits of the flat config files will be perplexed as to why some stanzas are moving back and forth between partitions.
Workaround:
If you wish to restore your flat config files to their proper state after the issue has already occurred, simply run "tmsh save sys config" on the affected device.
Alternatively, to prevent the issue in the first place, you can Config-Sync using the following command "tmsh run cm config-sync force-full-load-push to-group <device-group>".
Note that neither workaround is permanent and the issue will reoccur.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5, 14.1.4.6, 13.1.5
435231 : Support RFC7919 Negotiated Finite Field Diffie-Hellman Ephemeral parameters
Links to More Info: K79342815, BT435231
Component: Local Traffic Manager
Symptoms:
RFC7919 Negotiated Finite Field Diffie-Hellman Ephemeral (FFDHE) parameters are not supported.
Conditions:
This affects ciphersuites that use Diffie–Hellman Ephemeral (DHE) key exchange.
Impact:
Support for larger FFDHE groups will be chosen if offered by the client.
Note: You might notice an impact to performance as compared with the previously chosen DHE 1024.
Workaround:
None
Fix:
With the support for the FFDHE groups defined in RFC7919, the system now supports DHE2048, DHE3072, DHE4096 keys. The default DHE key size is 2048 bits. (In previous BIG-IP versions, the default was 1024 bits.)
You can configure this default value by enabling or disabling the DB variable tmm.ssl.dh1024. To do so, use the following TMSH command syntax:
modify sys db tmm.ssl.dh1024 value enable/disable
To use FFDHE2048, FFDHE3072, FFDHE4096 keys, you define them in a cipher rule, and then use this rule in a cipher group before associating it with an SSL profile.
Note: If you use a cipher rule that does not define any of the FFDHE2048, FFDHE3072, or FFDHE4096 groups (e.g., f5-default), this feature is not enabled.
For more information, and for steps to define these rules, see K79342815: BIG-IP support for RFC7919 Negotiated Finite Field Diffie-Hellman Ephemeral (FFDHE) :: https://support.f5.com/csp/article/K79342815.
Behavior Change:
RFC7919 Negotiated FFDHE parameters are now supported.
The FFDHE2048, FFDHE3072, FFDHE4096 keys are supported in this release. The default is DHE 2048 bits.
In previous versions, the default DHE key size was 1024 bits. If you want to continue to use DHE 1024 you can enable db var tmm.ssl.dh1024, by default it is disabled.
For more information, and for steps to use this feature, see K79342815: BIG-IP support for RFC7919 Negotiated Finite Field Diffie-Hellman Ephemeral (FFDHE) :: https://support.f5.com/csp/article/K79342815.
Fixed Versions:
17.0.0, 16.1.3
423519-5 : Bypass disabling the redirection controls configuration of APM RDP Resource.
Links to More Info: K74302282, BT423519
Component: Access Policy Manager
Symptoms:
User can bypass RDP resource redirection restrictions between RDP remote machine and local machine.
Conditions:
1. Create RDP resource. Disable redirection parameter.
2. Launch the resource.
3. Launch RDP Client, enable redirection parameter.
Impact:
User can bypass RDP resource restrictions.
Workaround:
NA
Fix:
User is not allowed to perform any redirection controls of the RDP resource.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
1213305-3 : Improper query string handling on undisclosed pages
Component: Global Traffic Manager (DNS)
Symptoms:
On undisclosed pages, query strings are not processed as expected.
Conditions:
N/A
Impact:
N/A
Workaround:
N/A
Fix:
The query string is processed as expected.
Fixed Versions:
16.1.3.4
1208989-3 : Improper value handling in DOS Profile properties page
Component: Application Security Manager
Symptoms:
The DOS Profile properties page incorrectly renders certain data in the UI.
Conditions:
N/A
Impact:
Improper rendering of the DOS Profile.
Workaround:
N/A
Fix:
The DOS Profile Properties page now renders data correctly.
Fixed Versions:
17.1.0, 16.1.3.4
1208001-1 : iControl SOAP vulnerability CVE-2023-22374
Links to More Info: K000130415, BT1208001
1207661-4 : Datasafe UI hardening
Component: Fraud Protection Services
Symptoms:
The Datasafe UI does not follow best security practices.
Conditions:
N/A
Impact:
N/A
Workaround:
Restrict access to the BIG-IP control plane to only trusted users.
Fix:
The Datasafe UI now follows best practices.
Fixed Versions:
17.1.0, 16.1.3.4
1204961-4 : Improper query string handling on undisclosed pages
Component: Application Visibility and Reporting
Symptoms:
On undisclosed pages, query strings are not processed as expected.
Conditions:
N/A
Impact:
N/A
Workaround:
Reduce access to the control plane to trusted users.
Fix:
The query string is processed as expected.
Fixed Versions:
16.1.3.4
1204793-4 : Improper query string handling on undisclosed pages
Component: Application Visibility and Reporting
Symptoms:
On undisclosed pages, query strings are not processed as expected.
Conditions:
N/A
Impact:
N/A
Workaround:
NA
Fix:
Query strings are processed as expected.
Fixed Versions:
16.1.3.4
1196033-2 : Improper value handling in DataSafe UI
Component: Fraud Protection Services
Symptoms:
The DataSafe UI does not properly handle certain requests.
Conditions:
N/A
Impact:
N/A
Workaround:
N/A
Fix:
Requests are now handled as expected.
Fixed Versions:
17.1.0, 16.1.3.4
1174873-3 : The location header query string separate is converted from "?" to "%3F" breaking multi-domain
Links to More Info: BT1174873
Component: Access Policy Manager
Symptoms:
In muti-domain Single Sign-On (SSO), the location header query string separate is converted from "?" to "%3F" breaking multi-domain.
Conditions:
- Create an access policy with a redirect to login page.
Impact:
Breaking multi-domain.
Workaround:
None
Fix:
Issue is with the normalized URL function, removed the search filter parameters normalization.
Fixed Versions:
17.1.0, 17.0.0.2, 16.1.3.3, 15.1.8.1, 14.1.5.3
1137037 : System boots into an inoperative state after installing engineering hotfix with FIPS 140-2/140-3 license in version 16.1.x★
Links to More Info: BT1137037
Component: Local Traffic Manager
Symptoms:
The BIG-IP persistently starts in an inoperative state after installing an engineering hotfix with a console error similar to the following:
- FIPS or Common Criteria power-up self-test failure.
- This system has been placed in an error state.
- To recover return to the grub menu and select another volume or reinstall the system.
- On many devices pressing the escape key followed by the key will bring up a menu which allows the system to be restarted.
Power-up self-test failures: <number>
Unmounting file systems
System halting.
Conditions:
- First boot after installing an engineering hotfix.
- FIPS 140-2 or FIPS 140-3 license.
- Running BIG-IP version 16.1.x releases or later, for example 16.1.3.1.
Impact:
Unable to boot the BIG-IP system into an operational state after applying an engineering hotfix, and required to boot to a known good volume. For more information about FIPS mode preventing system boot, see https://support.f5.com/csp/article/K52534643
Workaround:
None
Fix:
The BIG-IP system successfully boots after installing an Engineering hotfix on a system with a FIPS 140-2 or FIPS 140-3 license.
Fixed Versions:
16.1.3.2
1134085-2 : Intermittent TMM core when iRule is configured with SSL persistence
Links to More Info: BT1134085
Component: Local Traffic Manager
Symptoms:
The TMM core file is observed.
Conditions:
Under certain conditions, the TMM core file is observed with iRule and SSL persistence.
Impact:
TMM core file is observed.
Workaround:
Perform either of the following tasks:
- Disable SSL persistence
- Disable iRule
Fix:
Added fix to handle cases which can lead to the TMM core file generation.
Fixed Versions:
17.1.0, 17.0.0.2, 16.1.3.3, 15.1.8.1
1123149 : Sys-icheck fail for /etc/security/opasswd
Links to More Info: BT1123149
Component: TMOS
Symptoms:
In common criteria mode, when password-memory is set to > 0 and create the user and login from CLI causes the system integrity check to failed
An error message may be logged "ERROR: S.5...... c /etc/security/opasswd (no backup)"
Conditions:
--- common criteria mode enabled
--- password-memory set to > 0 in password-policy configuration
--- create a new user and login first time using CLI
--- run sys-icheck
Impact:
System integrity check failure when common criteria mode is enabled
Workaround:
None
Fixed Versions:
17.1.0, 16.1.3.1
1122473-4 : TMM panic while initializing URL DB
Links to More Info: BT1122473
Component: Access Policy Manager
Symptoms:
TMM panic because of a race condition which prevents the TMM from accessing files related to the URL database.
Conditions:
While the BIG-IP system is rebooting, if an infrequent timing delay occurs, one or more files related to the URL database may be created in the wrong order of sequence.
Impact:
Traffic disrupted while TMM restarts.
Workaround:
None. Repeated attempts at rebooting may eventually succeed.
Fixed Versions:
17.1.0, 16.1.3.3
1120685 : Unable to update the password in the CLI when password-memory is set to > 0
Links to More Info: BT1120685
Component: TMOS
Symptoms:
A BIG-IP system with password-memory enabled will fail to update the user password in the first login using the CLI
Conditions:
Password-memory set to > 0 in password-policy configuration
Impact:
Not able to update the user password in the first login using the CLI.
Workaround:
Create the user using the GUI and log in from the GUI.
Fixed Versions:
17.1.0, 16.1.3.1
1120433-2 : Removed gtmd and big3d daemon from the FIPS-compliant list
Links to More Info: BT1120433
Component: TMOS
Symptoms:
The gtmd is not able to establish a secure connection to big3d due to failure in handshake because no common ciphers were found between big3d and gtmd in FIPS mode.
Conditions:
-- BIG-IP versions 16.1.2.2 and above
-- FIPS 140-3 license is installed on the BIG-IP or its a FullBoxFIPS device.
-- Connections are established between big3d and gtmd in FIPS mode.
Impact:
SSL handshakes fail between big3d and gtmd because no common ciphers are present.
Workaround:
None
Fix:
Gtmd and big3d can now communicate when FIPS mode is enabled.
Fixed Versions:
17.1.0, 16.1.3.1
1113549-3 : System boots into an inoperative state after installing engineering hotfix with FIPS140-2/140-3 License★
Links to More Info: BT1113549
Component: Local Traffic Manager
Symptoms:
The BIG-IP system persistently starts up in an inoperative state after installing an engineering hotfix with a console error similar to:
*** FIPS or Common Criteria power-up self-test failure.
*** This system has been placed in an error state.
*** To recover return to the grub menu and select another volume
*** or reinstall the system.
***
*** On many devices pressing the escape key followed by the (
*** key will bring up a menu which allows the system to be restarted.
Power-up self-test failures: <number>
Unmounting file systems
System halting.
Conditions:
- First boot after installing an engineering hotfix.
- FIPS 140-2 or FIPS140-3 license.
Impact:
You are unable to boot the BIG-IP system into an operational state after applying an engineering hotfix, and you are required to boot to a known good volume.
For more information, see K52534643: Overview of the Platform FIPS BIG-IP system :: https://support.f5.com/csp/article/K52534643
Workaround:
None
Fix:
The BIG-IP system successfully boots after installing an engineering hotfix on a system with a FIPS 140-2 or FIPS140-3 license.
For a complete solution for BIG-IP software v16.1.3.1 and later v16.1.x releases, you must also have the additional fix described in ID 1137037 https://cdn.f5.com/product/bugtracker/ID1137037.html.
Fixed Versions:
17.1.0, 16.1.3.1
1113385-4 : Expired REST tokens are not getting deleted from /var/run/pamcache on standalone BIG-IP
Links to More Info: BT1113385
Component: TMOS
Symptoms:
REST tokens which are present in /var/run/pamcache on BIG-IP are not deleted after token expiration when there are a large number of tokens.
Conditions:
When a large number of tokens are generated.
Impact:
More memory will be used as /run/pamcache is an in memory filesystem
Workaround:
Try to remove token files from /run/pamcache manually.
You can check what would be deleted by the command below by using -print in place of -delete
# find /run/pamcache -regextype posix-extended -type f -regex '/run/pamcache/[A-Z0-9]{26}' -delete
Fix:
Expired token are removed from /run/pamcache by the BIG-IP system.
Fixed Versions:
17.1.0, 17.0.0.2, 16.1.3.3, 15.1.8.1, 14.1.5.3
1110205-2 : SSL::collect in CLIENTSSL_DATA prevents orderly connection shutdown
Links to More Info: BT1110205
Component: Local Traffic Manager
Symptoms:
If a virtual server has an iRule performing SSL payload processing in CLIENTSSL_DATA, TMM fails to process or forward an ingress TCP FIN from a client, leaving the connection in a zombie state until it eventually idles out.
Conditions:
The issue occurs only when SSL::collect is used in CLIENTSSL_DATA
when CLIENTSSL_DATA {
log local0. "."
SSL::release
SSL::collect
}
Impact:
Unexpected growth in the number of connections idling on a virtual server leads to memory pressure.
Workaround:
None
Fixed Versions:
17.1.0, 16.1.3.1
1109833-1 : HTTP2 monitors not sending request
Links to More Info: BT1109833
Component: Local Traffic Manager
Symptoms:
HTTP2 monitors do not send monitor traffic, incorrectly marking pool members down.
Conditions:
HTTP2 monitor configured.
Impact:
Pool members marked down erroneously.
Workaround:
Use different monitor type, if possible.
Fixed Versions:
17.1.0, 16.1.3.1
1108181-2 : iControl REST call with token fails with 401 Unauthorized
Links to More Info: BT1108181
Component: TMOS
Symptoms:
For a short period after creating or refreshing a token, the iControl REST calls may fail with a 401 Unauthorized error and an HTML body content, or a 401 F5 Authorization Required error and a JSON body content.
When using F5 Ansible modules for BIG-IP, the modules may fail with an error "Expecting value: line 1 column 1 (char 0)".
The AS3 may return an error "AS3 API code: 401".
Conditions:
- REST call using valid token.
- Can commonly occur on the call after a token has been refreshed or a Token list has been requested.
Impact:
The iControl REST calls may temporarily fail (typically less than 1 second) after the creation or refresh of an iControl REST token.
Workaround:
After being issued a token or refreshing a token, wait a second before attempting to use it.
If this does not work, request a new token.
No workaround exists for AS3 or F5 Ansible BIG-IP modules.
Fix:
A race condition on a PAM file update has been resolved. Tokens should remain valid.
Fixed Versions:
17.1.0, 17.0.0.1, 16.1.3, 15.1.6.1, 14.1.5.1
1106989-3 : Certain configuration settings leads to memory accumulation
Component: Local Traffic Manager
Symptoms:
Some specific traffic configurations causing memory consumption.
Conditions:
Profiles attached to Virtual server
Impact:
Memory will get accumulated.
Workaround:
Set udp timeout > 0 on a UDP profile.
Fix:
corrected memory management during packet processing.
Fixed Versions:
17.1.0, 16.1.3.4
1106325 : Upgrade from BIG-IP 16.1.3 to BIG-IP 17.0 does not work when FIPS mode is enabled★
Links to More Info: BT1106325
Component: TMOS
Symptoms:
Upgrade from BIG-IP 16.1.3 to BIG-IP 17.0 does not work when FIPS mode is enabled.
Error displayed in console:
01070911:3: The requested integer (2) is out of range (0 - 1) for fipscipherversion in httpd (/Common/httpd)
Unexpected Error: Loading configuration process failed.
Conditions:
- BIG-IP 16.1.3
- FIPS 140-3 license is installed on BIG-IP 16.1.3 or its a FullBoxFIPS device.
When FIPS 140-3 is enabled in BIG-IP 16.1.3 then the upgrade to version 17.0 will fail.
Impact:
Upgrade from version 16.1.3 to version 17.0 fails when FIPS enabled.
Workaround:
Disable the FIPS 140-3 license and then perform the upgrade.
Fixed Versions:
16.1.3
1104493-1 : Client-side abort during server-side establishment may cause tmm to behave abnormally in HTTP MRF proxy
1104073-2 : Use of iRules command whereis with "isp" or "org" options may cause TCL object leak.
Links to More Info: BT1104073
Component: Local Traffic Manager
Symptoms:
When iRules command whereis is being used with "isp" or "org" options and underlying GEOIP database(s) have not been loaded,
cur_allocs for tcl memory increases over time and does not return to the prior level.
Conditions:
- iRules command whereis is used with "isp" or "org" options
- The underlying GEOIP database(s) have not been loaded
Impact:
Cur_allocs for tcl memory increases over time and does not return to the prior level.
Workaround:
Load the underlying GEOIP database(s) before using "isp" or "org" options of the iRules command whereis.
Fixed Versions:
17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7
1103369-2 : DELETE of REST Auth token does not result in deletion of the pamcache token file on a multi-slot VIPRION chassis, vCMP guest, or VELOS tenant
Links to More Info: BT1103369
Component: TMOS
Symptoms:
The REST tokens are not deleted from cache /var/run/pamcache when the tokens are expired or deleted.
Conditions:
- A large number of REST Auth tokens are created in multi-slot VIPRION, multi-slot vCMP Guest, or multi-slot VELOS tenant.
Impact:
The deleted token continue to be available in the cache.
Memory is consumed as cache is stored in an in-memory filesystem.
Workaround:
Execute the following commands in bash to remove the pamcache directory from the set being acted upon by "csyncd":
# clsh "cp /etc/csyncd.conf /etc/csyncd.conf.$(date +%Y%m%d_%H%M%S)"
# clsh "sed -i '/run\/pamcache/,+2s/^/#/' /etc/csyncd.conf"
# clsh "bigstart restart csyncd"
Also, clear any stale content either by rebooting or deleting the tokens.
Remove token files from /run/pamcache manually.
Execute the following command by using -print instead of -delete to verify the tokens to be deleted (recommended to not use clsh):
# clsh "find /run/pamcache -regextype posix-extended -type f -regex '/run/pamcache/[A-Z0-9]{26}' -delete"
Fix:
Auth tokens in /run/pamcache are deleted as required.
Fixed Versions:
17.1.0, 17.0.0.2, 16.1.3.3, 15.1.8.1, 14.1.5.3
1103233-2 : Diameter in-tmm monitor is logging disconnect events unnecessarily
Links to More Info: BT1103233
Component: Service Provider
Symptoms:
Errors are logged to /var/log/ltm:
err tmm[20104]: 01cc0006:3: Peer (<peer>) connection state has changed: disconnected
Conditions:
A diameter in-tmm monitor is configured
Impact:
Debug logs are logged at the error level.
Workaround:
None
Fix:
Log level has been changed to the debug level for the peer disconnected log.
Fixed Versions:
17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7
1101705-2 : RSA-KEX ciphers list are removed from httpd configuration in FIPS mode since these are non-approved ciphers for FIPS 140-3 certification
Links to More Info: BT1101705
Component: TMOS
Symptoms:
- RSA-KEX ciphers list are removed from httpd configuration when FIPS mode is enabled since these are non-approved ciphers for FIPS 140-3 certification.
- Mandatory fix for FIPS 140-3 Certification.
Conditions:
- BIG-IP versions 16.1.3 and above.
- Applies to systems requiring FIPS 140-3 Certification.
- FIPS 140-3 license is installed on BIG-IP or its a FullBoxFIPS device.
- https connections are established using the RSA-KEX based ciphers
Impact:
- BIG-IP systems running without this fix on a release targeted for certification (BIG-IP 16.1.x or later) will not be running a FIPS 140-3 certified configuration.
- https connection using RSA KEX ciphers will not be successful when FIPS 140-3 license is installed in the device.
Workaround:
None
Fix:
Apply this fix to ensure that the system is compliant with FIPS 140-3 Certification.
Fixed Versions:
17.1.0, 17.0.0.1, 16.1.3
1100609 : Length Mismatch in DNS/DHCP IPv6 address in logs and pcap
Links to More Info: BT1100609
Component: TMOS
Symptoms:
The wrong length is shown in logs for DNS/DHCP IPv6 addresses.
Conditions:
-- DNS/DHCP IPv6 configured in IKE-PEER configuration.
-- The tunnel is established.
Impact:
The length is reported incorrectly in the logs. It is reported as 15 when it should be reported as 16.
Workaround:
None
Fix:
Fix the logs.
Fixed Versions:
17.1.0, 16.1.3
1097821-2 : Unable to create apm policy customization image using tmsh or VPE in the configuration utility command when source-path is specified
Links to More Info: BT1097821
Component: Access Policy Manager
Symptoms:
Creating an APM policy image file with source_path attribute fails.
Conditions:
APM provisioned
Impact:
You are unable to use the source_path attribute for creating APM customization image files.
Workaround:
Copy the image file to one of the directories of /var/config/rest/, /var/tmp/, /shared/tmp/ and use local_path instead of source_path.
E.g. create apm policy image-file test.jpg local-path /var/tmp/<file name>
Fixed Versions:
17.1.0, 17.0.0.1, 16.1.3, 15.1.6.1, 14.1.5
1097193-2 : Unable to SCP files using WinSCP or relative path name
Links to More Info: BT1097193
Component: TMOS
Symptoms:
When attempting to retrieve a file with WinSCP, you receive an error dialog and the session will be terminated:
"SCP Protocol error: Invalid control record (r; elative addresses not allowed)
Copying files from remote side failed."
If attempting to transfer a file by relative path with a command line utility the transfer will fail with the message:
"relative addresses not allowed"
Conditions:
-- Running BIG-IP version with fix for ID 915981
-- Using WinSCP set to use SCP protocol to retrieve files from a BIG-IP system.
-- Using a relative remote path to transfer a file with command line scp utility.
Impact:
No longer able to use WinSCP to retrieve files such as packet captures, log archives, or other diagnostic data from the BIG-IP system.
Workaround:
Use a command line SCP tool that allows specifying an absolute path for the source and/or destination file (a path that starts with a forward slash /), when the source and/or destination locations are a BIG-IP device.
If the user ID is permitted to do so, you may use WinSCP in SFTP mode.
Fixed Versions:
17.1.0, 16.1.3.1
1096373-2 : Unexpected parameter handling in BIG3d
Component: Global Traffic Manager (DNS)
Symptoms:
The iQuery listener does not handler certain parameters received correctly.
Conditions:
Messages sent to the iQuery listener.
Impact:
Unexpected behavior.
Workaround:
If the IP addresses or subnets of trusted mesh members are known, then mesh communication security can be improved by creating a network-specific packet filter or by adding management interface firewall rules, depending on the situation.
Fix:
Parameters are handled as expected.
Fixed Versions:
16.1.3.4
1094177-4 : Analytics iApp installation fails
Links to More Info: BT1094177
Component: iApp Technology
Symptoms:
By default restjavad.disablerpmtasks value is true. This causes iApp RPM installation to be blocked.
Conditions:
Analytics iApp RPM installation
Impact:
The RPM installation fails with an error "403, Protocol Exception".
Workaround:
Change the restjavad.disablerpmtasks sys db variable to false, and then restart restjavad:
tmsh modify sys db restjavad.disablerpmtasks value false
To restart restjavad on a VIPRION or multi-bladed vCMP guest or multi-bladed F5OS tenant:
clsh tmsh restart sys service restjavad
To restart restjavad on an appliance or single-slot vCMP guest or F5OS tenant:
tmsh restart sys service restjavad
NOTE: This will require a cluster sync for any device groups configured for manual config sync. All updated systems will require a restart of restjavad for the change to take affect.
After restjavad restarts on all affected devices, you can perform the iApp installation.
Fix:
By default, the sys db variable restjavad.disablerpmtasks should be "false". When appliance mode is enabled, this DB key is forced to "true".
Fixed Versions:
17.0.0, 16.1.3, 15.1.6.1, 14.1.5.1
1093621-2 : Some SIP traffic patterns over TCP may cause resource exhaustion on BIG-IP
Links to More Info: K10347453
1091761-1 : Mqtt_message memory leaks when iRules are used
Links to More Info: BT1091761
Component: Local Traffic Manager
Symptoms:
Mqtt_message memory leaks when iRules like insert_after, insert_before, and respond are used.
Conditions:
Basic mqtt virtual server with any of the below rules ->insert_after
>insert_before
>respond
Impact:
Memory leak occurs and TMM may crash
Workaround:
NA
Fix:
There is no longer a memory leak with iRules usage
Fixed Versions:
17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7, 14.1.5.1
1091565-1 : Gy CCR AVP:Requested-Service-Unit is misformatted/NULL
Links to More Info: BT1091565
Component: Policy Enforcement Manager
Symptoms:
Observed diameter protocol warning when Requested Service Unit(RSU) is empty for CCR-I and CCR-U requests.
Conditions:
If the 'Initial Quota' is EMPTY in policy under Policy Enforcement ›› Rating Groups, the BIG-IP system reports empty data in AVP: Requested-Service-Unit.
Impact:
In Wireshark, a protocol warning occurs.
Workaround:
None
Fix:
If the Initial PEM Quota values are EMPTY/0 We are updating the RSU values to Zero.
Fixed Versions:
17.1.0, 16.1.3.1
1091345-2 : The /root/.bash_history file is not carried forward by default during installations.
Links to More Info: BT1091345
Component: TMOS
Symptoms:
By default, the /root/.bash_history file is not included in the UCS archives. As such, this file is not rolled forward during a software installation.
Conditions:
Performing a BIG-IP software installation.
Impact:
This issue may hinder the efforts of F5 Support should the need to determine what was done prior to a software installation arise.
Workaround:
None
Fixed Versions:
17.1.0, 17.0.0.1, 16.1.3.1, 15.1.6.1, 14.1.5.1
1091249-2 : BIG-IP DNS and Link Controller systems may use an incorrect IPv6 translation address.
Links to More Info: BT1091249
Component: Global Traffic Manager (DNS)
Symptoms:
As BIG-IP DNS and Link Controller systems connect with one another (or with monitored BIG-IP systems) over iQuery, you may notice:
-- Log messages that specify IPv6 translation addresses non-existent in your configuration and often meaningless (as in not pertaining to some of the more common IPv6 address spaces). For example:
debug gtmd[24229]: 011ae01e:7: Creating new socket to connect to 2001::1 (a06d:3d70:fd7f:0:109c:7000::)
-- If you restart the gtmd daemon, the IPv6 translation address mentioned above between parenthesis changes to a new, random meaningless value.
-- The GTM portion of the configuration fails to synchronize.
Conditions:
IPv6 translation addresses are in use in relevant objects.
Impact:
The logs are misleading and the GTM portion of the configuration may fail to synchronize.
Workaround:
If possible, do not use IPv6 translation addresses.
Fix:
IPv6 translation addresses now function as designed.
Fixed Versions:
17.1.0, 17.0.0.1, 16.1.3.1, 15.1.6.1, 14.1.5.1
1090649-3 : PEM errors when configuring IPv6 flow filter via GUI
Links to More Info: BT1090649
Component: Policy Enforcement Manager
Symptoms:
An error occurs while configuring an IPv6 flow filter using the GUI:
0107174e:3: The source address (::) and source netmask (0.0.0.0) addresses for pem flow info filter (filter0) must be be the same type (IPv4 or IPv6).
Conditions:
Configuring an IPv6 flow filter using the GUI
Impact:
You are unable to configure the IPv6 flow filter via the GUI
Workaround:
The error does not occur when using tmsh.
Fix:
Modified the IPv6 Validation. Able to create IPV6 flow filter after the fix
Fixed Versions:
17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7, 14.1.5.1
1090569-1 : After enabling a TLS virtual server, TMM crashes with SIGFPE and 1 hour later with SIGSEGV
Links to More Info: BT1090569
Component: TMOS
Symptoms:
Some SSL handshakes are fail when using the CRL certificate validator and tmm crashes.
Conditions:
-- TLS virtual server
-- The virtual server passes network traffic
Impact:
Traffic disrupted while tmm restarts.
Workaround:
None
Fix:
Fixed a tmm crash related to the CRL certificate validator.
Fixed Versions:
17.1.0, 17.0.0.1, 16.1.3.1, 15.1.6.1
1089849 : NIST SP800-90B compliance
Links to More Info: BT1089849
Component: TMOS
Symptoms:
Common Criteria and FIPS 140-3 certifications require compliance with NIST SP800-90B; this completes that compliance.
Conditions:
This applies to systems requiring Common Criteria and/or FIPS 140-3 compliance.
Impact:
BIG-IP systems running without this fix on a release targeted for certification (BIG-IP 16.1.x or later) will not be using a Common Criteria and/or FIPS 140-3 certified configuration.
Workaround:
None
Fix:
Apply this fix to ensure that the system is compliant with NIST SP800-90B.
Fixed Versions:
17.1.0, 17.0.0.1, 16.1.3
1087621-1 : IKEv2: IPsec CREATE_CHILD_SA (IKE) fails due to bad ECP payload
Links to More Info: BT1087621
Component: TMOS
Symptoms:
The tunnel stops working after initially starting with no problem.
The BIG-IP will send a bad KE (Key Exchange) Payload when rekeying the IKE SA with ECP.
Conditions:
-- IKEv2
-- ECP PFS
-- Peer attempts to re-key IKE SA (CREATE_CHILD SA) over existing IKE SA.
Impact:
IPsec tunnels stop working for periods of time.
Workaround:
Do not use ECP for PFS.
Fix:
ECP will work correctly when rekeying.
Fixed Versions:
17.1.0, 17.0.0.1, 16.1.3.1, 15.1.6.1
1087469-2 : iRules are not triggered when an SSL client connects to a BIG-IP system using an empty certificate.
Links to More Info: BT1087469
Component: Local Traffic Manager
Symptoms:
When an SSL client connects to BIG-IP system and sends an empty certificate, the CLIENTSSL_CLIENTCERT is not triggered for iRules.
Conditions:
- Virtual server configured on BIG-IP with a clientssl profile
- Client authentication on the virtual server is set to "request"
- iRule relying on CLIENTSSL_CLIENTCERT
- A client connects to BIG-IP using an empty certificate
Impact:
CLIENTSSL_CLIENTCERT irules aren't triggered.
Workaround:
None
Fix:
CLIENTSSL_CLIENTCERT irules are now triggered when receiving empty certificates.
Fixed Versions:
17.1.0, 16.1.3.1, 15.1.6.1
1087217-2 : TMM crash as part of the fix made for ID912209
Links to More Info: BT1087217
Component: Local Traffic Manager
Symptoms:
TMM crashes.
Conditions:
BIG-IP versions 16.1.0 or later which includes the fix of ID912209.
Impact:
Traffic disrupted while tmm restarts.
Workaround:
None
Fixed Versions:
17.1.0, 16.1.3.1
1086897-1 : PEM subcriber lookup can fail for internet side/subscriber side new connections
Links to More Info: BT1086897
Component: Policy Enforcement Manager
Symptoms:
PEM subscriber lookup can fail for internet/subscriber side flow for new connections, as PEM uses the local address to look up the session, which is not the subscriber.
Conditions:
-- PEM enabled and configured
-- Subscriber session has multiple IP's
-- Each IP lands on a different TMM
Impact:
PEM subscriber lookup can fail on the internet side or subscriber side
Workaround:
None
Fix:
PEM subscriber lookup now always succeeds for internet side and subscriber side new connections,
Fixed Versions:
17.0.0, 16.1.2.2
1086677-4 : TMM Crashes in xvprintf() because of NULL Flow Key
Links to More Info: BT1086677
Component: Local Traffic Manager
Symptoms:
TMM crashes while passing traffic
Conditions:
This was observed during internal testing and occurred while making configuration changes while passing traffic.
Impact:
Traffic disrupted while tmm restarts.
Workaround:
None
Fix:
Fixed a tmm crash.
Fixed Versions:
17.0.0, 16.1.3.1, 15.1.7
1084993 : [PEM][Gy] e2e ID/h2h ID in RAR / RAA Not Matching
Links to More Info: BT1084993
Component: Policy Enforcement Manager
Symptoms:
E2e id and h2h id in Re-Authorisation Answer from PEM to OCS is not matching with Re-Authorisation Request from OCS to PEM.
Conditions:
Diameter-endpoint configuration. PCEF(PEM) communicating over gy interface with OCS for quota information.
Impact:
OCS will not be able to determine for which RAR it got RAA. This is catastrophic for billing.
Workaround:
None
Fix:
There was conversion issue in PEM, fixed it.
Fixed Versions:
17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7
1084673-2 : GTM Monitor "require M from N" status change log message does not print pool name
Links to More Info: BT1084673
Component: Global Traffic Manager (DNS)
Symptoms:
The number of probes that are succeeding is changing in between different windows in which the "N" number of probes were sent.
Conditions:
- GTM/DNS is provisioned
- A "require M from N" monitor rule is assigned to a gtm pool or an individual gtm pool member.
Impact:
The log written to provide information on the changing number of successful probes does not contain information about the pool member.
Workaround:
None
Fixed Versions:
17.1.0, 17.0.0.1, 16.1.3.1, 15.1.6.1, 14.1.5.1
1084173-1 : Unable to specify "no caching desired" for ephemeral DNS resolvers (i.e. RESOLV::lookup).
Links to More Info: BT1084173
Component: Global Traffic Manager (DNS)
Symptoms:
Each time the iRule command RESOLV::lookup is invoked with a different target IP address or internal virtual server, a unique resolver context is created.
However, for performance and memory preservation reasons, all ephemeral resolvers are backed by the same set of DNS caches.
This means that repeated identical queries to different ephemeral resolvers will always return the answer from the cache that was retrieved by the first ephemeral resolver (until the TTL of the record expires).
While this is fine in the traditional use of DNS, this may be problematic in certain specific use-cases. For example, this does not allow for per-user DNS servers to return different results for the same query. This technique could be used by an iRule to retrieve user-specific information to then spin up user-unique virtual environments.
Conditions:
Sending repeated queries for the same FQDN to different ephemeral resolvers (before the TTL expires) and expecting different results back.
Impact:
Inability to support specific use-cases in a BIG-IP iRule.
Fix:
Versions with the fix include a new DB key called dnscache.ephemeralsnocache, which defaults to "disable".
When set to "disable", the system behaves exactly as in previous releases.
When set to "enable", ephemeral resolvers spawned in an iRule by the RESOLV::lookup command no longer cache anything, thus allowing for use-cases similar to the example mentioned under Symptoms.
Fixed Versions:
17.0.0, 16.1.3, 15.1.6.1
1083989-1 : TMM may restart if abort arrives during MBLB iRule execution
Links to More Info: BT1083989
Component: Local Traffic Manager
Symptoms:
"Unallocated flow while polling for rule work. Skipping." is logged in /var/log/ltm.
*or*
"flow in use" assert fails causing TMM to restart.
Conditions:
- Virtual using MBLB proxy.
- iRule with LB_SELECTED, CLIENT_CLOSED, and SERVER_CLOSED events.
- client connection is aborted while LB_SELECTED is queued for execution.
Impact:
TMM may restart unexpectedly.
Workaround:
Remove LB_SELECTED event from the iRule, if feasible.
Fix:
The MBLB proxy now correctly handles being aborted when it has iRule events queued for execution.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5
1083977-1 : MCPD crashes when changing HTTPD configuration, all secondary blades of clustered system remain offline★
Links to More Info: BT1083977
Component: TMOS
Symptoms:
Making a configuration change to the HTTPD configuration causes MCPD to hang for five minutes, and then MCPD crashes and restarts.
On a multi-slot VIPRION, vCMP guest, or BIG-IP tenant, after upgrading to an affected version, all secondary blades may remain in an offline state.
Conditions:
Making a configuration change to the management HTTPD configuration.
Impact:
System goes offline and services restart.
On a VIPRION chassis, all secondary blades remain offline.
Workaround:
None
Fix:
The system remains stable when modifying the HTTPD configuration.
Fixed Versions:
17.0.0, 16.1.3
1083913-2 : Missing error check in ICAP handling
Links to More Info: BT1083913
Component: Application Security Manager
Symptoms:
Bd crashes.
Conditions:
Asm policy is configured for ICAP integration
Impact:
Traffic disrupted while bd restarts.
Workaround:
None
Fixed Versions:
17.1.0, 16.1.3.1, 15.1.6.1, 14.1.5.1
1083537 : FIPS 140-3 Certification
Links to More Info: BT1083537
Component: TMOS
Symptoms:
For FIPS 140-3 Certification
Conditions:
This applies to systems requiring FIPS 140-3 Certification.
Impact:
BIG-IP systems running without this fix on a release targeted for certification (BIG-IP 16.1.x or later) will not be running a FIPS 140-3 certified configuration.
Workaround:
None
Fix:
Apply this fix to ensure that the system is compliant with FIPS 140-3 Certification.
Fixed Versions:
17.1.0, 17.0.0.1, 16.1.2.2
1082885-1 : MR::message route virtual asserts when configuration changes during ongoing traffic
Links to More Info: BT1082885
Component: Service Provider
Symptoms:
MR::message route virtual causes TMM to crash / panic when the configuration changes during ongoing traffic. This is due to
an invalid validation of the TYPEIDs when mis-matched virtual servers / proxies are identified because of the configuration change.
Conditions:
A BIG-IP configuration change is made while passing traffic.
Impact:
Traffic disrupted while tmm restarts.
Fix:
With the fix, proper validation of the Proxy TYPEIDs will make the server to gracefully close the connection when PROXIES TYPEIDs mismatch is detected and a relevant error log is printed in the ltm logs as well.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6, 14.1.5
1082505 : TLS ciphersuites including RSA-KEX are non-approved ciphers for FIPS 140-3 certification
Links to More Info: BT1082505
Component: Local Traffic Manager
Symptoms:
TLS ciphersuites including RSA KEX are non-approved ciphers as per FIPS 140-3 certification standard
Conditions:
- BIG-IP versions 16.1.3 and above
- FIPS 140-3 license is installed on BIG-IP or its a FullBoxFIPS device.
- f5-fips cipher-group is associated with SSL profiles
- Connections are established using the RSA-KEX based ciphers
Impact:
SSL handshake will not be successful.
Workaround:
Create a custom cipher-group including all the required cipher strings and associate with the SSL profiles.
Fix:
For FIPS 140-3 certification, TLS ciphersuites including RSA-KEX are reported as non-approved ciphers in fips mode, also these cipher strings have been removed from the f5-fips cipher group.
Fixed Versions:
17.1.0, 17.0.0.1, 16.1.3
1082461-2 : The enforcer cores during a call to 'ASM::raise' from an active iRule
Links to More Info: BT1082461
Component: Application Security Manager
Symptoms:
In the case of 'ASM::raise' call execution from an iRule that contains a list length greater than 100, the enforcer (bd) will core.
