BIG-IP Release Information

Version: 16.1.4.1
Build: 5.0

Note: This content is current as of the software release date
Updates to bug information occur periodically. For the most up-to-date bug data, see Bug Tracker.

The blue background highlights fixes

Cumulative fixes from BIG-IP v16.1.4 that are included in this release
Cumulative fixes from BIG-IP v16.1.3.5 that are included in this release
Cumulative fixes from BIG-IP v16.1.3.4 that are included in this release
Cumulative fixes from BIG-IP v16.1.3.3 that are included in this release
Cumulative fixes from BIG-IP v16.1.3.2 that are included in this release
Cumulative fixes from BIG-IP v16.1.3.1 that are included in this release
Cumulative fixes from BIG-IP v16.1.3 that are included in this release
Cumulative fixes from BIG-IP v16.1.2.2 that are included in this release
Cumulative fixes from BIG-IP v16.1.2.1 that are included in this release
Cumulative fixes from BIG-IP v16.1.2 that are included in this release
Cumulative fixes from BIG-IP v16.1.1 that are included in this release
Known Issues in BIG-IP v16.1.x

Functional Change Fixes

None


Access Policy Manager Fixes

Cumulative fixes from BIG-IP v16.1.4 that are included in this release


Vulnerability Fixes

Functional Change Fixes

TMOS Fixes

Local Traffic Manager Fixes

Performance Fixes

Global Traffic Manager (DNS) Fixes

Application Security Manager Fixes

Application Visibility and Reporting Fixes

Access Policy Manager Fixes

Service Provider Fixes

Advanced Firewall Manager Fixes

Policy Enforcement Manager Fixes

Carrier-Grade NAT Fixes

Anomaly Detection Services Fixes

Traffic Classification Engine Fixes

Device Management Fixes

iApp Technology Fixes

Protocol Inspection Fixes

Guided Configuration Fixes

In-tmm monitors Fixes

SSL Orchestrator Fixes

Cumulative fixes from BIG-IP v16.1.3.5 that are included in this release


Vulnerability Fixes

Functional Change Fixes

None



Cumulative fixes from BIG-IP v16.1.3.4 that are included in this release


Vulnerability Fixes

Functional Change Fixes

None


Traffic Classification Engine Fixes

Cumulative fixes from BIG-IP v16.1.3.3 that are included in this release


Vulnerability Fixes

Functional Change Fixes

None


TMOS Fixes

Local Traffic Manager Fixes

Access Policy Manager Fixes

Cumulative fixes from BIG-IP v16.1.3.2 that are included in this release


Vulnerability Fixes

Functional Change Fixes

None


Local Traffic Manager Fixes

Cumulative fixes from BIG-IP v16.1.3.1 that are included in this release


Vulnerability Fixes

Functional Change Fixes

TMOS Fixes

Local Traffic Manager Fixes

Global Traffic Manager (DNS) Fixes

Application Security Manager Fixes

Application Visibility and Reporting Fixes

Access Policy Manager Fixes

Service Provider Fixes

Advanced Firewall Manager Fixes

Policy Enforcement Manager Fixes

In-tmm monitors Fixes

SSL Orchestrator Fixes

Cumulative fixes from BIG-IP v16.1.3 that are included in this release


Vulnerability Fixes

Functional Change Fixes

TMOS Fixes

Local Traffic Manager Fixes

Global Traffic Manager (DNS) Fixes

Application Security Manager Fixes

Access Policy Manager Fixes

Advanced Firewall Manager Fixes

iApp Technology Fixes

Cumulative fixes from BIG-IP v16.1.2.2 that are included in this release


Vulnerability Fixes

Functional Change Fixes

TMOS Fixes

Local Traffic Manager Fixes

Global Traffic Manager (DNS) Fixes

Application Security Manager Fixes

Application Visibility and Reporting Fixes

Access Policy Manager Fixes

Service Provider Fixes

Advanced Firewall Manager Fixes

Policy Enforcement Manager Fixes

Carrier-Grade NAT Fixes

Fraud Protection Services Fixes

Anomaly Detection Services Fixes

Traffic Classification Engine Fixes

Protocol Inspection Fixes

In-tmm monitors Fixes

SSL Orchestrator Fixes

Cumulative fixes from BIG-IP v16.1.2.1 that are included in this release


Vulnerability Fixes

Functional Change Fixes

TMOS Fixes

Local Traffic Manager Fixes

Global Traffic Manager (DNS) Fixes

Application Security Manager Fixes

Application Visibility and Reporting Fixes

Access Policy Manager Fixes

Service Provider Fixes

Policy Enforcement Manager Fixes

Anomaly Detection Services Fixes

SSL Orchestrator Fixes

Cumulative fixes from BIG-IP v16.1.2 that are included in this release


Vulnerability Fixes

Functional Change Fixes

TMOS Fixes

Local Traffic Manager Fixes

Global Traffic Manager (DNS) Fixes

Application Security Manager Fixes

Application Visibility and Reporting Fixes

Access Policy Manager Fixes

Service Provider Fixes

Advanced Firewall Manager Fixes

Traffic Classification Engine Fixes

Device Management Fixes

SSL Orchestrator Fixes

Cumulative fixes from BIG-IP v16.1.1 that are included in this release


Vulnerability Fixes

Functional Change Fixes

TMOS Fixes

Local Traffic Manager Fixes

Global Traffic Manager (DNS) Fixes

Application Security Manager Fixes

Application Visibility and Reporting Fixes

Access Policy Manager Fixes

Service Provider Fixes

Advanced Firewall Manager Fixes

Protocol Inspection Fixes

 

Cumulative fix details for BIG-IP v16.1.4.1 that are included in this release

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

Known Issues in BIG-IP v16.1.x


TMOS Issues

ID Number	Severity	Links to More Info	Description
934133-3	1-Blocking	BT934133	Unable to Create/delete ltm virtual server via CLI transaction when destination is not specified on the ltm virtual object
913713-3	1-Blocking	BT913713	Rebooting a blade causes MCPd to core as it rejoins the cluster
1322009-2	1-Blocking		UCS restore fails with ifile not found error
1226585-2	1-Blocking	BT1226585	Some SSL Orchestrator rest endpoints not loading on startup after BIG-IP is rebooted when it is set to CC/STIP mode
1190777-2	1-Blocking		Unable to add a device to a device trust when the BigDB variable icontrol.basic_auth is set to disable on target device
1049085-3	1-Blocking	BT1049085	Booting into a newly installed hotfix volume may stall on RAID-capable platforms★
997793-3	2-Critical	K34172543, BT997793	Error log: Failed to reset strict operations; disconnecting from mcpd★
990853-1	2-Critical	BT990853	Mcpd restarts on Secondary VIPRION blades upon modifying a vCMP guest's management IP address or gateway.
988645-4	2-Critical	BT988645	Traffic may be affected after tmm is aborted and restarted
979045-1	2-Critical	BT979045	The tpm-status-check service shows System Integrity Status: Invalid when Engineering Hotfix installed on certain platforms
967769-1	2-Critical	BT967769	During reset of high-speed interfaces, TMMs may mistakenly continue hardware watchdog checks
967573-3	2-Critical	BT967573	Qkview generation from Configuration Utility fails
965897-4	2-Critical	BT965897	Disruption of mcpd with a segmentation fault during config sync
937481-5	2-Critical	BT937481	Tomcat restarts with error java.lang.OutOfMemoryError
929133-6	2-Critical	BT929133	TMM continually restarts with errors 'invalid index from net device' and 'device_init failed'
865653-1	2-Critical	BT865653	Wrong FDB table entries with same MAC and wrong VLAN combination
858877-5	2-Critical	BT858877	SSL Orchestrator config sync issues between HA-pair devices
842669-6	2-Critical	BT842669	Syslog-ng / systemd-journald cannot handle logs with embedded newlines, write trailing content to /var/log/user.log
780437-8	2-Critical	BT780437	Upon rebooting a VIPRION chassis provisioned as a vCMP host, some vCMP guests can return online with no configuration.
777389-7	2-Critical	BT777389	In rare occurrences related to PostgreSQL monitor, the mcpd process restarts
776117-1	2-Critical	BT776117	BIG-IP Virtual Edition virtio driver incompatible with Q35 machine type
767473-2	2-Critical	BT767473	SMTP Error: Could not authenticate
758929-7	2-Critical	BT758929	Bcm56xxd MIIM bus access failure
756830-6	2-Critical	BT756830	BIG-IP may fail source translation for connections when connection mirroring is enabled on a virtual server that also has source port set to 'preserve strict'
737692-5	2-Critical	BT737692	Handle x520 PF DOWN/UP sequence automatically by VE
721591-2	2-Critical	BT721591	Java crashes with core during a basic TLS signature test.
652877-7	2-Critical	BT652877	Reactivating the license on a VIPRION system may cause MCPD process restart on all secondary blades
382363-8	2-Critical	K30588577	min-up-members and using gateway-failsafe-device on the same pool.
1330213-3	2-Critical	BT1330213	SIGABRT is sent when single quotes are not closed/balanced in TMSH commands
1327649	2-Critical	BT1327649	Invalid certificate order within cert-chain associated to JWK configuration
1295481-2	2-Critical	BT1295481	FIPS keys are not restored when BIG-IP license is renewed after it expires
1191137-3	2-Critical	BT1191137	WebUI crashes when the localized form data fails to match the expectations
1093717-1	2-Critical	BT1093717	BGP4 SNMP traps are not working.
1077789-4	2-Critical	BT1077789	System might become unresponsive after upgrading.★
1075905-3	2-Critical	BT1075905	TCP connections may fail when hardware SYN Cookie is active
1067857-7	2-Critical	BT1067857	HSB completion time out causes unexpected reboot
1039609-1	2-Critical	BT1039609	Unable to poll Dynamic routing protocols SNMP OID's on non-default route domain
1027961-2	2-Critical	BT1027961	Changes to an admin user's account properties may result in MCPD crash and failover
1024269-1	2-Critical	BT1024269	Forcing a file system check on the next system reboot does not check all filesystems.
1014361-2	2-Critical	BT1014361	Config sync fails after provisioning APM or changing BIG-IP license
1012493-5	2-Critical	BT1012493	Systemauth.primaryadminuser set to anything but 'admin' causes internal error for mcp-state check
1004929-1	2-Critical	BT1004929	During config sync operation, MCPD restarts on secondary blade logging 01020012:3: A unsigned four-byte integer message item is invalid.
1004517-1	2-Critical	BT1004517	BIG-IP tenants on VELOS cannot install EHFs
999021-2	3-Major	BT999021	IPsec IKEv1 tunnels fail after a config sync from Standby to Active
998957-1	3-Major	BT998957	MCPD consumes excessive CPU while collecting statistics
998649-1	3-Major	BT998649	Hostnames that contain a period are logged incorrectly
997561-5	3-Major	BT997561	TMM CPU imbalance with GRE/TB and GRE/MPLS traffic
997541-5	3-Major	BT997541	Round-robin GRE Disaggregator for hardware and software
996145-1	3-Major	BT996145	After UCS restore on HA pair, one of the devices is missing folder /var/config/rest/iapps/f5-iappslx-ssl-orchestrator
995605-2	3-Major	BT995605	PVA accelerated traffic does not update route domain stats
994365-1	3-Major	BT994365	Inconsistency in tmsh 'object mode' for some configurations
994361-2	3-Major	BT994361	Updatecheck script hangs/Multiple updatecheck processes
992449-1	3-Major	BT992449	The vCMP host does not report the correct number of guest CPUs on the guest page of the GUI
992253-4	3-Major	BT992253	Cannot specify IPv6 management IP addresses using GUI
992113-2	3-Major	BT992113	Page allocation failures on VIPRION B2250 blades
992053-4	3-Major	BT992053	Pva_stats for server side connections do not update for redirected flows
988745-4	3-Major	BT988745	On reboot, 'could not find platform object' errors may be seen in /var/log/ltm
987949-2	3-Major	BT987949	Error messages erroneously generated during boot up★
987081-1	3-Major	BT987081	Alarm LED remains active on Secondary blades even after LCD alerts are cleared
981485-6	3-Major	BT981485	Neurond enters a restart loop after FPGA update.
977953-3	3-Major	BT977953	Show running config interface CLI could not fetch the interface info and crashes the imi
969345-1	3-Major	BT969345	Temporary TMSH files not always removed after session termination
967557-1	3-Major	BT967557	Improve apm logging when loading sys config fails due to corruption of epsec rpm database
962477-2	3-Major	BT962477	REST calls that modify GTM objects as a user other than admin may take longer than expected
959241-1	3-Major	BT959241	Fix for ID871561 might not work as expected on the VCMP host
959057-5	3-Major	BT959057	Unable to create additional login tokens for the default admin user account
958601-4	3-Major	BT958601	In the GUI, searching for virtual server addresses does not match address lists
957993-4	3-Major	BT957993	Unable to set a port list in the GUI for an IPv6 address for a virtual server
955953-5	3-Major	BT955953	iRule command 'table' fails to resume when used with Diameter 'irule_scope_msg'
953477-1	3-Major	BT953477	Syncookie HW mode not cleared when modifying VLAN config.
950153-3	3-Major	BT950153	LDAP remote authentication fails when empty attribute is returned
948601-1	3-Major	BT948601	File object checksum attribute is not updated when an external data-group file or external monitor file is edited from GU
945413-2	3-Major	BT945413	Loop between keymgmtd and mcpd causes BIG-IP to be out of sync or in constant automatic config sync
942217-6	3-Major	BT942217	Virtual server rejects connections even though the virtual status is 'available'
939249-1	3-Major	BT939249	iSeries LCD changes to secure mode after multiple reboots
938145-3	3-Major	BT938145	DAG redirects packets to non-existent tmm
935485-4	3-Major	BT935485	BWC: flows might stall when using dynamic BWC policy
931797-3	3-Major	BT931797	LTM virtual address netmask does not persist after a reboot
928389-6	3-Major	BT928389	GUI becomes inaccessible after importing certificate under import type 'certificate'
928353-4	3-Major	BT928353	Error logged installing Engineering Hotfix: Argument isn't numeric★
927025-1	3-Major	BT927025	Sod restarts continuously
924297-4	3-Major	BT924297	Ltm policy MCP objects are not being synced over to the peer device
922613-6	3-Major	BT922613	Tunnels using autolasthop might drop traffic with ICMP route unreachable
922153-5	3-Major	BT922153	Tcpdump is failing on tmm 0.x interfaces
922053-1	3-Major	BT922053	inaccurate number of trunk members reported by bcm56xxd/bcmLINK
921069-3	3-Major	BT921069	Neurond cores while adding or deleting rules
915493-6	3-Major	BT915493	imish command hangs when ospfd is enabled
913013-1	3-Major	BT913013	Racoon daemon may crash once at startup
908753-5	3-Major	BT908753	Password memory not effective even when password policy is configured
908453-5	3-Major	BT908453	Trunks with names longer than 32 characters update working-mbr-count in vCMP guests incorrectly
904713-2	3-Major	BT904713	FailoverState device status and CM device status do not match shortly after triggering failover
904401-5	3-Major	BT904401	Guestagentd core
894593-2	3-Major	BT894593	High CPU usage caused by the restjavad daemon continually crashing and restarting
891333-2	3-Major	K32545132, BT891333	The HSB on BIG-IP platforms can get into a bad state resulting in packet corruption.
888081-6	3-Major	BT888081	BIG-IP VE Migration feature fails for 1NIC
884729-1	3-Major	BT884729	The vCMP CPU usage stats are incorrect
883149-7	3-Major	BT883149	The fix for ID 439539 can cause mcpd to core.
882609-7	3-Major	BT882609	ConfigSync status remains 'Disconnected' after setting ConfigSync IP to 'none' and back
880689-1	3-Major		Update oprofile tools for compatibility with current architecture
879969-8	3-Major	BT879969	FQDN node resolution fails if DNS response latency >5 seconds
872165-4	3-Major	BT872165	LDAP remote authentication for REST API calls may fail during authorization
867549-1	3-Major	BT867549	LCD touch panel reports "Firmware update in progress" indefinitely★
867253-4	3-Major	BT867253	Systemd not deleting user journals
851837-1	3-Major	BT851837	Mcpd fails to start for single NIC VE devices configured in a trust domain
844925-5	3-Major	BT844925	Command 'tmsh save /sys config' fails to save the configuration and hangs
838597-5	3-Major	BT838597	Unable to load license/dossier when going down for vCMP
838337-8	3-Major	BT838337	The BIG-IP system's time zone database does not reflect recent changes implemented by Brazil in regard to DST.
814273-6	3-Major	BT814273	Multicast route entries are not populating to tmm after failover
809089-4	3-Major	BT809089	TMM crash after sessiondb ref_cnt overflow
803157-4	3-Major	BT803157	LTM log contains shutdown sequence logs after boot_marker as logs are buffered until BIG-IP reboots
798885-6	3-Major	BT798885	SNMP response times may be long when processing requests
796985-4	3-Major	BT796985	Default IPv4 IP address is assigned to Alt-Address in isolated vCMP guest; vCMP host or guest are upgraded and guest is 'Inoperative'★
780745-5	3-Major	BT780745	TMSH allows creation of duplicate community strings for SNMP v1/v2 access
778513-3	3-Major	BT778513	APM intermittently drops log messages for per-request policies
775845-6	3-Major	BT775845	Httpd fails to start after restarting the service using the iControl REST API
775797-5	3-Major	BT775797	Previously deleted user account might get authenticated
762097-5	3-Major	BT762097	No swap memory available after upgrading to v14.1.0 and above★
760982-3	3-Major	BT760982	An NLRI with a default route information is not propagated on 'clear ip bgp <neighbor router-id> soft out' command in some scenarios
760400-1	3-Major	BT760400	High number of vcmp guests on clusters and discovery appliances may result in retries for guest deployment
760354-7	3-Major	BT760354	Continual mcpd process restarts after removing big logs when /var/log is full
759258-7	3-Major	BT759258	Instances shows incorrect pools if the same members are used in other pools
757787-5	3-Major	BT757787	Unable to edit LTM/AFM Policies that belong to an Application Service (iApp) using the WebUI.
755207-3	3-Major	BT755207	Large packets silently dropped on VE mlxvf5 devices
749757-4	3-Major	BT749757	-s option in qkview help does not indicate maximum size
721892-2	3-Major	BT721892	Pfmand on vCMP guests does not recover after service interruption
718291-4	3-Major	BT718291	iHealth upload error does not clear
711747-2	3-Major	BT711747	Vcmp_pde_state_memcpy core during http traffic and pfmand resets.
703226-3	3-Major	BT703226	Failure when using transactions to create and publish policies
698594-4	3-Major	K53752362, BT698594	Cave Creek Crypto hardware reports a false positive of a stuck queue state
691219-3	3-Major	BT691219	Hardware syncookie mode is used when global auto last hop is disabled.
690928-6	3-Major	BT690928	System posts error message: 01010054:3: tmrouted connection closed
673952-6	3-Major	BT673952	1NIC VE in high availability (HA) device-group shows 'Changes Pending' after reboot
658850-6	3-Major	BT658850	Loading UCS with the platform-migrate parameter could unexpectedly set or unset management DHCP
612083-3	3-Major	BT612083	The System Event Log may list correctable hardware, PCIe or DMI errors.
554506-3	3-Major	K47835034, BT554506	PMTU discovery from management does not work
538283-6	3-Major	BT538283	iControl REST asynchronous tasks may block other tasks from running
528314-2	3-Major	K16816, BT528314	Generating new default certificate and key pairs for BIG-IP ssl profiles via CLI will not be reflected in GUI or in tmsh
499348-14	3-Major	BT499348	System statistics may fail to update, or report negative deltas due to delayed stats merging.
493740-4	3-Major	BT493740	tmsh allows cipher group creation with non-existent "require" or "exclude" cipher rule.
431503-11	3-Major	K14838, BT431503	TMSH crashes in rare initial tunnel configurations
342319-1	3-Major		BIND forwarder server list and the recursion and forward options.
1350693-2	3-Major	BT1350693	Log publisher using replicated destination with unreliable destination servers may leak xfrags
1348061-2	3-Major	BT1348061	[Dual Stack MGMT] - Upgrade of BIG-IP in HA with Dual stacked mgmt IP causes deletion of peers failover IPv4 unicast address★
1347861-2	3-Major	BT1347861	Monitor status update logs unclear for FQDN template pool member
1345989	3-Major	BT1345989	"Rest framework is not available" being displayed when navigating to the "Device Management >> Overview" page
1340513-2	3-Major	BT1340513	The "max-depth exceeds 6" message in TMM logs
1332473-2	3-Major	BT1332473	Configuring SNAT Origin IPv6 address through GUI in non RD0 incorectly expands subnet mask to '/32' causes error during configuration load
1325561	3-Major	BT1325561	Reboot should be prohibited in the middle of Terraform onboarding and the f5-bigip-runtime-init is not finished
1322413-2	3-Major	BT1322413	FQDN node status changes to Unknown/Unchecked on peer device after config sync
1320389-1	3-Major		vCMP guest loses connectivity because of bad interface mapping
1316481-2	3-Major	BT1316481	Large CRL file update fails with memory allocation failure
1316113-2	3-Major	BT1316113	1nic VE reloads on every reboot
1312225-2	3-Major	BT1312225	System Integrity Status: Invalid with some Engineering Hotfixes
1311613-2	3-Major	BT1311613	UCS obtained from F5OS tenant with FPGA causes continuous TMM restarts when loaded to BIG-IP
1311125-3	3-Major	BT1311125	DDM Receive Power value reported by BCM56xxd is off by a factor of 10
1304849-1	3-Major	BT1304849	iSeries LCD displays "Host inaccessible or in diagnostic mode"
1301897-3	3-Major	BT1301897	DAG transition does not complete when TMM starts in FORCED_OFFLINE mode
1298133-3	3-Major	BT1298133	BFD sessions using floating self IP do not work well on multi-blade chassis
1297257-2	3-Major	BT1297257	Pool member Forced Offline then Enabled is marked down on peer after Incremental sync
1295353-2	3-Major	BT1295353	The vCMP guest is not sending HTTP flow samples to sFlow receiver
1294109-3	3-Major	BT1294109	MCP does not properly read certificates with empty subject name
1293193-2	3-Major	BT1293193	Missing MAC filters for IPv6 multicast
1288009-3	3-Major	BT1288009	Vxlan tunnel end point routed through the tunnel will cause a tmm crash
1283721-2	3-Major	BT1283721	Vmtoolsd memory leak
1269709-1	3-Major	BT1269709	GUI should throw the error when the VS is configured with both vdi and HTTP/2 profiles
1253449-3	3-Major	BT1253449	After publishing, the draft LTM policy configuration might not be updated (intermittently) into the bigip.conf
1217473-2	3-Major	BT1217473	All the UDP traffic is sent to a single TMM
1215613-2	3-Major	BT1215613	ConfigSync-IP changed to IPv6 address and it cannot be changed back to IPv4 address
1211797-3	3-Major	BT1211797	MCPD CPU usage is 100% on updating long address-list through GUI
1211089-3	3-Major	BT1211089	Traffic to IPv6 all nodes address not received by TMM on VE with ixlv driver
1209465	3-Major	BT1209465	When vCMP host is rebooted, oldEngineID is not restored on guest
1194409-2	3-Major	BT1194409	Dropped messages seen in auditforwarder logging
1188857-4	3-Major	BT1188857	EPSEC RPM database is corrupted
1186649	3-Major	BT1186649	TMM keep crashing after vCMP Guest Upgrade to BIG-IP v16.1.3.2
1185605-3	3-Major	BT1185605	The iCall EventTriggeredHandler in non-common partition break after scriptd daemon restart
1182993	3-Major	BT1182993	MCPD returns dossier error 01 after reboot
1182729-2	3-Major	BT1182729	Java connection establishes from BIG-IP to BIG-IQ Management
1181757-4	3-Major	BT1181757	BGPD assert when sending an update due to cq_wbuf mishandling
1169141-3	3-Major	BT1169141	Bash tab-completion Issue
1155861-2	3-Major	BT1155861	'Unlicensed objects' error message appears despite there being no unlicensed configuration
1154381-4	3-Major	BT1154381	The tmrouted might crash when management route subnet is received over a dynamic routing protocol
1153853-4	3-Major	BT1153853	Revision of default value for provision.restjavad.extramb to avoid OOM errors in restjavad
1145749-4	3-Major	BT1145749	Locally defined BIG-IP users can be lost during a failed config-sync
1143809-1	3-Major	BT1143809	Unable to modify SNMP monitors from webUI
1137269-4	3-Major	BT1137269	MCPD fails to reply if a request is proxied to another daemon and the connection to that daemon closes
1136781-2	3-Major	BT1136781	Incorrect parsing of 'bfd notification' CLI in IMI Shell (imish)
1135961-7	3-Major	BT1135961	The tmrouted generates core with double free or corruption
1135393-1	3-Major	BT1135393	The pfmand support is not available on i15820-DF (D120)
1134509-4	3-Major	BT1134509	TMM crash in BFD code when peers from ipv4 and ipv6 families are in use.
1134057-4	3-Major	BT1134057	BGP routes not advertised after graceful restart
1132957-1	3-Major	BT1132957	Modifying IPsec tunnels tunnel object may result in TMM core
1132949-4	3-Major	BT1132949	GUI reported error when changing password after mgmt port was changed
1127881-2	3-Major	BT1127881	Deprecate sysClientsslStatFullyHwAcceleratedConns, sysClientsslStatPartiallyHwAcceleratedConns and sysClientsslStatNonHwAcceleratedConns
1126181-2	3-Major	BT1126181	ZebOS "no log syslog" configuration is not surviving reboot
1125733-3	3-Major	BT1125733	Wrong server-side window scale used in hardware SYN cookie mode
1124733-1	3-Major	BT1124733	Unnecessary internal traffic is observed on the internal tmm_bp vlan
1122021-3	3-Major	BT1122021	Killall command might create corrupted core files
1121085-3	3-Major	BT1121085	Some valid connections may get rejected in hardware SYN cookie mode
1120345-6	3-Major	BT1120345	Running tmsh load sys config verify can trigger high availability (HA) failover
1114137-4	3-Major	BT1114137	LibUV library for latest bind 9.16
1112649	3-Major		FIPS 140-2/FIPS 140-3 compliant mode is incorrect after upgrade to 16.1.2.2★
1111993-2	3-Major	BT1111993	HSB tool utility does not display PHY settings for HiGig interfaces
1105021-4	3-Major	BT1105021	F5OS BIG-IP tenants perform an MCPD "forceload" operation after a reboot
1103953-1	3-Major	BT1103953	SSMTP errors in logs every 20 minutes
1093973-7	3-Major	BT1093973	Tmm may core when BFD peers select a new active device.
1093553-4	3-Major	BT1093553	OSPF "default-information originate" injects a new link-state advertisement
1093313-2	3-Major	BT1093313	CLIENTSSL_CLIENTCERT iRule event is not triggered for TLS1.3 when the client sends an empty certificate response
1090313-3	3-Major	BT1090313	Virtual server may remain in hardware SYN cookie mode longer than expected
1086393-1	3-Major		Sint Maarten and Curacao are missing in the GTM region list
1082133-3	3-Major		iSeries LCD displays "Host inaccessible or in diagnostic mode"
1080925-3	3-Major	BT1080925	Changed 'ssh-session-limit' value is not reflected after restarting mcpd
1076801-4	3-Major		Loaded system increases CPU usage when using CS features
1074841-1	3-Major	BT1074841	Invalid syslog configuration kills syslog-ng after restarting syslog-ng.
1074053-1	3-Major	BT1074053	Delay in displaying the "Now Halting..." message while performing halt from LCD.
1073429-1	3-Major	BT1073429	Auth partition definition is incorrectly synchronized to peer and then altered.
1072081-1	3-Major	BT1072081	Imish segmentation fault when running 'ip pim sparse-mode ?' on interface config.
1070393-1	3-Major	BT1070393	The f5_api_com.crt certificate file may be removed by the load sys config command
1064893-1	3-Major	BT1064893	Keymgmtd memory leak occurrs while configuring ca-bundle-manager.
1064257-2	3-Major	BT1064257	Bundled SSL certificates may not get revalidated successfully over OCSP after stapling parameters have been modified.
1063597-1	3-Major	BT1063597	Memory leak in rewrite in some cases when no pool is selected on virtual server
1062901-1	3-Major	BT1062901	The 'trap-source' and 'network' SNMP properties are ineffective, and SNMP traps may be sent from an unintended interface.
1062857-3	3-Major	BT1062857	Non-tmm source logs stop populating after a system time change.
1061905-3	3-Major	BT1061905	Adding peer unit into device trust changes the failover address family.
1060181-3	3-Major	BT1060181	SSL handshakes fail when using CRL certificate validator.
1059293-1	3-Major	BT1059293	During DPD config changes, the IKEv2 tunnel may not start.
1058789-2	3-Major	BT1058789	Virtual addresses are not created from an address list that includes an IP address range.
1058765-2	3-Major	BT1058765	Virtual Addresses created from an address list with prefix all say Offline (enabled)
1057709-4	3-Major	BT1057709	Invalid Certificate for all BIG-IP VE OVA images on vCenter 7.0U2.
1057501-4	3-Major	BT1057501	Expired DST Root CA X3 resulting in http agent request failing.
1057305-1	3-Major	BT1057305	On deployments that use DPDK, "-c" may be logged as the TMM process/thread name.
1050457-1	3-Major	BT1050457	The "Permitted Versions" field of "tmsh show sys license" only shows on first boot
1046261-1	3-Major	BT1046261	Asynchronous REST task IDs do not persist across process restarts
1045277-4	3-Major	BT1045277	The /var partition may become 100% full requiring manual intervention to clear space
1044281-1	3-Major	BT1044281	In some cases, cpcfg does not trigger selinux relabel, leaving files unlabeled
1044021-2	3-Major	BT1044021	Searching for IPv4 strings in statistics module does not work.
1043141-1	3-Major	BT1043141	Misleading 'Symmetric Unit Key decrypt failure - decrypt failure' when loading UCS from another BIG-IP
1042589-1	3-Major	BT1042589	Wrong trunk_id is associated in bcm56xxd.
1041317-1	3-Major	BT1041317	MCPD delay in processing a query_all message if the update_status bit is set
1040573-4	3-Major	BT1040573	REST operation takes a long time when two different users perform tasks in parallel
1040277-4	3-Major	BT1040277	Syslog-ng issue may cause logging to stop and possible reboot of a system
1040117-2	3-Major	BT1040117	BIG-IP Virtual Edition drops UDP packets
1036613-3	3-Major	BT1036613	Client flow might not get offloaded to PVA in embryonic state
1036557-1	3-Major	BT1036557	Monitor information not seen in GUI
1036541-4	3-Major	BT1036541	Inherited-traffic-group setting of floating IP does not sync on incremental sync
1036461-4	3-Major	BT1036461	icrd_child may core with high numbers of open file descriptors.
1036097-4	3-Major	BT1036097	VLAN failsafe does not trigger on guest
1035661-4	3-Major	BT1035661	REST Requests return 401 Unauthorized when using Basic Auth
1033689-1	3-Major	BT1033689	BGP route map community value cannot be set to the required range when using AA::NN notation
1033333-4	3-Major		FIPS: importing a stub SSL key file results in 2 keys that share the same FIPS device
1032257-1	3-Major	BT1032257	Forwarded PVA offload requests fail on platforms with multiple PDE/TMM
1032001-2	3-Major	BT1032001	Statemirror address can be configured on management network or clusterd restarting
1031117-1	3-Major	BT1031117	The mcpd error for virtual server profiles incompatible needs to have more details
1031025-3	3-Major	BT1031025	Nitrox 3 FIPS: Upgrade from v12.1.x to v14.1.x results in new .key.exp files for the FIPS keys created before upgrade.★
1027481-3	3-Major	BT1027481	The log messages 'error: /bin/haloptns unexpected error -- 768' generated on A110 and D112 platforms
1027477-3	3-Major	BT1027477	Virtual server created with address-list in custom partition non-RD0 does not create listener
1027237-1	3-Major	BT1027237	Cannot edit virtual server in GUI after loading config with traffic-matching-criteria
1026989-1	3-Major	BT1026989	More specific dynamic or static routes created for application traffic processing can erroneously replace the route to the management subnet.
1026973-1	3-Major	BT1026973	Static routes created for application traffic processing can erroneously replace the route to the management subnet.
1026861-3	3-Major	BT1026861	Live Update of Browser Challenges and Anti-Fraud are not cleaned up
1026581-4	3-Major	BT1026581	NETFLOW/IPFIX observationTimeMilliseconds Information Element value is not populated correctly.
1026273-4	3-Major	BT1026273	HA failover connectivity using the cluster management address does not work on VIPRION platforms★
1025513-1	3-Major	BT1025513	PAM Authenticator can cause authorization failure if it fails to lock /var/log/tallylog
1024421-2	3-Major	BT1024421	At failover, ePVA flush leads to clock advancing and MPI timeout messages in TMM log
1022997-1	3-Major	BT1022997	TCP segments with an incorrect checksum are transmitted when the sock driver is used in AWS deployments (e.g., 1NIC)
1021925-4	3-Major	BT1021925	During bootup AWS BIG-IP endpoint was not licensed when custom gateway configured over management interface
1021873-1	3-Major	BT1021873	TMM crash in IPIP tunnel creation with a pool route
1021109-4	3-Major	BT1021109	The cmp-hash VLAN setting does not apply to trunked interfaces.
1020277-1	3-Major	BT1020277	Mcpd may run out of memory when build image is missing★
1020129-2	3-Major	BT1020129	Turboflex page in GUI reports 'profile.Features is undefined' error★
1020089-1	3-Major	BT1020089	MCP validation should prevent defining multiple virtual servers with the same virtual address but with different subnet masks
1020005-1	3-Major	BT1020005	OOM errors after upgrade and VE instance unresponsive★
1019793-2	3-Major	BT1019793	Image2disk does not work on F5OS BIG-IP tenant.★
1019749-2	3-Major	BT1019749	Enabling DHCP for management should not be allowed on vCMP guest
1019709-1	3-Major	BT1019709	Modifying mgmt-dhcp options should not be allowed on VCMP guest
1019429-1	3-Major	BT1019429	CMP Forwarded flows do not get syncache counter decremented when only server-side is PVA accelerated
1019285-1	3-Major	BT1019285	Systemd hangs and is unresponsive
1019129-4	3-Major	BT1019129	Changing syslog remote port requires syslog-ng restart to take effect
1018673-1	3-Major	BT1018673	Virtual Edition systems replicate host traffic to all TMMs when a multicast MAC address is the traffic's nexthop
1018165-1	3-Major	BT1018165	GUI display of DHCPv6 profile not correct for virtual server in non-default route-domain
1017897-1	3-Major	BT1017897	Self IP address creation fails with 'ioctl failed: No such device'
1017857-1	3-Major	BT1017857	Restore of UCS leads to incorrect UID on authorized_keys★
1015453-1	3-Major	BT1015453	In few circumstances, the Local Traffic menu in System > Configuration is inaccessible in the GUI
1015093-1	3-Major	BT1015093	The "iq" column is missing from the ndal_tx_stats table
1014285-5	3-Major	BT1014285	Set auto-failback-enabled moved to false after upgrade★
1012601-4	3-Major	BT1012601	Alarm LED and LCD alert cleared prematurely on startup for missing PSU input
1012449-1	3-Major	BT1012449	Unable to edit custom inband monitor in the GUI
1012377-2	3-Major	BT1012377	Unable to display/edit 'management route' via GUI
1012049-1	3-Major	BT1012049	Incorrect virtual server list returned in response to status request
1011265-3	3-Major	BT1011265	Failover script cannot read /config/partitions/ after upgrade★
1010341-4	3-Major	BT1010341	Slower REST calls after update for CVE-2021-22986
1009793-2	3-Major		Tmm crash when using ipsec
1009337-2	3-Major	BT1009337	LACP trunk down due to bcm56xxd send failure
1007909-1	3-Major	BT1007909	Tcpdump with :p (peer flow) flag does not capture forwarded between TMMs
1006345-4	3-Major	BT1006345	Static mac entry on trunk is not programmed on CPU-only blades
1004469-1	3-Major	BT1004469	SNMP OID ltmSipsessionProfileStatVsName and ltmSiprouterProfileStatVsName returns empty string
1003629	3-Major	BT1003629	PAYG license becomes invalid when swapping associated NICs for instances in both Azure and AWS.
1003225-2	3-Major	BT1003225	'snmpget F5-BIGIP-LOCAL-MIB::ltmWebAccelerationProfileStat* returns zeroes
1002417-2	3-Major	BT1002417	Switch L2 forwarding entries learnt on multi-blade trunk in one blade needs to be synchronized to other blades of that trunk
1001129-1	3-Major		Maximum Login Failures lockout for root and admin
1000325-1	3-Major	BT1000325	UCS load with 'reset-trust' may not work properly if base configuration fails to load★
992241-3	4-Minor	BT992241	Unable to change initial admin password from GUI after root password change
986821-1	4-Minor	BT986821	Command 'run util bash' event is not captured in log when initially executed
977681-3	4-Minor	BT977681	Incorrect error message when changing password using passwd
976517-2	4-Minor	BT976517	Tmsh run sys failover standby with a device specified but no traffic group fails
933597-5	4-Minor	BT933597	Mandatory arguments missing in tmsh security protocol-inspection profile help
929173-3	4-Minor	BT929173	Watchdog reset due to CPU stall detected by rcu_sched
928665-4	4-Minor	BT928665	Kernel nf_conntrack table might get full with large configurations.
927441-5	4-Minor	BT927441	Guest user not able to see virtual server details when ASM policy attached
915473-4	4-Minor	BT915473	Accessing Dashboard page with AVR provisioned causes continuous audit logs
915141-5	4-Minor	BT915141	Availability status of virtual server remains 'available' even after associated pool's availability becomes 'unknown'
908005-5	4-Minor	BT908005	Limit on log framework configuration size
895669-3	4-Minor	BT895669	VCMP host does not validate when an unsupported TurboFlex profile is configured
868801-2	4-Minor	BT868801	BIG-IP still sends STARTTLS if the 'No encryption' SNMP option is enabled
860573-6	4-Minor	BT860573	LTM iRule validation performance improvement by tracking procedure/event that have been validated
857045-4	4-Minor	BT857045	LDAP system authentication may stop working
843293-1	4-Minor	BT843293	When L7 performance FPGA is loaded, "tmsh show sys fpga" shows standard-balanced-fpga.
808481-6	4-Minor	BT808481	Hertfordshire county missing from GTM Region list
807309-5	4-Minor	BT807309	Incorrect Active/Standby status in CLI Prompt after failover test
803773-3	4-Minor	BT803773	BGP Peer-group route-maps are not applied to newly configured address-family ipv6 peers
753712-4	4-Minor	BT753712	Incorrect warning: Traffic Matching Criteria's inline source address has been set to any4 from any6 to match inline destination address' address family.
745125-2	4-Minor	BT745125	Network Map page Virtual Servers with associated Address/Port List have a blank address.
714705-8	4-Minor	BT714705	Excessive 'The Service Check Date check was skipped' log messages.
713183-7	4-Minor	BT713183	Malformed JSON files may be present on vCMP host
712241-8	4-Minor	BT712241	A vCMP guest may not provide guest health stats to the vCMP host
696363-7	4-Minor	BT696363	Unable to create SNMP trap in the GUI
694765-7	4-Minor	BT694765	Changing the system's admin user causes vCMP host guest health info to be unavailable
690781-4	4-Minor	BT690781	VIPRION systems with B2100 or B2150 blades cannot run certain combinations of vCMP guest sizes
689147-6	4-Minor	BT689147	Confusing log messages on certain user/role/partition misconfiguration when using remote role groups
673573-8	4-Minor	BT673573	tmsh logs boost assertion when running child process and reaches idle-timeout
659579-6	4-Minor	BT659579	Timestamps in icrd, restjavad, and restnoded logs are not synchronized with the system time
658943-5	4-Minor	BT658943	Errors when platform migration process is loading UCS using trunks on vCMP guest/F5OS Tenants
646768-6	4-Minor	K71255118, BT646768	VCMP Guest CM device name not set to hostname when deployed
550526-3	4-Minor	K84370515, BT550526	Some time zones prevent configuring trust with a peer device using the GUI.
539648-4	4-Minor	K45138318, BT539648	Disabled db var Watchdog.State prevents vCMP guest activation.
447522-1	4-Minor	BT447522	GUI: SNMPV3 Incorrectly requires "OID" when creating an SNMP user.
1331037-3	4-Minor	BT1331037	The message MCP message handling failed logs in TMM with FQDN nodes/pool members
1324681-3	4-Minor	BT1324681	Virtual-server might stop responding when traffic-matching-criteria is removed.
1320889-3	4-Minor	BT1320889	1NIC AWS deployments might fail to forward some packets.
1314769-2	4-Minor	BT1314769	The error "No Access" is displayed when trying to remove Bundle Manager object from list
1311977-4	4-Minor	BT1311977	IPsec interface mode tunnel not sending icmp unreachable fragmentation needed
1302353	4-Minor	BT1302353	Duplicate OID index warnings observed in /var/log/ltm
1301865-3	4-Minor	BT1301865	OSPF summary might have incorrect cost when advertised by Standby unit.
1301317	4-Minor	BT1301317	Update Check request using a proxy will fail if the proxy inserts a custom header
1283749-2	4-Minor	BT1283749	Systemctl start and restart fail to start the vmtoolsd service
1280281-1	4-Minor	BT1280281	SCP allow list may have issues with file paths that have spaces in them
1270989-3	4-Minor	BT1270989	REST MemcachedClient uses fixed TMM address 127.1.1.2 to connect to memcached
1229325-3	4-Minor	BT1229325	Unable to configure IP OSPF retransmit-interval as intended
1223589-3	4-Minor	BT1223589	Network Map page is unresponsive when a node name has the form "<IPv4>:<port>"
1217077-2	4-Minor	BT1217077	Race condition processing network failover heartbeats with timeout of 1 second
1213277	4-Minor	BT1213277	Certificate order manager configuration using DigiCert URL fails in the BIG-IP
1209589-4	4-Minor	BT1209589	BFD multihop does not work with ECMP routes
1145729-3	4-Minor	BT1145729	Partition description between GUI and REST API/TMSH does not match
1144729-4	4-Minor	BT1144729	PVA stats may be incorrect when PVA offloaded flows have their nexthops changed to a different VLAN
1142445-4	4-Minor	BT1142445	Multicast handling on wildcard virtual servers leads to TMM memory leak
1141213-2	4-Minor	BT1141213	Peer is aborting the connection when PEM client runs diameter traffic over SCTP
1136837-4	4-Minor	BT1136837	TMM crash in BFD code due to incorrect timer initialization
1121169-3	4-Minor	BT1121169	Unable to resize the /appdata: /dev/mapper/vg--db--sda-dat.appdata when in use
1114253-4	4-Minor	BT1114253	Weighted static routes do not recover from BFD link failures
1105757-2	4-Minor	BT1105757	Creating CSR with invalid parameters for basic-constraints, tmsh does not generate meaningful errors
1101741-2	4-Minor	BT1101741	Virtual server with default pool down and iRule pool up will flap for a second during a full config-sync.
1096461-5	4-Minor	BT1096461	TACACS system-auth Accounting setting has no effect when set to send-to-all-servers/send-to-first-server
1095973-3	4-Minor	BT1095973	Config load failure when Trusted CA Bundle is missing and URL is present in the Bundle Manager
1095205-4	4-Minor	BT1095205	Config.auditing.forward.multiple db Variable with value "none" is not working as expected with multiple destination addresses in audit_forwarder.
1089005-4	4-Minor	BT1089005	Dynamic routes might be missing in the kernel on secondary blades.
1082193-3	4-Minor	BT1082193	TMSH: Need to update the version info for SERVER_INIT in help page
1077293-2	4-Minor	BT1077293	APPIQ option still showing in BIG-IP GUI even though its functionality migrated to BIG-IQ.
1074513-3	4-Minor	BT1074513	Traffic class validation does not detect/prevent attempts to add duplicate traffic classes to virtual
1073965-1	4-Minor	BT1073965	IPsec IKEv2 tunnel may report huge "life" for IKE SA.
1067653-2	4-Minor	BT1067653	Ndisc6 is not working with non-default route domain.
1065821-4	4-Minor	BT1065821	Cannot create an iRule with a newline between event and opening brace.
1064753-4	4-Minor	BT1064753	OSPF LSAs are dropped/rate limited incorrectly.
1063609	4-Minor	BT1063609	"Failed to start Jitterentropy Gatherer Daemon" encountered during boot
1060769-1	4-Minor	BT1060769	The /mgmt/tm/sys/performance/all-stats and /mgmt/tm/sys/performance/throughput iControl REST endpoints cannot be successfully parsed by common JSON libraries.
1060721-2	4-Minor	BT1060721	Unable to disable auto renew in Certificate order manager via GUI.
1057925-4	4-Minor	BT1057925	GTP iRule generates a warning.
1055053-4	4-Minor	BT1055053	"tmsh load sys config default" does not clear Zebos config files.
1054497-1	4-Minor	BT1054497	Tmsh command "show sys fpga" does not report firmware for all blades.
1053037-7	4-Minor	BT1053037	MCP error on loading a UCS archive with a global flow eviction policy
1050413-4	4-Minor	BT1050413	Drive model HGST HUS722T1TALA604 must be added to pendsect drives.xml
1044893	4-Minor	BT1044893	Kernel warnings from NIC driver Realtek 8139
1036265-4	4-Minor	BT1036265	Overlapping summary routes might not be advertised after ospf process restart.
1035017-6	4-Minor		Remove unused CA-bundles
1034509-6	4-Minor	BT1034509	Sensor read errors on VIPRION C2200 chassis
1033969-4	4-Minor	BT1033969	MPLS label stripping needs next protocol indicator
1032921-4	4-Minor	BT1032921	VCMP Guest CPU usage shows abnormal values at the Host
1029173-4	4-Minor	BT1029173	MCPD fails to reply and does not log a valid message if there are problems replicating a transaction to PostgreSQL
1025965-1	4-Minor	BT1025965	Audit role users cannot see folder properties under sys-folder
1024301-1	4-Minor	BT1024301	Missing required logs for "tmsh modify disk directory" command
1023817-2	4-Minor	BT1023817	Misleading "Enabling NAT64 for virtual server with security NAT policy configured is redundant/not required." warning
1022297-4	4-Minor	BT1022297	In BIG-IP GUI using "Select All" with filters is not working appropriately for policies
1020109-1	4-Minor	BT1020109	Subnet mask property of virtual addresses not displayed in management GUI
1011081-3	4-Minor	BT1011081	Connection lost to the Postgres client during the BIG-IP bootup process
1010785-3	4-Minor	BT1010785	Online help is missing for CRL in client SSL profile and server SSL profile
1010761-3	4-Minor	BT1010761	Missing TMSH help description for client-ssl profile 'CRL'
1006449-1	4-Minor	BT1006449	The default size of the subagent object cache possibly leading to slow snmp response time and high mcpd CPU use★
1003469-1	4-Minor	BT1003469	The BIG-IP GUI fails to reset the statistics for an IPv6 pool member and returns an error.
1003081-3	4-Minor	BT1003081	GRE/TB-encapsulated fragments are not forwarded.
989937-2	5-Cosmetic	BT989937	Device Trust Certificates Expiring after 2038-01-19 show date of 1969
1323081	5-Cosmetic	BT1323081	Wrong Licensed Date is displayed after license activation
1189949-2	5-Cosmetic	BT1189949	The TMSH sys core is not displaying help and tab complete behavior
1099621-3	5-Cosmetic	BT1099621	DAG context synchronization debug instrumentation
1072173-1	5-Cosmetic	BT1072173	The BIG-IP system incorrectly presents legacy ways of defining mirroring properties
1022421-4	5-Cosmetic	BT1022421	Pendsec utility incorrectly starts on i2x00/i4x00 platform with NON WD disk