Conditions:
A call to 'ASM::raise' with a list length greater than 100 from an iRule.
Impact:
Traffic disrupted while bd restarts.
Workaround:
While constructing the iRule, make sure that the list passed into 'ASM::raise' contains fewer than 100 elements.
Fix:
Fixed an enforcer core.
Fixed Versions:
17.1.0, 17.0.0.1, 16.1.3.1, 15.1.6.1
1082225-4 : Tmm may core while Adding/modifying traffic-class attached to a virtual server.
Links to More Info: BT1082225
Component: Local Traffic Manager
Symptoms:
Tmm may core with 'tmm SIGSEGV' while performing addition/updating of traffic class attached to a virtual server.
Conditions:
-- Some Traffic classes have been removed from the virtual server.
-- A new traffic class is attached to the virtual server, or modification of the existing traffic class is triggered.
Impact:
Traffic disrupted while tmm restarts.
The traffic class might not be applied as expected.
Workaround:
None
Fixed Versions:
17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7, 14.1.5.1
1080581-1 : Virtual server creation is not allowed to have TCP, UDP and HTTP together with Client or Server SSL Profiles.★
Links to More Info: BT1080581
Component: Local Traffic Manager
Symptoms:
During the upgrade, the configuration load fails with an error:
err mcpd[6381]: 01070734:3: Configuration error: A virtual server (/Common/my_virtual) is not allowed to have TCP, UDP and HTTP together with Client or Server SSL Profiles.
Conditions:
-- Upgrading from an earlier version that contains a QUIC profile in a virtual server having tcp, UDP, and HTTP together
-- Upgrading to version 15.1.5 or 16.1.2.2
Impact:
BIG-IP will remain in inoperative state after upgrade
Fix:
QUIC protocol is allowed to use tcp and udp protocol in combination
Fixed Versions:
17.0.0, 16.1.3.1, 15.1.5.1
1080341-4 : Changing an L2-forward virtual to any other virtual type might not update the configuration.
Links to More Info: BT1080341
Component: Local Traffic Manager
Symptoms:
Changing an L2-forward virtual-server to any other virtual-server type might not update the saved configuration.
Conditions:
Changing an L2-forward virtual-server to any other virtual-server type.
Impact:
Traffic still behaves as if L2-forward virtual-server is configured.
Workaround:
Remove and re-create the affected virtual-server.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5
1080317-3 : Hostname is getting truncated on some logs that are sourced from TMM
Links to More Info: BT1080317
Component: TMOS
Symptoms:
Hostnames in the APM, IPSEC, SAAS, FW_LOG logs that are sourced from TMM are truncated.
Conditions:
The truncation occurs when the hostname contains a period (for example "my.hostname").
Impact:
Some logs contain truncated hostnames and some contain full hostnames. The inconsistent hostnames degrade the readability and therefore the usefulness of the logs.
Fixed Versions:
17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7, 14.1.5.1
1079909-1 : The bd generates a core file
Links to More Info: K82724554, BT1079909
Component: Application Security Manager
Symptoms:
The bd generates a core file and restarts.
Conditions:
- ASM running on BIG-IP version 15.1.5.1 or 15.1.6. Other versions are not affected.
- Content profile is configured to check attack signatures.
Impact:
Traffic is disrupted while bd restarts.
Workaround:
Set the internal parameter disable_second_extra_normalization to 1 and restart ASM by executing:
/usr/share/ts/bin/add_del_internal add disable_second_extra_normalization 1
bigstart restart asm
Note: This relaxes matching of attack signatures for some cases.
Fix:
Fixed a bd crash. As mentioned in Conditions field, there are only two official software versions, version 15.1.5.1 and version 15.1.6, that are affected by this bug. This bug was fixed on other major release branches (17.0.x, 16.1.x, 14.1.x, and 13.1.x) before publishing any affected versions to the field, thus this bug appears as fixed with those major releases, but there are actually no affected official versions.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1, 14.1.4.6, 13.1.5
1079817-1 : Java null pointer exception when saving UCS with iAppsLX installed★
Links to More Info: BT1079817
Component: TMOS
Symptoms:
When saving a UCS the resulting archive does not contain iAppLX packages. This is because the POST to /shared/iapp/build-package gets a 400 error from restjavad.
The restjavad log files will show a null pointer exception when this occurs.
Conditions:
Saving UCS file when iAppLX packages are installed.
Impact:
When saving a UCS the resulting archive does not contain iAppLX packages.
Workaround:
None
Fix:
The RPM build completes successfully.
Fixed Versions:
17.0.0, 16.1.3, 15.1.6.1, 14.1.5.1
1079721 : OWASP 2017 A2 Category - Login enforcement link is broken
Links to More Info: BT1079721
Component: Application Security Manager
Symptoms:
Under A2 category, Broken Authentication: ‘Login Enforcement: Not fulfilled’ - if you click on the Not fulfilled link you end up with a broken link
Conditions:
1. Go to OWASP page (Security ›› Overview : OWASP Compliance)
2. Collapse Broken Authentication field
3. Click on Login Enforcement protection state link (Fulfilled or Not Fulfilled).
Impact:
Link is broken, and need to go manually to login enforcement tab in Policy Configuration page
Workaround:
Go to the related policy configuration page, click on Session and Logins tab. You will see there the Login Pages section.
Fixed Versions:
16.1.3.1
1079637-1 : Incorrect Neuron rule order
Links to More Info: BT1079637
Component: Advanced Firewall Manager
Symptoms:
The order of Neuron rules created for the virtual servers may be incorrect.
Conditions:
- Platforms with Neuron support (BIG-IP iSeries and Viprion B4450 blade) configured with a Turboflex profile other than turboflex-base.
Impact:
There are several features that rely on the Neuron rules.
In case of hardware SYN Cookie a TCP virtual server may not receive the TCP SYN packets even if the virtual server is not in SYN Cookie mode.
Some sPVA feature may behave unexpectedly.
Fix:
The order of the Neuron rules is now correct.
Fixed Versions:
17.0.0, 16.1.3, 15.1.5.1
1078821-1 : Upgrade tomcat with OpenJDK 1.7 32bit to OpenJDK 1.8 32bit
Links to More Info: BT1078821
Component: TMOS
Symptoms:
TMUI (the GUI) needs to be upgraded with OpenJDK 1.8 to support TLS 1.2 AES GCM ciphers for OAuth Provider Discovery
Conditions:
BIG-IP systems using the GUI
Impact:
Deployments which use Microsoft Azure AD as OAuth IDP, will start facing issues with OAuth Provider discovery after 31st Jan 2022. Microsoft is deprecating TLS1.0/1.1 and supporting TLS1.2 AES GCM ciphers only.
Fix:
Upgrade tomcat with OpenJDK 1.7 32bit to OpenJDK 1.8 32bit
Note: This results in an increase in the size of /usr. Although not an issue on its own, cumulative increases in /var, /usr, and /root might result in installation failures on iSeries devices when multiple slots contain software versions 16.1.x or later. Depending on the combination of versions, you might not be able to install/upgrade three TMOS software volumes on your iSeries device (see K41812306: The appdata volume on BIG-IP iSeries platforms is now larger :: https://support.f5.com/csp/article/K41812306 ).
Behavior Change:
Upgrade tomcat with OpenJDK 1.7 32bit to OpenJDK 1.8 32bit
Note: This results in an increase in the size of /usr. Although not an issue on its own, cumulative increases in /var, /usr, and /root might result in installation failures on iSeries devices when multiple slots contain software versions 16.1.x or later. Depending on the combination of versions, you might not be able to install/upgrade three TMOS software volumes on your iSeries device (see K41812306: The appdata volume on BIG-IP iSeries platforms is now larger :: https://support.f5.com/csp/article/K41812306 ).
Fixed Versions:
17.0.0, 16.1.3, 15.1.6.1, 14.1.5
1078765-1 : Arcsight remote log with 200004390,200004389 signatures in the request may crash the enforcer.
Links to More Info: BT1078765
Component: Application Security Manager
Symptoms:
A BD core may occur due to enforcement of 200004390 200004389 signatures with the combination of Arcsight remote logger enabled.
Conditions:
The request must contain 200004390 200004389 signatures with the combination of Arcsight remote logger attached to the virtual server.
Impact:
The enforcer may crash.
Workaround:
Disable 200004390 200004389 signatures.
Fix:
200004390 200004389 are now signatures enforced successfully.
Fixed Versions:
17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7
1078669-2 : iRule command “RESOLVER::name_lookup” returns null for TCP resolver with TC (truncated) flag set.
Links to More Info: BT1078669
Component: Global Traffic Manager (DNS)
Symptoms:
“RESOLVER::name_lookup” returns null for TCP resolver with TC set.
Conditions:
Backend server returns very large DNS response.
Impact:
iRule command does not give any response but with TC set.
Workaround:
N/A
Fix:
N/A
Fixed Versions:
17.0.0, 16.1.3.1, 15.1.7
1077701-1 : GTM "require M from N" monitor rules do not report when the number of "up" responses change
Links to More Info: BT1077701
Component: Global Traffic Manager (DNS)
Symptoms:
The number of probes that are succeeding is changing in between different windows in which the "N" number of probes were sent.
Conditions:
- GTM/DNS is provisioned.
- A "require M from N" monitor rule is assigned to a gtm resource.
Impact:
The change in the number of successful monitor probes isn't available which is useful for troubleshooting.
Workaround:
None
Fix:
A logline is written to show the change in the number of successful probes.
Fixed Versions:
17.0.0, 16.1.3.1, 15.1.6.1, 14.1.5.1
1077281-2 : Import xml policy fails with “Malformed xml” error when session awareness configuration contains login pages
Links to More Info: BT1077281
Component: Application Security Manager
Symptoms:
When a policy contains an individual login page in session tracking, the exported xml policy fails to be imported back due to error “Malformed XML: Could not resolve foreign key dependence”.
Conditions:
The policy contains an individual login page in session tracking and the policy is exported in xml format
Impact:
Import the policy fails with an error: "Could not resolve foreign key dependence”.
Workaround:
This occurs when using XML format only, so you can use binary export/import
Fix:
XML export/import now will work also if policy contains an individual login page in session tracking
Fixed Versions:
17.1.0, 16.1.2.2, 15.1.6.1
1076921-1 : Hostname in BootMarker logs and /var/log/ltm logs that are sourced from TMM are getting truncated
Links to More Info: BT1076921
Component: TMOS
Symptoms:
1. BootMarker logs in all the log files are getting truncated.
2. LTM logs that are getting sourced from TMM are getting truncated.
Conditions:
-- Hostname contains a period.
-- Check Hostname in BootMarker logs and /var/log/ltm in which the logs sourced from TMM get truncated.
Impact:
Logs are not in useful state. Some logs contain truncated hostnames and some contain full hostnames.
Fixed Versions:
17.0.0, 16.1.3.1, 15.1.6.1, 14.1.5.1
1076401-5 : Memory leak in TMM (ldns) when exceeding dnssec.maxnsec3persec.
Links to More Info: BT1076401
Component: Global Traffic Manager (DNS)
Symptoms:
Memory leak leading to TMM running out of free memory.
Conditions:
-- Dnssec.maxnsec3persec set to non-default value (default 0 - unlimited).
-- Number of DNS requests leading to NSEC3 responses goes above the limit of dnssec.maxnsec3persec.
Impact:
TMM runs out of memory.
Workaround:
Set dnssec.maxnsec3persec to 0.
Fix:
N/A
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5
1076377-3 : OSPF path calculation for IA and E routes is incorrect.
Links to More Info: BT1076377
Component: TMOS
Symptoms:
--OSPF path calculation for IA and E routes is incorrect.
--E2 route might be preferred over E1 route.
--Cost calculation for IA routes is incorrect.
Conditions:
Mixing E2/E1 routes and IA routes with different cost.
Impact:
Wrong route is installed.
Workaround:
N/A
Fix:
N/A
Fixed Versions:
17.0.0, 16.1.2.2
1075205-1 : Using TCP::close after HTTP::redirect/HTTP::respond causes HTTP response not to be delivered to the client.
Links to More Info: BT1075205
Component: Local Traffic Manager
Symptoms:
Using TCP::close after HTTP::redirect/HTTP::respond causes HTTP response not to be delivered to the client.
Conditions:
iRule similar to:
ltm rule REDIRECT {
when HTTP_REQUEST {
HTTP::redirect "https://[HTTP::host][HTTP::uri]"
TCP::close
}
Impact:
Redirect/response not delivered to the client.
Workaround:
Remove TCP::close from an iRule.
Fix:
N/A
Fixed Versions:
17.0.0, 16.1.2.2
1074517-1 : Tmm may core while adding/modifying traffic-class attached to a virtual server
Links to More Info: BT1074517
Component: Local Traffic Manager
Symptoms:
Tmm may core while adding/modifying traffic-class attached to a virtual server
Conditions:
-- Traffic class is attached to a virtual server.
-- Add an existing traffic class to a virtual server.
-- Afterwards, a new traffic class is attached to the virtual server, or modification of the existing traffic class is triggered.
Impact:
Traffic disrupted while tmm restarts.
Workaround:
None
Fixed Versions:
17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7, 14.1.5.1
1074113-1 : IPsec IKEv2: Selectors incorrectly marked up after disable ike-peer
Links to More Info: BT1074113
Component: TMOS
Symptoms:
When disabling an ike-peer, sometimes the traffic-selector is not marked "down" in one or both directions.
Conditions:
All the following must be true
-- IKEv2 IPsec tunnel
-- A nonzero value for ipsec.pfkey.load, ipsec.sp.migrate and ipsec.sp.owner is set.
-- During the life of the SA the tunnel was migrated to another tmm owner.
The final point is not normally visible unless debug2 logging is enabled on ike-daemon.
Impact:
Cosmetic. The traffic selector is incorrectly reported as up for one or both directions.
Workaround:
The selector state cannot be changed unless it goes up/down again. There is no way to manually fix it.
Fix:
Disabling an ike-peer config object will correctly mark the associated traffic-selector down.
Fixed Versions:
17.0.0, 16.1.2.2
1073973-1 : Gateway HTTP/2, response payload intermittently not forwarded to client.
Links to More Info: BT1073973
Component: Local Traffic Manager
Symptoms:
Some HTTP/2 requests through a Gateway HTTP2 (HTTP2 clientside/HTTP1 serverside, no MRF) stall, with:
- the BIG-IP receives a request and forwards it to the server
- the server responds with both headers and response body
- the BIG-IP forwards the response headers back to the client
- the BIG-IP does not forward the response body to the client
Conditions:
-- BIG-IP virtual server configured with an HTTP/2 profile on both the client side and server side
-- A high number of HTTP/2 requests traverse the HTTP/2 connection
Impact:
HTTP response body is not forwarded to the client from the BIG-IP system.
Workaround:
N/A
Fix:
N/A
Fixed Versions:
17.0.0, 16.1.2.2
1073625-2 : Peer (standby) unit's policies after autosync show a need for Apply Policy when the imported policy has learning enabled.
Links to More Info: BT1073625
Component: Application Security Manager
Symptoms:
ASM policy import is successful on Active unit and it syncs to standby device, but "Apply changes" is displayed on the standby device policies page.
Conditions:
1. XML policy with learning enabled imported via TMSH.
2. Autosync with incremental sync enabled on device-group with ASM sync enabled.
Impact:
The peer (standby) unit needs to have the policies applied manually even though everything is set to auto-sync
Workaround:
N/A
Fix:
N/A
Fixed Versions:
17.1.0, 17.0.0.1, 16.1.3.1, 15.1.6.1, 14.1.5.1
1073609-4 : Tmm may core while using reject iRule command in LB_SELECTED event.
Links to More Info: BT1073609
Component: Local Traffic Manager
Symptoms:
Tmm cores with SIGFPE "packet is locked by a driver"
Conditions:
-- Fastl4 virtual server
-- iRule attached that uses reject iRule command in LB_SELECTED event
Impact:
Traffic disrupted while tmm restarts.
Fix:
Tmm does not core while using iRules attached that uses reject iRule command in LB_SELECTED event.
Fixed Versions:
17.0.0, 16.1.3.1, 15.1.6.1, 14.1.5.1
1072953-2 : Memory leak in traffic management interface.
Links to More Info: BT1072953
Component: Local Traffic Manager
Symptoms:
When configuration objects that use a traffic management interface are modified, they leave behind orphaned objects. The memory leak can become significant over time if there are frequent config changes.
Conditions:
Request logging profile attached to a VIP.
Impact:
TMM uses more memory than it should.
Workaround:
Restart tmm to free the memory, avoid making frequent configuration changes to virtual servers that contain request logging profiles.
Fix:
Traffic management interface no longer leaks memory.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5
1072733-4 : Protocol Inspection IM package hardening
Component: Protocol Inspection
Symptoms:
Protocol Inspection IM packages do not follow current best practices.
Conditions:
- Authenticated administrative user
- Protocol Inspection IM packages uploaded to BIG-IP
Impact:
Protocol Inspection IM packages do not follow current best practices.
Workaround:
N/A
Fix:
Protocol Inspection IM packages now follows current best practices.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5
1072237-1 : Retrieval of policy action stats causes memory leak
Links to More Info: BT1072237
Component: TMOS
Symptoms:
When a virtual server with an L7 policy is present, the tmsh show ltm policy command triggers a memory leak.
Conditions:
The tmsh show ltm policy command is executed when a virtual server with an L7 policy attached is present.
one more condition -
Retrieving the ltm policy statistics will cause the umem_alloc_16 memory leak
Impact:
Memory leak for umem_alloc_16 cur_allocs for each request for
each request of tmsh show ltm policy
Workaround:
None
Fix:
Umem_alloc_16 cur_allocs no longer leaking memory.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5
1072197-1 : Issue with input normalization in WebSocket.
Links to More Info: K94142349, BT1072197
Component: Application Security Manager
Symptoms:
Under certain conditions, attack signature violations might not be triggered in WebSocket scenario.
Conditions:
- ASM handles WebSocket flow.
- Malicious WebSocket message contains specific characters.
Impact:
Attack detection is not triggered as expected.
Workaround:
N/A
Fix:
Attack detection is now triggered as expected.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
1072057-1 : "ANY" appears despite setting an IP address or host as the source in Security->Network Firewall->Policy.
Links to More Info: BT1072057
Component: Advanced Firewall Manager
Symptoms:
The GUI incorrectly displays the sources address in certain conditions.
1. If the source address of a firewall policy is not empty (that is, some specific IP addresses available to the rule), the word "Any" is displayed.
2. If the source address is empty (that is, no specific IP addresses exist), nothing (empty) is displayed.
Conditions:
Viewing a firewall policy in the GUI via Security > Firewall > policy.
Impact:
No functional impact
Workaround:
N/A
Fix:
Fixed a display issue with the source address field.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6
1071689-1 : SSL connection not immediately closed with HTTP2 connection and lingers until idle timeout
Links to More Info: BT1071689
Component: Local Traffic Manager
Symptoms:
SSL connections using HTTP/2 are not immediately closed and linger until the idle timeout expires.
Conditions:
This occurs during SSL handshake termination from the client to the BIG-IP system.
Impact:
SSL connection does not close.
Fix:
System will properly terminate the connection without lingering until timeout
Fixed Versions:
17.0.0, 16.1.3
1071621-1 : Increase the number of supported traffic selectors
Links to More Info: BT1071621
Component: TMOS
Symptoms:
There is an imposed limit of 30 traffic selectors that can be attached to an IPsec policy / IKEv2 ike-peer.
Conditions:
-- IKEv2
-- More than 30 traffic selectors required on one IPsec policy / ike-peer.
Impact:
No more than 30 traffic selectors can be added to a single IPsec policy / ike-peer.
Workaround:
None
Fix:
The behavior of sys db ipsec.maxtrafficselectors has changed.
- Max traffic selectors associated with an ike-peer are increased from 30 to 100.
- When the sys-db variable is non-zero, the limit is enforced.
Warning: Adding hundreds or thousands of traffic-selectors to an ipsec-policy may result in slow config-load times (for example, during startup). An excessive number of traffic selectors may also slow down IPsec tunnel negotiation. The impact will depend on the BIG-IP system's provisioning and the overall configuration.
- ipsec.maxtrafficselectors can be set to "0" to indicate there is no limit.
Behavior Change:
The behavior of sys db ipsec.maxtrafficselectors has changed.
- Max traffic selectors associated with an ike-peer are increased from 30 to 100.
- When the sys-db variable is non-zero, the limit is enforced.
- ipsec.maxtrafficselectors can be set to "0" to indicate there is no limit.
Warning: Adding hundreds or thousands of traffic-selectors to an ipsec-policy may result in slow config-load times (for example, during startup). An excessive number of traffic selectors may also slow down IPsec tunnel negotiation. The impact will depend on the BIG-IP system's provisioning and the overall configuration.
Fixed Versions:
17.1.0, 17.0.0.1, 16.1.3.1, 15.1.6.1
1071609-2 : IPsec IKEv1: Log Key Exchange payload in racoon.log.
Links to More Info: BT1071609
Component: TMOS
Symptoms:
The key exchange payload is not logged to the IPsec logs.
Conditions:
The issue is observed during IKEv1 tunnel establishment.
Impact:
If you are investigating the IKEv1 key calculation, the key exchange payload information will not be available.
Workaround:
N/A
Fix:
N/A
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1
1071585-1 : BIG-IP system does not respond to an arp from a SelfIP configured in virtual wire mode
Links to More Info: BT1071585
Component: Local Traffic Manager
Symptoms:
BIG-IP system does not respond to an arp from a SelfIP configured in virtual wire mode in Virtual Edition platforms.
Conditions:
Configure network in virtual wire mode in VADC pltaform
Impact:
Virtual server traffic is disrupted.
Workaround:
None
Fix:
Fix for the ARP not getting resolved when BIG-IP is configured with selfip on vwire's while redirecting to a different tmm.
Fixed Versions:
17.0.0, 16.1.2.2
1071485-3 : For IP based bypass, Response Analytics sends RST.
Links to More Info: BT1071485
Component: Access Policy Manager
Symptoms:
When SSL takes a dynamic bypass action (IP based bypass decision), the Per-Request Policy agents skip execution when necessary. That is, Category Lookup exits early due to no data because of the early bypass. The same check is not present in Response Analytics and URL Filter agents so that they don't take the error path due to not seeing Category Lookup data.
Conditions:
IP based bypass (in client SSL profile) with Response Analytics or URL Filtering in the Per-Request Policy.
Impact:
Category Lookup skips execution due to IP based bypass and thus Response Analytics and URL Filtering do not have the necessary data, so they take an internal error path. This will cause an RST.
Workaround:
Do not add Response Analytics or URL Filtering agents to paths that you know will not have appropriate Category Lookup data due to bypass.
Fix:
When the SSL level filter bypasses based on client data, Per-Request Policy agents will now be appropriately bypassed as well if there is not enough data to run on. They will take the fallback branches instead of sending a RST on error.
Fixed Versions:
17.0.0, 16.1.3.1
1071449-4 : The statsd memory leak on platforms with license disabled processors.
Links to More Info: BT1071449
Component: Local Traffic Manager
Symptoms:
Memory usage in statsd will continue to grow until the control-plane is out of memory.
Conditions:
This issue occurs when the license on the BIG-IP disables some of the processors.
Following are the affected platforms:
C123 = iSeries i11000 - Discovery Extreme
C124 = iSeries i11000-DS - Discovery Extreme Turbo
Impact:
The statsd may consume excessive memory causing OOM killer activity.
Workaround:
Restart statsd periodically.
Fix:
The statsd no longer leaks memory.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5
1071301-1 : GTM server does not get updated even when the virtual server status changes.
Links to More Info: BT1071301
Component: Global Traffic Manager (DNS)
Symptoms:
GTM Server is in an Unknown state even though the single virtual server is green.
Conditions:
-- Three-member sync group.
-- Create a large number of virtual servers.
-- Virtual servers are disabled and enabled.
Impact:
The server status does not reflect the virtual server status, and there is no obvious way to recover.
Workaround:
N/A
Fix:
N/A
Fixed Versions:
17.0.0, 16.1.3.1, 15.1.6.1, 14.1.5.1
1071269 : SSL C3D enhancements introduced in BIG-IP version 16.1.3 will not be available in 17.0.0.★
Links to More Info: BT1071269
Component: Local Traffic Manager
Symptoms:
The SSL C3D enhancements and features were introduced in BIG-IP version 16.1.3. If the feature is enabled in 16.1.3 and you upgrade to version 17.0.0, all of the following SSL C3D features will not be available, and the upgrade will fail:
- SSL C3D ability to convert RDN values to PrintableString or UTF-8 encoding.
- SSL C3D ability to modify CN in forged client certificate subject.
- SSL C3D ability to add custom SAN extension to the forged client certificate.
- SSL C3D ability to add AKI extension to the forged client certificate.
Conditions:
In the following conditions:
1. The BIG-IP config in 16.1.3 uses any of the two new iRules namely 'SSL::c3d subject' and 'X509::subject <cert> commonName'.
2. Upgrading to BIG-IP version 17.0.0
Impact:
Upgrade fails. You are unable to use any SSL C3D enhancements and features.
Workaround:
Workaround 1: Remove any config that had the SSL C3D feature enabled and caused the upgrade failure.
Workaround 2: If you require C3D features, upgrade to a release that supports them.
Fix:
N/A
Fixed Versions:
16.1.3
1071233-1 : GTM Pool Members may not be updated accurately when multiple identical database monitors are configured
Links to More Info: BT1071233
Component: Global Traffic Manager (DNS)
Symptoms:
When two or more GTM database monitors (MSSQL, MySQL, PostgreSQL, and Oracle) with identical 'send' and 'recv' strings are configured and applied to different GTM pools (with at least one pool member in each), the monitor status of some GTM pool members may not be updated accurately.
Other parameters of the affected monitors that differ (such as 'recv row' or 'recv column' indicating where the specified 'recv' string should be found in the result set) may cause GTM pool members using one of the affected monitors to connect to the same database to be marked UP, while GTM pool members using another affected monitor may be marked DOWN.
As a result of this issue, GTM pool members that should be marked UP or DOWN by the configured GTM monitor may instead be marked according to another affected monitor's configuration, resulting in the affected GTM pool members being intermittently marked with an incorrect state.
After the next monitor ping interval, affected GTM pool members members may be marked with the correct state.
Conditions:
This may occur when multiple GTM database monitors (MSSQL, MySQL, PostgreSQL, and Oracle) are configured with identical 'send' and 'recv' parameters, and applied to different pools/members which share the same IP address and Port values.
For example:
gtm monitor mysql mysql_monitor1 {
...
recv none
send "select version();"
...
}
gtm monitor mysql mysql_monitor2 {
...
recv none
send "select version();"
...
}
Impact:
Monitored GTM pool members using a database monitor (MSSQL, MySQL, PostgreSQL, and Oracle) randomly go offline/online.
Workaround:
To avoid this issue, configure each GTM database monitor with values that make the combined parameters unique by changing either the 'send' or the 'recv' parameters, or both.
For example:
gtm monitor mysql mysql_monitor1 {
...
recv none
send "select version();"
...
}
gtm monitor mysql mysql_monitor2 {
...
recv 5.7
send "select version();"
...
}
Fix:
The system updates GTM pool members correctly when multiple identical database monitors are configured.
Fixed Versions:
17.0.0, 16.1.3.1, 15.1.6.1, 14.1.5.1
1071181-2 : Improving Signature Detection Accuracy
Links to More Info: BT1071181
Component: Anomaly Detection Services
Symptoms:
BADOS generates signatures have up to 20% false positive if the signature covers 100% of bad traffic.
Conditions:
The attack signature generated covers all bad traffic.
Impact:
BADOS generates false positives
Workaround:
None
Fix:
This feature has been removed.
Fixed Versions:
16.1.2.2, 15.1.6.1, 14.1.5
1070833-2 : False positives on FileUpload parameters due to default signature scanning
Links to More Info: BT1070833
Component: Application Security Manager
Symptoms:
False positives on FileUpload parameters due to signature scanning by default
Conditions:
A request containing binary content is sent in "FileUpload" type parameters
Impact:
False positives and ineffective resource utilization
Workaround:
Disable signature scanning on "FileUpload" parameters manually using GUI/REST.
Fix:
Default signature scanning is disabled for FileUpload parameters created using OpenAPI to reduce false positives on binary content.
Fixed Versions:
17.1.0, 16.1.3, 15.1.6.1
1070789 : SSL fwd proxy invalidating certificate even through bundle has valid CA
Links to More Info: BT1070789
Component: Local Traffic Manager
Symptoms:
BIG-IP system rejects SSL forward proxy connections due to expired CA certificates present in ca-bundle even though other, valid CA certificates exist.
Conditions:
-- Forward proxy is enabled in client and server SSL profiles.
-- A valid CA certificate is followed by an expired CA certificate in ca-bundle.
Impact:
SSL handshakes will fail.
Workaround:
Remove all invalid trusted (i.e., expired) certificates from the certificate chain and replace them with a valid trusted certificate.
Fix:
Fixed the certificate verification issue that was leading to SSL handshake failure.
Fixed Versions:
17.1.0, 16.1.3.1
1070677-1 : Learning phase does not take traffic into account - dropping all.
Links to More Info: BT1070677
Component: Protocol Inspection
Symptoms:
Suggestions are generated every suggestion interval and every suggestion interval suggestions are overriding, so the last suggestion is considered after the staging period is completed.
Conditions:
Once the start of staging period, suggestions will override every time until the staging period completes.
Impact:
IPS learning phase, which lasts the default 7 days, sees a ton of traffic from websites hitting against signatures, but at the end of the 7 days it blocks all signatures and causes an outage.
Workaround:
N/A
Fix:
We now make the decision based on the overall suggestions that are generated during the staging period instead of the last suggestion.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5
1070273-1 : OWASP Dashboard does not calculate Disallow DTDs in XML content profile protection properly.
Links to More Info: BT1070273
Component: Application Security Manager
Symptoms:
On OWASP dashboard, both 2021 and 2017, the Disallow DTDs in XML content profile protection is not calculated correctly on the xml-profile allowDTD field.
Conditions:
Open the OWASP page for any non-parent/child security policy, (Security ›› Overview : OWASP Compliance). For OWASP 2017, DTDs is located under A4 category, and for 2021 under A5 category.
Impact:
Actual OWASP compliance for this protection can be different from the one shown by the GUI.
Workaround:
The actual conditions that satisfy the Disallow DTDs in XML content profile protection are:
1. 'XML data does not comply with format settings' violation should be set to alarm+block.
2. 'Malformed XML data' violation should be set to alarm + block.
3. No XML content profile in the policy is set so that allowDTDs to true.
Fix:
Scoring calculation was changed: Now score will be given only if no XML content profile in the policy has allowDTDs field set as true.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1
1070009 : iprepd, icr_eventd and tmipsecd restarts continuously after installing FIPS 140-3 license in BIG-IP cloud platform
Links to More Info: BT1070009
Component: TMOS
Symptoms:
32 bit applications (iprepd, icr_eventd and tmipsecd) uses clock_gettime to gather the time which causes the restart of applications. This issue occurs only in Azure and Google Cloud platform when FIPS 140 license is installed.
Conditions:
- Occurs only in Azure and Google Cloud platform
-32 bit applications (iprepd, icr_eventd and tmipsecd) which uses clock_gettime to gather the time for generating entropy data
- A FIPS 140 license is installed
Impact:
Applications restart continuously.
Workaround:
None.
Fix:
32-bit applications does not restart continuously while using clock_gettime to generate entropy data when FIPS 140 license is installed.
Fixed Versions:
17.0.0, 16.1.2.2
1069501-1 : ASM may not match certain signatures
Links to More Info: K22251611, BT1069501
Component: Application Security Manager
Symptoms:
Under certain condition, ASM may not match signatures as expected.
Conditions:
- base64 violations not configured for blocking
Impact:
Signatures not matched as expected.
Workaround:
Illegal base64 value violation should be set to blocking.
This way if Base64 decoding fails the requests gets blocked.
Fix:
ASM now processes signature as expected.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5
1069449-1 : ASM attack signatures may not match cookies as expected
Links to More Info: K39002226, BT1069449
Component: Application Security Manager
Symptoms:
Under certain conditions ASM attack signatures may not match cookies as expected.
Conditions:
- Specially crafted cookies
Impact:
Attack signatures are not detected as expected.
Workaround:
N/A
Fix:
ASM attack signatures now match cookies as expected.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
1069133-4 : ASMConfig memory leak
Links to More Info: BT1069133
Component: Application Security Manager
Symptoms:
A slow leak exists for long-lived asm_config_handler processes that handle configuration updates.
Conditions:
Configuration updates are being regularly made.
Impact:
Processes slowly grow in size until they reach a limit and restart themselves.
Workaround:
N/A
Fix:
The slow leak has been fixed.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5
1068561-1 : Can't create key on the second netHSM partition.
Links to More Info: BT1068561
Component: Local Traffic Manager
Symptoms:
While trying to create a key pair in a second partition, the key creation fails.
Conditions:
-- Multiple partitions are used
-- Attempt to create a key with the second partition
Impact:
Unable to use multiple netHSM partitions.
Workaround:
N/A
Fix:
Corrected session handle able to create keys in second partition.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1
1068445-1 : TCP duplicate acks are observed in speed tests for larger requests
Links to More Info: BT1068445
Component: Local Traffic Manager
Symptoms:
- A lot of TCP duplicate acks are observed in speed tests for larger requests
Conditions:
Below conditions are met
- Large request
- fastL4 profile with PVA acceleration set
- Below sys db variables are enabled
tm.tcpsegmentationoffload
tm.tcplargereceiveoffload
- Softpva is used
Impact:
- Reduced throughput because of duplicate ACKs and retransmissions
Workaround:
Either one of the conditions
- fastL4 profile with PVA acceleration set to NONE
- Disable below sys db variables
tm.tcpsegmentationoffload
tm.tcplargereceiveoffload
Fixed Versions:
17.0.0, 16.1.3.1, 15.1.6.1, 14.1.5.1
1068353-1 : Unexpected event sequence may cause HTTP/2 flow stall during shutdown
Links to More Info: BT1068353
Component: Local Traffic Manager
Symptoms:
HTTP/2 flows may stall during shutdown, eventually being freed by expiration or reset from the TCP peer.
Conditions:
HTTP/2 configured
Impact:
Flows may be retained longer than expected and continue to consume system resources until expired or reset by the TCP peer.
Workaround:
None
Fix:
Shutdown events are now handled correctly for HTTP/2 flows.
Fixed Versions:
16.1.2.2
1068237-1 : Some attack signatures added to policies are not used.
Links to More Info: BT1068237
Component: Application Security Manager
Symptoms:
Some attack signatures added to an existing signature set may not be utilized by Policies associated with the signature set, despite the attack signatures being reported as now present in the Policies.
Conditions:
1. Have one or more policies utilizing a manual attack signature set.
2. Update the attack signature database by installing an ASU or creating a custom attack signature.
3. Update the previously created manual attack signature set with one or more attack signatures which were not updated by the ASU (if ASU installed) or are not the newly created custom attack signature (if new custom signature created).
Impact:
The additional attack signatures added to the attack signature set will show up in the Policies utilizing the signature set however the Policies will not actually use those additional attack signatures.
Workaround:
There are two workarounds:
1. When adding additional attack signatures to a Policy, place them in a new attack signature set rather than re-using an existing signature set.
2. If adding signatures to an existing set, afterwards create a new custom attack signature, add it to a new manual attack signature set, add the set to any active policy and then remove the set from the policy (the set and signature can then be deleted if desired).
Both workarounds will result in all attack signatures listed as present in all Policies being fully and properly utilized by the Policies.
Fix:
N/A
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5
1067617-4 : BGP default route not advertised after mid-session OPEN.
Links to More Info: BT1067617
Component: TMOS
Symptoms:
After BGP peer opens a new session with BIG-IP in the middle of the existing session and the session is dropped, BIG-IP does not send default route NLRI to the peer when the new session is established.
Conditions:
Mid-session OPEN (Event 16 or Event 17 per RFC spec).
Impact:
Default route is missing on a BGP peer.
Workaround:
Clear the BGP session manually.
Fix:
N/A
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1
1067285-1 : Re-branding - Change 'F5 Networks, Inc.' to 'F5, Inc.'
Links to More Info: BT1067285
Component: Application Security Manager
Symptoms:
F5 Networks, Inc.
F5 Networks Inc.
F5 Networks appear as F5, Inc.
Conditions:
NA
Impact:
F5 Networks, Inc
F5 Networks
F5 Networks Inc will appear as F5, Inc to the end user, be it online help, or any ASM related screens.
Workaround:
NA
Fix:
F5 Networks, Inc
F5 Networks
F5 Networks Inc will appear as F5, Inc to the end user, be it online help, or any ASM related screens.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
1067105-2 : Racoon logging shows incorrect SA length.
Links to More Info: BT1067105
Component: TMOS
Symptoms:
Debug2 logs incorrect "total SA" length in racoon.log.
Conditions:
-- IKEv1 tunnels in use
-- ikedaemon in debug2 mode
Impact:
Troubleshooting is confused by misleading information about the SA payload length.
Workaround:
None. This is a cosmetic / logging issue.
Fix:
Clarified the log message to indicate what the logged length actually covers.
Fixed Versions:
17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7
1066829-1 : Memory leak for xml/json auto-detected parameter with signature patterns.
Links to More Info: BT1066829
Component: Application Security Manager
Symptoms:
A memory leak is observed in ASM when specific traffic arrives.
Conditions:
A request contains a JSON parameter value with the signature pattern.
Impact:
Memory leak in the system.
Workaround:
N/A
Fix:
No memory leak observed after the fix.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1
1066673-1 : BIG-IP Configuration Utility(TMUI) does not follow best practices for managing active sessions
1066377-1 : OpenAPI - Content profile is not consistent with wildcard configuration
Links to More Info: BT1066377
Component: Application Security Manager
Symptoms:
A content profile is created with an inconsistent order for wildcard content types.
Conditions:
-- Create OpenAPI policy
-- Configure any endpoint with multiple wildcard content types
Impact:
HTTP request body is not enforced properly
Workaround:
None
Fix:
Fix provided to create content profile with proper order for wild card content type
Fixed Versions:
17.0.0, 16.1.2.2
1066285-4 : Master Key decrypt failure - decrypt failure.
Links to More Info: BT1066285
Component: TMOS
Symptoms:
After MCPD restarts or the system reboots:
-- the system is inoperative and MCPD may be restarting
-- the logs report this error:
err mcpd[12444]: 01071769:3: Decryption of the field (value) for object (config.auditing.forward.sharedsecret) failed while loading configuration that is encrypted with a different master key.
-- the system may be reporting this error:
load_config_files[5635]: "/usr/bin/tmsh -n -g -a load sys config partitions all " - failed. -- Error: failed to reset strict operations; disconnecting from mcpd. Will reconnect on next command.
This may occur during a system upgrade.
Conditions:
When config.auditing.forward.sharedsecret is encrypted and masterkey value is changed.
Impact:
MCPD will continuously restart, and the system will remain inoperative.
Workaround:
If a system is affected by this issue, set the DB key back to its default value. Once the configuration is loaded, set the DB key back to the correct value:
- tmsh modify /sys db config.auditing.forward.sharedsecret value '<null>'
After changing the SecureValue master key but before encountering the issue, run the following command to update the value of the DB key on-disk:
setdb config.auditing.forward.sharedsecret "$(getdb config.auditing.forward.sharedsecret)"
Fix:
N/A
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
1065789-1 : TMM may send duplicated alerts while processing SSL connections
Component: Local Traffic Manager
Symptoms:
Under certain conditions, TMM may send duplicated SSL alerts while processing encrypted connections.
Conditions:
- Fatal SSL error
Impact:
Increased resource usage, potentially leading to degraded performance.
Workaround:
N/A
Fix:
SSL alerts are now processed as expected.
Fixed Versions:
17.0.0, 16.1.2.1, 15.1.5
1065585-1 : System does not halt on on FIPS/entropy error threshold for BIG-IP Virtual Edition
Links to More Info: BT1065585
Component: TMOS
Symptoms:
BIG-IP Virtual Edition keeps running even after multiple FIPS/entropy errors occur.
Conditions:
Multiple FIPS/entropy errors on BIG-IP Virtual Edition system.
Impact:
BIG-IP Virtual Edition keeps running even after multiple FIPS/entropy errors occur
Workaround:
None
Fix:
System should halt after the threshold number of FIPS/entropy errors occue
Fixed Versions:
17.0.0, 16.1.2.2
1064669-1 : Using HTTP::enable iRule command in RULE_INIT event might cause TMM to crash.
Links to More Info: BT1064669
Component: Local Traffic Manager
Symptoms:
TMM crashes if an iRule is configured that has HTTP::enable in the RULE_INIT event.
Conditions:
iRule that uses HTTP:enable command in RULE_INIT event, for example:
ltm rule example_rule {
when RULE_INIT {
# Don't do this!
HTTP::enable
}
}
Impact:
Traffic disrupted while TMM restarts.
Workaround:
Do not use the HTTP::enable iRule command in the RULE_INIT event.
Fix:
N/A
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.5
1064617-1 : DBDaemon process may write to monitor log file indefinitely
Links to More Info: BT1064617
Component: Local Traffic Manager
Symptoms:
If debug logging is enabled for a database monitor (mssql, mysql, postgresql or oracle), the DBDaemon process may write to a monitor log file indefinitely, including after the monitor log file is rotated and/or deleted.
Conditions:
This problem may occur when:
- using a database monitor (mssql, mysql, postgresql or oracle) which is configured with the "debug" value set to "yes"
- using a database monitor (mssql, mysql, postgresql or oracle) for a pool member which is configured with the "logging" set to "enabled"
Impact:
The DBDaemon process may write debug logging messages to the affected monitor log file indefinitely, including after the monitor log file has been rotated and/or deleted.
As a result, storage in the /var/log volume may be consumed to the point that other logging cannot be performed, and the BIG-IP instance may be restarted/rebooted.
Workaround:
To work around this issue, restart the DBDaemon process.
To find the PID of the DBDaemon process, observe the output of the following command:
ps -ef |grep -v grep | grep DB_monitor.jar | awk '{print($2)}'
To confirm whether the DBDaemon process is writing to a monitor log file, and if so, which file:
lsof -p $(ps -ef | grep -v grep | grep DB_monitor.jar | awk '{print($2)}') | grep -e COMMAND -e '/var/log/monitors'
To kill the DBDaemon process:
kill $(ps -ef | grep -v grep | grep DB_monitor.jar | awk '{print($2)}')
NOTE:
Killing the DBDaemon process will cause a short-term loss of database monitoring functionality, until DBDaemon is restarted by the next database monitor probe.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
1064461-4 : PIM-SM will not complete RP registration over tunnel interface when floating IP address is used.
Links to More Info: BT1064461
Component: TMOS
Symptoms:
PIM-SM will not complete rendezvous point (RP) registration over the tunnel interface when a floating IP address is used (ip pim use-floating-address). Join/prune from RP gets dropped on BIG-IP when doing local-address validation.
BIG-IP never completes registration successfully.
Conditions:
RP registration over tunnel interface when floating IP address is used.
Impact:
BIG-IP never completes registration and outgoing packets are register-encapsulated.
Workaround:
N/A
Fix:
N/A
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5
1064357-1 : execute_post_install: EPSEC: Installation of EPSEC package failed
Links to More Info: BT1064357
Component: TMOS
Symptoms:
APM EPSEC installation fails and an error message is logged in /var/log/ltm: "execute_post_install: EPSEC: Installation of EPSEC package failed"
Conditions:
APM EPSEC package installation
Impact:
Installation fails with an error message
Fixed Versions:
17.0.0, 16.1.3, 15.1.7
1064217-1 : Port bit not set correctly in the ipv6 destination address with 1:8 mapping for CGNAT MAP-T.
Links to More Info: BT1064217
Component: Carrier-Grade NAT
Symptoms:
Port bits are not set as expected in the ipv6 destination address with 1:8 mapping for CGNAT MAP-T.
Conditions:
This occurs in a MAP-T configuration.
Impact:
MAP-T port translation does not work as expected.
Workaround:
N/A
Fix:
Fixed an issue with the port bit not being set correctly.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5
1064189-1 : DoH proxy and server listeners from GUI with client-ssl profile and server-ssl profile set to None produces undefined warning
Links to More Info: BT1064189
Component: Global Traffic Manager (DNS)
Symptoms:
Dns Over HTTPS (DOH) is allowed to work without a clientssl profile on clientside. Setting it to none disables the DNS resolution via the HTTPS protocol.
Conditions:
- Selecting "None" in Client SSL Profile and Server SSL Profile in DOH Server Listener and DOH Proxy Listener from GUI
Impact:
An error occurs:
GUI: 01020036:3: The requested profile (/Common/NO_SELECTION) was not found.
TMSH: 01070734:3: Configuration error: In Virtual Server (/Common/mydohproxylistener) http2 specified activation mode requires a client ssl profile
Workaround:
None
Fixed Versions:
17.0.0, 16.1.2.2
1064157-1 : Http_proxy_opaque_get should constrain search to local/spawn flows, not looped flows
Links to More Info: BT1064157
Component: Local Traffic Manager
Symptoms:
In a VIP-on-VIP (looped) situation, HTTP on one virtual server uses/reuses an existing 'http_proxy_opaque' whilst still in use by another virtual server that causes unexpected state changes in the opaque which may cause tmm to core.
Conditions:
-- Explicit Forward Proxy SSL Orchestrator, in other words an L3 Explicit Proxy which is usually deployed in a VIP on VIP configuration
-- Hostname resolution using explicit 'RESOLV::lookup' iRule in HTTP_PROXY_REQUEST on the explicit/client-facing VIP
Impact:
Traffic disrupted while tmm restarts.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1
1063977-3 : Tmsh load sys config merge fails with "basic_string::substr" for non-existing key.
Links to More Info: BT1063977
Component: Local Traffic Manager
Symptoms:
"tmsh load sys config merge" fails with the following error.
Loading configuration...
/var/tmp/repro.txt
01070711:3: basic_string::substr
Unexpected Error: Loading configuration process failed.
Conditions:
The key referenced in the configuration of the SSL profile does not exist in the BIG-IP.
Impact:
"tmsh load sys config merge" fails which is expected, but the error is not meaningful.
Workaround:
Identify the missing SSL key used in the configuration and correct it.
Fix:
You should now be able to see the error message "The requested certificate (<Cert Name>) was not found." or "The requested certificate (<Key Name>) was not found." if a non-existing key is used in the configuration.
Fixed Versions:
17.1.0, 16.1.3
1063453-1 : FastL4 virtual servers translating between IPv4 and IPv6 may crash on fragmented packets.
Links to More Info: BT1063453
Component: Local Traffic Manager
Symptoms:
Tmm crashes while passing IPv4-to-IPv6 traffic over FastL4.
Conditions:
-- A FastL4 virtual server translates between IPv4 and IPv6.
-- Fragment reassembly is not enabled in the FastL4 profile.
-- A feature requiring asynchronous completion is configured including: asynchronous irules on LB events (LB_SELECTED, LB_FAILED, LB_PERSIST_DOWN, LB_QUEUED, SA_PICKED), persistence, sessiondb operations, HA, virtual rate limiting.
Impact:
All traffic is disrupted while the TMM restarts.
Workaround:
Configure the FastL4 profile to always reassemble fragments.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5
1063345-5 : Urldbmgrd may crash while downloading the database.
Links to More Info: BT1063345
Component: Access Policy Manager
Symptoms:
Urldbmgrd may crash while downloading the database.
Conditions:
SWG or URLDB is provisioned.
Impact:
User traffic will be impacted when urldbmgrd is down.
Workaround:
N/A
Fix:
N/A
Fixed Versions:
17.0.0, 16.1.3.1
1062513-4 : GUI returns 'no access' error message when modifying a GTM pool property.
Links to More Info: BT1062513
Component: Global Traffic Manager (DNS)
Symptoms:
When you modify a GTM pool property and then click "Update," the next page displays the error message "No access."
When you modify GTM pool properties using the GUI, the properties do not update or display.
Conditions:
This occurs when you modify a GTM pool property using the GUI.
Impact:
You cannot change a GTM pool property using the GUI.
Workaround:
Use TMSH to change the GTM pool property.
OR
Click on "Update" a second time in the GUI.
Fix:
N/A
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
1062493-1 : BD crash close to it's startup
Links to More Info: BT1062493
Component: Application Security Manager
Symptoms:
BD crashes shortly after startup.
Conditions:
FTP or SMTP are in use. Other causes are unknown.
Impact:
Traffic disrupted while bd restarts.
Workaround:
No workaround except removal of the FTP/SMTP protection.
Fix:
Crashes close to startup coming from SMTP or FTP were fixed.
Fixed Versions:
17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7
1062333-6 : Linux kernel vulnerability: CVE-2019-19523
Component: TMOS
Symptoms:
A flaw was found in the Linux kernel’s implementation for ADU devices from Ontrak Control Systems, where an attacker with administrative privileges and access to a local account could pre-groom the memory and physically disconnect or unload a module.
Conditions:
The attacker must be able to access either of these two events to trigger the use-after-free, and then race the access to the use-after-free, to create a situation where key USB structs can be manipulated into corrupting memory.
Impact:
An attacker could pre-groom the memory and physically disconnect or unload a module.
Workaround:
N/A
Fix:
Kernel patched to mitigate CVE-2019-19523
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5
1061797-1 : Upgraded AWS CloudFormation Helper Scripts which now support IMDSv2
Links to More Info: BT1061797
Component: TMOS
Symptoms:
For AWS's CloudFormation to work with IMDSv2, the Helper Script module had to be upgraded.
Conditions:
Using AWS CloudFormation for IMDSv2-only instances
Impact:
The Helper scripts throw a "No Handler found" error when used to launch IMDSv2 instances
Fix:
With the latest version of BIG-IP VE, you can now launch IMDSv2 instances using AWS's CloudFormation templates.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1
1061617-4 : Some of the URL Attack signatures are not detected in the URL if "Handle Path Parameters" is configured "As Parameters".
Links to More Info: BT1061617
Component: Application Security Manager
Symptoms:
The following Attack Signatures are not identified if "Handle Path Parameters" = "As Parameters".
200001660, 200001663, 200007032, 200101543, 200101632, 200101635, 200101638, 200101641, 200101644
Conditions:
- Configure "Handle Path Parameters" = "As Parameters"
- Enable URL attack signatures 200001660, 200001663, 200007032, 200101543, 200101632, 200101635, 200101638, 200101641, 200101644
Impact:
Some URL attack signatures are not detected by ASM.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5
1061481-1 : Denied strings were found in the /var/log/ folder after an update or reboot
Links to More Info: BT1061481
Component: TMOS
Symptoms:
Denied strings error message were found in /var/log/dmesg and /var/log/messages files after update or reboot.
For example, the string "denied" was found:[ 5.704716] type=1401 audit(1636790175.688:4): op=security_bounded_transition seresult=denied oldcontext=system_u:system_r:init_t:s0 newcontext=system_u:system_r:f5_jitter_entropy_t:s0
Conditions:
After update or reboot, check the following log files:
/var/log/dmesg and /var/log/messages.
Impact:
Error strings are observed in /var/log/dmesg and /var/log/messages.
Workaround:
None.
Fix:
No error strings are observed.
Fixed Versions:
17.1.0, 17.0.0.1, 16.1.3
1060989 : Improper handling of HTTP::collect
Links to More Info: BT1060989
Component: Local Traffic Manager
Symptoms:
When a complete body has been received and a new HTTP::collect is attempted, an error occurs:
TCL error: /Common/rule_vs_server_15584 <HTTP_RESPONSE_DATA> - ERR_ARG (line 1) invoked from within "HTTP::collect 256000"
Conditions:
- HTTP Virtual server
- incremental HTTP::collect irule
Impact:
iRule failure
Workaround:
None
Fixed Versions:
17.1.0, 16.1.3.1
1060933-1 : Issue with input normalization.
Links to More Info: K49237345
Component: Application Security Manager
Symptoms:
Under certain conditions, attack signature violations may not be triggered.
Conditions:
- ASM provisioned with XML content profile
- Request contains XML body
Impact:
Attack detection is not triggered as expected.
Workaround:
None
Fix:
Attack detection is now triggered as expected.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
1060625-1 : Wrong INTERNAL_IP6_DNS length.
Links to More Info: BT1060625
Component: TMOS
Symptoms:
Tunnel establishment fails when an IPv6 DNS IP address is provided in the IKE_AUTH payload. As per RFC it should be 16 octets, but BIG-IP sends 17 octets(that is, it tries to provide the subnet info also).
Conditions:
Initiator requests an IPv6 DNS IP during tunnel negotiation.
Impact:
Tunnel will not establish.
Workaround:
None
Fix:
The INTERNAL_IP6_DNS payload is now filled with only the IPv6 address (the subnet is excluded).
Fixed Versions:
17.1.0, 17.0.0, 16.1.2.2
1060409-2 : Behavioral DoS enable checkbox is wrong.
Links to More Info: BT1060409
Component: Anomaly Detection Services
Symptoms:
Behavioral DoS Enabled indicator is wrongly reported after configuration change, when no traffic is injected to the virtual server.
Conditions:
Behavioral DoS is enabled and then disabled when no traffic is injected to the virtual server.
Impact:
After server health is stabilized and constant, the BIG-IP system doesn't report the configuration changes.
Workaround:
Send 1-2 requests to the server and the configuration will be updated.
Fix:
Behavioral DoS enabled/disabled flag is now reported correctly.
Fixed Versions:
17.1.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
1060149-2 : BIG-IP vCMP guest data-plane failure with turboflex-adc selected on the host.
Links to More Info: BT1060149
Component: TMOS
Symptoms:
-- Interfaces in the vCMP guest may remain uninitialized.
-- 'Invalid VCMP PDE state version' log in /var/log/tmm*.
Conditions:
-- BIG-IP i5xxx/i7xxx/i10xxx/i11xxx platform.
-- vCMP provisioned.
-- turboflex-adc profile selected.
Impact:
Affected guest is non-functional.
Workaround:
Use the turboflex-base profile.
Fix:
N/A
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1
1059853 : Long loading configuration time after upgrade from 15.1.3.1 to 16.1.2.★
Links to More Info: BT1059853
Component: TMOS
Symptoms:
Tmsh load sys config/tmsh load sys config verify takes much longer (~10x).
Conditions:
While loading config tmsh load sys config verify.
Impact:
Configuration loading takes a long time (more than 8 minutes).
Workaround:
N/A
Fix:
N/A
Fixed Versions:
17.0.0, 16.1.2.2
1059621-2 : IP Exceptions feature and SSRF feature do not work as expected if both the entries are configured with the same IP/IPs.
Links to More Info: BT1059621
Component: Application Security Manager
Symptoms:
IP Exceptions/SSRF does not work as expected if the same IPs are configured in both IP Exception and SSRF.
Conditions:
- Enable XFF Header.
- Configure same IP/IPs in both SSRF and IP Exceptions.
- Send traffic with xff header and URI parameter.
Impact:
One of the IP Exceptions or SSRF features do not work as expected.
Workaround:
N/A
Fix:
N/A
Fixed Versions:
17.0.0, 16.1.2.2
1059165-1 : Multiple virtual server pages fail to load.
Links to More Info: BT1059165
Component: TMOS
Symptoms:
Virtual server-related pages fail to load in the GUI.
Conditions:
This issue is observed only when the DOS module is provisioned.
Impact:
Virtual server properties do not load.
Workaround:
None
Fix:
Virtual Server pages now load successfully.
Fixed Versions:
17.0.0, 16.1.2.2
1059053-2 : Tmm crash when passing traffic over some configurations with L2 virtual wire
Links to More Info: BT1059053
Component: Local Traffic Manager
Symptoms:
In very rare cases, tmm crashes while passing traffic over some configurations with L2 virtual wire.
Conditions:
-- L2 wire setup
-- A routing error occurs
Impact:
Traffic disrupted while tmm restarts.
Workaround:
None
Fix:
Modified code to prevent such crashes.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1
1058677-2 : Not all SCTP connections are mirrored on the standby device when auto-init is enabled.
Links to More Info: BT1058677
Component: TMOS
Symptoms:
When auto-init is enabled, Not all SCTP connections are mirrored to the standby device.
Conditions:
-- SCTP Profile and Mirroring.
-- Auto initialization is enabled.
Impact:
Only half of the connections are mirrored to the standby device.
Workaround:
Disable auto initialization:
tmsh modify ltm message-routing diameter peer <affected_peer> { auto-initialization disabled }
Fix:
SCTP connections are mirrored successfully to standby device.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6
1058469-1 : Disabling strict-updates for an iApp service which includes a non-default NTLM profile will cause virtual servers using that profile to stop working.
Links to More Info: BT1058469
Component: Local Traffic Manager
Symptoms:
A virtual server which is part of an iApp service and which was previously working correctly now rejects all traffic.
Upon inspecting the log, entries similar to the following examples may be noticed:
==> /var/log/tmm <==
<13> Oct 28 23:41:36 bigip1 notice hudfilter_init: clientside matches TCP position. 0 0
==> /var/log/ltm <==
Oct 28 23:41:36 bigip1 err tmm[21251]: 01010008:3: Proxy initialization failed for /Common/my.app/my-vs. Defaulting to DENY.
Oct 28 23:41:36 bigip1 err tmm[21251]: 01010008:3: Listener config update failed for /Common/my.app/my-vs: ERR:ERR_UNKNOWN
Conditions:
This issue is known to occur when strict-updates is disabled for an iApp service which includes a non-default NTLM profile.
Impact:
Traffic outage as the affected virtual server(s) no longer passes any traffic.
Workaround:
To recover an affected system, either restart TMM (bigstart restart tmm) or delete and redeploy the iApp service.
To prevent this issue from occurring again, modify the iApp configuration to use the default NTLM profile rather than a custom one (if the iApp template involved allows this).
Fix:
Disabling strict-updates for an iApp service, which includes a non-default NTLM profile, no longer causes virtual servers associated with the profile to suddenly stop working.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6
1058401-1 : SSL Bypass does not work for inbound traffic
Links to More Info: BT1058401
Component: SSL Orchestrator
Symptoms:
Per-request policy's SSL Bypass Set agent does not bypass TLS traffic for inbound topology.
Conditions:
-- SSL Orchestrator is licensed and provisioned.
-- Per-request policy is attached to interception rules and SSL Bypass Set agent is used in the policy.
Impact:
BIG-IP/SSL Orchestrator does not bypass the TLS traffic for inbound topology.
Fix:
SSL Bypass Set agent in the per-request policy now bypasses TLS traffic for inbound topology.
Fixed Versions:
17.0.0, 16.1.2.2
1058297-2 : Policy history values for 'max Size Of Saved Versions' and for 'min Retained Files In Dir' is reset during upgrade★
Links to More Info: BT1058297
Component: Application Security Manager
Symptoms:
The values for "minRetainedFilesInDir" and "maxSizeOfSavedVersions" in /etc/ts/tools/policy_history.cfg
are set back to default after an upgrade.
Conditions:
-- Non-default values for "minRetainedFilesInDir" and for "maxSizeOfSavedVersions"
-- An upgrade occurs
Impact:
After upgrade, the values in the configuration file are set back to default.
Workaround:
Update the values after the upgrade is complete.
Fix:
The usage of the configuration file /etc/ts/tools/policy_history.cfg is deprecated.
New internal config items have been added:
"policy_history_min_retained_versions" and "policy_history_max_total_size"
The internal variables are preserved during the upgrade.
Fixed Versions:
17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7
1056993-2 : 404 error is raised on GUI when clicking "App IQ."
Links to More Info: BT1056993
Component: TMOS
Symptoms:
When the App IQ menu option is clicked in the GUI workflow, (GUI: System ›› Configuration >> App IQ) the result is "Not Found. The requested URL was not found on this server."
Conditions:
Clicking the App IQ menu option in the GUI workflow, GUI: System ›› Configuration >> App IQ.
Impact:
Not able to access App IQ page.
Workaround:
Navigate directly to the following page on your BIG-IP (replacing <BIG-IP> with the IP/hostname of the system):
https://<BIG-IP>/tmui/tmui/system/appiq_ng/views/settings.html
Fix:
N/A
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6
1056957-1 : An attack signature can be bypassed under some scenarios.
Links to More Info: BT1056957
Component: Application Security Manager
Symptoms:
An attack signature is not detected.
Conditions:
A specific condition.
Impact:
False negative - attack is not detected.
Workaround:
N/A
Fix:
N/A
Fixed Versions:
17.1.0, 17.0.0.1, 16.1.3.1
1056741-2 : ECDSA certificates signed by RSA CA are not selected based by SNI.
Links to More Info: BT1056741
Component: TMOS
Symptoms:
Attempts to select a client-ssl profile based on the certificate subject/SAN will not work for ECDSA certificates if ECDSA cert is signed by RSA CA. Even when the SNI in the client hello matches the certificate subject/SAN, BIG-IP selects the default client SSL profile.
Conditions:
-- ECDSA certificate signed by RSA CA.
-- Client SSL profile does not have "server name" option configured.
Impact:
The desired client-ssl profile is not selected for ECDSA hybrid certificates when the SNI matches the certificate subject/SAN.
Workaround:
Do not use hybrid certificates or configure the "server name" option in the client-ssl profile matching SNI.
Fix:
N/A
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1
1056401-4 : Valid clients connecting under active syncookie mode might experience latency.
Links to More Info: BT1056401
Component: Local Traffic Manager
Symptoms:
Valid clients that connect using active syncookie mode might experience latency.
Conditions:
- SYN Cookie (Hardware or Software) is enabled.
- SYN Cookies are activated (TCP Half Open) for the virtual server.
- FastL4 tcp-generate-isn option or SYN-ACK vector 'suspicious event count' options are enabled.
- SYN Cookie issue and validation with client is correct.
- SSL Client Hello packet sent by client reaches DHD right after TCP SYN packet is sent to backend server.
Impact:
Random connections might be disrupted.
Workaround:
None
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1
1056365-1 : Bot Defense injection does not follow best SOP practice.
Links to More Info: BT1056365
Component: Application Security Manager
Symptoms:
In specific cases, Bot Defense challenge does not follow Same Origin Policy.
Conditions:
Bot Defense Profile is attached to VS.
Impact:
In some cases, Bot Defense Injection does not follow Same Origin Policy.
Workaround:
N/A
Fix:
N/A
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5
1055361-1 : Suspending iRule command in L7CHECK_CLIENT_DATA can lead to a tmm crash.
Links to More Info: BT1055361
Component: SSL Orchestrator
Symptoms:
Suspending iRule command in L7CHECK_CLIENT_DATA can lead to a TMM crash.
Conditions:
Suspending iRule command in L7CHECK_CLIENT_DATA
Example:
ltm rule /Common/rule-a {
when L7CHECK_CLIENT_DATA {
after 10000
}
}
Impact:
Traffic disrupted while tmm restarts.
Workaround:
Do not use Suspending iRule command in L7CHECK_CLIENT_DATA.
Fix:
Fixed a TMM crash.
Fixed Versions:
17.0.0, 16.1.2.1, 15.1.5.1
1055097-1 : TCP proxy with ramcache and OneConnect can result in out-of-order events, which stalls the flow.
Links to More Info: BT1055097
Component: Local Traffic Manager
Symptoms:
Because the client resends the request, the connection is not lost, but is stalled for a considerable time.
Conditions:
-- virtual server running affected version has both webacceleration and OneConnect profiles.
-- The response has 'Cache-Control: no-cache' header.
Impact:
The stalled connection causes slow response times for application users.
Workaround:
Remove the configuration for either the OneConnect or Caching profile.
Fix:
N/A
Fixed Versions:
17.0.0, 16.1.2.2
1053309-1 : Localdbmgr leaks memory while syncing data to sessiondb and mysql.
Links to More Info: BT1053309
Component: Access Policy Manager
Symptoms:
Top output shows that localdbmgr memory increases steadily.
Conditions:
Localdb auth is enabled or localdb is used for storing APM-related information like for MDM intune.
Impact:
Localdbmgr is killed by oom killer and is restarted, thereby affecting the execution of access policies.
Workaround:
N/A
Fix:
N/A
Fixed Versions:
17.0.0, 16.1.3, 15.1.6.1, 14.1.5
1053149-1 : A FastL4 TCP connection which is yet to fully establish fails to update its internal SEQ space when a new SYN is received.
Links to More Info: BT1053149
Component: Local Traffic Manager
Symptoms:
Depending on the software version running on the BIG-IP system, this issue can manifest in one of two ways:
- Versions with the fix for ID1008077 will fail to forward the client's final ACK (from the TCP 3-way handshake) to the server. Eventually, once the TCP handshake timeout expires, the BIG-IP system will reset both sides of the connection.
- Versions without the fix for ID1008077 will forward the traffic correctly, but will not advance the internal FastL4 state for the connection. Given enough traffic for the same 4-tuple, the connection may never expire. Traffic for subsequent connections will appear to be forwarded correctly, but no load-balancing will occur due to the original connection not having expired yet.
Conditions:
A FastL4 TCP connection not completing the TCP handshake correctly, and the client retrying with a new (different SEQ number) SYN.
Impact:
Traffic failures (intended as either connections failing to establish, or improper load-balancing occurring).
Fix:
A FastL4 TCP connection which is yet to fully establish now correctly updates its internal SEQ space when a new SYN is received. This means the connection advances as it should through internal FastL4 states, and is removed from the connection table when the connection closes.
Fixed Versions:
17.0.0, 16.1.3.1, 15.1.6.1, 14.1.5.1
1052929-4 : MCPD logs "An internal login failure is being experienced on the FIPS card" when FIPS HSM is uninitialized.
Links to More Info: BT1052929
Component: Local Traffic Manager
Symptoms:
When MCPD starts, it may log an error message reporting an issue communicating with the onboard FIPS HSM. If the HSM is uninitialized, this message is erroneous, and an be ignored.
Depending on the hardware platform, the message may be one of the following:
err mcpd[12345]: 01b50049:3: FIPSUserMgr Error: An internal login failure is being experienced on the FIPS card. Please issue 'FIPSutil loginreset -r' followed by 'bigstart restart' for a password reset. You will need your FIPS Security Officer password to reset the password..
err mcpd[12345]: 01b50049:3: FIPSUserMgr Error: An internal login failure is being experienced on the FIPS card. The FIPS card must be reinitialized, which will erase its contents..
Conditions:
-- BIG-IP system with an onboard FIPS HSM, or a vCMP guest running on a BIG-IP system with an onboard FIPS HSM
-- the FIPS HSM is not initialized, i.e. "fipsutil info" reports "FIPS state: -1".
Impact:
This message can be ignored when the FIPS HSM is not in-use, and is uninitialized.
Workaround:
Initialize the FIPS HSM following the instructions in the F5 Platforms : FIPS Administration manual.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
1052893-4 : Configuration option to delay reboot if dataplane becomes inoperable
Component: TMOS
Symptoms:
When certain system failures occur and the dataplane cannot continue to handle network traffic, the BIG-IP system will automatically reboot. This behavior may restore traffic management, but it may prevent diagnosis of the failure.
Conditions:
Low-level system failure, possibly in HSB SRAM or other hardware
Impact:
Diagnosis of the dataplane failure is hindered.
Workaround:
None
Fix:
A new "sys db" variable "tmm.hsb.dataplanerebootaction" is added. The default value is "enable", which retains the previous behavior of rebooting, if a failure occurs making the dataplane inoperable. The value may optionally be set to "disable", which avoids an immediate system reboot by making the HA action be "go-offline-downlinks".
Fixed Versions:
16.1.2.2
1052173-1 : For wildcard SSRF hosts "Matched Disallowed Address" field is wrong in the SSRF violation.
Links to More Info: BT1052173
Component: Application Security Manager
Symptoms:
"Matched Disallowed Address" and "Actual Disallowed Address" both are shown as same "Actual Disallowed Address" only.
Conditions:
- configure wildcard SSRF host
Impact:
Misleading SSRF violation details
Workaround:
None.
Fixed Versions:
17.0.0, 16.1.2.2
1052169 : Traffic is blocked on detection of an SSRF violation even though the URI parameter is in staging mode
Links to More Info: BT1052169
Component: Application Security Manager
Symptoms:
Traffic is blocked on an SSRF violation even though the URI parameter is in staging mode.
Conditions:
-- URI parameter should be in staging mode
-- Traffic contains an SSRF deny-listed host as URI parameter value
Impact:
Traffic is blocked even though the URI parameter is in staging mode
Workaround:
None.
Fixed Versions:
16.1.2.2
1052153-2 : Signature downloads for traffic classification updates via proxy fail
Links to More Info: BT1052153
Component: Traffic Classification Engine
Symptoms:
Downloading IM package via proxy fails.
Conditions:
Downloading the IM file through a proxy.
Impact:
Auto-download IM package from f5.com will fail
Workaround:
Disable the proxy and trigger the IM package download from the management interface.
Fix:
Fixed an issue with downloading updates through a proxy.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6
1051213-1 : Increase default value for violation 'Check maximum number of headers'.
Links to More Info: BT1051213
Component: Application Security Manager
Symptoms:
Due to recent change in browsers, up to 7 headers are newly inserted in the request.
In ASM, there is default limit of 20 headers. So, when legitimate requests have more than 20 headers, they're blocked with violation "Maximum Number of Headers exceeded".
Conditions:
When the number of headers passed in request is greater than the value of maximum number of headers set, then this violation is raised.
Impact:
Legitimate requests are blocked with violation "Maximum Number of Headers exceeded" when number of header is greater than the value set for the policy (default 20).
Workaround:
Increase "Check maximum number of headers" to 30 under Learning and Blocking settings screen for a policy.
Fix:
Increased default value of maximum number of headers to 30.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
1051209-1 : BD may not process certain HTTP payloads as expected
Links to More Info: K53593534, BT1051209
Component: Application Security Manager
Symptoms:
Under certain conditions BD may not process HTTP payloads as expected.
Conditions:
- HTTP request
Impact:
Payloads are not processed as expected, potentially leading to missed signature matches.
Workaround:
N/A
Fix:
BD now processes HTTP payloads as expected.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
1050969-1 : After running clear-rest-storage you are logged out of the UI with a message - Your login credentials no longer valid
Links to More Info: BT1050969
Component: SSL Orchestrator
Symptoms:
Running clear-rest-storage removes all the available tokens as well as cookie files from /var/run/pamchache.
Conditions:
Run the clear-rest-storage command.
Impact:
All users are logged out of the GUI.
Workaround:
Re-login.
Fix:
Clear-rest-storage should only remove tokens not cookies.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.5
1050697-4 : Traffic learning page counts Disabled signatures when they are ready to be enforced
Links to More Info: BT1050697
Component: Application Security Manager
Symptoms:
The traffic learning page counts Disabled signatures when they are ready to be enforced.
Conditions:
Policy has a disabled signature.
Impact:
Traffic learning page shows different counts of "ready to be enforced" signatures compared to Security ›› Application Security : Security Policies : Policies List ›› <policy name>
Workaround:
None
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
1050537-1 : GTM pool member with none monitor will be part of load balancing decisions.
Links to More Info: BT1050537
Component: Global Traffic Manager (DNS)
Symptoms:
A GTM pool member containing no monitor (status=BLUE) is not included in load balancing decisions.
Conditions:
GTM pool member the monitor value set to none.
Impact:
GTM does not load balance to this pool member.
Workaround:
N/A
Fix:
Handled GTM pool with "none" monitor
Behavior Change:
GTM pool members with "none" monitor are now part of load balancing decisions
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
1050273-1 : ERR_BOUNDS errors observed with HTTP explicit proxy service in SSL Orchestrator.
Links to More Info: BT1050273
Component: SSL Orchestrator
Symptoms:
The following similar error log messages repeated many times:
err tmm[13905]: 01c80017:3: CONNECTOR: Listener=/Common/sslo_intercept.app/sslo_intercept-in-t-4, Profile=/Common/ssloS_httpEpxy.app/ssloS_httpEpxy-t-4-connector: Error forwarding egress to return virtual server (null) - ERR_BOUNDS
err tmm8[13905]: 01c50003:3: Service : encountered error: ERR_BOUNDS File: ../modules/hudfilter/service/service_common.c Function: service_cmp_send_data, Line: 477
Conditions:
1. SSL Orchestrator with HTTP explicit proxy as a service.
2. System is under load.
3. On VELOS platform.
Impact:
SSL Orchestrator throughput is degraded.
Workaround:
N/A
Fix:
After the fix, no such errors are observed and the throughput is back to normal.
Fixed Versions:
17.0.0, 16.1.3.1, 15.1.5
1049229-1 : When you try to create a sub-rule under the Network Firewall rule list, the error: 'No Access' displays.
Links to More Info: BT1049229
Component: Advanced Firewall Manager
Symptoms:
An authenticated administrative user tries to create a sub-rule under the Network Firewall rule list from the GUI and is redirected to a 'No Access' error page.
Conditions:
This error can occur when you create a sub-rule under the Network Firewall rule list in the TMOS GUI on a version of BIG-IP (including engineering hotfixes) that include the fixes for BIG-IP bugs ID1032405 and ID941649.
Impact:
The user cannot create a sub-rule under the Network Firewall rule list in the TMOS GUI.
Workaround:
Use the TMOS Shell (tmsh) command-line interface to perform the equivalent action.
Fix:
After the fixes for ID1032405 and ID941649 are installed, the "No Access" errors no longer occur when you create a sub-rule under the Network Firewall rule list in the TMOS GUI.
Fixed Versions:
17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5
1048853-1 : "IKE VBUF" memory leak debug.
Links to More Info: BT1048853
Component: TMOS
Symptoms:
The memory increase is seen through tmctl memory_usage_stat when ipsec-sa are deleted and new ipsec-sa are created.
Conditions:
A tunnel connection exists between the BIG-IP initiator and responder.
Impact:
Memory consumption increases after every ipsec-sa delete operation when the new ipsec-sa is created.
Workaround:
N/A
Fix:
Fixed a memory leak related to ipsec-sa.
Fixed Versions:
17.0.0, 16.1.3.1, 15.1.7
1048685-4 : Rare TMM crash when using Bot Defense Challenge
Links to More Info: BT1048685
Component: Application Security Manager
Symptoms:
When using the Bot Defense Profile on Blocking mode, TMM could crash on rare cases with a core dump.
Conditions:
Using the Bot Defense profile on blocking mode.
Impact:
Traffic disrupted while tmm restarts.
Workaround:
None
Fix:
TMM will no longer crash on rare conditions when using the Bot Defense Challenge
Fixed Versions:
17.0.0, 16.1.3.1, 15.1.7
1048541-1 : Certificate Order Manager: renew requests to the Comodo (now Sectigo) CA are unsuccessful.
Links to More Info: BT1048541
Component: TMOS
Symptoms:
A BIG-IP Administrator utilizing the 'Certificate Order Manager' feature is unable to renew SSL certificates issued by the Comodo (now Sectigo) certification authority.
Conditions:
Using the 'Certificate Order Manager' feature on BIG-IP to renew SSL certificates issued by the Comodo (now Sectigo) certification authority.
Impact:
The renew requests fail.
Fix:
The renew requests now succeed.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1
1048445-1 : Accept Request button is clickable for unlearnable violation illegal host name
Links to More Info: BT1048445
Component: Application Security Manager
Symptoms:
For the following violations:
- VIOL_HOSTNAME (Hostname violation)
- VIOL_HOSTNAME_MISMATCH (Hostname mismatch violation)
The accept button is clickable when it should not. Accept Request button should be disabled for this violations.
Conditions:
Generate an illegal host name or hostname mismatch violation.
Impact:
Request will not be accepted even though you have elected to accept the illegal request.
Workaround:
Do not accept the request to hostname and hostname mismatch violation, no ASM config changes will be triggered.
Fixed Versions:
17.1.0, 16.1.2.2, 15.1.6.1
1048433-1 : Improve Extract logic of thales-sync.sh to support VIPRION cluster to support 12.6.10 client installation.★
Links to More Info: BT1048433
Component: Local Traffic Manager
Symptoms:
The thales-sync.sh script tries to install on the second blade eventually The packages provided by formerly Thales now nShield/Entrust are increasing version to version, The extract logic is not compatible with to latest versions.
Conditions:
While upgrading lower versions to 12.60.
Impact:
The installation script will fail to find to extract packages.
Workaround:
N/A
Fix:
Extract all the tarballs in the target directory to resolve the issue.
Fixed Versions:
16.1.2.1, 15.1.5.1
1048141-3 : Sorting pool members by 'Member' causes 'General database error'
Links to More Info: BT1048141
Component: TMOS
Symptoms:
The configuration utility (web UI) returns 'General database error' when sorting pool members. The pool member display does not work for the duration of the login.