Local Traffic Manager Issues

ID Number	Severity	Links to More Info	Description
1305865-1	1-Blocking	BT1305865	Drop in performance with high throughput on BIG-IP 15.1.9 Virtual Edition or tenants on r2000 or r4000 hosts.
1168309-2	1-Blocking	BT1168309	Virtual Wire traffic over trunk interface sometimes fail in Tenant based platforms
1136081-5	1-Blocking	BT1136081	HSM sync issue in high availability (HA) setups
999669-1	2-Critical	BT999669	Some HTTPS monitors are failing after upgrade when config has different SSL option★
949137-1	2-Critical	BT949137	Clusterd crash and vCMP guest failover
938545-1	2-Critical	BT938545	Oversize plugin Tcl object results can result in 0-length messages and plugin crash
927633-4	2-Critical	BT927633	Failure path in external datagroup internal mapping operation failure may result in 'entry != NULL' panic
851385-8	2-Critical	BT851385	Failover takes too long when traffic blade failure occurs
797573-1	2-Critical	BT797573	TMM assert crash with resulting in core generation in multi-blade chassis
758491-5	2-Critical	BT758491	When using NetHSM integration, after upgrade to 14.1.0 or later (or creating keys using fipskey.nethsm), BIG-IP cannot use the keys
599135-4	2-Critical	BT599135	B2250 blades may suffer from high TMM CPU utilisation with tcpdump
1319365-2	2-Critical	BT1319365	Policy with external data group may crash TMM or return nothing with search contains
1305697-3	2-Critical	BT1305697	TMM may crash after performing a full sync, when in-tmm monitors are configured and ssl-profile is changed
1298029-3	2-Critical	BT1298029	DB_monitor may end the wrong processes
1209197-1	2-Critical	BT1209197	Gtmd crash SIGSEGV - OBJ_sn2nid() in
1134257-2	2-Critical	BT1134257	TMM cores when pingaccess profile is modified multiple times and configuration is loaded
1127725-1	2-Critical	BT1127725	Performance drop with the AES_CCM 128 cipher★
1105145-2	2-Critical	BT1105145	Request body on server side egress is not chunked when it needs to be after HTTP processes a 100 continue response.
1100721-2	2-Critical	BT1100721	IPv6 link-local floating self-IP breaks IPv6 query to BIND
1100249-2	2-Critical	BT1100249	SNAT with FLOW_INIT firewall rule may core TMM due to wrong type of underlying flow structure
1091021-2	2-Critical	BT1091021	The BIG-IP system may not take a fail-safe action when the bigd daemon becomes unresponsive.
1087981-2	2-Critical	BT1087981	Tmm crash on "new serverside" assert
1078741-2	2-Critical	BT1078741	Tmm crash
1073897-2	2-Critical	BT1073897	TMM core due to memory corruption
1072377-3	2-Critical	BT1072377	TMM crash in rare circumstances during route changes
1070181-3	2-Critical	BT1070181	Secondary MCPD crashes with Configuration error
1064649-2	2-Critical	BT1064649	Tmm crash after upgrade.★
1060369-1	2-Critical	BT1060369	HTTP MRF Router will not change serverside load balancing method
1039145-1	2-Critical	BT1039145	Tenant mirroring channel disconnects with peer and never reconnects after failover.
998253-4	3-Major	BT998253	SNI configuration is not sent via HTTPS when in-tmm monitors are disabled
996649-6	3-Major	BT996649	Improper handling of DHCP flows leading to orphaned server-side connections
994081-1	3-Major	BT994081	Traffic may be dropped with an Immediate idle timeout setting
991265-3	3-Major	BT991265	Persistence entries point to the wrong servers for longer periods of time
985749-1	3-Major	BT985749	TCP exponential backoff algorithm does not comply with RFC 6298
985401-1	3-Major	BT985401	ProxySSL virtual servers should work with web acceleration (ramcache) profiles attached
984897-1	3-Major	BT984897	Some connections performing SSL mirroring are not handled correctly by the Standby unit.
978953-3	3-Major	BT978953	The value of the sys db variable vlan.backplane.mtu intermittently out-of-sync with the value of the MTU of the kernel interface tmm_bp during the initial boot up
975725-5	3-Major	BT975725	Wildcard virtual servers do not forward L3 unicast traffic sent to L2 broadcast
975657-1	3-Major	BT975657	With HTTP2 enabled, only partial sorry contents (< 32KB) can be sent to the client via HTTP::respond
968949-7	3-Major	BT968949	Keepalives aren't sent in FIN_WAIT_2 when using a TCP profile
967353-1	3-Major	BT967353	HTTP proxy should trim spaces between a header field-name and colon in its downstream responses.
966785-1	3-Major	BT966785	Rate Shaping stops TCP retransmission
963393-2	3-Major	BT963393	Key handle 0 is treated as invalid for NetHSM devices
961653-3	3-Major	BT961653	Unable to retrieve DNS link statistics via SNMP OID gtmLinkStatRate
961001-5	3-Major	BT961001	Arp requests not resolved for snatpool members when primary blade goes offline
958785-8	3-Major	BT958785	FTP data transfer does not complete after QUIT signal
945189-5	3-Major	BT945189	HTTPS monitor fails due to missing ECDHE-RSA-AES256-CBC-SHA★
944173-4	3-Major	BT944173	SSL monitor stuck does not change TLS version
937573-1	3-Major	BT937573	Connections drop in virtual server with Immediate Action On Service Down set to Drop
932461-5	3-Major	BT932461	Cert update on server SSL profile on HTTPS monitor: BIG-IP not using the updated certificate.
928445-5	3-Major	BT928445	HTTPS monitor is down when server_ssl profile cipher string is configured to TLSv1_2
927589-1	3-Major	BT927589	ILX::call command response get truncated
922641-6	3-Major	BT922641	Any iRules that park in a clientside or serverside command leave the iRule attached to the wrong flow
912293-5	3-Major	BT912293	Persistence might not work properly on virtual servers that utilize address lists
907177-5	3-Major	BT907177	Priority of embedded APM iRules is ignored
906653-1	3-Major	BT906653	Server side UDP immediate idle-timeout drops datagrams
905477-6	3-Major	BT905477	The sdmd daemon cores during config sync when multiple devices configured for iRules LX
901569-4	3-Major	BT901569	Loopback traffic might get dropped when VLAN filter is enabled for a virtual server.
891565-1	3-Major	BT891565	The Subject Alternative Name (SAN) field in Certificates and Certificate Signing Requests is limited to 4095 bytes
891145-7	3-Major	BT891145	TCP PAWS: send an ACK for half-open connections that receive a SYN with an older TSVal
888885-3	3-Major	BT888885	BIG-IP Virtual Edition TMM restarts frequently without core
887265-4	3-Major	BT887265	BIG-IP systems may fail to come online after upgrade with ASM and VLAN-failsafe configuration★
887045-7	3-Major	BT887045	The session key does not get mirrored to standby.
881937-2	3-Major	BT881937	TMM and the kernel choose different VLANs as source IPs when using IPv6.
881065-5	3-Major	BT881065	Adding port-list to Virtual Server changes the route domain to 0
878253-5	3-Major	BT878253	LB::down no longer sends an immediate monitor probe
874877-4	3-Major	BT874877	The bigd monitor reports misleading error messages
867985-6	3-Major	BT867985	LTM policy with a 'shutdown' action incorrectly allows iRule execution
862001-6	3-Major	BT862001	Improperly configured NTP server can result in an undisciplined clock stanza
857769-1	3-Major	BT857769	FastL4+HTTP or FastL4+Hash-Persistence virtual servers do not work correctly in DSR mode.
846977-7	3-Major	BT846977	TCP:collect validation changed in 12.0.0: the first argument can no longer be zero★
842137-6	3-Major	BT842137	Keys cannot be created on module protected partitions when strict FIPS mode is set
812693-5	3-Major	BT812693	Connection in FIN_WAIT_2 state may fail to be removed
805561-1	3-Major	BT805561	Change of pool configuration in OneConnect environment can impact active traffic
779137-7	3-Major	BT779137	Using a source address list for a virtual server does not preserve the destination address prefix
778501-5	3-Major	BT778501	LB_FAILED does not fire on failure of HTTP/2 server connection establishment
751451-4	3-Major	BT751451	When upgrading to v14.0.0 or later, the 'no-tlsv1.3' option is missing from HTTPS monitors automatically created server SSL profiles
740274-2	3-Major	BT740274	TMM stall during startup when syslog is not listening to tmm.pipe
739475-6	3-Major	BT739475	Site-Local IPv6 Unicast Addresses support.
679316-8	3-Major	BT679316	iQuery connections reset during SSL renegotiation
369640-8	3-Major	K17195	iRules might return incorrect data when multiple partitions and/or folders contain objects with the same name
1350885-2	3-Major	BT1350885	TMM cored with SIGSEGV when using dtls by disabling the unclean shutdown flag
1330249-3	3-Major	BT1330249	Fastl4 can queue up too many packets
1328893-1	3-Major	BT1328893	TMM core when processing invalid timer.
1325649-2	3-Major	BT1325649	POST request with "Expect: 100-Continue" and HTTP::collect + HTTP::release is not being passed to pool member
1322937-2	3-Major	BT1322937	Tmm crash in Google Cloud during a live migration: Assertion `empty xfrag' failed.
1319265-3	3-Major	BT1319265	Tmm crash observed in GCP after a migration
1312041	3-Major	BT1312041	Connection RST with reason "STREAM max match size exceeded" after upgrading to v16.1.x★
1306249-1	3-Major	BT1306249	Hourly spike in the CPU usage and lasts for fraction of second causing delay in TLS connections
1305609-3	3-Major	BT1305609	Missing cluster hearbeart packets in clusterd process and the blades temporarily leave the cluster
1305361-2	3-Major	BT1305361	Flows that are terminated by an ILX streaming plugin may not expire immediately
1305329	3-Major	BT1305329	HTTP iRule event HTTP_REQUEST_DATA is triggered even though there is no data collected via HTTP::collect command.
1304189-3	3-Major	BT1304189	Duplicate SYNs to a mirrored FastL4 virtual may result in connection failures
1302077-4	3-Major	BT1302077	Virtual address statistics being counted for different virtual address after changing the destination address of a virtual server
1300925-3	3-Major	BT1300925	Shared memory race may cause TMM to core
1294289-2	3-Major		SSL Persist leaks memory on when client and server hello exceeds MSS
1284413	3-Major	BT1284413	After upgrade to 16.1.3.2 from 16.0.1.1, BIG-IP can send CONNECT requests when no proxy select agent is used★
1284261-3	3-Major	BT1284261	Constant traffic on DHCPv6 virtual servers may cause a TMM crash.
1273161-3	3-Major	BT1273161	Secondary blades are unavailable, clusterd is reporting shutdown, and waiting for other blades
1272501	3-Major	BT1272501	Connections are being reset with the cause "F5RST:HTTP redirect rewrite failure"
1271341	3-Major	BT1271341	Unable to use DTLS without TMM crashing
1251173-1	3-Major	BT1251173	SNI based redirection using LTM policies is not working in BIG-IP
1238529-2	3-Major	BT1238529	TMM might crash when modifying a virtual server in low memory conditions
1216053-4	3-Major	BT1216053	Regular monitors do not use options from SSL profiles
1215165-1	3-Major	BT1215165	Support added for Microsoft Azure Managed HSM
1205045-4	3-Major	BT1205045	WMI monitor does not put pool members into an offline/unchecked state when BIG-IP receives HTTP responses other than 200
1188837	3-Major	BT1188837	Server side timewait close state causes long establishment under port reuse on i15820DF
1185929-2	3-Major	BT1185929	Under rare circumstances, the TCL interpreter can crash TMM after a long time
1166481-3	3-Major	BT1166481	The vip-targeting-vip fastL4 may core
1148181	3-Major	BT1148181	SSL TLS1.3 connection terminates with "empty persist key" error when SSL persistence is enabled and session tickets are disabled
1148065-2	3-Major	BT1148065	HTTP::header exists and value iRule commands will not return successful even if the header is present
1144845-4	3-Major	BT1144845	GARPs from a newly active unit may be bridged for a brief time while the peer chassis transitions to standby
1143833-2	3-Major	BT1143833	ILX (iRules LX) may corrupt tmstat (profile statistics) memory
1137521	3-Major	BT1137521	TLSv1.3 connections dropped when SSL Persistence is enabled
1125381-2	3-Major	BT1125381	Extraneous warnings recorded in when using only intermediate certificates
1112385-3	3-Major	BT1112385	Traffic classes match when they shouldn't
1112205-3	3-Major	BT1112205	HTTP/2 may garble responses if the client-side stream aborts while response headers are on the wire
1110949-2	3-Major	BT1110949	Updating certKeyChain of parent SSL profile using iControl does not change the cert and key outside certKeyChain of the child profile
1110485-3	3-Major	BT1110485	SSL handshake failures with invalid profile error
1110165-3	3-Major	BT1110165	Fasthttp connections infrequently fail
1107605-1	3-Major	BT1107605	TMM crash reported with specific policy settings
1106673-3	3-Major	BT1106673	Tmm crash with FastL4 virtual servers and CMP disabled
1105969-1	3-Major	BT1105969	Gratuitous ARP not issued for non-floating self-IP on clicking "Update" via the GUI
1104553-2	3-Major	BT1104553	HTTP_REJECT processing can lead to zombie SPAWN flows piling up
1099373-2	3-Major	BT1099373	Virtual Servers may reply with a three-way handshake when disabled or when processing iRules
1093061-2	3-Major	BT1093061	MCPD restart on secondary blade during hot-swap of another blade
1091785-2	3-Major	BT1091785	DBDaemon restarts unexpectedly and/or fails to restart under heavy load
1088597-2	3-Major	BT1088597	TCP keepalive timer can be immediately re-scheduled in rare circumstances
1087569-4	3-Major	BT1087569	Changing max header table size according HTTP2 profile value may cause stream/connection to terminate
1086473-3	3-Major	BT1086473	BIG-IP resumes a TLS session on the client-side but then proceeds to do a full handshake
1084965-3	3-Major	BT1084965	Low visibility of attack vector
1083621-1	3-Major	BT1083621	The virtio driver uses an incorrect packet length
1083589-3	3-Major	BT1083589	Some connections are dropped on chained IPv6 to IPv4 virtual servers.
1080985-1	3-Major		Route Domain ID specified in Address list does not take effect on virtual server IP via TMC.
1079237-1	3-Major	BT1079237	After certain configuration tasks are performed, TMM may run with stale SNAT translation parameters.
1078357-2	3-Major	BT1078357	HTTP_REJECT processing can lead to zombie SPAWN flows
1075045-1	3-Major	BT1075045	Proxy initialization failed, Defaulting to DENY, after applying additional profile to a virtual server
1072397-1	3-Major	BT1072397	VLAN failsafe failover does not occur in three-node device group
1071701-1	3-Major	BT1071701	VE rate limit should not count packet that does not have a matched vlan or matched MAC address
1071385-3	3-Major	BT1071385	SSL session resumption is incorrectly logging handshake failure messages
1070957-1	3-Major	BT1070957	Database monitor log file backups cannot be rotated normally.
1069001	3-Major	BT1069001	TMM crash in TLS/SSL processing
1067469-4	3-Major		Discrepancy in virtual server stats with LRO enabled.
1065353-1	3-Major	BT1065353	Disabling ciphers does not work due to the order of cipher suite.
1065013-4	3-Major	BT1065013	Tmm crash with iRuleLX plugin in use
1063865-7	3-Major	BT1063865	Blade remains in an INOPERATIVE state after being moved to new chassis.
1060541-1	3-Major	BT1060541	Increase in bigd CPU utilization from 13.x when SSL/TLS session resumption is not utilized by HTTPS pool members due to Open SSL upgrade
1059573-4	3-Major	BT1059573	Variation in a case insensitive value of an operand in LTM policy may fail in some rules.
1057561	3-Major	BT1057561	Occasional Nitrox5 zip engine hang.
1057121-3	3-Major	BT1057121	MQTT Over Websockets in Websocket Termination mode is not working
1056941-2	3-Major	BT1056941	HTTPS monitor continues using cached TLS version after receiving fatal alert.
1051153-4	3-Major	BT1051153	DHCP fails intermittently when the connection is through BIG-IP.
1043985-1	3-Major	BT1043985	After editing an iRule, the execution order might change.
1040957-1	3-Major	BT1040957	The ipother profile can be used with incompatible profiles in a virtual server
1040465-3	3-Major	BT1040465	Incorrect SNAT pool is selected
1040045-3	3-Major	BT1040045	Unable to delete trunk member on a VCMP guest
1039349-1	3-Major	BT1039349	HTTP statistics not updated
1037645-4	3-Major	BT1037645	TMM may crash under memory pressure when using iRule 'AES::key' command
1037257-2	3-Major	BT1037257	SSL::verify_result showing wrong output for revoked cert during Dynamic CRL check
1036873-2	3-Major	BT1036873	Pre-shared key extension sometimes is not the last extension in ClientHello in TLS1.3
1036093-4	3-Major	BT1036093	Tmm sends out neighbor advertisements for the link local addresses even if IPv6 is disabled
1036013-3	3-Major	BT1036013	BIG-IP systems may terminate connections prematurely when a TLS close-notify alert is received
1034953-3	3-Major	BT1034953	In explicit proxy, HTTP_STATCODE missing from syslog
1033937-1	3-Major	BT1033937	HTTP message router stats do not increment for virtual servers and pools
1029069-2	3-Major	BT1029069	Non-ASCII characters are not displayed correctly.
1026781-3	3-Major	BT1026781	Standard HTTP monitor send strings have double CRLF appended
1025089-1	3-Major	BT1025089	Pool members marked DOWN by database monitor under heavy load and/or unstable connections
1023529-2	3-Major	BT1023529	FastL4 connections with infinite timeout may become immune to manual deletion and remain in memory.
1021837-3	3-Major	BT1021837	When a virtual server has an inline service profile configured, connections will be reset with cause "No server selected"
1020069-1	3-Major	BT1020069	Equinix SmartKey HSM is not working with nethsm-partition 'fortanix'
1019641-3	3-Major	BT1019641	SCTP INIT_ACK not forwarded
1018765-1	3-Major	BT1018765	Changing the sshd port breaks some BIG-IP utilities on a multi-bladed system
1017885-5	3-Major	BT1017885	Wildcard server-name does not match multiple labels in FQDN
1017801-1	3-Major	BT1017801	Internal listeners (cgc, ftp data, etc) all share the same listener_key stats
1017421-4	3-Major	BT1017421	SASP Monitor does not log significant error conditions at default logging level
1017029-5	3-Major	BT1017029	SASP monitor does not identify specific cause of failed SASP Registration attempt
1016921-3	3-Major	BT1016921	SSL Connection mirroring - session resumption does not occur on standby when the session ticket is enabled
1016909-1	3-Major	BT1016909	BIG-IP iRule commands FLOW::this or FLOW::peer can create zombie flows.
1016589-1	3-Major	BT1016589	Incorrect expression in STREAM::expression might cause a tmm crash
1016433-2	3-Major	BT1016433	URI rewriting is incorrect for "data:" and "javascript:"
1015817-1	3-Major	BT1015817	Flows rejected due to no return route do not increment rejection stats
1014633-4	3-Major	BT1014633	Transparent / gateway monitors may fail if there is no route to a node
1013597-2	3-Major	BT1013597	`HTTP2::disable serverside` can reset flows
1013209-5	3-Major	BT1013209	BIG-IP components relying on ca-bundle.crt may stop working after upgrade★
1012009-3	3-Major	BT1012009	MQTT Message Routing virtual may result in TMM crash
1010209-1	3-Major	BT1010209	BIG-IP configuration allows literal CR and LF characters in LTM monitor send and recv strings
1009921-3	3-Major	BT1009921	'SSL::verify_result' iRule command may return incorrect value when combined with dynamic CRL check
1006857-1	3-Major	BT1006857	Adding a source address list to a virtual server in a partition with a non-default route domain fails.
1004609-6	3-Major	BT1004609	SSL forward proxy virtual server may set empty SSL session_id in server hello.
1002969-4	3-Major	BT1002969	Csyncd can consume excessive CPU time★
999709-6	4-Minor	BT999709	iRule 'pool'/'virtual' commands not triggered in CLIENT_ACCEPTED with HTTP/2.
997357-1	4-Minor	BT997357	iRule command "SSL:session invalidate" not working as expected
990173-1	4-Minor	BT990173	Dynconfd repeatedly sends the same mcp message to mcpd
987401-1	4-Minor	BT987401	Increased TMM memory usage on standby unit after pool flap
947745-3	4-Minor	BT947745	Tcp proxy does not ignore HUDEVT_CHILD_CONNECTED and gives an error
940837-4	4-Minor	BT940837	The iRule command node is not triggered in CLIENT_ACCEPTED with HTTP/2.
932553-6	4-Minor	BT932553	An HTTP request is not served when a remote logging server is down
929429-8	4-Minor	BT929429	Oracle/SQL database monitor uses excessive CPU when Platform FIPS is licensed
921993-1	4-Minor	BT921993	LTM policy with a 'contains' operator does not work as expected when using an external data group.
904537-1	4-Minor	BT904537	The csyncd process may keep trying to sync the GeoIP database to a secondary blade
829021-1	4-Minor	BT829021	BIG-IP does not account a presence of http2 profile when response payload is modified
804089-2	4-Minor	BT804089	iRules LX Streaming Extension dies with Uncaught, unspecified error event
683534-2	4-Minor	BT683534	'tmsh show sys connection' command prompt displaying 4 billion connections is misleading
669934-2	4-Minor	BT669934	Session commands may not work correctly in FLOW_INIT event.
1348869	4-Minor	BT1348869	Hourly spike in the CPU usage and lasts for fraction of second causing delay in TLS connections
1348841	4-Minor	BT1348841	TMM cored with SIGSEGV when using dtls by disabling the unclean shutdown flag
1329509-2	4-Minor	BT1329509	TCL error 'ERR_VAL (line 1) invoked from within "HTTP::path"'.
1326797-3	4-Minor	BT1326797	The Pool State of an offline pool with one or more user-disabled pool members depends on which pool member was marked down last by its monitor (non-deterministic behaviour)
1325045	4-Minor	BT1325045	Nexthop of mirrored flow is not updated when standby becomes active
1322117-3	4-Minor	BT1322117	FastL4 TCP PVA accelerated connection might not be cleared until idle timeout.
1318377-3	4-Minor	BT1318377	TMM memory leak when using http+fastl4 profile with 'rtt-from-client/rtt-from-server' enabled.
1314597-2	4-Minor	BT1314597	Connection on standby may stay until idle timeout when receiving ICMP error
1304289-2	4-Minor	BT1304289	Pool member monitored by both GTM and LTM monitors may be erroneously marked Down
1297521-2	4-Minor	BT1297521	Full sync failure for traffic-matching-criteria with port list update on existing object in certain conditions
1281405	4-Minor	BT1281405	"fipsutil fwcheck -f" command may not correct result
1269773-3	4-Minor	BT1269773	Convert network-order to host-order for extensions in TLS1.3 certificate request
1238897-3	4-Minor	BT1238897	TMM TCL interpreter's non-TMM "compat" memcasechr broken in 64-bit build
1167609-2	4-Minor	BT1167609	The messages msg->ref > 0 are seen in TMM logs with websockets/ASM plugin
1142225-2	4-Minor	BT1142225	Regular and In-TMM HTTPS monitors advertise different cipher suites with SSL profile is set to None
1138101-2	4-Minor	BT1138101	Tunnel connections might not come up when using pool routes
1124085-4	4-Minor	BT1124085	iRules command [info hostname] does not reflect modified hostname
1121349-2	4-Minor	BT1121349	CPM NFA may stall due to lack of other state transition
1107453	4-Minor	BT1107453	Performance drop observed in some Ramcache::HTTP tests on BIG-IP i10800 platform
1103117-2	4-Minor	BT1103117	iAppLX extension using express with httpserver script leaves lingering client-side flow on HTTP requests.
1093545-4	4-Minor	BT1093545	Attempts to create illegal virtual-server may lead to mcpd crash.
1070141-1	4-Minor	BT1070141	The SNAT Automap and self IP address selection.
1067025-4	4-Minor	BT1067025	Rate-shaping + immediate timeout causing connection to stall.
1064725-4	4-Minor	BT1064725	CHMAN request for tag:19 as failed.
1037153-1	4-Minor	BT1037153	iRule "log" command to remote destinations may cause TMM to leak memory
1035757-4	4-Minor	BT1035757	iRulesLX restart leaves stale files in /var/tmstat/blade/tmplugin_ilx_*
1034865-1	4-Minor	BT1034865	CACHE::enable failed on private/no-store content
1030093-1	4-Minor	BT1030093	An http2 to http2 virtual connection with translate-address disabled might only use one stream on the server side.
1015793-1	4-Minor	BT1015793	Length value returned by TCP::payload is signed and can appear negative
1015117-5	4-Minor	BT1015117	Headers are corrupted during modification/insertion if a mix of end-of-line markers <CRLF> and <LF> are used
1013937-1	4-Minor	BT1013937	In-TMM HTTP and HTTPS monitors require RFC-compliant send strings to work.
1011889-6	4-Minor	BT1011889	The BIG-IP system does not handle DHCPv6 fragmented traffic properly
1004953-5	4-Minor	BT1004953	HTTP does not fall back to HTTP/1.1★
979213-1	5-Cosmetic	BT979213	Spurious spikes are visible in Throughput(bits) and Throughput(packets) performance graphs following a restart of TMM.
926085-2	5-Cosmetic	BT926085	In WebUI node or port monitor test is not possible, but it works in TMSH
897437-7	5-Cosmetic	BT897437	First retransmission might happen after syn-rto-base instead of minimum-rto.
860277-6	5-Cosmetic	BT860277	Default value of TCP Profile Proxy Buffer High Low changed in 14.1
490139-7	5-Cosmetic	BT490139	Loading iRules from file deletes the last few comment lines
1035741-1	5-Cosmetic	BT1035741	Wrong default value for lacp-port-priority.

Performance Issues

ID Number	Severity	Links to More Info	Description
908001-2	2-Critical	BT908001	vCMP guest CPU usage may increase 4-5% after upgrade of vCMP host to v16.1.x★
1063173-2	2-Critical	BT1063173	Blob size consistency after changes to pktclass.
1037617-1	2-Critical	BT1037617	Switching between bare-metal and vCMP modes can leave HSM with poorly deployed accelerator engine counts
475997-2	3-Major	K16687, BT475997	SSL stream throughput slows down when hardware SSL offloading is in use

Global Traffic Manager (DNS) Issues

ID Number	Severity	Links to More Info	Description
940733-5	2-Critical	BT940733	Downgrading a FIPS-enabled BIG-IP system or running big3d_install results in a system halt★
931149-3	2-Critical	BT931149	Some RESOLV::lookup queries, including PTR lookups for RFC1918 addresses, return empty strings
887681-4	2-Critical	BT887681	Tmm SIGSEGV in rrset_array_lock,services/cache/rrset.c
705869-1	2-Critical	BT705869	TMM crashes as a result of repeated loads of the GEOIP database
1322497-2	2-Critical	BT1322497	GTM monitor recv string with special characters causes frequent iquery reconnects
1318625-2	2-Critical	BT1318625	The gtm_add sync configuration is in the unintended direction with large GTM configuration
1267845-3	2-Critical	BT1267845	ISC's internal_current function asserted because ifa_name was NULL
1225061-3	2-Critical	BT1225061	The zxfrd segfault with numerous zone transfers
1212081-2	2-Critical	BT1212081	The zxfrd segfault and restart loop due to incorrect packet processing
1127241-1	2-Critical	BT1127241	AS3 tenants don't sync reliably in GTM sync groups.
1103833-2	2-Critical	BT1103833	Tmm core with SIGSEGV in gtmpoolmbr_UpdateStringProc
1081473-5	2-Critical	BT1081473	GTM/DNS installations may observe the mcpd process crashing
1073273-1	2-Critical	BT1073273	RESOLVER::name_lookup not returning truncated responses
1031945-4	2-Critical	BT1031945	DNS cache configured and tmm stuck in 'not ready' state indefinitely after TMM restart or reboot★
994221-1	3-Major	BT994221	ZoneRunner returns error 'Resolver returned no such record'
990929-2	3-Major	BT990929	Status of GTM monitor instance is constantly flapping
987709-6	3-Major	BT987709	Static target string as CNAME pool member might cause config load failure if wide IP with same name exists in another partition
977625-1	3-Major	BT977625	GTM persistence records linger in tmm
973341-1	3-Major	BT973341	Customized device certs will break scripts relying on /config/httpd/conf/ssl.crt/server.crt
969553-1	3-Major	BT969553	A DNS Cache (or Network DNS Resolver) returns SERVFAIL to some queries.
967737-3	3-Major	BT967737	DNS Express: SOA stops showing up in statistics from second zone transfer
965053-4	3-Major	BT965053	[Regression of ID787881 & ID761032] DNSX fails to sign zone transfer using tsig key after failure
958157-4	3-Major	BT958157	Hash collisions in DNS rapid-response packet processing
936777-1	3-Major	BT936777	Old local config is synced to other devices in the sync group.
936417-4	3-Major	BT936417	DNS/GTM daemon big3d does not accept ECDHE or DHE ciphers
936361-2	3-Major	BT936361	IPv6-based bind (named) views do not work
920817-7	3-Major	BT920817	Wide IP operations performed in quick succession result in missing resource records and out of sync journals.
918693-5	3-Major	BT918693	Wide IP alias validation error during sync or config load
913917-1	3-Major	BT913917	Unable to save UCS
911497-1	3-Major	BT911497	Unbound's backoff algorithm interacts badly with net resolver iRules
911241-8	3-Major	BT911241	The iqsyncer utility leaks memory for large bigip_gtm.conf file when log.gtm.level is set to debug
908829-2	3-Major	BT908829	The iqsyncer utility may not write the core file for system signals
908801-2	3-Major	BT908801	SELinux policies may prevent from iqsh/iqsyncer dumping core
903521-1	3-Major	BT903521	TMM fails to sign responses from BIND when BIND has 'dnssec-enable no'
899253-1	3-Major	BT899253	[GUI] GTM wideip-pool-manage in GUI fails when tens of thousands of pools exist
862949-4	3-Major	BT862949	ZoneRunner GUI is unable to display CAA records
795633-1	3-Major	BT795633	GUI and REST API unable to add virtual servers containing a space in the name to a pool
779185-1	3-Major	BT779185	Forward zone deleted when wideip updated
766593-7	3-Major	BT766593	RESOLV::lookup with bytes array input does not work when length is exactly 4, 16, or 20
222220-8	3-Major	K11931	Distributed application statistics are not passed correctly.
1328857-2	3-Major	BT1328857	GUI error when accessing hyperlink for associated gtm link object on a virtual server
1313369-3	3-Major		Significant performance drop observed for DNS cache validating resolver for responses with indeterminate and insecure validation status
1289313-3	3-Major	BT1289313	Creation of wideip with alias would cause inconsistent zone data across GTM sync group
1281433-2	3-Major	BT1281433	Missing GTM probes on GTM server when an external monitor is attached to an additional pool
1269601-2	3-Major	BT1269601	Unable to delete monitor while updating DNS virtual server monitor through transaction
1250077-4	3-Major	BT1250077	TMM memory leak
1205509-2	3-Major	BT1205509	Region cache fails to update appropriately after referenced region update
1205061-2	3-Major	BT1205061	DNSSEC keys removed from the configuration before expiration date when iQuery connection goes down
1191349-2	3-Major	BT1191349	The dns_cache_derived_stat show corrupted values.
1189877-4	3-Major	BT1189877	The option /dev/random is depreciated from rndc-confgen with the latest BIND 9.16
1162221-2	3-Major	BT1162221	Probing decision will skip local GTM upon reboot if net interface is not brought up soon enough
1161241-5	3-Major	BT1161241	BIND default behavior changed from 9.11 to 9.16
1154313-2	3-Major	BT1154313	TMM crash due to rrsets structure corruption
1142153-2	3-Major	BT1142153	DNS Resource Records for Wide IPs are potentially misleading when creating or deleting a large number of Wide IPs
1137569-3	3-Major	BT1137569	Set nShield HSM environment variable.
1137217-2	3-Major	BT1137217	DNS profile fails to set TC flag for responses containing RRSIG algorithm 13
1133201-1	3-Major	BT1133201	Disabling a GTM pool member results in the same virtual server no longer being monitored in other pools
1127805-2	3-Major	BT1127805	Server.crt containing "<" will cause frequent reconnects between local gtmd and big3d
1124217-1	3-Major	BT1124217	Big3d cores on CTCPSocket::TCPReceive and connector
1116513-1	3-Major	BT1116513	Route-domains should not be allowed on name server addresses via the GUI.
1112089-1	3-Major	BT1112089	Prevent zrd from rolling back named.conf file in wrong situations
1111361-3	3-Major	BT1111361	Refreshing DNS wide IP pool statistics returns an error
1108557-1	3-Major	BT1108557	DNS NOTIFY with TSIG is failing due to un-matched TSIG name
1103477-3	3-Major	BT1103477	Refreshing pool member statistics results in error while processing requests
1100197-2	3-Major	BT1100197	GTM sends wrong commit_id originator for iqsyncer to do gtm group sync
1100169-1	3-Major	BT1100169	GTM iQuery connections may be reset after SSL key renegotiation.
1096165-4	3-Major	BT1096165	Tmm cored for accessing the pool after the gtm_add command is run
1094069-1	3-Major	BT1094069	iqsyncer will get stuck in a failed state when requesting a commit_id that is not on the target GTM
1083405-3	3-Major	BT1083405	"Error connecting to named socket" from zrd
1082197-1	3-Major	BT1082197	RNAME and MNAME field order reversed for Synthetic SOAs sent for negative response
1075469-1	3-Major	BT1075469	DNS GUI: Refreshing a DNS Express record sometimes fails to populate the server.
1073673-1	3-Major	BT1073673	Prevent possible early exit from persist sync
1070953-4	3-Major	BT1070953	Dnssec zone transfer could cause numerous gtm sync events.
1067309-1	3-Major	BT1067309	GTMD cored followed by TMM core SIGSEGV due to illegal GTM server reference.
1066397-1	3-Major	BT1066397	GTM persists to last resort pool members even when primary pool members become available.
1064205-1	3-Major	BT1064205	GSLB virtual server's status can't be changed from the drop-down selection box on its properties page.
1063829-1	3-Major	BT1063829	Zxfrd could run out of memory because zone db files are not efficiently recycled.
1055077-1	3-Major	BT1055077	Modifying the datacenter does not check GTM server configuration for prober-pool.
1051125-1	3-Major	BT1051125	GTM marks virtual servers offline even when LTM virtual servers are available.
1050661-1	3-Major	BT1050661	Warning message with UDP on DOH server side.
1044873-1	3-Major	BT1044873	Deleted GTM link is not removed from virtual server object and causes load failure.
1041889-2	3-Major	BT1041889	RRSIG missing for CNAME with RDATA in different zone
1041657-1	3-Major	BT1041657	PEM and Analytics tabs are displayed when accessing DoH Proxy/Server profiles.
1041625-5	3-Major	BT1041625	Virtual server flapping when the active and standby devices have different configuration.
1040153-1	3-Major	BT1040153	Topology region returns narrowest scope netmask without matching
1030237-1	3-Major	BT1030237	Zxfrd core and continual restart when out of configured space
1026621-1	3-Major	BT1026621	DNS cache resolver could not connect to remote DNS server with snatpool if multiple routes exist
1024905-1	3-Major	BT1024905	GTM monitor times out if monitoring a virtual server with translation address
1024553-1	3-Major	BT1024553	GTM Pool member set to monitor type "none" results in big3d: timed out
1012061-1	3-Major	BT1012061	Link Controller auto-discovery does not remove deleted virtual servers
1003233-2	3-Major	BT1003233	SNMP Polling can cause inconsistencies in gtm link stats.
1001101-1	3-Major	BT1001101	Cannot update/display GTM/DNS listener route advertisement correctly
996261-1	4-Minor	BT996261	Zrd in restart loop with empty named.conf
995369-1	4-Minor	BT995369	DNSSEC manual key created with other algorithms ends up using RSA/SHA1 algorithm
959613-1	4-Minor	BT959613	Double-monitoring a generic-host virtual server might show blank 'Reason'
947217-6	4-Minor	BT947217	Fix of ID722682 prevents GTM config load when the virtual server name contains a colon★
886145-1	4-Minor	BT886145	The 'Reconnect' and 'Reconnect All' buttons do not work if reached via a particular section of the DNS GUI.
882933-1	4-Minor	BT882933	Nslookup might generate a core during system restart
839361-7	4-Minor	BT839361	iRule 'drop' command does not drop packets when used in DNS_RESPONSE
708680-4	4-Minor	BT708680	TMUI is unable to change the Alias Address of DNS/GTM Monitors
464708-3	4-Minor	BT464708	DNS logging does not support Splunk format log
1311169-3	4-Minor		DNSSEC response is not signed when failure-rcode-response is enabled and no record is returned
1295565-3	4-Minor	BT1295565	BIG-IP DNS not identified in show gtm iquery for local IP
1186789-2	4-Minor	BT1186789	DNSSEC keys stored on an internal FIPS card do not work after upgrading to versions >= 16.x
1128405-3	4-Minor	BT1128405	DNS overall Request/Second counter can be inaccurate
1125161-2	4-Minor	BT1125161	Wideip fails to display or delete in the Link Controller GUI.
1121937-4	4-Minor	BT1121937	ZoneRunner GUI is unable to display CAA records with "Property Value" set to ";"
1067821-1	4-Minor	BT1067821	Stats allocated_used for region inside zxfrd is overflowed
1026813-7	4-Minor	BT1026813	LCD IP address is missing from /etc/hosts on iSeries
1014761-2	4-Minor	BT1014761	[DNS][GUI] Not able to enable/disable pool member from pool member property page
1008233-1	4-Minor	BT1008233	The gtm_add command fails but reports no error
1274385-3	5-Cosmetic	BT1274385	BIGIP-DNS GUI delivery summary stats shows incorrect count for "Disabled" GTM listeners
1225941-2	5-Cosmetic	BT1225941	OLH Default Values on Notification and Early Retransmit Settings
1122153-4	5-Cosmetic	BT1122153	Zonerunner GUI displaying incorrect error string "RRSig Covers Unsupported Record Type"
1053605-2	5-Cosmetic	BT1053605	When you use NAT, the iQuery status displays 'BIGIP' instead of 'BIGIP-DNS'.

Application Security Manager Issues

ID Number	Severity	Links to More Info	Description
890037-3	2-Critical	BT890037	Rare BD process core
887621-4	2-Critical	BT887621	ASM virtual server names configuration CRC collision is possible
1325145-2	2-Critical	BT1325145	SSRF DNS Lookup can cause memory leak
1282281-3	2-Critical	BT1282281	Roll forward upgrade fails with policy that has unapplied changes and Threat Campaigns
1217549-3	2-Critical	BT1217549	Missed ASM Sync on startup
1050089-5	2-Critical		TMM crash in certain cases
987453-3	3-Major		Bot Defense browser verification fails upon iframes of different top-level domains
974513-7	3-Major	BT974513	Dropped requests are reported as blocked in Reporting/charts
966613-6	3-Major	BT966613	Cannot create XML profile based on WSDL when wsdl contains empty soap:address – getting error ‘Column 'object_uri' cannot be null’
959965-1	3-Major		Asmlogd stops deleting old protobufs
959957-1	3-Major	BT959957	Asmlogd stops deleting old protobufs
943441-4	3-Major	BT943441	Issues in verification of Bot Defense with F5 Anti-Bot Mobile SDK
932193-1	3-Major	BT932193	Improper handling of multiple cookie headers results in security bypass
919917-5	3-Major	BT919917	File permission errors during bot-signature installation
902445-3	3-Major	BT902445	ASM Policy Event Logging stops working after 'No space in shmem' error disconnection mitigation
1348425-3	3-Major		Header name or parameter name is configured with space.
1346461-3	3-Major		Bd crash at some cases
1329557-2	3-Major	BT1329557	The Attack Types and Violations reported in the incident do not match the incident subtype
1329065	3-Major	BT1329065	Hostname violation when hostname starts with multiple 0's
1328573	3-Major	BT1328573	Illegal repeated header violation is not enforced for cookie header
1324777-1	3-Major	BT1324777	The get_file_from_link in F5::Utils::File should support HTTPS links also when proxy.host DB key is configured
1316529-3	3-Major		Upgrade from BIG-IP version 14.0.0 to 17.1.0 fails with hidden DOS
1302925-2	3-Major	BT1302925	Failed to load detected bots list , when you clicked on Bot Category
1302689-3	3-Major	BT1302689	ASM requests to rechunk payload
1301197-3	3-Major	BT1301197	Bot Profile screen does not load and display large number of pools/members
1298161-2	3-Major		Ts_cookie_add_attrs is not effective with cookies that have non-root path or domain attribute
1295057-3	3-Major	BT1295057	Installation of Attack Signatures file reported as fail after 1 hour
1295009-1	3-Major	BT1295009	"JSON data does not comply with JSON schema" violation is raised when concurrent requests occur with same JSON data
1292685-2	3-Major	BT1292685	The date-time RegExp pattern through swagger would not cover all valid options
1288517-2	3-Major	BT1288517	Item filter does not work on /mgmt/tm/asm/tasks/export-suggestions/
1284073-3	3-Major		Cookies are truncated when number of cookies exceed "max_enforced_cookies"
1281397-1	3-Major		SMTP requests are dropped by ASM under certain conditions
1281389-1	3-Major	BT1281389	Bot Defense can crash when using SMTP security profile
1280813-1	3-Major		Illegal URL violation triggered for after upgrade due to due to missing content-profiles in DB
1271469-3	3-Major	BT1271469	Failed to install ASU file scheduled for install
1270133-3	3-Major		bd crash during configuration update
1245221-1	3-Major	BT1245221	ASM Policy IP Intelligence configuration does not seem to synchronize when the device group is set to automatic sync
1239297-2	3-Major	BT1239297	TMM URL web scraping limit not synced to secondary slot 2 in VIPRION chassis
1235337-1	3-Major	BT1235337	The 'JSON profile' with 'JSON schema validation' was not created for the body parameter in the OpenAPI URL
1231697	3-Major	BT1231697	Configuration to ignore “URI Parameters” in the A10 category is not retained during upgrade from 16.1.x to higher versions.
1231137-3	3-Major	BT1231137	During signature update, Bot signature from one user partition affecting the Bot profile created in another Partition
1229813-2	3-Major	BT1229813	The ref schema handling fails with oneOf/anyOf
1211905-2	3-Major	BT1211905	Error occurs when importing ASM Policy in XML format with element "violation_ratings_counts"
1210321-1	3-Major	BT1210321	Parameters are not created for properties defined in multipart request body when URL include path parameter
1207793-1	3-Major	BT1207793	Bracket expression in JSON schema pattern does not work with non basic latin characters
1136833-2	3-Major	BT1136833	Unparseable request content subviolation override cannot be configured on microservices
1134441-2	3-Major	BT1134441	Inactive policy synced to peer results ASM removed from virtual server only for sync-only DG
1123157-3	3-Major		Single-page application AJAX does not work properly with page's navigation
1081285-1	3-Major	BT1081285	ASM::disable iRule command causes HTTP2 RST_STREAM response when MRF is enabled
1069441-3	3-Major	BT1069441	Cookie without '=' sign does not generate rfc violation
1069137-2	3-Major	BT1069137	Missing AWAF sync diagnostics
1069113-1	3-Major	BT1069113	ASM process watchdog should be less aggressive
1065681-1	3-Major	BT1065681	Sensitive data is not masked under certain conditions.
1062105-3	3-Major	BT1062105	For specific configurations (Auto-Added Signature Accuracy and Case Sensitive parent policy), child security policy fails to create.
1057557-5	3-Major	BT1057557	Exported policy has greater-than sign '>' not escaped to '>' with response_html_code tag.
1051589-1	3-Major		Missing configuration after upgrade★
1039361-1	3-Major	BT1039361	[GraphQL] In case of more than one malformed violation, the first is reported multiple times
1038689-3	3-Major		"Mandatory request body is missing" violation should trigger for "act as a POST" methods only
1036969-1	3-Major	BT1036969	Chrome sometimes ignores cross-site bot-defense cookies
1033025-4	3-Major	BT1033025	TMM might crash when unsupported bot iRule is used
1031461-2	3-Major		Session awareness entries aren't mirrored to both sides of an active-active deployment.
1029373-4	3-Major	BT1029373	Firefox 88+ raising Suspicious browser violations with bot defense
1028493-1	3-Major	BT1028493	Live Update genesis file for Server Technologies installation fails
1023229-1	3-Major	BT1023229	False negative on specific authentication header issue
1021609-1	3-Major	BT1021609	Improve matching of URLs with specific characters to a policy.
1020149-4	3-Major	BT1020149	Bot Defense does not support iOS's WKWebView framework
1017261-7	3-Major	BT1017261	Configuraton update triggers from MCP to ASM are ignored
994013-1	4-Minor	BT994013	Modifying bot defense allow list via replace-all-with fails with match-order error
991765-3	4-Minor	BT991765	Inheritance of staging_period_in_days from policy template
987977-3	4-Minor	BT987977	VIOL_HTTP_RESPONSE_STATUS is set in violation_details of remote logging message even if ALM/BLK flags are disabled for the violation
984521-4	4-Minor	BT984521	Accept-Encoding header is stripped by Bot Defense profile in case of incompatible file extension and a dot in the file name
984449-2	4-Minor	BT984449	Unnecessary swagger validation violation may raise due to behavioral WAF parameter traps that have identical name
950953-3	4-Minor	BT950953	Browser Challenges update file cannot be installed after upgrade★
911729-4	4-Minor	BT911729	Redundant learning suggestion to set a Maximum Length when parameter is already at that value
882729-5	4-Minor	BT882729	Applied Blocking Masks discrepancy between local/remote event log
807569-3	4-Minor	BT807569	Requests fail to load when backend server overrides request cookies and Bot Defense is used
757486-2	4-Minor	BT757486	Errors in IE11 console appearing with Bot Defense profile
1348945	4-Minor	BT1348945	BD core is seen while setting "likely_false_positive_mode"
1330473-2	4-Minor		Response_log_rate_limit is not applied
1311253-3	4-Minor		Set-Cookie header has no value (cookie-string) in server-side, due to asm.strip_asm_cookies
1308393-2	4-Minor	BT1308393	Export security policy XML format fail with "too large and cannot be exported" message
1300665-3	4-Minor	BT1300665	ASMCSD memory leak if tsconfd.loglevel is set for debug level
1293261-3	4-Minor	BT1293261	Subviolations (e.g., IP in host header violation) are not reported to the policy builder
1232649-1	4-Minor		Unterminated POST requests never close and consume UMU buffers
1230833-2	4-Minor		In the signature advanced mode, the Update button is kept disabled even after some changes in the rule
1225677-2	4-Minor	BT1225677	Challenge Failure Reason is not functioning in ASM remote logging
1211437-2	4-Minor		When mobile cookie is too long, Anti-Bot SDK is failing
1210569-3	4-Minor		User defined signature rule disappears when using high ASCII in rule
1210053-1	4-Minor		The cred_stuffing_fail_open Internal Parameter does not cause Leaked Credential violation in case of expiration or error
1181833-2	4-Minor	BT1181833	Content is not updating under respective tab of webUI when CSRF enabled
1154725-4	4-Minor		Custom or predefined method is not changing the behavior while changing from GET to POST method
1137245-1	4-Minor	BT1137245	Issue with injected javascript can cause an error in the browser.
1132705-3	4-Minor		Failed on insert entry to DCC.ACCOUNT_LOGIN_OBJECT_ATTRIBUTES
1120529-1	4-Minor	BT1120529	Illegal internal request in multipart batch request
1097853-1	4-Minor	BT1097853	Session Tracking screen may be missing the scroll bar after saving the configuration
1087005-2	4-Minor	BT1087005	Application charset may be ignored when using Bot Defense Browser Verification
1076165-1	4-Minor	BT1076165	GRPC traffic does not work with DoSL7.
1067917-1	4-Minor	BT1067917	Attaching iRule DOSL7::enable when mitigation is not enabled at dosl7 profile, it is not showing warning in GUI.
1059421-4	4-Minor		Bot Signature is not updated when the signature rule is updated.
1058665-1	4-Minor		Bot signature with a semicolon followed by a space is not detected.
1057713-2	4-Minor		"South Sudan" is missing from the ASM Geolocation Enforcement list.
1048617-3	4-Minor		Nice level BigDB paramter is not applied for BD
1017149-1	4-Minor		User-defined bot sigs that are created in tmsh don't overlap staged factory bot sigs
1005309-4	4-Minor	BT1005309	Additional Tcl variables showing information from the AntiBot Mobile SDK
1005181-4	4-Minor	BT1005181	Bot Defense Logs indicate the mobile debugger is used even when it is not
1004801-2	4-Minor	BT1004801	In the violation details for Max Parameter Protocol Compliance, the incorrect number of parameters is shown.
1229861-2	5-Cosmetic	BT1229861	Signature rule : regex "i" modifier should be translated into "nocase", instead of prepending "(?i)"
1048989-2	5-Cosmetic	BT1048989	Slight correction of button titles in the Data Guard Protection Enforcement
1030129-4	5-Cosmetic	BT1030129	iHealth unnecessarily flags qkview for H701182 with mcp_module.xml

Application Visibility and Reporting Issues

ID Number	Severity	Links to More Info	Description
949593-5	3-Major	BT949593	Unable to load config if AVR widgets were created under '[All]' partition★
939933-7	3-Major	BT939933	Monpd restarts every few seconds due to missing of AVR database
933777-5	3-Major	BT933777	Context use and syntax changes clarification
932189-1	3-Major	BT932189	Incorrect BD Swap Size units on ASM Resources chart
869049-7	3-Major	BT869049	Charts discrepancy in AVR reports
830073-7	3-Major	BT830073	AVRD may core when restarting due to data collection device connection timeout
808801-6	3-Major	BT808801	AVRD crash when configured to send data externally
743826-7	3-Major	BT743826	Incorrect error message: "Can't find pool []: Pool was not found" even though Pool member is defined with port any(0)
1294141-3	3-Major	BT1294141	ASM Resources Reporting graph displays over 1000% CPU usage
1211817	3-Major	BT1211817	AVRD may crash while modifying the global settings
950305-5	4-Minor	BT950305	Analytics data not displayed for Pool Names
915005-3	4-Minor	BT915005	AVR core files have unclear names
910777-1	4-Minor	BT910777	Sending ASM report via AWS SES failed duo to wrong content type
1312045	4-Minor	BT1312045	The graph lines do not match the source translation request value
1311997	4-Minor	BT1311997	Disable the f5_cspm and f5_p words from the AVR cookie disclosure.
1299085	4-Minor	BT1299085	AVR shows Server Latency as 0 for http2 virtual with MRF enabled
1294113-2	4-Minor		During the attack, attack_id=0 is indicated in the AVR attack summary log
930217-1	5-Cosmetic	BT930217	Zone colors in ASM swap usage graph are incorrect