Conditions:
Sorting the pool member list by member.
Impact:
A pool's pool member page cannot be displayed.
Workaround:
Clear site and cached data on browser and do not sort by pool member.
Fix:
Pool members can be sorted by member.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6
1048137-2 : IPsec IKEv1 intermittent but consistent tunnel setup failures
Links to More Info: BT1048137
Component: TMOS
Symptoms:
IKEv1 tunnels fail to start or re-key after an upgrade.
In the racoon.log file a clear sign of this issue is the combination of an IPsec SA being established and a buffer space error immediately after:
INFO: IPsec-SA established: ESP/Tunnel 172.16.1.6[0]->172.16.12.6[0] spi=2956426629(0xb0377d85)
ERROR: pfkey UPDATE failed: No buffer space available
Conditions:
-- IPsec IKEv1 tunnels
Impact:
IPsec tunnels will stop working after being up for an initial period of time.
Workaround:
The only workaround is to switch to IKEv2.
Fix:
Internal message handling related to IKEv2 high availability (HA) has changed, unintentionally breaking IKEv1's ability to keep tunnel states up-to-date. IKEv1 can now track tunnel state correctly.
Note: IKEv1 high availability (HA) / mirroring is still not supported and there is no plan to support it.
Fixed Versions:
17.0.0, 16.1.3.1
1048033-1 : Server-speaks-first traffic might not work with SSL Orchestrator
Links to More Info: BT1048033
Component: SSL Orchestrator
Symptoms:
Server-speaks-first traffic does not pass through BIG-IP SSL Orchestrator. BIG-IP does not do service chaining to the service that has port-remap enabled.
Conditions:
- Interception Rule has verified accept enabled.
- Security policy is service chaining and port-remap is enabled on one of the security services
Impact:
Connection does not succeed, client sees a reset after timeout.
Workaround:
Disable port-remap on service and redeploy.
Fix:
Fix SSL Orchestrator connector to handle server-speaks-first traffic. After fix, server speaks first traffic will work even with port-remap enabled on the service.
Fixed Versions:
17.0.0, 16.1.2.2
1047581-3 : Ramcache can crash when serving files from the hot cache
Links to More Info: BT1047581
Component: Local Traffic Manager
Symptoms:
Under certain circumstances, TMM may crash when processing traffic for a virtual server that uses RAM Cache.
Conditions:
- RAM Cache configured
- Document served not out of the hotcache
- The server served with must-revalidate.
- The server 304 contains a 0 byte gzip payload
Impact:
Traffic disrupted while tmm restarts.
Workaround:
None
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5
1047389-4 : Bot Defense challenge hardening
Links to More Info: BT1047389
Component: Application Security Manager
Symptoms:
Under certain conditions, the Bot Defense profile does not follow current best practices.
Conditions:
Bot Defense profile used
Impact:
The Bot Defense profile does not follow current best practices.
Workaround:
None
Fix:
The Bot Defense profile now follows current best practices.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6
1047377-1 : "Server-speak-first" traffic might not work with SSL Orchestrator
Links to More Info: BT1047377
Component: SSL Orchestrator
Symptoms:
Server-speaks-first traffic does not pass through BIG-IP SSL Orchestrator. BIG-IP does not perform a TCP three-way handshake to the server.
Conditions:
SSL Orchestrator interception rule has an attached security policy that is service chaining and at-least one service has port-remap enabled.
Impact:
Connection does not succeed, client sees a reset after timeout.
Workaround:
Disable port-remap on service and redeploy.
Fix:
Fix SSL Orchestrator connector to handle server speaks first traffic. After fix, server-speaks-first traffic will work even with port-remap enabled on the service.
Fixed Versions:
17.0.0, 16.1.2.2
1047213-1 : VPN Client to Client communication fails when clients are connected to different TMMs.
Links to More Info: BT1047213
Component: TMOS
Symptoms:
Client-to-client communication between APM VPN clients connected to different TMMs does not work.
Conditions:
-- Clustered multiprocessing (CMP) is enabled.
Impact:
Client to client communication over the network access connection fails.
Workaround:
Demote the virtual server from CMP processing.
# tmsh modify ltm virtual <virtual> cmp-enabled no
Fix:
N/A
Fixed Versions:
17.0.0, 16.1.2.2
1047169-1 : GTM AAAA pool can be deleted from the configuration despite being in use by an iRule.
Links to More Info: BT1047169
Component: TMOS
Symptoms:
A BIG-IP Administrator is incorrectly able to delete a GTM AAAA pool from the configuration, despite this object being referenced in an iRule in use by an AAAA wideip.
An error similar to the following example will be visible in the /var/log/gtm file should the iRule referencing the pool run after the pool has been deleted:
err tmm[11410]: 011a7001:3: TCL error: Rule /Common/my_rule <DNS_REQUEST> - GTM Pool 'my_pool' of type 'A' not found (line 1)GTM Pool 'my_pool' of type 'A' not found (line 1) invoked from within "pool my_pool"
Note the error message incorrectly reports the pool as type A (it should report type AAAA).
Conditions:
-- Two GTM pools of type A and AAAA share the same exact name (which is legal).
-- The pool name is referenced in an iRule by the 'pool' command.
-- The iRule is in use by an AAAA wideip.
-- A BIG-IP Administrator attempts to delete the AAAA pool.
Impact:
The system incorrectly allows the deletion of the AAAA pool from the configuration.
Consequently, the next time the GTM configuration is reloaded from file, the operation will fail.
Additionally, traffic which relied on the pool being present in the configuration will fail.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
1046785-1 : Missing GTM probes when max synchronous probes are exceeded.
Links to More Info: BT1046785
Component: Global Traffic Manager (DNS)
Symptoms:
GTM probes are missing, resources are marked down.
When instances fail and BIG-IP is not aware of the failure, some virtual servers/pool members are marked as available and some objects are marked down on part of the sync group members.
In the /var/log/gtm file, the following message may be seen:
011ae116:4: The list processing time (x seconds) exceeded the interval value. There may be too many monitor instances configured with a y second interval
Note that this message is only logged once when gtmd is restarted, or when monitors are added or removed in the gtm configuration.
Conditions:
Max synchronous probes are exceeded. This value is controlled by the GTM global variable max-synchronous-monitor-requests.
Impact:
-- Resources are marked down.
-- Inconsistent monitor statuses across BIG-IP DNS systems in a single sync group, with some showing 'big3d: timed out' and others potentially showing a stale up or down status for the same targets.
-- Because some monitor instances don't have monitor traffic, if an instance fails, the BIG-IP DNS systems may not be aware of the failure.
Workaround:
Increase the value of Max Synchronous Monitor Requests:
tmsh modify gtm global-settings metrics max-synchronous-monitor-requests value <value - default is 20>
Fix:
All monitors are now allowed to probe without triggering a failure.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.5, 13.1.5
1046693-4 : TMM with BFD confgured might crash under significant memory pressure
Links to More Info: BT1046693
Component: TMOS
Symptoms:
TMM might crash when processing BFD traffic under high memory pressure.
Conditions:
- BFD in use.
- TMM under high memory pressure.
Impact:
Traffic disrupted while tmm restarts.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
1046669-1 : The audit forwarders may prematurely time out waiting for TACACS responses
Links to More Info: BT1046669
Component: TMOS
Symptoms:
If a TACACS server takes longer than five seconds to respond, the audit forwarder will reset the connection.
Conditions:
-- Using remote TACACS logging.
-- TACACS server takes longer than 5 seconds to respond to logging requests.
Impact:
Misleading log messages.
Fix:
The time that a BIG-IP system will wait for a response from a TACACS server is now configurable using the DB variable config.auditing.forward.tacacs.timeout.response.
Behavior Change:
The time that a BIG-IP system will wait for a response from a TACACS server is now configurable using the DB variable config.auditing.forward.tacacs.timeout.response.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
1046317-2 : Violation details are not populated with staged URLs for some violation types
Links to More Info: BT1046317
Component: Application Security Manager
Symptoms:
The "Triggered Violations" field in the event log screen and corresponding data in remote logging is not populated.
Conditions:
- The URL is in staging
- The triggered violation is one of the following violations
VIOL_MANDATORY_REQUEST_BODY
VIOL_URL_CONTENT_TYPE
VIOL_METHOD
Impact:
Lack of details in the request log event.
Workaround:
None
Fix:
This defect is closely related to ID1036305 and both defects are fixed together
Fixed Versions:
17.0.0, 16.1.3.1, 15.1.6.1
1045549-4 : BFD sessions remain DOWN after graceful TMM restart
Links to More Info: BT1045549
Component: TMOS
Symptoms:
BFD sessions remain DOWN after graceful TMM restart
Conditions:
TMM is gracefully restarted, for example with 'bigstart restart tmm' command.
Impact:
BFD sessions remain DOWN after graceful TMM restart
Workaround:
After restarting TMM, restart tmrouted.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
1045421-1 : No Access error when performing various actions in the TMOS GUI
Links to More Info: K16107301, BT1045421
Component: TMOS
Symptoms:
An authenticated administrative user is redirected to a 'No Access' error page while performing various actions in the TMOS GUI, including when trying to:
-- Apply a policy to a virtual server
-- Import images (TMOS images / hotfixes / apmclients)
-- Export/apply an APM policy
-- Run the high availability (HA) setup wizard
-- Export a certificate/key through one of the following paths:
---- System / Certificate Management : Traffic Certificate Management : SSL Certificate List / test-renew-self-sign / Renew
---- DNS / GSLB : Pools : Pool List / Click Testpool / Click Members / Click Manage
---- System / Software Management : APM Clients / Import
---- System / Certificate Management : Traffic Certificate Management : SSL Certificate List / NewSSLCert / Certificate / Export / Click Download
Conditions:
This may occur when performing various actions in the TMOS GUI on a version of BIG-IP software (including Engineering Hotfixes) that includes fixes for ID1032405 :: https://cdn.f5.com/product/bugtracker/ID1032405.html and ID941649 :: https://cdn.f5.com/product/bugtracker/ID941649.html .
Impact:
Cannot perform various actions in the TMOS GUI.
Workaround:
Use the TMOS Shell (tmsh) command-line interface to perform the equivalent action.
Fix:
'No Access' errors no longer occur when performing various actions in the TMOS GUI under these conditions.
Fixed Versions:
17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5
1045229-1 : APMD leaks Tcl_Objs as part of the fix made for ID 1002557
Links to More Info: BT1045229
Component: Access Policy Manager
Symptoms:
APMD memory grows over time causing OOM killer to kill apmd
Conditions:
Access policy has resource assignment agents/variable assignments
Impact:
APMD memory grows over time and OOM killer may terminate apmd thereby affecting traffic. Access traffic disrupted while apmd restarts.
If APMD is not killed by OOM killer the system may start thrashing and become unstable, generally resulting in cores from innocent processes that are no longer scheduled correctly - keymgmtd, bigd, mcpd are typical victims.
Ultimately system may restart automatically as watchdogs fail.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.5
1044425-1 : NSEC3 record improvements for NXDOMAIN
Links to More Info: K85021277, BT1044425
Component: Global Traffic Manager (DNS)
Symptoms:
BIG-IP DNSSEC NSEC3 records for NXDOMAIN responses can be improved to support current best practices.
Conditions:
- DNSSEC zone configured
Impact:
BIG-IP DNSSEC NSEC3 records for NXDOMAIN responses do not follow current best practices.
Workaround:
N/A
Fix:
BIG-IP DNSSEC NSEC3 records for NXDOMAIN responses now follow current best practices.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
1044121-3 : APM logon page is not rendered if db variable "ipv6.enabled" is set to false
Links to More Info: BT1044121
Component: Access Policy Manager
Symptoms:
When accessing a Virtual Server with an access policy, users are redirected to the hangup page.
Conditions:
Db variable "ipv6.enabled" is set to false
Impact:
Users will not be able to access the virtual server and associated resources behind it.
Workaround:
Keep the value of db variable "ipv6.enabled" set to true.
# setdb "ipv6.enabled" true
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.5
1043805-3 : ICMP traffic over NAT does not work properly.
Links to More Info: BT1043805
Component: Local Traffic Manager
Symptoms:
ICMP traffic hitting a NAT translation address is dropped and not sent further to the originating address.
Conditions:
-- An LTM NAT is configured.
-- ICMP traffic arrives.
Impact:
ICMP traffic fails to be forwarded over the NAT.
Fixed Versions:
17.0.0, 16.1.3.1, 15.1.7, 14.1.5.1
1043533-3 : Unable to pick up the properties of the parameters from audit reports.
Links to More Info: BT1043533
Component: Application Security Manager
Symptoms:
In the GUI under Security ›› Application Security : Audit : Reports, if you select "User-input parameters..." in the menu "Security Policy Audit Reports", then click on the parameter to retrieve the properties, you will see this error:
" Could not retrieve parameter; Could not get the Parameter, No matching record was found."
Conditions:
1) Create a new parameter.
2) Customize or overwrite an existing ASM signature for the parameter in question.
3) Save and apply to the policy the new changes
4) Go to:
Security ›› Application Security : Audit : Reports
Report Type : User-input parameters with overridden attacks signatures (this also happens for other "User-input parameters...")
Select the parameter to audit
Error: "Could not retrieve parameter; Could not get the Parameter, No matching record was found."
Impact:
A page error occurs.
Workaround:
1. Open in a separate tab the following screen: Security ›› Application Security : Parameters : Parameters List
2. Under "Parameter List" title, there is a filter dropdown with the "Parameter Contains" texting.
3. On the blank part (before "Go" button) type the name of the required parameter.
4. You will get the desired page with the desired parameter properties.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1
1043385-4 : No Signature detected If Authorization header is missing padding.
Links to More Info: BT1043385
Component: Application Security Manager
Symptoms:
If the Authentication scheme value in the Authorization header contains extra/missing padding in base64, then ASM does not detect any attack signatures.
Conditions:
HTTP request with Authorization header contains base64 value with extra/missing padding.
Impact:
Attack signature not detected.
Workaround:
N/A
Fix:
Base64 values with extra/missing padding has been handled to detect attack signature
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
1043357-4 : SSL handshake may fail when using remote crypto client
Links to More Info: BT1043357
Component: Local Traffic Manager
Symptoms:
ServerSSL handshake fails when verifying ServerKeyExchange message.
Conditions:
Remote crypto client is configured and the ServerSSL profile connects using an ephemeral RSA cipher suite.
Impact:
The virtual server is unable to connect to the backend server.
Workaround:
Use non-ephemeral RSA or ECDSA cipher suite on ServerSSL.
Fix:
Fix remote crypto client.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6
1043217-1 : NTLM frontend auth fails with the latest Microsoft RDP client on MacOS 14.0.1 platform
Links to More Info: BT1043217
Component: Access Policy Manager
Symptoms:
NTLM frontend auth fails with the latest Microsoft RDP client on MacOS 14.0.1 platform
Conditions:
Windows Server configured as a back-end and BIG-IP is acting as an RDP gateway. After recent upgrade of MacOS Client (iOS 14.0.1), the Remote desktop starts failing.
Latest Microsoft RDP clients mandate below three flags as part of NTLM CHALLENGE message which will sent from NTLM Auth Server/Proxy
1.NTLMSSP_NEGOTIATE_KEY_EXCH
2.NTLMSSP_NEGOTIATE_VERSION
3.NTLMSSP_REQUEST_TARGET
Due to this, RDP client rejecting the NTLM challenge, and authentication is failing.
Impact:
Users won't be able to establish RDP sessions to the backend Windows Server
Fix:
Updated the ECA (NTLM frontend auth service) to include these flags as part of NTLM Challenge.
Fixed Versions:
17.0.0, 16.1.3.1, 15.1.6.1, 14.1.5.1
1043205-1 : SSRF Violation should be shown as a Parameter Entity Reference.
Links to More Info: BT1043205
Component: Application Security Manager
Symptoms:
SSRF Violation is shown as a URL Entity Reference instead of a Parameter Entity Reference.
Conditions:
- Create a URI data type parameter
- Add a host to the SSRF Host List
- Send traffic which contains the URI parameter with the value configured in the SSRF Host List
Impact:
Wrong Entity Reference in the SSRF violation is misleading.
Workaround:
N/A
Fix:
Corrected the Entity reference as a parameter instead of a URL in the SSRF violation.
Fixed Versions:
16.1.2.1
1043017-4 : Virtual-wire with standard-virtual fragmentation
Links to More Info: BT1043017
Component: Local Traffic Manager
Symptoms:
A standard virtual-server configured on top of a virtual-wire has unexpected handling of fragmented IP traffic.
Conditions:
Standard virtual-server configured on top of a virtual-wire handling fragmented IP traffic.
Impact:
- Fragments missing on egress.
- Packet duplication on egress.
Workaround:
Use fastl4 virtual-server instead.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1, 14.1.4.6
1042917-1 : Using 'Full Export' of security policy should result with no diffs after importing it back to device.
Links to More Info: BT1042917
Component: Application Security Manager
Symptoms:
'Declarative policy import' is adding entities into the policy according what it has in the JSON file.
When it imports the policy builder settings, some automatic changes are created in the policy, and it may override other entities which were added before.
Conditions:
Policy builder settings are added in import after other affected entities were added before.
Impact:
The resulted policy will be different from the exported policy.
Workaround:
N/A
Fix:
'Declarative Policy import' first adds the policy builder settings, and all other affected entities are imported only after it, and in this way the resulted policy is the same as the exported one.
Fixed Versions:
17.0.0, 16.1.2
1042913-2 : Pkcs11d CPU utilization jumps to 100%
Links to More Info: BT1042913
Component: Local Traffic Manager
Symptoms:
CPU utilization of pkcs11d increases to 100%.
Conditions:
This occurs when pkcs11d is disconnected from the external HSM.
Impact:
As the pkcs11d consumes most of the CPU, other processes are starved for CPU.
Workaround:
None.
Fix:
Pkcs11d no longer consumes 100% CPU when it is disconnected from the external HSM.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5
1042737-4 : BGP sending malformed update missing Tot-attr-len of '0.
Links to More Info: BT1042737
Component: TMOS
Symptoms:
BIG-IP might send a malformed BGP update missing Tot-attr-len of '0 when performing a soft reset out.
Conditions:
-- Multiple traffic groups configured.
-- A BGP soft reset occurs.
Impact:
BGP peering resets.
Fixed Versions:
17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7
1042605-1 : ASM Critical Warnings during UCS load after upgrade to v15.1.0 or above★
Links to More Info: BT1042605
Component: Application Security Manager
Symptoms:
Following an upgrade, an error occurs:
ERROR: Failed during loading ASM configuration.
An "ASM critical warning" banner is displayed in the ASM GUI.
Conditions:
-- ASM is upgraded to v15.1.0 or above
-- The following query returns results prior to upgrading:
SELECT policy_name_crc FROM DCC.ACCOUNTS accounts WHERE policy_name NOT IN (SELECT name FROM PLC.PL_POLICIES)
Impact:
ASM upgrade is aborted due to an exception:
Can't call method "clear_traffic_data" on unblessed reference
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1
1042509-1 : On an HTTP2 gateway virtual server, TMM does not ever update the stream's window for a large POST request
Links to More Info: BT1042509
Component: Local Traffic Manager
Symptoms:
On an HTTP2 gateway virtual server (HTTP/2 on clientside, no httprouter profile), TMM does not update the stream's window (i.e. acking data at the HTTP/2 stream layer). This causes large HTTP requests with payloads (i.e. POSTs) to stall and eventually time out.
TMM does sometimes send WINDOW_UPDATE messages for the entire connection, but not for the stream. Since flow control is required at both the connection and stream levels, the client stalls out.
Conditions:
-- Virtual server with HTTP2 profile
-- Configured as HTTP2 Gateway (HTTP2 profile on clientside and no 'httprouter' profile)
-- Client sends large data transfer to the virtual server
Impact:
Client data transfer through HTTP/2 virtual server (POST / PUT / etc) fails.
Workaround:
Use an HTTP router profile (assign the 'httprouter' profile to the virtual server, or select the 'HTTP MRF Router' option in TMUI)
Fixed Versions:
17.0.0, 16.1.2.2
1042069-1 : Some signatures are not matched under specific conditions.
Component: Application Security Manager
Symptoms:
Some signatures are not matched and attack traffic can pass through.
Conditions:
There are more than 20 signatures that have a common keyword with a signature that does not match (and has a common keyword and a new keyword).
Impact:
Attacking traffic can bypass the WAF.
Workaround:
N/A
Fix:
Attack signatures that share words with other attack signatures will be matched correctly now.
Fixed Versions:
17.0.0, 16.1.2.1, 15.1.4.1, 14.1.4.5, 13.1.5
1042009-1 : Mcpd fails to reply if a request is proxied to another daemon and the connection to that daemon closes
Links to More Info: BT1042009
Component: TMOS
Symptoms:
Mcpd does not reply to the request if the publisher's connection closes/fails, in this case when bcm56xxd
is restarted. The perceivable signs of the failure are the snmpwalk failing with a timeout and the
"MCPD query response exceeding" log messages
Conditions:
1) Configure snmp on the BIG-IP so you can run snmpwalk locally on the BIG-IP.
2) From one session on the BIG-IP, run a snmpwalk in the while loop.
while true;do date; snmpwalk -v2c -c public 127.0.0.1 sysDot1dbaseStat;sleep 2;done
Sample output:
Sat Aug 21 00:57:23 PDT 2021
F5-BIGIP-SYSTEM-MIB::sysDot1dbaseStatResetStats.0 = INTEGER: 0
F5-BIGIP-SYSTEM-MIB::sysDot1dbaseStatMacAddr.0 = STRING: 0:23:e9:e3:8b:41
F5-BIGIP-SYSTEM-MIB::sysDot1dbaseStatNumPorts.0 = INTEGER: 12
F5-BIGIP-SYSTEM-MIB::sysDot1dbaseStatType.0 = INTEGER: transparentonly(2)
3) From a second session on the BIG-IP restart bcm56xxd
bigstart restart bcm56xxd
4a) the snmpwalk will continually report the following:
Timeout: No Response from 127.0.0.1
And snmpd will continually log "MCPD query response exceeding" every 30 seconds in /var/log/ltm
Impact:
SNMP stopped responding to queries after upgrade
Workaround:
Snmpd restart
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
1041865-4 : Correctable machine check errors [mce] should be suppressed
Links to More Info: K16392416, BT1041865
Component: TMOS
Symptoms:
Log emerg in kern.log similar to:
emerg kernel: mce: [Hardware Error]: CPU 0: Machine Check: 0 Bank 10: cc003009000800c1
Conditions:
Correctable errors can be identified by analyzing the 16‐bit value shown in bits [31:16] of the 64‐bit error from the /var/log/kern.log message. There are many types of correctable errors that are not service impacting. Correctable errors are part of the ECC DIMM technology. The following is an example of a correctable error.
An example is shown below.
Log error matches this pattern:
Machine Check: 0 [bank number]: [cc003009][0008][00c1]
bits [31:16] = 0008
Impact:
Correctable errors are logged in kern.log and to the console. There is no functional impact.
Workaround:
If the error message matches the signature in the example above, an RMA is not needed.
If the error message does not match that signature, check the system's traffic condition and confirm there is no negative performance impact. If no performance impact is observed then it means the error is a correctable error and an RMA is not required.
F5 recommends that you upgrade to a fixed TMOS version, then check that the error message is eliminated. For more information, see K16392416: Memory errors and MCE errors
Fix:
Fixed “correctable MCE error suppressed” errors.
Fixed Versions:
17.0.0, 16.1.3.1, 15.1.7
1041765-2 : Racoon may crash in rare cases
Links to More Info: BT1041765
Component: TMOS
Symptoms:
Racoon may crash when NAT Traversal is on and passing IPsec traffic in IKEv1.
Conditions:
-- IKEv1 IPsec tunnel configured
-- NAT Traversal is on in ike-peer configuration.
Impact:
Racoon will crash and any IKEv1 tunnels will restart
Workaround:
Use IKEv2 only.
Fix:
This racoon crash has been stopped.
Fixed Versions:
17.0.0, 16.1.2.1
1041149-1 : Staging of URL does not affect apply value signatures
Links to More Info: BT1041149
Component: Application Security Manager
Symptoms:
When a URL is staged and a value content signature is detected, the matched request is blocked.
Conditions:
-- URL is set to staging;
-- Only default ("Any") content profile is present, set to apply value signatures (all other content profiles deleted);
-- Request matches attack signature
Impact:
The request for staged URL is blocked
Workaround:
Configure relevant content profiles or leave the default content profiles configuration.
Fix:
Fixed to correctly handle URL staging in case of only "Any" content profile.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1
1040821-4 : Enabling an iRule or selecting a pool re-checks the "Address Translation" and "Port Translation" checkboxes
Links to More Info: BT1040821
Component: TMOS
Symptoms:
Address Translation and Port Translation checkboxes are automatically checked under the virtual server's advanced configuration.
Conditions:
Virtual Server's Advanced configuration option is selected followed by adding an iRule or a pool.
Impact:
The Address and Port translation options are automatically checked when the default is to have them unchecked.
Workaround:
Manually un-check Address Translation and Port Translation checkboxes under virtual server's advanced configuration
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
1040677 : BIG-IP D120 platform reports page allocation failures in N3FIPS driver
Links to More Info: BT1040677
Component: Local Traffic Manager
Symptoms:
Despite having free memory, the BIG-IP system logs kernel page allocation failures to the /var/log/kern.log file. The first line of the output appears similar to the following example:
swapper/6: page allocation failure: order:2, mode:0x204020
After that, a stack trace follows. The process name in the line ('swapper/16', in this example). You may see generic Linux processes or processes specific to F5 in that line.
Conditions:
This issue is known to occur on the appliance D120 (iSeries i15820-DF).
Impact:
As different processes can experience this issue, and the system may behave unpredictably. Software installation may fail.
Workaround:
You can work around this issue by increasing the value of the min_free_kbytes kernel parameter. This controls the amount of memory that is kept free for use by special reserves.
It is recommend to increase this to 128 MB (131072 KB).
When instantiating this workaround, consider whether you want the workaround to survive only reboots, or to survive reboots, upgrades, RMAs, etc. This is an important consideration to make, as you should stop using this workaround when this issue is fixed in a future version of BIG-IP software. So consider the pros and cons of each approach before choosing one.
-- If you want the workaround to survive reboots only, perform the following procedure:
1) Log on to the advanced shell (BASH) of the primary blade of the affected system.
2) Run the following commands (with the desired amount in KB):
# clsh "sysctl -w vm.min_free_kbytes=131072"
# clsh "echo -e '\n# Workaround for ID 851785' >> /etc/sysctl.conf"
# clsh "echo 'vm.min_free_kbytes = 131072' >> /etc/sysctl.conf"
-- If you want the workaround to survive reboots, upgrades, RMAs, etc., perform the following procedure:
1) Log on to the advanced shell (BASH) of the primary blade of the affected system.
2) Run the following commands (with the desired amount in KB):
# clsh "sysctl -w vm.min_free_kbytes=131072"
# echo -e '\n# Workaround for ID851785' >> /config/startup
# echo 'sysctl -w vm.min_free_kbytes=131072' >> /config/startup
Note that the last two commands are not wrapped inside 'clsh' because the /config/startup file is already automatically synchronized across all blades.
Once the issue is fixed in a future BIG-IP version, remove the workarounds:
-- To remove the first workaround:
1) Edit the /etc/sysctl.conf file on the BIG-IP appliance and remove the added lines at the bottom.
2) Reboot the system by running 'clsh reboot'. This will restore the min_free_kbytes kernel parameter to its default value for the BIG-IP version you are running.
-- To remove the second workaround:
1) Edit the /config/startup file on the BIG-IP appliance and remove the extra lines at the bottom.
2) Reboot the system by running 'clsh reboot'. This restores the min_free_kbytes kernel parameter to its default value for the BIG-IP version you are running.
To verify the workaround is in place, run the following command (this should return the desired amount in KB):
# clsh "cat /proc/sys/vm/min_free_kbytes"
Fix:
The BIG-IP system no longer experiences excessive kernel page allocation failures.
Fixed Versions:
17.0.0, 16.1.1
1040513-5 : The counter for "FTP commands" is always 0.
Links to More Info: BT1040513
Component: Application Security Manager
Symptoms:
On the FTP Statistics page, the "FTP Commands" value is always zero.
Conditions:
FTP security is applied and "FTP commands violations" is enforced.
Impact:
The FTP security does not show violations statistics regarding the FTP commands.
Workaround:
None
Fix:
"FTP commands statistics" now shows an accurate value in the UI.
Fixed Versions:
17.1.0, 17.0.0.1, 16.1.3.1, 15.1.6.1, 14.1.5.1
1040361-1 : TMM crashes during its startup when TMC destination port list attached/deleted to virtual server.
Links to More Info: BT1040361
Component: Local Traffic Manager
Symptoms:
-- Log message written to TMM log file:
panic: ../kern/page_alloc.c:736: Assertion "vmem_hashlist_remove not found" failed.
Conditions:
-- Virtual Server using a traffic-matching-criteria (TMC) with a destination-port-list, with multiple distinct ranges of ports.
-- Config changes to virtual server with traffic-matching criteria can cause memory corruption which can lead to delayed TMM crashes.
Impact:
Traffic disrupted while tmm restarts.
Workaround:
Do not use Traffic Matching Criteria with destination port lists.
TMM restart is required in case the virtual server is modified with traffic-matching-criteria related config.
Fix:
TMM no longer crashes under these conditions.
Fixed Versions:
17.0.0, 16.1.2, 15.1.5, 14.1.4.5
1039725-1 : Reverse proxy traffic fails when a per-request policy is attached to a virtual server.
Links to More Info: BT1039725
Component: Access Policy Manager
Symptoms:
Reverse proxy or inbound traffic fails during SSL renegotiation when a per-request policy is attached to the virtual server.
Conditions:
-- SSL Orchestrator is licensed and provisioned.
-- Per-request policy is attached to virtual server.
-- Client or backend server initiates SSL renegotiation.
Impact:
Reverse proxy traffic fails during SSL renegotiation.
Workaround:
If renegotiation is not required then it can be disabled on BIG-IP. The client SSL and server SSL profiles have 'Renegotiation' settings. If it is set to disabled, BIG-IP or SSL Orchestrator does not do SSL renegotiation.
Fix:
Reverse proxy or inbound traffic no longer fails during SSL renegotiation when per-req policy is attached to the virtual server.
Fixed Versions:
17.0.0, 16.1.3.1
1039553-1 : Non-200 HTTP status codes fail to be matched by GTM HTTP(S) monitors
Links to More Info: BT1039553
Component: Global Traffic Manager (DNS)
Symptoms:
GTM virtual servers have the wrong status (up when they should be down, or down when they should be up, depending on the monitor's configuration).
Conditions:
-- The GTM virtual servers are monitored with an HTTP or HTTPS monitor that performs HTTP status matching.
-- The monitor tries to match an HTTP status code other than 200 (for example, 301).
-- The monitor uses HTTP version 1.0 or 1.1 for the request (the default is 0.9).
Impact:
The system incorrectly considers all non-200 responses a failed monitor attempt, despite what the user specified as acceptable status codes in the monitor's configuration. As a result, the availability status reported for a virtual server may be incorrect. This may cause the GTM system to send traffic to unsuitable resources causing application disruptions.
Workaround:
You can work around this issue in any of the following ways:
-- Use HTTP version 0.9 for the monitor requests.
-- Match on the 200 HTTP status code.
-- Do not use HTTP status matching altogether.
Fix:
GTM HTTP(S) monitors using HTTP version 1.0 or 1.1 can now successfully match status codes other than 200 in the response.
Fixed Versions:
17.0.0, 16.1.2.1, 15.1.5
1039329-2 : MRF per peer mode is not working in vCMP guest.
Links to More Info: BT1039329
Component: Service Provider
Symptoms:
MRF diameter setup, in peer profile "auto-initialization" and "per peer" mode are enabled, but no connection attempts towards the pool member occur.
When the mode is switched to "per tmm" or "per blade", connections are established.
Conditions:
The peer connection mode in the peer profile is set to "per peer".
Impact:
The "per peer" setting does not work.
Workaround:
Switch the connection mode to "per tmm" or "per blade"
Fixed Versions:
17.0.0, 16.1.2.1, 15.1.5, 14.1.4.5
1039245-2 : Policy Properties screen does not load and display
Links to More Info: BT1039245
Component: Application Security Manager
Symptoms:
On the Security ›› Application Security : Security Policies : Policies List page, if you click one of the policies, the page gets stuck in " Loading policy general settings... "
Conditions:
This occurs if you try to view a policy that has no template associated
Impact:
Unable to use the GUI for the affected ASM policies.
Workaround:
# cp /var/ts/dms/script/dist/angular/TsuiAngularPoliciesScripts.min.js /shared/TsuiAngularPoliciesScripts.min.js.bk
# chmod 644 /var/ts/dms/script/dist/angular/TsuiAngularPoliciesScripts.min.js
# sed -i -e 's/"POLICY_TEMPLATE_GRAPHQL/p.policy.template\&\&"POLICY_TEMPLATE_GRAPHQL/' /var/ts/dms/script/dist/angular/TsuiAngularPoliciesScripts.min.js
# chmod 444 /var/ts/dms/script/dist/angular/TsuiAngularPoliciesScripts.min.js
# bigstart restart httpd
Fixed Versions:
17.0.0, 16.1.2.2
1039069-1 : Multiple issues affecting the RESOLV::lookup iRule command following the fix to ID1007049.★
Links to More Info: BT1039069
Component: Global Traffic Manager (DNS)
Symptoms:
For more information on the specific issues fixed, please refer to:
https://cdn.f5.com/product/bugtracker/ID1010697.html
https://cdn.f5.com/product/bugtracker/ID1037005.html
https://cdn.f5.com/product/bugtracker/ID1038921.html
Please note the only versions 15.1.3.1 and 16.1.0 are affected.
Conditions:
-- Running BIG-IP version 15.1.3.1 or 16.1.0
-- RESOLV::lookup iRule is used
Impact:
Multiple issues can occur with the RESOLV::lookup command, such as DNS resolutions failing or incorrect DNS responses being received.
Workaround:
None
Fix:
-
Fixed Versions:
17.0.0, 16.1.1, 15.1.4
1039049-2 : Installing EHF on particular platforms fails with error "RPM transaction failure"
Links to More Info: BT1039049
Component: TMOS
Symptoms:
-- Installing an EHF fails with the error "RPM transaction failure"
-- Errors similar to the following are seen in the liveinstall.log file:
info: RPM: /var/tmp/rpm-tmp.LooFVF: line 11: syntax error: unexpected end of file
info: RPM: error: %preun(fpga-tools-atlantis-15.1.3-0.0.11.i686) scriptlet failed, exit status 2
Conditions:
-- Installing an EHF that contains an updated version of the 'fpga-tools-atlantis' package
-- Using the following platforms:
+ BIG-IP i4600 / i4800
+ BIG-IP i2600 / i2800
+ BIG-IP i850
Impact:
EHF installation fails.
Workaround:
None
Fixed Versions:
17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5
1039041 : Log Message: Clock advanced by <number> ticks
Links to More Info: BT1039041
Component: Local Traffic Manager
Symptoms:
<ticks> is the number of milliseconds the Traffic Management Microkernel (TMM) clock is out of sync (behind) the system clock because the TMM thread is waiting for a response.
Logs are similar to below.
bigip1 notice tmm15[46856]: 01010029:5: Clock advanced by 103 ticks
bigip1 notice tmm7[46855]: 01010029:5: Clock advanced by 106 ticks
bigip1 notice tmm10[46855]: 01010029:5: Clock advanced by 107 ticks
bigip1 notice tmm25[46856]: 01010029:5: Clock advanced by 113 ticks
bigip1 notice tmm15[46856]: 01010029:5: Clock advanced by 121 ticks
bigip1 notice tmm5[46855]: 01010029:5: Clock advanced by 106 ticks
Conditions:
These logs are seen more frequently in i15820-DF platforms with FIPS enabled, in comparison to other FIPS platforms. The messages are observed during FIPS key lookup in the HSM. These lookups occur either during TMM start/restart or during SSL profile configuration modification.
Impact:
This message may appear intermittently depending on system load and conditions mentioned above, and it does not necessarily indicate system instability or a cause for concern unless accompanied by another error message or at the time of a serious event.
In all the above conditions, clock advance ticks are in the range of 100 - 170.
Fixed Versions:
17.0.0, 16.1.2
1038913-4 : The weekly ASM reporting "Security ›› Reporting : Application : Charts" filter "View By" as IP Intelligence shows only the "Safe" category
Links to More Info: BT1038913
Component: Application Visibility and Reporting
Symptoms:
In GUI "Security ›› Reporting : Application : Charts" filtering "View By" as IP Intelligence "Last Week", "Last Month" and "Last Year" reports show the "Safe" category instead of "Aggregated".
Conditions:
-- ASM is provisioned
-- The system is under heavy traffic
-- The number of stats records per report period (5 min) is higher than 10,000
Impact:
Inaccurate Last Week IPI reporting
Fixed Versions:
16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
1038741-4 : NTLM type-1 message triggers "Unparsable request content" violation.
Links to More Info: BT1038741
Component: Application Security Manager
Symptoms:
When internal parameter for "authorization header decode failure" is disabled, Valid NTLM type-1 message will be blocked with "Unparsable request content" violation.
Conditions:
Disable internal parameter ignore_authorization_header_decode_failure
Impact:
Valid NTLM Type-1 message will be blocked by ASM.
Workaround:
Enable internal parameter ignore_authorization_header_decode_failure, ASM will not block the NTLM type-1 message request
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
1038733-4 : Attack signature not detected for unsupported authorization types.
Links to More Info: BT1038733
Component: Application Security Manager
Symptoms:
ASM does not detect an Unsupported Bearer authorization type that contains header value in base64 format.
Conditions:
HTTP Request containing Bearer Authorization header which
contain a matching signature in base64 encoded format.
Impact:
ASM does not raise a violation and does not block the request.
Workaround:
N/A
Fix:
ASM decodes base64 value in Bearer Authorization header and perform attack signature matching, raises violation and block request if it contains attack.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
1038669-1 : Antserver keeps restarting.
Links to More Info: BT1038669
Component: SSL Orchestrator
Symptoms:
Antserver keeps restarting, as indicated in /var/log/ecm:
notice ant_server.sh[5898]: starting ant_server on 057caae1e95a11d7ecd1118861fb49f30ce1c22d
notice ant_server.sh[6311]: no ant_server process
notice ant_server.sh[6312]: check: no running ant_server
Conditions:
The Secure Web Gateway is provisioned on i15800 or i15820 platform.
Impact:
User connection will be reset if request or response analytics agent is deployed with per-request policy.
Workaround:
N/A
Fix:
N/A
Fixed Versions:
17.0.0, 16.1.2, 15.1.5
1038629-4 : DTLS virtual server not performing clean shutdown upon reception of CLOSE_NOTIFY from client
Links to More Info: BT1038629
Component: Local Traffic Manager
Symptoms:
With the DTLS virtual server, when client sends the CLOSE_NOTIFY alert, BIG-IP is simply closing the connection without sending the CLOSE_NOTIFY back to client as well as the backend server. This causes the backend server to not close/shutdown the connection completely.
Conditions:
This issue occurs with all DTLS virtual servers which has associated client-ssl and server-ssl profiles.
Impact:
Backend server and client will have a dangling connection for certain period of time (Based on the timeout implementation at the respective ends).
Fixed Versions:
17.0.0, 16.1.2.1, 15.1.5, 14.1.4.5, 13.1.5
1038445-1 : During upgrade to 16.1, the previous FPS Engine live update remains active★
Links to More Info: BT1038445
Component: Fraud Protection Services
Symptoms:
On a BIG-IP system with FPS JS engine Live Update, after upgrade to 16.1.x , the old live update is not replaced by the engine in the build.
Conditions:
-- BIG-IP with FPS JS engine Live Update
-- Upgrade to 16.1.x
-- FPS / DataSafe / AWAF provisioned.
Impact:
In upgrade from 15.1 or older, this sometimes results in the device staying offline.
Workaround:
Installing a new, 16.1 FPS Engine update will fix the issue (where available).
Alternatively, running these commands fixes the issue, but results in the BIG-IP going offline for a few minutes.
rm -rf /var/datasync/updates/*
touch /etc/datasync/regenerate_all
tmsh -q -c 'cd datasync-global/; delete security datasync update-file update-file-versafe_js*'
bigstart restart tmm
Fixed Versions:
17.0.0, 16.1.2.2
1037457-1 : High CPU during specific dos mitigation
Links to More Info: BT1037457
Component: Application Security Manager
Symptoms:
CPU is high.
Conditions:
A dos attack with specific characteristic is active and the policy is configured in a specific way.
Impact:
While the attack is mitigated on the BIG-IP system and does not reach the server, the CPU of the BIG-IP increases and this may impact other services on the BIG-IP device.
Workaround:
N/A
Fix:
A specific high CPU scenario during dos attacks was fixed.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
1036521-1 : TMM crash in certain cases
Links to More Info: BT1036521
Component: Application Security Manager
Symptoms:
TMM crash in certain case when dosl7 is attached
Conditions:
TMM is configured with dosl7
Impact:
Traffic disrupted while tmm restarts.
Workaround:
None
Fix:
N/A
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
1036305-5 : "Mandatory request body is missing" violation in staging but request is unexpectedly blocked
Links to More Info: BT1036305
Component: Application Security Manager
Symptoms:
Request is blocked on a staged URL for the violation "Mandatory request body is missing".
Conditions:
- "Mandatory request body is missing" violation is set for blocking
- The URL is in staging
- "Mandatory request body is missing" is enabled on the URL
Impact:
Requests are blocked unexpectedly
Workaround:
None
Fix:
This defect is closely related to ID1036305 and both defects are fixed together
Fixed Versions:
17.0.0, 16.1.3.1, 15.1.6.1
1036285-1 : Enforce password expiry after local user creation
Links to More Info: BT1036285
Component: TMOS
Symptoms:
When a local user is created, the password is not expired.
[root@bigip1:Active:Standalone] config # chage -l testuser
Last password change : Feb 02, 2021
Password expires : never
Password inactive : never
Account expires : never
Minimum number of days between password change : 0
Maximum number of days between password change : 99999
Number of days of warning before password expires : 7
Conditions:
A local user is created
Impact:
The new user's password is not set to expired automatically.
Fix:
When the local user is created, the password is expired.
Behavior Change:
When the local user is created, the password is expired.
When the user logins for the first time, the password change prompt appears.
Fixed Versions:
17.0.0, 16.1.3
1036169-4 : VCMPD rsync server max connection limit: guest "Exit flags for PID 17299: 0x500".
Links to More Info: BT1036169
Component: Local Traffic Manager
Symptoms:
Guestagentd will log the message "Exit flags for PID <PID>:0x500" in guest ltm log, if vcmp host rsync server current active connection is more than 4.
Conditions:
-- vCMP guest.
-- Rsync transfer frequency is 10 seconds between vCMP guest to vCMP host.
-- more than 4 vCMP guests.
Impact:
Guest LTM logs fill with "Exit flags for PID <PID>: 0x500".
Workaround:
N/A
Fix:
Modify sys db vcmp.dynamic_rsync_conn_allowed value false -> It will set the max connection limit to 4. (Default setting)
modify sys db vcmp.dynamic_rsync_conn_allowed value true -> It will set the max connection limit to max number of guest that slot supports.
Restart vcmpd by running 'bigstart restart vcmpd'
Fixed Versions:
17.0.0, 16.1.3.1, 15.1.6.1, 14.1.5.1
1036057-1 : Add support for line folding in multipart parser.
Links to More Info: BT1036057
Component: Application Security Manager
Symptoms:
RFC 2616 allowed HTTP header field values to be extended over multiple lines by preceding each extra line with at least one space or horizontal tab. This was then deprecated by RFC 7230.
The multipart parser of ASM does not support the multiple line header, so these requests cause false positives.
Conditions:
Multiline header in multipart request
Impact:
False positives.
Workaround:
None
Fix:
Introduced a new ASM internal parameter: multipart_allow_multiline_header
Note: default value is 0 (disabled)
Note: enabling/disabling the feature requires asm restart that triggers the unit going offline for a short time period. If the unit is a part of a high availability (HA) cluster, failover to the other unit will occur. If it is a standalone unit, traffic disruption until the unit comes back to online.
- Enable multiline header support
# /usr/share/ts/bin/add_del_internal add multipart_allow_multiline_header 1
# bigstart restart asm
- Disable multiline header support
# /usr/share/ts/bin/add_del_internal add multipart_allow_multiline_header 0
# bigstart restart asm
Behavior Change:
Introduced a new ASM internal parameter: multipart_allow_multiline_header
Note: default value is 0 (disabled)
Note: enabling/disabling the feature requires asm restart that triggers the unit going offline for a short time period. If the unit is a part of a high availability (HA) cluster, failover to the other unit will occur. If it is a standalone unit, traffic disruption until the unit comes back to online.
- Enable multiline header support
# /usr/share/ts/bin/add_del_internal add multipart_allow_multiline_header 1
# bigstart restart asm
- Disable multiline header support
# /usr/share/ts/bin/add_del_internal add multipart_allow_multiline_header 0
# bigstart restart asm
Fixed Versions:
17.1.0, 17.0.0.1, 16.1.3.1, 15.1.6.1, 14.1.5.1
1035853-1 : Transparent DNS Cache can consume excessive resources.
Links to More Info: K41415626, BT1035853
Component: Global Traffic Manager (DNS)
Symptoms:
Under certain conditions, the Transparent DNS Cache can consume excessive resources.
Conditions:
- The BIG-IP system is licensed for DNS Services
- Transparent DNS Cache is configured on a virtual server
Impact:
Excessive resource consumption, which can lead to increased server-side load.
Workaround:
N/A
Fix:
The Transparent DNS Cache now consumes resources as expected.
Fixed Versions:
17.0.0, 16.1.2, 15.1.5, 14.1.4.5, 13.1.5
1035361-4 : Illegal cross-origin after successful CAPTCHA
Links to More Info: BT1035361
Component: Application Security Manager
Symptoms:
After enabling CAPTCHA locally on BIG-IP with brute force, after configured login attempts, CAPTCHA appears, but after bypassing the CAPTCHA successfully the user receives a support ID with cross-origin violation.
Conditions:
- brute force with CAPTCHA mitigation enforced on login page.
- cross-origin violation is enforced on the login page.
- user fails to login until CAPTCHA appears
- user inserts the CAPTCHA correctly
Impact:
- blocking page appears.
- on the event log cross-origin violation is triggered.
Workaround:
- disable cross-origin violation enforcement.
Fix:
Fixing origin header offset in reconstruct challenge request.
Fixed Versions:
17.1.0, 16.1.2.2, 15.1.5.1, 14.1.5
1035133-4 : Statistics data are partially missing in various BIG-IQ graphs under "Monitoring" tab
Links to More Info: BT1035133
Component: Application Visibility and Reporting
Symptoms:
In various BIG-IQ GUI forms under the "Monitoring" tab (for example Monitoring -> Local Traffic -> HTTP), data for some time periods are missing.
Multiple "Unexpected end of ZLIB input stream" errors appear in BIG-IQ DCD logs under /var/log/appiq/gc_agent-manager.log
Conditions:
BIG-IP is attached to BIG-IQ, traffic volume is high
Impact:
Data in BIG-IQ are missing therefore some graphs show incorrect information
Workaround:
None
Fix:
Fixed an issue with missing statistics.
Fixed Versions:
17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5
1034941-1 : Exporting and then re-importing "some" XML policy does not load the XML content-profile properly
Links to More Info: BT1034941
Component: Application Security Manager
Symptoms:
Exporting and then re-importing an existing ASM policy in XML format does not load its XML content-profile properly. An XML content-profile containing a firewall configuration shows the 'Import URL' as N/A for most .xsd files.
Conditions:
Corner case, when the second import_url value is null
Impact:
The import_url field is set as N/A for all files, except for the first one
Workaround:
None
Fix:
Fixed incorrect XML export when we've multiple import_url in content-profile
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
1034617-1 : Login/Security Banner text not showing in console login.
Links to More Info: BT1034617
Component: TMOS
Symptoms:
Setting the Login/Security Banner causes the banner to appear when connecting via the management port and not when connecting via the console.
Conditions:
-- The login banner is configured.
-- You log into the command line.
Impact:
Mismatch in displaying banner text with management and console logins.
Workaround:
Configure an identical banner for ssh sessions by following https://support.f5.com/csp/article/K6068.
Fix:
The banner text now displays for both management and console logins.
Fixed Versions:
17.0.0, 16.1.2
1034589-1 : No warning is given when a pool or trunk that was in use by an high availability (HA) Group is deleted from the configuration.
Links to More Info: BT1034589
Component: TMOS
Symptoms:
It is possible to delete a Pool or Trunk from the configuration while one or more high availability (HA) Groups still reference it.
As a result, the configuration of affected high availability (HA) Groups is automatically and silently adjusted (i.e. the deleted object is no longer referenced by any high availability (HA) Group).
The lack of warning about this automatic change could lead to confusion.
Conditions:
A pool or trunk is deleted from the configuration while still being referenced from a high availability (HA) Group.
Impact:
The automatic and silent removal of the deleted object from all high availability (HA) Groups may go unnoticed by BIG-IP Administrators, with potential consequences on the failover behavior of the devices.
Fix:
A warning message is logged to /var/log/ltm, and is also presented in tmsh.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
1034329-1 : SHA-512 checksums for BIG-IP Virtual Edition (VE) images available on downloads.f5.com
Links to More Info: BT1034329
Component: TMOS
Symptoms:
SHA-512 checksums for BIG-IP Virtual Edition images are not available on downloads.f5.com.
Conditions:
You wish to perform a SHA-512 validation of the BIG-IP Virtual Edition images.
Impact:
Cannot download the SHA-512 checksum for checksums for BIG-IP Virtual Edition images.
Workaround:
None
Fix:
Added SHA-512 checksum for ISOs and BIG-IP Virtual Edition images to downloads.f5.com.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5
1033837-1 : REST authentication tokens persist on reboot★
Links to More Info: K23605346, BT1033837
Component: TMOS
Symptoms:
REST authentication tokens persist across reboots. Current best practices require that they be invalidated at boot.
Conditions:
-- REST authentication token in use
-- BIG-IP restarts
Impact:
REST authentication tokens are not invalidated at boot.
Workaround:
None
Fix:
REST authentication tokens are invalidated at boot. Additionally, a new db variable is introduced: httpd.matchclient which is used to validate that the IP address of the creator of the token is the only valid user of that token.
Behavior Change:
Existing REST tokens are now invalidated on boot; new tokens will need to be generated after a reboot.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
1033829-3 : Unable to load Traffic Classification package
Links to More Info: BT1033829
Component: Traffic Classification Engine
Symptoms:
After installation and initial configuration, the latest Traffic Classification IM package fails to load.
Conditions:
This type of behavior is observed when the system is configured as follows,
1. LTM provisioned
2. Create virtual servers with classification profile
3. Then provision PEM module
4. Do a Hitless upgrade
Impact:
The latest Traffic Classification IM package fails to load.
Workaround:
Once the TMM is restarted after the issue, the latest IM is loaded.
Fix:
The traffic classification package now loads successfully.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.5
1033017-1 : Policy changes learning mode to automatic after upload and sync
Links to More Info: BT1033017
Component: Application Security Manager
Symptoms:
When newly created policies are synchronized, the learning states of the policies are different.
Conditions:
-- Active/Active high availability (HA) setup in sync-failover device group with ASM enabled.
-- Sync a new policy configured with disabled/manual learning mode.
Impact:
Learning mode changes from disabled to automatic on peer device after sync, so learning modes differ on the peer devices.
Workaround:
1. On the peer device, change the learning mode to disabled.
2. Push sync from the originator device.
Both devices are then in sync and policies have the same learning mode (disabled), so operations complete as expected.
Fix:
The sync operation no longer attempts to keep the learning flags enabled on the receiving device.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5
1032949-1 : Dynamic CRL configured with client authentication profile as "Request" causes connection termination without certificate.
Links to More Info: BT1032949
Component: TMOS
Symptoms:
When you configure Dynamic CRL and set the client authentication as "Request", the handshake fails when clients do not supply a certificate.
Conditions:
Clientssl profile configured with the following:
1. Dynamic CRL
2. Client Authentication enabled with "Request" option
Impact:
SSL handshake fails
Workaround:
Workaround 1:
Use Static CRL
Workaround2:
Use Client authentication with either "Require" or "Ignore"
Workaround3:
Disable TLS1.2 and below versions in the Client SSL profile.
Which means allow only TLS1.3 traffic.
Fix:
N/A
Fixed Versions:
17.0.0, 16.1.2.1, 15.1.5
1032797-1 : Tmm continuously cores when parsing custom category URLs
Links to More Info: BT1032797
Component: SSL Orchestrator
Symptoms:
Tmm crashes when trying to parse more than 256 custom category URLs.
Conditions:
-- More than 256 URLs defined in custom url-category.
Impact:
Traffic disrupted while tmm restarts.
Fix:
TMM no longer crashes and it can parse more than 256 custom category URLs.
Fixed Versions:
17.0.0, 16.1.2, 15.1.5
1032737-2 : IPsec: tmm SIGSEGV in getlocaladdr in ikev2_initiate
Links to More Info: BT1032737
Component: TMOS
Symptoms:
Tmm crashes while passing IPsec traffic
Conditions:
Wildcard selectors are used.
Impact:
Traffic disrupted while tmm restarts.
Workaround:
None
Fix:
Avoid the core dump by adding checks.
Fixed Versions:
17.0.0, 16.1.2, 15.1.4.1
1032689 : UlrCat Custom db feedlist does not work for some URLs
Links to More Info: BT1032689
Component: Traffic Classification Engine
Symptoms:
The first URL getting normalized is not classified.
Conditions:
The URL contains caps or 'www' is not getting categorized in few cases.
Impact:
The 'custom' category is not displayed for all the apps available in the feedlist file.
Workaround:
None
Fix:
Starting normalized lines with \n.
Fixed Versions:
16.1.2, 15.1.4.1, 14.1.4.5
1032077-1 : TACACS authentication fails with tac_author_read: short author body
Links to More Info: BT1032077
Component: TMOS
Symptoms:
If a TACACS user is part of a group with 10s of attribute value pairs (AVPs) were the length of all the avp's combined is such that the authorization reply message from the TACACS server is segmented, the login will fail.
The error message that is logged when the login fails is
"tac_author_read: short author body, 4468 of 6920: Operation now in progress" Where the numbers 4468 and 6920 will vary.
Conditions:
- TACACS authentication
- TACACS user that is part of a group where the combined length of the AVPs is greater then the largest TCP segment the TACACS server is able to send.
Impact:
User is unable to login.
Workaround:
If possible, reduce the number of attributes of the TACACS group or user.
Fixed Versions:
17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5
1031901-2 : In HTTP2 deployment, RST_STREAM sent to client if server in CLOSING state is picked
Links to More Info: BT1031901
Component: Local Traffic Manager
Symptoms:
When request from client is forwarded to server which is in CLOSING state due to server sent GOAWAY but not yet close the connection, request will be failed to be forwarded to server and RST_STREAM will be sent to client
Conditions:
-- Virtual Server with HTTP2 profile
-- There is an open connection from BIG-IP to the server.
-- The server sends a GOAWAY message to the BIG-IP and the connection is kept open.
-- The client sends a request to BIG-IP, BIG-IP picks the connection mentioned above to forward the request to
Impact:
Traffic from the specific client is interrupted
Workaround:
N/A
Fix:
In HTTP2 deployment, RST_STREAM is no longer sent to client if server in CLOSING state is picked
Fixed Versions:
17.0.0, 16.1.2, 15.1.4.1
1031609-1 : Improve nethsm-thales-install.sh and nethsm-thales-rfs-install.sh to be compatible with Entrust Client v12.60.10 package.★
Links to More Info: BT1031609
Component: Local Traffic Manager
Symptoms:
Formerly Thales now nShield/Entrust has changed the directory structure of their client package and also added new libraries. Due to this change, install script will be incompatible with v12.60.10 onwards.
Conditions:
Upgrading to PKCS11 client package v12.60.10.
Impact:
The installation script will fail while extracting the package.
Workaround:
N/A
Fix:
Extracted all the tarballs in the target directory to resolve the issue.
Fixed Versions:
17.0.0, 16.1.2.1, 15.1.5.1
1031425-3 : Provide a configuration flag to disable BGP peer-id check.
Links to More Info: BT1031425
Component: TMOS
Symptoms:
A fix for ID 945265 (https://cdn.f5.com/product/bugtracker/ID945265.html) introduced strict checking of a peer-id. This check might be not desired in some configurations.
Conditions:
EBGP peering with two routers in the same autonomous system, configured with the same peer-id.
Impact:
BIG-IP will not pass the NLRIs between two eBGP peers. The following message can be seen in debug logs:
172.20.10.18-Outgoing [RIB] Announce Check: 0.0.0.0/0 Route Remote Router-ID is same as Remote Router-ID
Workaround:
Change peer-ids to be unique on eBGP peers.
Fix:
New, neighbor-specific, af-specific configuration option is provided to allow routes to be passed to external peers sharing the same router-id. The check is done on egress, so the configuration should be changed towards the peer that is supposed to receive a route.
router bgp 100
bgp graceful-restart restart-time 120
neighbor as200 peer-group
neighbor as200 remote-as 200
neighbor as200 disable-peerid-check
neighbor 172.20.8.16 peer-group as200
neighbor 172.20.8.16 disable-peerid-check
neighbor 172.20.10.18 peer-group as200
neighbor 172.20.10.18 disable-peerid-check
!
address-family ipv6
neighbor as200 activate
neighbor as200 disable-peerid-check
neighbor 172.20.8.16 activate
neighbor 172.20.8.16 disable-peerid-check
neighbor 172.20.10.18 activate
neighbor 172.20.10.18 disable-peerid-check
exit-address-family
When configured on a single neighbor it will cause session to be re-established.
When configured on a peer-group a manual session restart is required for changes to take effect.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6
1031357-2 : After reboot of standby and terminating peer, some IPsec traffic-selectors are still online
Links to More Info: BT1031357
Component: TMOS
Symptoms:
HA Standby marks traffic selectors up when they are actually down on the Active device.
Conditions:
-- High availability (HA) configured and mirroring configured
-- IPsec tunnels up on Active
-- Reboot Standby
-- Standby starts correctly and all SAs are mirrored
-- Tunnel(s) go down on Active
Impact:
-- Traffic Selector is incorrectly marked up on the Standby when it is actually down on the Active.
-- While this is cosmetic, the information is misleading.
Workaround:
None
Fix:
After Standby reboot and deleting IPsec tunnels, the
traffic selectors on the Standby are marked in down state.
Fixed Versions:
17.0.0, 16.1.2
1030881-1 : [GTM] Upgrade failure - 01070022:3: The monitor template min was not found.★
Links to More Info: BT1030881
Component: Global Traffic Manager (DNS)
Symptoms:
GTM config load fails with the following error message:
01070022:3: The monitor template min was not found.
Conditions:
Min or required feature is applied to GTM generic host and upgrade from v15.x to v16.x.
Impact:
GTM config load fails.
Workaround:
Delete the special config for the generic host server and add it back after upgrade.
Fixed Versions:
17.0.0, 16.1.2.2
1030853-1 : Route domain IP exception is being treated as trusted (for learning) after being deleted
Links to More Info: BT1030853
Component: Application Security Manager
Symptoms:
Traffic is considered trusted for learning even though a trusted IP exception was deleted.
Conditions:
Creating and deleting a route domain-specific IP exception
Impact:
Traffic learning suggestions scores are miscounted.
In automatic policy builder mode the policy can be updated by the policy builder based on the wrong score counting.
Workaround:
Stop and restart learning for the relevant policy
Fix:
When a route domain IP Exception configured for trusted learning is deleted, the upcoming suggestions scores will be calculated correctly without considering the deleted IP trusted.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
1030845-1 : Time change from TMSH not logged in /var/log/audit.
Links to More Info: BT1030845
Component: TMOS
Symptoms:
Whenever time is changed, the message is not logged in /var/log/audit.
Conditions:
This occurs when the system time is changed manually using either the 'date' command or 'tmsh modify sys clock'.
Impact:
The time change is not logged to the audit log.
Workaround:
N/A
Fix:
Time changes are now logged to the audit log.
Fixed Versions:
17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5
1030645-4 : BGP session resets during traffic-group failover
Links to More Info: BT1030645
Component: TMOS
Symptoms:
BGP session might be hard reset during a traffic group failover. The following log is displayed:
BGP[11111]: BGP : %BGP-5-ADJCHANGE: neighbor 1.1.1.1 Down Peer reset due to nh address change
Conditions:
Floating self-ips defined on a single vlan/subnet, with different traffic-groups configured.
Impact:
BGP session goes down during traffic-group failover.
Fix:
Soft clear is performed instead.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6
1030133-2 : BD core on XML out of memory
Links to More Info: BT1030133
Component: Application Security Manager
Symptoms:
Missing error handling in lib xml parser.
Conditions:
XML parser going out of memory.
Impact:
ASM traffic disrupted while bd restarts.
Workaround:
None
Fixed Versions:
17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7, 14.1.5.1
1029949-2 : IPsec traffic selector state may show incorrect state on high availability (HA) standby device
Links to More Info: BT1029949
Component: TMOS
Symptoms:
IPsec traffic selector state can be viewed in the config utility or by tmsh with the "tmsh show net ipsec traffic-selector" command. On an high availability (HA) standby device, some selector states may be incorrect.
Conditions:
-- High availability (HA) environment
-- Standby reboots or in some way, such as a tmm restart, is forced to re-learn all the mirrored IPsec security associations (SAs).
Impact:
There is no functional impact. The issue is that a selector may incorrectly appear down in one or both directions.
Workaround:
When the tunnel re-keys on the high availability (HA) active device, the selector state shows the correct value.
Fix:
IPsec traffic selectors show the correct state after the high availability (HA) standby device reboots.
Fixed Versions:
17.0.0, 16.1.2
1029897-1 : Malformed HTTP2 requests can be passed to HTTP/1.1 server-side pool members.
Links to More Info: K63312282, BT1029897
Component: Local Traffic Manager
Symptoms:
The BIG-IP system may pass malicious requests to server-side pool members.
Conditions:
1. The BIG-IP LTM has one or more virtual servers configured to proxy HTTP/2 requests from the client-side to HTTP/1 requests on the server-side.
2. An HTTP/2 client sends a request with one of the following issues and the BIG-IP passes it to the server-side pool members:
a. H2.TE request line injection
I. An HTTP/1 request embedded within an HTTP/2 pseudo-header value
II. Individual carriage return (CR) or line feed (LF) allowed within an HTTP/2 pseudo-header
b. Request line injection (folder traps)
c. Request line injection (rule bypass)
Impact:
Malicious HTTP/2 requests can be translated to HTTP/1 requests and sent to the pool member web server. Depending on the behavior of the pool member web server, This could result in unauthorized data injection in HTTP requests. When the affected virtual server is configured with the OneConnect profile, a malicious actor might be able to impact the responses sent to a different client.
Workaround:
You can configure the BIG-IP ASM system or Advanced WAF to block an HTTP/1 request that is embedded within an HTTP/2 pseudo header value from being sent to the backend server.
Fix:
This has been fixed so that client requests are appropriately rejected by BIG-IP.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
1029869-1 : Use of ha-sync script may cause gossip communications to fail
Links to More Info: BT1029869
Component: SSL Orchestrator
Symptoms:
Using the ha-sync script on platforms in a sync-failover device group may cause gossip communications to fail.
Conditions:
This issue occurs after using the ha-sync script on devices that are in a sync-failover device-group.
Impact:
When the gossip communications fail, SSL Orchestrator will be unable to communicate iAppLX configuration from one device to the other. This can lead to deployment failures upon redeployment of SSL Orchestrator topologies.
Workaround:
None
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1
1029689-2 : Incosnsitent username "SYSTEM" in Audit Log
Links to More Info: BT1029689
Component: Application Security Manager
Symptoms:
The Security Policy Auto Log in ASM displays the system component that triggered the event. The component name is sometimes shown as 'SYSTEM', other times shown as 'System'
Conditions:
The value is "SYSTEM" when Apply Policy was initiated locally.
The value is "System" when Apply Policy was initiated by the peer unit
Impact:
Component name inconsistency causing confusion
Workaround:
None
Fixed Versions:
17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7
1029585-1 : Use of ha-sync script may cause platforms in a sync-failover device group to fall out of sync
Links to More Info: BT1029585
Component: SSL Orchestrator
Symptoms:
Following the use of the ha-sync script on platforms in a sync-failover device group to become out of sync.
Conditions:
This can occur following the use of the ha-sync script.
Impact:
Both platforms in the sync-failover device group to fall out of sync. Forcing the admin to perform a device-group sync operation.
Workaround:
None
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1
1029397-4 : Tmm may crash with SIP-ALG deployment in a particular race condition
Links to More Info: BT1029397
Component: Service Provider
Symptoms:
Tmm crashes in SIP-ALG deployment, when lsn DB callback is returned from a different tmm, and the SIP connection has been lost on tmm where the REGISTER request arrived.
Conditions:
--- SIP-ALG is deployed
--- Processing of SIP REGISTER message at server side
--- lsn DB entry is mapped to a different tmm
Impact:
Traffic disrupted while tmm restarts
Workaround:
NA
Fix:
Tmm no longer crashes in this race condition
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5, 14.1.4.6
1028969-1 : An unused traffic-selector can prevent an IKEv2 IPsec tunnel from working
Links to More Info: BT1028969
Component: TMOS
Symptoms:
If both IKEv1 and IKEv2 try to listen to the same self IP address on the BIG-IP for a local tunnel IP address, only one can win, and previously a v2 ike-peer would be blocked if a v1 listener managed to get installed first.
If a partial tunnel config exists, with no ike-peer and only ipsec-policy and traffic-selector definitoins, this is understood to be IKEv1 implicitly, by default, and will install a v1 listener for the IP address and port.
Then if a fully configured ike-peer is added using IKEv2, it can fail to establish the required listener for v2 when an existing v1 listener is squatting on that IP address.
Conditions:
Conflict between IKEv2 and IKEv1 on the same IP address when:
-- a v2 ike-peer has local tunnel IP address X
-- a v1 ike-peer, or a traffic-selector with no peer at all, has the same local IP address X
Impact:
An IKEv2 tunnel can fail to negotiate when v2 packets cannot be received on a local IP address because a listener for IPsec cannot be established on that IP address.
Workaround:
You can avoid conflict between v1 and v2 by:
-- removing a traffic-selector not in use (which is v1)
-- avoiding use of the same local IP in both v1 and v2 definitions of ike-peer
Fix:
The fix gives precedence to IKEv2, so any pre-existing IKEv1 listener is simply removed from an IP address whenever a v2 listener is desired for that IP address.
This means IKEv1 can never be negotiated on a local IP address which is also in use by an IKEv2 ike-peer.
Importantly, this fix may cause tunnels to be permanently down after an upgrade. Prior to this change it was possible to have IKEv1 and IKEv2 tunnels working on the same self IP, but in that scenario some tunnels would intermittently fail to establish and the success of the tunnel establishment depended on whether the BIG-IP was the Initiator. IKEv1 and IKEv2 tunnels on the same self IP may still work after this change, but are not considered a valid or supported config by F5.
Fixed Versions:
17.0.0, 16.1.2
1028773-1 : Support for DNS Over TLS
Links to More Info: BT1028773
Component: Global Traffic Manager (DNS)
Symptoms:
The BIG-IP system does not have support for DNS over TLS (DoT).
Conditions:
This is encountered if you wish to combine a clientssl profile with the dns profile on a virtual server.
Impact:
Performance is degraded.
Workaround:
None
Fix:
Clients can now initiate DNS over TLS requests to virtual servers that have the clientssl and dns profiles attached.
Fixed Versions:
17.0.0, 16.1.2
1028473-1 : URL sent with trailing slash might not be matched in ASM policy
Links to More Info: BT1028473
Component: Application Security Manager
Symptoms:
Request sent to a specific URL with added trailing slash may not be handled according to expected policy.
Conditions:
-- Request is sent with URL containing trailing slash.
-- Security policy contains the same URL, but without slash.
Impact:
URL enforcement is not done according to expected rules.
Workaround:
Add configuration for same URL with added trailing slash.
Fix:
URL with trailing slash is now handled as expected.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5
1028269-2 : Device using CGNAT + subscriber discovery license shows unknown for pem_subscriber-id.
Links to More Info: BT1028269
Component: Carrier-Grade NAT
Symptoms:
On a BIG-IP device configured with CGNAT + subscriber discovery license, the LSN log shows "unknown" for the pem_subscriber-id field.
Conditions:
-- PEM and CGNAT enabled
-- RADIUS and CGNAT traffic are in different route domains
Impact:
LSN log shows "unknown" for the pem_subscriber-id field.
Workaround:
N/A
Fix:
Subscriber-id now shows correctly in the LSN log after it is added with CGNAT provisioned check in subscriber-discovery.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1
1028109-1 : Detected attack signature is reported with the wrong context.
Links to More Info: BT1028109
Component: Application Security Manager
Symptoms:
A detected attack signature on a multipart request might be reported with the wrong context.
Conditions:
Attack signature is detected in a multipart request.
Impact:
Reporting of the signature might contain the wrong context.
Workaround:
N/A
Fix:
All detected signatures on multipart requests are reported with the correct context.
Fixed Versions:
17.0.0, 16.1.2
1027657-4 : Monitor scheduling is sometimes inconsistent for "require M from N" monitor rules.
Links to More Info: BT1027657
Component: Global Traffic Manager (DNS)
Symptoms:
Inconsistent monitor intervals for resource monitoring.
Conditions:
"require M from N" monitor rules configured.
Impact:
Monitor status flapping.
Workaround:
Do not use "require M from N" monitor rules.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.5
1027217-1 : Script errors in Network Access window using browser.
Links to More Info: BT1027217
Component: Access Policy Manager
Symptoms:
1. Users may receive JavaScript errors in their browser when starting Network Access resources.
2. User resources may fail to display when accessing a Full webtop.
3. When logging out, users may be redirected to https://apm-virtual-server/vdesk/undefined and get a blank page
4. Logon Page from SWG Policies may fail to display inside a browser.
Conditions:
The issue can be observed with at least one of these conditions.
1. Accessing APM virtual server using a browser.
2. Accessing APM resources via a Full webtop.
3. Starting APM resources via a Full webtop.
4. Accessing Logon Page in SWG deployment.
Impact:
1. Users cannot start Network Access resources.
2. Users are unable to logout properly from full webtop.
3. Logon page is not rendered and users will not be able to access resources.
Workaround:
1. Log into BIG-IP.
2. mount -o remount,rw /usr/.
3. Add "response_chunking 2" to _tmm_apm_portal_http in "/usr/lib/tmm/tmm_base.tcl" Example:
profile http _tmm_apm_portal_http {
max_header_size 32768
max_header_count 64
known_methods "CONNECT DELETE GET HEAD LOCK OPTIONS POST PROPFIND PUT TRACE UNLOCK"
response_chunking 2
}
4. Restart tmm once the above param is added.
5. Garbage values in JavaScript aren't inserted after this change.
6. Remount the /usr directory as read-only.
mount -o remount,ro /usr/
-------------------------
Fix:
The logon page now renders correctly, resources are properly displayed on the webtop, you can start resources without JavaScript errors, and you no longer receive blank pages when logging out.
Fixed Versions:
17.0.0, 16.1.2, 15.1.4.1
1026605-6 : When bigd.mgmtroutecheck is enabled monitor probes may be denied for non-mgmt routes
Links to More Info: BT1026605
Component: Local Traffic Manager
Symptoms:
When bigd.mgmtroutecheck is enabled and monitors are configured in a non-default route-domain, bigd may calculate the interface index incorrectly. This can result in monitor probes improperly being denied when they egress a non-mgmt VLAN. Or monitor probes might be allowed to egress the management interface
Conditions:
-- Bigd.mgmtroutecheck is enabled.
-- Monitor probes in a non-default route domain
-- More than one VLAN configured in the route-domain
Impact:
Monitor probes may be denied even thought they egress a non-mgmt VLAN.
Monitor probes may be improperly allowed out a mgmt interface.
/var/log/ltm:
err bigd.0[19431]: 01060126:3: Health check would route via mgmt port, node fc02:0:0:b::1%1. Check routing table.
bigd debug log:
:(_do_ping): probe denied; restricted egress device and route check [ tmm?=false td=true tr=false addr=fc02:0:0:b::1%1:0 srcaddr=none ]
Workaround:
Disable bigd.mgmtroutecheck, reduce the number of VLANs inside the route-domain
Fix:
The Bigd interface index is now calculated properly
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
1026549-1 : Incorrect BIG-IP Virtual Edition interface state changes may be communicated to mcpd
Links to More Info: BT1026549
Component: TMOS
Symptoms:
For some BIG-IP Virtual Edition drivers, TMM may occasionally communicate an incorrect interface state change that might cause the interface to flap.
Conditions:
-- BIG-IP Virtual Edition using ixlv, ixvf, mlx5, or xnet drivers.
-- More TMMs and interfaces configured make this issue more likely to happen, but it happens randomly.
Impact:
In the case where the interface is part of a trunk a flap will occur when this happens.
There may be other as-yet unknown impacts for this issue.
Workaround:
Use a different VE driver than one of the ones listed above.
Fix:
BIG-IP Virtual Edition drivers no longer communicate incorrect interface states to mcpd.
Fixed Versions:
17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5
1026005-1 : BIG-IP Virtual Edition (VE) does NOT preserve the order of NICs 5-10 defined in the VMware ESXi hypervisor and NSXT platforms.
Links to More Info: BT1026005
Component: Local Traffic Manager
Symptoms:
The ordering of NICs 5-10 in VMware ESXi is based on PCI coordinates for the first boot and the order is ensured based on the /etc/ethmap script written by the kernel during initialization. BIG-IP VE does not follow/maintain the NIC order defined in the VMware ESXi hypervisor.
Conditions:
Using 5-10 interfaces, swap/remove/add an interface at the hypervisor level.
Impact:
When using 5-10 NICs in VMware ESXi and NSXT platforms, automation is prohibited due to BIG-IP VE not maintaining the NIC order defined in the hypervisor.
Workaround:
N/A
Fix:
Enabled BIG-IP VE scripts to honor the NIC order defined by the user in the VMware ESXi hypervisor and NSXT platforms.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.5
1025529-2 : TMM generates core when iRule executes a nexthop command and SIP traffic is sent
Links to More Info: BT1025529
Component: Service Provider
Symptoms:
If an iRule uses the 'nexthop' command to select a VLAN for a virtual server, TMM may crash.
Conditions:
-- Virtual server with SIP profile and iRule that executes a 'nexthop' command
-- SIP network traffic occurs
Impact:
Traffic disrupted while TMM restarts.
Workaround:
Avoid using 'nexthop vlan' in an iRule in a SIP environment.
Fix:
iRule creation does not cause any TMM core.
Fixed Versions:
17.0.0, 16.1.2.1, 15.1.4.1, 14.1.4.5
1025261-3 : Restjavad uses more resident memory in control plane after software upgrade
Links to More Info: BT1025261
Component: TMOS
Symptoms:
The restjavad process immediately reserves more memory and the process size (as shown by RSS) increases as the starting heap size has been made to be the same as maximum heap size for performance reasons.
(Note the process name displays as 'java', but there are multiple independent Java processes on the system. The parent process of restjavad is 'runsv restjavad', and the command line arguments may have 'logging' in them.)
For restjavad with the default size, the increase is usually 200 MB-300 MB.
The increase is particularly apparent where restjavad.useextramb is set to the value 'true' and provision.extramb is set to a high value but restjavad had not required that much extra memory previously.
Conditions:
After upgrading to a BIG-IP software version with the fix for ID 776393 ( https://cdn.f5.com/product/bugtracker/ID776393.html ), where more memory has been allocated for restjavad.
Impact:
The memory Resident Set Size (RSS) of the restjavad process will be larger than needed, possibly constricting other processes in the control plane.
Workaround:
If restjavad.useextramb is set to value true you may find that if only a small amount of extra restjavad memory was required (~192 MB or less extra) that it can be set to false.
This is because the default size of restjavad has increased by 192 MB to 384MB.
Restart restjavad after the change.
Fix:
A new sys DB variable, provision.restjavad.extramb has been introduced to allow finer-grained control of restjavad memory.
It takes effect only if sys db restjavad.useextramb is true. It can be used to set restjavad heap size both above and below the default heap size of 384 MB.