Access Policy Manager Issues

ID Number	Severity	Links to More Info	Description
349706-4	0-Unspecified		NetworkAccess assigns 1.1.1.1 address to remote ppp endpoint APM VPN
1146341-2	1-Blocking	BT1146341	TMM crashes while processing traffic on virtual server
930625-1	2-Critical	BT930625	TMM crash is seen due to double free in SAML flow
831737-3	2-Critical	BT831737	Memory Leak when using Ping Access profile
1325721-3	2-Critical	BT1325721	Oauth not allowed for old tokens after upgrade to 15.1.9
1294529	2-Critical	BT1294529	APM webtop hardening
1282769-2	2-Critical		Localdb user can change the password of other user
1104517-2	2-Critical	BT1104517	In SWG explicit proxy, some TCP connections are reset because of inconsistency between sessionDB and local IP2SessionId map
1083053-2	2-Critical	BT1083053	Apmd memory grows over time in AD auth scenarios
1063261-4	2-Critical	BT1063261	TMM crash is seen due to sso_config objects.
1020881-1	2-Critical	BT1020881	TMM crashes while passing APM traffic.
1007869-1	2-Critical	BT1007869	Upgrade from v14.1.x to v15.1.2.1 or later fails for app-tunnel, RDP and config migration★
984765-2	3-Major	BT984765	APM NTLM auth fails every week with RPC return code 0xC0000022(STATUS_ACCESS_DENIED)★
976553-1	3-Major	BT976553	Portal Access: Chrome/Edge browser: cookie transport: sync XMLHttpRequests should not be used in onbeforeunload handlers
967185	3-Major	BT967185	Increase the size limit of JWT for OAuth
958773-2	3-Major	BT958773	[SAML SP] Assertion canonicalization fails if <AttributeValue> contains spaces.
949477-4	3-Major	BT949477	NTLM RPC exception: Failed to verify checksum of the packet
947613-2	3-Major	BT947613	APM reset after upgrade and modify of LDAP Group Lookup★
942729-3	3-Major		Export of big Access Policy config from GUI can fail
934825-2	3-Major	BT934825	Restarting MCPD via command line may not restart the aced process
903573-3	3-Major	BT903573	AD group cache query performance
903501-3	3-Major	BT903501	VPN Tunnel establishment fails with some ipv6 address
898381-3	3-Major	BT898381	Changing the setting of apm-forwarding-fastl4 profile does not take effect
893801-2	3-Major	BT893801	Launching resources that are published on an APM Webtop from multiple VMWare servers will fail when the Native View client is selected
868557-1	3-Major	BT868557	Unable to initiate SWG database download from Admin UI when management network has no direct internet connectivity.
738716-1	3-Major	BT738716	Add support for "Restart Desktop" setting in View clients, native as well as HTML5 clients
666845-4	3-Major	K08684622, BT666845	Rewrite plugin can accumulate memory used for patching very large files
634576-3	3-Major	K48181045, BT634576	TMM core in per-request policy
527119-9	3-Major	BT527119	An iframe document body might be null after iframe creation in rewritten document.
1350985	3-Major	BT1350985	APM policy sync fails after deleting macro ending
1350273-2	3-Major	BT1350273	Kerberos SSO Failing for Cross Domain After Upgrade from 15.1.8.2 to 15.1.9.1
1345997-2	3-Major	BT1345997	Very large number of custom URLs in SWG can impact performance.
1341849	3-Major	BT1341849	APM- tmm core SIGSEGV in saml artifact usage
1338837	3-Major	BT1338837	[APM][RADIUS] Support Framed-IPv6-Address in RADIUS Accounting STOP message
1328433	3-Major	BT1328433	TMM cores while using VPN with ipv6 configured
1327961-1	3-Major	BT1327961	EAM plugin crashes
1327933-1	3-Major	BT1327933	'tmsh show sys ip-address' command throws 'Syntax Error: Invalid IP address' error when address space is added
1318653	3-Major	BT1318653	Upgrading or failover of APM with lot of access policies takes long time to become "really" active
1318397-2	3-Major	BT1318397	Fails to sign Authentication Request in clientless-mode
1312125	3-Major	BT1312125	MCPD crash on the changes of Device trust sync only group modification
1307441	3-Major	BT1307441	Case APM as SAML IDP does not include all certs from bundle when metadata file is exported
1294381	3-Major	BT1294381	Variable assign handles some error cases disgracefully
1293805	3-Major	BT1293805	Access policies not in Partition Common are not applied in auto discovery process
1293237	3-Major	BT1293237	Page customization of Front image for standard Access profile fails for image uploaded from local disk
1292141-1	3-Major	BT1292141	TMM crash while processing myvpn request
1290937	3-Major	BT1290937	'contentWindow' of a dynamically genereated iframe becomes null
1289009-2	3-Major	BT1289009	PA based Hosted content does not add implicit allowed ACL
1281693	3-Major	BT1281693	Icons displayed on webtop are different from Storefront server when modified
1273881-4	3-Major	BT1273881	TMM crashes while processing traffic on the virtual server
1251157-3	3-Major	BT1251157	Ping Access filter can accumulate connections increasing the memory use
1251061-1	3-Major	BT1251061	apmd core caused by accessing null issuer from JWT
1224377	3-Major	BT1224377	Policy Sync fails for a policy when default-all Address Space assigned to Network Access resource
1217365-3	3-Major	BT1217365	OIDC: larger id_token encoded incorrectly by APM
1211369-1	3-Major	BT1211369	[Validation] Do not allow AD/LDAP object pointing to the same IP:PORT
1211361-1	3-Major	BT1211361	Validate AD/LDAP object names
1210025-1	3-Major	BT1210025	Address list discovery task does not trigger apply access policy automatically
1207821-3	3-Major	BT1207821	APM internal virtual server leaks memory under certain conditions
1200941-2	3-Major	BT1200941	PA version check causes page reloads
1194745	3-Major	BT1194745	The multi-thread use case in LDAP cache reads APMD crash
1191045	3-Major	BT1191045	AD/LDAP queue processing is stuck and being asserted by the session cleaner
1190025-2	3-Major	BT1190025	The OAuth process crash
1188417-2	3-Major	BT1188417	SelfTest/Integrity test failure triggers reboot action
1169105-1	3-Major	BT1169105	Provide download links on BIG-IP for Linux ARM64 VPN Client
1147621-2	3-Major	BT1147621	AD query do not change password does not come into effect when RSA Auth agent used
1145989-2	3-Major	BT1145989	ID token sub-session variables are not populated
1144353	3-Major	BT1144353	After creating a "Dynamic Exclude Address Spaces" or "Dynamic LAN Address Spaces" from inside a Network Access List object fails to redirect back to Network Access List object page
1136905-1	3-Major	BT1136905	Request for Portal Access Hosted Content are RST with "No available SNAT addr"
1124793-1	3-Major	BT1124793	Space inserted for variable assigned in a custom expression in the GUI
1095909-1	3-Major	BT1095909	DEBUG_NOTICE macro truncating log messages of size more than 1024
1091509-3	3-Major	BT1091509	SAML Artifact resolution service fails to resolve artifacts on same IP after reboot
1089685-1	3-Major	BT1089685	[APM]Webtop loading issue when 'oneconnect' profile is attached to a virtual server
1089293	3-Major	BT1089293	Backend password reset is not working in Webtop when sso is disabled.
1071021-1	3-Major	BT1071021	Some URLs such as *cdn.onenote.net configured in the Office 365 dynamic address space are not processed by APM
1058873	3-Major	BT1058873	Configuring source address as "address list" in a virtual server causes APMD to restart
1054677-1	3-Major	BT1054677	Ng_export fails for users with the 'pager' option enabled in their 'cli preference' configuration.
1044457-3	3-Major	BT1044457	APM webtop VPN is no longer working for some users when CodeIntegrity is enabled.
1041989-4	3-Major	BT1041989	APM Portal Access does not add automatically the / after the URL encoded (after the '$$'), Redirect breaks
1022877-3	3-Major	BT1022877	Ping missing from list of Types for OAuth Client
1006509-1	3-Major	BT1006509	TMM memory leak★
996985-1	4-Minor	BT996985	No IP address format validation while adding IP addresses in IPv4 LAN Address Space or IPv4 Exclude Address Space when configuring Network Access Resource.
996977-1	4-Minor	BT996977	No IP address format validation while adding IP addresses in IPv6 LAN Address Space or IPv6 Exclude Address Space when configuring Network Access Resource.
963129-3	4-Minor	BT963129	RADIUS Accounting Stop message fails via layered virtual server
937665-1	4-Minor	BT937665	Relaystate in SLO request results in two Relaystates in SLO Response
936061-3	4-Minor	BT936061	Variable session.user.agent missing for Edge Client & F5 Access clients
869541-3	4-Minor	BT869541	Series of unexpected <aborted> requests to same URL
547947-2	4-Minor	BT547947	Feeding empty username and password to the Logon Page followed by RadiusAuthAgent shows the session as Logged out
1351493	4-Minor		Invalid JSON node type while support-introspection enabled
1294993	4-Minor	BT1294993	URL Database download logs are not visible after bigip16.0.1.1
1218813-4	4-Minor	BT1218813	"Timeout waiting for TMM to release running semaphore" after running platform_diag
1142389-3	4-Minor	BT1142389	APM UI report displays error "Error Processing log message ..." when the log contains some special character received in client request
1100561	4-Minor	BT1100561	AAA: a trailing ampersand is added to serverside request when using HTTP forms based auth
1050153	4-Minor	BT1050153	Unknown browscap value sent by the client.
1022973-2	4-Minor	BT1022973	Sessiondb entries related to Oauth module not cleaned up in certain conditions
1004845-1	4-Minor	BT1004845	Accessing attribute using attributeNode value does not work with Portal Access
427094-1	5-Cosmetic	BT427094	Accept-language is not respected if there is no session context for page requested.
1234953	5-Cosmetic	BT1234953	Multiple APs requested to apply changes after importing a new AP with HTTP auth agent

WebAccelerator Issues

ID Number	Severity	Links to More Info	Description
941961-4	3-Major	BT941961	Upgrading system using WAM TCP profiles may prevent the configuration from loading

Wan Optimization Manager Issues

ID Number	Severity	Links to More Info	Description
863601-5	2-Critical	BT863601	Panic in TMM due to internal mirroring interactions

Service Provider Issues

ID Number	Severity	Links to More Info	Description
1270497-2	2-Critical	BT1270497	MRF SIP/ALG Core dump observed while accessing trans_data in sipmsg_register_ingress_register_request_session_reply_common method
1268373-4	2-Critical	BT1268373	MRF flow tear down can fill up the hudq causing leaks
917637-5	3-Major	BT917637	Tmm crash with ICAP filter
1307517-2	3-Major		Allow SIP reply with missing FROM
1156149-1	3-Major	BT1156149	Early responses on standby may cause TMM to crash
1008169-1	3-Major	BT1008169	BIG-IP systems disconnect the DIAMETER transport connection if it receives an answer message without a Result-Code AVP
1329477-2	4-Minor	BT1329477	Auto-initialization does not work with certain MRF connection-mode
1294301	4-Minor	BT1294301	Tmm core when freeing pool name
1251013-2	4-Minor	BT1251013	Allow non-RFC compliant URI characters
1249929-3	4-Minor	BT1249929	Diameter MRF sends CER to pool-member even after peer sent DPR and force-offline the pool member
1225797-4	4-Minor	BT1225797	SIP alg inbound_media_reinvite test fails
1184629-2	4-Minor	BT1184629	Validate content length with respective to SIP header offset instead of parser offset

Advanced Firewall Manager Issues

ID Number	Severity	Links to More Info	Description
964989-4	2-Critical	BT964989	AFM DOS half-open does not handle wildcard virtual servers properly.
609878-6	2-Critical	BT609878	Bad ACK Flood is not detected by AFM when loose-init is enabled on the virtual server
1215161-2	2-Critical	BT1215161	A new CLI option introduced to display rule-number for policy, rules and rule-lists
1084133-1	2-Critical	BT1084133	At device level ICMP frags are not counting for BA and BD
1080957-4	2-Critical	BT1080957	TMM Seg fault while Offloading virtual server DOS attack to HW
1067405-3	2-Critical	BT1067405	TMM crash while offloading / programming bad actor connections to hardware.
1061929-2	2-Critical	BT1061929	Unable to perform IPI update (through proxy) after upgrade to 15.1.4.★
1060833-2	2-Critical	BT1060833	After handling a large number of connections with firewall rules that log or report translation fields or server side statistics, TMM may crash.
1058645-2	2-Critical	BT1058645	ipsecalg blocks Sophos ISAKMP negotiation during tunnel setup.
992233-1	3-Major	BT992233	DNS DoS profile (Error Vector) does not mitigate/detect at the virtual server level.
987637-3	3-Major	BT987637	DDoS: Single endpoint flood vectors and Bad destination not supported properly on Neuron hardware
987605-3	3-Major	BT987605	DDoS: ICMP attacks are not hardware-mitigated
984965-4	3-Major	BT984965	While intentionally exiting, sshplugin may invoke functions out of sequence and crash
977449-1	3-Major	BT977449	Total address and Total endpoints is shown as '0' in nat stats
968953-1	3-Major	BT968953	Unnecessary authorization header added in the response for an IP intelligence feed list request
965849-1	3-Major	BT965849	Displayed 'Route Domain ID' value is confusing if it is set to None
955773-3	3-Major	BT955773	Fw_lsn_pool_pba_stat: excessively high active_port_blocks stat for IPv4
935769-5	3-Major	BT935769	Upgrading / Rebooting BIG-IP with huge address-list configuration takes a long time★
926549-3	3-Major	BT926549	AFM rule loops when 'Send to Virtual' is used with Virtual Server iRule 'LB::reselect'
926417-3	3-Major	BT926417	AFM not using the proper FQDN address information
915221-6	3-Major	BT915221	DoS unconditionally logs MCP messages to /var/tmp/mcpd.out
844597-6	3-Major	BT844597	AVR analytics is reporting null domain name for a dns query
1325681-2	3-Major	BT1325681	VLAN tscookies with fastl4 timestamp preserve and PVA acceleration cause connection problems.
1311561-1	3-Major		Unable to add Geo regions with spaces into blacklist, Error: invalid on shun entry adding
1307697-1	3-Major	BT1307697	IPI not working on a new device - 401 invalid device error from BrightCloud
1199025-2	3-Major	BT1199025	DNS vectors auto-threshold events are not seen in webUI
1196053-3	3-Major	BT1196053	The autodosd log file is not truncating when it rotates
1137133-2	3-Major	BT1137133	Stats rate is showing incorrect data for broadcast, multicast and arp flood vectors
1132449-2	3-Major	BT1132449	Incomplete or missing IPv6 IPI database results to connection reset and/or high TMM CPU usage
1101653-2	3-Major	BT1101653	Query Type Filter in DNS Security Profile blocks allowed query types
1079985-3	3-Major	BT1079985	int_drops_rate shows an incorrect value
1079053-1	3-Major	BT1079053	SSH Proxy feature is not working in FIPS Licensed platforms
1076477-2	3-Major	BT1076477	AFM allows deletion of a firewall policy even if it's being used in a route domain.
1057061-2	3-Major	BT1057061	BIG-IP Virtual Edition + security-log-profile (HSL) performance issue with Log Translation Fields.
1053949-3	3-Major	BT1053949	AFM SSH proxy offering weak ciphers, the ciphers must be removed
1047933-1	3-Major	BT1047933	Virtual server security policy - An error has occurred while trying to process your request
1045065-3	3-Major	BT1045065	Enable traffic group modification in source-translation object
1042153-2	3-Major	BT1042153	AFM TCP connection issues when tscookie-vlans enabled on server/client side VLAN.
1032329-1	3-Major	BT1032329	A user with low privileges cannot open the Rule List editor.
1031909-2	3-Major	BT1031909	NAT policies page unusable due to the page load time
1022613-1	3-Major	BT1022613	Cannot modify Security "global-network" Logging Profile
1019557-1	3-Major	BT1019557	Bdosd does not create /var/bdosd/*.json
1019453-1	3-Major	BT1019453	Core generated for autodosd daemon when synchronization process is terminated
1012413-1	3-Major	BT1012413	Tmm performance impact for DDoS vector on virtual server when hardware mitigation is enabled
981145-1	4-Minor	BT981145	DoS events do not include the attack name for "tcp syn ack flood"
967245-1	4-Minor		Incorrect SPVA counter incremented during Sweep attack on profile
926425-4	4-Minor	BT926425	Hardware SYN Cookies may not deactivate after the SYN attack ends and valid TCP traffic starts
1302869	4-Minor	BT1302869	AFM is not accounting Nxdomain attack for TCP query
1277641-1	4-Minor	BT1277641	DoS | i-series | After mitigation of bad destination at profile level, bd_hit is not incrementing for host unreachable vector.
1273225	4-Minor	BT1273225	Remove DNS Malformed vector at virtual server Level
1251105-2	4-Minor	BT1251105	DoS Overview (non-HTTP) - A null pointer was passed into a function
1167953-2	4-Minor	BT1167953	Issue with UI, while opening rule name in Packet Tester to check the rule for the drop reason
1162661-3	4-Minor	BT1162661	The Bad Actor (BA) hit counter is not updating for ICMP vector during hardware mitigation
1144417	4-Minor	BT1144417	DoS WL allowed in BIG-IP version 16.1.x if it was configured in a previous version 15.1.x
1123189-2	4-Minor	BT1123189	De-Provisioning AFM does not disable SYN-ACK cookie generation
1084901-1	4-Minor	BT1084901	Updating the firewall rule list for IPv6 with route domain throws an error in the GUI, works from tmsh
1063681-2	4-Minor	BT1063681	PCCD cored, SIGSEGV in pc::cfg::CMessageProcessor::modify_fqdn.
1052317-3	4-Minor	BT1052317	The BIG-IP system does not output the show security nat source-translation command.
1033021-2	4-Minor	BT1033021	UI: Partition does not work when clicking through security zones
1022213-4	4-Minor		DDOS: BDOS: Warning messages related to high availability (HA) watchdog seen on system bring up

Policy Enforcement Manager Issues

ID Number	Severity	Links to More Info	Description
829657-5	2-Critical	BT829657	Possible TMM crash with a multi-IP PEM subscriber configured with more than 16 IP addresses
1312145-1	2-Critical	BT1312145	Bcdatabase file gets truncated, deleted and re-downloaded in a loop
1019481-1	2-Critical	BT1019481	Unable to provision PEM on VELOS platform
924589-3	3-Major	BT924589	PEM ephemeral listeners with source-address-translation may not count subscriber data
1302677-4	3-Major	BT1302677	Memory leak in PEM when Policy is queried via TCL
1267269-1	3-Major	BT1267269	The wr_urldbd crashes and generates a core file
1231001-2	3-Major	BT1231001	PEM flow-term-on-sess-delete can cause cores
1015501-3	3-Major	BT1015501	Changes to DHCP Profile are not used by tmm

Carrier-Grade NAT Issues

ID Number	Severity	Links to More Info	Description
751719-5	2-Critical	BT751719	UDP::hold/UDP::release does not work correctly
994985-3	3-Major	BT994985	CGNAT GUI shows blank page when applying SIP profile
1183877-2	3-Major	BT1183877	CGNAT related links are unavailable in Statistics section
1096317-4	3-Major	BT1096317	SIP msg alg zombie flows
1023461-2	3-Major	BT1023461	Multiple entries for CGNAT when PBA pools allocation is defined: for each request, a new entry is created
1317773-3	4-Minor	BT1317773	CGNAT / AFM NAT: "Clients Using Max Port Blocks" counter might be inaccurate
1128429-5	4-Minor	BT1128429	Rebooting one or more blades at different times may cause traffic imbalance results High CPU
1034009-4	4-Minor	BT1034009	CGNAT+Subscriber Discovery - NAT IP with wrong route domain on the CGNAT Log

Fraud Protection Services Issues

ID Number	Severity	Links to More Info	Description
1075545	3-Major	BT1075545	Changing the datasyncd activation-epoch results in high CPU usage for 24 hours
1060393-1	3-Major	BT1060393	Extended high CPU usage caused by JavaScript Obfuscator.
1016481-1	3-Major	BT1016481	Special JSON characters in Dom Signatures breaks configuration

Anomaly Detection Services Issues

ID Number	Severity	Links to More Info	Description
1046469-1	3-Major	BT1046469	Memory leak during large attack
1010717-1	3-Major	BT1010717	Default DoS profile creation from tmsh is incorrectly interpreted by DoS profile GUI

Traffic Classification Engine Issues

ID Number	Severity	Links to More Info	Description
901041	2-Critical	BT901041	CEC update using incorrect method of determining number of blades in VIPRION chassis★
984657	3-Major	BT984657	Sysdb variable not working from tmsh
1184853-3	3-Major		Youtube video not classified in the BIG-IP version 16.1.0
1058349-3	3-Major		Requirement of new signatures to detect IMO and Google Duo service.
941773-1	4-Minor	BT941773	Video resolution mis-prediction
941765-1	4-Minor	BT941765	Video resolution mis-predictions
1144329-4	4-Minor	BT1144329	Traffic Intel does not classify Microsoft app properly
1136893-2	4-Minor	BT1136893	Youtube classification fails
1103245	4-Minor	BT1103245	Policies not being applied

Device Management Issues

ID Number	Severity	Links to More Info	Description
663754-1	2-Critical	BT663754	Modifying the default management port can break internal functionality
996129-3	3-Major	BT996129	The /var partition is full as cleanup of files on secondary is not executing
985329-2	3-Major	BT985329	Saving UCS takes longer when iControl LX extension is installed
880565-5	3-Major	BT880565	Audit Log: "cmd_data=list cm device recursive" is been generated continuously
717174-5	3-Major	BT717174	WebUI shows error: Error getting auth token from login provider★
563144-2	3-Major	BT563144	Changing the system's admin user causes many errors in the REST framework.
999085-1	4-Minor	BT999085	REST endpoint registration errors in restjavad logs
1041113	4-Minor	BT1041113	BIG-IP Admin role credentials are not usable for getting device discovered by BIG-IQ

iApp Technology Issues

ID Number	Severity	Links to More Info	Description
842193-6	3-Major	BT842193	Scriptd coring while running f5.automated_backup script
1091505	3-Major	BT1091505	In AGC 8.0 you cannot choose from existing SSL profiles

Protocol Inspection Issues

ID Number	Severity	Links to More Info	Description
989529-1	3-Major	BT989529	AFM IPS engine takes action on unspecified services
778225-6	3-Major	BT778225	vCMP guests don't have the f5_api_com key and certificate installed when licensed by vCMP host
1307385-2	3-Major	BT1307385	When blade replacement happens, signature config is lost in bigip.conf when IM is loading on a new blade
1256809-2	3-Major	BT1256809	The tmctl statistics for IPS library table shows unloaded.
1075001-2	3-Major	BT1075001	Types 64-65 in IPS Compliance 'Unknown Resource Record Type'
1013777-4	3-Major	BT1013777	An error is encountered when enabling reset-learning to all the signatures of a protocol inspection profile in the GUI.
1011133	3-Major	BT1011133	Protocol Inspection compliance check 10208 gtp_disallowed_message_types does not take GTP version into account
1182305-2	4-Minor	BT1182305	Descriptions requested for IPS IDs

Guided Configuration Issues

ID Number	Severity	Links to More Info	Description
991829-1	3-Major		Continuous connection refused errors in restjavad
982801-2	3-Major	BT982801	AGC hardening

In-tmm monitors Issues

ID Number	Severity	Links to More Info	Description
1287045-3	3-Major	BT1287045	In-TMM monitor may mark pool member offline despite its response matches Receive Disable String
1211985-4	3-Major	BT1211985	BIG-IP delays marking Nodes or Pool Members down that use In-TMM monitoring
1019261-1	3-Major	BT1019261	In-TMM HTTPS monitor with SSL Profile set to None does not use serverssl profile.
1002345-4	3-Major	BT1002345	Transparent DNS monitor does not work after upgrade★
788257-5	4-Minor	BT788257	Bigd.mgmtroutecheck setting ignored by in-tmm monitors after bigstart restart

SSL Orchestrator Issues

ID Number	Severity	Links to More Info	Description
1253621-1	2-Critical	BT1253621	Remote logging SSL Orchestrator Audit logs when running in the Appliance mode
1303185-4	3-Major	BT1303185	Large numbers of URLs in url-db can cause TMM to restart
1289417	3-Major	BT1289417	SSL Orchestrator SEGV TMM core
1294709-1	4-Minor	BT1294709	SSL Orchestrator ICAP service changes do not propagate to TMSH (GUI/CLI)
1270849	5-Cosmetic	BT1270849	SSL Orchestrator enables "Bypass on Handshake Alert" and "Bypass on Client Certificate Failure" for Client SSL profiles

 

Known Issue details for BIG-IP v16.1.x

999709-6 : iRule 'pool'/'virtual' commands not triggered in CLIENT_ACCEPTED with HTTP/2.

Links to More Info: BT999709

Component: Local Traffic Manager

Symptoms:
The 'pool'/'virtual' iRule commands cause the specified pool to be used directly. However, with HTTP/2, the 'pool'/'virtual' command may fail to execute within the CLIENT_ACCEPTED event. This results in no traffic being sent.

Conditions:
-- A 'pool'/'virtual' command is used under CLIENT_ACCEPTED event.
-- An HTTP/2 profile applied to virtual server.
-- The HTTP/2 protocol in use.
-- HTTP/2 Message Routing is disabled.

Impact:
With HTTP/2 configured, the iRule 'pool'/'virtual' commands fail to execute within the CLIENT_ACCEPTED event, causing no traffic to be sent to the desired pool/virtual.

Workaround:
As a workaround, you may use HTTP_REQUEST event instead of CLIENT_ACCEPTED in iRule syntax.

---

999669-1 : Some HTTPS monitors are failing after upgrade when config has different SSL option★

Links to More Info: BT999669

Component: Local Traffic Manager

Symptoms:
Some HTTPS monitors are failing after upgrade when the config has different SSL option properties for different monitors.

Conditions:
-- Individual SSL profiles exist for different HTTPS monitors with SSL parameters.
-- A unique server SSL profile is configured for each HTTP monitor (one with cert/key, one without).

Impact:
Some HTTPS monitors fail. Pool is down. Virtual server is down.

Workaround:
None

---

999085-1 : REST endpoint registration errors in restjavad logs

Links to More Info: BT999085

Component: Device Management

Symptoms:
Errors are logged to /var/log/restjavad.0.log at the SEVERE log level:

[SEVERE]... [IcrWorker] Unable to register iControl endpoint "/xxxx/xxxx". Error: uriPath '/tm/xxxx/xxxx' already registered

Conditions:
The system reports these errors during startup of the restjavad service because of multiple registrations of the same endpoint.

Impact:
There is no functional impact and these errors can be ignored.

Workaround:
None

---

999021-2 : IPsec IKEv1 tunnels fail after a config sync from Standby to Active

Links to More Info: BT999021

Component: TMOS

Symptoms:
When racoon (the IKEv1 daemon) sees a tunnel config change, which occurs due to a config sync from the standby device, the change causes tmm and racoon to have conflicting views on the state of that tunnel.

If the IKEv1 tunnel is up at the time of the config change, tmm fails to restart the tunnel.

Conditions:
-- IPsec IKEv1 tunnel in use.
-- Changes made to IPsec IKEv1 tunnel on the Standby BIG-IP device, which are then sync'd to the Active BIG-IP device.
-- And/or a full config sync from the Standby to Active BIG-IP system.

Impact:
IPsec IKEv1 tunnels fail and do not start again.

Workaround:
-- Do not make changes to IPsec IKEv1 tunnels on the Standby device.

-- Avoid full syncs from Standby to Active.

How to recover when the problem occurs:

-- Disable the affected ike-peer and re-enable it.

---

998957-1 : MCPD consumes excessive CPU while collecting statistics

Links to More Info: BT998957

Component: TMOS

Symptoms:
MCPD CPU utilization is 100%.

Conditions:
This condition can occur when the BIG-IP system has a large number of virtual servers, pools, and pool members for which statistics are being collected. The CPU impact is proportional to the number of objects configured. It appears unlikely to see a significant impact when under 1000 objects.

Impact:
CPU utilization by MCPD is excessive.

Workaround:
None

---

998649-1 : Hostnames that contain a period are logged incorrectly

Links to More Info: BT998649

Component: TMOS

Symptoms:
Sylog-ng uses the hostname (machine name) and truncates it starting at the first '.' (period). This results in hostnames that contain a period being logged incorrectly (for example, 'my.hostname' is logged as 'my' by syslog-ng).
Additionally, hostnames are being truncated in bootmarker logs and the ltm, apm, apm, ipsec, saas, and fw_log that are sourced from TMM.

Three sub-bugs BZ1076909, BZ1076921, BZ1080317 are created and BZ998649 is the base bug for tracking the above three issues.

Conditions:
Hostname contains a period '.' (For example 'my.hostname').

Impact:
Some logs that go directly to syslog-ng use a truncated hostname. Logs sourced from TMM uses truncated hostname.

Workaround:
None.

---

998253-4 : SNI configuration is not sent via HTTPS when in-tmm monitors are disabled

Links to More Info: BT998253

Component: Local Traffic Manager

Symptoms:
The Server Name Indication (SNI) extension is missing on the HTTPS handshake.

Conditions:
-- Global in-tmm monitors are disabled
-- HTTPS monitor traffic

Impact:
The HTTPS client-server handshake occurs without a TLS SNI.

Workaround:
None

---

997793-3 : Error log: Failed to reset strict operations; disconnecting from mcpd★

Links to More Info: K34172543, BT997793

Component: TMOS

Symptoms:
After rebooting the device you are unable to access the GUI. When checking the LTM logs in the SSH/console, it repeatedly prompts an error: tmm crash.

Failed to reset strict operations; disconnecting from mcpd.

Conditions:
-- APM provisioned.
-- Previous EPSEC packages that are still residing on the system from earlier BIG-IP versions are installed upon boot.

Impact:
Mcpd fails to fully load and the device fails to come up fully, and it cannot pass traffic.

An internal timer might cause the installation to be aborted and all daemons to be restarted through bigstart restart. Traffic is disrupted while tmm restarts.

Workaround:
You can recover by restarting the services. Traffic will be disrupted while tmm restarts:

1. Stop the overdog daemon first by issuing the command:
   systemctl stop overdog.

2. Restart all services by issuing the command:
   bigstart restart.

3. Wait for 10 to 20 mins until EPSEC packages are successfully installed and mcpd successfully starts.

4. Start the overdog daemon after the system is online
   systemctl start overdog.

---

997561-5 : TMM CPU imbalance with GRE/TB and GRE/MPLS traffic

Links to More Info: BT997561

Component: TMOS

Symptoms:
When handling unidirectional GRE traffic, a lack of inner payload entropy can lead to CPU pinning.

In some circumstances, handling this traffic should not require maintaining state across TMMs.

Conditions:
This occurs with GRE/TB (transparent ethernet bridging) and GRE/MPLS traffic.

Impact:
TMM utilization across CPUs is imbalanced, which can impact overall device performance.

Workaround:
None

---

997541-5 : Round-robin GRE Disaggregator for hardware and software

Links to More Info: BT997541

Component: TMOS

Symptoms:
GRE tunnel traffic is pinned to one CPU.

Conditions:
GRE traffic is passed through BIG-IP system.

Impact:
Traffic is pinned to one CPU and overall performance is degraded.

Workaround:
None

---

997357-1 : iRule command "SSL:session invalidate" not working as expected

Links to More Info: BT997357

Component: Local Traffic Manager

Symptoms:
The iRule command "SSL:session invalidate" allows session resumption to happen. Session resumption not supposed to occur when this iRule command is used in an iRule.

Conditions:
"SSL:session invalidate" is used in the iRule event HTTP_REQUEST

Impact:
Session resumption would happen where the iRule is used with "SSL:session invalidate" included which is not supposed to occur

Workaround:
Session resumption should be disabled in SSL profiles

---

996985-1 : No IP address format validation while adding IP addresses in IPv4 LAN Address Space or IPv4 Exclude Address Space when configuring Network Access Resource.

Links to More Info: BT996985

Component: Access Policy Manager

Symptoms:
IP address format is not properly validated for IPv4 LAN Address Space and IPv4 Exclude Address Space fields which may lead to misconfiguration when IPv6 addresses are configured in this fields.

Conditions:
This can occur if you misconfigure the IPv4 LAN Address Space or IPv4 Exclude Address Space fields by adding IPv6 addresses while configuring Network Access Resource.

Impact:
This may cause the split tunnel to malfunction.

Workaround:
Correct the configuration by removing IPv6 Addresses in IPv4 LAN Address Space or IPv4 Exclude Address Space.

---

996977-1 : No IP address format validation while adding IP addresses in IPv6 LAN Address Space or IPv6 Exclude Address Space when configuring Network Access Resource.

Links to More Info: BT996977

Component: Access Policy Manager

Symptoms:
IP address format is not properly validated for IPv6 LAN Address Space and IPv6 Exclude Address Space fields which may lead to misconfiguration when IPv4 addresses are configured in this fields.

Conditions:
This can occur if you misconfigure the IPv6 LAN Address Space or IPv6 Exclude Address Space fields by adding IPv4 addresses while configuring Network Access Resource.

Impact:
This may cause the split tunnel to misfunction.

Workaround:
Correct the configuration by removing IPv4 Addresses in IPv6 LAN Address Space or IPv6 Exclude Address Space.

---

996649-6 : Improper handling of DHCP flows leading to orphaned server-side connections

Links to More Info: BT996649

Component: Local Traffic Manager

Symptoms:
When there are multiple client-side flows tied to a single server-side DHCP flow, timeout handling on the client-side flows is incorrect and might lead to a server-side flow getting orphaned. This results in traffic from the server not making its way back to the client.

Conditions:
Regular DHCP virtual server in use.

Impact:
Traffic is not passed to the client.

Workaround:
None.

---

996261-1 : Zrd in restart loop with empty named.conf

Links to More Info: BT996261

Component: Global Traffic Manager (DNS)

Symptoms:
The zrd process enters a restart loop:
logger[20015]: Re-starting zrd

Conditions:
This occurs when /var/named/config/named.conf is empty.

Impact:
The zrd process enters a restart loop. If the device is in a sync group, zrd enters a restart loop on all devices.

Workaround:
Restore content to the named.conf file.

---

996145-1 : After UCS restore on HA pair, one of the devices is missing folder /var/config/rest/iapps/f5-iappslx-ssl-orchestrator

Links to More Info: BT996145

Component: TMOS

Symptoms:
After restoring via UCS file, the SSL Orchestrator page reads:

Not Found
The requested URL was not found on this server

Conditions:
-- Devices are in a high availability (HA) pair
-- SSL Orchestrator deployed
-- A UCS file is loaded

Impact:
SSL Orchestrator is not available.

/var/config/rest/iapps/f5-iappslx-ssl-orchestrator is not restored correctly during UCS load.

Workaround:
Restore the UCS file again

---

996129-3 : The /var partition is full as cleanup of files on secondary is not executing

Links to More Info: BT996129

Component: Device Management

Symptoms:
The system does not boot because the /var partition is full.

Conditions:
This may be observed on multi-blade vCMP guests and hosts, as well as on multi-blade tenants.

Impact:
The partition housing /var/config/ may become 100% full, impacting future disk IO operation and it may cause unexpected traffic disruption.

Workaround:
None

---

995605-2 : PVA accelerated traffic does not update route domain stats

Links to More Info: BT995605

Component: TMOS

Symptoms:
PVA accelerated traffic does not update route domain stats

Conditions:
-- PVA accelerated traffic.
-- Viewing the route domain stats.

Impact:
The route domain stats may be inaccurate

Workaround:
Use the virtual server stats or ifc_stats instead.

---

995369-1 : DNSSEC manual key created with other algorithms ends up using RSA/SHA1 algorithm

Links to More Info: BT995369

Component: Global Traffic Manager (DNS)

Symptoms:
Generated DNSSEC keys always use RSA/SHA1 algorithm.

Conditions:
DNSSEC keys are generated with manual key management method.

Impact:
You are unable to create DNSSEC keys with other algorithms.

Workaround:
Choose automatic key management method.

---

994985-3 : CGNAT GUI shows blank page when applying SIP profile

Links to More Info: BT994985

Component: Carrier-Grade NAT

Symptoms:
The virtual server properties GUI page shows blank when a SIP profile is applied to the virtual server.

Conditions:
-- Create virtual server and attach a SIP profile.
-- Navigate to virtual server properties page.

Impact:
The virtual server properties page does not display the configuration.

Workaround:
None.

---

994365-1 : Inconsistency in tmsh 'object mode' for some configurations

Links to More Info: BT994365

Component: TMOS

Symptoms:
Tmsh does not support object mode when modifying certain configurations, such as the node configuration. This results in misleading error 'not found' even though the configuration is available.

Conditions:
Modify node config results in error, even though the config is present.

# Node Object 'example' is created successfully
(tmos)# create ltm node example address 1.2.3.4

# On modifying the node 'example', tmsh gives error
(tmos)# modify ltm node example
      Data Input Error: node "example" not found

The modify command does work when a property is specified:
(tmos)# modify ltm node example description "Node 1234"

Impact:
Inconsistent tmsh syntax when using 'object mode' for modifying the configuration.

Workaround:
Use 'tmsh modify' commands, or the GUI, to make the required changes without 'entering' the object in tmsh.

---

994361-2 : Updatecheck script hangs/Multiple updatecheck processes

Links to More Info: BT994361

Component: TMOS

Symptoms:
Multiple updatecheck and 'rpm -qf' processes running simultaneously.

Updatecheck is not functional

Conditions:
Updatecheck is run periodically via a cronjob. Updatecheck runs 'rpm -qf' command.

Impact:
Due to that 'rpm -qf' command hangs. This causes multiple updatecheck and 'rpm -qf' processes. High CPU and memory usage.

The most likely explanation is that rpmdb has gotten corrupted.

Workaround:
To rebuild rpmdb:

1. Halt all running updatecheck and 'rpm -qf' processes.

2. Run these commands:
rm /var/lib/rpm/__db*
rpm --rebuilddb

---

994221-1 : ZoneRunner returns error 'Resolver returned no such record'

Links to More Info: BT994221

Component: Global Traffic Manager (DNS)

Symptoms:
ZoneRunner returns error 'Resolver returned no such record'.

Conditions:
When trying to retrieve TXT records with single backslash.

Impact:
Not able to manage TXT record.

Workaround:
Use double backslashes to retrieve TXT records.

---

994081-1 : Traffic may be dropped with an Immediate idle timeout setting

Links to More Info: BT994081

Component: Local Traffic Manager

Symptoms:
When the idle timeout is set to Immediate, flows may be expired while packets are buffered. Buffered packets are dropped. This can impact iRules and non-standard L4 virtual servers.

Conditions:
-- idle timeout set to Immediate.
-- iRules are configured
-- performance l4, ip forwarding, l2 forwarding virtual servers are used.
-- debug tmm is in use

Impact:
Traffic is dropped.

Workaround:
You can use either workaround:

-- Configure a standard L4 virtual server.

-- Consider removing iRules.

---

994013-1 : Modifying bot defense allow list via replace-all-with fails with match-order error

Links to More Info: BT994013

Component: Application Security Manager

Symptoms:
An error occurs when modifying the allow list (or in case of 'load sys config verify' with similar configuration):

01b90026:3: Bot defense profile (/Common/bot-defense-device-id-generate-before-access) error: match-order should be unique.

Conditions:
-- Either modification via replace-all-with:
tmsh modify security bot-defense profile bot-defense-device-id-generate-before-access whitelist replace-all-with { first_1 { match-order 1 source-address 10.0.0.0/8 url /foo } second_2 { match-order 2 source-address ::/32 url /bar } }

-- Or delete all, add, save and load-verify:
tmsh modify security bot-defense profile bot-defense-device-id-generate-before-access whitelist delete { all }
tmsh modify security bot-defense profile bot-defense-device-id-generate-before-access whitelist add { first_1 { match-order 1 source-address 10.0.0.0/8 url /foo } second_2 {match-order 2 source-address ::/32 url /bar}}
tmsh save sys config
load sys config verify

Impact:
You are unable to add-replace the bot defense allow list configuration

Workaround:
You can use either of the following workarounds:

-- Change match-order of defaults in profile_base.conf to use match-order 3 and up (and load config).
-- Change match-order of custom modify command (to continue with match-order 3 and up).

---

992449-1 : The vCMP host does not report the correct number of guest CPUs on the guest page of the GUI

Links to More Info: BT992449

Component: TMOS

Symptoms:
The total number of cores for a multi-slot vCMP guest is not shown correctly on the GUI page for a vCMP guest.

Conditions:
-- vCMP Host on VIPRION platforms with multiple blades.
-- vCMP guest spanning two or more blades.

Impact:
Incorrect number of cores listed.

-- The vCMP :: Guest List page shows all cores for all slots.
-- The vCMP -> Guest List specific_guest page shows only cores for that guest's slot.

Workaround:
View the Guest List page to see a graphical representation of the number of cores per guest.

---

992253-4 : Cannot specify IPv6 management IP addresses using GUI

Links to More Info: BT992253

Component: TMOS

Symptoms:
You are unable to set the IPv6 mgmt IP address using the GUI, even if the IPv6 address format is a not a short address. When you submit the change, the field is empty.

Conditions:
Attempt to set up IPv6 management address using the GUI

Impact:
You are unable to configure IPv6 management addresses using the GUI.

Workaround:
Use tmsh:

tmsh create sys management-ip <address>/<netmask>
tmsh create sys management-route default-inet6 <address>

---

992241-3 : Unable to change initial admin password from GUI after root password change

Links to More Info: BT992241

Component: TMOS

Symptoms:
While trying to change the admin password from GUI, an error occurs:
-- Authentication failed: Password expired. Update password via /mgmt/shared/authz/users.

Conditions:
-- Change the password for the root user the first time, before the admin password has been changed. This action sets both the root and admin password at the same time.

-- Navigate to the GUI and attempt to update the admin password.

Impact:
GUI password change fails.

Workaround:
You can use either of the following workarounds:

-- Change the password admin via the GUI before changing the root admin via ssh.

-- After changing the root password, use tmsh to set the admin password using the command:

modify auth user admin password.

---

992233-1 : DNS DoS profile (Error Vector) does not mitigate/detect at the virtual server level.

Links to More Info: BT992233

Component: Advanced Firewall Manager

Symptoms:
The GUI makes it appear as if the DNS malformed vector can be configured at the virtual server level when it cannot be.

Conditions:
Using the GUI to configure DoS vectors in the virtual server context.

Impact:
The GUI allows you configure something that does not actually work.

Workaround:
None

---

992113-2 : Page allocation failures on VIPRION B2250 blades

Links to More Info: BT992113

Component: TMOS

Symptoms:
Page allocation failure warnings in kern.log similar to the following example:

kswapd0: page allocation failure: order:2, mode:0x104020

Conditions:
This issue is known to occur on the following VIPRION blade models:

- B2250 (A112)

but its other triggering conditions are not yet understood.

Impact:
The exact impact depends on which process becomes affected and how this process is designed to handle such a failure to allocate memory.

---

992053-4 : Pva_stats for server side connections do not update for redirected flows

Links to More Info: BT992053

Component: TMOS

Symptoms:
Pva_stats for server side connections do not update for the re-directed flows

Conditions:
-- Flows that are redirected to TMM.
-- Server flows are offloaded to PVA.

Impact:
PVA stats do not reflect the offloaded flow.

Workaround:
None

---

991829-1 : Continuous connection refused errors in restjavad

Component: Guided Configuration

Symptoms:
Continuous connection refused errors observed in restjavad.

[com.f5.rest.workers..AsmConfigWorker] nanoTime:[879945045679087] threadId:[63] Exception:[org.apache.thrift.transport.TTransportException: java.net.ConnectException: Connection refused (Connection refused)

[8100/tm/asm/owasp/task OWASPTaskScheduleWorker] Unexpected exception in getting all the polcies: org.apache.thrift.transport.TTransportException: java.net.ConnectException: Connection refused (Connection refused)

Conditions:
The errors are observed regardless of ASM provisioning.

Impact:
-- This issue causes a noisy log file of restjavad.
-- This issue may cause the restart of restjavad due to out of memory error if the restjavad heap size is very low, such as 192MB.

Workaround:
None

---

991765-3 : Inheritance of staging_period_in_days from policy template

Links to More Info: BT991765

Component: Application Security Manager

Symptoms:
Enforcement readiness period of newly created Policy does not get its value from Policy Template.

Conditions:
Creating new ASM Policy from a template with an Enforcement readiness period different from the default (default is 7).

Impact:
Newly created policy has an incorrect configuration.

Workaround:
Create the Policy using tmsh or REST API.

---

991265-3 : Persistence entries point to the wrong servers for longer periods of time

Links to More Info: BT991265

Component: Local Traffic Manager

Symptoms:
Persistence entries point to the wrong servers for a longer than expected.

Conditions:
A pool member goes down, causing the persistence entry to change to a new pool member. Then, the pool member comes back up.

Impact:
The persistence entry does not change to the pool member that came back up. It does not expire as client requests using this cookie continue to refresh the persistence entry that goes to the wrong server.

This can delay recovery of the pool members when they are marked down for regular maintenance, or if all pool members are cycled up/down periodically, it causes persistence entries to point to the wrong servers for longer periods of time than necessary.

Workaround:
None.

---

990929-2 : Status of GTM monitor instance is constantly flapping

Links to More Info: BT990929

Component: Global Traffic Manager (DNS)

Symptoms:
Status of GTM monitor instance is constantly flapping.

Conditions:
GTM devices in a GTM sync group configured with IP addresses that can not communicate with each other.

Impact:
Resources are marked offline constantly.

Workaround:
Remove from the GTM server object definition the IP addresses that do not communicate with each other.

---

990853-1 : Mcpd restarts on Secondary VIPRION blades upon modifying a vCMP guest's management IP address or gateway.

Links to More Info: BT990853

Component: TMOS

Symptoms:
The mcpd daemon restarts on all secondary VIPRION blades after logging error messages similar to the following example to the /var/log/ltm file:

-- err mcpd[6250]: 0107098a:3: The ip address (10.10.10.3%1) for a VCMP Mgmt IP in partition () references a route domain (1) in a different partition (part1). Objects may only reference objects in the same or the 'Common' partition
-- err mcpd[6250]: 01070734:3: Configuration error: Configuration from primary failed validation: 0107098a:3: The ip address (10.10.10.3%1) for a VCMP Mgmt IP in partition () references a route domain (1) in a different partition (part1). Objects may only reference objects in the same or the 'Common' partition... failed validation with error 17238410.

Conditions:
-- Multi-blade VIPRION system provisioned as vCMP host.
-- The system is configured with partitions using non-default route-domains.
-- Using the GUI, an Administrator attempts to modify the management IP address or management gateway of a vCMP guest.
-- A non-Common partition is selected in the GUI Partition drop-down menu when making the change.

Impact:
MCPD restarts, causing all other daemons on the blade to restart as well. The vCMP guests running on the affected blades suffer an outage and are unable to process traffic while the daemons restart.

Workaround:
Ensure that when you make management IP address or gateway changes to a vCMP guest, you do so while the Common partition is selected in the GUI.

---

990173-1 : Dynconfd repeatedly sends the same mcp message to mcpd

Links to More Info: BT990173

Component: Local Traffic Manager

Symptoms:
If dynconfd sends a single message to mcpd containing two or more operations, and one of the operations fails mcpd validation, dynconfd repeatedly sends same message to mcpd.

An example of two operations in one mcp message would be an ephemeral node creation and an ephemeral pool member creation in a single mcp message.

Conditions:
This can occur when:

-- Using FQDN nodes and FQDN pool members.

-- There is an additional issue where the message from dynconfd fails validation within mcpd (e.g., a misconfiguration in which the monitor assigned to the pool is configured with a wildcard destination and the pool member is added to the pool with a port of '0' or 'any'.

Impact:
By repeatedly resending the same messages, which fail repeatedly, dynconfd causes increased mcpd CPU utilization.

This might cause the population of ephemeral nodes and pool members to fail and become out of sync with what the DNS server is resolving.

Workaround:
Examine the LTM logs for mcpd error messages indicating failed attempts to create ephemeral nodes or ephemeral pool members, and resolve the cause of the failed node or pool-member creation.

---

989937-2 : Device Trust Certificates Expiring after 2038-01-19 show date of 1969

Links to More Info: BT989937

Component: TMOS

Symptoms:
If you import a Certificate into the Device Trust Certificates that expires after 2038-01-19, the system GUI shows an expiration date of 1969.

Conditions:
Certificate expiring on/after 2038-01-19T03:14:08Z.

Impact:
The expiration date in the GUI shows 1969. This does not impact iquery or device function.

Workaround:
You can use the command line interface to view the certificate:

$ cd /config/big3d
$ openssl crl2pkcs7 -nocrl -certfile client.crt | openssl pkcs7 -print_certs -noout -text | grep "Issuer:＼|Subject:＼|Not Before:＼|Not After :"

---

989529-1 : AFM IPS engine takes action on unspecified services

Links to More Info: BT989529

Component: Protocol Inspection

Symptoms:
Specific ports configured in the IPS profile are not taken into account during the matching action exercised by the IPS subsystem. As a result, all ports are matched.

Conditions:
Service ports specified under Security :: Protocol Security : Inspection Profiles :: service type (e.g., HTTP).

Impact:
Increased resource usage and excessive logging.

Workaround:
None.

---

988745-4 : On reboot, 'could not find platform object' errors may be seen in /var/log/ltm

Links to More Info: BT988745

Component: TMOS

Symptoms:
During a reboot, several error messages are logged in /var/log/ltm:

-- err mcpd[9401]: 01070710:3: Database error (0), get_platform_obj: could not find platform object - sys/validation/Platform.cpp, line 188.

-- err chmand[6578]: 012a0003:3: hal_mcp_process_error: result_code=0x1070710 for result_operation=eom result_type=eom

Conditions:
This occurs when either of the following conditions is met:
-- A fresh installation of a BIG-IP system.
-- A reboot after forcing the mcpd process to reload the BIG-IP configuration,

Impact:
There is no functional impact to these error messages.

Workaround:
None.

---

988645-4 : Traffic may be affected after tmm is aborted and restarted

Links to More Info: BT988645

Component: TMOS

Symptoms:
Traffic may be affected after tmm is aborted and restarted.
/var/log/tmm contains a lot of "DAG Proxy failed" messages.

Conditions:
-- A BIG-IP device is deployed in a VELOS tenant
-- Tmm aborts and restarts for some reason.

Impact:
Traffic disrupted while tmm restarts. Traffic may be disrupted even after tmm has restarted.

Workaround:
Reboot the tenant

---

987977-3 : VIOL_HTTP_RESPONSE_STATUS is set in violation_details of remote logging message even if ALM/BLK flags are disabled for the violation

Links to More Info: BT987977

Component: Application Security Manager

Symptoms:
Remote logging message, violation_details field, includes XML document for VIOL_HTTP_RESPONSE_STATUS even though it is configured not to do so (Learn/Alarm/Block are all disabled) with VIOL_HTTP_RESPONSE_STATUS violation.

Conditions:
When all the following conditions are met

-- Response status code is not one of 'Allowed Response Status Codes'.
-- Learn/Alarm/Block flags are disabled with 'Illegal HTTP status in response'.
-- Logging profile is configured for remote storage.
-- Storage format is comma-separated.
-- Both violation_details and violations fields are set.

Impact:
Remote logging server receives inaccurate message.

Workaround:
None

---

987949-2 : Error messages erroneously generated during boot up★

Links to More Info: BT987949

Component: TMOS

Symptoms:
During boot up, error messages are found in /var/log/ltm:

Could not retrieve DB variable for (provision.datastor): status 0xff00
Write F5 license shared memory device failed err = -5
Dossier data not available from hypervisor.
Database error (0), get_platform_obj: could not find platform object -
hal_mcp_process_error: result_code= for result_operation=eom result_type=eom
Setting /sys/kernel/debug/x86/ibpb_enabled failed. Request ibpb=0 ignored
Blade 2 turned RED: Quorum: perfect time sync, high availability (HA) TABLE offline
Device error: init Cannot get pci config register data for device 00:0e:00

Conditions:
Upgrade BIG-IP software to version 14.1.4.

Impact:
There is no impact on functionality and the error message can be ignored.

Workaround:
None

---

987709-6 : Static target string as CNAME pool member might cause config load failure if wide IP with same name exists in another partition

Links to More Info: BT987709

Component: Global Traffic Manager (DNS)

Symptoms:
GTM config fails to load with errors similar to this:

01070726:3: Pool 5 /Common/cnamepool1 in partition Common cannot reference GTM wideip pool member 5 /Common/cnamepool1 gslb.mycompany.com /App2/gslb.mycompany.com 1 in partition App2
Unexpected Error: Loading configuration process failed

Conditions:
There is a wide IP with the same name in another partition as the static target CNAME pool member.

Impact:
Gtm config fails to load.

Workaround:
Create the wide IP first and then add the static target CNAME pool member.

---

987637-3 : DDoS: Single endpoint flood vectors and Bad destination not supported properly on Neuron hardware

Links to More Info: BT987637

Component: Advanced Firewall Manager

Symptoms:
BIG-IP systems mitigate traffic on all of the IP addresses in an address list when certain DoS vectors are detected on a virtual server.

Conditions:
-- BIG-IP hardware platform equipped with Neuron (BIG-IP iSeries)
-- Virtual server configured with a DoS profile
-- Flood traffic reaches the virtual server

Impact:
For Neuron-supported hardware, virtual servers with subnet destinations are not properly mitigated when flood vectors are detected.

Workaround:
None

---

987605-3 : DDoS: ICMP attacks are not hardware-mitigated

Links to More Info: BT987605

Component: Advanced Firewall Manager

Symptoms:
ICMP/Fragments attacks against a virtual server with a DOS profile are not mitigated by hardware.

Conditions:
ICMP/Fragments attacks mitigation/detection is configured on a virtual system with neuron-capable hardware.

Impact:
ICMP/Fragments attacks mitigation/detection is handled in software. A large volume of attack traffic can spike the tmm CPU.

Workaround:
None

---

987453-3 : Bot Defense browser verification fails upon iframes of different top-level domains

Component: Application Security Manager

Symptoms:
When using Bot Defense on a page which has an iframe to a different top-level domain, the iframe may fail to load.

Conditions:
Page has an iframe on a different top-level domain than that of the main page. Note that iframes with different sub-domains are not impacted.