Behavior Change:
A new sys DB variable, provision.restjavad.extramb has been introduced to allow finer-grained control of restjavad memory.
The variable is particularly useful when you need restjavad to be slightly bigger and also need a much larger provision.extramb without most of that being taken by restjavad.
For the variable to take effect, sys db restjavad.useextramb must be set to 'true'; otherwise, default memory values are used.
The variable sets the heap size, and defaults to and has a minimum value of 192 MB.
If the value of provision.restjavad.extramb is set above a certain cap value, the heap size will be set to the cap value. In this release, the cap value 384 MB + 80% of provision.extramb.
So with restjavad.useextramb set to 'true', you can set the restjavad heap size from 192 MB to 384 MB + 80% of provision.extramb using the provision.restjavad.extramb variable.
After changing value of provision.restjavad.extramb, restart restjavad to enable the change in memory size:
bigstart restart restjavad
Or on multi-blade systems:
clsh bigstart restart restjavad
If using a sys db restjavad.useextramb value of true and needing to restore your previous restjavad memory setting ( based on maximum heap size) please look at advice below.
Before upgrade - if you set sys db restjavad.useextramb to value false before install of new version you will have more restjavad memory, the default 384MB, after upgrade.
tmsh modify sys db restjavad.useextramb value false
If you restart restjavad you can see if that value works before upgrade. If you don't restart then it will come into effect after reboot.
If that no longer has issues after update then leave that setting at false. Otherwise set back to true (no restart) and increase provision.restjavad.extramb as in After upgrade section below.
After upgrade:
Set sys db provision.restjavad.extramb to an appropriate value and restart restjavad.
Run the following command:
tmsh modify sys db provision.restjavad.extramb value X
bigstart restart restjavad
Iterate as necessary.
The value of X is derived by using one of the following formulae:
- When updating from versions before 14.1.4 and 15.1.3, to affected versions, a value that preserves the maximum previous restjavad heap size is:
192MB + 80% of MIN(provision.extramb|2500)
the minimum possible heap size was:
192MB + 20% of MIN(provision.extramb|2500)
The actual restjavad heap size would be between those extremes. SSLO systems would typically need a higher amount towards the maximum.
Example 1: If provision.restjavad was 1000 MB on previous version, the possible range of restjavad heap size would have been between (20% of 1000 + 192) = 392 MB and (80% of 1000 + 192) = 992 MB.
Example 2: If provision.extramb was 4000 MB, the possible range would be between (20 % of 2500 + 192) = 692 MB and (80% of 2500 + 192) = 2192 MB.
- When updating from 14.1.4-14.1.5, from 15.1.3-15.1.6.1 or from 16.0.x to affected versions:
384MB + 80% of MIN(provision.extramb|2500)
Example 3: If provision.extramb was 500 MB, the restjavad heap size on the previous version would have been 80% of 500 + 384 = 784 MB.
- When updating from 16.1.0-16.1.3 or from 17.0.0.0 to affected versions:
384MB + 90% of MIN(provision.extramb|4000)
Example 4: If provision.extramb was 2000 MB, the restjavad heap size on the previous version would have been 90% of 2000 + 384 = 2184 MB.
Fixed Versions:
17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7, 14.1.5.1
1024841-2 : SSL connection mirroring with ocsp connection failure on standby
Links to More Info: BT1024841
Component: Local Traffic Manager
Symptoms:
SSL connection mirroring with ocsp stapling connection failure on standby, active completes handshake with delay.
Conditions:
SSL connection mirroring with ocsp stapling
Impact:
Handshake delay on active
Workaround:
Disable ocsp stapling or ssl connection mirroring
Fix:
SSL connection mirroring handshake with ocsp stapling completes normally.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1
1024761-1 : HTTP adds Transfer-Encoding and terminating chunk to responses that cannot have a body
Links to More Info: BT1024761
Component: Local Traffic Manager
Symptoms:
When rechunking is requested, HTTP responses with methods or status codes indicating that no body be present (like HEAD or 304) are receiving a Transfer-Encoding header and a terminating chunk. These responses should not have a body of any sort.
Conditions:
HTTP virtual server with rewrite profile present with the server that does HTTP caching.
Impact:
HTTP clients are unable to connect.
Workaround:
Remove the rewrite profile.
Possibly change http profile response-chunking from sustain to unchunk. This resolves the issue for the 304, but means that all other requests are changed from either chunking or unchunked with Content-Length header to unchunked without Content-Length and with "Connection: Close".
Fixed Versions:
17.0.0, 16.1.2.1, 15.1.5
1024661-3 : SCTP forwarding flows based on VTAG for bigproto
Links to More Info: BT1024661
Component: TMOS
Symptoms:
Sometimes SCTP traffic is unidirectionally dropped on one link after an SCTP link down occurs.
Conditions:
-- SCTP configured and BIG-IP is passing traffic
-- A link goes down
Impact:
Flow creation on the wrong TMM and some traffic is dropped.
Workaround:
Disable SCTP flow redirection.
tmm.sctp.redirect_packets == disable
Fixed Versions:
17.1.0, 17.0.0.1, 16.1.3.1, 15.1.6.1, 14.1.5.1
1024621-4 : Re-establishing BFD session might take longer than expected.
Links to More Info: BT1024621
Component: TMOS
Symptoms:
It might take a few minutes for a BFD session to come up. During this time you will notice session state transition multiple times between 'Admin Down' <-> 'Down'.
Conditions:
BFD peer trying to re-establish a session with BIG-IP, choosing ephemeral ports dis-aggregating to different TMMs.
Impact:
It might take a few minutes for a BFD session to come up.
Workaround:
Increasing Tx/Rx timers will minimize a chance of hitting the problem (For example 1000 TX/RX)
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
1024437-6 : Urldb index building fails to open index temp file
Links to More Info: BT1024437
Component: Access Policy Manager
Symptoms:
The following error message shows up in /var/log/urldbmgr-trace.log:
THREAD: 2CDD4700; ERROR; WsFileOpen: Could not open file /var/urldb/staging/current/host.6417.byte.dat.003
THREAD: 2CDD4700; ERROR; WsIndexBuilderOpenFile: Failed to open index file /var/urldb/staging/current/host.6417.byte.dat.003.
THREAD: 2CDD4700; ERROR; WsHostIndexV7OpenFile: Failed to open Host index file /var/urldb/staging/current/host.6417.byte.dat.003.
THREAD: 2CDD4700; ERROR; WsHostIndexV7BuildProcessTempFiles: Failed to open host index temp file
As a result of this error, some requested URL category lookups return "Uncategorized".
Conditions:
The error can happen during index building after a new primary URLDB is downloaded.
Impact:
Some websites are categorized as "Uncategorized"
Workaround:
1) Stop urldbmgrd:
bigstart stop urldb urldbmgrd
2) Delete databases:
rm -rf /var/urldb/master/
rm -rf /var/urldb/rtu/
3) Start urldbmgrd:
bigstart start urldb urldbmgrd
4) Force database download:
- tmsh command: "modify sys url-db download-schedule urldb download-now true", or
- Admin GUI: Access >> Secure Web Gateway >> Database Settings >> Database Download >> Download Now
Databases will re-download and index.
Fix:
N/A
Fixed Versions:
17.0.0, 16.1.3.1
1024225-3 : BIG-IP sends "Transfer-Encoding: chunked" to http/2 client after HEAD request
Links to More Info: BT1024225
Component: Local Traffic Manager
Symptoms:
BIG-IP proxying http2 -> http1.1. In response to a HEAD request, pool member sends response with "Transfer-Encoding: chunked" header without chunked payload. BIG-IP sends "Transfer-Encoding: chunked" header back to http2 client which generates RST_STREAM, PROTOCOL_ERROR. According to RFC 7450 a proxy SHOULD remove such headers.
Conditions:
1) H2 <-> H1 is configured on virtual server
2) HEAD request over http2->http1.1 gateway getting chunked response.
Impact:
Http2 connection is reset
Workaround:
iRule to remove "Transfer-Encoding: Chunked" header from response.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5
1024101-1 : SWG as a Service license improvements
Links to More Info: BT1024101
Component: Access Policy Manager
Symptoms:
SWG sessions maxed out and the SWG license is not released until the APM session is ended.
Conditions:
SWG and APM are in use.
Impact:
SWG sessions are tied to APM sessions and can reach the limit and not be recycled even if the APM session is not actively using SWG.
Workaround:
None
Fix:
Fixed an issue with SWG session tracking.
Fixed Versions:
17.0.0, 16.1.3, 16.1.1
1023993-4 : Brute Force is not blocking requests, even when auth failure happens multiple times
Links to More Info: BT1023993
Component: Application Security Manager
Symptoms:
Send traffic with multiple Authorization headers in the request after configuring the brute force. The traffic will not be blocked, when it is supposed to be.
Conditions:
When there is more than one Authorization header present in the requests.
Impact:
Brute force is possible with specially crafted requests having multiple Authorization headers and will be able to bypass brute force checks.
Workaround:
Enable "Illegal repeated header violation" and configure Authorization header repeated occurrence to disallow.
Fix:
ASM detects the brute force attempt with multiple Authorization headers in the request.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
1023721 : iapp_restricted_key not available on fresh installation and overwrites the peer device's master key during config sync
Links to More Info: BT1023721
Component: iApp Technology
Symptoms:
Config sync of a deployment fails for SSL Orchestrator or Application Guided Config applications.
There is an error in /var/log/restjavad.0.log:
java.lang.Exception: Failed to find key com.f5.rest.common.RestRequestSender$HttpException: java.net.ProtocolException: status:404, body:{"code":404,"message":"Object not found - /Common/iappKey","errorStack":[],...
Conditions:
-- Recently formed device service cluster
-- Deploying SSL Orchestrator or AGC and triggering a config sync for the first time
Impact:
Secure Storage will not secure restricted_properties with the correct master key which will raise issues with encryption/decryption of data.
Workaround:
None
Fix:
iapp_restricted_key object should be synced properly during config sync
Fixed Versions:
17.0.0, 16.1.3
1023437-1 : Buffer overflow during attack with large HTTP Headers
Component: Anomaly Detection Services
Symptoms:
When the HTTP Headers are larger than 1024 characters and one of the anomalous textual headers is located after 1024, a buffer overflow might occur.
Conditions:
HTTP or TLS Signature protection is activated and during attack anomalous request arrives.
Impact:
Most of the time results in bad characters in the signature name, more rarely results in Memory Access Violation which could be exploited as buffer overflow attack.
Fix:
Enforce HTTP metadata size limit to be within the first 1024 characters of the HTTP Headers payload.
Fixed Versions:
17.0.0, 16.1.2.1, 15.1.5, 14.1.4.5, 13.1.5
1023365-2 : SSL server response could be dropped on immediate client shutdown.
Links to More Info: BT1023365
Component: Local Traffic Manager
Symptoms:
SSL server response might be dropped if peer shutdown arrives before the server response.
Conditions:
-- the virtual server is using a Server SSL profile
-- the client sends FIN/ACK before the server responds
Impact:
The response from the pool member may be dropped.
Workaround:
N/A.
Fix:
Serverssl response now received after peer shutdown
Fixed Versions:
17.0.0, 16.1.2, 15.1.4.1
1023341-1 : HSM hardening
Component: Local Traffic Manager
Symptoms:
Under certain conditions, HSM interactions do not follow current best practices.
Conditions:
- HSM in use
Impact:
Certain HSM interactions do not follow current best practices.
Workaround:
N/A
Fix:
HSM interactions now follow current best practices.
Fixed Versions:
17.0.0, 16.1.1, 15.1.5.1, 14.1.4.6, 13.1.5
1022757-2 : Tmm core due to corrupt list of ike-sa instances for a connection
Links to More Info: BT1022757
Component: TMOS
Symptoms:
Tmm generates a core when a corrupt list of ike-sa instances is processed.
Conditions:
Deletion of an expired ike-sa.
Impact:
Restart of tmm and re-negotiation of IPsec tunnels. Traffic disrupted while tmm restarts.
Workaround:
None
Fix:
The internal list data structure has been reorganized to use fewer entities in less-complex relationships. This makes it less likely for a corrupted list to occur, so this issue is less likely to occur.
Fixed Versions:
17.0.0, 16.1.2
1022637-1 : A partition other than /Common may fail to save the configuration to disk
Links to More Info: BT1022637
Component: TMOS
Symptoms:
A mismatch between the running-configuration (i.e. what is returned by "tmsh list ...") and the saved-configuration (i.e. what is stored in the flat configuration files) for a partition other than /Common, despite a "tmsh save config" operation was just performed (either by the user or as a result of a config-sync).
Conditions:
- One or more partitions other than /Common exist on the system.
- One or more of said partitions have no more configuration objects defined in them (i.e. are empty).
- A config save operation similar to "tmsh save sys config partitions { Common part1 [...] }" occurs, either manually initiated by an Administrator or as a result of a config-sync operation (in which case the device-group must be configured for manual synchronization).
Impact:
Should a BIG-IP Administrator notice the mismatch, the only immediate impact is confusion as to why the config save operation was not effective.
However, as the flat config files are now out-of-date, performing a config load operation on a unit in this state will resurrect old configuration objects that had been previously deleted.
On an Active unit, this may affect traffic handling. On a redundant pair, there is the risk that the resurrected objects may make it to the Active unit after a future config-sync operation.
Workaround:
If you notice the mismatch, you can resolve it by performing a config save operation for all partitions (i.e. "tmsh save sys config").
Fix:
Non /Common partitions now get saved to disk as intended.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5, 14.1.4.6, 13.1.5
1022625-2 : Profile type 'swg-transparent' should be selected on create page when 'create-new' is selected for SwgAsService in SSL Orchestrator
Links to More Info: BT1022625
Component: Access Policy Manager
Symptoms:
When creating a new service, certain default access profiles are not automatically selected.
Conditions:
1. SSL Orchestrator + APM + SWG provisioned
2. Select 'create-new' for access profile drop-down when adding a SwgAsService in SSL Orchestrator
A new tab opens with the profile creation page, but the access profile type drop-down does not have any type selected.
Impact:
When adding a SwgAsService in SSL Orchestrator, the only supported access profile type is SWG-Transparent, hence it should be automatically selected.
Workaround:
None
Fix:
Fixed an issue with automatic profile selection.
Fixed Versions:
17.0.0, 16.1.1
1022493-4 : Slow file descriptor leak in urldbmgrd (sockets open over time)
Links to More Info: BT1022493
Component: Access Policy Manager
Symptoms:
Unix domain sockets are opened and never closed in urldbmgrd. This is a very slow leak over time.
Conditions:
SWG or URLDB is provisioned.
Impact:
Urldbmgrd may hit a limit of open file descriptors, and may eventually core and restart. When urldbmgrd restarts, urldb also restarts. This may result in a momentary instant where URL categorization is not available.
Workaround:
Restarting urldbmgrd will clear the open file descriptors. Performing a forced restart during a time of no traffic will mitigate the risk of urldbmgrd restarting at an inconvenient time if there are too many sockets open.
"bigstart restart urldbmgrd" will restart the daemon.
Fixed Versions:
17.0.0, 16.1.3.1
1022453-4 : IPv6 fragments are dropped when packet filtering is enabled.
Links to More Info: BT1022453
Component: Local Traffic Manager
Symptoms:
IPv6 fragments are dropped when packet filtering is enabled.
Conditions:
Packet filtering is enabled and the system is processing IPv6 fragments.
Impact:
Some or all of the fragments of an IPv6 packet are lost.
Workaround:
Disable packet filtering
Fixed Versions:
17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7
1022417-1 : Ike stops with error ikev2_send_request: [WINDOW] full window
Links to More Info: BT1022417
Component: TMOS
Symptoms:
IKE SAs will be lost.
Conditions:
A failover occurs while IKE is sending DPD to the peer, and the reply is received by the newly active BIG-IP.
Multiple failovers can increase the likelihood that this occurs.
Impact:
IKE SAs may be deleted and there will be traffic loss.
Workaround:
Increase in DPD interval to reduce the probability of occurrence of the issue.
Fix:
Fixed an issue where IKE SAs were being lost during failover events.
Fixed Versions:
17.0.0, 16.1.2
1022269-1 : False positive RFC compliant violation
Links to More Info: BT1022269
Component: Application Security Manager
Symptoms:
False positive RFC compliant violation.
Conditions:
Authorization header with specific types.
Impact:
False positive violations.
Workaround:
Turn on an internal parameter:
/usr/share/ts/bin/add_del_internal add ignore_authorization_header_decode_failure 1
Fix:
Added tolerance to the authorization headers parser.
Fixed Versions:
17.0.0, 16.1.2, 15.1.4, 14.1.4.4, 13.1.5
1021773-1 : Mcpd core.
Links to More Info: BT1021773
Component: TMOS
Symptoms:
Mcpd crashes and leaves a core file.
Conditions:
This issue can occur if BIG-IP fails to allocate huge pages, which can occur during module provisioning.
Impact:
Mcpd crashes and the system goes into an inoperative state.
Workaround:
N/A
Fix:
N/A
Fixed Versions:
17.0.0, 16.1.2, 15.1.7
1021637-4 : In some cases BD enforces CSRF on all URLs, ignoring CSRF URLs
Links to More Info: BT1021637
Component: Application Security Manager
Symptoms:
CSRF is sometimes enforced on URLs that do not match the CSRF URLs list
Conditions:
ASM policy with CSRF settings
Impact:
URLs that do not match the CSRF URLs list can be blocked due to CSRF violation.
Workaround:
None
Fix:
N/A
Fixed Versions:
17.1.0, 16.1.2.2, 15.1.6.1
1021521-1 : JSON Schema is not enforced if OpenAPI media-type is wild card.
Links to More Info: BT1021521
Component: Application Security Manager
Symptoms:
If the openAPI configuration contains a wildcard media type for an endpoint, ASM does not enforce the JSON schema for requests with a JSON payload.
Conditions:
Create an OpenAPI policy with media type set to wildcard.
Impact:
ASM doesn't enforce JSON schema validation for HTTP requests containing a JSON payload.
Workaround:
N/A
Fix:
Provided fix and verified
Fixed Versions:
17.0.0, 16.1.2.2
1021485-3 : VDI desktops and apps freeze with Vmware and Citrix intermittently
Links to More Info: BT1021485
Component: Access Policy Manager
Symptoms:
VMware VDI:
Blank screen is seen while opening remote desktop when VDI is configured with VMware.
Citrix:
Desktop freezes immediately after opening remote desktop when VDI is configured with Citrix.
Conditions:
VMware VDI:
-- VDI is configured with VMware
-- Desktop or App is launched using native client from Webtop.
wait till 2X inactivity timeout if inactivity timeout
Citrix:
-- VDI is configured with Citrix
-- Desktop or App is launched using native client from Webtop.
-- Configure Inactivity timeout to 0.
Impact:
VDI desktops freeze while opening or immediately after opening.
The following error is seen in APM logs:
"Session stats update failed: ERR_NOT_FOUND"
Workaround:
No
Fix:
Users should not experience any intermittent desktop freeze.
Fixed Versions:
17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5
1021481-1 : 'http-tunnel' and 'socks-tunnel' (which are internal interfaces) should be hidden.
Links to More Info: BT1021481
Component: Local Traffic Manager
Symptoms:
The Linux command 'ifconfig' or 'ip a' shows two devices 'http-tunnel' and 'socks-tunnel' that are for TMM internal use only.
Conditions:
These interfaces show up regardless of the BIG-IP configuration.
Impact:
As long as these devices are not used there is no impact aside from possibly causing confusion. Any attempt to use those devices from a host process fails or produces unpredictable results. These devices should not be exposed on the Linux host.
Workaround:
N/A
Fix:
The devices 'http-tunnel' and 'sock-tunnel' no longer show up on the Linux host.
Fixed Versions:
17.0.0, 16.1.2
1021417-1 : Modifying GTM pool members with replace-all-with results in pool members with order 0
Links to More Info: BT1021417
Component: Global Traffic Manager (DNS)
Symptoms:
GTMpool has multiple members with order 0.
Conditions:
There is an overlap for the pool members for the command replace-all-with and the pool members to be replaced.
Impact:
Multiple pool members have the same order.
Workaround:
Perform this procedure:
1. Delete all pool members from the GTM pool.
2. Use replace-all-with.
Fixed Versions:
17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5
1021061-4 : Config fails to load for large config on platform with Platform FIPS license enabled
Links to More Info: BT1021061
Component: Global Traffic Manager (DNS)
Symptoms:
Config fails to load.
Conditions:
-- Platforms with Platform FIPS license enabled.
-- There are several ways to encounter this. One is with a large GTM (DNS) configuration that requires extending the gtmd stats file.
Impact:
Config file fails to load. For the gtmd configuration, gtmd repeatedly logs error messages similar to:
err gtmd[14954]: 011af002:3: TMSTAT error 'Invalid argument' creating row '/Common/vs_45_53' in table 'gtm_vs_stat'
For merged daemon, reports messages similar to:
err merged[9166]: 011b0900:3: TMSTAT error tmstat_row_create: Invalid argument.
Workaround:
None
Fixed Versions:
17.0.0, 16.1.2.1, 15.1.5, 14.1.4.5, 13.1.5
1020957-1 : HTTP response may be truncated by the BIG-IP system
Links to More Info: BT1020957
Component: Local Traffic Manager
Symptoms:
Web pages are not rendered properly; HTTP responses are truncated when traversing the BIG-IP system.
Conditions:
-- Virtual server with an HTTP profile
-- HTTP server generates a compressed response
-- BIG-IP system determines that it must decompress the payload, e.g., a rewrite profile attached to the virtual server
Impact:
HTTP responses are truncated when passing through the BIG-IP system.
Workaround:
One of the following:
-- Add an HTTP Compression profile to the virtual server, and ensure that 'Keep Accept-Encoding' is not selected.
-- Use an iRule to remove the Accept-Encoding header from requests, e.g.:
ltm rule workaround {
when HTTP_REQUEST {
HTTP::header remove Accept-Encoding
}
}
Fixed Versions:
17.0.0, 16.1.2
1020789-4 : Cannot deploy a four-core vCMP guest if the remaining cores are in use.
Links to More Info: BT1020789
Component: TMOS
Symptoms:
When trying to deploy a vCMP guest on an i11800 vCMP host using four or more cores while all of the other cores are in use, the following error message may be seen:
err mcpd[<pid>]: 0107131f:3: Could not allocate vCMP guest (<guest_name>) because fragmented resources
--------------------------------------------------
one more similar issue has raised for 8 guests allocation failure
When trying to deploy a eight core guest on an i11800 vCMP host where four 2 cores are in use, the following error message may be seen:
0107131f:3: Could not allocate vCMP guest (guest-8cores-A) because fragmented resources
Conditions:
-- VCMP provisioned and all or most cores are in use.
-- Attempt to deploy a guest.
This is more likely to occur with vCMP guests that use four or more cores.
Impact:
All of the available cores cannot be used.
Workaround:
You may be able to work around this by deploying the largest guests first, then any remaining 2-core guests.
There is currently no other fix.
Fix:
N/A
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1, 14.1.4.6, 13.1.5
1020717-4 : Policy versions cleanup process sometimes removes newer versions
Links to More Info: BT1020717
Component: Application Security Manager
Symptoms:
The policy versions cleanup process sometimes removes versions in incorrect order. Newer versions are removed while older versions are preserved.
Conditions:
"maxSizeOfSavedVersions" configuration parameter in "/etc/ts/tools/policy_history.cfg" has very low value.
Impact:
Newer versions are removed.
Workaround:
increase value of "maxSizeOfSavedVersions" configuration parameter in "/etc/ts/tools/policy_history.cfg"
Fixed Versions:
17.1.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
1020705-2 : tmsh show analytics dos-l3 report view-by attack-id" shows "allowed-requests-per-second" instead "attack_type_name
Links to More Info: BT1020705
Component: Application Visibility and Reporting
Symptoms:
Output of "tmsh show analytics dos-l3 report view-by attack-id" command has changed from version 13.x to 15.x. "Attack type" was removed from the system, so it was automatically replaced by the first metric "allowed-requests-per-second". For DOS L3 "Attack type" was replaced by "Vector Name" but it currently is not shown in the report along wit "Attack ID"
Conditions:
AFM is provisioned
Impact:
This change might cause scripts to fail if they use the name of the field.
Workaround:
1) edit /etc/avr/monpd/monp_dosl3_entities.cfg file. Change [dosl3_attack_id] section the following way: add 'vector_name' to measures list and add an additional parameter 'default_measure' as specified below :
[dosl3_attack_id]
...
measures=allowed_requests_per_sec,count,drop_per_sec,drop_count,total_per_sec,total_count,attacks_count,attack_type_name,category_name,vip_name,period,vector_name
default_measure=vector_name
...
2) edit /etc/avr/monpd/monp_dosl3_measures.cfg file. Add in the end the following section:
[vector_name]
id=vector_crc
formula=IF(count(distinct FACT.vector_crc)>1,'Aggregated',attack_vector_str)
merge_formula=IF(count(distinct vector_name)>1,'Aggregated',vector_name)
dim=AVR_DIM_DOS_VIS_ATTACKS_VECTOR
dim_id=attack_vector_crc
tmsh_display_name=vector-name
display_name=Vector
comulative=false
priority=65
3) restart the BIG-IP system: bigstart restart
After the system is up you can apply the same tmsh command: "tmsh show analytics dos-l3 report view-by attack-id"
You will get a result similar to 13.x. Note that "attack_type_name" is replaced by "vector-name"
Fix:
Workaround applied as fix.
Fixed Versions:
17.0.0, 16.1.2, 15.1.3.1, 14.1.4.4
1020645 : When HTTP CONNECT is sent, iRule event HTTP_RESPONSE_RELEASE is not triggered
Links to More Info: BT1020645
Component: Local Traffic Manager
Symptoms:
In an explicit proxy configuration when an HTTP request is sent to an HTTPS destination server via proxy, the HTTP CONNECT method is sent, but the iRule event HTTP_RESPONSE_RELEASE is not fired.
Conditions:
- Simple HTTP explicit proxy virtual server
- An HTTP request from the client is sent to an 'https://' destination server
Impact:
iRule event HTTP_RESPONSE_RELEASE does not get triggered.
Workaround:
None
Fix:
When HTTP CONNECT is sent, the iRule event HTTP_RESPONSE_RELEASE is now triggered.
Fixed Versions:
17.1.0, 16.1.3.1, 15.1.4.1
1020549-1 : Server-side connections stall with zero window with OneConnect profile
Links to More Info: BT1020549
Component: Local Traffic Manager
Symptoms:
Serverside connections from pool member to BIG-IP hang, with the BIG-IP advertising a TCP zero window.
Conditions:
-- Virtual server with OneConnect profile
-- The BIG-IP applies flow-control to the serverside connection (e.g. the server's response to the BIG-IP is faster than the BIG-IP's forwarding the response to the client)
-- The serverside connection is subsequently re-used
Impact:
Serverside connections hang in the middle of data transfer, and will eventually time out.
Workaround:
If possible, remove the OneConnect profile from the virtual server.
Note: removing a OneConnect profile may cause problems with persistence, as described in
K7964: The BIG-IP system may appear to ignore persistence information for Keep-Alive connections (https://support.f5.com/csp/article/K7964)
Fixed Versions:
17.0.0, 16.1.2.2
1020377-1 : Missing IKEv2 listeners can send IKE packets to the IKEv1 racoon daemon
Links to More Info: BT1020377
Component: TMOS
Symptoms:
If an IKEv2 tunnel terminates with an error condition, afterward it is possible for IKE packets to be received by the IKEv1 racoon daemon, which is listening to local host (i.e 127.0.0.1) on ports 500 and 4500.
Conditions:
To get the problem to occur, you may need these details:
-- an IKEv2 config where traffic selector narrowing happens
-- termination of an IKEv2 tunnel with an error condition
-- some other BIG-IP service using the same local self IP
Packets can reach the IKEv1 racoon daemon only when some BIG-IP service uses bigself as the proxy, which forwards packets to localhost (127.0.0.1) with the same port number. So even if no IKEv1 config is present for a local self IP, if some other BIG-IP service also uses bigself as a proxy, this can forward IKE packets to localhost as well.
Impact:
The IKEv2 tunnel does not get renegotiated, because IKE packets reach the IKEv1 daemon, which ignores them, because the proper listener to handle IKEv2 is missing. As a result, tunnel service is interrupted.
Workaround:
Deleting and re-adding the problematic ike-peer and traffic-selector should bring back IPsec support for that tunnel.
If the initiating and responding sides of the tunnel have identical traffic-selector proposals, then narrowing should not happen, and this would also prevent the problem in the first place.
Fix:
BIG-IP systems now manage and handle multiple references to the same listener in a more rigorous way, so the IKEv2 listener cannot go away while it is still needed.
Fixed Versions:
17.0.0, 16.1.2
1020337-2 : DNS msg_ObjType can cause buffer overrun due to lack of NUL terminator
Links to More Info: BT1020337
Component: Global Traffic Manager (DNS)
Symptoms:
Tmm cores with umem debug enabled.
Conditions:
A string operation is performed against DNS resource records (RRs) from DNSMSG::section in an iRule.
Impact:
Tmm memory corruption. In some situations, tmm might crash. Traffic disrupted while tmm restarts.
Workaround:
Do not use string operations against DNS RRs returned from DNSMSG::section.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1
1019853-1 : Some signatures are not matched under specific conditions
Links to More Info: K30911244, BT1019853
Component: Application Security Manager
Symptoms:
Some signatures are not matched, attacking traffic may pass through.
Conditions:
- Undisclosed signature conditions
Impact:
Attacking traffic can bypass the WAF.
Workaround:
N/A
Fix:
Signatures are now matched as expected.
Fixed Versions:
17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5
1019829-2 : Configsync.copyonswitch variable is not functioning on reboot
Links to More Info: BT1019829
Component: TMOS
Symptoms:
Configsync.copyonswitch variable is not functioning properly during reboot to another partition
Conditions:
-- db variable configsync.copyonswitch modified
-- hostname is changed in global-settings
-- reboot to another partition
Impact:
The hostname will be changed back to the default hostname after reboot
Fixed Versions:
16.1.1
1019721-1 : Wrong representation of JSON/XML validation files in template based (minimal) JSON policy export
Links to More Info: BT1019721
Component: Application Security Manager
Symptoms:
When exporting template-based (minimal) JSON policy with profiles and associated validation files, the resulting configuration is wrong.
- Configuration for the JSON validation file is missing from the exported policy
- The JSON profile associated validation file has the name but no content
Conditions:
Export a minimal JSON policy with JSON/XML validation files associated to the JSON/XML profile.
Impact:
Error due to wrong configuration of the validation file during import.
Fixed Versions:
17.0.0, 16.1.2.2
1019613-5 : Unknown subscriber in PBA deployment may cause CPU spike
Links to More Info: BT1019613
Component: Carrier-Grade NAT
Symptoms:
in PBA deployment, a CPU spike may be observed if the subscriber-id log is enabled and the subscriber-id is unknown.
Conditions:
-- PBA configuration
-- Address translation persistent is enabled
-- Subscriber-id log is enabled
-- There is an unknown subscriber
Impact:
Overall system capacity reduces.
Workaround:
Disable subscriber-id logging.
Fix:
Unknown subscriber in PBA deployment no longer causes a CPU spike.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6
1019609-1 : No Error logging when BIG-IP device's IP address is not added in client list on netHSM.★
Links to More Info: BT1019609
Component: Local Traffic Manager
Symptoms:
"Ensure BIG-IP's IP address is added to the client list"
error log is not displayed, despite the BIG-IP not being added to the client list in Thales/nShield/Entrust HSM.
Conditions:
BIG-IP is not added to the client list in Thales/nShield/Entrust HSM.
Impact:
Difficult to debug the error condition to due lack of error message
Workaround:
None
Fix:
Grep error text information on stderror stream now works.
Fixed Versions:
17.0.0, 16.1.2.1, 15.1.5.1
1019357-2 : Active fails to resend ipsec ikev2_message_id_sync if no response received
Links to More Info: BT1019357
Component: TMOS
Symptoms:
In high availability (HA) setup, after failover, the newly active BIG-IP device, will send ikev2_message_id_sync messages to the other device.
If the BIG-IP device did not receive a response, it has to retransmit the packet. Some of the IKE tunnels are trying to retransmitting the packet, but its not going out of BIG-IP due to wrong state of relation between IKE tunnel and connection flow.
After 5 retries, it marks the peer as down, and the IKE tunnel is deleted.
Conditions:
-- High availability (HA) environment
-- IKE tunnels configured
-- A failover occurs
Impact:
Traffic loss.
Workaround:
None
Fix:
Fetch latest connection flow during retransmission of IKE/IPSEC packet.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1
1018613-1 : Modify wideip pools with replace-all-with results pools with same order 0
Links to More Info: BT1018613
Component: Global Traffic Manager (DNS)
Symptoms:
Multiple wideip pools have the order 0.
Conditions:
There are overlap for the pools for command replace-all-with and the pools to be replaced.
Impact:
iQuery flapping between GTMs.
Workaround:
First delete all pools from the wideip and then use replace-all-with.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
1018577-4 : SASP monitor does not mark pool member with same IP Address but different Port from another pool member
Links to More Info: BT1018577
Component: Local Traffic Manager
Symptoms:
When the LTM SASP monitor is applied to a pool with multiple members having the same IP Address but different Ports, only one of the pool members with the duplicated IP Address will be monitored (marked UP or DOWN as appropriate). Other pool members sharing the same IP Address will remain in a 'checking' state.
Conditions:
This occurs when using the SASP monitor in a pool with multiple members having the same IP Address but different Ports.
For example:
ltm pool sasp_test_pool {
members {
sasp_1:80 {
address 10.10.10.1
}
sasp_1:8080 {
address 10.10.10.1
}
sasp_2:80 {
address 10.10.10.2
}
sasp_2:8080 {
address 10.10.10.2
}
}
monitor sasp_test
}
In this case, only one pool member with a given IP Address will be correctly monitored by the sasp monitor.
Any additional pool members with the same IP Address but different port will not be monitored by the SASP monitor and will remain in a 'checking' state.
Impact:
Not all pool members may be effectively/accurately monitored by the SASP monitor.
Fix:
The ltm sasp monitor correctly monitors members of a pool which share the same IP Address but different Ports.
Fixed Versions:
17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5
1018493-1 : Response code 304 from TMM Cache always closes TCP connection.
Links to More Info: BT1018493
Component: Local Traffic Manager
Symptoms:
When a virtual server is configured to accelerate HTTP traffic, it caches responses with 200 and 304 response codes. Serving a response with "304 Not Modified" code, TMM may close a connection to a client.
Conditions:
-- A virtual server has a web-acceleration profile (without a web application for versions prior 16.0.0).
-- A response with code 304, stored in TMM cache, is served to a request.
Impact:
A client needs to open a new TCP connection every time when a response with "304 Not Modified" code is served.
Fix:
TMM correctly serves a response with "304 Not Modified" code, allowing to correctly handle TCP connection status.
Fixed Versions:
17.0.0, 16.1.2, 15.1.4, 14.1.4.5, 13.1.5
1018309-5 : Loading config file with imish removes the last character
Links to More Info: BT1018309
Component: TMOS
Symptoms:
While loading a configuration from the file with IMISH ('imish -f <f_name>'),truncating the last line.
printf 'log file /var/log/zebos.log1' >/shared/tmp/new.cfg
Running imish -r 0 -f /shared/tmp/new.cfg have the last character missing like below:
log file /var/log/zebos.log
Conditions:
Loading a config with 'imish -f <f_name>' commands.
Note: This command is used with the bigip_imish_config Ansible module.
Impact:
Configuration commands cannot be created properly.
Workaround:
For CLI, use extra control char at the end or \n.
Fixed Versions:
17.0.0, 16.1.1, 15.1.4.1
1018285-2 : MRF DIAMETER to select automatic removal of a persistence entry on completion of a transaction
Links to More Info: BT1018285
Component: Service Provider
Symptoms:
MRF DIAMETER is not DIAMETER-application aware. It does not have application-specific business logic. When creating a DIAMETER solution, BIG-IP operators often need to write iRule scripts that remove a session persistence entry at the end of a transaction.
Conditions:
Some applications require removal of the persistence entry upon successful and unsuccessful completion of a transaction.
root@(bigip1)(cfg-sync Standalone)(Active)(/Common)(tmos)# list ltm rule log_dia_error
ltm rule log_dia_error {
when DIAMETER_INGRESS {
set cmd_code [DIAMETER::command]
if { $cmd_code == 272 } {
set cc_req_type [DIAMETER::avp data get 416 integer32]
if {[DIAMETER::is_response] && $cc_req_type == 3 } {
log local0. "Persistence record delete-on-any"
DIAMETER::persist delete-on-any
}
}
}
Impact:
iRule script is required.
Fix:
DIAMETER::persist irule are supported to remove a persistence entry based on the result status of a answer message.
below irule commands are supported.
DIAMETER::persist delete-on-any
DIAMETER::persist delete-on-success
DIAMETER::persist delete-on-failure
DIAMETER::persist delete-none
Fixed Versions:
17.0.0, 16.1.2, 15.1.4.1
1018145 : Firewall Manager user role is not allowed to configure/view protocol inspection profiles
Links to More Info: BT1018145
Component: Protocol Inspection
Symptoms:
A user account with the "firewall-manager" role that is assigned permissions only to custom partitions will not be able to configure protocol inspection profiles.
Conditions:
-- A user account is created with the role firewall-manager.
-- A custom partition is created.
-- The newly created user is given access to the newly created partition.
Impact:
Any user account without access to "/Common" partition is not allowed to configure protocol inspection profiles.
Workaround:
- If the user account is provided access to "/Common" partition as well, the user should be able to configure protocol-inspection profiles in the newly created custom partitions.
Fix:
The permissions are granted for any non-admin user to configure protocol inspection profiles in a custom partition as long as they have access to "/Common" partition as well.
Fixed Versions:
16.1.1, 15.1.4
1017721-5 : WebSocket does not close cleanly when SSL enabled.
Links to More Info: BT1017721
Component: Local Traffic Manager
Symptoms:
After sending a close frame to the WebSocket server, the WebSocket client receives 1006 response.
Conditions:
Virtual server with the following profiles:
-- WebSocket
-- HTTP over SSL (at least server side SSL)
and connection closure is initiated by the client.
Impact:
Client side applications experience errors in the form of WebSocket abnormally closing connections with error code 1006.
Workaround:
Avoid using SSL on WebSocket server context.
Fix:
WebSocket connections close without any error.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5.1
1017533-3 : Using TMC might cause virtual server vlans-enabled configuration to be ignored
Links to More Info: BT1017533
Component: Local Traffic Manager
Symptoms:
When switching between traffic-matching-criteria (TMC) and regular virtual-server configuration, the vlans-enabled option might be ignored, causing unexpected traffic handling.
Conditions:
Changing virtual-server configuration when using traffic-matching-criteria.
Impact:
Unexpected traffic handling and disruption
Workaround:
Avoid using TMC (port lists and address lists). When in a 'faulty' state you can try changing vlan-enabled on and changing it back on the virtual server, you might need to clear existing connections afterwards.
Follow below articles.
K53851362: Displaying and deleting BIG-IP connection table entries from the command line
K52091701: Handling Connections that have been matched to the wrong Virtual Server.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1, 14.1.4.6
1017513-5 : Config sync fails with error Invalid monitor rule instance identifier or monitors are in a bad state such as checking
Links to More Info: BT1017513
Component: Local Traffic Manager
Symptoms:
If you remove or attach a different monitor to an fqdn pool, then perform a full config-sync, an error occurs:
Load failed from /Common/bigip1 01070712:3: Caught configuration exception (0), Invalid monitor rule instance identifier: 58.
This error can occur on FQDN nodes or regular nodes. It's the use of fqdn nodes that allows this issue to occur.
Conditions:
-- BIG-IP device is configured with fqdn nodes/pools with monitors.
-- Modify an fqdn pool to remove or attach a different monitor.
-- Run the command:
run cm config-sync to-group Failover
-- Perform a full config-sync.
Impact:
You might experience the following:
-- Sync to the peer devices fails.
-- Monitors may be stuck in an unexpected state such as down (even with a good reply) or checking even though an up or down response is received.
Workaround:
Use incremental-sync.
If incremental sync fails to correct the issue it can sometimes be recovered by running the following command:
bigstart restart mcpd
Note: Traffic disrupted while the system restarts.
Fixed Versions:
17.0.0, 16.1.2.1, 15.1.5.1, 14.1.4.5, 13.1.5
1017233-2 : APM uses wrong session key when iRule for ActiveSync is used resulting in passwords corruption
Links to More Info: BT1017233
Component: Access Policy Manager
Symptoms:
A corrupted password is sent as part of the "Authorization" header to the backend device and as a result, http 404 is returned
Conditions:
-- iRule for ActiveSync is used
-- The BIG-IP system has multiple tmms running
Impact:
User Authentication is failed by the backed server
Fixed Versions:
17.0.0, 16.1.2, 15.1.4.1
1017153-4 : Asmlogd suddenly deletes all request log protobuf files and records from the database.
Links to More Info: BT1017153
Component: Application Security Manager
Symptoms:
Asmlogd suddenly deletes all request log protobuf files and records from the database.
Additionally, after the deletion happens, newly generated event logs seen in database do not show up in TMUI.
Conditions:
-- ASM provisioned
-- Config-sync setup, with frequent sync recovery and/or with a manual-sync device-group with ASM sync enabled.
Impact:
Sudden loss of request logs.
Workaround:
Delete all empty partitions and restart asmlogd.
1) View all the partitions:
# perl -MF5::Db::Partition -MData::Dumper -MF5::DbUtils -e 'print Dumper(F5::Db::Partition::retrieve_partitions_info(dbh => F5::DbUtils::get_dbh(), table_name => "PRX.REQUEST_LOG"))'
Take note of the 'PARTITION_NAME' and 'TABLE_ROWS' for each partition.
2) For every partition_X (in PARTITION_NAME) with '0' in TABLE_ROWS, delete it by:
# perl -MF5::Db::Partition -MF5::DbUtils -e 'F5::Db::Partition::delete_partition(dbh => F5::DbUtils::get_dbh(), table_name => "PRX.REQUEST_LOG", partition_name => "partition_X")'
3) restart asmlogd if and after done all deletes:
# pkill -f asmlogd
NOTE: this workaround is temporary. Meaning, that the number of empty partitions will again accumulate and the same issue will happen again. The MAX number of partitions is - 100. Thus, it is advised to monitor the total number of *empty* partitions and repeat the workaround periodically. A cron script should work well. Normally, empty partitions should NOT accumulate. Thus, it is safe to run this script once an hour and remove all empty partitions.
Optionally, if you are having TMUI issue with newly generated event logs, perform the additional command below to delete rows from PRX.REQUEST_LOG_PROPERTIES for which no corresponding rows exist in PRX.REQUEST_LOG.
# mysql -t -u root -p$(perl -MPassCrypt -nle 'print PassCrypt::decrypt_password($_)' /var/db/mysqlpw) -e 'delete from PRX.REQUEST_LOG_PROPERTIES where request_log_id > (select id from PRX.REQUEST_LOG order by id desc limit 1)'
Fix:
Upgrading to a fixed software version will not delete accumulated partitions and will not clear the symptom away. The fix will prevent ASM from accumulating partitions unnecessarily in the scenarios.
If your ASM system is experiencing this and partitions are accumulated, perform the workaround to clear the symptom. Using a fixed software version, you only need to perform the workaround once. You no longer have to perform it periodically.
Fixed Versions:
17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5
1016449-3 : After certain configuration tasks are performed, TMM may run with stale Self IP parameters.
Links to More Info: BT1016449
Component: Local Traffic Manager
Symptoms:
A Self IP instantiated by performing specific configuration tasks (see Conditions) does not work (e.g. the system does not respond to ARP requests for it).
On the contrary, the system continues to use (e.g. respond to ARP requests for) an old version of the Self IP specifying a different address.
Conditions:
This issue is known to occur when one of the following operations is performed:
- Restoring a UCS or SCF archive in which a Self IP with a specific name specifies a different address.
- Performing a config-sync between redundant units in which the sender changes a Self IP with a specific name to use a different address. For example:
tmsh delete net self <name>
tmsh create net self <name> address <new_address> ...
tmsh run cm config-sync to_group ...
- Performing specific tmsh CLI transactions involving Self IP modifications.
Impact:
The system does not utilise the configured Self IP address. Traffic will be impacted as a result (for example, in connections to the unit, in snat automap, etc.).
Workaround:
Restart TMM (bigstart restart tmm) on affected units.
Fix:
TMM now correctly handles supported Self IP address modifications.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6
1016441-4 : RFC Enforcement Hardening
Component: Local Traffic Manager
Symptoms:
When the HTTP profile RFC Enforcement Flag is enabled, certain non-RFC compliant headers are still allowed.
Conditions:
- Virtual Server with HTTP profile.
- RFC Enforcement Flag enabled.
- HTTP request with non-RFC compliant headers.
Impact:
Non-RFC compliant headers passed to server.
Workaround:
N/A
Fix:
BIG-IP will drop non-RFC compliant HTTP requests when the RFC compliance flag is ON.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6
1016113-1 : HTTP response-chunking 'sustain' profile option may not rechunk responses when also using a web acceleration profile.
Links to More Info: BT1016113
Component: Local Traffic Manager
Symptoms:
Configurations containing HTTP response-chunking 'sustain' and a Web Acceleration profile do not rechunk payload regardless of whether the web server responds with a chunked response.
Conditions:
-- Incoming response payload to the BIG-IP system is chunked.
-- HTTP profile is configured with response-chunking 'sustain'.
-- Web Acceleration profile also configured on the same virtual server.
Impact:
The BIG-IP response is not chunked, regardless of whether the associated web server responds with a chunked payload when the Web Acceleration is utilized.
Workaround:
For a chunked response to be delivered to the client, apply the iRule command 'HTTP::rechunk' to responses when a Web Acceleration profile is used.
Fix:
The BIG-IP response is chunked appropriately when a Web Acceleration profile is used.
Fixed Versions:
17.0.0, 16.1.2, 15.1.4
1016049-6 : EDNS query with CSUBNET dropped by protocol inspection
Links to More Info: BT1016049
Component: Local Traffic Manager
Symptoms:
EDNS query might be dropped by protocol inspection with an error log in /var/log/ltm similar to:
info tmm[21575]: 23003139 SECURITYLOG Drop sip:192.168.0.0 sport:64869 dip:1.1.1.1 dport:53 query:test.f5.com qtype:malformed attack:malformed
Conditions:
Query containing CSUBNET option.
Impact:
Some queries might fail.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6
1015881-4 : TMM might crash after configuration failure
Links to More Info: BT1015881
Component: Application Security Manager
Symptoms:
TMM crashes after DoSL7 application configuration failure
Conditions:
DoSL7 configuration is changed, and the configuration change fails in TMM.
Impact:
Traffic disrupted while TMM restarts.
Workaround:
None
Fixed Versions:
17.1.0, 16.1.3.1, 15.1.7
1015645-2 : IPSec SA's missing after reboot
Links to More Info: BT1015645
Component: TMOS
Symptoms:
Some IPSec SA's created after Tunnel migration may be missing after a reboot.
Conditions:
- IPSec tunnels
- Load balancing continues through tunnel migration
- The active BIG-IP system is rebooted
Impact:
Some IPSec SA's may be missing after the reboot
Workaround:
None
Fix:
During reboot, Load balancing information is loaded based on creation time instead of arrival time.
Fixed Versions:
17.0.0, 16.1.2
1015133-5 : Tail loss can cause TCP TLP to retransmit slowly.
Links to More Info: BT1015133
Component: Local Traffic Manager
Symptoms:
If a long tail loss occurs during transmission, TCP might be slow to recover.
Conditions:
-- A virtual server is configured with the TCP profile attached.
-- SACK and TLP are enabled.
-- A tail loss of multiple packets sent by the BIG-IP occurs.
Impact:
BIG-IP retransmits one packet per RTT, causing a long recovery. The impact is more pronounced if an entire window is lost.
Workaround:
Disabling TLP may improve performance in this particular case, but may degrade performance in other situations.
Fix:
A new sys db key was added: tm.tcpaggressivepartialack (disabled by default). When enabled, more data is retransmitted every RTT, similar to slow-start.
Behavior Change:
A new sys db key was added: tm.tcpaggressivepartialack (disabled by default). When enabled, more data is retransmitted every RTT, similar to slow-start.
Fixed Versions:
17.0.0, 16.1.2.1, 15.1.5, 14.1.4.5, 13.1.5
1014973-5 : ASM changed cookie value.
Links to More Info: BT1014973
Component: Application Security Manager
Symptoms:
ASM changes the value of a cookie going to the server.
Conditions:
Specific conditions.
Impact:
Domain cookie will reach the server with a wrong value. Can cause different malfunctions depending on the application.
Workaround:
Change the following db variable:
tmsh modify sys db asm.strip_asm_cookies (https://support.f5.com/csp/article/K30023210) value false.
There is no need to restart asm.
Add an iRule without the use of strip_asm_cookies:
https://support.f5.com/csp/article/K13693.
Fix:
Original cookies not being deleted/modified after the removing of TS cookies in ASM.
Fixed Versions:
17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7
1014573-1 : Several large arrays/objects in JSON payload may core the enforcer
Links to More Info: BT1014573
Component: Application Security Manager
Symptoms:
Requests with JSON payload that consists of more than one object with elements, such as a couple of large arrays, may cause the enforcer to crash.
Conditions:
Each of the objects/arrays in JSON payload has to consist lesser amount of elements than defined in the "Maximum Array Length" JSON profile attribute.
Impact:
Large enough arrays may cause performance decrease, in addition, the enforcer may crash.
Workaround:
Set "Maximum Array Length" to a lower value than the requests array length.
Fix:
Added internal param "count_overall_child_elements_in_json" to control "Maximum Array/Object Elements" behaviour:
0 (default) - retain current behaviour (check max elements in each array/object separately);
1 - count overall elements in all arrays/objects.
Fixed Versions:
17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7, 14.1.5.1
1013629-4 : URLCAT: Scan finds many Group/User Read/Write (666/664/662) files
Links to More Info: BT1013629
Component: Traffic Classification Engine
Symptoms:
Shared memory files in relation with URLCAT have file permissions set to (-rwxrwxrwx), which is not necessary and needs to be restricted to (-rw-rw-r--).
Conditions:
Policy Enforcement Manager is provisioned
Impact:
Full permission can result in unintentional/unauthorized access, which could result in unexpected behavior of the URLCAT feature.
Workaround:
Manually change permissions from (-rwxrwxrwx) to (-rw-rw-r--) using the chmod command.
Fix:
Shared Memory file permissions are now set to (-rw-rw-r--).
Fixed Versions:
17.0.0, 16.1.2
1012721-4 : Tmm may crash with SIP-ALG deployment in a particular race condition
Links to More Info: BT1012721
Component: Service Provider
Symptoms:
Tmm crashes in SIP-ALG deployment
Conditions:
--- SIP-ALG is deployed
--- While processing first SIP REGISTER at server-side
Impact:
Traffic disrupted while tmm restarts.
Workaround:
None
Fix:
Tmm no longer crashes in this race condition
Fixed Versions:
17.0.0, 16.1.1, 15.1.4.1, 14.1.4.4, 13.1.5
1012581-1 : Evidence of hardware syncookies triggered but no stats after tcp half-open is triggered
Links to More Info: BT1012581
Component: Advanced Firewall Manager
Symptoms:
As soon as global syncookie enabled stats counts starts decrementing and when attack_detection_common callback function calls, the stats range is always under the configured packets per-second threshold, resulting in some tmms not being able to detect the attack but syncookies are already enabled on these tmms, and no statistics are gathered.
Conditions:
A SYN flood attack or similar SYN attack where SYNs are flooded into the BIG-IP system.
Impact:
SYN cookies may still be sent after traffic goes below the attack detection threshold.
Workaround:
Restart tmm
Fix:
Now, global syncookie state changing from full-hardware to non-activated when attack ends.
Fixed Versions:
17.0.0, 16.1.3, 15.1.6.1, 14.1.5
1012221-1 : Message: childInheritanceStatus is not compatible with parentInheritanceStatus★
Links to More Info: BT1012221
Component: Application Security Manager
Symptoms:
The BIG-IP system is unable to deploy a revision of upgraded child policies and you see an error:
Failed pushing changed objects to device <device>: Could not update the Section 'Threat Campaigns'. childInheritanceStatus is not compatible with parentInheritanceStatus.
Conditions:
-- An ASM Child Policy is present on the BIG-IP device in a version earlier than 14.0.0
-- The BIG-IP system is upgraded to version 14.0.0 or later
Impact:
This corruption impacts BIG-IQ interactions with the Child Policy and causes exported Child Policies to be incorrect.
Workaround:
After upgrading, perform the following:
1. Log into the BIG-IP Configuration Utility
2. Go to Security :: Application Security :: Security Policies :: Policies List
3. Select the first Parent Policy
4. Go to Inheritance settings and change Threat Campaigns from None to Optional
5. Click Save Changes
6. Change Threat Campaigns from Optional back to None
7. Click Save Changes
8. Click Apply
9. Repeat steps 3-8 for each additional Parent Policy
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6
1011433-1 : TMM may crash under memory pressure when performing DNS resolution
Links to More Info: BT1011433
Component: Global Traffic Manager (DNS)
Symptoms:
When running low on free memory, TMM may crash when performing DNS resolution.
Conditions:
-- TMM is under memory pressure.
-- TMM is performing DNS resolution via one of the following mechanisms:
--+ iRule using the "RESOLV::lookup" command
--+ AFM firewall rules that reference hostnames
--+ APM
Impact:
Traffic disrupted while tmm restarts.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1
1011217-5 : TurboFlex Profile setting reverts to turboflex-base after upgrade★
Links to More Info: BT1011217
Component: TMOS
Symptoms:
Custom TurboFlex Profile settings revert to the default turboflex-base profile after an upgrade.
Conditions:
-- iSeries platform with ix800 performance license
-- A non-default TurboFlex Profile is applied
-- The BIG-IP device is upgraded
Impact:
Some features of the previously selected TurboFlex Profile that are not part of the turboflex-base profile, are missing after upgrade. The TurboFlex Profile must be reconfigured after upgrade.
Workaround:
Reconfigure the TurboFlex Profile after upgrade.
Fix:
TurboFlex Profile settings are now preserved after the upgrade.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1
1011069-1 : Group/User R/W permissions should be changed for .pid and .cfg files.
Links to More Info: BT1011069
Component: Application Security Manager
Symptoms:
The following files should be set with lower permissions:
/etc/ts/dcc/dcc.cfg (-rw-rw--w-)
/run/asmcsd.pid (-rw-rw--w-)
/run/bd.pid (-rw-rw--w-)
/run/dcc.pid (-rw-rw--w-)
/run/pabnagd.pid (-rw-rw--w-)
Conditions:
Always
Impact:
Incorrect file permissions.
Workaround:
chmod 664 <files_list>
Fix:
The corrected permissions 664 are applied to the given list of files.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
1011065-1 : Certain attack signatures may not match in multipart content
Links to More Info: K39002226, BT1011065
Component: Application Security Manager
Symptoms:
Under certain conditions, ASM may not correctly detect attack signatures.
Conditions:
- ASM provisioned
- Request contains multipart body that matches specific attack signatures.
Impact:
Attack detection is not triggered as expected.
Workaround:
None
Fix:
Attack detection is now triggered as expected.
Fixed Versions:
17.0.0, 16.1.2, 15.1.4.1
1011061-4 : Certain attack signatures may not match in multipart content
Links to More Info: K39002226, BT1011061
Component: Application Security Manager
Symptoms:
Under certain conditions, ASM may not correctly detect attack signatures.
Conditions:
- ASM provisioned
- Request contains a specially-crafted multipart body
Impact:
Attack detection is not triggered as expected.
Workaround:
None
Fix:
Attack detection is now triggered as expected.
Fixed Versions:
17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5
1010617-1 : String operation against DNS resource records cause tmm memory corruption
Links to More Info: BT1010617
Component: Global Traffic Manager (DNS)
Symptoms:
Tmm cores with umem debug enabled.
Conditions:
A string operation is performed against DNS resource records (RRs) in an iRule.
Impact:
Tmm memory corruption. In some situations, tmm could crash. Traffic disrupted while tmm restarts.
Workaround:
Do not use string operation against DNS RRs.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1
1010597-1 : Traffic disruption when virtual server is assigned to a non-default route domain★
Links to More Info: BT1010597
Component: Access Policy Manager
Symptoms:
Assigning a virtual server to a non-default route domain might cause a traffic disruption.
Conditions:
-- An APM virtual server is assigned to a route domain other than 0 (zero, the default).
-- An access policy has an agent that results in tmm communicating to the renderer (e.g., Logon agent, HTTP 401 Response agent, and others).
Impact:
Access policy fails.
Workaround:
1. Log in to the Configuration utility.
2. Go to Network > Route Domains > affected route domain.
3. In the section Parent Name select '0 (Partition Default Route Domain)'.
4. Select Update.
Fixed Versions:
17.0.0, 16.1.3.1, 15.1.6.1, 14.1.5.1
1009949-4 : High CPU usage when upgrading from previous version★
Links to More Info: BT1009949
Component: TMOS
Symptoms:
When upgrading version from 12.x to 14.1.4, ospfd has high cpu utilization.
Conditions:
-- OSPF is enabled.
-- The BIG-IP system is upgraded from 12.x to 14.1.4.
Impact:
Performance Impact.
Fixed Versions:
17.0.0, 16.1.2, 15.1.4.1, 14.1.4.4
1009093-2 : GUI widgets pages are not functioning correctly
Links to More Info: BT1009093
Component: Application Visibility and Reporting
Symptoms:
Some links and drop-down fields are not available for 'pressing/clicking' on AVR-GUI widgets pages
Conditions:
AVR/ASM is provisioned
Impact:
Cannot use AVR GUI pages correctly
Workaround:
1. Back up the following file, and then edit it:
/var/ts/dms/amm/templates/overview.tpl
1.a. Remove the following line:
<script type="text/javascript" src="script/analytics_stats.js{{BIGIP_BUILD_VERSION_JS}}"></script>
1.b. Add the following lines after the 'var _default_smtp = '{{smtp_mailer}}';' line:
$(document).ready(function() {
if(!window.AVR_LOCALIZATION) return;
$('.need-localization-avr').each(function() {
var item = $(this);
if (item.is("input")) {
var key = "avr." + item.val().replace(/\s/g, '');
item.val(window.AVR_LOCALIZATION[key] || item.val());
} else {
var key = "avr." + item.text().replace(/\s/g, '');
item.text(window.AVR_LOCALIZATION[key] || item.text());
}
}).removeClass('need-localization-avr');
});
1.c. Save and exit (might require the 'force' save with root user).
2. Log out of the GUI.
3. Log back in.
Fix:
GUI widgets pages now function correctly.
Fixed Versions:
17.0.0, 16.1.2.1, 15.1.5
1009037-1 : Tcl resume on invalid connection flow can cause tmm crash
Links to More Info: BT1009037
Component: Global Traffic Manager (DNS)
Symptoms:
Tmm crashes.
Tmm logs contain a line that looks like: "Oops @ 0x2bbd463:139: Unallocated flow while polling for rule work. Skipping."
Conditions:
1) iRule uses a function that may suspend iRule processing (see https://support.f5.com/csp/article/K12962 for more about this).
2) The connflow associated with the iRule is being torn down by tmm.
3) Depending upon the exact timing there is a rare chance that the iRule will resume on the wrong connflow which can cause a core.
Impact:
Traffic disrupted while tmm restarts.
Workaround:
None
Fixed Versions:
17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5
1008849-4 : OWASP "A4 XML External Entities (XXE)" is not reflecting the XXE signatures configuration.
Links to More Info: BT1008849
Component: Application Security Manager
Symptoms:
To fulfill "A4 XML External Entities (XXE)", some required signatures need to be enforced.
Due to an update in some of those attack signatures names, this section does not find the signatures and by mistake it shows that the signatures are not enforced.
Also, when you choose to enforce the required signatures, this section tries to enforce the signatures, but looks for them via the old name, so it does not find them, and can't enforce them.
Conditions:
The attack signatures file is updated with the new names for the XXE signatures.
The old names are in use while trying to find and enforce the signatures, but it does not find them and can't enforce them and also can't see if they are already enforced.
Impact:
"A4 XML External Entities (XXE)" Compliance can't be fully compliant.
Workaround:
N/A
Fix:
The signature ID is being used instead of signature name, and now it can find them and enforce them if needed.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1
1008837-1 : Control plane is sluggish when mcpd processes a query for virtual server and address statistics
Links to More Info: BT1008837
Component: TMOS
Symptoms:
When there are thousands of rows in the virtual_server_stat table and mcpd receives a query for for all virtual server or virtual address statistics, mcpd can take a long time to process the request.
There might be thousands of rows if thousands of virtual servers server are configured.
There could also be thousands of rows if there are virtual servers configured for source or destination address lists, where those lists contain tens or hundreds of addresses.
Conditions:
-- Thousands of virtual_server_stat rows.
-- mcpd processes a query_stats request for the virtual_server_stat table.
Impact:
When mcpd is processing a query for virtual server statistics:
-- TMSH and GUI access is very slow or non-responsive.
-- SNMP requests timeout.
-- mcpd CPU usage is high.
Workaround:
None
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.4, 14.1.4.4
1008501-1 : TMM core
Links to More Info: BT1008501
Component: Local Traffic Manager
Symptoms:
TMM crashes.
Conditions:
Transparent monitors monitoring a virtual server's IP address.
Note: Although this is the current understanding of the issue, it is not clear whether this is an true requirement for the issue to occur.
Impact:
Traffic disrupted while tmm restarts.
Workaround:
None
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6
1008269-1 : Error: out of stack space
Links to More Info: BT1008269
Component: TMOS
Symptoms:
When polling for profile statistics via iControl REST, the BIG-IP system returns an error:
Error: out of stack space
Conditions:
Polling stats via iControl REST.
Impact:
You are intermittently unable to get stats via iControl REST.
Workaround:
None
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
1008265-1 : DoS Flood and Sweep vector states are disabled on an upgrade to BIG-IP software versions 14.x and beyond★
Links to More Info: K92306170, BT1008265
Component: Advanced Firewall Manager
Symptoms:
DoS Flood and Sweep vector states are disabled after upgrade.
Conditions:
DoS Flood and Sweep vectors are enabled prior to an upgrade to software release 14.x and beyond.
Impact:
DoS Flood and Sweep vector states are disabled. System is susceptible to a DoS attack.
Workaround:
Reset the DoS Flood and Sweep vectors to their previous state.
Fix:
Removed default disabled state from upgrade scripts so that both vectors were restored to previous configured state
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6
1008017-2 : Validation failure on Enforce TLS Requirements and TLS Renegotiation
Links to More Info: BT1008017
Component: Local Traffic Manager
Symptoms:
The configuration load fails with an error:
err mcpd[4182]: 0107186b:3: Invalid "enforce-tls-requirements" value for profile /prod/my_profile. In Virtual Server (/common/my_virtual_server) an http2 profile with enforce-tls-requirements enabled is incompatible with client-ssl/server-ssl profile with renegotiation enabled. Value must be disabled.
Conditions:
BIG-IP system allows this configuration and fails later:
-- Virtual server with HTTP/2, HTTP, and client SSL profiles (with renegotiation disabled).
1. Enable the 'Enforce TLS Requirements' option in the HTTP/2 profile (by default it is enabled).
2. Add server SSL profile with 'TLS Renegotiation' enabled.
3. Save the configuration.
4. Load the configuration.
Impact:
The configuration will not load if saved.
Workaround:
If enabling 'Enforce TLS Requirements' in a HTTP/2 profile configured on a virtual server, ensure that 'TLS Renegotiation' is disabled in the Server SSL profiles on that virtual server.
Fix:
There is now a validation check to prevent this configuration, which is the correct functionality.
Fixed Versions:
17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5
1008009-3 : SSL mirroring null hs during session sync state
Links to More Info: BT1008009
Component: Local Traffic Manager
Symptoms:
Tmm crashes.
Conditions:
-- SSL connection mirroring enabled
-- Running a version where ID 760406 is fixed (https://cdn.f5.com/product/bugtracker/ID760406.html)
-- A handshake failure occurs during session sync
Impact:
Traffic disrupted while tmm restarts.
Workaround:
Disable connection mirroring
Fix:
The system now protects for dropped SSL handshakes during connection mirror session sync.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.5
1007901-1 : Support for FIPS 140-3 Module identifier service.
Links to More Info: BT1007901
Component: TMOS
Symptoms:
The module provides a service to output module name/identifier and version that can be mapped to the validation records.
The 'tmsh show sys version' command shows a version, but it does not show a module name, where the "module name" is the name on the FIPS certificate.
Conditions:
Running 'tmsh show sys version' while the system is running in FIPS mode
Impact:
The module does not provide a service to output module name/identifier and version that can be mapped to the validation records.
Workaround:
N/A
Fix:
Added the FIPS module information to output of command "show sys version". FIPS module information is now appended after "Project" field info of the "show sys version"
The syntax of the new field is "FIPS Module <FIPS_module_name>"
In the GUI, FIPS module info shall be appended to existing "Version" information shown under system(tab)→Device→Version
The syntax will be "Version: <Existing Info> <FIPS_module_name>
Fixed Versions:
17.0.0, 16.1.2.2
1007821-3 : SIP message routing may cause tmm crash
Links to More Info: BT1007821
Component: Service Provider
Symptoms:
In very rare circumstances, tmm may core while performing SIP message routing.
Conditions:
This can occur while passing traffic when SIP message routing is enabled.
Impact:
Traffic disrupted while tmm restarts.
Workaround:
None
Fix:
SIP message routing no longer results in a core due to internal memory errors in message parsing.
Fixed Versions:
17.0.0, 16.1.1, 15.1.4
1007749-2 : URI TCL parse functions fail when there are interior segments with periods and semi-colons
Links to More Info: BT1007749
Component: Local Traffic Manager
Symptoms:
URI::path, URI::basename, etc., return the wrong strings, e.g., URI::path can return a subset of what it should return.
Conditions:
This happens for URIs like these:
/alpha/beta/Sample.text;param/trailer/
/alpha/beta/Sample.text;param/file.txt
Impact:
iRules fail to work as expected for these types of URIs.
This occurs because the combination of the period and semi-colon in 'Some.thing;param' confuses the BIG-IP system parser, causing incorrect results to be returned.
Workaround:
If this is happening for known URIs, then it should be possible to process those URIs in a special way within iRules to do things like temporarily replacing interior periods with another character, like a plus sign.
Fixed Versions:
17.0.0, 16.1.2.1, 15.1.5
1007677-2 : Artifact resolution on SAML IdP fails with error 'SAML SSO: Cannot find SP connector'
Links to More Info: BT1007677
Component: Access Policy Manager
Symptoms:
SAML fails on APM SAML IdP after receiving the SAML ArtifactResolve Request, and needs to extract Artifact data from sessionDB to build the assertion. An error is logged:
-- err tmm[24421]: 014d1211:3: ::ee23458f:SAML SSO: Cannot find SP connector (/Common/example_idp)
-- err tmm[24421]: 014d0002:3: SSOv2 plugin error(12) in sso/saml.c:11864
Conditions:
The 'session-key' in the sessiondb includes a colon ':' in its value.
Impact:
SAML may fail on APM SAML IdP using artifact binding.
Fix:
The system now handles this occurrence of 'session-key'.
Fixed Versions:
17.0.0, 16.1.2.1, 15.1.4.1
1007113-3 : Pool member goes DOWN if the time difference between SCTP INIT and SCTP ABORT is less than two seconds
Links to More Info: BT1007113
Component: Service Provider
Symptoms:
In case of diameter over SCTP, while aborting the connection of the pool member, if SCTP INIT is sent by the BIG-IP system before the SCTP ABORT is processed, the pool member is marked UP (provided the SCTP connection is established successfully), and then goes down later, immediately after ABORT is fully processed.
Conditions:
The time difference between SCTP ABORT and SCTP INIT is very small, i.e., 2 seconds or less
Impact:
Pool member is marked DOWN even though it is active
Workaround:
If the watchdog is configured in the diameter session profile (i.e., watchdog-timeout is greater than 0), the pool member is marked UP after DWA is received from the pool member.
Fix:
The system now marks the pool member as UP if DWA is received from the pool member.
Fixed Versions:
17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5
1006893-4 : Use of ACCESS::oauth after ACCESS::session create/delete may result in TMM core
Links to More Info: BT1006893
Component: Access Policy Manager
Symptoms:
When ACCESS::oauth is used after ACCESS::session create/delete in an iRule event, TMM may core.
Conditions:
ACCESS::oauth is used after ACCESS::session create/delete in an iRule event.
Impact:
Traffic disrupted while tmm restarts.
Workaround:
No workaround
Fix:
TMM does not core and functionality works as expected.
Fixed Versions:
17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5
1006781-2 : Server SYN is sent on VLAN 0 when destination MAC is multicast
Links to More Info: BT1006781
Component: Local Traffic Manager
Symptoms:
TCP connections cannot be established when a multicast destination MAC is used. Traffic outage occurs.
Conditions:
Virtual wire with multicast destination MAC used while establishing TCP connections.
Impact:
Traffic outage.
Workaround:
None
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.4.1
1006157-3 : FQDN nodes not repopulated immediately after 'load sys config'
Links to More Info: BT1006157
Component: Local Traffic Manager
Symptoms:
A DNS query is not sent for configured FQDN nodes until the TTL value expires.
Conditions:
This occurs when 'load sys config' is executed.
Impact:
Name addresses do not resolve to IP addresses until the TTL expires.
Workaround:
You can use either of the following workarounds:
-- Change the default TTL value to be fewer than 300 seconds (the default value is 3600 seconds).
-- Restart dynconfd daemon:
tmsh restart sys service dynconfd
Fixed Versions:
17.1.0, 17.0.0.1, 16.1.3.1, 15.1.7, 14.1.5.1
1005109-4 : TMM crashes when changing traffic-group on IPv6 link-local address
Links to More Info: BT1005109
Component: Local Traffic Manager
Symptoms:
TMM crashes when changing the traffic-group on an IPv6 link-local address.
Conditions:
Changing the traffic-group on an IPv6 link-local address.
Impact:
Traffic disrupted while tmm restarts.
Workaround:
None
Fixed Versions:
17.0.0, 16.1.2.1, 15.1.5, 14.1.4.5
1005105-3 : Requests are missing on traffic event logging
Links to More Info: BT1005105
Component: Application Security Manager
Symptoms:
Some traffic requests are missing in Security :: Event Logs.
Conditions:
-- Local logging enabled
-- Two or more virtual servers passing heavy traffic
Impact:
High CPU load prevents the Policy Builder from analyzing and sending all traffic requests to the request log.
Workaround:
None
Fix:
The Policy Builder now attempts to send traffic requests to the request log, even when learning analysis is limited due to high CPU load.
Fixed Versions:
17.0.0, 16.1.1, 15.1.4, 14.1.4.5
1004897-5 : 'Decompression' is logged instead of 'Max Headers Exceeded' GoAway reason
Links to More Info: BT1004897
Component: Local Traffic Manager
Symptoms:
In HTTP2 setup, when the header count from the client request exceeds max-header-count value in the HTTP profile , COMPRESSION_ERROR(0x09) is seen in GoAway frame instead of FRAME_SIZE_ERROR(0x06)
Conditions:
- Virtual server with HTTP2 enabled
- A http2 request has a header count that exceeds 'Maximum Header Count' in the HTTP profile (default value is 64)
Impact:
Wrong GoAway Reason is logged
Fix:
When header count in client request exceeds max-header-count value in HTTP profile
1) FRAME_SIZE_ERROR(0x06) error code sent with GoAway frame
2) In http2 profile stats (tmsh show ltm profile http2 all) 'Max Headers Exceeded' is logged as GoAway reason
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1, 14.1.4.4
1004833 : NIST SP800-90B compliance
Links to More Info: BT1004833
Component: TMOS
Symptoms:
Common Criteria and FIPS 140-2 certifications require compliance with NIST SP800-90B; this completes that compliance.
Conditions:
This applies to systems requiring Common Criteria and/or FIPS 140-2 compliance.
Impact:
BIG-IP systems running without this fix on a release targeted for certification (BIG-IP 14.1.4.2 or BIG-IP 15.1.2.1) will not be running a Common Criteria and/or FIPS 140-2 certified configuration.
Workaround:
None
Fix:
Apply this fix to ensure that the system is compliant with NIST SP800-90B.
Fixed Versions:
17.0.0, 16.1.3, 15.1.4, 14.1.4.2
1004689-4 : TMM might crash when pool routes with recursive nexthops and reselect option are used.
Links to More Info: BT1004689
Component: Local Traffic Manager
Symptoms:
When re-selecting to the non-directly-connected pool route member for which the route was withdrawn, TMM might experience a crash.
Conditions:
- Pool routes with non-directly-connected or recursive nexthops (pool members).
- Reselect option enabled.
- Pool members go down/up so that the re-select is triggered.
Impact:
Traffic disrupted while TMM restarts.
Workaround:
Do not use non-directly-connected/recursive nexthops (pool members) in pool routes.
Fix:
N/A
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5
1004665 : Secure iAppsLX Restricted Storage issues.
Links to More Info: BT1004665
Component: iApp Technology
Symptoms:
iAppLX restricted storage needs hardening.
Conditions:
iAppLX applications (such as SSL Orchestrator) that contain configuration objects that use restricted parameters like password or passphrase.
Impact:
Stronger encryption needed for sensitive data.
Workaround:
None
Fix:
The iAppLX master key is now stored in mcpd's secure vault as a new secure config object name "iapp_restricted_key".
Fixed Versions:
17.0.0, 16.1.3
1004537-2 : Traffic Learning: Accept actions for multiple suggestions not localized
Links to More Info: BT1004537
Component: Application Security Manager
Symptoms:
When you open the accept suggestions actions list, the actions are not localized. Labels are shown instead of text, for example asm.button.Accept instead of Accept.
Conditions:
This occurs after selecting several suggestions and opening the Accept suggestions actions list.
Impact:
Actions not localized.
Workaround:
None
Fix:
Fixed localization for Accept suggestions actions list.
Fixed Versions:
17.0.0, 16.1.2, 15.1.4
1004069-4 : Brute force attack is detected too soon
Links to More Info: BT1004069
Component: Application Security Manager
Symptoms:
A Brute force attack is detected too soon.
Conditions:
The login page has the expected header validation criteria.
Impact:
The attack is detected earlier than the setpoint.
Workaround:
N/A
Fixed Versions:
17.0.0, 16.1.2, 15.1.5, 14.1.4.5, 13.1.5
1003633-1 : There might be wrong memory handling when message routing feature is used
Links to More Info: BT1003633
Component: Service Provider
Symptoms:
The following log is observed from /var/log/ltm
Oops @ 0x28c3060:232: buf->ref == 0
Conditions:
Message routing is used either by
- Generic message (ltm message-routing generic) or
- HTTP2 with Message router option enabled
Impact:
For most cases, this kind of incorrect memory handling may only generate warning log message. In rare case, it might lead to a tmm crash.
Workaround:
N/A
Fix:
Wrong memory handling in message routing is fixed.
Fixed Versions:
17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5
1003257-6 : ZebOS 'set ipv6 next-hop' and 'set ipv6 next-hop local' do not work as expected
Links to More Info: BT1003257
Component: TMOS
Symptoms:
ZebOS 'set ipv6 next-hop' and 'set ipv6 next-hop local' commands are not working properly. The address is always set to interface-configured global/local addresses respectively.
Conditions:
Using BGPv4 with IPv6 capability extension and a route-map with 'set ipv6 next-hop' and/or 'set ipv6 next-hop local' configuration.
Impact:
Wrong next-hop is advertised.
Workaround:
None.
Fixed Versions:
17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5
1002945-4 : Some connections are dropped on chained IPv6 to IPv4 virtual servers.
Links to More Info: BT1002945
Component: Local Traffic Manager
Symptoms:
IPv6 virtual servers targeting IPv4 virtual servers (for example, using the 'virtual' iRule command) might drop traffic coming from some clients unexpectedly.
Conditions:
- IPv6 to IPv4 virtual server chaining.
Impact:
Traffic is dropped.
Workaround:
None
Fixed Versions:
17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5
1002809-4 : OSPF vertex-threshold should be at least 100
Links to More Info: BT1002809
Component: TMOS
Symptoms:
OSPF vertex-threshold should be at least 100, but you are able to set it to any number between 0 and 10000000.
Conditions:
-- Using OSPFv2/OSPFv3
-- Configuring the vertex-threshold setting
Impact:
When the setting is less than the default of 100, routes may not be installed properly.