Impact:
Page resources may fail to load.

Workaround:
None

---

987401-1 : Increased TMM memory usage on standby unit after pool flap

Links to More Info: BT987401

Component: Local Traffic Manager

Symptoms:
TMM memory usage on a BIG-IP standby device might be substantially higher than an active device.

Conditions:
Standby device with UDP mirroring traffic and datagram-load-balancing disabled.

Impact:
The standby device may not be able to take over traffic when failover happens.

Workaround:
None.

---

987081-1 : Alarm LED remains active on Secondary blades even after LCD alerts are cleared

Links to More Info: BT987081

Component: TMOS

Symptoms:
When a condition occurs which causes an alert message to be logged to the LCD display for a VIPRION chassis, the Alarm LED on the blade where the condition was reported may be set (to solid or flashing amber or red) according to the severity of the reported condition.

When the LCD alert messages are cleared, the Alarm LED on the Primary blade in the chassis will be cleared (or set according to remaining alert messages if only a subset of messages are cleared).

However, the Alarm LED on the Secondary blades in the chassis will not be cleared, and will continue to indicate the highest severity of the previously reported alert messages.

Conditions:
This occurs when:
-- A condition is reported by a Secondary blade in the chassis which causes its Alarm LED to be set (to solid or flashing amber or red) and a message logged to the chassis LCD display.
-- The LCD alert messages are cleared, such as by issuing the 'tmsh reset-stats sys alert lcd' command.

Impact:
The Alarm LED on one or more Secondary blades in the chassis continues to indicate an alert condition even after the previously reported alert messages have been cleared.

Workaround:
To restore the Secondary blade LEDs to their proper state, restart the fpdd daemon on each affected blade.

For example, if the Alarm LED is not reset on the blade in slot 4, issue one of the following commands from the console of the Primary blade in the chassis:
-- clsh --slot=4 "bigstart restart fpdd"
-- ssh slot4 "bigstart restart fpdd"

Alternately, you may log in to the console of the affected blade and issue the 'bigstart restart fpdd' command directly.

---

986821-1 : Command 'run util bash' event is not captured in log when initially executed

Links to More Info: BT986821

Component: TMOS

Symptoms:
The initiation of 'run util bash' is not captured in the audit log (/var/log/audit)

Conditions:
Run 'run util bash' command in tmsh mode.

Impact:
The timestamp for a 'run util bash' command will occur when the subshell exits, not when the subshell is first executed. It is difficult to determine when the bash subshell started.

Workaround:
None

---

985749-1 : TCP exponential backoff algorithm does not comply with RFC 6298

Links to More Info: BT985749

Component: Local Traffic Manager

Symptoms:
The algorithms used for TCP exponential backoff are different for SYN and non-SYN packets.

Conditions:
Using TCP.

Impact:
Retransmission timeout interval depends on the inclusion/exclusion of SYN flag.

Workaround:
None

---

985401-1 : ProxySSL virtual servers should work with web acceleration (ramcache) profiles attached

Links to More Info: BT985401

Component: Local Traffic Manager

Symptoms:
Attempting to attach a web acceleration profile to a virtual server that has an SSL profile with ProxySSL enabled will result in the following validation error:

A validation error similar to:

01070734:3: Configuration error: Proxy SSL is not compatible with Web Acceleration profile on Virtual Server (<virtual server name>).

Conditions:
-- Virtual server using an SSL profile with ProxySSL enabled.
-- Attaching a web acceleration (webacceleration) profile to the virtual server.

Impact:
Unable to use the web acceleration profile with ProxySSL virtual servers.

Workaround:
Avoid using ProxySSL virtual servers with web acceleration (ramcache) profiles attached.

---

985329-2 : Saving UCS takes longer when iControl LX extension is installed

Links to More Info: BT985329

Component: Device Management

Symptoms:
The tmsh command 'save sys ucs' takes longer when iControl LX extensions is installed.

You may also see errors logged in /var/log/restjavad.0.log:

[WARNING][211][date and time UTC][8100/shared/iapp/build-package BuildRpmTaskCollectionWorker] Failed to execute the build command 'rpmbuild -bb --define '_tmppath /shared/tmp' --define 'main /var/config/rest/iapps/f5-service-discovery' --define '_topdir /var/config/rest/node/tmp' '/var/config/rest/node/tmp/ac891731-acb1-4832-b9f0-325e73ed1fd1.spec'', Threw:com.f5.rest.common.CommandExecuteException: Command execution process killed
        at com.f5.rest.common.ShellExecutor.finishExecution(ShellExecutor.java:281)
        at com.f5.rest.common.ShellExecutor.access$000(ShellExecutor.java:33)
        at com.f5.rest.common.ShellExecutor$1.onProcessFailed(ShellExecutor.java:320)
        at org.apache.commons.exec.DefaultExecutor$1.run(DefaultExecutor.java:203)
        at java.lang.Thread.run(Thread.java:748)


Errors logged in /var/log/ltm:

err iAppsLX_save_pre: Failed to get task response within timeout for: /shared/iapp/build-package/a1724a94-fb6b-4b3e-af46-bc982567df8f
err iAppsLX_save_pre: Failed to get getRPM build response within timeout for f5-service-discovery

Conditions:
iControl LX extensions (e.g., AS3, Telemetry) are installed on the BIG-IP system.

Impact:
Saving the UCS file takes a longer time (e.g., ~1-to-2 minutes) than it does if iControl LX extensions are not installed (e.g., ~40 seconds).

Workaround:
None

---

984965-4 : While intentionally exiting, sshplugin may invoke functions out of sequence and crash

Links to More Info: BT984965

Component: Advanced Firewall Manager

Symptoms:
The sshplugin process used by the AFM module may continually restart and deposit a large number of core-dump files, displaying a SIGSEGV Segmentation fault.

In the file /var/log/sshplugin.start, errors may be logged including these lines:

shmget name:/var/run/tmm.mp.sshplugin18, key:0xeb172db6, size:7, total:789184 : Invalid argument
tm_register failed: Bad file descriptor

Conditions:
-- AFM provisioned and in use.
-- Heavy system load makes problem more likely.

Impact:
-- Extra processing load from relaunching sshplugin processes.
-- The large number of core files might fill up /var/core.

Workaround:
First, attempt a clean process restart:

    # bigstart restart sshplugin

If that is not effective, rebooting the entire system may clear the condition.

---

984897-1 : Some connections performing SSL mirroring are not handled correctly by the Standby unit.

Links to More Info: BT984897

Component: Local Traffic Manager

Symptoms:
Some of the connections performing SSL mirroring do not advance through TCP states as they should on the Standby unit.

Additionally, these connections do not get removed from the connection table of the Standby unit when the connections close. Instead, they linger on until the idle timeout expires.

Conditions:
A virtual server configured to perform SSL connection mirroring.

Impact:
Should the units fail over, some connections may not survive as expected.

Additionally, given a sufficient load and a long idle timeout, this could cause unnecessary TMM memory utilization on the Standby unit.

Workaround:
None.

---

984765-2 : APM NTLM auth fails every week with RPC return code 0xC0000022(STATUS_ACCESS_DENIED)★

Links to More Info: BT984765

Component: Access Policy Manager

Symptoms:
NTLM User logon authentication fails every week with RPC return code 0xC0000022(STATUS_ACCESS_DENIED) from the Active Directory (AD) server.

Conditions:
-- Upgrading from legacy versions to BIG-IP v14.1.2 or later.
-- AD servers are updated with latest security patches from Microsoft.

Impact:
NTLM Authentication fails after a week. APM end user client logon (such as Outlook users, Remote Desktop Users, and Browser-based NTLM Auth logons that use BIG-IP APM as forward/reverse proxy) fails, and the service is down.

Workaround:
To resolve the issue temporarily, use either of the following:

-- Reset the NTLM Machine Account with the 'Renew Machine Password' option.

-- Run the command:
bigstart restart nlad

The problem can reappear after a week, so you must repeat these steps each time the issue occurs.

---

984657 : Sysdb variable not working from tmsh

Links to More Info: BT984657

Component: Traffic Classification Engine

Symptoms:
When cloud_only system db variable is enabled, urlcat_query returns categorization from webroot from tmsh

Conditions:
The following sys db variable is enabled: cloud_only

You attempt to run the following command:

tmsh list sys db urlcat_query

Impact:
Sysdb variables does not work from tmsh

---

984521-4 : Accept-Encoding header is stripped by Bot Defense profile in case of incompatible file extension and a dot in the file name

Links to More Info: BT984521

Component: Application Security Manager

Symptoms:
Bot Defense profile checks if a page is not an HTML page by checking the file extension (among other ways).

In case the filename contains a dot (.) - the parsing is wrong and it is not detected as incompatible. As a result, the Accept-Encoding header is removed (to allow injection in the response).

Conditions:
-- Bot Defense profile is attached to s virtual server configured with any response injection (Device ID, Browser Verification, or Single Page Application).
Request is sent to an incompatible file extension (one of gif,png,bmp,jpg,ico,css,mp3,mp4,mpg,avi,wmv,mov,3gp,fla,swf,js), and filename contains a dot (.).

Impact:
Accept-Encoding header is removed, causing the server to not send a gzipped response.

Workaround:
Add this specific URL to sys db:

dosl7.parse_html_excluded_urls

---

984449-2 : Unnecessary swagger validation violation may raise due to behavioral WAF parameter traps that have identical name

Links to More Info: BT984449

Component: Application Security Manager

Symptoms:
An unnecessary swagger validation violation may be raised about illegal parameters which is actually the parameter trap that was injected by ASM and failed to be ignored by the enforcer. Only one of these parameter traps will be ignored - enforcement will be avoided for it. Expected behavior is to avoid enforcement for both parameters traps.

Conditions:
Security team provide 2 traps with type parameter and with identical name but with different values. In adition one of these parameter traps was injected by ASM to the web-page.

Impact:
Unecessary swagger validation violation may raise regarding one of these parameters traps and request may be blocked, instead of ignoring swagger enforcement for both parameters traps.

Workaround:
None.

---

982801-2 : AGC hardening

Links to More Info: BT982801

Component: Guided Configuration

Symptoms:
AGC does not follow current best practices.

Conditions:
- APM is provisioned
- AGC used for Azure AD Application

Impact:
AGC does not follow current best practices.

Workaround:
N/A

---

981485-6 : Neurond enters a restart loop after FPGA update.

Links to More Info: BT981485

Component: TMOS

Symptoms:
After FPGA firmware upgrade, the neurond process might enter a restart loop, unable to recover.

When the problem is present you might see logs similar to:
-- notice chmand[6674]: 012a0005:5: FPGA PNP FW upgrade check: req type 0, file:Latest
-- notice chmand[6674]: 012a0005:5: FPGA: Requesting type: 0, vers: Latest
-- notice chmand[6674]: 012a0005:5: FPGA: current type: 2, vers: hsb_5SGXEA7H2F35C2_t37dc_1d10_v5.23.5.0_d20.06.11.00.bit
-- notice chmand[6674]: 012a0005:5: FPGA: match for type: 0, vers: hsb_5SGXEA7H2F35C2_t37dc_1d10_v5.6.7.0_d20.06.11.00.bit
-- notice chmand[6674]: 012a0005:5: removed /var/db/mcpdb.* FPGA current disk firmware updated to: /L7L4_BALANCED_FPGA type: 0
-- notice chmand-fpga-pnp[17551]: Stopping TMM, BCM56xxd, and neurond
-- notice logger[17553]: /bin/bash /etc/init.d/fw_pnp_upgrade upgrade restart ==> /usr/bin/bigstart stop tmm bcm56xxd neurond

Conditions:
FPGA firmware mismatch, leading to FPGA firmware upgrade.

Impact:
Enhanced flow acceleration provided by the Neuron chip cannot be utilized.

Workaround:
Perform a full system restart.

---

981145-1 : DoS events do not include the attack name for "tcp syn ack flood"

Links to More Info: BT981145

Component: Advanced Firewall Manager

Symptoms:
BIG-IQ does not display the attack name for a 'tcp syn ack flood' attack.

Conditions:
DoS on BIG-IP enabled to address 'tcp syn ack flood' attack.

Impact:
Lack of DoS attack information. The mitigation occurs as expected. Only the notification information is missing.

Workaround:
None.

---

979213-1 : Spurious spikes are visible in Throughput(bits) and Throughput(packets) performance graphs following a restart of TMM.

Links to More Info: BT979213

Component: Local Traffic Manager

Symptoms:
Upon reviewing the performance graphs in the GUI, you may notice significant spikes in the Throughput(bits) and Throughput(packets) graphs.

The spikes may report unrealistically high levels of traffic.

Note: Detailed throughput graphs are not affected by this issue.

Conditions:
This issue occurs when the following conditions are met:

-- The BIG-IP device is a physical system.
-- TMM was restarted on the system.
-- At some point, at least one interface was up on the system and recorded some traffic.

Impact:
This issue is purely cosmetic but might cause concern when reviewing the performance graphs.

Workaround:
None.

---

979045-1 : The tpm-status-check service shows System Integrity Status: Invalid when Engineering Hotfix installed on certain platforms

Links to More Info: BT979045

Component: TMOS

Symptoms:
After installing an Engineering Hotfix version of BIG-IP v14.1.0 or later, certain BIG-IP hardware systems. The Trusted Platform Module (TPM), status is showing as INVALID.

Conditions:
This may occur:
-- Running BIG-IP v14.1.0 or later.
-- Using Engineering Hotfixes containing fixes for the following bugs:
   - ID893885 (https://cdn.f5.com/product/bugtracker/ID893885.html)
   - ID946745 (https://cdn.f5.com/product/bugtracker/ID946745.html)
   - ID963017 (https://cdn.f5.com/product/bugtracker/ID963017.html)
-- The issue is observed only on the following platforms:
   - i11600 / i11800
   - i11400-DS / i11600-DS / i11800-DS

Impact:
The TPM status INVALID indicates that the system integrity is compromised when it is actually valid.

Workaround:
None.

---

978953-3 : The value of the sys db variable vlan.backplane.mtu intermittently out-of-sync with the value of the MTU of the kernel interface tmm_bp during the initial boot up

Links to More Info: BT978953

Component: Local Traffic Manager

Symptoms:
During the initial boot of the device the MTU of the tmm_bp kernel interface is out-of-sync with the value of sys db vlan.backplane.mtu as well as out-of-sync with the MTU displayed by the following command:
 tmsh show /net vlan all-properties -hidden.
 tmsh list net vlan tmm_bp all-properties -hidden.

Additionally, running the following command:

modify sys db vlan.backplane.mtu value <some value> (within the range accepted), and saving the configuration change does not last through a reboot.

Conditions:
This issue occurs on the first boot intermittently.

Impact:
When the values are seen at non-sync, after the modification of the backplane vlan mtu and saving the config, changing the mtu config value does not last through a reboot.

Workaround:
Rebooting the device resolves the issue

---

977953-3 : Show running config interface CLI could not fetch the interface info and crashes the imi

Links to More Info: BT977953

Component: TMOS

Symptoms:
The confd command 'show running-config' does not display interface information if nsm and bgpd are the only processes running.

If you run 'show running-config interface', imi crashes.

Conditions:
1. nsm and bgpd are the daemons running.
2. Run the "show running-config" command

Impact:
Imish cannot retrieve interface information from the show running-config command.

Workaround:
* Enable OSPF. For example,

  # tmsh modify /net route-domain 0 routing-protocol add { BGP OSPFv3 }

  # ps -ef | egrep -i ospf
  root 11954 4654 0 11:25 ? S 0:00 ospf6d%0

---

977681-3 : Incorrect error message when changing password using passwd

Links to More Info: BT977681

Component: TMOS

Symptoms:
When using the 'passwd' utility from the command line to change a user password, the error message on why the new password is not accepted is wrong.
Instead of the actual reason why the new password is not accepted, the following message is printed:

"passwd.bin: Have exhausted maximum number of retries for service"

Conditions:
- Using the 'passwd' utility from the command line to change a user password.

- The new password is not accepted according to the configured tmsh auth password-policy.

Impact:
The real reason why the new password is not accepted is masked by the default error message:

"passwd.bin: Have exhausted maximum number of retries for service"

Workaround:
Instead of using the command line 'passwd' utility, change the user password using tmsh.
With tmsh, the real reason why a new password is not accepted is printed accurately:

root@(bigip)(cfg-sync Standalone)(Active)(/Common)(tmos)# modify auth password root
changing password for root
new password: default
confirm password: default
01070366:3: Bad password (root): BAD PASSWORD: it is too simplistic/systematic


Or, when using the 'passwd' utility from the command line, it's still possible to find the actual reason why the new password isn't accepted in the /var/log/ltm log file.

---

977625-1 : GTM persistence records linger in tmm

Links to More Info: BT977625

Component: Global Traffic Manager (DNS)

Symptoms:
-- GTM persistence records are not cleared.
-- GTM still answers from persist records even though the persist records not listed by the "tmsh show gtm persist" command.

Conditions:
Persistence for wideip or application is disabled and then enabled quickly afterwards

Impact:
GTM answers from stale persist records.

Workaround:
Do not enable persistence right after disabling.

---

977449-1 : Total address and Total endpoints is shown as '0' in nat stats

Links to More Info: BT977449

Component: Advanced Firewall Manager

Symptoms:
Total address and Total endpoints is shown as '0' (zero) in the output of 'show ltm nat-stats roll-up-level fw-nat-source-translation-object name <name> all',

Conditions:
The prefix length for IPv6 source translation is configured as less than or equal to 64.

Impact:
There is no functional impact, as only the 'show' output is affected for the two stats.

Workaround:
None

---

976553-1 : Portal Access: Chrome/Edge browser: cookie transport: sync XMLHttpRequests should not be used in onbeforeunload handlers

Links to More Info: BT976553

Component: Access Policy Manager

Symptoms:
Error message in browser console:

Uncaught DOMException: Failed to execute 'send' on VM41 cache-fm.js:618
'XMLHttpRequest': Failed to load ''https://appportal.omo.nl/private/fm/volatile.html': Synchronous XHR in page dismissal. See https://www.chromestatus.com/feature/4664843055398912 for more details.

Conditions:
Setting and/or getting cookies in onbeforeunload/onunload handlers defined by the web-application.

Impact:
Web-application does not function as expected. Behavior varies, depending on web-application control flow.

Workaround:
Important: This workaround will work until later versions of Chrome and Edge Browser are released. You can refer to the release notes for these browsers to determine when functionality is removed.


Use an iRule to allow sync requests from onbeforeunload, onunload, and other page dismissal events.

This is intended to inject into responses from the BIG-IP virtual server header, Origin-Trial, using a token obtained from the Google Chrome developer console. This token allows for use of synchronous requests in page dismissal events. It should work for Chrome and Microsoft Edge browsers where such sync requests are disabled now.

To obtain the token you need to use the following iRule with your virtual server:

1. Go to the Chrome Origin Trials page:
https://developers.chrome.com/origintrials/#/trials/active.

2. Click the 'REGISTER' button to the right of 'Allow Sync XHR In Page Dismissal'.

3. Enter the origin of your virtual server and other information:
https://domain_of_your_virtual_server.

4. Click REGISTER.

By doing this, you obtain a token to use in place of the token provided in the following iRule.

Note: For additional info about Origin Trials and how they work:
https://github.com/GoogleChrome/OriginTrials/blob/gh-pages/developer-guide.md


when HTTP_RESPONSE_RELEASE {
      HTTP::header insert Origin-Trial Aq5OZcJJR3m8XG+qiSXO4UngI1evq6n8M33U8EBc+G7XOIVzB3hlNq33EuEoXZQEt30Yv2W6YgFelr2aGUkmowQAAABieyJvcmlnaW4iOiJodHRwczovLzEwLjE5Mi4xNTIuMzk6NDQzIiwiZmVhdHVyZSI6IkFsbG93U3luY1hIUkluUGFnZURpc21pc3NhbCIsImV4cGlyeSI6MTU5ODk5NzIyMX0=
}

---

976517-2 : Tmsh run sys failover standby with a device specified but no traffic group fails

Links to More Info: BT976517

Component: TMOS

Symptoms:
The tmsh run /sys failiover standby device <device> command fails and returns an error if no traffic-group is specified:

Syntax Error: There is no failover device with a name (/Common/bigip2.localhost).

Conditions:
Two or more BIG-IPs configured with high availability (HA)

Impact:
You are required to specify all the traffic groups you want to failover to a peer.

Workaround:
For each traffic group that you want to failover to a peer run the tmsh run /sys failover standby.

For example if you want to fail over both traffic groups traffic-group-1 and traffic-group-2 to failover to bigip2.localhost, run the following:

tmsh run /sys failover standby device bigip2.localhost traffic-group traffic-group-1

tmsh run /sys failover standby device bigip2.localhost traffic-group traffic-group-2

If you want the device to be standby for all traffic groups but you don't care what device takes over as active, run the following command (note there is no traffic-group nor device):

tmsh run /sys failover standby

---

975725-5 : Wildcard virtual servers do not forward L3 unicast traffic sent to L2 broadcast

Links to More Info: BT975725

Component: Local Traffic Manager

Symptoms:
L3 unicast traffic with L2 broadcast destination MAC (ff:ff:ff:ff:ff:ff) matching wildcard virtual servers is not handled properly.

Conditions:
Wildcard virtual server is configured to handle such traffic.

Impact:
Traffic will not be forwarded properly.

Workaround:
Use specific non-wildcard virtual-server.

---

975657-1 : With HTTP2 enabled, only partial sorry contents (< 32KB) can be sent to the client via HTTP::respond

Links to More Info: BT975657

Component: Local Traffic Manager

Symptoms:
Partial content (<= max allowed "write-size" in HTTP2 profile i.e. 32KB) can be sent to client via the HTTP:respond iRule command.

Conditions:
-- HTTP2 enabled on virtual server
-- Content sent by the iRule exceeds 32KB

Impact:
Client fails to receive the whole content

---

974513-7 : Dropped requests are reported as blocked in Reporting/charts

Links to More Info: BT974513

Component: Application Security Manager

Symptoms:
Dropped requests are reported as blocked in Reporting/charts.

Conditions:
Request is dropped (or client side challenge / captcha is not answered) as part of a brute force mitigation or a slow post attack causes dropping of a request.

Impact:
Data reported might be incorrect. There is a filter for dropped requests which, when selected, does not show anything, even when there are drops.

Workaround:
None.

---

973341-1 : Customized device certs will break scripts relying on /config/httpd/conf/ssl.crt/server.crt

Links to More Info: BT973341

Component: Global Traffic Manager (DNS)

Symptoms:
Bigip_add, big3d_install, gtm_add will not work.

Conditions:
Device cert is customized.

Impact:
Bigip_add, big3d_install, gtm_add not work.

Workaround:
Copy the content of the new cert to default file "/etc/httpd/conf/ssl.crt/server.crt".

---

969553-1 : A DNS Cache (or Network DNS Resolver) returns SERVFAIL to some queries.

Links to More Info: BT969553

Component: Global Traffic Manager (DNS)

Symptoms:
- A DNS Cache (or Network DNS Resolver) returns SERVFAIL responses to clients, despite the BIG-IP system receiving a good (albeit delayed) response from upstream servers.

- When this happens, the BIG-IP system rejects the responses from the upstream servers with ICMP errors (Destination unreachable - Port unreachable).

- If the db key dnscacheresolver.loglevel is set to debug5, the following error message is visible in the /var/log/ltm file when this issue occurs:

debug tmm[13147]: DNScache: request example.com. has exceeded the maximum number of glue fetches 17 to a single delegation point

- If a Network DNS Resolver is used with an HTTP Explicit Proxy profile, the symptoms can appear as "503 Service Unavailable" responses to clients due to DNS lookup failure.

Conditions:
This issue occurs when the following conditions are met:

- A DNS Cache (or Network DNS Resolver) is in use on the BIG-IP system.

- The aforementioned object is configured with a forward-zone that uses multiple servers to perform resolutions.

- The RTT of the servers fluctuates. For example, the servers are generally fast to reply for most domains, but take extra time to reply for a given domain.

- 'Randomize Query Character Case' is enabled in the DNS Cache (or Network DNS Resolver).

- If the requests for the domain take a long time to resolve, BIG-IP may reply with SERVFAIL.

Impact:
Clients of the BIG-IP DNS Cache (or Network DNS Resolver) are not returned an answer. As a result, application failures may occur.

Workaround:
You can work around this issue by changing 'Randomize Query Character Case' to 'No' in the DNS Cache (or Network DNS Resolver) settings.

---

969345-1 : Temporary TMSH files not always removed after session termination

Links to More Info: BT969345

Component: TMOS

Symptoms:
Temporary TMSH-related subdirectories and files located in /var/system/tmp/tmsh may not be properly cleaned up after a TMSH session is terminated. These files can accumulate and eventually cause disk-space issues.

Conditions:
A TMSH session is terminated abruptly rather than ended gracefully.

Impact:
The /var filesystem may fill up, causing any of a variety of problems as file-I/O operations fail for various software subsystems.

Workaround:
The BIG-IP software includes a shell script (/usr/local/bin/clean_tmsh_tmp_dirs) which can be run by the system administrator to clean up excess temporary files in the directories /var/tmp/tmsh and /var/system/tmp/tmsh.

---

968953-1 : Unnecessary authorization header added in the response for an IP intelligence feed list request

Links to More Info: BT968953

Component: Advanced Firewall Manager

Symptoms:
Empty authorization header in the response for an IP intelligence feed list request.

Conditions:
Feed list configured without username/password pair.

Impact:
Feed List request from dwbld adds unnecessary Authorization header. There is no functional impact.

Workaround:
None.

---

968949-7 : Keepalives aren't sent in FIN_WAIT_2 when using a TCP profile

Links to More Info: BT968949

Component: Local Traffic Manager

Symptoms:
When a client-side connection goes into FIN_WAIT_2, BIG-IP does not send keepalives even if they are being sent on the server-side connection.

Conditions:
- Virtual server configured with a TCP profile and network listener.

Impact:
Client-side connections timeout prematurely.
As a result, the server-side connections end up being open indefinitely.

Workaround:
No workaround currently known.

---

967769-1 : During reset of high-speed interfaces, TMMs may mistakenly continue hardware watchdog checks

Links to More Info: BT967769

Component: TMOS

Symptoms:
Tmm crashes and restarts. The following panic message is found in /var/log/tmm:

    notice panic: ../dev/hsb/if_hsb.c:6129: Assertion "HSB lockup, see ltm and tmm log files" failed.

Conditions:
-- Running on a platform that incorporates 'HiGig MAC' network interfaces.
-- Some error or glitch is detected on the high-speed bus (HSB).
-- Software commands a reset of the HSB and interface hardware.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

---

967737-3 : DNS Express: SOA stops showing up in statistics from second zone transfer

Links to More Info: BT967737

Component: Global Traffic Manager (DNS)

Symptoms:
Start of Authority (SOA) record is not displayed in zone statistics.

Conditions:
The issue appears after the 2nd zone transfer.

Impact:
This is a cosmetic issue without any actual impact.

Workaround:
None

---

967573-3 : Qkview generation from Configuration Utility fails

Links to More Info: BT967573

Component: TMOS

Symptoms:
When you attempt to generate a qkview using the Configuration Utility, the system fails to generate a qkview.

Conditions:
Trying to generate a Qkview using the Configuration Utility.

Impact:
The Configuration Utility cannot be used to generate a qkview.

Workaround:
Use the qkview command to generate a qkview from the command line.

---

967557-1 : Improve apm logging when loading sys config fails due to corruption of epsec rpm database

Links to More Info: BT967557

Component: TMOS

Symptoms:
Loading sys config fails and mcpd may not be running properly due to corruption of EPSEC rpm database. It is difficult to tell from logs that the issue is with epsec rpm database. This error may be the only indication:

emerg load_config_files[10761]: "/usr/bin/tmsh -n -g -a load sys config partitions all base " - failed. -- Error: failed to reset strict operations; disconnecting from mcpd. Will reconnect on next command.

Conditions:
Loading of sys config fails due to corruption of EPSEC rpm database.

Impact:
Difficult to troubleshoot the root cause for config load failure.

---

967353-1 : HTTP proxy should trim spaces between a header field-name and colon in its downstream responses.

Links to More Info: BT967353

Component: Local Traffic Manager

Symptoms:
Client receives no response along with a connection reset by the BIG-IP system.

Conditions:
-- HTTP profile is enabled on the BIG-IP system.
-- Server sends HTTP response with one or more header field names separated with the trailing colon by a space.

Impact:
HTTP responses that should be delivered to the client by the proxy are not being sent out.

Workaround:
None

---

967245-1 : Incorrect SPVA counter incremented during Sweep attack on profile

Component: Advanced Firewall Manager

Symptoms:
Incorrect SPVA counters updated.

Conditions:
Configure DoS Sweep vector on an SPVA supported device.

Impact:
Usage of dos_spva_stat will result in displaying incorrect counters.

---

967185 : Increase the size limit of JWT for OAuth

Links to More Info: BT967185

Component: Access Policy Manager

Symptoms:
Currently, the allowed payload size for JWT is 4K. Users whose claims of length exceed the limit are unable to authenticate.

Conditions:
OAuth is configured with JWT.

Impact:
Users whose claims of length are more than the limit are unable to authenticate.

---

966785-1 : Rate Shaping stops TCP retransmission

Links to More Info: BT966785

Component: Local Traffic Manager

Symptoms:
When rate shaping is applied to a virtual server, the BIG-IP system does not retransmit unacknowledged data segments, even when the BIG-IP system receives a duplicate ACK.

Conditions:
This issue occurs when both of the following conditions are met:

-- Virtual server configured with a rate shaping.
-- Standard type of virtual server.

Impact:
The BIG-IP system does not retransmit unacknowledged data segments.

Workaround:
None

---

966613-6 : Cannot create XML profile based on WSDL when wsdl contains empty soap:address – getting error ‘Column 'object_uri' cannot be null’

Links to More Info: BT966613

Component: Application Security Manager

Symptoms:
Perl error returned when saving new XML content profile using wsdl file with empty soap:address node "<soap:address/>".

Conditions:
Creating a new content profile using a wsdl file which contains a "<soap:address/>" node which does not have a "location" attribute value.

When this content profile is saved, ASM attempts to create an associated URL with no value, which fails validation.

Impact:
After trying to save the content profile, you see an error message: "Could not create XML Profile; Error: DBD::mysql::db do failed: Column 'object_uri' cannot be null"

Workaround:
Delete the node "<soap:address/>" from the wsdl file

---

965897-4 : Disruption of mcpd with a segmentation fault during config sync

Links to More Info: BT965897

Component: TMOS

Symptoms:
The mcpd process on the peer device fails with a segfault, restarts and then segfaults again in a loop

Numerous messages may be logged in the "daemon" logfile of the following type:

emerg logger[2020]: Re-starting mcpd

Conditions:
-- High availability (HA) configuration
-- A port-and-address list configuration is changed to be only an address list
-- A config sync occurs

Impact:
Continuous restarts of mcpd process on the peer device.

Workaround:
One possible measure for getting the peer-machine "mcpd" out of its failure mode is to command the still-functioning system to push a "full" config sync to the appropriate device group. Doing this twice consecutively may be necessary.

  # tmsh run /cm config-sync force-full-load-push to-group APPROPRIATE-DEVICE-GROUP

---

965849-1 : Displayed 'Route Domain ID' value is confusing if it is set to None

Links to More Info: BT965849

Component: Advanced Firewall Manager

Symptoms:
The numeric value of RT_DOMAIN_NONE is 65535. Lsndb displays this value, which is confusing.

Conditions:
If the parent route domain is set to "None", lsndb displays 65535.

Impact:
No impact on functionality.

Workaround:
None

---

965053-4 : [Regression of ID787881 & ID761032] DNSX fails to sign zone transfer using tsig key after failure

Links to More Info: BT965053

Component: Global Traffic Manager (DNS)

Symptoms:
DNSX fails to sign zone transfer using tsig key.

Conditions:
A transfer error occurs while DNSX is initializing.

Impact:
DNSX zones are not been updated.

Workaround:
Re-enter the tsig key secret.

---

964989-4 : AFM DOS half-open does not handle wildcard virtual servers properly.

Links to More Info: BT964989

Component: Advanced Firewall Manager

Symptoms:
AFM DOS half-open vector does not handle wildcard virtual servers properly.

Conditions:
-- Wildcard virtual-server.
-- AFM DOS half-open vector configured.
-- Attacks towards multiple destinations covered by a single virtual-server.

Impact:
- Wrong statistics reporting.
- Wrong status of syncookie protection.
- Unexpected traffic drops.

Workaround:
Split wildcard virtual server into a series of /32 virtual servers.

---

963393-2 : Key handle 0 is treated as invalid for NetHSM devices

Links to More Info: BT963393

Component: Local Traffic Manager

Symptoms:
HTTPS pool members are marked down when they are up.

Conditions:
-- SafeNet HSM configured
-- HTTPS monitor uses the safenet keys
-- The key handle generated by the HSM is 0

Impact:
Pool members are marked down because bigd cannot connect to the pool member using the Safenet HSM key.

Workaround:
Use in-TMM monitors as an alternative to bigd monitors.

---

963129-3 : RADIUS Accounting Stop message fails via layered virtual server

Links to More Info: BT963129

Component: Access Policy Manager

Symptoms:
RADIUS Stop messages do not exit the BIG-IP device after a client disconnects.

Conditions:
BIG-IP is configured with APM and multiple virtual servers and an iRule.

Impact:
RADIUS Accounting Stop is not sent.

Workaround:
None

---

962477-2 : REST calls that modify GTM objects as a user other than admin may take longer than expected

Links to More Info: BT962477

Component: TMOS

Symptoms:
After performing a REST call to modify a GTM object, subsequent requests may take longer than expected to complete. Delays of 800-1000ms are possible for a brief time after a GTM object is modified.

Conditions:
Modifying a GTM object with a user other than "admin". When a device is part of a GTM sync group.

Impact:
Slower than expected REST performance. Scripts that perform a series of modifications and subsequent queries could be heavily impacted.

Workaround:
Use the admin account or use transactions.

---

961653-3 : Unable to retrieve DNS link statistics via SNMP OID gtmLinkStatRate

Links to More Info: BT961653

Component: Local Traffic Manager

Symptoms:
Unable to retrieve link statistics via SNMP OID gtmLinkStatRate

config # snmpwalk -c public localhost F5-BIGIP-GLOBAL-MIB::gtmLinkStatRate
F5-BIGIP-GLOBAL-MIB::gtmLinkStatRate = No Such Object available on this agent at this OID

Conditions:
A BIG-IP DNS/LC system configured with link objects.

Try to do an snmpwalk for F5-BIGIP-GLOBAL-MIB::gtmLinkStatRate which is not successful.

Impact:
BIG-IP DNS system link statistics cannot be retrieved via SNMP.

Workaround:
No workaround.

---

961001-5 : Arp requests not resolved for snatpool members when primary blade goes offline

Links to More Info: BT961001

Component: Local Traffic Manager

Symptoms:
Arp requests not resolved for snatpool members and traffic does not go through when the primary blade becomes offline.

Conditions:
-- VIPRION platforms serving as AAA and Diameter virtual server to load-balance.
-- route-domain configured other than 0.
-- Radius authentication pool and snatpool are configured.
-- Primary blade goes offline and new Primary is not elected.

Impact:
Traffic failure when primary became offline.

Workaround:
Disable primary blade which is offline.

---

959965-1 : Asmlogd stops deleting old protobufs

Component: Application Security Manager

Symptoms:
Protobuf files are being cleaned only when trying to write to the protobuf file and on startup.

Conditions:
This occurs during normal operation.

Impact:
/var/asmdata1 can run out of disk space.

Workaround:
None

---

959957-1 : Asmlogd stops deleting old protobufs

Links to More Info: BT959957

Component: Application Security Manager

Symptoms:
Asmlogd restarts and there are asmlogd errors:

asmlogd|ERR|Oct 19 13:46:35.199|6005|,,asmlogd ended unexpectedly
asmlogd|ERR|Oct 19 13:46:35.203|6005|,,Can't call method "size" on an undefined value at /usr/local/share/perl5/F5/RequestLog.pm line 1902.

Conditions:
Disk is full -- the following warnings are being displayed:

err diskmonitor[3483]: 011d0004:3: Disk partition /var/asmdata1 (slot 1) has only 0% free

Impact:
Old protobuf files are not cleaned up.

Workaround:
0) If the /appdata partition is filled to 100% and MySQL restarts continuously, refer to the following Knowledge Articles:
   https://support.f5.com/csp/article/K14956
   https://support.f5.com/csp/article/K42497314

1) To identify the empty partitions, look into:
   SELECT * FROM INFORMATION_SCHEMA.PARTITIONS WHERE table_name = 'REQUEST_LOG' AND table_schema = 'PRX'＼G

2) For every partition that is empty, manually (or via shell script) execute this sql:
   ALTER TABLE PRX.REQUEST_LOG DROP PARTITION empty_partition_name
where 'empty_partition_name' is the partition name as 'p100001'

4) Increase 'open_files_limit' to '10000'.
--------------------------------
In the /etc/my.cnf file:
1. Change the value of the 'open_files_limit' parameter to 10000.
2. Restart MySQL:
   bigstart restart mysql
--------------------------------

5) pkill asmlogd

Note: This workaround does not survive upgrade. It must be reapplied after every upgrade until the upgraded version contains a fix.

---

959613-1 : Double-monitoring a generic-host virtual server might show blank 'Reason'

Links to More Info: BT959613

Component: Global Traffic Manager (DNS)

Symptoms:
When you double-monitor a Generic Host Virtual Server using the same monitor, the 'Reason' is omitted from the output:

-- Output of 'tmsh show gtm server <server> virtual-servers' shows a "blank" reason for monitoring failure/success.
-- If double-monitoring at pool level, the output of 'tmsh show gtm pool <type> <pool> members' shows a "blank" reason for monitoring failure/success.

Conditions:
-- Using the same monitor at virtual-server level and pool level
AND/OR:
-- Using the same monitor on two different pools (when monitoring the same virtual-server)

Impact:
Impedes your ability to identify the failure/success reason quickly.

Workaround:
-- Do not use the exact same monitor on both the virtual server and the pool level.
-- If double-monitoring at pool level, do not use the exact same monitor to monitor the same virtual-server on multiple pools.

---

959241-1 : Fix for ID871561 might not work as expected on the VCMP host

Links to More Info: BT959241

Component: TMOS

Symptoms:
Attempting to deploy an engineering hot fix (EHF) for ID871561 (https://cdn.f5.com/product/bugtracker/ID871561.html) fails in the same manner

Conditions:
-- Attempting to install an EHF containing a fix for ID871561 on a vCMP guest
-- The fix for ID871561 has not already been applied to the vCMP guest

Impact:
Unable to perform software installations on vCMP guests using installation media located on the vCMP host even if fix for ID871561 is available on VCMP guest.

Workaround:
Option 1:
===========
Make sure that the .iso files for both base image and engineering hotfix are copied to the vCMP guest (under /shared/images) before starting the installation. If installing the software from the command line, use syntax similar to the following:

tmsh install sys software hotfix <hotfix-image-name> volume <volume.name>

Option 2:
===========
Even if the engineering hotfix installation has failed, the base image should still have been installed properly. You can restart the vCMP guest and perform a hotfix installation on top of already installed base image, using syntax similar to the following:

tmsh install sys software hotfix <hotfix-image-name> volume <volume.name>

Option 3:
===========
Even if the engineering hotfix installation has failed, the base image should still have been installed properly. Ensure there is copy of the engineering hotfix image locally within the vCMP Guest.

Then restart the lind service on the vCMP Guest:
  tmsh restart sys service lind

If running the vCMP Guest on multiple slots, you may need to restart lind on all slots. From the primary slot on the vCMP Guest, run:
  clsh tmsh restart sys service lind

The hotfix installation should begin again, this time using the hotfix from within the /shared/images/ location on the vCMP Guest.

Option 4:
===========
Manually eject the CD from the vCMP guest's virtual CD drive, and then restart lind. On the vCMP Guest:

1. Confirm the wrong ISO image is still locked (inserted in the CD drive):
  isoinfo -d -i /dev/cdrom

Note: Pay attention to the volume ID in the output from within the vCMP guest.

2. Unlock (eject) the image:
  eject -r -F /dev/cdrom && vcmphc_tool -e

3. Verify the CD drive is now empty:
  isoinfo -d -i /dev/cdrom

The output should report an error that includes:
<...> Sense Code: 0x3A Qual 0x00 (medium not present) Fru 0x0 <…>

4. Restart lind:
  tmsh restart sys service lind

If running the vCMP Guest on multiple slots, you may need to restart lind on all vCMP Guest slots. From the primary slot on the vCMP Guest, run:
  clsh tmsh restart sys service lind

---

959057-5 : Unable to create additional login tokens for the default admin user account

Links to More Info: BT959057

Component: TMOS

Symptoms:
When remote user authentication is configured, BIG-IP systems apply maximum active login token limitation of 100 to the default admin user account.

Conditions:
Remote Authentication is configured

Impact:
Unable to create more than 100 tokens for admin when remote authentication is configured

---

958785-8 : FTP data transfer does not complete after QUIT signal

Links to More Info: BT958785

Component: Local Traffic Manager

Symptoms:
When a QUIT signal is sent over an FTP connection to an FTP virtual server during a data transfer, the data connection is closed immediately instead of waiting until the transfer is complete.

Conditions:
- BIG-IP configured with an FTP virtual server
- A client connects to the FTP virtual server
- Client starts an FTP data transfer
- Client sends a QUIT signal before the data transfer completes.

Impact:
FTP data connections are closed prematurely, causing incomplete data transfers.

Workaround:
This does not occur if the FTP profile for the FTP virtual server has inherit-parent-profile set to enable.

---

958773-2 : [SAML SP] Assertion canonicalization fails if <AttributeValue> contains spaces.

Links to More Info: BT958773

Component: Access Policy Manager

Symptoms:
In /var/log/apm

[apmd]modules/Authentication/Saml/SamlSPAgent.cpp: 'verifyAssertionSignature()': 5883: Verification of SAML signature #1 failed
[apmd]SAML Agent: /Common/xxxxxx failed to process signed assertion, error: Digest of SignedInfo mismatch

Conditions:
SAML attribute values have double-byte spaces.

Impact:
Verification of SAML signature fails.

Workaround:
Remove double-byte spaces from SAML Attribute values (consult a vendor who populates SAML attribute values for advice on how to remove double-byte spaces).

---

958601-4 : In the GUI, searching for virtual server addresses does not match address lists

Links to More Info: BT958601

Component: TMOS

Symptoms:
In the GUI, if you filter the virtual server listing using an IP address, or part of an IP address, if there are any virtual servers that are using an address list that contains an address that matches that search string, those virtual servers will not show up in the search results.

Similarly, if you filter the virtual server listing using an IP address, or part of an IP address, if there are any virtual servers that are using an address that matches the search string, but are using a port list, those virtual servers will not show up in the search results.

Conditions:
-- Using Address Lists or Port lists with a virtual server.
-- Using the GUI to search for virtual servers based on address.

Impact:
Virtual servers that should match a search are not found.

Workaround:
None.

---

958157-4 : Hash collisions in DNS rapid-response packet processing

Links to More Info: BT958157

Component: Global Traffic Manager (DNS)

Symptoms:
DNS rapid-response (FastDNS) packet processing may cause unexpected traffic drops.

Conditions:
- DNS rapid-response is enabled in a DNS profile:

ltm profile dns dns {
    enable-rapid-response yes
}

Note: This issue is more likely to occur on systems with a lower number of TMMs.

Impact:
Unexpected traffic drops

---

957993-4 : Unable to set a port list in the GUI for an IPv6 address for a virtual server

Links to More Info: BT957993

Component: TMOS

Symptoms:
When creating a virtual server in the GUI with an IPv6 destination address and a port list (shared object) or a source address list (shared object), the system returns an error similar to:

0107028f:3: The destination (0.0.0.0) address and mask (ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff) for virtual server (/Common/vs03-v6_dns) must be be the same type (IPv4 or IPv6).

Conditions:
-- Creating or updating a virtual server.
-- Attempting to use an IPv6 Host address with a Port List shared object or a Source Address List shared object.

Impact:
Unable to create/modify virtual server.

Workaround:
Create an Address List shared object with the IPv6 address in it and use that instead of the Host address.

---

955953-5 : iRule command 'table' fails to resume when used with Diameter 'irule_scope_msg'

Links to More Info: BT955953

Component: TMOS

Symptoms:
'table' command fails to resume causing processing of traffic to halt due to 'irule_scope_msg' causing iRule processing to proceed in a way that 'table' does not expect.

Conditions:
- iRule using 'table' command
- Diameter 'irule_scope_msg' enabled

Impact:
Traffic processing halts (no crash)

---

955773-3 : Fw_lsn_pool_pba_stat: excessively high active_port_blocks stat for IPv4

Links to More Info: BT955773

Component: Advanced Firewall Manager

Symptoms:
TMM specific stats shows unrealistic values.

Conditions:
The respective TMMs have shortage of NAT PBAs.

Impact:
No functional impact. Only on stats reporting side impact.

---

953477-1 : Syncookie HW mode not cleared when modifying VLAN config.

Links to More Info: BT953477

Component: TMOS

Symptoms:
Changing VLAN configuration can cause BIG-IP get stuck in hardware syncookie mode.

Conditions:
- Changing VLAN configuration when vlan-based syncookies are active.

For a list of platforms that support hardware syncookie protection, see https://support.f5.com/csp/article/K14779

Impact:
Device is stuck in hardware syncookie mode and generates syncookies.

Workaround:
Run the following command:
tmsh restart sys service tmm

Impact of workaround: restarting tmm disrupts traffic.

---

950953-3 : Browser Challenges update file cannot be installed after upgrade★

Links to More Info: BT950953

Component: Application Security Manager

Symptoms:
After upgrading BIG-IP, the Browser Challenges factory default update file cannot be installed, and you see this error:

Installation error: gpg: WARNING: unsafe ownership on homedir `/usr/share/live-update/share/gpg/browser_challenges_genesis_load'gpg: encrypted with 1024-bit ELG key, ID 7C3E3CE5, created 2007-03-20 "asm_sigfile_installer"gpg: Signature made Mon Aug 2

Conditions:
The new file that comes with the installation is ready to install

Impact:
New updated cannot be installed

Workaround:
There are 2 options:
1. download a new version of the update file (if exists)
2.
   2.1 download a copy of that file from the machine to your locale machine
   2.2 rename it :
       > cp BrowserChallenges_20200722_072935.im BrowserChallenges_<CURRENT_DATE>_<CURRENT_TIME>.im
       ## the date and time are for tracking and the have to be in a specific format DATE : YYYYMMDD, TIME: HHMMSS
   2.3 upload the file and install it manually from the LiveUpdate screen.

---

950305-5 : Analytics data not displayed for Pool Names

Links to More Info: BT950305

Component: Application Visibility and Reporting

Symptoms:
You cannot see reports (statistics->analytics->pool) when you choose to view by pool names.

Conditions:
This is encountered in the statistics screen.

Impact:
You can't see the statistics->analytics->pool report when you choose view by pool names.

---

950153-3 : LDAP remote authentication fails when empty attribute is returned

Links to More Info: BT950153

Component: TMOS

Symptoms:
LDAP/AD Remote authentication fails and the authenticating service may crash.

The failure might be intermittent.

Conditions:
LDAP/AD server SearchResEntry includes attribute with empty or NULL value.

This can be seen in tcpdump of the LDAP communication in following ways

1. No Value for attribute . Example in tcpdump taken on affected user :

vals: 1 item
        AttributeValue:

2. 1. NULL Value for attribute . Example in tcpdump taken on affected user :

vals: 1 item
    AttributeValue: 00

Impact:
Logging in via the GUI will fail silently
Logging in via ssh will cause the sshd service on LTM to crash and logs will be seen under /var/log/kern.log

The logs will be similar to :

info kernel: : [460810.000004] sshd[31600]: segfault at 0 ip 00002b3abcb2ef3e sp 00007fffef3431a0 error 4 in pam_ldap.so[2b3abcb2c000+7000]
info kernel: : [460810.002036] traps: sshd[31598] general protection ip:fffffffffffffff3 sp:80000 error:0

Workaround:
There is no Workaround on the LTM side.

For LDAP, you change/add the value from none/NULL on the affected attribute to ANY dummy value which will prevent the issue

---

949593-5 : Unable to load config if AVR widgets were created under '[All]' partition★

Links to More Info: BT949593

Component: Application Visibility and Reporting

Symptoms:
When upgrading to or loading saved configuration on BIG-IP software v13.0.0 or later, if the configuration contains AVR widgets created under a partition of '[All]', the config load fails.

Conditions:
This occurs if one or more AVR widgets in the configuration was created under the read-only '[All]' pseudo-partition.
This could have occurred if you were running a version of BIG-IP which did not include the fix for ID 721408.

Impact:
Upgrading to or loading an affected configuration on BIG-IP v13.x or later fails.

Workaround:
Manually edit the /config/bigip.conf configuration file and change '[All]' to 'Common':

# sed -i 's/＼＼＼[All＼]/Common/g' /config/bigip.conf
# tmsh load sys config
# tmsh save sys config

This should be done before upgrading to BIG-IP v13.x or later, or before saving configuration to be loaded later, or before loading a saved configuration from the config files.

---

949477-4 : NTLM RPC exception: Failed to verify checksum of the packet

Links to More Info: BT949477

Component: Access Policy Manager

Symptoms:
NTLM authentication fails with the error:

RPC exception: Failed to verify checksum of the packet.

Conditions:
-- Start nlad process with 'encryption'.
-- Configure a user, and map that user to a huge number of groups.
-- Configure NTLM front-end authentication.

Impact:
User authentication fails.

Workaround:
1. Run the 'nlad' process with '-encrypt no' in the file /etc/bigstart/startup/nlad.

2. Disable encryption for nlad:
   # vim /etc/bigstart/startup/nlad

   change:
   exec /usr/bin/${service} -use-log-tag 01620000

   to:
   exec /usr/bin/${service} -use-log-tag 01620000 -encrypt no

3. Restart nlad to make the change effective, and to force the schannel to be re-established:
   # bigstart restart nlad

---

949137-1 : Clusterd crash and vCMP guest failover

Links to More Info: BT949137

Component: Local Traffic Manager

Symptoms:
Clusterd crashes and a vCMP guest fails over.

Conditions:
The exact conditions under which this occurs are unknown. It can occur during normal operation.

Impact:
Memory corruption and clusterd can crash, causing failover.

Workaround:
None.

---

948601-1 : File object checksum attribute is not updated when an external data-group file or external monitor file is edited from GU

Links to More Info: BT948601

Component: TMOS

Symptoms:
SHA1 checksum attribute/property of the file object is not persisted/published/propagated to the MCP datastore/GUI.