Workaround:
Ensure that vertex-threshold is set to 100 (default) or above.
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.5.1, 14.1.4.6, 13.1.5
1002385-1 : Fixing issue with input normalization
Links to More Info: K67397230, BT1002385
Component: Application Security Manager
Symptoms:
Under certain conditions, ASM does not follow current best practices.
Conditions:
- ASM provisioned
Impact:
Attack detection is not triggered as expected
Workaround:
N/A
Fix:
Attack detection is now triggered as expected
Fixed Versions:
17.0.0, 16.1.2.1, 15.1.5, 14.1.4.6
1000789-1 : ASM-related iRule keywords may not work as expected
Links to More Info: BT1000789
Component: Application Security Manager
Symptoms:
Some ASM-related iRule keywords may not work as expected when DoSL7 is used.
Conditions:
ASM iRule keywords are used in a bot defense- or DoSL7-related event, and DoSL7 is used.
Impact:
ASM-related iRule keywords may not work as expected.
Workaround:
None
Fixed Versions:
17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5
1000741-1 : Fixing issue with input normalization
Links to More Info: K67397230, BT1000741
Component: Application Security Manager
Symptoms:
Under certain conditions, ASM does not follow current best practices.
Conditions:
- ASM provisioned
Impact:
Attack detection is not triggered as expected
Workaround:
N/A
Fix:
Attack detection is now triggered as expected
Fixed Versions:
17.0.0, 16.1.1, 15.1.4, 14.1.4.4
1000405-1 : VLAN/Tunnels not listed when creating a new rule via GUI
Links to More Info: BT1000405
Component: Advanced Firewall Manager
Symptoms:
Available tunnels are not displayed on the AFM rules-creation page in the GUI.
Conditions:
-- Navigate to the firewall network rules creation page in the GUI.
-- In the rules source section, under the VLAN/Tunnel dropdown, select the 'specify' option.
Impact:
Available tunnels do not display in the select box. Cannot specify tunnels for firewall rules from the GUI.
Workaround:
Use tmsh to specify tunnels for firewall rules.
Fix:
The available tunnels now display in the VLAN/Tunnels dropdown.
Fixed Versions:
17.0.0, 16.1.1, 15.1.4
Known Issues in BIG-IP v16.1.x
TMOS Issues
ID Number | Severity | Links to More Info | Description |
934133-3 | 1-Blocking | BT934133 | Unable to Create/delete ltm virtual server via CLI transaction when destination is not specified on the ltm virtual object |
913713-3 | 1-Blocking | BT913713 | Rebooting a blade causes MCPd to core as it rejoins the cluster |
1226585-2 | 1-Blocking | Some SSL Orchestrator rest endpoints not loading on startup after BIG-IP is rebooted when it is set to CC/STIP mode | |
1224125-1 | 1-Blocking | BT1224125 | When you upgrade to 16.1.3.2 or 17.1, keys that are not approved in FIPS 140-3 are permitted to be used. |
1190777-2 | 1-Blocking | Unable to add a device to a device trust when the BigDB variable icontrol.basic_auth is set to disable on target device | |
1173441-3 | 1-Blocking | BT1173441 | The 'tmsh save sys config' call is being triggered when REST Authentication tokens (X-F5-Auth-Token) are deleted or expired |
1161913-1 | 1-Blocking | BT1161913 | Upgrade from 15.1.8 or 15.1.8.1 to 16.x or 17.x fails, and leaves device INOPERATIVE★ |
1116845-4 | 1-Blocking | BT1116845 | Interfaces using the xnet driver are not assigned a MAC address |
1088037-3 | 1-Blocking | BT1088037 | VELOS platform's cmp hash has been updated to handle only even ephemeral port numbers |
1049085-3 | 1-Blocking | BT1049085 | Booting into a newly installed hotfix volume may stall on RAID-capable platforms★ |
997793-3 | 2-Critical | K34172543, BT997793 | Error log: Failed to reset strict operations; disconnecting from mcpd★ |
995849-1 | 2-Critical | BT995849 | Tmm crash SIGSEGV - rcs_getsalen() in lib/rc_net.c |
994033-3 | 2-Critical | BT994033 | The daemon httpd_sam does not recover automatically when terminated |
993481-1 | 2-Critical | BT993481 | Jumbo frame issue with DPDK eNIC |
990853-1 | 2-Critical | BT990853 | Mcpd restarts on Secondary VIPRION blades upon modifying a vCMP guest's management IP address or gateway. |
988645-4 | 2-Critical | BT988645 | Traffic may be affected after tmm is aborted and restarted |
967905-5 | 2-Critical | BT967905 | Attaching a static bandwidth controller to a virtual server chain can cause tmm to crash |
967769-1 | 2-Critical | BT967769 | During reset of high-speed interfaces, TMMs may mistakenly continue hardware watchdog checks |
967573-3 | 2-Critical | BT967573 | Qkview generation from Configuration Utility fails |
965897-4 | 2-Critical | BT965897 | Disruption of mcpd with a segmentation fault during config sync |
950201-3 | 2-Critical | BT950201 | Tmm core on GCP |
937481-5 | 2-Critical | BT937481 | Tomcat restarts with error java.lang.OutOfMemoryError |
929133-6 | 2-Critical | BT929133 | TMM continually restarts with errors 'invalid index from net device' and 'device_init failed' |
888765-2 | 2-Critical | BT888765 | After upgrading from 13.1.0 to 15.1.0.1 CGNAT is deprovisioned and tmm is restarted by reloaded config from text files★ |
865653-1 | 2-Critical | BT865653 | Wrong FDB table entries with same MAC and wrong VLAN combination |
858877-5 | 2-Critical | BT858877 | SSL Orchestrator config sync issues between HA-pair devices |
842669-6 | 2-Critical | BT842669 | Syslog-ng / systemd-journald cannot handle logs with embedded newlines, write trailing content to /var/log/user.log |
780437-8 | 2-Critical | BT780437 | Upon rebooting a VIPRION chassis provisioned as a vCMP host, some vCMP guests can return online with no configuration. |
777389-7 | 2-Critical | BT777389 | In rare occurrences related to PostgreSQL monitor, the mcpd process restarts |
776117-1 | 2-Critical | BT776117 | BIG-IP Virtual Edition virtio driver incompatible with Q35 machine type |
756830-6 | 2-Critical | BT756830 | BIG-IP may fail source translation for connections when connection mirroring is enabled on a virtual server that also has source port set to 'preserve strict' |
737692-5 | 2-Critical | BT737692 | Handle x520 PF DOWN/UP sequence automatically by VE |
721591-2 | 2-Critical | BT721591 | Java crashes with core during a basic TLS signature test. |
652877-7 | 2-Critical | BT652877 | Reactivating the license on a VIPRION system may cause MCPD process restart on all secondary blades |
382363-8 | 2-Critical | K30588577 | min-up-members and using gateway-failsafe-device on the same pool. |
1232997-1 | 2-Critical | BT1232997 | The iked/isakmp.c:2338: Assertion "Invalid policy remote index" failed |
1209709-4 | 2-Critical | BT1209709 | Memory leak in icrd_child when license is applied through BIG-IQ |
1195377 | 2-Critical | BT1195377 | Getting Service Indicator log for disallowed RSA-1024 crypto algorithm |
1191137-3 | 2-Critical | BT1191137 | WebUI crashes when the localized form data fails to match the expectations |
1181613-1 | 2-Critical | BT1181613 | IPsec IKEv2: BIG-IP version 16.1.0 introduced RFC5996 non-compliance in IKE SA delete |
1178221-3 | 2-Critical | BT1178221 | In IPsec IKEv2, packet memory corruption after retransmitted ISAKMP with NAT |
1144477-1 | 2-Critical | BT1144477 | IKE_SA_INIT uses src port 500 and dst port 4500 after IKE SA deleted |
1136429-4 | 2-Critical | BT1136429 | Closing of unrelated MCPD connection causes an errant reply to an in-progress transaction or request group |
1134301-3 | 2-Critical | BT1134301 | IPsec interface mode may stop sending packets over tunnel after configuration update |
1128629 | 2-Critical | BT1128629 | Neurond crash observed during live install through test script |
1110893-4 | 2-Critical | BT1110893 | Some portions of the BIG-IP GUI do not work when accessed behind an HTTP proxy |
1105901-2 | 2-Critical | BT1105901 | Tmm crash while doing high-speed logging |
1095217-1 | 2-Critical | BT1095217 | Peer unit incorrectly shows the pool status as unknown after merging the configuration |
1093717-1 | 2-Critical | BT1093717 | BGP4 SNMP traps are not working. |
1085805-2 | 2-Critical | BT1085805 | UCS restore with SSL Orchestrator deployed fails due to multiple iFiles and incorrect iFile reference. |
1085597-1 | 2-Critical | BT1085597 | IKEv1 IPsec peer cannot be created in config utility (web UI) |
1077789-4 | 2-Critical | BT1077789 | System might become unresponsive after upgrading.★ |
1076909-4 | 2-Critical | BT1076909 | Syslog-ng truncates the hostname at the first period. |
1075905-3 | 2-Critical | BT1075905 | TCP connections may fail when hardware SYN Cookie is active |
1067857-7 | 2-Critical | BT1067857 | HSB completion time out causes unexpected reboot |
1039609-1 | 2-Critical | BT1039609 | Unable to poll Dynamic routing protocols SNMP OID's on non-default route domain |
1035121-4 | 2-Critical | BT1035121 | Configsync syncs the node's monitor status |
1027961-2 | 2-Critical | BT1027961 | Changes to an admin user's account properties may result in MCPD crash and failover |
1024269-1 | 2-Critical | BT1024269 | Forcing a file system check on the next system reboot does not check all filesystems. |
1023829-2 | 2-Critical | BT1023829 | Security->Policies in Virtual Server web page spins mcpd 100%, which later cores |
1014361-2 | 2-Critical | BT1014361 | Config sync fails after provisioning APM or changing BIG-IP license |
1012493-5 | 2-Critical | BT1012493 | Systemauth.primaryadminuser set to anything but 'admin' causes internal error for mcp-state check |
1004929-1 | 2-Critical | BT1004929 | During config sync operation, MCPD restarts on secondary blade logging 01020012:3: A unsigned four-byte integer message item is invalid. |
1004517-1 | 2-Critical | BT1004517 | BIG-IP tenants on VELOS cannot install EHFs |
999021-2 | 3-Major | BT999021 | IPsec IKEv1 tunnels fail after a config sync from Standby to Active |
998957-1 | 3-Major | BT998957 | MCPD consumes excessive CPU while collecting statistics |
998649-1 | 3-Major | BT998649 | Hostnames that contain a period are logged incorrectly |
998225-6 | 3-Major | BT998225 | TMM crash when disabling/re-enabling a blade that triggers a primary blade transition. |
997561-5 | 3-Major | BT997561 | TMM CPU imbalance with GRE/TB and GRE/MPLS traffic |
997541-5 | 3-Major | BT997541 | Round-robin GRE Disaggregator for hardware and software |
996145-1 | 3-Major | BT996145 | After UCS restore on HA pair, one of the devices is missing folder /var/config/rest/iapps/f5-iappslx-ssl-orchestrator |
995605-2 | 3-Major | BT995605 | PVA accelerated traffic does not update route domain stats |
995097-1 | 3-Major | BT995097 | Certain management-dhcp supersede options fail to restore correctly when the configuration is reloaded from a file. |
994365-1 | 3-Major | BT994365 | Inconsistency in tmsh 'object mode' for some configurations |
994361-2 | 3-Major | BT994361 | Updatecheck script hangs/Multiple updatecheck processes |
992813-7 | 3-Major | BT992813 | The list of dhcp-options known to mcpd is outdated, leading to the inability to instantiate certain management-dhcp configurations. |
992449-1 | 3-Major | BT992449 | The vCMP host does not report the correct number of guest CPUs on the guest page of the GUI |
992253-4 | 3-Major | BT992253 | Cannot specify IPv6 management IP addresses using GUI |
992053-4 | 3-Major | BT992053 | Pva_stats for server side connections do not update for redirected flows |
989501-2 | 3-Major | BT989501 | A dataplane_inoperable_t action should be triggered when HSB falls off of PCI bus |
988745-4 | 3-Major | BT988745 | On reboot, 'could not find platform object' errors may be seen in /var/log/ltm |
987949-2 | 3-Major | BT987949 | Error messages erroneously generated during boot up★ |
987301-3 | 3-Major | BT987301 | Software install on vCMP guest via block-device may fail with error 'reason unknown' |
987081-1 | 3-Major | BT987081 | Alarm LED remains active on Secondary blades even after LCD alerts are cleared |
981485-6 | 3-Major | BT981485 | Neurond enters a restart loop after FPGA update. |
977953-3 | 3-Major | BT977953 | Show running config interface CLI could not fetch the interface info and crashes the imi |
967557-1 | 3-Major | BT967557 | Improve apm logging when loading sys config fails due to corruption of epsec rpm database |
966949-6 | 3-Major | BT966949 | Multiple FQDN ephemeral nodes not deleted upon deleting FQDN template node |
964125-6 | 3-Major | BT964125 | Mcpd cores while processing a query for node statistics when there are thousands of FQDN nodes and pool members. |
962477-2 | 3-Major | BT962477 | REST calls that modify GTM objects as a user other than admin may take longer than expected |
959241-1 | 3-Major | BT959241 | Fix for ID871561 might not work as expected on the VCMP host |
959057-5 | 3-Major | BT959057 | Unable to create additional login tokens for the default admin user account |
958601-4 | 3-Major | BT958601 | In the GUI, searching for virtual server addresses does not match address lists |
957993-4 | 3-Major | BT957993 | Unable to set a port list in the GUI for an IPv6 address for a virtual server |
955953-5 | 3-Major | BT955953 | iRule command 'table' fails to resume when used with Diameter 'irule_scope_msg' |
953477-1 | 3-Major | BT953477 | Syncookie HW mode not cleared when modifying VLAN config. |
950153-3 | 3-Major | BT950153 | LDAP remote authentication fails when empty attribute is returned |
948601-1 | 3-Major | BT948601 | File object checksum attribute is not updated when an external data-group file or external monitor file is edited from GU |
945413-2 | 3-Major | BT945413 | Loop between keymgmtd and mcpd causes BIG-IP to be out of sync or in constant automatic config sync |
939249-1 | 3-Major | BT939249 | iSeries LCD changes to secure mode after multiple reboots |
938145-3 | 3-Major | BT938145 | DAG redirects packets to non-existent tmm |
936093-5 | 3-Major | BT936093 | Non-empty fipserr files loaded from a UCS archive can cause a FIPS BIG-IP platform to remain offline |
935485-4 | 3-Major | BT935485 | BWC: flows might stall when using dynamic BWC policy |
931797-3 | 3-Major | BT931797 | LTM virtual address netmask does not persist after a reboot |
930393-2 | 3-Major | BT930393 | IPsec tunnel does not start after an upgrade, first configuration, or reconfiguration |
928353-4 | 3-Major | BT928353 | Error logged installing Engineering Hotfix: Argument isn't numeric★ |
927025-1 | 3-Major | BT927025 | Sod restarts continuously |
925469-2 | 3-Major | BT925469 | SubjAltName (SAN) cannot be sent in the Certificate Order Manager for Comodo / Sectigo |
924297-4 | 3-Major | BT924297 | Ltm policy MCP objects are not being synced over to the peer device |
922613-6 | 3-Major | BT922613 | Tunnels using autolasthop might drop traffic with ICMP route unreachable |
922153-5 | 3-Major | BT922153 | Tcpdump is failing on tmm 0.x interfaces |
922053-1 | 3-Major | BT922053 | inaccurate number of trunk members reported by bcm56xxd/bcmLINK |
921149-6 | 3-Major | BT921149 | After applying static bandwidth controller on a virtual server, any changes to the virtual server disassociates the BWC policy |
915493-6 | 3-Major | BT915493 | imish command hangs when ospfd is enabled |
913013-1 | 3-Major | BT913013 | Racoon daemon may crash once at startup |
908753-5 | 3-Major | BT908753 | Password memory not effective even when password policy is configured |
908453-5 | 3-Major | BT908453 | Trunks with names longer than 32 characters update working-mbr-count in vCMP guests incorrectly |
906273-1 | 3-Major | BT906273 | MCPD crashes receiving a message from bcm56xxd |
904713-2 | 3-Major | BT904713 | FailoverState device status and CM device status do not match shortly after triggering failover |
904401-5 | 3-Major | BT904401 | Guestagentd core |
894593-2 | 3-Major | BT894593 | High CPU usage caused by the restjavad daemon continually crashing and restarting |
891333-2 | 3-Major | K32545132, BT891333 | The HSB on BIG-IP platforms can get into a bad state resulting in packet corruption. |
888081-6 | 3-Major | BT888081 | BIG-IP VE Migration feature fails for 1NIC |
884729-1 | 3-Major | BT884729 | The vCMP CPU usage stats are incorrect |
882609-7 | 3-Major | BT882609 | ConfigSync status remains 'Disconnected' after setting ConfigSync IP to 'none' and back |
880689-1 | 3-Major | Update oprofile tools for compatibility with current architecture | |
879969-8 | 3-Major | BT879969 | FQDN node resolution fails if DNS response latency >5 seconds |
872165-4 | 3-Major | BT872165 | LDAP remote authentication for REST API calls may fail during authorization |
867549-1 | 3-Major | BT867549 | LCD touch panel reports "Firmware update in progress" indefinitely★ |
867253-4 | 3-Major | BT867253 | Systemd not deleting user journals |
851837-1 | 3-Major | BT851837 | Mcpd fails to start for single NIC VE devices configured in a trust domain |
844925-5 | 3-Major | BT844925 | Command 'tmsh save /sys config' fails to save the configuration and hangs |
838597-5 | 3-Major | BT838597 | Unable to load license/dossier when going down for vCMP |
814273-6 | 3-Major | BT814273 | Multicast route entries are not populating to tmm after failover |
809089-4 | 3-Major | BT809089 | TMM crash after sessiondb ref_cnt overflow |
804529-1 | 3-Major | BT804529 | REST API to /mgmt/tm/ltm/pool/members/stats will fail for some pools |
803157-4 | 3-Major | BT803157 | LTM log contains shutdown sequence logs after boot_marker as logs are buffered until BIG-IP reboots |
798885-6 | 3-Major | BT798885 | SNMP response times may be long when processing requests |
796985-4 | 3-Major | BT796985 | Default IPv4 IP address is assigned to Alt-Address in isolated vCMP guest; vCMP host or guest are upgraded and guest is 'Inoperative'★ |
780745-5 | 3-Major | BT780745 | TMSH allows creation of duplicate community strings for SNMP v1/v2 access |
778513-3 | 3-Major | BT778513 | APM intermittently drops log messages for per-request policies |
775845-6 | 3-Major | BT775845 | Httpd fails to start after restarting the service using the iControl REST API |
775797-5 | 3-Major | BT775797 | Previously deleted user account might get authenticated |
760982-3 | 3-Major | BT760982 | An NLRI with a default route information is not propagated on 'clear ip bgp <neighbor router-id> soft out' command in some scenarios |
760400-1 | 3-Major | BT760400 | High number of vcmp guests on clusters and discovery appliances may result in retries for guest deployment |
760354-7 | 3-Major | BT760354 | Continual mcpd process restarts after removing big logs when /var/log is full |
759258-7 | 3-Major | BT759258 | Instances shows incorrect pools if the same members are used in other pools |
757787-5 | 3-Major | BT757787 | Unable to edit LTM/AFM Policies that belong to an Application Service (iApp) using the WebUI. |
755207-3 | 3-Major | BT755207 | Large packets silently dropped on VE mlxvf5 devices |
749757-4 | 3-Major | BT749757 | -s option in qkview help does not indicate maximum size |
737739-4 | 3-Major | BT737739 | Bash shell still accessible for admin even if disabled |
718291-4 | 3-Major | BT718291 | iHealth upload error does not clear |
711747-2 | 3-Major | BT711747 | Vcmp_pde_state_memcpy core during http traffic and pfmand resets. |
703226-3 | 3-Major | BT703226 | Failure when using transactions to create and publish policies |
698594-4 | 3-Major | K53752362, BT698594 | Cave Creek Crypto hardware reports a false positive of a stuck queue state |
691219-3 | 3-Major | BT691219 | Hardware syncookie mode is used when global auto last hop is disabled. |
690928-6 | 3-Major | BT690928 | System posts error message: 01010054:3: tmrouted connection closed |
673952-6 | 3-Major | BT673952 | 1NIC VE in high availability (HA) device-group shows 'Changes Pending' after reboot |
662301-8 | 3-Major | BT662301 | 'Unlicensed objects' error message appears despite there being no unlicensed config |
658850-6 | 3-Major | BT658850 | Loading UCS with the platform-migrate parameter could unexpectedly set or unset management DHCP |
612083-3 | 3-Major | BT612083 | The System Event Log may list correctable hardware, PCIe or DMI errors. |
605966-9 | 3-Major | BT605966 | BGP route-map changes may not immediately trigger route updates |
566995-2 | 3-Major | BT566995 | bgpd might crash in rare circumstances. |
528314-2 | 3-Major | K16816, BT528314 | Generating new default certificate and key pairs for BIG-IP ssl profiles via CLI will not be reflected in GUI or in tmsh |
499348-14 | 3-Major | BT499348 | System statistics may fail to update, or report negative deltas due to delayed stats merging. |
493740-4 | 3-Major | BT493740 | tmsh allows cipher group creation with non-existent "require" or "exclude" cipher rule. |
431503-11 | 3-Major | K14838, BT431503 | TMSH crashes in rare initial tunnel configurations |
342319-1 | 3-Major | BIND forwarder server list and the recursion and forward options. | |
1269709-1 | 3-Major | GUI should throw the error when the VS is configured with both vdi and HTTP/2 profiles | |
1253449-3 | 3-Major | BT1253449 | After publishing, the draft LTM policy configuration might not be updated (intermittently) into the bigip.conf |
1238693-2 | 3-Major | BT1238693 | Adding SSHD support for rsa-sha2-256 and rsa-sha2-512 HostKeyAlgorithms and removing support for ed25519 |
1217473-2 | 3-Major | BT1217473 | All the UDP traffic is sent to a single TMM |
1215613-2 | 3-Major | BT1215613 | ConfigSync-IP changed to IPv6 address and it cannot be changed back to IPv4 address |
1211797-3 | 3-Major | BT1211797 | MCPD CPU usage is 100% on updating long address-list through GUI |
1211513-2 | 3-Major | HSB loopback validation feature | |
1211089-3 | 3-Major | BT1211089 | Traffic to IPv6 all nodes address not received by TMM on VE with ixlv driver |
1209465 | 3-Major | BT1209465 | When vCMP host is rebooted, oldEngineID is not restored on guest |
1194409-2 | 3-Major | BT1194409 | Dropped messages seen in auditforwarder logging |
1186649 | 3-Major | BT1186649 | TMM keep crashing after vCMP Guest Upgrade to BIG-IP v16.1.3.2 |
1185605-3 | 3-Major | BT1185605 | The iCall EventTriggeredHandler in non-common partition break after scriptd daemon restart |
1182993 | 3-Major | BT1182993 | MCPD returns dossier error 01 after reboot |
1181757-4 | 3-Major | BT1181757 | BGPD assert when sending an update due to cq_wbuf mishandling |
1169141-3 | 3-Major | BT1169141 | Bash tab-completion Issue |
1166329-2 | 3-Major | BT1166329 | The mcpd process fails on secondary blades, if the predefined classification applications are updated. |
1160805-2 | 3-Major | BT1160805 | The scp-checkfp fail to cat scp.whitelist for remote admin |
1155861-2 | 3-Major | 'Unlicensed objects' error message appears despite there being no unlicensed configuration | |
1154381-4 | 3-Major | BT1154381 | The tmrouted might crash when management route subnet is received over a dynamic routing protocol |
1153865-4 | 3-Major | BT1153865 | Restjavad OutOfMemoryError errors and restarts after upgrade★ |
1153853-4 | 3-Major | BT1153853 | Revision of default value for provision.restjavad.extramb to avoid OOM errors in restjavad |
1146017-1 | 3-Major | BT1146017 | WebUI does not displays error when parent rewrite profile is not assigned to user defined rewrite profile |
1145749-4 | 3-Major | BT1145749 | Locally defined BIG-IP users can be lost during a failed config-sync |
1143809-1 | 3-Major | BT1143809 | Unable to modify SNMP monitors from webUI |
1137269-4 | 3-Major | BT1137269 | MCPD fails to reply if a request is proxied to another daemon and the connection to that daemon closes |
1136921-4 | 3-Major | BT1136921 | BGP might delay route updates after failover |
1136781-2 | 3-Major | BT1136781 | Incorrect parsing of 'bfd notification' CLI in IMI Shell (imish) |
1136013-7 | 3-Major | BT1136013 | The tmrouted generates core with double free or corruption |
1135961-7 | 3-Major | BT1135961 | The tmrouted generates core with double free or corruption |
1135393-1 | 3-Major | BT1135393 | The pfmand support is not available on i15820-DF (D120) |
1134509-4 | 3-Major | BT1134509 | TMM crash in BFD code when peers from ipv4 and ipv6 families are in use. |
1134057-4 | 3-Major | BT1134057 | BGP routes not advertised after graceful restart |
1133469 | 3-Major | BT1133469 | SSL Orchestrator upgrade fails due to "MCP Session terminated" |
1132957-1 | 3-Major | BT1132957 | Modifying IPsec tunnels tunnel object may result in TMM core |
1132949-4 | 3-Major | BT1132949 | GUI reported error when changing password after mgmt port was changed |
1128169-1 | 3-Major | BT1128169 | TMM core when IPsec tunnel object is reconfigured |
1127881-2 | 3-Major | BT1127881 | Deprecate sysClientsslStatFullyHwAcceleratedConns, sysClientsslStatPartiallyHwAcceleratedConns and sysClientsslStatNonHwAcceleratedConns |
1127169 | 3-Major | BT1127169 | The BIG-IP can reboot due to failure to initialize the OpenSSL FIPS RNG |
1126805-3 | 3-Major | BT1126805 | TMM CPU usage statistics may show a lower than expected value on Virtual Edition |
1126181-2 | 3-Major | BT1126181 | ZebOS "no log syslog" configuration is not surviving reboot |
1125733-3 | 3-Major | BT1125733 | Wrong server-side window scale used in hardware SYN cookie mode |
1124733-1 | 3-Major | BT1124733 | Unnecessary internal traffic is observed on the internal tmm_bp vlan |
1124209-3 | 3-Major | BT1124209 | Duplicate key objects when renewing certificate using pkcs12 bundle |
1123885-2 | 3-Major | BT1123885 | A specific type of software installation may fail to carry forward the management port's default gateway. |
1122021-3 | 3-Major | BT1122021 | Killall command might create corrupted core files |
1121517-2 | 3-Major | BT1121517 | Interrupts on Hyper-V are pinned on CPU 0 |
1121085-3 | 3-Major | BT1121085 | Some valid connections may get rejected in hardware SYN cookie mode |
1120345-6 | 3-Major | BT1120345 | Running tmsh load sys config verify can trigger high availability (HA) failover |
1114137-4 | 3-Major | BT1114137 | LibUV library for latest bind 9.16 |
1113961-1 | 3-Major | K43391532, BT1113961 | BIG-IP 16.1.3 VE with FIPS 140-3 May Fail to start in AWS-China |
1112649 | 3-Major | BT1112649 | FIPS 140-2/FIPS 140-3 compliant mode is incorrect after upgrade to 16.1.2.2★ |
1112537-2 | 3-Major | BT1112537 | LTM/GTM config instantiated in a certain way can cause a LTM/GTM monitor to fail to delete. |
1112109-4 | 3-Major | BT1112109 | Unable to retrieve SCP files using WinSCP or relative path name |
1111629-4 | 3-Major | BT1111629 | Messages with "Failed Read: User, referer" are logged in /var/log/httpd/httpd_errors |
1111421-1 | 3-Major | BT1111421 | TMSH/GUI fails to display IPsec SAs info |
1106489-2 | 3-Major | BT1106489 | GRO/LRO is disabled in environments using the TMM raw socket "sock" driver. |
1103953-1 | 3-Major | BT1103953 | SSMTP errors in logs every 20 minutes |
1102849-3 | 3-Major | BT1102849 | Less-privileged users (guest, operator, etc) are unable to run top level commands |
1101453-1 | 3-Major | BT1101453 | MCPD SIGABRT and core happened while deleting GTM pool member |
1100409-4 | 3-Major | BT1100409 | Valid connections may fail while a virtual server is in SYN cookie mode. |
1100321 | 3-Major | BT1100321 | MCPD memory leak |
1100125-4 | 3-Major | BT1100125 | Per virtual SYN cookie may not be activated on all HSB modules |
1093973-7 | 3-Major | BT1093973 | Tmm may core when BFD peers select a new active device. |
1093553-4 | 3-Major | BT1093553 | OSPF "default-information originate" injects a new link-state advertisement |
1093313-2 | 3-Major | BT1093313 | CLIENTSSL_CLIENTCERT iRule event is not triggered for TLS1.3 when the client sends an empty certificate response |
1091725-4 | 3-Major | BT1091725 | Memory leak in IPsec |
1090313-3 | 3-Major | BT1090313 | Virtual server may remain in hardware SYN cookie mode longer than expected |
1088429-4 | 3-Major | BT1088429 | Kernel slab memory leak |
1086517-2 | 3-Major | BT1086517 | TMM may not properly exit hardware SYN cookie mode |
1086393-1 | 3-Major | BT1086393 | Sint Maarten and Curacao are missing in the GTM region list |
1085837-2 | 3-Major | BT1085837 | Virtual server may not exit from hardware SYN cookie mode |
1081649-2 | 3-Major | BT1081649 | Remove the "F5 iApps and Resources" link from the iApps->Package Management |
1081641-4 | 3-Major | BT1081641 | Remove Hyperlink to Legal Statement from Login Page |
1080925-3 | 3-Major | BT1080925 | Changed 'ssh-session-limit' value is not reflected after restarting mcpd |
1080297-1 | 3-Major | BT1080297 | ZebOS does not show 'log syslog' in the running configuration, or store it in the startup configuration |
1079705-4 | 3-Major | BT1079705 | Restjavad may restart repeatedly if sys db provision.extramb is high |
1077533-1 | 3-Major | BT1077533 | BIG-IP fails to restart services after mprov runs during boot. |
1077405-2 | 3-Major | BT1077405 | Ephemeral pool members may not be created with autopopulate enabled. |
1076801-4 | 3-Major | BT1076801 | Loaded system increases CPU usage when using CS features |
1076785-2 | 3-Major | BT1076785 | Virtual server may not properly exit from hardware SYN Cookie mode |
1074841-1 | 3-Major | BT1074841 | Invalid syslog configuration kills syslog-ng after restarting syslog-ng. |
1074053-1 | 3-Major | BT1074053 | Delay in displaying the "Now Halting..." message while performing halt from LCD. |
1073429-1 | 3-Major | BT1073429 | Auth partition definition is incorrectly synchronized to peer and then altered. |
1072081-1 | 3-Major | BT1072081 | Imish segmentation fault when running 'ip pim sparse-mode ?' on interface config. |
1067797-1 | 3-Major | BT1067797 | Trunked interfaces that share a MAC address may be assigned in the incorrect order. |
1064893-1 | 3-Major | BT1064893 | Keymgmtd memory leak occurrs while configuring ca-bundle-manager. |
1064257-2 | 3-Major | BT1064257 | Bundled SSL certificates may not get revalidated successfully over OCSP after stapling parameters have been modified. |
1063597-1 | 3-Major | BT1063597 | Memory leak in rewrite in some cases when no pool is selected on virtual server |
1063237-4 | 3-Major | BT1063237 | Stats are incorrect when the management interface is not eth0 |
1062953-1 | 3-Major | BT1062953 | Unable to save configuration via tmsh or the GUI. |
1062901-1 | 3-Major | BT1062901 | The 'trap-source' and 'network' SNMP properties are ineffective, and SNMP traps may be sent from an unintended interface. |
1062857-3 | 3-Major | BT1062857 | Non-tmm source logs stop populating after a system time change. |
1061905-3 | 3-Major | BT1061905 | Adding peer unit into device trust changes the failover address family. |
1060181-3 | 3-Major | BT1060181 | SSL handshakes fail when using CRL certificate validator. |
1059293-1 | 3-Major | BT1059293 | During DPD config changes, the IKEv2 tunnel may not start. |
1058789-2 | 3-Major | BT1058789 | Virtual addresses are not created from an address list that includes an IP address range. |
1058765-2 | 3-Major | BT1058765 | Virtual Addresses created from an address list with prefix all say Offline (enabled) |
1057709-4 | 3-Major | BT1057709 | Invalid Certificate for all BIG-IP VE OVA images on vCenter 7.0U2. |
1057501-4 | 3-Major | BT1057501 | Expired DST Root CA X3 resulting in http agent request failing. |
1057305-1 | 3-Major | BT1057305 | On deployments that use DPDK, "-c" may be logged as the TMM process/thread name. |
1050457-1 | 3-Major | BT1050457 | The "Permitted Versions" field of "tmsh show sys license" only shows on first boot |
1046261-1 | 3-Major | BT1046261 | Asynchronous REST task IDs do not persist across process restarts |
1045277-4 | 3-Major | BT1045277 | The /var partition may become 100% full requiring manual intervention to clear space |
1044281-1 | 3-Major | BT1044281 | In some cases, cpcfg does not trigger selinux relabel, leaving files unlabeled |
1044089-3 | 3-Major | BT1044089 | ICMP echo requests to virtual address gets a response even when the virtual server is offline when updated from GUI. |
1044021-2 | 3-Major | BT1044021 | Searching for IPv4 strings in statistics module does not work. |
1043141-1 | 3-Major | BT1043141 | Misleading 'Symmetric Unit Key decrypt failure - decrypt failure' when loading UCS from another BIG-IP |
1042589-1 | 3-Major | BT1042589 | Wrong trunk_id is associated in bcm56xxd. |
1041317-1 | 3-Major | BT1041317 | MCPD delay in processing a query_all message if the update_status bit is set |
1040573-4 | 3-Major | BT1040573 | REST operation takes a long time when two different users perform tasks in parallel |
1040277-4 | 3-Major | BT1040277 | Syslog-ng issue may cause logging to stop and possible reboot of a system |
1040117-2 | 3-Major | BT1040117 | BIG-IP Virtual Edition drops UDP packets |
1036613-3 | 3-Major | BT1036613 | Client flow might not get offloaded to PVA in embryonic state |
1036557-1 | 3-Major | BT1036557 | Monitor information not seen in GUI |
1036541-4 | 3-Major | BT1036541 | Inherited-traffic-group setting of floating IP does not sync on incremental sync |
1036461-4 | 3-Major | BT1036461 | icrd_child may core with high numbers of open file descriptors. |
1036097-4 | 3-Major | BT1036097 | VLAN failsafe does not trigger on guest |
1035661-4 | 3-Major | BT1035661 | REST Requests return 401 Unauthorized when using Basic Auth |
1033689-1 | 3-Major | BT1033689 | BGP route map community value cannot be set to the required range when using AA::NN notation |
1033333-4 | 3-Major | FIPS: importing a stub SSL key file results in 2 keys that share the same FIPS device | |
1032821-7 | 3-Major | BT1032821 | Syslog: invalid level/facility from /usr/libexec/smart_parse.pl |
1032257-1 | 3-Major | BT1032257 | Forwarded PVA offload requests fail on platforms with multiple PDE/TMM |
1032001-2 | 3-Major | BT1032001 | Statemirror address can be configured on management network or clusterd restarting |
1031117-1 | 3-Major | BT1031117 | The mcpd error for virtual server profiles incompatible needs to have more details |
1031025-3 | 3-Major | BT1031025 | Nitrox 3 FIPS: Upgrade from v12.1.x to v14.1.x results in new .key.exp files for the FIPS keys created before upgrade.★ |
1029105-1 | 3-Major | BT1029105 | Hardware SYN cookie mode state change logs bogus virtual server address |
1027481-3 | 3-Major | BT1027481 | The log messages 'error: /bin/haloptns unexpected error -- 768' generated on A110 and D112 platforms |
1027477-3 | 3-Major | BT1027477 | Virtual server created with address-list in custom partition non-RD0 does not create listener |
1027237-1 | 3-Major | BT1027237 | Cannot edit virtual server in GUI after loading config with traffic-matching-criteria |
1026989-1 | 3-Major | BT1026989 | More specific dynamic or static routes created for application traffic processing can erroneously replace the route to the management subnet. |
1026973-1 | 3-Major | BT1026973 | Static routes created for application traffic processing can erroneously replace the route to the management subnet. |
1026861-3 | 3-Major | BT1026861 | Live Update of Browser Challenges and Anti-Fraud are not cleaned up |
1026581-4 | 3-Major | BT1026581 | NETFLOW/IPFIX observationTimeMilliseconds Information Element value is not populated correctly. |
1026273-4 | 3-Major | BT1026273 | HA failover connectivity using the cluster management address does not work on VIPRION platforms★ |
1025513-1 | 3-Major | BT1025513 | PAM Authenticator can cause authorization failure if it fails to lock /var/log/tallylog |
1024421-2 | 3-Major | BT1024421 | At failover, ePVA flush leads to clock advancing and MPI timeout messages in TMM log |
1022997-1 | 3-Major | BT1022997 | TCP segments with an incorrect checksum are transmitted when the sock driver is used in AWS deployments (e.g., 1NIC) |
1021925-4 | 3-Major | BT1021925 | During bootup AWS BIG-IP endpoint was not licensed when custom gateway configured over management interface |
1021873-1 | 3-Major | BT1021873 | TMM crash in IPIP tunnel creation with a pool route |
1021109-4 | 3-Major | BT1021109 | The cmp-hash VLAN setting does not apply to trunked interfaces. |
1020277-1 | 3-Major | BT1020277 | Mcpd may run out of memory when build image is missing★ |
1020129-2 | 3-Major | BT1020129 | Turboflex page in GUI reports 'profile.Features is undefined' error★ |
1020089-1 | 3-Major | BT1020089 | MCP validation should prevent defining multiple virtual servers with the same virtual address but with different subnet masks |
1020005-1 | 3-Major | BT1020005 | OOM errors after upgrade and VE instance unresponsive★ |
1019793-2 | 3-Major | BT1019793 | Image2disk does not work on F5OS BIG-IP ten |