Conditions:
This could be observed when an external data-group file or external monitor file definition is edited from GUI.
Below mentioned is the workflow where the issue can be seen/replicated,
System ›› File Management : Data Group File List >> FILE
Edit the "definition" field of the file object & click update.
1.) edit sys file data-group "filename"
2.) list sys file data-group "filename"
Aforementioned commands can be used from TMOS shell to understand the correct behavior that is expected when the same is done from GUI

Impact:
You are unable to identify whether the file object was modified by just validating/comparing the file object's metadata/schema property i.e. "checksum SHA1"

Workaround:
None

---

947745-3 : Tcp proxy does not ignore HUDEVT_CHILD_CONNECTED and gives an error

Links to More Info: BT947745

Component: Local Traffic Manager

Symptoms:
Tcp proxy does not ignore HUDEVT_CHILD_CONNECTED and gives an error message:
hud_tcp_serverside_handler/3676: 10.0.0.20.21 - 10.10.10.1.51147: unexpected serverside message HUDEVT_CHILD_CONNECTE

Conditions:
FTP profile is in use

Impact:
Logs entries in the log file

Workaround:
None

---

947613-2 : APM reset after upgrade and modify of LDAP Group Lookup★

Links to More Info: BT947613

Component: Access Policy Manager

Symptoms:
-- Per-Request Policy fails.
-- APM reset the connection.

Conditions:
Upgrade from 13.1.3.4 to 15.1.0.4 and modify the LDAP Group Lookup.

Impact:
APM resets the connection.

Workaround:
1. Create a new empty object with the same expression as the LDAP Group Lookup.
2. Remove the LDAP Query Agent.
3. Restart the system:
bigstart restart tmm

---

947217-6 : Fix of ID722682 prevents GTM config load when the virtual server name contains a colon★

Links to More Info: BT947217

Component: Global Traffic Manager (DNS)

Symptoms:
GTM is unable to load the configuration.

Conditions:
-- GTM has been upgraded to a version with fix for ID722682 from a version that does not have the fix for ID722682
-- A GTM server has a name with no colon
-- That GTM server has a virtual server with colon in the name
-- That virtual server is added to a pool

Impact:
GTM config file cannot be loaded successfully after upgrade.

Workaround:
Edit bigip_gtm.conf manually to delete "＼＼" or replace colon ":" with other non-reserved char. such as "-".

---

945413-2 : Loop between keymgmtd and mcpd causes BIG-IP to be out of sync or in constant automatic config sync

Links to More Info: BT945413

Component: TMOS

Symptoms:
The BIG-IP system constantly downloads the certificate bundle if the CA-bundle manager config includes a URL.

Symptoms are different depending on if BIG-IP systems is in a manual or automatic sync device group.

Manual sync device groups will not stay in sync.

Automatic sync device groups will constantly sync.

Conditions:
The CA-bundle manager is configured.

Impact:
The keymgmtd and mcpd process gets into a loop that causes constant config changes and if the ca-bundle-manager includes a URL, the BIG-IP system constantly downloads the bundle.

---

945189-5 : HTTPS monitor fails due to missing ECDHE-RSA-AES256-CBC-SHA★

Links to More Info: BT945189

Component: Local Traffic Manager

Symptoms:
After upgrade, the 'DEFAULT' cipher in the server SSL profile attached to the HTTPS monitor does not include the ECDHE-RSA-AES256-CBC-SHA cipher suite in the Client Hello.

Conditions:
After upgrade, HTTPS monitor cipherlist is read from server SSL profile ciphers and set to DEFAULT after upgrade.

Impact:
1. Upgrade breaks the SSL pool monitoring.
2. It is also possible that the pools monitoring succeeds but with unexpected ciphers from the 'DEFAULT' list which may cause increased resource usage or unexpectedly weaker encryption.

Note: The ciphers negotiated between the HTTPS backend being monitored and the server SSL profile will still belong to the 'DEFAULT' list.

Workaround:
BIG-IP provides ways to customize the cipher string used by the server SSL profile.

Via the configuration utility:
https://techdocs.f5.com/en-us/bigip-15-0-0/big-ip-ltm-configuring-custom-cipher-string-for-ssl-negotiation/configuring-a-custom-cipher-string-for-ssl-negotiation.html

Via tmsh commands:
https://support.f5.com/csp/article/K65292843

---

944173-4 : SSL monitor stuck does not change TLS version

Links to More Info: BT944173

Component: Local Traffic Manager

Symptoms:
The SSL monitor remains in the current TLS version and does not switch to another version when a server changes.

Conditions:
-- SSL monitor configured.
-- Server configuration changes from TLSv1.2 to TLSv1.

Impact:
Pool members marked down.

Workaround:
Use the In-TMM monitor.

---

943441-4 : Issues in verification of Bot Defense with F5 Anti-Bot Mobile SDK

Links to More Info: BT943441

Component: Application Security Manager

Symptoms:
Verification may be incomplete when using the F5 Anti-Bot Mobile SDK with the Bot Defense profile.

Conditions:
-- Using the Bot Defense profile together with the F5 Anti-Bot Mobile SDK.
-- Enabling the Mobile Applications section in the profile.

Impact:
Mobile application verification may be incomplete.

Workaround:
None

---

942729-3 : Export of big Access Policy config from GUI can fail

Component: Access Policy Manager

Symptoms:
Export of Access Policy times out after five minutes and fails via the GUI

Conditions:
Exact conditions are unknown, but it occurs while handling a large access policy.

Impact:
Unable to redeploy configuration

Workaround:
Use thge cli to export the access policy:

K30575107: Overview of the ng_export, ng_import and ng_profile commands
https://support.f5.com/csp/article/K30575107

---

942217-6 : Virtual server rejects connections even though the virtual status is 'available'

Links to More Info: BT942217

Component: TMOS

Symptoms:
With certain configurations, a virtual server keeps rejecting connections with reset cause 'VIP down' after 'trigger' events occur.

Conditions:
Required Configuration:

-- On the virtual server, the service-down-immediate-action is set to 'reset' or 'drop' and 'connection-limit' to be any (not 0).

-- The pool member has rate-limit enabled.

Required Conditions:

-- Monitor flap, or adding/removing monitor or set the connection limit to be zero or configuration change made with service-down-immediate-action.

-- At that time, one of the above events occur, the pool member's rate-limit is active.

Impact:
Virtual server keeps rejecting connections.

Workaround:
Delete one of the conditions.

Note: The affected virtual server may automatically recover upon the subsequent monitor flap, etc., if no rate-limit is activated at that time.

---

941961-4 : Upgrading system using WAM TCP profiles may prevent the configuration from loading

Links to More Info: BT941961

Component: WebAccelerator

Symptoms:
If a BIG-IP is on version 13.1.0 through 15.1.x and has profiles in use that use wam-tcp-wan-optimized and/or wam-tcp-lan-optimized as parent profiles, then when the configuration is upgraded to 16.0.0, the configuration fails to load, with an error similar to:

err mcpd[10087]: 01020036:3: The requested parent profile (/Common/wam-tcp-wan-optimized) was not found.

Conditions:
-- Upgrading from version 13.1.0 through 15.1.x.
-- Using profiles derived from wam-tcp-wan-optimized and/or wam-tcp-lan-optimized.

Impact:
Configuration does not load.

Workaround:
Remove these profiles and adjust the configuration elements that use them accordingly.

Here are two examples:

-- Copy the definition of 'wam-tcp-wan-optimized' from /defaults/wam_base.conf into /config/bigip.conf, and then reload the configuration.

-- Change the references to wam-tcp-wan-optimized to something else in your config file (e.g., tcp-wan-optimized), and then reload the configuration.

---

941773-1 : Video resolution mis-prediction

Links to More Info: BT941773

Component: Traffic Classification Engine

Symptoms:
Certain video traffic is not getting classified with high accuracy.

Conditions:
- Behavioral classifier for Classification Engine is enabled

Impact:
- Mis-predictions can lead to higher definition videos being categorized as low-definition videos and vice versa.

---

941765-1 : Video resolution mis-predictions

Links to More Info: BT941765

Component: Traffic Classification Engine

Symptoms:
BIG-IP's traffic playback resolution prediction is calculated on all individual connections of a client's video stream.

Conditions:
- Video streaming client downloads through BIG-IP
- Video is downloaded using multiple connections.

Impact:
- Mis-prediction in the video resolution.

---

940837-4 : The iRule command node is not triggered in CLIENT_ACCEPTED with HTTP/2.

Links to More Info: BT940837

Component: Local Traffic Manager

Symptoms:
The node iRule command causes the specified server node to be used directly, thus bypassing any load-balancing. However, with HTTP/2, the node command may fail to execute within the CLIENT_ACCEPTED event. This results in no traffic being sent to configured node.

Conditions:
-- A node command is used under CLIENT_ACCEPTED event.
-- An HTTP/2 profile applied to virtual server.
-- The HTTP/2 protocol in use.

Impact:
With HTTP/2 configured, the iRule node command fails to execute within the CLIENT_ACCEPTED event, causing no traffic to be sent to the desired node.

Workaround:
As a workaround, you may use HTTP_REQUEST event instead of CLIENT_ACCEPTED in iRule syntax.

---

940733-5 : Downgrading a FIPS-enabled BIG-IP system or running big3d_install results in a system halt★

Links to More Info: BT940733

Component: Global Traffic Manager (DNS)

Symptoms:
The system fails during the boot-up process, reports a libcrypto validation error, and the system halts. The console will show this error:

Power-up self-test failures:
OpenSSL: Integrity test failed for libcrypto.so

This occurs after one of the following:
-- Upgrading a FIPS-enabled BIG-IP system, booting to a volume running an earlier software version
-- Running big3d_install from a BIG-IP GTM configuration to a BIG-IP LTM


On a FIPS-licensed BIG-IP LTM configuration, when checking the big3d version you may see something similar to this:

 /shared/bin/big3d -V
fips.c:204:f5_get_library_path: failed to dlopen libcrypto.so.1.0.2za
./big3d version big3d Version 17.0.0.0.0.22 for linux

Conditions:
-- FIPS-licensed BIG-IP system.
-- Upgrade.
-- Boot into a volume running an earlier version of the software.

Another way to encounter the issue is:

-- FIPS-licensed BIG-IP LTM.
-- BIG-IP DNS (GTM) device running a higher software version than the LTM.
-- Run big3d_install from a BIG-IP GTM-configuration pointing to FIPS-licensed BIG-IP LTM configuration.

Impact:
System boots to a halted state or big3d may continuously restart.

Workaround:
Before booting to the volume with the earlier version, delete /shared/bin/big3d.

Note: This issue might have ramifications for DNS/GTM support. DNS/GTM is not FIPS-certified.

If the target software volume has already experienced this issue (the system boots to a halted state), addition to deleting /shared/bin/big3d, follow the instructions in K25205233: BIG-IP System halted while booting. Halt at boot after FIPS Integrity Check Result FAIL :: https://support.f5.com/csp/article/K25205233 .

For additional information, see K29290121: Rollback after upgrade or big3d_install may cause FIPS to halt system on boot :: https://support.f5.com/csp/article/K29290121.

---

939933-7 : Monpd restarts every few seconds due to missing of AVR database

Links to More Info: BT939933

Component: Application Visibility and Reporting

Symptoms:
The database was not created by monpd, because the ‘init_avrdb’ file was not under the /var/avr.

Conditions:
The monpd is down after booting into HD1.2 on 2 slots.

Impact:
Clearing AVR database will remove all existing statistics data.

Workaround:
1. Stop monpd: bigstart stop monpd
2. Clean data base: touch /var/avr/init_avrdb
3. Clean the statistics file are waiting to be loaded:
   cd /var/avr/loader
   rm -rf *
4. Start monpd: bigstart start monpd

---

939249-1 : iSeries LCD changes to secure mode after multiple reboots

Links to More Info: BT939249

Component: TMOS

Symptoms:
After repeatedly rebooting an iSeries platform, the LCD can become erroneously set to secure mode on its own, and you are unable to use the menus on the LCD.

Conditions:
-- Repeated reboots of the device.
-- The db lcd.showmenu value initially set to enable are required.
-- Other required conditions are not fully known.

Impact:
-- LCD becomes set to secure mode.
-- The bigdb variable lcd.showmenu is changed to 'disable'.

Workaround:
Run the commands:
tmsh modify sys db lcd.showmenu value disable
tmsh modify sys db lcd.showmenu value enable

This clears the secure mode of the LCD.

---

938545-1 : Oversize plugin Tcl object results can result in 0-length messages and plugin crash

Links to More Info: BT938545

Component: Local Traffic Manager

Symptoms:
Bd crashes.

Conditions:
-- ASM enabled.
-- iRule used.
-- Command arguments are greater than maximum MPI message size.

Impact:
ASM traffic disrupted while bd restarts.

Workaround:
None.

---

938145-3 : DAG redirects packets to non-existent tmm

Links to More Info: BT938145

Component: TMOS

Symptoms:
-- Connections to self-IP addresses may fail.
-- SYNs packets arrive but are never directed to the Linux host.

Conditions:
-- Provision as vCMP dedicated host.
-- Create a self-IP address with appropriate allow-service.

Impact:
Repeated attempts to connect to the self-IP (e.g., via ssh) fail.

Workaround:
None

---

937665-1 : Relaystate in SLO request results in two Relaystates in SLO Response

Links to More Info: BT937665

Component: Access Policy Manager

Symptoms:
When BIG-IP APM acts as the SAML IdP and receives a redirect binding single logout (SLO) request that contains a relaystate, the BIG-IP APM generates an SLO response that contains two relaystates.

Conditions:
-- BIG-IP APM configured as IdP
-- Redirect binding SLO request contains a relaystate

Impact:
SLO processing on SP may not work.

Workaround:
None.

---

937573-1 : Connections drop in virtual server with Immediate Action On Service Down set to Drop

Links to More Info: BT937573

Component: Local Traffic Manager

Symptoms:
In a virtual server configured with Immediate Action On Service Down set to Drop and an iRule to pick a pool different from the one attached to the virtual server, if the default pool is attached in an offline state, connections are always dropped even when the default pool becomes available later.

Conditions:
- Virtual server configured with Immediate Action On Service Down set to Drop.
- An iRule selects a different pool from the one attached to the virtual server.

Impact:
Connections are silently dropped.

Workaround:
Change the virtual server's Immediate Action On Service Down setting to None.

---

937481-5 : Tomcat restarts with error java.lang.OutOfMemoryError

Links to More Info: BT937481

Component: TMOS

Symptoms:
In the GUI, while trying to list a large configuration, tomcat restarts with error java.lang.OutOfMemoryError: Java heap space due to a large read operation.

Conditions:
-- From the GUI, navigate to Local Traffic :: Pools :: Pool List.
-- The configuration contains approximately 10,000 objects (objects include pools, nodes, virtual servers, etc.).

Impact:
When the system attempts to list the large configuration, tomcat restarts, resulting in 503 error.

Workaround:
Use the provision.tomcat.extramb database variable to increase the maximum amount of Java virtual memory available to the tomcat process.

Impact of workaround: Allocating additional memory to Apache Tomcat may impact the performance and stability of the BIG-IP system. You should perform this procedure only when directed by F5 Technical Support after considering the impact to Linux host memory resources.

-- Using a utility such as free or top, determine if you have enough free memory available to use this procedure.

For example, the following output from the free utility shows 686844 kilobytes available:
total used free shared buffers cachedMem:
16472868 15786024 686844 807340 827748 2543836
-/+ buffers/cache: 12414440 4058428
Swap: 1023996 0 1023996

-- View the current amount of memory allocated to the tomcat process by typing one of the following commands:
ps | grep " -client" | egrep -o Xmx'[0-9]{1,5}m'

The command output appears similar to the following example:

Xmx260m
Xmx260m

-- View the current value of the provision.tomcat.extramb database variable by typing the following command
tmsh list /sys db provision.tomcat.extramb

-- Set the provision.tomcat.extramb database variable to the desired amount of additional memory to be allocated using the following command syntax:
modify /sys db provision.tomcat.extramb value <MB>

-- If the device is part of a high availability (HA) configuration, the provision.tomcat.extramb database value should be synchronized to the peer devices from the command line. To run the ConfigSync process, use the following command syntax:
tmsh run /cm config-sync <sync_direction> <sync_group>

For example, the following command pushes the local device's configuration to remote devices in the Syncfailover device group:

tmsh run /cm config-sync to-group Syncfailover

-- Restart the tomcat process by typing the following command:
restart /sys service tomcat

---

936777-1 : Old local config is synced to other devices in the sync group.

Links to More Info: BT936777

Component: Global Traffic Manager (DNS)

Symptoms:
Newly added DNS/GTM device may sync old local config to other devices in the sync group.

Conditions:
Newly added DNS/GTM device has a more recent change than other devices in the sync group.

Impact:
Config on other DNS/GTM devices in the sync group are lost.

Workaround:
You can use either of the following workarounds:

-- Make a small DNS/GTM configuration change before adding new devices to the sync group.

-- Make a small DNS/GTM configuration change on the newly added device to re-sync the correct config to other DNS/GTM devices.

---

936417-4 : DNS/GTM daemon big3d does not accept ECDHE or DHE ciphers

Links to More Info: BT936417

Component: Global Traffic Manager (DNS)

Symptoms:
The DNS/GTM big3d daemon does not accept ECDHE or DHE ciphers.

Conditions:
Connections to big3d with ECDHE or DHE ciphers.

Impact:
ECDHE/DHE ciphers do not work with big3d.

Workaround:
Configure ciphers with RSA key exchange.

---

936361-2 : IPv6-based bind (named) views do not work

Links to More Info: BT936361

Component: Global Traffic Manager (DNS)

Symptoms:
Bind does not match IPv6 addresses configured for a zone view, and returns REFUSED responses, rather than the
expected answers.

After enabling debug logging in bind (see K14680), the apparent source address of the IPv6 DNS requests shows as being in the fe80::/96 range, rather than the IPv6 source address that sent the request.

For example:

debug 1: client @0x579bf188 fe80::201:23ff:fe45:6701%10#4299: no matching view in class 'IN'

Conditions:
- BIG-IP DNS is provsioned
- One or more ZoneRunner views is defined using IPv6 addresses.
- A DNS query is sent from an IPv6 source address

Impact:
You cannot use DNS views in bind (zonerunner) based on IPv6 addresses.

Workaround:
If possible, use only IPv4 addresses to define views for DNS queries

---

936061-3 : Variable session.user.agent missing for Edge Client & F5 Access clients

Links to More Info: BT936061

Component: Access Policy Manager

Symptoms:
When connecting with Edge Client & F5 Access clients the BIG-IP APM session variable session.user.agent is missing from APM sessions.

Conditions:
BIG-IP APM
Edge Client & F5 Access clients

Impact:
Session variable session.user.agent cannot be used for BIG-IP APM Access Policy logic flows

Workaround:
An iRule can be used to generate a like session variable. For example:

# This event fires once per session
when ACCESS_SESSION_STARTED {
  log local0. "Setting User-Agent based on HTTP data - [HTTP::header User-Agent]"
  ACCESS::session data set session.custom.client.useragent [HTTP::header User-Agent]
  #Use this variable in the VPE to make some decision
}

---

935769-5 : Upgrading / Rebooting BIG-IP with huge address-list configuration takes a long time★

Links to More Info: BT935769

Component: Advanced Firewall Manager

Symptoms:
Version upgrade takes more time than usual when the config contains address-lists with a lot of IP addresses. The same delay will be observed with 'tmsh load sys config' as well.

Conditions:
-- Configure address-list with 10K to 20K IP addresses or address ranges or subnets.
-- Configuration loading (e.g. Post upgrade, running tmsh load sys config, modification of the configuration and subsequent full load as in full config sync)

Impact:
Version upgrade / 'tmsh load sys config' process takes a long time than usual.

Workaround:
1) Convert continuous individual addresses in the address-lists to IP address ranges and subnets if possible.

2) Remove the huge address-lists from config before the upgrade and add back after the upgrade process is finished.

3) Upgrading to a release or EHF that contains the fix for 1209409. 1209409 does not eliminate the issue but it does reduce the time it takes to validate certain address lists.

---

935485-4 : BWC: flows might stall when using dynamic BWC policy

Links to More Info: BT935485

Component: TMOS

Symptoms:
When multiple flows are passing through the single instance of BWC policy, one or more flows might stall for a few seconds or more. The fairness among the flows is also affected.

Conditions:
-- BWC dynamic policy is enabled.
-- Multiple flows are passing through a single instance of the BWC dynamic policy.

Impact:
Some of the flows may stall.

Workaround:
None.

---

934825-2 : Restarting MCPD via command line may not restart the aced process

Links to More Info: BT934825

Component: Access Policy Manager

Symptoms:
Configurations with secure ID authentication may face issues after restarting MCPD using the command line (bigstart restart mcpd).

Conditions:
Executing the "bigstart restart mcpd" from command line does not always restart the aced process.

Impact:
Configurations with secure ID authentication may face issues after restarting MCPD and may not restart the aced process.

Workaround:
"bigstart restart mcpd" is not the recommended way to restart MCPD. Please restart the BIG-IP system to reflect any changes you have made.

---

934133-3 : Unable to Create/delete ltm virtual server via CLI transaction when destination is not specified on the ltm virtual object

Links to More Info: BT934133

Component: TMOS

Symptoms:
A CLI transaction fails with an error:

transaction failed: 0107028f:3: The destination (::) address and mask (255.255.255.255) for virtual server (/Common/foo) must be be the same type (IPv4 or IPv6).

Conditions:
-- A CLI transaction is used to create or delete a virtual server
-- When destination is not specified.
-- The virtual server references a traffic matching criteria

Impact:
The transaction fails with error and the virtual server is not created/deleted.

Workaround:
None

---

933777-5 : Context use and syntax changes clarification

Links to More Info: BT933777

Component: Application Visibility and Reporting

Symptoms:
There are two context and syntax-related issues:

-- In v14.x, the context for tmsh analytics commands related to server side connections changed. For example, 'total-server-side-conns' became a simple 'server-side-conns'.

-- In v13.x and 14.x, the calculation method for 'max-tps' changed from cumulative to commutative.

Conditions:
This occurs in either of the following scenarios:
-- Using tmsh analytics commands related to max-tps in v13.x or later.
-- Using tmsh analytics commands related to server side connections in BIG-IP v14.x and later.

Impact:
Stats names do not reflect their actual values. The 'max-tps' value is no longer valid for client IP context. These changes might have varied impacts, depending on your configuration.

Workaround:
None

---

933597-5 : Mandatory arguments missing in tmsh security protocol-inspection profile help

Links to More Info: BT933597

Component: TMOS

Symptoms:
Missing mandatory arguments for tmsh security protocol-inspection profile command list.

Conditions:
Profile - Configures the protocol inspection profiles
Module - security protocol-inspection profile

Impact:
Tmsh does not specify the mandatory arguments, which makes it difficult to write any script or automate the tmsh command around this security profile.

Workaround:
Specify the following arguments for this profile:

-- Ports

---

932553-6 : An HTTP request is not served when a remote logging server is down

Links to More Info: BT932553

Component: Local Traffic Manager

Symptoms:
BIG-IP systems provide an option to sanitize HTTP traffic via the http_security profile. When the profile is configured to alarm on a violation, it is possible that a connection to the violating client is reset if a remote logging server is marked down.

Conditions:
-- A BIG-IP system has an HTTP profile and and an http_security profile with the alarm option set.
-- A remote logging server is configured via a BIG-IP pool.
-- The pool has a monitor that marks all the pool members down.
-- A request with an HTTP violation is processed and triggers an alarm configured in the http_security profile.

Impact:
-- A TCP connection to a client is reset by the BIG-IP system.
-- The web page may not render, or may not render as expected.
-- Data are not delivered to a server with a POST request.

Workaround:
None.

---

932461-5 : Cert update on server SSL profile on HTTPS monitor: BIG-IP not using the updated certificate.

Links to More Info: BT932461

Component: Local Traffic Manager

Symptoms:
If you overwrite the certificate that is configured on the server SSL profile and used with the HTTPS monitor, the BIG-IP system still uses an old certificate.

After you update the certificate, the stored certificate is incremented, but monitor logging indicates it is still using the old certificate.

Conditions:
--Create a pool with an HTTPS pool member.
--Create an HTTPS monitor with cert and key.
--Assign the HTTPS monitor to the HTTPS pool.
--Update the certificate via GUI or tmsh.

Impact:
The monitor still tries to use the old certificate, even after the update.

Workaround:
Use either of the following workarounds:

-- Restart bigd:
bigstart restart bigd

-- Modify the server SSL profile cert key, set it to 'none', and switch back to the original cert key name.

The bigd utility successfully loads the new certificate file.

---

932193-1 : Improper handling of multiple cookie headers results in security bypass

Links to More Info: BT932193

Component: Application Security Manager

Symptoms:
Improper handling of multiple cookies results in security bypass when certain server technologies are used. The multiple cookie headers are handled separately in ASM, but the backend server concatenates it and can lead to potential signature attacks.

Conditions:
When PHP server technology is used as backend and a specially crafted request is sent with multiple cookies header.

Impact:
Bypass of negative security enforcement and can affect certain server technologies

---

932189-1 : Incorrect BD Swap Size units on ASM Resources chart

Links to More Info: BT932189

Component: Application Visibility and Reporting

Symptoms:
The 'BD Swap Size' reported on the 'Security :: Reporting : ASM Resources : Memory Utilization' page is much too high and incorrect.

Conditions:
ASM provisioned.

Impact:
Graphically reported BD swap memory usage is incorrect.

Workaround:
None.

---

931797-3 : LTM virtual address netmask does not persist after a reboot

Links to More Info: BT931797

Component: TMOS

Symptoms:
The virtual address netmask is missing after the system reboots.

Conditions:
When referencing an "ltm traffic-matching-criteria" object from the virtual server.

Impact:
Netmask address is set to 'any' after the system reboots.

Workaround:
None

---

931149-3 : Some RESOLV::lookup queries, including PTR lookups for RFC1918 addresses, return empty strings

Links to More Info: BT931149

Component: Global Traffic Manager (DNS)

Symptoms:
RESOLV::lookup returns an empty string.

Conditions:
The name being looked up falls into one of these categories:

-- Forward DNS lookups in these zones:
    - localhost
    - onion
    - test
    - invalid

-- Reverse DNS lookups for:
    - 127.0.0.0/8
    - ::1
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
    - 0.0.0.0/8
    - 169.254.0.0/16
    - 192.0.2.0/24
    - 198.51.100.0/24
    - 203.0.113.0/24
    - 255.255.255.255/32
    - 100.64.0.0/10
    - fd00::/8
    - fe80::/10
    - 2001:db8::/32
    - ::/64

Impact:
RESOLV::lookup fails.

Workaround:
Use a DNS Resolver ('net dns') and RESOLVER::name_lookup / DNSMSG:: instead of RESOLV::lookup:

1. Configure a local 'net dns' resolver, replacing '192.88.99.1' with the IP address of your DNS resolver:

    tmsh create net dns-resolver resolver-for-irules answer-default-zones no forward-zones add { . { nameservers add { 192.0.2.1:53 } } }

2. Use an iRule procedure similar to this to perform PTR lookups for IPv4 addresses:

proc resolv_ptr_v4 { addr_v4 } {
    # Convert $addr_v4 into its constituent bytes
    set ret [scan $addr_v4 {%d.%d.%d.%d} a b c d]
    if { $ret != 4 } {
        return
    }

    # Perform a PTR lookup on the IP address $addr_v4, and return the first answer
    set ret [RESOLVER::name_lookup "/Common/resolver-for-irules" "$d.$c.$b.$a.in-addr.arpa" PTR]
    set ret [lindex [DNSMSG::section $ret answer] 0]
    if { $ret eq "" } {
        # log local0.warn "DNS PTR lookup for $addr_v4 failed."
        return
    }

    # Last element in '1.1.1.10.in-addr.arpa. 600 IN PTR otters.example.com'
    return [lindex $ret end]
}

-- In an iRule, instead of:
    RESOLV::lookup @192.0.2.1 $ipv4_addr
Use:
    call resolv_ptr_v4 $ipv4_addr

---

930625-1 : TMM crash is seen due to double free in SAML flow

Links to More Info: BT930625

Component: Access Policy Manager

Symptoms:
When this issue occurs the TMM will crash

Conditions:
Exact reproduction steps are not known but it occurs during SAML transactions

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

---

930217-1 : Zone colors in ASM swap usage graph are incorrect

Links to More Info: BT930217

Component: Application Visibility and Reporting

Symptoms:
In GUI ASM memory utilization chart, 'BD swap size, Total swap size' graph show inconsistent background colors. It looks like these colors are assigned with an assumption that swap usage is shown as percentage but it is shown as absolute value.

Conditions:
-- ASM is provisioned.
-- Viewing ASM memory utilization chart/

Impact:
Potential confusion viewing colors in ASM memory utilization chart.

Workaround:
None. This is a cosmetic issue only.

---

929429-8 : Oracle/SQL database monitor uses excessive CPU when Platform FIPS is licensed

Links to More Info: BT929429

Component: Local Traffic Manager

Symptoms:
Whenever you create Oracle or SQL (mssql, mysql or postgresql) database monitors, and add a member to the monitor, every time the OpenSSL libraries are loaded for a new connection, high CPU usage occurs.

Conditions:
-- Create an Oracle or SQL database LTM monitor.
-- Add a pool member to the Oracle or SQL database monitor created.
-- Platform FIPS is licensed.

Impact:
High CPU Usage due to the loading of libraries whenever new connection is created.

Workaround:
None.

---

929173-3 : Watchdog reset due to CPU stall detected by rcu_sched

Links to More Info: BT929173

Component: TMOS

Symptoms:
Rcu_sched detected CPU stall, which can cause vCMP host reboot. The device reboots without core and records "Host Watchdog timeout."

Typically there will logs in kern.log similar to:
err kernel: : [526684.876928] INFO: rcu_sched detected stalls on CPUs/tasks: ...

Conditions:
Host undergoing a watchdog reset in a vCMP environment.

Impact:
CPU RCU stalls and host watchdog reboots

---

929133-6 : TMM continually restarts with errors 'invalid index from net device' and 'device_init failed'

Links to More Info: BT929133

Component: TMOS

Symptoms:
VLANs with a name that that start with "eth" will cause tmm to fail and restart.

Conditions:
Vlan name that starts with "eth"

Impact:
Since tmm fails to start, the BIG-IP cannot serve traffic.

Workaround:
Rename all vlans that start with "eth"

---

928665-4 : Kernel nf_conntrack table might get full with large configurations.

Links to More Info: BT928665

Component: TMOS

Symptoms:
Linux host connections are unreliable, and you see warning messages in /var/log/kern.log:

warning kernel: : [182365.380925] nf_conntrack: table full, dropping packet.

Conditions:
This can occur during normal operation for configurations with a large number of monitors, for example, 15,000 or more active entries.

Impact:
Monitors are unstable/not working at all.

Workaround:
1. Modify /etc/modprobe.d/f5-platform-el7-conntrack-default.conf
increasing the hashsize value:

options nf_conntrack hashsize=262144

2. Save the file.
3. Reboot the system.

---

928445-5 : HTTPS monitor is down when server_ssl profile cipher string is configured to TLSv1_2

Links to More Info: BT928445

Component: Local Traffic Manager

Symptoms:
HTTPS monitor state is down when server_ssl profile cipher string has the value 'TLSv1_2'.
 -- configured cipherstring TLSv1_2/TLSv1_1 is rejected by OpenSSL.

Conditions:
-- Pool member is attached with HTTPS monitor.
-- Monitor is configured with an SSL profile.
-- The configured server_ssl profile has cipher string as DEFAULT:!TLSv1_2.

Impact:
Pool status is down.

Workaround:
-- Enable 'in-tmm' monitoring.
-- Use SSL options available in the server SSL profile to disable TLSv1_2 or TLSv1_1 instead of cipher string.
-- Use the same cipher string with cipher group / cipher rule that is attached to the SSL profile.

---

928389-6 : GUI becomes inaccessible after importing certificate under import type 'certificate'

Links to More Info: BT928389

Component: TMOS

Symptoms:
After importing a new certificate, httpd goes down and the GUI becomes inaccessible.

Conditions:
Upload new certificate using Import-type 'Certificate' option.

Impact:
The GUI is inaccessible as soon as you import a new device certificate using import-type 'Certificate'.

Workaround:
Manually copy the matching key to /config/httpd/conf/ssl.key/server.key and restart apache (bigstart restart httpd)

If you do not have the matching key, generate a new key/cert pair from the command line by following K9114

---

928353-4 : Error logged installing Engineering Hotfix: Argument isn't numeric★

Links to More Info: BT928353

Component: TMOS

Symptoms:
When installing an Engineering Hotfix, the following error may be logged in /var/log/liveinstall.log:

Argument "" isn't numeric in numeric eq (==) at /var/tmp/install/pkgcpio/usr/local/lib/tm_install/Hotfix.pm line 651.

Conditions:
This error may occur when installing an Engineering Hotfix, if the Engineering Hotfix does not include an update to the nash-initrd component.

Impact:
The error message gives a mistaken impression that the Engineering Hotfix did not install successfully. However, it does install correctly, and the system operates without issue. You can safely ignore this message.

Workaround:
None.

---

927633-4 : Failure path in external datagroup internal mapping operation failure may result in 'entry != NULL' panic

Links to More Info: BT927633

Component: Local Traffic Manager

Symptoms:
Log messages written to /var/log/ltm:
-- notice tmm2[30394]: 01010259:5: External Datagroup (/Common/dg1) queued for update.

and to /var/log/tmmX:
-- notice panic: ../kern/sys.c:1081: Assertion "entry != NULL" failed.

Conditions:
-- Create datagroups.
-- Some condition causes a datagroup to not be present (e.g., delete, rename operations, or another, internal operation).
-- Load the config.

Impact:
Internal mapping of external datagroup fails. Datagroup creation fails.

Workaround:
None.

---

927589-1 : ILX::call command response get truncated

Links to More Info: BT927589

Component: Local Traffic Manager

Symptoms:
If a response to an ILX::call command is larger than 64 KB, data is truncated.

Conditions:
-- iRule script including an ILX::call command in use.
-- Return response is greater than 64 KB.

Impact:
iRule fails and the connection aborts.

Workaround:
None.

---

927441-5 : Guest user not able to see virtual server details when ASM policy attached

Links to More Info: BT927441

Component: TMOS

Symptoms:
When ASM is attached to a Virtual Server, a BIG-IP user account configured with the Guest role cannot see virtual server details. An error message is printed instead:
01070823:3: Read Access Denied: user (guestuser) type (GTM virtual score).

Conditions:
-- ASM Policy attached to virtual server.
-- Logging onto the BIG-IP system using an account configured with the guest user role.
-- Running the command:
tmsh show ltm virtual detail

Impact:
Cannot view virtual server details.

Workaround:
None.

---

927025-1 : Sod restarts continuously

Links to More Info: BT927025

Component: TMOS

Symptoms:
After upgrading to v14.1.2.6, sod keeps restarting and dumping core.

Conditions:
This occurs when /dev/shm/chmand is missing and the system restarts chmand and sod upon reload.

Note: It is unknown how this condition might occur.

Impact:
Unstable sod process can affect failover functionality in BIG-IP systems.

Note: This happens only the first time after upgrade. To recover, you must power down the system for a full reboot.

Workaround:
Run the following command:

restorecon /dev/shm/chmand

---

926549-3 : AFM rule loops when 'Send to Virtual' is used with Virtual Server iRule 'LB::reselect'

Links to More Info: BT926549

Component: Advanced Firewall Manager

Symptoms:
With some configurations, executing a command such as 'tmsh show security firewall global-rules active' loops continuously, causing stat counters to rise, and possibly log messages to be written to /var/log/ltm.

Conditions:
-- AFM is routing traffic to a Virtual Server through the 'Send to Virtual' option.
-- The target Virtual Server uses the 'LB_FAILED' iRule to select a new Virtual Server through virtual command and 'LB::reselect'.

Impact:
The iRule loops continuously, causing stat counters to rise, and possibly logging messages in /var/log/ltm.

Workaround:
This configuration should be avoided, but if it is used, and if this does happen, you can restart tmm:
bigstart restart tmm

This stops the current looping, until it is triggered again.

Impact of workaround: Traffic disrupted while tmm restarts.

---

926425-4 : Hardware SYN Cookies may not deactivate after the SYN attack ends and valid TCP traffic starts

Links to More Info: BT926425

Component: Advanced Firewall Manager

Symptoms:
Hardware SYN Cookies activated on a virtual server under a SYN attack may not deactivate after the SYN attack ends and valid TCP traffic starts. The non-supported TCP options under SYN Cookie protection continue to be unsupported until hardware SYN cookies are disabled.

Conditions:
SYN Cookie activated on Neuron-capable platforms:
  + VIPRION B4450N blade
  + BIG-IP iSeries devices (ix800) except the i850, ix2800, and ix4800:
     -- BIG-IP i5800 Series
     -- BIG-IP i7800 Series
     -- BIG-IP i11800 Series
     -- BIG-IP i15800 Series

Impact:
This can successfully cause hardware SYN cookies to be activated on the BIG-IP virtual server under attack. However, once the attack subsides and falls below the SYN check threshold, SYN cookies may not immediately deactivate.

Because SYN cookie protection is still active, and because under SYN cookie protection some TCP options are not supported, the options are not taken into account when processing traffic. For example, under SYN cookie protection, MSS is fixed to a few sizes. For traffic that arrives with a different MSS size, the system uses a supported size instead.

Workaround:
You can use any of the following to clear the HSB issue:
-- Restart neurond.
-- Restart TMM,
-- Reboot the device.

---

926417-3 : AFM not using the proper FQDN address information

Links to More Info: BT926417

Component: Advanced Firewall Manager

Symptoms:
Duplicate resolved entries in FQDN address-lists may cause FQDN to use incorrect address information until the next FQDN reload.

Conditions:
Any two FQDN address-lists having entries which DNS resolves to the same IP address present in the configuration, at any point since the last TMM restart/FQDN load.

Impact:
Even after one of the duplicate entries is removed, AFM does not use proper FQDN address information.

Workaround:
Remove the problematic rule and recreate the same rule again
or Remove one of the duplicate addresses, and run "tmsh load security firewall fqdn-entity all" command,
or restart TMM.

---

926085-2 : In WebUI node or port monitor test is not possible, but it works in TMSH

Links to More Info: BT926085

Component: Local Traffic Manager

Symptoms:
When attempting to test a newly created Pool Member monitor, node address field is disabled, you cannot enter a node address. This prevents from using the Test operation to test this type of monitor in the WebUI.

Conditions:
-- Create a new Pool Member monitor (not a Node Address monitor). For example, HTTP, HTTPS, FTP, TCP, or Gateway ICMP.
-- With the monitor configuration displayed in the WebUI, click the Test tab.
-- View the Address field, and try to run the test.

Impact:
The Address field is disabled, with *.* in the field. You cannot enter a node address. The test fails with following message:

invalid monitor destination of *.*:80.
invalid monitor destination of *.*:443. (:port used to test)

Workaround:
Run either of the following TMSH commands:

-- tmsh run ltm monitor <type> <name> destination <IP address>:<port>
-- tmsh modify ltm monitor <type> <name> destination *:*

For example, for HTTP:
-- tmsh run ltm monitor http my_http destination <IP address>:<port>
-- tmsh modify ltm monitor http my_http destination *:*

For example, for HTTPS:
-- tmsh run ltm monitor https my_https destination <IP address>:<port>
-- tmsh modify ltm monitor https my_https destination *:*

---

924589-3 : PEM ephemeral listeners with source-address-translation may not count subscriber data

Links to More Info: BT924589

Component: Policy Enforcement Manager

Symptoms:
When a PEM profile is associated with a protocol that can create dynamic server-side listeners (such as FTP), and source-address-translation is also enabled on the virtual server, traffic on that flow (for example ftp-data) is not associated with the subscriber, and is therefore not counted or categorized.

Conditions:
-- Listener configured with PEM and FTP profiles
-- Some form of source address translation is enabled on the listener (for example, SNAT, Automap, SNAT Pool)

Impact:
Inaccurate subscriber traffic reporting and classification.

Workaround:
None.

---

924297-4 : Ltm policy MCP objects are not being synced over to the peer device

Links to More Info: BT924297

Component: TMOS

Symptoms:
An LTM policy does not sync to the peer device, but the devices report "In Sync".

Conditions:
-- Sync/failover device group with full load on sync disabled
-- A draft policy is attached to a parent policy's rule actions and published.
-- A config sync occurs (manually or automatically)

Impact:
The LTM policy does not sync to the peer device.

Workaround:
Perform a full config sync:

tmsh run cm config-sync force-full-load-push to-group <device group name>

---

922641-6 : Any iRules that park in a clientside or serverside command leave the iRule attached to the wrong flow

Links to More Info: BT922641

Component: Local Traffic Manager

Symptoms:
iRule commands issued after a clientside or serverside command operate on the wrong peer flow.

Conditions:
An iRule contains a script that parks in a clientside or serverside command.

Examples of parking commands include 'table' and 'persist'.

Impact:
The iRule commands operate on the wrong peer flow.

Workaround:
Avoid using commands that park inside the clientside or serverside command.

---

922613-6 : Tunnels using autolasthop might drop traffic with ICMP route unreachable

Links to More Info: BT922613

Component: TMOS

Symptoms:
Traffic that should be encapsulated and sent via tunnel might get dropped with an ICMP error, destination unreachable, unreachable route. This happens in a scenario where no route exists towards the remote tunnel endpoint and the BIG-IP system relies on autolasthop to send the encapsulated traffic back to the other end of the tunnel.

Conditions:
No route exists to the other end of the tunnel.

Impact:
Traffic dropped with ICMP error, destination unreachable, unreachable route.

Workaround:
Create a route towards the other remote end of the tunnel.

---

922153-5 : Tcpdump is failing on tmm 0.x interfaces

Links to More Info: BT922153

Component: TMOS

Symptoms:
The tcpdump command exits immediately with an error:
 errbuf ERROR:TMM side closing: Aborted
tcpdump: pcap_loop: TMM side closing: Aborted

Conditions:
Capturing the packets on tmm interfaces.

Impact:
Unable to capture the packets on specific tmm interfaces.

Workaround:
There are two possible workarounds:

-- Start tcpdump on the tmm that actually owns the interface using the TCPDUMP_ADDR command; for example, using blade1 for 1/0.16, run the command:

TCPDUMP_ADDR=127.1.1.16 tcpdump -w testcap.pcap -s 0 -i 1/0.16


-- Send the TCPDUMP_ADDR command to a specific tmm, which could work from any blade (127.20.<slot>.<tmmnumber+1> (e.g. 127.20.1.1 == slot1/tmm0, 127.20.2.16 == slot2/tmm15):

TCPDUMP_ADDR=127.20.1.16 tcpdump -w testcap.pcap -s 0 -i 1/0.16

---

922053-1 : inaccurate number of trunk members reported by bcm56xxd/bcmLINK

Links to More Info: BT922053

Component: TMOS

Symptoms:
The "bcmLINK" process (sometimes referred to as "bcm56xxd") may fail with a segmentation fault and be restarted, leaving behind a core-dump file for "bcmLINK".

An error message may be logged about the condition "max_mbrs > 0".

Conditions:
-- occurs in multi-blade VIPRION system with trunked interfaces
-- precise trigger is not known

Impact:
Momentary disruption of traffic handling by TMM.

Workaround:
None known.

---

921993-1 : LTM policy with a 'contains' operator does not work as expected when using an external data group.

Links to More Info: BT921993

Component: Local Traffic Manager

Symptoms:
If a combination of other operators and the 'contains' operator are used in LTM Policy, searches might fail if the hashing-based operators have not populated the target entries.

Conditions:
-- LTM policy with 'contains' operator.
-- Use of external datagroups.

Impact:
LTM policy might not work as expected with external data groups.

Workaround:
Use either of the following workarounds:

-- If applicable, change the 'contains' operator to 'starts_with' in the policy.

-- Change the policy into an iRule (executing '[class get <datagroup]' )

---

921069-3 : Neurond cores while adding or deleting rules

Links to More Info: BT921069

Component: TMOS

Symptoms:
Neurond cores if it receives error while adding or deleting rules in neuron hardware.

Conditions:
Adding or deleting rules in neuron hardware

Impact:
Neurond cores

Workaround:
None

---

920817-7 : Wide IP operations performed in quick succession result in missing resource records and out of sync journals.

Links to More Info: BT920817

Component: Global Traffic Manager (DNS)

Symptoms:
Two issues occur with Wide IP operations performed in quick succession:
1. DNS Zone syncing is missing resource records.
2. In some cases it throws named/zrd error: journal rollforward failed: journal out of sync with zone.

Conditions:
This issue can occur when a large number of configuration changes, including Wide IP changes, are made simultaneously on multiple GTM/DNS devices in a sync group.

Impact:
DNS resource records can be missing from the BIND DNS database.

The impact of this issue is that if GSLB Load Balancing falls back to BIND, the DNS resource records may not be present.
Manually remove the .jnl files in order to restore named/zrd on all GTMs.

Workaround:
Restrict configuration (Wide IP) changes to one GTM/DNS device in a device group.

Note: It is also possible to turn off zone syncing. GTM/DNS configuration is still synced, but you lose the ability to sync non-Wide IP changes to the BIND DB.
If you do not use ZoneRunner to add additional non-Wide IP records, this is only a problem when GSLB resorts fallback to BIND.
This can be mitigated with DNSX and DNS (off device) for non Wide IP Resource Records.

Manually remove the .jnl files in order to restore named/zrd on all GTMs.

---

919917-5 : File permission errors during bot-signature installation

Links to More Info: BT919917

Component: Application Security Manager

Symptoms:
When you install Bot-Sig IM file through LU, /var/log/ltm shows file permission errors.

Cannot open lock file (/var/run/config_lock), permission denied.

Cannot open command history file (/root/.tmsh-history-root), Permission denied : framework/CmdHistoryFile.cpp, line 92.

Conditions:
Installing bot-signature.

Impact:
If MCPD restart or box reboot immediately after bot-signature installation without following other configuration change, then the bot-signature installation is reverted.

Workaround:
Any configuration change in LTM that follows the bot-signature installation prevents it from being reverted.

---

918693-5 : Wide IP alias validation error during sync or config load

Links to More Info: BT918693

Component: Global Traffic Manager (DNS)

Symptoms:
DB validation exception occurs during GTM config sync or config load:

01070734:3: Configuration error: DB validation exception, unique constraint violation on table (gtm_wideip_alias) object ID (1 /Common/alias.test.com www.test.com). A duplicate value was received for a non-primary key unique index field. DB exception text (Cannot update_indexes/checkpoint DB object, class:gtm_wideip_alias status:13)
Unexpected Error: Loading configuration process failed.

Conditions:
-- A wideip alias is moved from one wideip to another
-- GTM sync occurs, or a gtm config is loaded manually.

This issue can occur any time a GTM config is loaded or synchronised where the new configuration has a wideip with an alias, which is already configured on a different wideip in the existing in-memory GTM configuration.

Impact:
You are unable to load config or full sync from peer GNS/GTM.

Workaround:
Follow this procedure:
1. Delete the wide IP alias on the destination device.
2. Try the sync or load config operation again.

---

917637-5 : Tmm crash with ICAP filter

Links to More Info: BT917637

Component: Service Provider

Symptoms:
Tmm crashes while passing traffic.

Conditions:
-- Per-request policies configured.
-- ICAP is configured.

This is rare condition that occurs intermittently.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None.

---

915493-6 : imish command hangs when ospfd is enabled

Links to More Info: BT915493

Component: TMOS

Symptoms:
Running the imish command hangs when ospfd is enabled.

Conditions:
-- Dynamic routing enabled.
-- The ospfd protocol is enabled.
-- Running the imish command.

Impact:
The imish operation hangs.

Workaround:
Restart the ospfd daemon.

---

915473-4 : Accessing Dashboard page with AVR provisioned causes continuous audit logs

Links to More Info: BT915473

Component: TMOS

Symptoms:
Navigating to Statistics :: Dashboard in the GUI with AVR or APM provisioned causes continuous audit logging and restjavad logs.

Conditions:
-- AVR provisioned
-- An administrator navigates to Statistics :: Dashboard.

Impact:
The continuous extra logs might lead to confusion and may not be helpful.

Workaround:
None.

---

915221-6 : DoS unconditionally logs MCP messages to /var/tmp/mcpd.out

Links to More Info: BT915221

Component: Advanced Firewall Manager

Symptoms:
Excessive and large DoS debug messages associated with tmsh commands and stat queries are logged to /var/tmp/mcpd.out which is not log-rotated.

Conditions:
-- AFM is provisioned.
-- DoS queries executed via tmsh.

Impact:
Disk space is consumed on the filesystem for /var/tmp, which can eventually lead to follow-on failures when the disk fills up.

Workaround:
Delete or purge /var/tmp/mcpd.out.

---

915141-5 : Availability status of virtual server remains 'available' even after associated pool's availability becomes 'unknown'

Links to More Info: BT915141

Component: TMOS

Symptoms:
Availability status of virtual server can be left 'available' even if the corresponding pool's availability becomes 'unknown'.

Conditions:
- Pool member is configured as an FQDN node.
- You set monitor to 'none' with the pool.

Impact:
Inconsistent availability status of pool and virtual server.

Workaround:
Set the FQDN node to 'force offline', and then 'enable'. This triggers virtual server's status updates and syncs to pool.

---

915005-3 : AVR core files have unclear names

Links to More Info: BT915005

Component: Application Visibility and Reporting

Symptoms:
If avrd fails a core file created in this case is named accordung to the thread name and has no indication that it belongs to avr, for example: SENDER_HTTPS.bld0.0.9.core.gz

Conditions:
Avrd fails with a core

Impact:
It is inconvenient for identifying the process that caused the core.

---

913917-1 : Unable to save UCS

Links to More Info: BT913917

Component: Global Traffic Manager (DNS)

Symptoms:
You are unable to create a backup UCS.

You see a warning in /var/log/restjavad.0.log:

[WARNING][8100/tm/shared/sys/backup/306b4630-aa74-4a3d-af70-0d49bdd1d89e/worker UcsBackupTaskWorker] Failure with backup process 306b4630-aa74-4a3d-af70-0d49bdd1d89e.
This is followed by a list of some files in /var/named/config/namedb/.

Conditions:
Named has some Slave zones configured and is going through frequent zone transfer.

Impact:
You are unable to create a UCS file.

Workaround:
Stop named zone transfer while doing UCS backup.

---

913713-3 : Rebooting a blade causes MCPd to core as it rejoins the cluster

Links to More Info: BT913713

Component: TMOS

Symptoms:
Tmm and mcpd cores for slot2

Conditions:
On the standby chassis, reboot the primary blade and wait for it to rejoin the cluster. Once it does, mcpd will core.

Impact:
Traffic disrupted while tmm and mcpd mcpd restarts.

Workaround:
N/A

---

913013-1 : Racoon daemon may crash once at startup

Links to More Info: BT913013

Component: TMOS

Symptoms:
When the IKEv1 racoon daemon starts, it may immediately exit with a core file.

Conditions:
One of the following events may lead to the restart:
-- BIG-IP systems start or restart as a standalone device.
-- BIG-IP becomes the Active member of High Availability (HA) setup.

Impact:
Racoon restarts. Because this restart happens when racoon is trying to start, no IPsec IKEv1 tunnels are affected because they are down anyway.

Workaround:
None

---

912293-5 : Persistence might not work properly on virtual servers that utilize address lists

Links to More Info: BT912293

Component: Local Traffic Manager

Symptoms:
-- Connections to the virtual server might hang.
-- Increased tmm CPU utilization.

Conditions:
-- A virtual server is configured with a traffic-matching-criteria that utilizes a source-address-list and/or destination-address-list.

-- The virtual server utilizes certain persistence one of the following persistence types:
  + Source Address (but not hash-algorithm carp)
  + Destination Address (but not hash-algorithm carp)
  + Universal
  + Cookie (only cookie hash)
  + Host
  + SSL session
  + SIP
  + Hash (but not hash-algorithm carp)

Impact:
-- High tmm CPU utilization.
-- Stalled connections.

Workaround:
Enable match-across-virtuals in the persistence profile.

Note: Enabling match-across-virtuals might might affect the behavior of other virtual servers in the configuration that utilize persistence.

---

911729-4 : Redundant learning suggestion to set a Maximum Length when parameter is already at that value

Links to More Info: BT911729

Component: Application Security Manager

Symptoms:
Policy Builder is issuing a learning suggestion to set a specific maximum length for a parameter when that parameter already has that exact maximum length already configured.

Conditions:
-- Response learning is turned on
-- Response parameter length is less than, but close to, the currently configured maximum length limit.

Impact:
Redundant learning suggestion is issued.

Workaround:
You can either:
-- Ignore the learning suggestion (Click the Ignore button).
-- Turn off Learn from response.

---

911497-1 : Unbound's backoff algorithm interacts badly with net resolver iRules

Links to More Info: BT911497

Component: Global Traffic Manager (DNS)

Symptoms:
Using RESOLVER::name_lookup in an iRule against a net resolver forward zone name server that happens to be down can result in the iRule pausing for up to a few minutes.

Conditions:
Nameserver configures as fwd-zone in net resolver should be down.

Impact:
The connection to the virtual server is paused for a significant amount of time.

Workaround:
Use a pool of dns-servers, and configure the pool to monitor the backend dns servers and load balance to healthy pool members.

---

911241-8 : The iqsyncer utility leaks memory for large bigip_gtm.conf file when log.gtm.level is set to debug

Links to More Info: BT911241

Component: Global Traffic Manager (DNS)

Symptoms:
The iqsyncer utility leaks memory.

Conditions:
-- There is a large bigip_gtm.conf.
-- The log.gtm.level is set to debug.

Impact:
The iqsyncer utility exhausts memory and is killed.

Workaround:
Do not set log.gtm.level equal to or higher than debug.

---

910777-1 : Sending ASM report via AWS SES failed duo to wrong content type

Links to More Info: BT910777

Component: Application Visibility and Reporting

Symptoms:
When you attempt to send an ASM report via AWS SES, the message bounces with the following message:
  Could not send e-mails: SMTP Error: data not accepted.; Transaction failed: Expected MIME type, got ;; Error code: 554.

This occurs because the BIG-IP system is sending out the report message with an empty Content-Type in the multipart MIME, which the AWS mail host cannot process.

Conditions:
This is encountered in the following scenario:
1. Set up SMTP and ASM schedule report.
2. Click Send Now, and get the error message in GUI.
3. SSH into the BIG-IP system.
4. Add this line under the following snippet:

[admin@bigip:Active:Standalone] ~ # chmod 644 /var/ts/dms/script/avrexport/avrmail.php
[admin@bigip:Active:Standalone] ~ # vi /var/ts/dms/script/avrexport/avrmail.php

if (!$mail_subject) $mail_subject = "BIG-IP Analytics Report";
if (!$mail_body) $mail_body = "Attached to this e-mail is a BIG-IP Analytics Report issued at $mail_time＼n＼n";
if (!$mail_from) $mail_from = 'BIG-IP Reporter';
if (!$mail_content_type) $mail_content_type = 'text/html'; <<<< Add this line for add text/html into content type.

[admin@bigip:Active:Standalone] ~ # chmod 444 /var/ts/dms/script/avrexport/avrmail.php

5. Click Send Now again and it works.


Note: To use AWS SES, you must verify your email address first (as a Sender). You can search SES in AWS and verify your email in Email Addresses. AWS sends an email. Click the embedded link after receipt, and then you can use it as the Sender address on the BIG-IP system.

Impact:
Cannot receive ASM reports.

---

908829-2 : The iqsyncer utility may not write the core file for system signals

Links to More Info: BT908829

Component: Global Traffic Manager (DNS)

Symptoms:
In certain instances, the iqsyncer utility may not write the core file for system signals.

Conditions:
-- SELinux policies enabled.
-- Run the iqsyncer utilities to initiate a core dump with system signals SIGABRT, SIGQUIT, and SIGSEGV.

Impact:
The iqsyncer utility does not write core file.

Workaround:
Disable SELinux with 'setenforce 0'.

You can now generate a core with a SIGQUIT (-3), but not with SIGABRT or SIGSEGV.

---

908801-2 : SELinux policies may prevent from iqsh/iqsyncer dumping core

Links to More Info: BT908801

Component: Global Traffic Manager (DNS)

Symptoms:
SELinux policies may prevent the iqsh/iqsyncer utilities from dumping core information.

Conditions:
-- SELinux policies enabled.
-- Run the iqsh/iqsyncer utilities to initiate a core dump.

Impact:
The operation does not result in dumping the core information.

Workaround:
Disable SELinux with 'setenforce 0'.

---

908753-5 : Password memory not effective even when password policy is configured

Links to More Info: BT908753

Component: TMOS

Symptoms:
The BIG-IP system does not prevent you from specifying previously used passwords, even if Secure Password Enforcement is enabled with password memory set to a non-zero value.

Conditions:
-- Password memory in auth settings is not 0 (zero).
-- Attempt to specify a previously specified password

Impact:
Password history to prevent user from using same password is not enforced.

Workaround:
None.

---

908453-5 : Trunks with names longer than 32 characters update working-mbr-count in vCMP guests incorrectly

Links to More Info: BT908453

Component: TMOS

Symptoms:
When a trunk is configured with a name longer than 32 characters on a vCMP host, guests update the working-mbr-count for the trunk incorrectly when another trunk on the host changes. This might result in vCMP guests failing over unexpectedly.

Conditions:
-- Trunk configured with a name longer than 32 characters on vCMP host.
-- Trunk made available to guests for high availability (HA) Group scoring.
-- At least one other trunk configured on vCMP host.
-- Interface state changes in any other trunk.

Impact:
The vCMP guests may fail over unexpectedly.

Workaround:
Do not use trunk names longer than 32 characters.

---

908005-5 : Limit on log framework configuration size

Links to More Info: BT908005

Component: TMOS

Symptoms:
While the system config is loading, you see numerous error messages:

-- err errdefsd[26475]: 01940010:3: errdefs: failed to add splunk destination.
-- err errdefsd[585]: 01940015:3: errdefs: failure publishing errdefs configuration.

Conditions:
This can occur during a log-config update/load that has numerous log-config objects configured.

Impact:
System does not log as expected.

Workaround:
None

---

908001-2 : vCMP guest CPU usage may increase 4-5% after upgrade of vCMP host to v16.1.x★

Links to More Info: BT908001

Component: Performance

Symptoms:
All vCMP guest configurations might see a 4-5% increase in CPU usage while running on VIPRION and iSeries platforms with the vCMP host upgraded to v16.1.x

Conditions:
-- All configurations (guest software version is not relevant)
-- Running vCMP on VIPRION and iSeries platforms
-- 'Host' upgraded to v16.1.x

Impact:
Increase of CPU usage of about 4-5% on the vCMP guest. This is not expected to cause noticeable performance impacts unless the vCMP guest CPU is already close to 100% use, when it is possible there may be up to a 15% TPS decrease.
 
If you are running vCMP on VIPRION and iSeries platforms, first evaluate your scenarios and capacity plan if you plan to upgrade the 'host' to 16.1.x.

Note: There is no CPU usage increase when v16.1.x 'guest' instances are run on an earlier 'host' version.

Guidance: In determining whether to upgrade the vCMP host to v16.1.x, carefully evaluate the performance and sizing requirements of your specific configuration.

Workaround:
None

---

907177-5 : Priority of embedded APM iRules is ignored

Links to More Info: BT907177

Component: Local Traffic Manager

Symptoms:
Custom iRule events are executed before the embedded APM iRule events, despite the custom iRule's priority value being larger than the APM iRule's priority value.

Conditions:
-- APM is provisioned.
-- Custom iRule with a priority value larger the APM iRule's priority value.

Impact:
Custom iRule event is executed before APM iRule event.

Workaround:
None.

---

906653-1 : Server side UDP immediate idle-timeout drops datagrams

Links to More Info: BT906653

Component: Local Traffic Manager

Symptoms:
With immediate idle-timeout, flows may be closed before a datagram is forwarded.

Conditions:
-- Immediate idle-timeout is set on the server context of a UDP virtual server.

Impact:
Datagrams are dropped periodically depending on traffic load.

Workaround:
None.

---

905477-6 : The sdmd daemon cores during config sync when multiple devices configured for iRules LX

Links to More Info: BT905477

Component: Local Traffic Manager

Symptoms:
The iRules LX workspaces belong on only one device in a Device Service Cluster (DSC). If you have the same iRules LX workspace configured on multiple devices and then perform a config sync operation, the sdmd daemon cores.

Conditions:
-- Multiple devices configured with the same iRules LX workspace in a DSC.
-- Change one of the devices such that the configuration requires a config sync.
-- Perform the config sync.

Impact:
The sdmd daemon cores. Although having multiple devices configured with the same iRules LX workspace is an incorrect configuration, sdmd should not core.

Workaround:
When the iRules LX workspace is correctly configured, i.e., on only one device in a DSC, there is no need to config sync, so this issues does not occur.

---

904713-2 : FailoverState device status and CM device status do not match shortly after triggering failover

Links to More Info: BT904713

Component: TMOS

Symptoms:
After triggering failover, the result returned by the API endpoint /mgmt/tm/shared/bigip-failover-state (the BIG-IP failover state worker) may not match the actual device failover state.

Conditions:
This may happen on an high availability (HA) setup with a sync-failover device group.

Impact:
Actions that require the correct output of the BIG-IP failover state worker may fail. For instance, deleting an SSL Orchestrator topology followed by immediately triggering failover may encounter this issue, causing the deletion to fail.

Workaround:
After waiting for a short amount of time, the BIG-IP failover state worker gets in sync with the device failover state. So in the example of deleting an SSL Orchestrator topology, the deletion should be successful if you try again after a short wait.

---

904537-1 : The csyncd process may keep trying to sync the GeoIP database to a secondary blade

Links to More Info: BT904537

Component: Local Traffic Manager

Symptoms:
The most common symptom is when csyncd repeatedly syncs the GeoIP files and loads the GeoIP database, causing a large number of Clock advanced messages on all tmms.

Repeated log messages similar to the following are reported when a secondary slot logs into the primary slot to load the sys geoip database:

-- info sshd(pam_audit)[17373]: 01070417:6: AUDIT - user root - RAW: sshd(pam_audit): user=root(root) partition=[All] level=Administrator tty=ssh host=x.x.x.x attempts=1 start="Wed Apr 29 13:50:49 2020".
-- notice tmsh[17401]: 01420002:5: AUDIT - pid=17401 user=root folder=/Common module=(tmos)# status=[Command OK] cmd_data=load sys geoip.

Conditions:
-- VIPRION or vCMP guests.
-- Either of the following:
   - First installing the GeoIP database if the /shared/GeoIP/v2 directory does not exist.
   - When a new blade is installed into a chassis.

Impact:
Repeated logs of Clock advanced messages.

Workaround:
Run the command:
 clsh bigstart restart csyncd

---

904401-5 : Guestagentd core

Links to More Info: BT904401

Component: TMOS

Symptoms:
Guestagentd crashes on a vCMP guest.

Conditions:
This can occur during normal operation in a vCMP environment.

Impact:
Guestagentd crashes on the vCMP guest, and the vCMP host does not have accurate guest information, such as version, provisioning, high availability (HA) status, and tmm status.

Workaround:
None.

---

903573-3 : AD group cache query performance

Links to More Info: BT903573

Component: Access Policy Manager

Symptoms:
Active Directory queries are slow.

Conditions:
This issue occurs under the following conditions:
-- Active Directory (AD) authentication used.
-- There are lots of AD caches in the environment, and users are in deeply nested groups.

Impact:
Active Directory query time can be excessive.

Workaround:
None

---

903521-1 : TMM fails to sign responses from BIND when BIND has 'dnssec-enable no'

Links to More Info: BT903521

Component: Global Traffic Manager (DNS)

Symptoms:
TMM fails to sign responses from BIND.

Conditions:
BIND has 'dnssec-enable no' in named.conf.

Impact:
TMM fails to sign responses from BIND.

Workaround:
Remove 'dnssec-enable no' from named.conf in options section.

---

903501-3 : VPN Tunnel establishment fails with some ipv6 address

Links to More Info: BT903501

Component: Access Policy Manager

Symptoms:
VPN Tunnel establishment fails with some ipv6 address

Conditions:
- APM is provisioned.
- Network Access with IPv6 virtual server is configured.

Impact:
VPN Tunnel cannot be established.

Workaround:
1. Disable the DB variable isession.ctrl.apm:
tmsh modify sys db isession.ctrl.apm value disable

2. Perform 'Apply Access Policy' for the access policy attached to the virtual server.

Important: The iSession control channel is needed if optimized apps are configured, so use this workaround only when 'No optimized apps are configured' is set (available in the GUI by navigating to Access :: Connectivity / VPN : Network Access (VPN) : Network Access Lists :: {NA resources} :: 'Optimization' tab).

---

902445-3 : ASM Policy Event Logging stops working after 'No space in shmem' error disconnection mitigation

Links to More Info: BT902445

Component: Application Security Manager

Symptoms:
ASM event logging stops working.

Conditions:
This can occur during normal ASM operation. It occurs after ASM executes 'No space in shmem' error disconnection mitigation, and this error is logged.

Impact:
ASM Policy Event Logging stop working; new event is not saved.

Workaround:
Restart asmlogd and pabnagd:
pkill asmlogd
pkill pabnagd

---

901569-4 : Loopback traffic might get dropped when VLAN filter is enabled for a virtual server.

Links to More Info: BT901569

Component: Local Traffic Manager

Symptoms:
Loopback traffic (local traffic) destined to a virtual server might get dropped when the incoming packet matches a terminating connection flow.

Conditions:
-- VLAN filter is enabled on the virtual server created for loopback traffic processing.
-- An incoming packet matches a terminating connection flow (i.e., the connection flow terminates because of timeout, being dropped by iRule, etc.).

Impact:
Traffic that is matched against a terminating connection flow of a virtual is not processed by the virtual server.

Workaround:
Because this filter is ignored for loopback traffic, removing the 'Enabled On VLAN' filter at the virtual server mitigates the issue.

---

901041 : CEC update using incorrect method of determining number of blades in VIPRION chassis★

Links to More Info: BT901041

Component: Traffic Classification Engine

Symptoms:
There is an issue with the script used for the Traffic Intelligence (CEC (Classification Engine Core)) Hitless Upgrade that misses installing on some blades during install/deploy on VIPRION systems.

Symptoms include:
-- POST error in the GUI.
-- Automatic classification updates are downloaded successfully, but downloaded packages disappear after some time if you do not proceed to install/deploy.

Conditions:
-- CEC hitless update.
-- Using VIPRION chassis.

Impact:
Unable to auto-update Classification signature package on all slots, because the slot count reported for CEC is 0. These packages are installed only on the current slot.

Workaround:
Install the package manually on each slot.

Note: When you refresh the GUI page, the downloaded package appears in the 'Available to Install' list, and you can proceed to install on each slot.

---

899253-1 : [GUI] GTM wideip-pool-manage in GUI fails when tens of thousands of pools exist

Links to More Info: BT899253

Component: Global Traffic Manager (DNS)

Symptoms:
Making changes to wide IP pools through GUI management do not take effect.

Conditions:
-- GTM configuration contains a sufficiently high number of pools (~ 15,000).
-- Using the GUI to assign a pool to a wide IP.

Impact:
Changes do not take effect. Unable to use the GUI to manage which pools are associated with a wide IP.

Workaround:
Use TMSH.

---

898381-3 : Changing the setting of apm-forwarding-fastl4 profile does not take effect

Links to More Info: BT898381

Component: Access Policy Manager

Symptoms:
Changing the setting of apm-forwarding-fastl4 profile does not take effect and is not getting applied to the last leg of client-initiated VPN traffic.

Conditions:
- APM is configured on the BIG-IP system.
- BIG-IP Administrator (Admin) has configured a VPN tunnel.
- Admin is trying to change the TCP characteristic of the last leg of VPN tunnel traffic by tuning the parameters of FastL4 profile apm-forwarding-fastl4.

Impact:
Admin cannot enforce the updated values of apm-forwarding-fastl4 profile on the last leg of client-imitated VPN tunnel traffic.

Workaround:
None.

---

897437-7 : First retransmission might happen after syn-rto-base instead of minimum-rto.

Links to More Info: BT897437

Component: Local Traffic Manager

Symptoms:
If a TCP profile is configured with a syn-rto-base value that is lower than minimum-rto, the first retransmission might happen after syn-rto-base.

This behavior is encountered only if the BIG-IP system is unable to compute the new RTO value before the retransmission timer expires, meaning:

-- The BIG-IP system has not received a packet with a TCP timestamp reply.
-- The BIG-IP system has not received an ACK for a timed sequence number.

Conditions:
Configured value of syn-rto-base is lower than minimum-rto.

Impact:
Retransmission might happen sooner than expected.

Workaround:
There are two possible workarounds:

-- Avoid using a syn-rto-base value that is lower than the minimum-rto value (the default values are 3 seconds for syn-rto-base and 1 second for minimum-rto).

-- Consider enabling timestamps to allow faster RTT measurement.

---

895669-3 : VCMP host does not validate when an unsupported TurboFlex profile is configured

Links to More Info: BT895669

Component: TMOS

Symptoms:
There is no validation error for when unsupported TurboFlex profiles are configured on vCMP hosts for relevant platforms. Due to this lack of validation, it can result in incorrect FPGA firmware being loaded on the host and thus a guest may fail to start or reboot constantly.

Conditions:
(1) Provision vCMP on the host and deploy 2x guests with 4 cores
(2) On the vCMP host, manually change TurboFlex profile type to be one that it does not support.

Impact:
Incorrect FPGA firmware is loaded on the host, which can cause problems with the data plane on the guest.

Workaround:
Only use supported turboflex profiles.

---

894593-2 : High CPU usage caused by the restjavad daemon continually crashing and restarting

Links to More Info: BT894593

Component: TMOS

Symptoms:
Restjavad may become unstable if the amount of memory required by the daemon exceeds the value allocated for its use.

Conditions:
The memory required by the restjavad daemon may grow significantly in system configurations with either a high volume of device statistics collection (AVR provisioning), or a with relatively large number of LTM objects managed by the REST framework (SSL Orchestrator provisioning).

Impact:
The overall system performance is degraded during the continuous restart of the restjavad daemon due to a relatively high CPU usage.

Workaround:
Please don't apply the workarounds below if encountering issues after upgrade to 14.1.5.1-, 15.1.7-, 16.1.3.1- and 17.0.0.1 and you already have restjavad.useextramb set to true. If you have low restjavad memory under these conditions it is likely you are encountering a problem caused by the behaviour change introduced in ID 1025261 ( https://cdn.f5.com/product/bugtracker/ID1025261.html ). The linked article has suggestions on how to mitigate the issue.

If you have restjavad.usextramb set to false and need more memory after upgrade to a version above you will also need to set provision.restjavad.extramb to a sensible value as well as the commands below - typically something like 384 + 80% of MIN (provision.extramb | 2500), so 1984 MB for example below.
That's a high value and it may be possible to set it lower eg it may be worth trying 384 + 20% of MIN(provision.extramb|2500) which is 784 MB for example beneath. You can try different values quite quickly by changing provision.restjavad.extramb and restarting restjavad which should only effect availability of REST API for a few seconds. Generally 384 MB should be seen as the minimum.

Increase the memory allocated for the restjavad daemon (e.g., 2 GB), by running the following commands in a BIG-IP terminal.
 
tmsh modify sys db restjavad.useextramb value true
tmsh modify sys db provision.extramb value 2000
bigstart restart restjavad
Note changing provision.extramb is service effecting and systems may take several minutes to return to a state they could handle traffic. It also needs to be set on each peer of a service cluster.

Note this may lead to impact on multi-module systems with ASM as approximately only 50-60% of provision.extramb value would be allocated as extra host memory and restjavad may take up to 80% of provision.extramb. It also lowers the ASM specific host allocation resulting in some tighter memory constraints on ASM daemons. Try to use the smallest value that works.

---

893801-2 : Launching resources that are published on an APM Webtop from multiple VMWare servers will fail when the Native View client is selected

Links to More Info: BT893801

Component: Access Policy Manager

Symptoms:
If APM is configured to publish multiple VMware resources (VCS servers) on an APM Webtop, and you select the Native View Client when you launch a resource, you can launch desktops and applications only from the first resource. Attempts to launch desktop or applications from other resources result in error.

Conditions:
-- APM is configured to protect multiple VMware resources (VCS servers) and publish those resources on an APM Webtop.
-- You attempt to launch a desktop or application specifying the native VMware client.

Impact:
Cannot access desktops and applications from multiple VMware back-ends.

Workaround:
Use HTML5 client instead.

---

891565-1 : The Subject Alternative Name (SAN) field in Certificates and Certificate Signing Requests is limited to 4095 bytes

Links to More Info: BT891565

Component: Local Traffic Manager

Symptoms:
When creating a Certificate Signing Request (CSR) or when creating or using a Certificate (CRT), there is a limit of 4096 bytes in the Subject Alternative Names (SAN) field.

Since one byte is reserved, the value entered into that field cannot exceed 4095 bytes.

Note that if the SAN list is so long that it causes the entire SSL handshake (ie, all handshake messages combined) to exceed 32K, then the handshake will be aborted with the code "hs msg overflow" - see K40902150 for further details.

Conditions:
- Generation of a Certificate Signing Request with a large SAN list.
(or)
 - Use of a client-ssl profile with a virtual server, where an associated certificate contains a large SAN field

Impact:
Very long SAN values cannot be used

Workaround:
- Create multiple certificates, where each certificate has a sufficiently short SAN list, then create client-ssl profiles for each cert+key, then assign all of those profiles to the same virtual server.

- Reduce the length of the Subject Alternative Name field, if possible by collapsing multiple entries into one by using wildcards, for example '*.example.com', rather than 'one.example.com;two.example.com'

---

891333-2 : The HSB on BIG-IP platforms can get into a bad state resulting in packet corruption.

Links to More Info: K32545132, BT891333

Component: TMOS

Symptoms:
Networking connectivity issues, such as ARP resolution issues, high availability (HA) failures, health monitor instability, etc.

Packet captures with Wireshark or tshark can be used to show bit-errors/corruption in the network packet for traffic passing through the HSB. This corruption can occur in various parts of the packet such as the MAC address, EtherType, packet checksums, etc.

Conditions:
This can occur on BIG-IP hardware platforms containing a high-speed bridge (HSB).

Impact:
Network connectivity problems on some traffic passing through the affected HSB. Could be reflected in the status of Config Sync or more health monitors down on one member of HA pair.

Workaround:
Reboot the affected device.

---

891145-7 : TCP PAWS: send an ACK for half-open connections that receive a SYN with an older TSVal

Links to More Info: BT891145

Component: Local Traffic Manager

Symptoms:
SYNs received with TSVal <= TS.Recent are dropped without sending an ACK in FIN-WAIT-2 state.

Conditions:
-- Timestamps are enabled in TCP profile.
-- Local TCP connection is in FIN-WAIT-2 state.
-- Remote TCP connection abandoned the flow.
-- A new TCP connection sends a SYN with TSVal <= TS.Recent to the local connection.

Impact:
The new TCP connection cannot infer the half-open state of Local TCP connections, which prevents faster recovery of half-open connections. The local TCP connection stays around for a longer time.

Workaround:
There are two workarounds:

-- Reduce the Fin Wait 2 timeout (the default: 300 sec) so that TCP connection is terminated sooner.

-- Disable TCP Timestamps.

---

890037-3 : Rare BD process core

Links to More Info: BT890037

Component: Application Security Manager

Symptoms:
The BD process crashes leaving a core dump. ASM restarts happening failover.

Conditions:
Traffic load to some extent, but beside that we do not know the conditions leading to this.

Impact:
Failover, traffic disturbance.

Workaround:
None

---

888885-3 : BIG-IP Virtual Edition TMM restarts frequently without core

Links to More Info: BT888885

Component: Local Traffic Manager

Symptoms:
The following messages are found in the QKViews:
"bigipA notice MCP bulk connection aborted, retrying"
"bigipA notice Initiating TMM shutdown"

Prior to this, the TMM process logs that it is waiting for its instances to reach different states. For example,
"localhost notice ixlv(1.3)[0:7.0]: Waiting for tmm1 to reach state 1..."

In the /var/log/ltm file, the following message are found sometimes.
"bigip1 crit tmm9[19358]: 01230017:2: Unable to attach to PCI device 00:09.00 for Interface 1.5"

Conditions:
BIG-IP VE with SR-IOV enabled on a Red Hat Enterprise Linux 7.7 which is a part of Red Hat OpenStack Platform 13

Impact:
The TMM process restarts without a core file repeatedly.
Traffic disrupted while tmm restarts.

---

888081-6 : BIG-IP VE Migration feature fails for 1NIC

Links to More Info: BT888081

Component: TMOS

Symptoms:
When a saved UCS is attempted to be restored in a new BIG-IP Virtual Edition (VE) in order to migrate the configuration, it fails.

load_config_files[28221]: "/usr/bin/tmsh -n -g -a load sys config partitions all " - failed. -- 01071412:3: Cannot delete IP (x.x.x.x) because it is used by the system config-sync setting.

Conditions:
The UCS load step might fail if the DB variable Provision.1NicAutoconfig is set to disable.

Impact:
The UCS restore fails.

Workaround:
The DB variable can be set to enable before loading the UCS.

# tmsh modify sys db provision.1nicautoconfig value enable

---

887681-4 : Tmm SIGSEGV in rrset_array_lock,services/cache/rrset.c

Links to More Info: BT887681

Component: Global Traffic Manager (DNS)

Symptoms:
TMM Cored with SIGSEGV.

Conditions:
N/A.

Impact:
Traffic disrupted while tmm restarts.

---

887621-4 : ASM virtual server names configuration CRC collision is possible

Links to More Info: BT887621

Component: Application Security Manager

Symptoms:
A policy add/modify/delete fails with the following error:

-- crit g_server_rpc_handler_async.pl[19406]: 01310027:2: ASM subsystem error (asm_config_server.pl ,F5::ASMConfig::Handler::log_error_and_rollback): Failed on insert to DCC.VS_RAMCACHE (DBD::mysql::db do failed: Duplicate entry '375946375' for key 'PRIMARY').

Conditions:
This can occur when adding a policy. The chance of it occurring increases when there are many virtual servers.

Impact:
Every config update fails.

Workaround:
Figure out which virtual servers have the CRC collision (by looking into DCC.RAMCACHE_VS). Change the name of one of these virtual servers.

You can get the name of the affected virtual server by using the entry reported in the 'Duplicate entry' log, and running this command.

mysql -u root -p$(perl -MPassCrypt -nle 'print PassCrypt::decrypt_password($_)' /var/db/mysqlpw) -e 'SELECT * FROM DCC.VS_RAMCACHE WHERE vs_name_crc = 375946375'

---

887265-4 : BIG-IP systems may fail to come online after upgrade with ASM and VLAN-failsafe configuration★

Links to More Info: BT887265

Component: Local Traffic Manager

Symptoms:
When booting to a boot location for the first time, the system does not come on-line.

Conditions:
-- There is a large configuration.
-- VLAN failsafe is configured, and the failsafe-action is something other than failover.
-- The BIG-IP system is an appliance.

Impact:
BIG-IP processes continually restart (VLAN failsafe-action failover-restart-tm), or the BIG-IP system continually reboots (VLAN failsafe-action reboot)

Workaround:
Either disable VLAN failsafe or set the failsafe-action to failover during an upgrade.

---

887045-7 : The session key does not get mirrored to standby.

Links to More Info: BT887045

Component: Local Traffic Manager

Symptoms:
When a session variable key length is 65 KB, session mirroring fails for that specific key.

Conditions:
-- APM high availability (HA) setup.
-- Access Policy is configured and synced across both devices.
-- A session variable key of ~65 KB arrives

Impact:
The session key does not get mirrored to standby.

Workaround:
None

---

886145-1 : The 'Reconnect' and 'Reconnect All' buttons do not work if reached via a particular section of the DNS GUI.

Links to More Info: BT886145

Component: Global Traffic Manager (DNS)

Symptoms:
The 'Reconnect' and 'Reconnect All' buttons (introduced in BIG-IP version 14.1.0 to restart some or all iQuery connections) do not work when clicked.

The 'Reconnect' button does not become enabled when a server is selected from the list, and an error is logged in the browser console.

The 'Reconnect All' button is clickable but returns the error when clicked:
No response action specified by the request.

Conditions:
You have accessed the buttons via the following GUI path:

DNS :: GSLB :: Data Centers :: [dc name] > Servers

Impact:
The buttons do not work, making the corresponding feature unavailable from the GUI.

Workaround:
Access the buttons using the following alternative GUI path:

DNS :: GSLB :: Servers

---

884729-1 : The vCMP CPU usage stats are incorrect

Links to More Info: BT884729

Component: TMOS

Symptoms:
The vCMP CPU usage stats are incorrect when process on a secondary blade has the same PID as that of primary blade's qemu process.

Conditions:
A process on a secondary blade has the same PID as that of primary blade's qemu process.

Impact:
The vCMP CPU usage stats are intermittently incorrect.

Workaround:
None.

---

883149-7 : The fix for ID 439539 can cause mcpd to core.

Links to More Info: BT883149

Component: TMOS

Symptoms:
Mcpd cores during config sync.

Conditions:
This has only been observed once. The device was going from standby to active, and the connection between the BIG-IP peers stalled out.

Impact:
Mcpd cores. Traffic disrupted while mcpd restarts.

Workaround:
NA

---

882933-1 : Nslookup might generate a core during system restart

Links to More Info: BT882933

Component: Global Traffic Manager (DNS)

Symptoms:
Nslookup generates a core file. The core file name might start with "nslookup", "isc-worker", "isc-timer" or "isc-socket".

Conditions:
Multiple instances of nslookup are running when the system shuts down.

Impact:
A core file is generated. However, since this is during system shutdown, the impact should be minimal.

---

882729-5 : Applied Blocking Masks discrepancy between local/remote event log

Links to More Info: BT882729

Component: Application Security Manager

Symptoms:
Applied Blocking Masks discrepancy between local/remote event log, ASM logging event logs both locally and remotely to BIG-IQ has discrepancy.

Conditions:
This occurs when "Applied Blocking Masks" logs are emitted on a device where local and remove event logging is configured.

Impact:
This is cosmetic but can lead to confusion.

---

882609-7 : ConfigSync status remains 'Disconnected' after setting ConfigSync IP to 'none' and back

Links to More Info: BT882609

Component: TMOS

Symptoms:
After setting a device's ConfigSync IP to 'none' and then back to an actual IP address, the device remains in a disconnected state, and cannot establish ConfigSync connections to other BIG-IP systems in its trust domain.

MCPD periodically logs messages in /var/log/ltm:
err mcpd[27610]: 0107142f:3: Can't connect to CMI peer a.b.c.d, TMM outbound listener not yet created.

Conditions:
--- BIG-IP system is in a trust domain with other BIG-IP systems.
--- Local device's ConfigSync IP is set to 'none', and then back to an actual IP address.

Impact:
Devices unable to ConfigSync.

Workaround:
This workaround will disrupt traffic while TMM restarts:

1. Ensure the local ConfigSync IP is set to an IP address.
2. Restart TMM:
bigstart restart tmm


This workaround should not disrupt traffic:

Copy and paste the following command into the Advanced Shell (bash) on a BIG-IP system, and then run it. This sets the ConfigSync IP for all device objects to 'none', and then back to their correct values.

TMPFILE=$(mktemp -p /var/tmp/ ID882609.XXXXXXX); tmsh -q list cm device configsync-ip > "$TMPFILE"; sed 's/configsync-ip .*$/configsync-ip none/g' "$TMPFILE" > "$TMPFILE.none"; tmsh load sys config merge file "$TMPFILE.none"; echo "reverting back to current"; tmsh load sys config merge file "$TMPFILE"

---

881937-2 : TMM and the kernel choose different VLANs as source IPs when using IPv6.

Links to More Info: BT881937

Component: Local Traffic Manager

Symptoms:
IPv6 traffic generated from the host, either from a host daemon, monitors, or from the command line, can use a MAC and IPv6 source address from different VLANs.

Conditions:
-- Multiple VLANs configured with IPv6 addresses.
-- Multiple routes to the same destination, either the same or more specific, default routes, etc., that cover the traffic destination.
-- Changes are made to routes that cause the traffic to the destination to shift from one VLAN and gateway to another. This can be typically observed with dynamic routing updates.
- The db key snat.hosttraffic is set to disable.

Impact:
Traffic to the destination may fail because the incorrect source IPv6/MAC address is used, which might cause monitor traffic to fail.

Workaround:
tmsh list sys db snat.hosttraffic
tmsh modify sys db snat.hosttraffic value enable
tmsh save sys config

---

881065-5 : Adding port-list to Virtual Server changes the route domain to 0

Links to More Info: BT881065

Component: Local Traffic Manager

Symptoms:
When attaching the port-list to virtual server dest:port-list, the route domain of the virtual server is changed to the default value of 0, and the port-list is not correctly applied. This is encountered in the GUI but not in the CLI.

Conditions:
Using port-list along with virtual server in non default route domain using the GUI.

Impact:
You are unable to use the GUI to attach a port-list that uses a non-default route domain to a virtual server.

Workaround:
Use tmsh to attach a port-list to a virtual server if the port-list uses a non-default route domain.

---

880689-1 : Update oprofile tools for compatibility with current architecture

Component: TMOS

Symptoms:
Current operf as shipped with BIG-IP is out of date and will not work.

Per the oprofile page (https://oprofile.sourceforge.io/news/) the version included in our systems (0.9.9) was released in 2013.

Conditions:
Opcontrol still works but operf will not load.
# operf --version
use the opcontrol command instead of operf.

Impact:
Outdated operf means that it cannot be used for troubleshooting purposes.

---

880565-5 : Audit Log: "cmd_data=list cm device recursive" is been generated continuously

Links to More Info: BT880565

Component: Device Management

Symptoms:
The system generates and logs the following message continuously, at the rate of 3 times a minute, in /var/log/audit:

-- bigip1 notice tmsh[47755]: 01420002:5: AUDIT - pid=47755 user=root folder=/ module=(tmos)# status=[Command OK] cmd_data=cd / ;
-- bigip1 notice tmsh[47755]: 01420002:5: AUDIT - pid=47755 user=root folder=/ module=(tmos)# status=[Command OK] cmd_data=list cm

Conditions:
This occurs during normal operation.

Impact:
Audit log file contains numerous 'cmd_data=list cm device recursive' messages.

Workaround:
-- To suppress all messages, do the following:

1. Edit the 'include' section of syslog configuration to suppress audit logs of 'cmd_data=cd /' and 'cmd_data=list cm device recursive':

# tmsh edit /sys syslog all-properties

2. Replace 'include none' with following syntax:
===
sys syslog {
- snip -
    include "
filter f_audit {
       facility(local0) and match(AUDIT) and not match(＼"cmd_data=list cm device recursive|cmd_data=cd /＼");
};"
- snip -
}


-- To filter the messages sent to existing remote syslog servers, do the following:

1. Set sys syslog remote-servers none:
# tmsh modify sys syslog remote-servers none

2. Define the remote syslog server in the 'sys syslog include' statement.

3. Add the following filter:

   filter f_remote_server {
   not (facility(local0) and message(＼"AUDIT＼") and match(＼"cmd_data=list cm device recursive|cmd_data=cd /＼"));
    };

Result: The system sends all messages to the remote syslog server, excluding the messages that match the filter.


Here is a sample filter, with sample data:

sys syslog {
    include "
    filter f_remote_server {
    not (facility(local0) and message(＼"AUDIT＼") anD match(＼"cmd_data=list cm device recursive|cmd_data=cd /＼"));
    };
    destination d_remote_loghost {
        udp(＼"10.0.0.1＼" port(514));
    };
    log {
        source(s_syslog_pipe);
        filter(f_remote_server);
        destination(d_remote_loghost);
    };
    "
}

---

879969-8 : FQDN node resolution fails if DNS response latency >5 seconds

Links to More Info: BT879969

Component: TMOS

Symptoms:
When resolving FQDN names for FQDN nodes/pool members, pending DNS requests are timed out after 5 seconds with no response from the DNS server.
If there is a persistent latency of 5 seconds or greater in the DNS server responses, FQDN name resolution will fail and ephemeral nodes/pool members will not be created.

Conditions:
- BIG-IP using FQDN nodes/pool members
- Persistent latency of 5 seconds or greater in the DNS server responses

Impact:
Ephemeral pool members may not be created, thus no traffic will be sent to the intended pool members.

Workaround:
Resolve any persistent latency issues that might cause delays of 5 seconds or more in DNS server responses.

---

878253-5 : LB::down no longer sends an immediate monitor probe

Links to More Info: BT878253

Component: Local Traffic Manager

Symptoms:
The iRule command LB::down is supposed to send an immediate monitor probe, but it does not.

Conditions:
-- Executing LB::down in an iRule.

Impact:
A monitor probe is not immediately sent, which may cause a pool member to be marked down longer than it should be.

---

874877-4 : The bigd monitor reports misleading error messages

Links to More Info: BT874877

Component: Local Traffic Manager

Symptoms:
When a recv string is used with an HTTP/HTTP2/HTTPS/TCP monitor, the HTTP status code is collected and in the event of failure, the most recent value (from before the failure) is retrieved and used as part of the log output. This can result in a message that is misleading.

Conditions:
- The BIG-IP system configured to monitor an HTTP/HTTP2 server.
- The BIG-IP system configured to monitor an HTTPS/TCP monitor.

Impact:
Generates a misleading log messages, difficulty in identifying the actual cause of the monitor failure.

This occurs because the system stores the 'last error' string for these monitors. This can be misleading, especially when a receive string is used. Following is an example:

-- A BIG-IP system is monitoring an HTTP server that is returning proper data (i.e., matching the receive string).
-- The HTTP server goes down. Now the BIG-IP system will have a last error string of 'No successful responses received before deadline' or 'Unable to connect'.
-- The HTTP server goes back up and works for a while.
-- For some reason, the HTTP server's responses no longer match the receive string.

In this case, a message is logged on the BIG-IP system:

      notice mcpd[6060]: 01070638:5: Pool /Common/http member /Common/n.n.n.n:n monitor status down. [ /Common/my_http_monitor: down; last error: /Common/my_http_monitor: Unable to connect @2020/01/09 04:18:20. ] [ was up for 4hr:18mins:46sec ]

The 'Unable to connect' last error reason is not correct: the BIG-IP system can connect to the HTTP server and gets responses back, but they do not match the received string.

Workaround:
None

---

872165-4 : LDAP remote authentication for REST API calls may fail during authorization

Links to More Info: BT872165

Component: TMOS

Symptoms:
LDAP (or Active Directory) remote authentication fails during authorization for REST API calls.

Clients receive 401 Unauthorized messages and /var/log/restjavad.x.log may report messages similar to the following:

-- [I][1978][26 Mar 2021 13:23:36 UTC][8100/shared/authn/login AuthnWorker] User remoteuser failed to login from 192.0.2.1 using the tmos authentication provider

-- [WARNING][807][26 Mar 2021 14:43:24 UTC][RestOperationIdentifier] Failed to validate Authentication failed.

Conditions:
LDAP (or Active Directory) remote authentication configured with a User Template instead of a Bind Account.

Impact:
Unable to authenticate as remote-user for access that uses authorization, like REST API calls.

Workaround:
You can use either of the following workarounds:

-- Configure LDAP/AD remote authentication to utilize a Bind account instead of the User Template.
-- Create a local user account for each remote user, allowing local authorization (authentication remains remote).

---

869541-3 : Series of unexpected <aborted> requests to same URL

Links to More Info: BT869541

Component: Access Policy Manager

Symptoms:
Series of unexpected <aborted> requests to same URL

Conditions:
Web-app using special code pattern in JavaScript.

For example:

     loc = window.location;

     obj = {}

     for (i in loc) {
        obj[i] = loc[i];
     }

Impact:
Page load is aborted

Workaround:
Following iRule can be used with customized SPECIFIC PAGE_URL value:

when REWRITE_REQUEST_DONE {
  if {
    [HTTP::path] ends_with "SPECIFIC_PAGE_URL"
  } {

    # log "URI=([HTTP::path])"
    # Found the file we wanted to modify

    REWRITE::post_process 1
    set do_fix 1
  }
}

when REWRITE_RESPONSE_DONE {
  if {[info exists do_fix]} {
    unset do_fix

    set strt [string first {<script>try} [REWRITE::payload]]

    if {$strt > 0} {
      REWRITE::payload replace $strt 0 {
        <script>
          (function () {
            var dl = F5_Deflate_location;
            F5_Deflate_location = function (o) {
              if (o.F5_Location) Object.preventExtensions(o.F5_Location)
              return dl(o);
            }
          })()
        </script>
      }
    }
  }
}

---

869049-7 : Charts discrepancy in AVR reports

Links to More Info: BT869049

Component: Application Visibility and Reporting

Symptoms:
Discrepancy in AVR reports. When filtering on the 'last month' interval, a specific number of total requests per virtual server is shown. Then when filtering to the present day from a date that encompasses that month, a lower number is reported.

Conditions:
-- Number of records in database exceeds the maximum mount of data that AVR can aggregate between different table-resolutions.
-- There are metrics on the report other than the default one (hits-count).

Impact:
Stats on DB get corrupted and incorrect.

Workaround:
None.

---

868801-2 : BIG-IP still sends STARTTLS if the 'No encryption' SNMP option is enabled

Links to More Info: BT868801

Component: TMOS

Symptoms:
The SMTP 'No Encryption' configuration option is not honored by the BIG-IP device.

Conditions:
The 'No Encryption' option is selected under the SMTP configuration object.

Impact:
BIG-IP disregards its SMTP configuration and attempts to initiate TLS.

Workaround:
None

---

868557-1 : Unable to initiate SWG database download from Admin UI when management network has no direct internet connectivity.

Links to More Info: BT868557

Component: Access Policy Manager

Symptoms:
If the management network is not directly connected to the internet, 'Download Now' action on 'Access ›› Secure Web Gateway : Database Settings : Database Download' fails the connectivity check and refuses to start database download.

Conditions:
-- Configure proxy in the same subnet and block BIG-IP management traffic on the gateway
-- Remove default routes from linux routing table and add route to the proxy server if necessary.

Impact:
Database download fails and you see an error message:

"Database download server (download.websense.com) could not be reached. Please verify the correctness of the DNS lookup server configured on this BIG-IP system."

Workaround:
-- Run the following tmsh command:
tmsh modify sys url-db download-schedule urldb download-now true

-or-

-- Configure download settings and wait until the scheduled database download.

---

867985-6 : LTM policy with a 'shutdown' action incorrectly allows iRule execution

Links to More Info: BT867985

Component: Local Traffic Manager

Symptoms:
BIG-IP systems provide manipulation tools over a connection with an LTM policy and/or iRule. LTM policy takes precedence over iRules and has an option to shutdown a connection based on satisfied conditions. When a connection is closing, an iRule should not be executed under the same conditions.

Conditions:
-- The BIG-IP system has a virtual server with an LTM policy and an iRule.
-- The LTM policy has action 'shutdown connection' under certain conditions.
-- The iRule has an event which is triggered under the same conditions.

Impact:
The iRule is executed before the connection is being reset.

Workaround:
None.

---

867549-1 : LCD touch panel reports "Firmware update in progress" indefinitely★

Links to More Info: BT867549

Component: TMOS

Symptoms:
After a software upgrade that includes an LCD firmware update, the LCD touch panel may remain stuck reporting an error indefinitely / for longer than 30 minutes:
Firmware update in Progress may take up to 30 minutes.

Conditions:
This issue occurs when all of the following conditions are met:

-- You have one of the following BIG-IP platforms:
 * i850
 * i2x00
 * i4x00
 * i5x00
 * i7x00
 * i10x00
 * i11x00
 * i15x00
 * HRC-i2x00
 * HRC-i5x00
 * HRC-i10x00

-- You perform a software upgrade that updates the firmware on the LCD touch panel, e.g. upgrading from BIG-IP v13.1.x to BIG-IP v14.1.x or newer.

Impact:
The system is functional, but the LCD displays the firmware update screen indefinitely. The LCD cannot be used while it is frozen on the firmware update warning screen.

Workaround:
Important: Before attempting this workaround, check that there are no indications the system is still performing a firmware update (such as a terminal prompt), and that the following messages can be found in /var/log/ltm after the most recent boot:

notice chmand[6302]: 012a0005:5: firmware update succeeded.
notice chmand[6302]: 012a0005:5: Firmware check finished.

These messages indicates that the firmware update has finished, and the LCD is displaying the warning screen in error, so it is safe to perform the workaround.

Reboot the BIG-IP system to return the LCD to normal operation.

After a reboot of the BIG-IP operating system, the LCD touch panel should be responsive.

---

867253-4 : Systemd not deleting user journals

Links to More Info: BT867253

Component: TMOS

Symptoms:
When setting 'SystemMaxUse' to any value, systemd does not honor this limit, and the specified size is exceeded.

Conditions:
Using a non-TMOS user account with external authentication permission.

Note: Systemd-journald is configured to create a user journal for every remote user that logs into the BIG-IP system.

Impact:
Journald filling up the file system. These journals are allocated with a minimum size of 4MiB and are not removed when the log entries age-out.

Workaround:
Option 1:
To immediately free up space, manually remove per-user journal logs from the following location:
  /var/log/journal/*/user-*

Option 2:
To prevent the system from creating these journal files going forward:

1. Edit /etc/systemd/journald.conf and add the following at the bottom of the file:
  SplitMode=none

2. Restart systemd-journal service
  # systemctl restart systemd-journald

3. Delete the existing user journal files from /var/log
  # rm /var/log/journal/*/user-*

Note:
-- You must apply this workaround separately to each blade of a VIPRION or vCMP guest running on a VIPRION.
-- You must reapply this workaround after performing software installations.

---

865653-1 : Wrong FDB table entries with same MAC and wrong VLAN combination

Links to More Info: BT865653

Component: TMOS

Symptoms:
Forwarding DataBase (FDB) table has duplicate MAC entries with the incorrect VLANs.

MAC entries are correct in the switch but not in the control plane.

Conditions:
Enable L2Wire.

Impact:
Duplicate MAC entries with incorrect VLANs in FDB table.

Workaround:
Restart bcm56xxd:
bigstart restart bcm56xxd

Note: You can use tmsh to see the table:
tmsh -m show net fdb

---

863601-5 : Panic in TMM due to internal mirroring interactions

Links to More Info: BT863601

Component: Wan Optimization Manager

Symptoms:
The Traffic Management Microkernel suddenly restarts due to a SIGSEGV segmentation fault.

Conditions:
-- APM is being used.
-- Connection mirroring is being used.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
Avoid configuring connection mirroring when APM is being used.

---

862949-4 : ZoneRunner GUI is unable to display CAA records

Links to More Info: BT862949

Component: Global Traffic Manager (DNS)

Symptoms:
Attempting to manage a CAA record via the GUI shows an error:

Resolver returned no such record.

Conditions:
-- Navigate to DNS :: Zones :: ZoneRunner :: Resource Record List :: Search All Records.
-- Click on record of type CAA.

Impact:
Unable to update CAA records via the GUI.

Workaround:
You can use either of the following workarounds:

-- Manually edit the BIND configuration.
-- Delete the record and create a new one with the desired changes.

---

862001-6 : Improperly configured NTP server can result in an undisciplined clock stanza

Links to More Info: BT862001

Component: Local Traffic Manager

Symptoms:
There can be an undisciplined clock stanza in /etc/ntp.conf, resulting in an undisciplined clock.

NTP documentation:
http://support.ntp.org/bin/view/Support/UndisciplinedLocalClock

Conditions:
This might occur in at least the following ways:
-- No server is specified in 'sys ntp servers {}'.
-- A server does exist, but an improper method was used to configure the NTP server.

Impact:
When the LOCAL undisciplined clock is left as a valid time-source, it delays the system synchronizing time to a real NTP server. It can also result in time being adjusted incorrectly if the the remote time-source becomes unreachable.

Workaround:
Configure a dummy server via 'ntp servers {}' that does not respond.

While this removes the undisciplined local clock, it does result in ntpd having an unreachable time source, and could be flagged in diagnostics, misdirect other troubleshooting, generate unnecessary traffic, etc.
 
However, if the 'dummy' source starts responding, it could become a rogue time source.

---

860573-6 : LTM iRule validation performance improvement by tracking procedure/event that have been validated

Links to More Info: BT860573

Component: TMOS

Symptoms:
Loading (with merge) a configuration file that references some iRules results in validating every iRule and ends up validating the same procedures multiple times for every virtual server a single iRule is associated with.

Conditions:
Configuration which has 100's of virtual servers, some iRules that are assigned to all virtual servers and a few library iRules.

Impact:
Task fails (via REST) or ends up taking a really long time when run manually.

Workaround:
None.

---

860277-6 : Default value of TCP Profile Proxy Buffer High Low changed in 14.1

Links to More Info: BT860277

Component: Local Traffic Manager

Symptoms:
Version: 13.1.3.1

# tmsh list ltm profile tcp tcp proxy-buffer-high proxy-buffer-low
ltm profile tcp tcp {
    proxy-buffer-high 49152
    proxy-buffer-low 32768
}

       proxy-buffer-high
            Specifies the highest level at which the receive window is closed.
            The default value is 49152.

       proxy-buffer-low
            Specifies the lowest level at which the receive window is closed.
            The default value is 32768.

Version: 14.1.2.2

# list ltm profile tcp TCP proxy-buffer-high proxy-buffer-low
ltm profile tcp tcp {
    proxy-buffer-high 65535
    proxy-buffer-low 32768
}


proxy-buffer-high
            Specifies the highest level at which the receive window is closed.
            The default value is 131072.

proxy-buffer-low
            Specifies the lowest level at which the receive window is closed.
            The default value is 98304.

Conditions:
Looking at the help for proxy-buffer-high and proxy-buffer-low in tmsh

Impact:
The default value for proxy-buffer-high is 65535 and the default value for proxy-buffer-low is 32768, but the help text indicates that the defaults are 13072 and 98304 respectively.

---

858877-5 : SSL Orchestrator config sync issues between HA-pair devices

Links to More Info: BT858877

Component: TMOS

Symptoms:
SSL Orchestrator configuration deployment across BIG-IP devices in a high-availability (HA) group may result in inconsistent state, if during deployment the connectivity between the HA peers is lost.

Conditions:
Deploying SSL Orchestrator configuration across BIG-IP devices in an HA group.

Impact:
Inconsistent SSL Orchestrator configuration on BIG-IP devices in an HA group.

Workaround:
Run the /usr/bin/ha-sync script. See ha-sync -h for help.

---

857769-1 : FastL4+HTTP or FastL4+Hash-Persistence virtual servers do not work correctly in DSR mode.

Links to More Info: BT857769

Component: Local Traffic Manager

Symptoms:
Given a long-lived TCP connection that can carry multiple client requests (for example, but not limited to, HTTP requests), the BIG-IP system fails to forward requests after the forty-eighth one.

The client will try re-transmitting the answered request, but the BIG-IP system will persist in dropping it.

Conditions:
This issue occurs when all of the following conditions are met:

1) The virtual server uses the FastL4 profile.
2) The virtual server also uses the HTTP or Hash-Persistence profiles.
3) The virtual server operates in DSR (Direct Server Return) mode (also known as N-Path).

Impact:
The BIG-IP system fails to forward traffic.

Workaround:
Do not use the HTTP or Hash-Persistence profiles with a FastL4 virtual server operating in DSR mode.

Note: It is fine to use an iRule that calls hash persistence commands (for example, "persist carp [...]") as long as the Hash-Persistence profile is not associated to the virtual server. This technique will allow you to persist on a hash based on L4 information that you can extract at CLIENT_ACCEPTED time. For example, the following iRule correctly persists a specific client socket to a pool member in a FastL4 DSR configuration:

when CLIENT_ACCEPTED {
   persist carp [IP::client_addr]:[TCP::client_port]
}

---

857045-4 : LDAP system authentication may stop working

Links to More Info: BT857045

Component: TMOS

Symptoms:
If the system daemon responsible for LDAP authentication crashes, the system will not automatically restart it, and remote LDAP authentication may stop working.

In /var/log/daemon.log, you may see the following:

warning systemd[1]: nslcd.service failed

Conditions:
Nslcd daemon crashed, and it fails to restart.

Impact:
System authentication stops working until nslcd is restarted.

Workaround:
Manually restart nslcd daemon:

systemctl start nslcd



nslcd can be reconfigured to restart automatically and create core files when it crashes, though these changes will be lost across software installs (and is not backed up as part of a UCS archive):

1. Run "systemctl edit nslcd", which will open a text editor (by default, nano).

2. In the text editor, add these contents:

[Service]

# Allow core files
LimitCORE=infinity
# Try to keep auth daemon running, even if it crashes
Restart=always

3. Exit the text editor and save the file

4. Check the output of "systemctl status nslcd" for any warnings/errors from systemd as a result of editing the file; there should not be any.

5. Restart nslcd:
   systemctl restart nslcd

---

851837-1 : Mcpd fails to start for single NIC VE devices configured in a trust domain

Links to More Info: BT851837

Component: TMOS

Symptoms:
Single NIC BIG-IP Virtual Edition (VE) devices configured in a trust domain (e.g., in high availability (HA)) cannot reload a running configuration when restarted and/or when mcpd fails to load the config, and reports a validation error:

err mcpd[25194]: 0107146f:3: Self-device config sync address cannot reference the non-existent Self IP ([IP ADDR]); Create it in the /Common folder first.

Conditions:
Single NIC VE devices configured in a trust domain (e.g., HA)

Impact:
The mcpd process fails to start, and the configuration does not load.

Workaround:
Manually copy and paste the self IP configuration snippet into the /config/bigip_base.conf file:

1. Connect to the CLI.

2. Edit bigip_base.conf, and add the following:

net self self_1nic {
    address 10.0.0.1/24
    allow-service {
       default
    }
    traffic-group traffic-group-local-only
    vlan internal
}

Note: replace 10.0.0.1 with the IP indicated in the error message

3. Save the changes and exit.

4. Load the configuration using the command:
tmsh load sys config

5. If APM or ASM is provisioned/configured, then also restart services with this command:
bigstart restart

---

851385-8 : Failover takes too long when traffic blade failure occurs

Links to More Info: BT851385

Component: Local Traffic Manager

Symptoms:
When blades 1 and 4 are disabled on the active chassis, the failover period is between 3.4 to 4.7 seconds before the next-active device starts processing messages.
  
If the blades are physically pulled from the chassis,
the failure occurs within 1 second.

Conditions:
-- Multi-blade VIPRION system
-- Blades 1 and 4 are connected to the network via trunks, blades 2 and 3 are CPU-only blades
-- Blades 1 and 4 are disabled via the GUI

Impact:
Significant delay before BIG-IP delivers a web page during between-cluster failover

---

846977-7 : TCP:collect validation changed in 12.0.0: the first argument can no longer be zero★

Links to More Info: BT846977

Component: Local Traffic Manager

Symptoms:
Validation for TCP::collect was changed in BIG-IP software v12.0.0 (with the introduction of JET specifications). Prior to 12.0.0, there were no restrictions on the values of the two arguments. As of 12.0.0, the first argument ('collect_bytes') must be a positive integer, and the second argument ('skip_bytes) must be a non-negative integer.

Occurrences of 'TCP::collect 0 0' in iRules experience issues when upgrading to a newer version, producing warnings in LTM log:

/Common/T_collect:9: warning: [The following errors were not caught before. Please correct the script in order to avoid future disruption. "invalid argument 0; expected syntax spec:"136 17][TCP::collect 0 0].

Conditions:
-- Using a version of BIG-IP software earlier than 12.0.0, configure an iRule with a 'TCP::collect 0 0' command.
-- Upgrade to 12.0.0 or later.

Impact:
Warning in the LTM log file. The iRules containing 0 values do not function as expected. There is no other impact.

Workaround:
Change 'TCP::collect 0 0' to a value other than 0 (zero) in any iRules before or after upgrade.

---

844925-5 : Command 'tmsh save /sys config' fails to save the configuration and hangs

Links to More Info: BT844925

Component: TMOS

Symptoms:
The 'tmsh save /sys config' command hangs and fails to save the configuration if there is a memory allocation failure when creating the reply.

Conditions:
-- A large number of iApps: in the thousands.
-- Each iApp has tens of variables.

Impact:
Because tmsh cannot save the configuration, if the BIG-IP system reboots, any changes made since the last successful save are lost.

Workaround:
Run the command:
tmsh save /sys config binary

This does not save the configuration to files in /config, but it does at least allow you to save the binary configuration.

That way, you can reboot the BIG-IP system and not lose the configuration.

Note: It is possible that a reboot will provide sufficient memory to save to configuration files. It depends on the configuration of virtual memory at the time of the save. It is possible that every time you want to save the config, you must use the binary option.

---

844597-6 : AVR analytics is reporting null domain name for a dns query

Links to More Info: BT844597

Component: Advanced Firewall Manager

Symptoms:
AVR analytics is reporting null domain name for a DNS query if DNS DoS profile is attached to a virtual server, but the profile does not have the matching type vector enabled to the query type.

Conditions:
-- DNS DoS profile is attached to a virtual server.
-- The query type in the DNS query does not match an enabled DNS vector on the DNS profile.

Impact:
DNS domain name is reported as NULL

Workaround:
Enable the matching type vector on the DNS DoS profile.

---

843293-1 : When L7 performance FPGA is loaded, "tmsh show sys fpga" shows standard-balanced-fpga.

Links to More Info: BT843293

Component: TMOS

Symptoms:
When L7 performance FPGA is loaded, "tmsh show sys fpga" shows standard-balanced-fpga. "tmsh list sys fpga" will list the expected type "l7-performance-fpga".

Conditions:
-- iSeries i5000/i7000/i10000/i11000/i15000 platform
-- Pay as you grow (PAYG) license applied
-- L7 performance FPGA is loaded

Impact:
"tmsh show sys fpga" shows standard-balanced-fpga

This is cosmetic and there is no function impact. "tmsh list sys fpga" will list the correct type "l7-performance-fpga".

Workaround:
N/A

---

842669-6 : Syslog-ng / systemd-journald cannot handle logs with embedded newlines, write trailing content to /var/log/user.log

Links to More Info: BT842669

Component: TMOS

Symptoms:
Systemd-journald cannot handle logs with embedded newlines, write trailing content to /var/log/user.log. Bare ')' being logged to /var/log/user.log., for example:

cat /var/log/user.log
[...]: Deleting file /shared/core/*.core.*
[...]: Deleting file /shared/core/*.core.*
[...] )
[...] )

Conditions:
This occurs when the system logs syslog messages containing embedded newlines, such as

- The cron process tries and fails to send an email because of output from a cron script.
- audit log entries when editing irules
- Modifying the syslog 'include' configuration
- Applying ASM policy configuration change
- GTM.debugprobelogging output from big3d
- iqsyncer mcpd message debug output (log.gtm.level=debug)

Impact:
The logging subsystem accepts syslog messages with embedded newlines, and writes first line to the appropriate file, and remaining lines to both /var/log/user.log and /var/log/messages

Workaround:
View the logs using journalctl

---

842193-6 : Scriptd coring while running f5.automated_backup script

Links to More Info: BT842193

Component: iApp Technology

Symptoms:
When the iApp, f5.automated_backup, script is terminated due to the max-script-run-time, the script still continues and finishes, sometimes with scriptd coring and posting error messages in /var/log/ltm:

-- info logger[17173]: f5.automated_backup iApp autobackup: STARTED
-- info logger[17175]: f5.automated_backup iApp autobackup: pem.f5lab.com_20191004.ucs GENERATING

-- err scriptd[13532]: 014f0004:3: script has exceeded its time to live, terminating the script <------ after 20 secs, it continues even after the scriptd core.

-- notice sod[3235]: 01140041:5: Killing /usr/bin/scriptd pid 13532.
-- warning sod[3235]: 01140029:4: high availability (HA) daemon_heartbeat scriptd fails action is restart.
-- info logger[19370]: f5.automated_backup iApp autobackup: pem.f5lab.com_20191004.ucs SAVED LOCALLY
(/var/local/ucs)
-- info logger[19372]: f5.automated_backup iApp autobackup: FINISHED

Conditions:
Configure the iApp application with f5.automated_backup template to do auto-backup at regular intervals.

Impact:
Scriptd core.

Workaround:
Increasing the sys scriptd max-script-run-time higher then the default of 300 seconds might be helpful if the higher timeout allows the script to complete.

For example, if the script is saving a UCS and the save takes 400 seconds, then increasing the max-script-run-time to 430 seconds would allow the script to finish and would work around this issue.

---

842137-6 : Keys cannot be created on module protected partitions when strict FIPS mode is set

Links to More Info: BT842137

Component: Local Traffic Manager

Symptoms:
When the Hardware Security Module (HSM) FIPS mode is set to FIPS 140-2 Level 3 protection, new keys cannot be created in the module's protected partition.

Note: Although FIPS grade Internal HSM (PCI card) is validated by the Marvell company at FIPS 140-2 Level 3, the BIG-IP system is not 140-2 Level 3 validated.

Conditions:
-- FIPS 140-2 Level 3 protection is configured on a NetHSM partition.
-- You attempt to create a FIPS key using that partition.

Impact:
New Keys cannot be create.

Workaround:
Follow these steps to generate a new NetHSM key called 'workaround' and install it into the BIG-IP config:

1. Generate the key:

[root@bigip1::Active:Standalone] config # fipskey.nethsm --genkey -o workaround -c module
WARNING: fipskey.nethsm will soon be deprecated for use with Thales. Please switch to using tmsh commands instead.
tmsh commands...

Generate Key:
tmsh create sys crypto key <key_name> security-type nethsm [gen-certificate|gen-csr] ...
For an exhaustive list of options, please consult F5's tmsh documentation.
Generate CSR for existing key:
tmsh create sys crypto csr <csr_name> key <key name> ...
For an exhaustive list of options, please consult F5's tmsh documentation.
Generate Self-Signed Certificate for existing key:
tmsh create sys crypto cert <cert_name> key <key name> ...
For an exhaustive list of options, please consult F5's tmsh documentation.
Delete Key:
tmsh delete sys crypto key <keyname>


str[cd /shared/tmp && /opt/nfast/bin/generatekey -b pkcs11 certreq=yes selfcert=yes protect=module size=2048 embedsavefile="workaround" plainname="workaround" digest=sha256]
key generation parameters:
 operation Operation to perform generate
 application Application pkcs11
 protect Protected by module
 verify Verify security of key yes
 type Key type RSA
 size Key size 2048
 pubexp Public exponent for RSA key (hex)
 embedsavefile Filename to write key to workaround
 plainname Key name workaround
 x509country Country code
 x509province State or province
 x509locality City or locality
 x509org Organisation
 x509orgunit Organisation unit
 x509dnscommon Domain name
 x509email Email address
 nvram Blob in NVRAM (needs ACS) no
 digest Digest to sign cert req with sha256

Key successfully generated.
Path to key: /opt/nfast/kmdata/local/key_pkcs11_ua882aa9fadee7e440772cb6686358f4b283922622
Starting synchronisation, task ID 5de83486.6e9e32d7f367eaf4
Directory listing failed: No such file or directory


2. Confirm the presence of the key with the label 'workaround':

[root@bigip1::Active:Standalone] config # nfkminfo -l

Keys with module protection:

 key_pkcs11_ua882aa9fadee7e440772cb6686358f4b283922622 `workaround'

Keys protected by cardsets:
...


3. Install the key:

[root@bigip1::Active:Standalone] config # tmsh install sys crypto key workaround from-nethsm


4. Install the public certificate:

[root@bigip1::Active:Standalone] config # tmsh install sys crypto cert workaround from-local-file /config/ssl/ssl.crt/workaround

---

839361-7 : iRule 'drop' command does not drop packets when used in DNS_RESPONSE

Links to More Info: BT839361

Component: Global Traffic Manager (DNS)

Symptoms:
The iRule 'drop' command may not drop a DNS response when called under DNS_RESPONSE event.

Conditions:
iRule drop is used under DNS_RESPONSE event.

Impact:
DNS response may be improperly forwarded to the client.

Workaround:
Use DNS::drop instead.

---

838597-5 : Unable to load license/dossier when going down for vCMP

Links to More Info: BT838597

Component: TMOS

Symptoms:
After provisioning vCMP on the BIG-IP system and rebooting, vcmpd might core during the shutdown with a log message in /var/log/ltm "Unable to load license/dossier: Failed to connect to HAL via halmsg".

Conditions:
This occurs when rebooting the BIG-IP system after provisioning vCMP.

Impact:
This crash does not impact any functionality - system is shutting down anyway

Workaround:
None

---

838337-8 : The BIG-IP system's time zone database does not reflect recent changes implemented by Brazil in regard to DST.

Links to More Info: BT838337

Component: TMOS

Symptoms:
In 2019, Brazil cancelled DST (Daylight Saving Time) and is now on standard time indefinitely. The BIG-IP system's time zone database needs to be updated to reflect this change.

Conditions:
None.

Impact:
BIG-IP systems configured to use "America/Sao_Paul" (or other applicable Brazilian localities) will still apply DST. Hence time will spring forward and backward on previously designated dates.

This will have no impact to application traffic handled by the BIG-IP system. However, logs, alerts, reports, cron jobs, etc. will use incorrect time.

Note: You can inspect the time changes your system is due to apply by running the following command from the BIG-IP system's advanced shell (bash):

zdump -v <timezone>

For example:

zdump -v America/Sao_Paulo

Workaround:
As a workaround, you can set the BIG-IP system's time zone to that of a different country with the same UTC offset and already not observing DST.

For example, instead of using "America/Sao_Paul", you could use "America/Buenos_Aires" to obtain the same result.

---

831737-3 : Memory Leak when using Ping Access profile

Links to More Info: BT831737

Component: Access Policy Manager

Symptoms:
The memory usage by pingaccess keeps going up when sending request with expired session cookie to a virtual server with PingAccess Profile.

Conditions:
1. BIG-IP virtual server that contains PingAccess Profile.
2. Request sent with expired session cookie.

Impact:
Memory leak occurs in which ping access memory usage increases.

---

830073-7 : AVRD may core when restarting due to data collection device connection timeout

Links to More Info: BT830073

Component: Application Visibility and Reporting

Symptoms:
Avrd crashes, one or more core avrd files exist in /var/core

Conditions:
-- A BIG-IP system is managed by BIG-IQ via secure channel
-- Avrd is restarted.

Impact:
Avrd cores as it is shutting down. During avrd shutdown, the BIG-IQ data collection device (DCD) is unreachable for 10 minutes

Workaround:
None.

---

829657-5 : Possible TMM crash with a multi-IP PEM subscriber configured with more than 16 IP addresses

Links to More Info: BT829657

Component: Policy Enforcement Manager

Symptoms:
TMM crash.

Conditions:
PEM configured with a multi-IP subscriber with more than 16 IP addresses.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
Do not create a PEM subscriber with more than 16 IP addresses.

---

829021-1 : BIG-IP does not account a presence of http2 profile when response payload is modified

Links to More Info: BT829021

Component: Local Traffic Manager

Symptoms:
The BIG-IP system might close a connection when the HTTP response payload is modified and sent without chunking encoding. If communication goes over an HTTP connection, the BIG-IP system closes a connection to tell a client that a response is served. With HTTP/2 connections, an unsized response is marked with the END_STREAM flag. This case is not accounted for, and the BIG-IP system closes HTTP communication with a server anyway.

Conditions:
-- A virtual server has an http/2 profile configured on the client side.
-- There are other profiles configured which can modify the HTTP response payload.

Impact:
The BIG-IP system wastes resources not reusing a server side HTTP connection when an unsized response is sent over an HTTP/2 connection to a client.

Workaround:
None.

---

814273-6 : Multicast route entries are not populating to tmm after failover

Links to More Info: BT814273

Component: TMOS

Symptoms:
Multicast route entries are not populating in tmm after failover. ZebOS has the multicast entries, but tmm does not.

Conditions:
-- High Availability (HA) configured, with multicast traffic.
-- A failover occurs.

Impact:
Multicast traffic does not pass through properly

Workaround:
Clear the multicast entries in ZebOS manually:
> clear ip mroute *
> clear ip igmp group

---

812693-5 : Connection in FIN_WAIT_2 state may fail to be removed

Links to More Info: BT812693

Component: Local Traffic Manager

Symptoms:
If a connection that has a fully closed client-side, but a server-side still in FIN_WAIT_2, receives a SYN matching the same connflow, the idle time is reset. This can result in the fin-wait-2-timeout never being reached. The SYN will be responded to with a RST - 'TCP Closed'

Conditions:
- Client side connection has been fully closed. This may occur if a client SSL profile is in use and an 'Encrypted Alert' has been received.
- Server side has sent a FIN which has been ACK'd, but no FIN has been received from the server.
- SYN received matching the existing connflow before the FIN-WAIT-2-timeout has been reached (300 default).

Impact:
Connection may fail to be removed in a timely manner. New connection attempts are RST with 'TCP Closed'

Workaround:
You can use either of the following:
-- Ensure servers are sending FIN's so as not to leave the connection in a FIN_WAIT_2 state.

-- Mitigate the issue by lowering the FIN-WAIT-2-timeout to a smaller value, e.g., FIN-WAIT-2-timeout 10.

---

809089-4 : TMM crash after sessiondb ref_cnt overflow

Links to More Info: BT809089

Component: TMOS

Symptoms:
Log message that indicates this issue may happen:
session_reply_multi: ERROR: unable to send session reply: ERR_BOUNDS
[...] valid s_entry->ref_cnt

Conditions:
-- Specific MRF configuration where all 500 session entries are owned by a single tmm.

-- High rate of session lookups with a lot of entries returned.

Note: This issue does not affect HTTP/2 MRF configurations.

Impact:
TMM core: the program terminates with signal SIGSEGV, Segmentation fault. Traffic disrupted while tmm restarts.

Workaround:
1. Change MRF configuration to spread session lookups across multiple tmms.
2. Reduce the sub-key entries to far below 500.

---

808801-6 : AVRD crash when configured to send data externally

Links to More Info: BT808801

Component: Application Visibility and Reporting

Symptoms:
AVRD can crash repeatedly when configured to send telemetry data externally.

Conditions:
-- AVR is configured to send telemetry data to an external source (like connection with BIG-IQ).
-- Large number of config objects in the system, such as virtual servers and pool members.

Impact:
AVRD process crashes, and telemetry data is not collected.

Workaround:
Split the configuration updates into smaller batches

---

808481-6 : Hertfordshire county missing from GTM Region list

Links to More Info: BT808481

Component: TMOS

Symptoms:
Hertfordshire county is missing from Regions in the United Kingdom Country/State list.

Conditions:
-- Creating a GTM region record.
-- Attempting to select Hertfordshire county for the United Kingdom.

Impact:
Cannot select Hertfordshire county from United Kingdom Country/State list.

Workaround:
None.

---

807569-3 : Requests fail to load when backend server overrides request cookies and Bot Defense is used

Links to More Info: BT807569

Component: Application Security Manager

Symptoms:
When Bot Defense is used on the backend server that overrides request cookies, requests to non-HTML resources may fail, or may receive the whitepage JavaScript challenge. An example is when a back-end server responds with a Set-Cookie header containing empty values for each cookie request cookie it does not recognize.

Conditions:
-- Bot Defense is enabled.
-- Backend server is overriding the Bot Defense cookies with the TS prefix.

Impact:
Some URLs fail to load following the JavaScript challenge.

Workaround:
Use an iRule to strip the TSPD_101 cookie from the request before forwarding it to the backend:

when HTTP_REQUEST_RELEASE {
    HTTP::cookie remove "TSPD_101"
}

---

807309-5 : Incorrect Active/Standby status in CLI Prompt after failover test

Links to More Info: BT807309

Component: TMOS

Symptoms:
After running 'promptstatusd -y' to check current failover status, it displays an incorrect Active/Standby status in the CLI prompt.

Conditions:
This occurs under the following conditions:

1. Modify the db variable: bigdb failover.state.
2. Check that /var/prompt/ps1 and CLI prompt reflect the setting.
2. Reboot the BIG-IP system.

Impact:
Status shown in the prompt does not change.

Workaround:
Do not run 'promptstatusd -y' command manually.

The db variable 'failover.state is a status-reporting variable. The system does not report status manually set to something other than the actual status.

Note: 'promptstatusd' is not a BIG-IP user command, it is a daemon. It is highly unlikely that manually running this command will produce information that is useful or relevant to the status being sought.

---

805561-1 : Change of pool configuration in OneConnect environment can impact active traffic

Links to More Info: BT805561

Component: Local Traffic Manager

Symptoms:
In OneConnect environments, when the default pool is updated for the first time, active connections reconnect to new pool members. Further update to pool configuration has no impact on traffic.

Conditions:
-- Virtual server configured with OneConnect profile.
-- Default pool is updated when active connections are present.

Impact:
Active traffic disrupted.

Workaround:
None.

---

804089-2 : iRules LX Streaming Extension dies with Uncaught, unspecified error event

Links to More Info: BT804089

Component: Local Traffic Manager

Symptoms:
You are using a virtual with an ilx profile generated from an iRules LX Streaming extension and observed the following error or similar.
  
Sep 05 09:16:52 pid[5850] Error: Uncaught, unspecified "error" event. (ETIMEDOUT)
Sep 05 09:16:52 pid[5850] at ILXFlow.emit (events.js:163:17)
Sep 05 09:16:52 pid[5850] at ILXFlowWrap.ilxFlowErrorCb [as onIlxError] (/var/sdm/plugin_store/plugins/<pluginName>/extensions/<workspaceName>/node_modules/f5-nodejs/lib/ilx_flow.js:108:10)

Conditions:
Virtual server with an ilx profile generated from an iRules LX Streaming extension. The problem is aggravated if a web-acceleration profile is configured.

Impact:
Traffic may be disrupted until the sdmd daemon has respawned another node.js process.

---

803773-3 : BGP Peer-group route-maps are not applied to newly configured address-family ipv6 peers

Links to More Info: BT803773

Component: TMOS

Symptoms:
Inbound or outbound route-map configuration may not be applied properly to address-family ipv6 members of peer-group

Conditions:
This happens when route-map is applied to a peer-group before the neighbor gets configured as a peer-group member.

For example:

conf t
   no route-map test
   no router bgp 64512

   route-map test permit 10
      match ipv6 address 2001::1/128
      
   router bgp 64512
      neighbor pg1 peer-group
      neighbor pg1 remote-as 64512

      address-family ipv6
         neighbor pg1 activate
         neighbor pg1 route-map test out
         
         end

conf t
   router bgp 64512
   neighbor 2001::2 peer-group pg1
   end

Impact:
route-map configuration inherited from the peer-group (in or out) may not be applied to the BGP neighbor

Workaround:
After a peer is added:
- Remove peer-group route-map configuration.
- Re-add peer-group route-map configuration.
- Clear BGP sessions to apply new config.

---

803157-4 : LTM log contains shutdown sequence logs after boot_marker as logs are buffered until BIG-IP reboots

Links to More Info: BT803157

Component: TMOS

Symptoms:
In reboot case, the BIG-IP system buffers the shutdown sequence log messages and writes them to disk once the syslog service starts during the boot process. The boot_marker message is written before shutdown messages sync to disk. This leads to out-of-sequence log messages, making it difficult to determine when the service stop occurred.

Conditions:
Reboot the BIG-IP system.

Impact:
Log messages appear out of order. It is difficult to tell whether service stop happened as part of reboot, or any error during the subsequent boot process.

Workaround:
None.

---

798885-6 : SNMP response times may be long when processing requests

Links to More Info: BT798885

Component: TMOS

Symptoms:
SNMP queries to the BIG-IP system may take longer (up to 15% more time) to process on BIG-IP systems with large configurations. mcpd CPU usage increases by a small amount (up to 10%) during these queries.

Conditions:
-- Large configuration.
-- Using SNMP to query statistics on the BIG-IP system.

Impact:
A small increase in response time to SNMP requests to the BIG-IP. Some SNMP queries might fail due to timeouts. mcpd CPU usage is slightly elevated while processing these queries.

Workaround:
If the responses to SNMP queries are taking too long, MCPD and SNMPD may overburden the control plane. It may be necessary to lengthen the timeout and retry values used by the SNMP client. It may also be helpful to trim what is queried, for example, not repetitively walking large tables like the Virtual Server or LTM Pool Member tables for statistics.

---

797573-1 : TMM assert crash with resulting in core generation in multi-blade chassis

Links to More Info: BT797573

Component: Local Traffic Manager

Symptoms:
TMM crashes while changing settings.

Conditions:
Seen on multi-blade chassis with either one of the options:
-- Running system with DoS and other traffic.
-- Create a new vCMP guest and deploy it.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None.

---

796985-4 : Default IPv4 IP address is assigned to Alt-Address in isolated vCMP guest; vCMP host or guest are upgraded and guest is 'Inoperative'★

Links to More Info: BT796985

Component: TMOS

Symptoms:
VCMP host or guest is upgraded, and the vCMP guest is 'Inoperative', with messages similar to the following in /var/log/ltm:

-- warning clusterd[1546]: 013a0005:4: Clusterd using /VERSION for SW specification.
-- info clusterd[1546]: 013a0023:6: Blade 1: No info received from slot: Starting up
-- err clusterd[1546]: 013a0004:3: result {
-- err clusterd[1546]: 013a0004:3: result.code 17237812
-- err clusterd[1546]: 013a0004:3: result.attribute float_mgmt2_ip
-- err clusterd[1546]: 013a0004:3: result.message 01070734:3: Configuration error: Cluster alt-address: 192.168.1.246 cannot be the same address family as cluster address: 192.168.1.246
-- err clusterd[1546]: 013a0004:3: }
-- err clusterd[1546]: 013a0004:3: Per-invocation log rate exceeded; throttling.
-- notice clusterd[1546]: 013a0006:5: Disconnecting from mcpd.
-- info clusterd[1546]: 013a0007:6: clusterd stopping...

Conditions:
-- Isolated vCMP guest.
-- Both 'Address' and 'Alt-Address' are assigned the same IPv4 address.
-- Upgrade occurs.

Impact:
Upon host/guest upgrade, vCMP guest is 'Inoperative'.

Workaround:
-- For new vCMP guests, or prior to booting the vCMP guest to an affected version for the first time, assign it a management-ip from the vCMP host. This prevents the alt-address from being assigned and the issue from occurring on subsequent upgrades.

tmsh modify vcmp <guest_name> management-ip 192.168.1.246/24

-- For existing vCMP guests already on an affected version, but not currently experiencing the issue, assign a management-ip from the vCMP host and remove the alt-address from within the vCMP guest to prevent the issue from occurring in a future upgrade or reboot:

    host# tmsh modify vcmp guest <guest-name> management-ip 192.168.1.246/24

    guest# tmsh modify sys cluster default alt-address none

-- When already upgraded and seeing the issue on a guest, set a management-ip from the vCMP host and run the following commands within the guest to remove the alternate address from the configuration file:

    host# tmsh modify vcmp guest <guest-name> management-ip 192.168.1.246/24

    guest# bigstart stop clusterd
    guest# sed -i s/alt_addr=.*// -i /shared/db/cluster.conf
    guest# bigstart start clusterd

---

795633-1 : GUI and REST API unable to add virtual servers containing a space in the name to a pool

Links to More Info: BT795633

Component: Global Traffic Manager (DNS)

Symptoms:
The GUI and REST API are unable to add virtual servers containing a space in the name to a pool.

Conditions:
Virtual server name contains a space.

Impact:
Unable to manage pool members if the virtual server contains a space in the name.

Workaround:
Use tmsh.

---

788257-5 : Bigd.mgmtroutecheck setting ignored by in-tmm monitors after bigstart restart

Links to More Info: BT788257

Component: In-tmm monitors

Symptoms:
The bigd.mgmtroutecheck db variable can be enabled to prevent monitor traffic from going through the management interface (for information, see K14549: Overview of the 'bigd.mgmtroutecheck' database key :: https://support.f5.com/csp/article/K14549); however, if in-tmm monitors are configured, the setting will be ignored after a bigstart restart.

Conditions:
-- bigd.mgmtroutecheck is enabled
-- bigd.tmm is enabled (i.e., in-tmm monitors are configured).
-- tmm has a route configured to the management interface.
-- A pool member exists that matches a route through the management interface.
-- bigstart restart is performed.

Impact:
In-tmm monitor traffic uses the management interface if there is a route to the pool member via the management interface, even when bigd.mgmtroutecheck indicates it is enabled.

Workaround:
None

---

780745-5 : TMSH allows creation of duplicate community strings for SNMP v1/v2 access

Links to More Info: BT780745

Component: TMOS

Symptoms:
TMSH allows you to create multiple access records with the same IP protocol, same Source IP network, and same community string.

Conditions:
Duplicate access records are created in TMSH.

Impact:
Unintended permissions can be provided when an undesired access record with the correct community string is matched to a request instead of the desired access record.

Workaround:
Use the Configuration Utility to manage SNMP v1/2c access records. (The GUI properly flags the error with the message:
The specified SNMP community already exists in the database.

If you use tmsh, ensure that community strings remain unique within each Source IP Network for each IP protocol.

---

780437-8 : Upon rebooting a VIPRION chassis provisioned as a vCMP host, some vCMP guests can return online with no configuration.

Links to More Info: BT780437

Component: TMOS

Symptoms:
It is possible, although unlikely, for a vCMP host to scan the /shared/vmdisks directory for virtual disk files while the directory is unmounted.

As such, virtual disk files that existed before the reboot will not be detected, and the vCMP host will proceed to create them again.

The virtual disks get created again, delaying the guests from booting. Once the guests finally boot, they have no configuration.

Additionally, the new virtual disk files are created on the wrong disk device, as /shared/vmdisks is still unmounted.

Symptoms for this issue include:

-- Running the 'mount' command on affected host blades and noticing that /shared/vmdisks is not mounted.

-- Running the 'tmsh show vcmp guest' command on affected host blades (early on after the reboot) and noticing some guests have status 'installing-vdisk'.

-- Running the 'lsof' command on affected and unaffected host blades shows different device numbers for the filesystem hosting the virtual disks, as shown in the following example (note 253,16 and 253,1):

qemu-kvm 19386 qemu 15u REG 253,16 161061273600 8622659 /shared/vmdisks/s1g2.img

qemu-kvm 38655 qemu 15u REG 253,1 161061273600 2678798 /shared/vmdisks/s2g1.img

-- The /var/log/ltm file includes entries similar to the following example, indicating new virtual disks are being created for one of more vCMP guests:

info vcmpd[x]: 01510007:6: VDisk (s2g1.img/2): Adding.
info vcmpd[x]: 01510007:6: VDisk (s2g1.img/2): Syncing with MCP - [filename:s2g1.img slot:2 installed_os:0 state:0]
notice vcmpd[x]: 01510006:5: Guest (s2g1): Creating VDisk (/shared/vmdisks/s2g1.img)
info vcmpd[x]: 01510007:6: VDisk (s2g1.img/2): Syncing with MCP - [filename:s2g1.img slot:2 installed_os:0 state:1]
info vcmpd[x]: 01510007:6: Guest (s2g1): VS_ACQUIRING_VDISK->VS_WAITING_INSTALL
info vcmpd[x]: 01510007:6: Guest (s2g1): VS_WAITING_INSTALL->VS_INSTALLING_VDISK
notice vcmpd[x]: 01510006:5: Guest (s2g1): Installing image (/shared/images/BIGIP-12.1.2.0.0.249.iso) to VDisk (/shared/vmdisks/s2g1.img).
info vcmpd[x]: 01510007:6: VDisk (s2g1.img/2): Syncing with MCP - [filename:s2g1.img slot:2 installed_os:0 state:2]

Conditions:
-- VIPRION chassis provisioned in vCMP mode with more than one blade in it.

-- Large configuration with many guests.

-- The VIPRION chassis is rebooted.

-- A different issue, of type 'Configuration from primary failed validation' occurs during startup on one or more Secondary blades. By design, MCPD restarts once on affected Secondary blades, which is the trigger for this issue. An example of such a trigger issue is Bug ID 563905: Upon rebooting a multi-blade VIPRION or vCMP guest, MCPD can restart once on Secondary blades.

Impact:
-- Loss of entire configuration on previously working vCMP guests.

-- The /shared/vmdisks directory, in its unmounted state, may not have sufficient disk space to accommodate all the virtual disks for the vCMP guests designated to run on that blade. As such, some guests may fail to start.

-- If you continue using the affected guests by re-deploying configuration to them, further configuration loss may occur after a new chassis reboot during which this issue does not happen. This occurs because the guests would then be using the original virtual disk files; however, their configuration may have changed since then, and so some recently created objects may be missing.

Workaround:
There is no workaround to prevent this issue. However, you can minimize the risk of hitting this issue by ensuring you are running a software version (on the host system) where all known 'Configuration from primary failed validation' issues have been resolved.

If you believe you are currently affected by this issue, please contact F5 Networks Technical Support for assistance in recovering the original virtual disk files.

---

779185-1 : Forward zone deleted when wideip updated

Links to More Info: BT779185

Component: Global Traffic Manager (DNS)

Symptoms:
When a forward zone is configured in zonerunner, and a wideip is configured in the same zone, BIG-IP may delete the bind zone whenever the wide ip's pool members are modified.

Subsequent modifications of the same zone will then result in a new primary zone being created in bind.

Conditions:
- A forward zone is configured in bind (zonerunner)
- The pool members associated with a wideip are modified

Impact:
Queries that do not match wideips are passed to bind for processing, and are no longer forwarded to the nameserver configured in the forward zone.

Workaround:
- Recreate the zonerunner forward zone after modifying the wideip

---

779137-7 : Using a source address list for a virtual server does not preserve the destination address prefix

Links to More Info: BT779137

Component: Local Traffic Manager

Symptoms:
Configuring a network virtual server with a source address list causes the system to treat the virtual server as a host.

Conditions:
-- Configure a source address list on the virtual server.
-- Configure a network address for the destination of the virtual server (not an address list).

Impact:
Traffic does not flow to the virtual server as expected.

Workaround:
See K58807232

---

778513-3 : APM intermittently drops log messages for per-request policies

Links to More Info: BT778513

Component: TMOS

Symptoms:
APM may intermittently drop log messages, leading to missing information on policy execution or other events.

Conditions:
This might occur under either of the following conditions:

 -- Using APM per-request policies, or ACCESS::log iRule commands.
 -- APM is configured to use multiple log destinations (such as: local-db and local-syslog).

Impact:
Administrator may fail to report certain logging events, hindering troubleshooting or auditing efforts.

Workaround:
No workaround is possible.

When reviewing APM logs, keep in mind that during periods of high activity (greater than 100 log messages in 1-to-2 seconds) that the system may drop some log messages.

---

778501-5 : LB_FAILED does not fire on failure of HTTP/2 server connection establishment

Links to More Info: BT778501

Component: Local Traffic Manager

Symptoms:
When the server connection fails to be established due to server being down or actively rejecting the connection, LB_FAILED should fire and allow a new destination to be selected via iRule.

Conditions:
- iRule with LB_FAILED event
- server connection establishment fails

Impact:
Selection of a new destination via LB_FAILED is not possible, thus the client connection will be aborted.

Workaround:
No workaround available.

---

778225-6 : vCMP guests don't have the f5_api_com key and certificate installed when licensed by vCMP host

Links to More Info: BT778225

Component: Protocol Inspection

Symptoms:
Automatic hitless upgrade for protocol inspection fails on vCMP guests. This occurs because vCMP guest don't install f5_api_com key and certificates.

Conditions:
After licensing a vCMP guest, there is no f5_api_com key or certificate (you can run key_cache_path and crt_cache_path to determine that).

Impact:
Hitless upgrade fails for protocol inspection and traffic classification on vCMP guests.

Workaround:
Install the hitless upgrade IM package manually.

---

777389-7 : In rare occurrences related to PostgreSQL monitor, the mcpd process restarts

Links to More Info: BT777389

Component: TMOS

Symptoms:
Possible indications include the following:

-- Errors such as the following may appear in ltm/log:

   - notice postgres[10872]: [466-1] WARNING: pgstat wait timeout.
   - notice sod[27693]: 01140041:5: Killing /usr/bin/mcpd pid 7144.
   - BD_CONF|ERR| ...failed to connect to mcpd after 5 retries, giving up...
   - BD_CONF|ERR| ...can't read message from mcp conn, status:16908291.
   - BD_MISC|CRIT| ...Received SIGABRT - terminating.

-- Errors such as the following may appear in the dwbld/log:

   - Couldn't send BLOB notification - MCP err 16908291.
   - Got a terminate/abort signal - terminating ...
   - Terminating mcp_bridge thread.

-- Processes may restart unexpectedly, including mcpd, bd, and postgresql.

Conditions:
-- The 'mcpd' process attempts to read monitoring data from the PostgreSQL server, but no data is available.

-- A contributing factor might be that the AFM module is licensed but not configured.

Impact:
Failing to receive a monitoring response from the SQL server, MCPD goes into an infinite loop and skips the heartbeat report, resulting in its restart. While MCPD is restarting, the system is offline and does not process traffic. After restart, system operation returns to normal.

Workaround:
The chance of occurrence can be minimized by making sure that control-plane processes have sufficient memory to run efficiently.

---

776117-1 : BIG-IP Virtual Edition virtio driver incompatible with Q35 machine type

Links to More Info: BT776117

Component: TMOS

Symptoms:
The BIG-IP Virtual Edition's virtio driver is incompatible with the Q35 machine type.

Conditions:
-- BIG-IP Virtual Edition with the virtio driver.
-- Setting the machine type to Q35 on the hypervisor.

Impact:
The BIG-IP will not use the virtio driver, using the sock (or unic, in versions prior to 14.1.0) driver instead.

---

775845-6 : Httpd fails to start after restarting the service using the iControl REST API

Links to More Info: BT775845

Component: TMOS

Symptoms:
After restarting httpd using the iControl REST API, httpd fails to start, even with a subsequent restart of httpd at the command line.

Similar to the following example:

config # restcurl -u admin:admin /tm/sys/service -X POST -d '{"name":"httpd", "command":"restart"}'
{
  "kind": "tm:sys:service:restartstate",
  "name": "httpd",
  "command": "restart",
  "commandResult": "Stopping httpd: [ OK ]＼r＼nStarting httpd: [FAILED]＼r＼n(98)Address already in use: AH00072: make_sock: could not bind to address n.n.n.n:n＼nno listening sockets available, shutting down＼nAH00015: Unable to open logs＼n"
}

config # tmsh restart sys service httpd
Stopping httpd: [ OK ]
Starting httpd: [FAILED]

Conditions:
Restarting httpd service using iControl REST API.

Impact:
Httpd fails to start.

Workaround:
To recover from the failed httpd state, you can kill all instances of the httpd daemon and start httpd:

killall -9 httpd

tmsh start sys service httpd

---

775797-5 : Previously deleted user account might get authenticated

Links to More Info: BT775797

Component: TMOS

Symptoms:
A user account which may have originally been manually configured as a local user (auth user) but may have since been removed, might still get authenticated and be able to modify the BIG-IP configuration.

Conditions:
-- User account configured as local user.
-- The user account is deleted later.

(Note: The exact steps to produce this issue are not yet known).

Impact:
The deleted user that no longer exists in the local user list and which is also not explicitly authorized by remote role groups, can get authenticated. The deleted user is also able to modify the BIG-IP configuration via iControl.

Workaround:
None.

---

767473-2 : SMTP Error: Could not authenticate

Links to More Info: BT767473

Component: TMOS

Symptoms:
When using a "sys smtp-server" object (System >> Configuration >> Device >> SMTP) to configure an SMTP mail server, mail may be rejected by the remote SMTP server, and clicking on the "Test Connection" button returns "SMTP Error: Could not authenticate"

Conditions:
The remote SMTP server requires TLS1.2 or higher.

Impact:
Unable to send mail for BIG-IP features that make use of the 'sys smtp-server' object, such as AVR and ASM reports.

Workaround:
Configure the BIG-IP to relay mail through a locally administered SMTP server that allows TLS 1.0 connections.

---

766593-7 : RESOLV::lookup with bytes array input does not work when length is exactly 4, 16, or 20

Links to More Info: BT766593

Component: Global Traffic Manager (DNS)

Symptoms:
RESOLV::lookup returns empty string.

Conditions:
Input bytes array is at length of 4, 16, or 20.

For example:
[RESOLV::lookup @dnsserveraddress -a [binary format a* $host1.d1test.com]]

Impact:
RESOLV::lookup returns empty string.

Workaround:
Use lindex 0 to get the first element of the array.

For example:
[RESOLV::lookup @dnsserveraddress -a [lindex [binary format a* $host1.d1test.com] 0]]

---

762097-5 : No swap memory available after upgrading to v14.1.0 and above★

Links to More Info: BT762097

Component: TMOS

Symptoms:
After an upgrade to v14.1.0 or higher, swap memory may not be mounted. TMM or other host processes may restart due to lack of memory.

Conditions:
-- System is upgraded to v14.1.0 or above.

-- System has RAID storage.

Impact:
May lead to low or out-of-memory condition. The Linux oom killer may terminate processes, possibly affecting service.

Typically management activities may be impacted, for example, a sluggish GUI (config utility) or tmsh sessions.

Workaround:
Mount the swap volume with correct ID representing the swap device.

Perform the following steps on the system after booting into the affected software version:

1. Get the correct ID (RAID device number (/dev/md<number>)):
blkid | grep swap

Note: If there is no RAID device number, perform the procedure detailed in the following section.

2. Check the device or UUID representing swap in /etc/fstab.

3. If swap is not represented with the correct ID, modify the /etc/fstab swap entry to point to the correct device.

4. Enable the swap:
swapon -a

5. Check swap volume size:
swapon -s


If the blkid command shows there is no UUID associated with the swap RAID device, use the following procedure:

1. Generate a random UUID:
uuidgen

2. Make sure swap is turned off:
swapoff -a

3. Recreate the swap partition with UUID generated in step 1:
mkswap -U <uuid_from_step_1> <raid_device_from_step_1>

4. Run blkid again to make sure that you now have a UUID associated with the raid device:
blkid | grep swap

5. edit fstab and find the line
      <old_value> swap swap defaults 0 0

6. Replace the old value, whether it was an incorrect UUID or a device name, with the UUID generated in step 1, for example:
      UUID=8b35b30b-1076-42bb-8d3f-02acd494f2c8 swap swap defaults 0 0

---

760982-3 : An NLRI with a default route information is not propagated on 'clear ip bgp <neighbor router-id> soft out' command in some scenarios

Links to More Info: BT760982

Component: TMOS

Symptoms:
Soft out reset does not work for the default route.

Conditions:
-- BGP enabled
-- A route configuration change is made and 'clear ip bgp <IP-addr> soft in/out' is executed

Impact:
A default-route is not propagated in Network Layer Reachability Information (NLRI) by 'soft out' request.

Workaround:
None

---

760400-1 : High number of vcmp guests on clusters and discovery appliances may result in retries for guest deployment

Links to More Info: BT760400

Component: TMOS

Symptoms:
- Guests coming up with retries and
- Messages like below in the LTM log

Guest (XXX): Killing VM process.

Conditions:
- Clusters or discovery appliances host
- High number of vcmp guests being deployed

Impact:
VCMP guests may become unable to pass traffic.

---

760354-7 : Continual mcpd process restarts after removing big logs when /var/log is full

Links to More Info: BT760354

Component: TMOS

Symptoms:
The BIG-IP device suddenly stops passing traffic. You might see errors similar to the following:

err mcpd[15230]: 01070596:3: An unexpected failure has occurred, TAP creation failed (tmm): Permission denied - net/validation/routing.cpp, line 168, exiting...

Conditions:
This might occur when when /var/log is full and then you remove big logs.

Impact:
The mcpd process restarts continuously. This occurs because tmm blocks mcpd from restarting after /var/log fills up.

Workaround:
Empty the contents of big size log files under /var/log and reboot the BIG-IP system.

If that does not resolve the problem, restart all processes (bigstart restart) or reboot the box.

---

759258-7 : Instances shows incorrect pools if the same members are used in other pools

Links to More Info: BT759258

Component: TMOS

Symptoms:
Monitor 'Instances' tab shows incorrect pools if the same members are used in other pools.

Conditions:
Steps to Reproduce:

1. Create custom monitor or use system default.
2. Assign that monitor to a test pool.
3. Navigate to Local Traffic :: Monitors, click the test monitor, then select the Instances tab.

Impact:
The test pool is displayed, as well any other pools that use the same member or members (but with other monitors assigned).

Workaround:
None.

---

758929-7 : Bcm56xxd MIIM bus access failure

Links to More Info: BT758929

Component: TMOS

Symptoms:
Bcm56xxd daemon running on certain BIG-IP devices might experience MIIM bus access failure. The system posts a message similar to the following in the ltm log:

 info bcm56xxd: 012c0016:6: MiimTimeOut:soc_miim_write, timeout (id=0xc9 addr=0x1f data=0x0000)

Conditions:
Using one of the following platforms:
  + VIPRION B2250 Blade (A112)
  + VIPRION B2150 Blade (A113)
  + VIPRION B4300 Blade (A108)
  + BIG-IP 5250v
  + BIG-IP 7200S
  + BIG-IP i5600
  + BIG-IP i5820
  + BIG-IP i7800

Impact:
The affected BIG-IP system fails to pass traffic. If configured for high availability (HA) and the HA connection has not been disrupted, failover occurs.

Workaround:
Reboot the affected BIG-IP platform / VIPRION blade.

---

758491-5 : When using NetHSM integration, after upgrade to 14.1.0 or later (or creating keys using fipskey.nethsm), BIG-IP cannot use the keys

Links to More Info: BT758491

Component: Local Traffic Manager

Symptoms:
For Thales:
The ltm/log shows SSL handshake failures with similar lines (this is for Diffie-Hellman Key Exchange):

-- warning bigip1 tmm1[28813] 01260013 SSL Handshake failed for TCP 192.0.2.1:5106 -> 192.0.2.200:5607
-- warning bigip1 tmm1[28813] 01260009 Connection error: ssl_hs_vfy_sign_srvkeyxchg:13583: sign_srvkeyxchg (80)
-- debug bigip1 tmm1[28813] 01260036 FIPS acceleration device error: fips_poll_completed_reqs: req: 4 status: 0x1 : Cancel
-- err bigip1 pkcs11d[26259] 01680002 Key table lookup failed. error.

After enabling pkcs11d debug, the pkcs11d.debug log shows:

-- 2019-10-03 11:21:50 [6399] t00075a9a462b0000: pkcs11: 000008D9 D obj_match_attribute class CKO_PRIVATE_KEY attribute CKA_CLASS
-- 2019-10-03 11:21:50 [6399] t00075a9a462b0000: pkcs11: 000008D9 D obj_match_attribute type CKA_CLASS matches
-- 2019-10-03 11:21:50 [6399] t00075a9a462b0000: pkcs11: 000008D9 D obj_match_attribute class CKO_PRIVATE_KEY attribute CKA_ID
-- 2019-10-03 11:21:50 [6399] t00075a9a462b0000: pkcs11: 000008D9 D obj_match_attribute type CKA_ID does not match <===


For Safenet:
-- warning tmm1[17495]: 01260009:4: Connection error: ssl_hs_vfy_sign_srvkeyxchg:13544: sign_srvkeyxchg (80)
-- warning tmm1[17495]: 01260013:4: SSL Handshake failed for TCP 10.1.1.11:6009 -> 10.1.1.201:443
-- err pkcs11d[5856]: 01680002:3: Key table lookup failed. error.

Conditions:
1. Keys were created on earlier versions of BIG-IP software, no matter if using tmsh (Safenet) or using fipskey.nethsm (Thales, Safenet) and the device was upgraded to 14.1.0 or later.

2. Keys were created on BIG-IP v14.1.0 or later directly, using fipskey.nethsm (Thales). For Safenet, fipskey.nethsm was deprecated in 14.0.0.

Impact:
SSL handshake failures.

Workaround:
There are two workarounds:
-- Re-create the keys using tmsh command.

IMPORTANT: This workaround is suitable for deployments that are new and not in production.


-- Re-import the keys from nethsm using:
tmsh install sys crypto key <key_label> from-nethsm


You can find the key_label here:
-- The rightmost string in the output of the Thales command:
nfkminfo -l

-- The string after label= in the 'cmu list' command for Safenet.

---

757787-5 : Unable to edit LTM/AFM Policies that belong to an Application Service (iApp) using the WebUI.

Links to More Info: BT757787

Component: TMOS

Symptoms:
When creating a new rule or modifying an existing rule in a LTM/AFM Policy policy using the WebUI, the operation fails and an error similar to the following example is returned:

Transaction failed:010715bd:3: The parent folder is owned by application service (/Common/MyPolicy.app/MyPolicy), the object ownership cannot be changed to ().

Conditions:
-- The LTM/AFM Policy belongs to an Application Service (iApp).
-- The modification is attempted via the WebUI.

Impact:
Unable to make changes to existing LTM/AFM Policies.

Workaround:
Use the tmsh utility to make the necessary modifications to the LTM/AFM Policy. For example, the following command modifies an existing rule:

tmsh modify ltm policy myapp.app/Drafts/myapp_l7policy rules modify { 0 { conditions modify { 0 { http-method equals values { GET POST } } } } }

---

757486-2 : Errors in IE11 console appearing with Bot Defense profile

Links to More Info: BT757486

Component: Application Security Manager

Symptoms:
When Bot Defense profile is used and has Browser Verification enabled to either Verify Before Access, or Verify After Access, Microsoft Internet Explorer v11 (IE11) Browsers may display the following errors in the browser console:

HTML1512: Unmatched end tag.
a.html (26,1)
HTML1514: Extra "<body>" tag found. Only one "<body>" tag should exist per document.
a.html (28,1)

Conditions:
-- Bot Defense profile is enabled with Browser Verification.
-- End user clients are using the IE11 browser.

Impact:
Cosmetic error messages appear in an end user's browser console.

Workaround:
In order to work around this issue, inject the scripts to the '<body>' tag instead of the '<head>' tag. This can be done using this tmsh command:

tmsh mod sys db dosl7.parse_html_inject_tags value after,body,before,/body`

---

756830-6 : BIG-IP may fail source translation for connections when connection mirroring is enabled on a virtual server that also has source port set to 'preserve strict'

Links to More Info: BT756830

Component: TMOS

Symptoms:
The BIG-IP system may fail source translation for connections matching a virtual server that has connection mirroring enabled and source port selection set to 'preserve strict'.

Conditions:
Connections match a virtual server that has following settings:

- Connection mirroring is enabled.
- Source Port set to 'Preserve Strict'.

In addition, CMP hash selection (DAG mode) on the corresponding VLANs is set to 'Default DAG'.

Impact:
Source translation may fail on BIG-IP system, leading to client connection failures.

Workaround:
You can try either of the following:

-- Do not use the Source Port setting of 'Preserve Strict'.

-- Disable connection mirroring on the virtual server.

---

755207-3 : Large packets silently dropped on VE mlxvf5 devices

Links to More Info: BT755207

Component: TMOS

Symptoms:
Jumbo frames are disabled by default for Mellanox ConnectX-4 and ConnectX-5 devices using the mlxvf5 driver (i.e., many BIG-IP Virtual Edition (VE) configurations). Packets larger than 1500 bytes are silently dropped. Only packets up to 1500 bytes are supported when jumbo framers are disabled.

Conditions:
BIG-IP VE with SR-IOV using Mellanox ConnectX-4 or ConnectX-5 NICs.

Typically this represents VE configurations running on private Cloud environments such as VMware, KVM, OpenStack, and others.

Note: You can determine your environment by running the following commands:

# tmctl -d blade tmm/device_probed
# tmctl -d blade xnet/device_probed

Configurations exhibiting this issue either:

1. reports a value of 'mlxvf5' in the driver_in_use column in tmm/device_probed, and possibly reports 'tmctl: xnet/device_probed: No such table.'
2. reports a value of 'xnet' in the driver_in_use column in tmm/device_probed, and a value of 'mlxvf5' in the driver_in_use column in xnet/device_probed.

Impact:
Packets larger than 1500 bytes are dropped without a warning.

Workaround:
Enable jumbo frames and then restart tmm.

1. Add the following line to /config/xnet_init.tcl:
drvcfg mlxvf5 jumbo_support 1

2. Restart tmm:
bigstart restart tmm

Important: There are two possible mlxvf5 drivers. It is possible to enable jumbo frames only for the xnet-based driver.

Important: Enabling jumbo frames causes a performance loss for 1500-byte-size packet, but offers higher throughput at lower CPU usage for larger packets. Note that 1500 bytes is the most common size for internet packets.

---

753712-4 : Incorrect warning: Traffic Matching Criteria's inline source address has been set to any4 from any6 to match inline destination address' address family.

Links to More Info: BT753712

Component: TMOS

Symptoms:
An incorrect warning message is given when the inline source/dest address is changed:

-- warning mcpd[6927]: 01071859:4: Warning generated : Traffic Matching Criteria's inline source address has been set to any4 from any6 to match inline destination address' address family.

Conditions:
This occurs after you create a traffic-matching-criteria (port-list, address-list) with different source and destination addresses.

Impact:
An incorrect and confusing warning message is given. This warning does not affect traffic processing. It is inadvertently triggered when reading the configuration of the traffic matching profile. Virtual servers should continue to work, and the config should load as expected, despite the warning.

Workaround:
None

---

751719-5 : UDP::hold/UDP::release does not work correctly

Links to More Info: BT751719

Component: Carrier-Grade NAT

Symptoms:
UDP::hold/UDP::release do not work properly. Connections cannot be deleted and tmm logs an error:

crit tmm14[38818]: 01010289:2: Oops @ 0x2b6b31b:7903: Flow already has peer. Tried to overwrite.

Conditions:
iRule with UDP::hold/UDP::release

Impact:
UDP::hold/UDP::release does not work correctly

---

751451-4 : When upgrading to v14.0.0 or later, the 'no-tlsv1.3' option is missing from HTTPS monitors automatically created server SSL profiles

Links to More Info: BT751451

Component: Local Traffic Manager

Symptoms:
If there are HTTPS monitor objects that were created using BIG-IP software v12.x, when the BIG-IP is upgraded directly to v14.0.0 or later, the operation automatically creates server SSL profiles for the HTTPS monitors as needed. Those server SSL profile objects do not have 'no-tlsv1.3' included in their 'options' configuration.

Conditions:
-- Having HTTPS monitors configured in v12.x before upgrading.
-- Directly upgrading from v12.x to v14.0.0 or later

Impact:
TLSv1.3 gets enabled on the server SSL profiles.

Workaround:
-- To avoid this issue, upgrade from v12.x to v13.x, and then upgrade to v14.0.0 or later


-- To mitigate this issue, modify the affected profile to disable TLSv1.3.

---

749757-4 : -s option in qkview help does not indicate maximum size

Links to More Info: BT749757

Component: TMOS

Symptoms:
When running qkview with the -h option to obtain help, the -s (size) option is incorrectly rendered.

It should read:

[ -s <max file size> range:0-104857600 Bytes ]

Conditions:
-- Running qkview -h.
-- Viewing the -s (size) option help.

Impact:
The measurement size, bytes, is missing, which might result in confusion.

Workaround:
Use the -s option as normal, but be advised that the number should be in bytes, and that the maximum number is 104857600.

---

745125-2 : Network Map page Virtual Servers with associated Address/Port List have a blank address.

Links to More Info: BT745125

Component: TMOS

Symptoms:
On the Local Traffic > Network Map page, some virtual servers have a blank address.

Conditions:
An address list or port list is associated with the virtual server

Impact:
The Network Map will display a blank address field.

---

743826-7 : Incorrect error message: "Can't find pool []: Pool was not found" even though Pool member is defined with port any(0)

Links to More Info: BT743826

Component: Application Visibility and Reporting

Symptoms:
When a pool member is defined with port any(0), calling the GetPoolMember() function, gives an incorrect error message that the pool member was not found.

Conditions:
Pool member with port any(0)

Impact:
Wrong error message printed to avrd.log

---

740274-2 : TMM stall during startup when syslog is not listening to tmm.pipe

Links to More Info: BT740274

Component: Local Traffic Manager

Symptoms:
When TMM runs at multi-thread mode which is by default, at the startup phase, except tmm.0, all threads stall. This happens when syslog-ng does not listen on tmm.pipe (for example, syslog-ng crashed or was unable to load the configuration).

Conditions:
This issue occurs when Syslog-ng is not listening on /var/run/tmm*.pipe.

Impact:
Tmm threads stall at startup, except tmm.0.

Workaround:
Resolve problems with syslog-ng.

---

739475-6 : Site-Local IPv6 Unicast Addresses support.

Links to More Info: BT739475

Component: Local Traffic Manager

Symptoms:
No reply to Neighbor Advertisement packets.

Conditions:
Using FE80::/10 addresses in network.

Impact:
Cannot use FE80::/10 addressees in network.

Workaround:
N/A

---

738716-1 : Add support for "Restart Desktop" setting in View clients, native as well as HTML5 clients

Links to More Info: BT738716

Component: Access Policy Manager

Symptoms:
When VMware resources are accessed through APM VMware VDI, the "Restart Desktop" setting is not seen on enumerated for Desktop resource. The same issue is observed with HTML5 clients.

Conditions:
- VMware Native or HTML5 client is used
- APM VMware VDI is used
- Desktop resources should be enumerated
- Right click on resource

Impact:
Unable to restart desktop from native and HTML5 clients.

Workaround:
None

---

737692-5 : Handle x520 PF DOWN/UP sequence automatically by VE

Links to More Info: BT737692

Component: TMOS

Symptoms:
When BIG-IP VE is running on a host, there is the host interface's Physical Function (PF, the actual interface on the host device), and Virtual Function (VF, a virtual PCI device that is passed to the BIG-IP-VE). If an x520 device's PF is set down and then up, tmm does not recover traffic on that interface.

Conditions:
-- VE is using a VF from a PF.
-- The PF is set down and then up.

Impact:
VE does not process any traffic on that VF.

Workaround:
Reboot VE.

---

721892-2 : Pfmand on vCMP guests does not recover after service interruption

Links to More Info: BT721892

Component: TMOS

Symptoms:
If pfmand on a vCMP host shuts down and starts back up, pfmand running on any of the vCMP guests loses connection and does not recover.

Conditions:
- vCMP host and guest(s) both have pfmand.healthstatus set to "enable"
- pfmand on the host shuts down and starts up again. This can sometimes occur due to re-licensing on the host.

Impact:
Pfmand on vCMP guests loses connection:

warning pfmand[20332]: 01660005:4: No connection to hypervisor.

Workaround:
Rebooting the vCMP host will allow the pfmand connection to be be re-established.

---

721591-2 : Java crashes with core during a basic TLS signature test.

Links to More Info: BT721591

Component: TMOS

Symptoms:
Java crashes with core.

Conditions:
This is a random crash and there are no known conditions for reproducing it.

Impact:
This crash occurs randomly during normal operation and has following impact:
-- Stats are not available.
-- Server health does not improve with mitigation.
-- Valid traffic never reaches the backend.

Workaround:
-- Restart the Java service with "bigstart restart restjavad" or "tmsh restart sys service restjavad".
-- Restart the BIG-IP system.

---

718291-4 : iHealth upload error does not clear

Links to More Info: BT718291

Component: TMOS

Symptoms:
If an error occurs that sets the iHealth error string, then this string is never cleared.

Conditions:
Setting an invalid hostname for db variable proxy.host.

Impact:
The system reports the following error string: curl: (56) Recv failure: Connection reset by peer. This error message is never cleared, despite running a successful upload. The bogus error message could result in unnecessary confusion after a successful upload.

Workaround:
To clear the error message, run the following command:
/usr/bin/guishell -c "update diags_ihealth_request set error_str='';"

---

717174-5 : WebUI shows error: Error getting auth token from login provider★

Links to More Info: BT717174

Component: Device Management

Symptoms:
Occasionally, the BIG-IP Admin Utility TMUI fails to function correctly and produces the following error:
Error getting auth token from login provider.

This occurs when the BIG-IP REST Daemon restjavad fails to start up properly.

Conditions:
This error most often occurs on the first or second boot after upgrade, and more often on Virtual Edition BIG-IP platforms running on oversubscribed or slow hypervisors.

Impact:
TMUI and any other BIG-IP system components that rely on REST Workers such as: OpenID Connect key rotation discovery, portions of the TMOS Web Configuration Utility, and Guided Configuration (AGC and WGC) fail to function properly.

Workaround:
Restarting the BIG-IP REST daemons restjavad and restnoded will usually correct the problem. To do so, connect to the SSH console and issue the following two commands:

bigstart restart restjavad
bigstart restart restnoded

---

714705-8 : Excessive 'The Service Check Date check was skipped' log messages.

Links to More Info: BT714705

Component: TMOS

Symptoms:
Large numbers of these warnings are logged into the "ltm" file:

  warning httpd[12345]: 0118000a:4: The Service Check Date check was skipped.

The message appears whenever a new "httpd" instance is launched.

Conditions:
The BIG-IP instance has been installed with a "no service check" license. These licenses are sometimes provided with cloud pre-licensed VE software images.

Impact:
Log files are saturated with many useless warnings. This can hide actual problems and impede their diagnosis.

Workaround:
During manual troubleshooting, commands such as the following may be used to filter the excess warnings:

# grep -v 'Service Check Date check was skipped' ltm | less

The syslog-ng 'include' filter mechanism is another possibility, but this should be attempted only with assistance of the F5 Support team.

---

713183-7 : Malformed JSON files may be present on vCMP host

Links to More Info: BT713183

Component: TMOS

Symptoms:
-- Many error messages such as the following may appear in the /var/log/ltm file:

  warning vcmpd[7457]: 01510005:4: Failed to update guest stats from JSON file.

-- The output of 'tmsh show vcmp health' may omit some guests.

Conditions:
All needed conditions are not yet defined.

- vCMP is provisioned.
- Guests are deployed.

Impact:
Some vCMP guests may not show up in the output of the command:
 tmsh show vcmp health

In addition, there might be files present named using the following structure:
 /var/run/vcmpd/<guestname>/json/sys-(ha-status|provision|software).json.bad.

There is no functional impact to the guests or to the host, other than these lost tables, which are provided as a convenience to the vCMP host administrator.

Workaround:
In some cases, the condition can be cleared by taking these actions in the guest instance:

1. clsh touch /service/mcpd/forceload

2. clsh reboot

Otherwise, superfluous log messages may be filtered out of local logging by use of a sys syslog 'include' filter.

You can filter messages related to remote/external logging using the procedure in K13333: Filtering log messages sent to remote syslog servers :: https://support.f5.com/csp/article/K13333.

---

712241-8 : A vCMP guest may not provide guest health stats to the vCMP host

Links to More Info: BT712241

Component: TMOS

Symptoms:
A vCMP guest usually provides the vCMP host with some guest health statistics as a convenience to the vCMP host administrator. These stats are:
-- mgmt/tm/sys/ha-status
-- mgmt/tm/sys/software/status
-- mgmt/tm/sys/software/provision

These tables are created by the host when host vcmpd queries the guest over the vmchannel using REST.

These RESTful queries may sometimes fail, causing the queried vCMP guest to be omitted in the display of the output of the following command: $ tmsh show vcmp guest

Conditions:
-- vCMP provisioned.
-- Guests are deployed.
-- Host vcmpd queries the guest over the vmchannel using REST.

Impact:
There is no functional impact to the guests or to the host, other than these lost tables.

-- Some vCMP guests may not show up in the output of the following command: tmsh show vcmp health
-- Some guests may appear with the wrong status in the GUI. Such as being grey when it should be green.
-- Files containing guest information, kept in:
/var/run/vcmpd/<guestname>/json/(sys-ha-status.json|sys-provision.json|sys-software.json) may be missing from that directory.
-- There might be files present there named using the following structure:
 /var/run/vcmpd/<guestname>/json/sys-(ha-status|provision|software).json.bad.

Workaround:
There is no workaround at this time.

---

711747-2 : Vcmp_pde_state_memcpy core during http traffic and pfmand resets.

Links to More Info: BT711747

Component: TMOS

Symptoms:
TMM restarts with core file available.

Conditions:
The issue occurs intermittently under the following conditions:

-- System uses pfmand.
-- pfmand health monitoring enabled (sys db pfmand.healthstatus value enable, this is the default).
-- The system is passing http traffic.
-- pfmand is reset (tmsh modify sys pfman device 0/00:0c.5 status reset).

Impact:
Traffic disrupted while TMM restarts.

Workaround:
N/A

---

708680-4 : TMUI is unable to change the Alias Address of DNS/GTM Monitors

Links to More Info: BT708680

Component: Global Traffic Manager (DNS)

Symptoms:
TMUI (the GUI) is unable to change the Alias Address of DNS/GTM Monitors.

Conditions:
-- Using the GUI.
-- DNS/GTM monitors with alias address.
-- Attempting to change the Alias Address.

Impact:
Cannot change the Alias Address.

Workaround:
Use tmsh.

---

705869-1 : TMM crashes as a result of repeated loads of the GEOIP database

Links to More Info: BT705869

Component: Global Traffic Manager (DNS)

Symptoms:
TMM crashes.

Conditions:
Repeatedly loading the GeoIP database in rapid succession.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
Don't do repeated load of GeoIP Database.

---

703226-3 : Failure when using transactions to create and publish policies

Links to More Info: BT703226

Component: TMOS

Symptoms:
Use batch mode transactions to create Virtual Servers with Policies containing rules.

Conditions:
Create and publish in the same transaction a Policy containing rules.

Impact:
Operation fails.

This occurs because the system is trying to look up a policy that does not exist because the 'create' operation is not yet complete. This might happen when the create and publish operations occur simultaneously, which might happen in response to scripts from iApps, batch mode creation of policies, UCS load, upgrade operation--all try to create domain trust, and all might include the policy create in the same operation.

Workaround:
Separate the create Policy and publish Policy operations into two transactions when the Policy contains rules.

---

698594-4 : Cave Creek Crypto hardware reports a false positive of a stuck queue state

Links to More Info: K53752362, BT698594

Component: TMOS

Symptoms:
In some cases, a stuck crypto queue may be erroneously detected on Cave Creek-based systems. This includes BIG-IP 2x00, 4x00, i850, i2x00, i4x00, and HRC-i2800.

The system writes messages similar to the following example to the /var/log/ltm file:

crit tmm3[11707]: 01010025:2: Device error: crypto codec qa-crypto3-3 queue is stuck.
warning sod[4949]: 01140029:4: HA crypto_failsafe_t qa-crypto3-3 fails action is failover.

Conditions:
This issue occurs when all of the following conditions are met:
- Your BIG-IP system uses the Cave Creek encryption hardware.
- You are making use of hardware-based SSL encryption.
- The BIG-IP system is under heavy load.

Impact:
The system reports device errors in logs, and takes crypto high availability (HA) action, possibly resulting in failover.

Workaround:
To work around this issue, you can modify the crypto queue timeout value. To do so, perform the following procedure.

Impact of workaround: Performing the following procedure should not have a negative impact on your system.

1. Log in to the BIG-IP system as an administrative user.

2. Log in to the Traffic Management Shell (tmsh) by running the following command:
tmsh

3. To change the crypto queue timeout value, run the following command:
modify /sys db crypto.queue.timeout value 300

4. Save the change by running the following command:
save sys config

Increasing the crypto queue timeout gives the hardware enough time to process all queued request.

---

696363-7 : Unable to create SNMP trap in the GUI

Links to More Info: BT696363

Component: TMOS

Symptoms:
Trying to create a SNMP trap may fail in the GUI with the following error message: An error has occurred while trying to process your request.

Conditions:
-- Trap destinations are configured using the GUI: When trap destinations are configured in the GUI, the trap name is generated using the destination IP address.
-- Traps of the same destination address were previously created and deleted.

Impact:
GUI parameter checking does not work as expected. BIG-IP Administrator is unable to create a SNMP trap session.

Workaround:
To work around this issue when using the GUI, remove all traps that have the same destination address as the new one that failed. Then re-add your destination.

Tip: You can use tmsh to create/delete/modify SNMP traps, which enables viewing of the generated names, making it easier to understand what error has occurred.

---

694765-7 : Changing the system's admin user causes vCMP host guest health info to be unavailable

Links to More Info: BT694765

Component: TMOS

Symptoms:
On the host, 'tmsh show vcmp health' does not display guest info.

The iControl REST log at /var/log/icrd contains entries similar to the following:

 notice icrd_child[32206]: 01420003:5: Cannot load user credentials for user "admin" Current session has been terminated.

Conditions:
Change the default admin user.

Note: You change the default admin user by following the steps in the Article K15632: Disabling the admin and root accounts using the BIG-IP Configuration utility or the Traffic Management Shell: https://support.f5.com/csp/article/K15632.

Impact:
Many REST APIs do not function, and functionality such as vCMP guest health that depend on REST fails.

Workaround:
Rename the default system admin to 'admin'.

Note: If you are using the default 'admin' account, make sure you change the password as well.

---

691219-3 : Hardware syncookie mode is used when global auto last hop is disabled.

Links to More Info: BT691219

Component: TMOS

Symptoms:
When global auto last hop is disabled, for iSeries platforms (excluding i2xxx/i4xxx) and B4450 blades, hardware syncookie mode is used on SYN attack.

Conditions:
Global autohop is disabled. This setting is controlled by the following DB variable:

# tmsh list sys db connection.autolasthop
sys db connection.autolasthop {
    value "enable"
}

The default setting is enable.

Impact:
The virtual server can enter hardware syncookie mode, at which point responses will be routed using the incoming packet route. This can break configurations that are using asymmetric routing.

Workaround:
Disable hardware syncookies using the following DB variable:

# tmsh list sys db pvasyncookies.enabled
sys db pvasyncookies.enabled {
    value "true"
}

The default setting is true.

---

690928-6 : System posts error message: 01010054:3: tmrouted connection closed

Links to More Info: BT690928

Component: TMOS

Symptoms:
Beginning in BIG-IP 12.0.0, the tmrouted process pushes dynamic routes directly to the Traffic Management Microkernel (TMM). This message indicates the system is shutting down and is expected behavior during the reboot or shutdown process. The appearance of this message on a stable running system may indicate an issue with tmrouted functionality.

System posts the following message in /var/log/ltm: 01010054:3: tmrouted connection closed

Conditions:
This message occurs when all of the following conditions are met:

-- You have configured the BIG-IP system to use dynamic routing.
-- The BIG-IP system is in the process of shutting down or rebooting.

Impact:
This message is benign, unless you view the message on a stable running system. In this case, the message may indicate an issue with the tmrouted process.

Workaround:
None.

---

690781-4 : VIPRION systems with B2100 or B2150 blades cannot run certain combinations of vCMP guest sizes

Links to More Info: BT690781

Component: TMOS

Symptoms:
VIPRION systems equipped with B2100 or B2150 blades cannot run any more vCMP guests in addition to three 1-slot 8-core guests.

So if a system has four blades, any additional guests created on the remaining blade will not be operational.

Although the system allows all guests to be created and started, the ones deployed last will not work correctly.

Specifically, the guests deployed last will fail to access TMM networks.

Additionally, the vCMP host logs messages similar to the following example to the /var/log/ltm file:

-- info bcm56xxd[13741]: 012c0016:6: FP(unit 0) Error: Group (6) no room.
-- err bcm56xxd[13741]: 012c0011:3: entry create failed: SDK error No resources for operation bs_field.cpp(447)
-- err bcm56xxd[13741]: 012c0011:3: geteid_qualify_egress failed: SDK error No resources for operation bs_field.cpp(2009)
-- err bcm56xxd[13741]: 012c0011:3: program dest mod/port rule failed: SDK error No resources for operation bs_vtrunk.cpp(5353)
-- err bcm56xxd[13741]: 012c0011:3: vdag class L4 redirect failed: SDK error No resources for operation bs_vtrunk.cpp(3261)

Conditions:
This issue occurs when the following conditions are met:

-- A C2400 VIPRION chassis is equipped with four B2100 or B2150 blades.

-- A vCMP configuration consisting of at least three 1-slot 8-core guests was put in place (in other words, three full-blade guests).

-- One or more vCMP guests are created on the remaining VIPRION blade in the chassis.

Impact:
One or more guests do not function properly as they cannot access TMM networks. All traffic fails to pass.

Workaround:
This issue is caused by a hardware limitation on B2100 and B2150 blades preventing this specific vCMP configuration from instantiating correctly.

As a workaround, you must specify different vCMP guest sizes.

For instance, you could use the following configuration:

-- Four 2-slot 4-core vCMP guests instead of four 1-slot 8-core vCMP guests

Although not the same, both configurations yield the same total number of TMM instances per guest.

---

689147-6 : Confusing log messages on certain user/role/partition misconfiguration when using remote role groups

Links to More Info: BT689147

Component: TMOS

Symptoms:
When using remote role groups to set user/role/partition information, user login fails, but logs in /var/log/secure indicate that authentication was successful.

Errors similar to the following appear in /var/log/ltm:

-- User restriction error: The administrator, resource administrator, auditor and web application security administrator roles may not be restricted to a single partition.
-- Input error: invalid remote user credentials, partition does not exist, broken-partition

Errors similar to the following appear in /var/log/secure:

tac_authen_pap_read: invalid reply content, incorrect key?

Conditions:
Using remote role groups to set user/role/partition information for remote users, and either of the following:
-- A remote user is configured with the role of administrator, resource administrator, auditor, or web application security administrator, with access to a particular partition, rather than all. (These roles require access to all partitions.)
-- A remote user is configured with partition access set to a partition that does not exist on the BIG-IP system.

Impact:
The messages in /var/log/secure may be confusing and make it more difficult to diagnose the login failure.

Workaround:
Check /var/log/ltm for more specific error messages.

---

683534-2 : 'tmsh show sys connection' command prompt displaying 4 billion connections is misleading

Links to More Info: BT683534

Component: Local Traffic Manager

Symptoms:
The 'tmsh show sys connection' may present a prompt asking you to confirm you want to display ~4 billion (4,294,967,295) connections:

# show sys connection max-result-limit infinite

Really display 4294967295 connections? (y/n)

Conditions:
-- The 'tmsh show sys connection' command is executed with max-result-limit option set to infinite.

Impact:
The value shown in the prompt (4294967295) is misleading, and does not reflect the actual number of connections being handled by the system. The 4294967295 number represents the maximum value the field can hold, not the number of actual connections.

Workaround:
None

---

679316-8 : iQuery connections reset during SSL renegotiation

Links to More Info: BT679316

Component: Local Traffic Manager

Symptoms:
Error in /var/log/gtm:
err gtmd[14797]: 011ae0fa:3: iqmgmt_receive: SSL error: error:140940F5:SSL routines:SSL3_READ_BYTES:unexpected record

Conditions:
This occurs when a system tries to send data over the iQuery connection while the two endpoints are performing SSL renegotiation.

Note: iQuery connections automatically perform SSL renegotiation every 24 hours.

Impact:
The BIG-IP system is marked 'down' until the connection is reestablished. This usually takes no longer than one second.

Note: This is a subtly different issue from the one (with a very similar error, 140940F5 virtual server 140940E5) described in Bug ID 477240: iQuery connection resets every 24 hours :: https://cdn.f5.com/product/bugtracker/ID477240.html (K16185: BIG-IP GTM iQuery connections may be reset during SSL key renegotiation :: https://support.f5.com/csp/article/K16185).

This issue occurs even in versions where ID 477240 is fixed. There is no fix for this specific trigger of the same message.

Note: The iQuery communication issue is fixed through Bug ID 760471: GTM iQuery connections may be reset during SSL key renegotiation :: https://cdn.f5.com/product/bugtracker/ID760471.html.

Workaround:
There is no workaround at this time, but the problem is fixed via changes made in ID760471

---

673952-6 : 1NIC VE in high availability (HA) device-group shows 'Changes Pending' after reboot

Links to More Info: BT673952

Component: TMOS

Symptoms:
When Virtual Edition (VE) is configured for 1NIC, you will see the following logs on reboot indicating that configuration has been loaded from file:

 notice tmsh[12232]: 01420002:5: AUDIT - pid=12232 user=root folder=/Common module=(tmos)# status=[Command OK] cmd_data=load sys config partitions all base
 notice tmsh[12392]: 01420002:5: AUDIT - pid=12392 user=root folder=/Common module=(tmos)# status=[Command OK] cmd_data=load sys config partitions all

Conditions:
- VE configured in 1NIC mode.
- Unit booted either through reboot or power on.

Impact:
This is unlikely to have any impact if the VE is in standalone mode but could result in an unexpected config if the configuration files differ.

If the VE is part of a device-group, then this will result in a commit id update and the units will show 'Changes pending'.

Workaround:
None.

---

673573-8 : tmsh logs boost assertion when running child process and reaches idle-timeout

Links to More Info: BT673573

Component: TMOS

Symptoms:
An idle-timeout occurs while running a sub-process in interactive mode, resulting in a log message. tmsh logs a benign but ominous-looking critical error to the console and to /var/log/ltm if a tmsh command reaches idle timeout and a spawned sub-process is still running.

The errors in /var/log/ltm begin with the following text:
    'boost assertion failed'

Conditions:
-- tmsh command reaches idle timeout.
-- Spawned sub-process is still running.

Impact:
Although the wording indicates a failure, the message is benign and you can safely ignore it.

Workaround:
None

---

669934-2 : Session commands may not work correctly in FLOW_INIT event.

Links to More Info: BT669934

Component: Local Traffic Manager

Symptoms:
Data read or write via session-related commands (e.g., table) in an iRule's FLOW_INIT event does not match that in other events.

Conditions:
This occurs when using session-related commands from FLOW_INIT event.

Impact:
iRule does not function as expected.

Workaround:
None.

---

666845-4 : Rewrite plugin can accumulate memory used for patching very large files

Links to More Info: K08684622, BT666845

Component: Access Policy Manager

Symptoms:
Rewrite plugin memory usage is significantly higher than normal (up to 200 MB RSS) and does not decrease.

Conditions:
This happens because the plugin caches and reuses already allocated chunks of memory instead of releasing them to the operating system.

Impact:
Out-of-memory crashes on systems with low amounts of memory.

Workaround:
Use one or both of the following workarounds:
-- Restart rewrite when memory usage is too high.
-- Disable patching for large (15-20 MB uncompressed) files.

---

663754-1 : Modifying the default management port can break internal functionality

Links to More Info: BT663754

Component: Device Management

Symptoms:
Modifying the default management port for httpd 443 (ssl-port) to anything else via tmsh, will break the below functionality :
1. Gossip Framework : REST high availability (HA) sync framework will not work.
2. Licensing via BIG-IQ
3. selfLinks will be wrong

Conditions:
Changing the default management port of BIG-IP for httpd from 443 to anything else.

Impact:
BIG-IP will be unable to provide below functionality :
1. Gossip Framework : REST high availability (HA) sync framework will not work.
2. Licensing via BIG-IQ
3. selfLinks will be wrong
4. iAppLx, SSL Orchestrator, Access Guided Configuration, AS3 will be affected as these modules depends on Gossip

Workaround:
NA

---

659579-6 : Timestamps in icrd, restjavad, and restnoded logs are not synchronized with the system time

Links to More Info: BT659579

Component: TMOS

Symptoms:
Logs on icrd, restnoded, and restjavad are in the UTC time zone and are not aligned to the system time, which makes it difficult to determine the time during troubleshooting operations.

Conditions:
Checking the icrd, restnoded, and restjavad logs timestamps.

Impact:
Difficult to troubleshoot as the logs are not aligned with system time.

Workaround:
None

---

658943-5 : Errors when platform migration process is loading UCS using trunks on vCMP guest/F5OS Tenants

Links to More Info: BT658943

Component: TMOS

Symptoms:
During the platform migration from a physical BIG-IP system to a BIG-IP vCMP guest/F5OS Tenant, the load fails with one of the following messages:

01070687:3: Link Aggregation Control Protocol (LACP) is not supported on this platform. Unexpected Error: Loading configuration process failed.

01070338:3: Cannot create trunk [name of trunk], maximum limit reached Unexpected Error: Loading configuration process failed.

Conditions:
-- The source device is a physical BIG-IP device with one or more trunks with or without LACP in its configuration.
-- The destination device is a vCMP guest/F5OS Tenant.

Impact:
The platform migration fails and the configuration does not load.

Workaround:
You can use one of the following workarounds:

-- Remove all trunks from the source configuration prior to generation of the UCS.

-- Before loading the UCS archive onto the target BIG-IP, edit the archive and remove the trunk configuration from ./config/bigip_base.conf, and then repack the UCS.

-- After the UCS load fails, edit the configuration manually on the destination to remove trunk references, and then reload the configuration.

-- K50152613

---

658850-6 : Loading UCS with the platform-migrate parameter could unexpectedly set or unset management DHCP

Links to More Info: BT658850

Component: TMOS

Symptoms:
When you load a UCS file using the platform-migrate parameter, the mgmt-dhcp value (enabled, disabled, or unset) will overwrite the value on the destination. Depending on the effect, this could change the destination's management IP and default management route.

If the UCS does not have mgmt-dhcp explicitly written out, note that its value is treated as the default for the local system, which varies by the type of system. On Virtual Edition (VE) platforms, the default is to enable DHCP. On all other platforms, the default is to disable DHCP.

Conditions:
This occurs when loading a UCS using the platform-migrate parameter:
tmsh load sys ucs <ucs_file_from_another_system> platform-migrate

Impact:
Changing the mgmt-dhcp value on the destination can result in management changing from statically configured to DHCP or DHCP to statically configured. This can result in loss of management access to the device, requiring in-band or console access.

Workaround:
There are a few ways to avoid this issue:

1. Specify the "keep-current-management-ip" parameter to the "load sys ucs" command, for instance:

tmsh load sys ucs <ucs_file_from_another_system> platform-migrate keep-current-management-ip

Note: The "keep-current-management-ip" parameter is undocumented and will not appear in context help or tab completion.

2. If you want to reset the target device to use a static IP, run the following commands after loading the UCS with the platform-migrate command:

tmsh modify sys global-settings mgmt-dhcp disabled
tmsh create sys management-ip <ip>/<mask>
tmsh delete sys management-route default
tmsh create sys management-route default gateway <ip>

---

652877-7 : Reactivating the license on a VIPRION system may cause MCPD process restart on all secondary blades

Links to More Info: BT652877

Component: TMOS

Symptoms:
All services on one or all secondary blades in a VIPRION chassis restart, and MCPD logs errors similar to the following:

-- err mcpd[9063]: 01070734:3: Configuration error: DB validation exception, unique constraint violation on table (sflow_vlan_data_source) object ID (1168). A duplicate value was received for a non-primary key unique index field. DB exception text (Cannot update_indexes/checkpoint DB object, class:sflow_vlan_data_source status:13)
-- err mcpd[9063]: 01070734:3: Configuration error: Configuration from primary failed validation: 01070734:3:Configuration error: DB validation exception, unique constraint violation on table (sflow_vlan_data_source) object ID (1168). A duplicate value was received for a non-primary key unique index field. DB exception text (Cannot update_indexes/checkpoint DB object, class:sflow_vlan_data_source status:13)... failed validation with error 17237812.

In versions prior to v11.6.0, the error is: 'Can't save/checkpoint DB object,' rather than 'Can't update_indexes/checkpoint DB object'.

Conditions:
Multi-bladed VIPRION system, where the 'if-index' value for VLANs differs between blades.

You can check the 'if-index' value by running the following command on each blade: tmsh list net vlan all if-index.

Impact:
MCPD restart on all secondary blades results in partial service outage.

Workaround:
Reactivate the license only on a system that is standby/offline.

---

646768-6 : VCMP Guest CM device name not set to hostname when deployed

Links to More Info: K71255118, BT646768

Component: TMOS

Symptoms:
When you access the vCMP guest instance after you deploy the system, the instance uses the hostname bigip1.

Conditions:
This issue occurs when all of the following conditions are met:

-- The BIG-IP system is running v11.6.0 or earlier.
-- You configure a vCMP guest instance that is running BIG-IP v11.6.0 or later.
-- You have configured the vCMP guest instance with a hostname other than bigip1.
-- You deploy the vCMP guest instance.

Impact:
The vCMP guest does not use the configured hostname.

Workaround:
-- In tmsh, run the following commands, in sequence:

 mv cm device bigip1 HOSTNAME
 save sys config

-- Rename the device name in the GUI.

---

634576-3 : TMM core in per-request policy

Links to More Info: K48181045, BT634576

Component: Access Policy Manager

Symptoms:
TMM might core in cases when per-request policy encounters a reject ending and the server-side flow is not available.

Conditions:
APM or SWG per-request policy with reject ending.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None.

---

612083-3 : The System Event Log may list correctable hardware, PCIe or DMI errors.

Links to More Info: BT612083

Component: TMOS

Symptoms:
One or more of the following messages appear in the system event log:

CPU0 HW Correctable Error
CPU 0 Corrected Error: Port 1a PCIe* logical port has detected an error.
CPU 0 PCI/DMI Error B:D:F 0x8: xpglberrsts: pcie_aer_correctable_error
CPU 0 PCI/DMI Error B:D:F 0x8: corerrsts: receiver_error_status
CPU 0 PCI/DMI Error B:D:F 0x8: rperrsts: correctable_error_received
CPU 0 PCI/DMI Error B:D:F 0x8: rperrsts: multiple_correctable_error_received
CPU 0 Corrected Error: DMI Error Status
CPU 0 PCI/DMI Error B:D:F 0x0: xpglberrsts: pcie_aer_correctable_error
CPU 0 PCI/DMI Error B:D:F 0x0: corerrsts: receiver_error_status
CPU 0 PCI/DMI Error B:D:F 0x0: rperrsts: correctable_error_received
CPU 0 PCI/DMI Error B:D:F 0x0: rperrsts: multiple_correctable_error_received

Conditions:
The error messages may appear following an AC power cycle of the BIG-IP iSeries platforms: i2000, i2800, i4000 and i11800.

Impact:
The system detected an error on an internal bus and was able to correct it. There is no data loss or functional impact.

Workaround:
None

---

609878-6 : Bad ACK Flood is not detected by AFM when loose-init is enabled on the virtual server

Links to More Info: BT609878

Component: Advanced Firewall Manager

Symptoms:
When loose-init is set, which has the implicit semantics of "every ACK packet can create a connection". Hence, there is never a "Bad ACK" to drop. This behavior is expected as per design, so while enabling this option one should aware of the side effects it will cause.

Conditions:
This issue will be seen when loose-init is enabled on the fastL4 profile and when the box is flooded with asymmetric ACK packets (or) Bad-Acks.

Impact:
Enabling loose initiation may make it more vulnerable to denial of service attacks.

Workaround:
When loose-init is set in the fastL4 profile, we need to turn on connection-limits on the virtual and also Eviction Policy to prevent flow-table exhaustion.

---

599135-4 : B2250 blades may suffer from high TMM CPU utilisation with tcpdump

Links to More Info: BT599135

Component: Local Traffic Manager

Symptoms:
B2250 blades may suffer from continuous TMM CPU utilization when tcpdump has been in use.

Conditions:
Run tcpdump on a B2250 platform

Impact:
Increment in TMM CPU utilization with every run of tcpdump.

Workaround:
Restart TMM, avoid the use of tcpdump.

---

563144-2 : Changing the system's admin user causes many errors in the REST framework.

Links to More Info: BT563144

Component: Device Management

Symptoms:
The iControl REST log at /var/log/icrd will have entries similar to the following:

 notice icrd_child[32206]: 01420003:5: Cannot load user credentials for user "admin" Current session has been terminated.

Conditions:
Change the default admin user, for example, by following the steps in the Article K15632: Disabling the admin and root accounts using the BIG-IP Configuration utility or the Traffic Management Shell: https://support.f5.com/csp/article/K15632.

Impact:
Many REST APIs do not function, and functionality that depends on REST fails.

Workaround:
There is no workaround. You must use the default admin in order for iControl REST calls to work.

---

554506-3 : PMTU discovery from management does not work

Links to More Info: K47835034, BT554506

Component: TMOS

Symptoms:
You encounter connectivity issues to management interface.

Conditions:
MTU on the intermediate route is less than the management interface's MTU and the response packets have the DF flag set.

Impact:
Connectivity issues to management interface.

Workaround:
None.

Note: Although there is no workaround for this module, you can disable auto last hop and configure a default gateway to avoid this issue.

For more information see K52592992: Overview of the Auto Last Hop feature on the management interface, available at
https://support.f5.com/csp/article/K52592992.

---

550526-3 : Some time zones prevent configuring trust with a peer device using the GUI.

Links to More Info: K84370515, BT550526

Component: TMOS

Symptoms:
AEST, AEDT, ACDT, ACWST, ACWDT, AWST, Asia/Muscat, and AWDT time zones prevent configuring trust with a peer device using the GUI.

Conditions:
-- Setting a BIG-IP system timezone to AEST, AEDT, ACDT, ACWST, ACWDT, AWST, Asia/Muscat, or AWDT.

-- Using the GUI to add a peer device to a trust configuration.

Impact:
Adding a peer device using the GUI fails.

Workaround:
You can use either of the following workarounds (you might find the first one easier):

-- Temporarily set the device timezone to a non-affected timezone (e.g.; UTC), establish trust, and set it back:

1. Navigate to System :: Platform.

2. Under 'Time Zone', select 'UTC', and click 'Update'

3. Repeat steps one and two to change all devices that are to be part of the trust domain.

4. Establish device trust by navigating to Device Management :: Device Trust :: Add all peers to be part of the trust domain.

5. Once trust is established, navigate to System :: Platform, and change Time Zone back to preferred time zone.

-- Use tmsh to add a peer device in these timezones: AEST, AEDT, ACDT, ACWST, ACWDT, AWST, Asia/Muscat, or AWDT.

---

547947-2 : Feeding empty username and password to the Logon Page followed by RadiusAuthAgent shows the session as Logged out

Links to More Info: BT547947

Component: Access Policy Manager

Symptoms:
Session logs out. No error messages or retry logon page.
---------------------------------------------

Your session is finished.

Logged out successfully.

Thank you for using BIG-IP.

To open a new session, please click here.
----------------------------------------------

Conditions:
Your environment has an access policy like the following

                                   Success
Start -> Logon Page -> Radius Auth ----> Advanced resource assign (webtop) -> allow.
                              |
                              | failure
                              -----------------------------------------------> Deny.

If you connect to the virtual server with this access policy and provide an empty username and password, you are logged out of the session and asked to open a new session page.

Impact:
Without providing proper username and password, user is shown the error "Logged out successfully.", which is improper.

Workaround:
No mitigation observed.

---

539648-4 : Disabled db var Watchdog.State prevents vCMP guest activation.

Links to More Info: K45138318, BT539648

Component: TMOS

Symptoms:
If a vCMP guest user disables the watchdog using the db variable Watchdog.State, then the vCMP guest does not reach a running state as reported by the vCMP host.

Conditions:
This occurs when the user sets sys db Watchdog.State value disable.

Impact:
vCMP guest fails to be operational.

Workaround:
Do not change the Watchdog.State db variable. The vCMP host requires the watchdog to monitor the guest health.

---

538283-6 : iControl REST asynchronous tasks may block other tasks from running

Links to More Info: BT538283

Component: TMOS

Symptoms:
If an iControl REST asynchronous task is running, other iControl REST queries (synchronous or asynchronous) will wait until the asynchronous task completes before executing. If the asynchronous task is long-running, subsequent requests will block for a long time.

Conditions:
-- Executing an iControl REST task asynchronously.
-- Performing further iControl REST tasks (synchronous or asynchronous) while the asynchronous task is still running.

Impact:
Potential (and unexpected) long wait times while running a task asynchronously.

Workaround:
None.

---

528314-2 : Generating new default certificate and key pairs for BIG-IP ssl profiles via CLI will not be reflected in GUI or in tmsh

Links to More Info: K16816, BT528314

Component: TMOS

Symptoms:
Using CLI to generate new default certificate and key pairs for BIG-IP ssl profiles are not reflected in GUI or in tmsh.

Conditions:
Using OpenSSL commands to generate a new default certificate and key pair, as described in SOL13579: Generating new default certificate and key pairs for BIG-IP ssl profiles, available here: https://support.f5.com/kb/en-us/solutions/public/13000/500/sol13579.html.

Impact:
After the renewal, tmsh list sys file ssl-cert default.crt command or the general properties in the GUI SSL Cert List shows the old one. This is a cosmetic issue only. The system uses the new default.

Workaround:
Perform a force reload of mcpd by running the following commands: -- touch /service/mcpd/forceload. -- tmsh restart sys service mcpd.

---

527119-9 : An iframe document body might be null after iframe creation in rewritten document.

Links to More Info: BT527119

Component: Access Policy Manager

Symptoms:
Cannot use certain page elements (such as the Portal Access menu) in Google Chrome, and it appears that JavaScript has not properly initialized, and results in JavaScript errors on the following kinds of code:
    iframe.contentDocument.write(html)
    iframe.contentDocument.close()
    <any operation with iframe.contentDocument.body>

Conditions:
-- The body of a dynamically created iframe document might be initialized asynchronously after APM rewriting.

-- Using the Chrome browser.

Impact:
Some JavaScript applications might not work correctly when accessed through Portal Access. For example, one of applications known to contain such code and fail after APM rewriting is TinyMCE editor.

Workaround:
Revert rewriting of the document.write call with a post-processing iRule.

The workaround iRule will be unique for each affected application.

---

499348-14 : System statistics may fail to update, or report negative deltas due to delayed stats merging.

Links to More Info: BT499348

Component: TMOS

Symptoms:
Under some conditions, the BIG-IP system might fail to report statistics over time. This can manifest as statistics reporting unchanging statistics (e.g., all zeroes (0)), or as sudden spikes in traffic, or as negative deltas in some counters.

The system performance graphs will also appear to have gaps / be missing data at the times that this occurs.

Conditions:
This occurs when there are frequent changes occurring to the underlying statistics data structures. This might occur under the following conditions:

-- The system is spawning/reaping processes on a frequent basis (e.g., when there is a large number of external monitors).

-- iRules are frequently using 'SSL::profile' to select different SSL profiles on a virtual server (this can cause per-virtual server, per-profile statistics to be created and deleted on a regular basis).

Impact:
Statistics fail to merge, which results in incorrect view of system behavior and operation.

Workaround:
This issue has two workarounds:

1. Reduce the frequency of changes in the statistics data structures. The specific action to take depends on what is triggering them. To do so, use any or all of the following:

 -- Reduce the frequency of configuration changes.
 -- Reduce the use of 'SSL::profile' in iRules.
 -- Reduce the number/frequency of processes being spawned by the system.

2. The second workaround has two parts:

a) Switch statistics roll-ups to the 'slow_merge' method, which causes the system to spend more CPU merging statistics. To do so, set the 'merged.method' DB key to 'slow_merge' using the following command:

    tmsh modify sys db merged.method value slow_merge

b) Change the merge-interval value to 2 to reduce CPU usage when merge-method is slow-merge.

    tmsh modify /sys db merged.merge.interval {value "2"}

Note: Performing the second workaround has the side-effect of disabling tmstat snapshots on the device. The tmstat snapshots are intended for F5-internal use only: the lack of snapshots will have no bearing on the functionality of your system; however, F5 Support might be impacted in their ability to troubleshoot issues on your system.

---

493740-4 : tmsh allows cipher group creation with non-existent "require" or "exclude" cipher rule.

Links to More Info: BT493740

Component: TMOS

Symptoms:
Using tmsh it is possible to create a cipher group referencing a non-existent cipher rule with tmsh even if this configuration is invalid.

Conditions:
Use tmsh to create a cipher group referencing a non-existent cipher rule using a command like this, where the 'require' or the 'exclude' directive comes after the 'allow' directive.

The non-existent cipher rule is "no-exist" in these examples:

tmsh create ltm cipher group test-group { allow add { f5-default } require add { no-exist } }

tmsh create ltm cipher group test-group { allow add { f5-default } exclude add { no-exist } }

Impact:
The result is an invalid configuration that can break configuration synchronisation between BIG-IP peers in some cases (after upgrades, or full configuration reload, for example).

Also, when navigating to the cipher group the GUI does not show it.

The GUI may also show this error:
"An error has occurred while trying to process your request. "

Workaround:
Use the GUI to create a new cipher groups.

When using tmsh, don't create a cipher group referencing a non-existent cipher rule.

---

490139-7 : Loading iRules from file deletes the last few comment lines

Links to More Info: BT490139

Component: Local Traffic Manager

Symptoms:
Loading iRules from the iRules file deletes the last few comment lines immediately preceding the closing bracket.

Conditions:
This occurs when loading an iRule file containing a comment after the last closing brace and then upgrading to a known affected version

Impact:
Although the comments are removed, this does not affect iRule functionality.

Workaround:
Add comments in places other than immediately above the closing bracket.

---

475997-2 : SSL stream throughput slows down when hardware SSL offloading is in use

Links to More Info: K16687, BT475997

Component: Performance

Symptoms:
When performing LAN-speed transfers of large files (hundreds of MB) over SSL, or transfers of small ssl records, the throughput speed of the transfer significantly drops if the hardware SSL offloading is performed. The performance drop is from ~30% - ~50% depending on the cipher suite used.

Conditions:
This issue occurs when hardware SSL offloading is turned on.

Impact:
The performance degrades from ~30% - ~50% depending on the cipher suite used.

Workaround:
To work around this issue, you can modify the High-Speed Bridge (HSB) scheduler. To do so, perform the following procedure:

Impact of workaround: Performing the following procedure should not have a negative impact on your system.

Modifying the scheduler.hsbpollmode.ltm db key

Log in to the Traffic Management Shell (tmsh) by typing the following command:
tmsh

To set the db key value to always, type the following command:
modify /sys db scheduler.hsbpollmode.ltm value always

Save the changes by typing the following command:
save /sys config

---

464708-3 : DNS logging does not support Splunk format log

Links to More Info: BT464708

Component: Global Traffic Manager (DNS)

Symptoms:
DNS logging does not support Splunk format logging. It fails to log the events, instead logging err messages:

hostname="XXXXXXXXXXXXX.XX",errdefs_msgno="01230140:3:

Conditions:
DNS logging configured for Splunk format.

Impact:
DNS logging does not log Splunk format to HSL.

Workaround:
Use an iRule to send Splunk-formatted messages to the Splunk server.

For example:

ltm rule dns_logging_to_splunk {

   when DNS_REQUEST {
      set ldns [IP::client_addr]
      set vs_name [virtual name]
      set q_name [DNS::question name]
      set q_type [DNS::question type]

      set hsl [HSL::open -proto UDP -pool splunk-servers]
      HSL::send $hsl "<190>,f5-dns-event=DNS_REQUEST,ldns=$ldns,virtual=$vs_name,query_name=$q_name,query_type=$q_type"
   }

   when DNS_RESPONSE {
      set ldns [IP::client_addr]
      set vs_name [virtual name]
      set q_name [DNS::question name]
      set q_type [DNS::question type]
      set answer [DNS::answer]

      set hsl [HSL::open -proto UDP -pool splunk-servers]
      HSL::send $hsl "<190>,f5-dns-event=DNS_RESPONSE,ldns=$ldns,virtual=$vs_name,query_name=$q_name,query_type=$q_type,answer=＼"$answer＼""
   }
}

---

447522-1 : GUI: SNMPV3 Incorrectly requires "OID" when creating an SNMP user.

Links to More Info: BT447522

Component: TMOS

Symptoms:
The BIG-IP GUI incorrectly requires an OID to be specified when creating an SNMPv3 user.

Conditions:
Creating an SNMPv3 user via the BIG-IP GUI.

Impact:
An OID can be used to restrict the view that the user has to a particular branch of the tree, but should not be a required attribute.

Workaround:
- Enter a value of ".1" (with a leading dot) to allow access to all OIDs
(or)
- Create the user using tmsh instead of the GUI, where the oid-subset attribute is not mandatory.

---

431503-11 : TMSH crashes in rare initial tunnel configurations

Links to More Info: K14838, BT431503

Component: TMOS

Symptoms:
In rare BIG-IP configuration scenarios, TMM may crash during its startup process when the tunnel configurations are loaded.

Conditions:
During TMM startup, a tunnel is created, then immediately removed during the configuration load period, when TMM neighbor messages may be in flight via the tunnel. When the race condition fits, the neighbor message may land on an invalid tunnel.

Impact:
TMM crash in rare race conditions.

Workaround:
None.

---

427094-1 : Accept-language is not respected if there is no session context for page requested.

Links to More Info: BT427094

Component: Access Policy Manager

Symptoms:
Localization settings are determined when the session is created.
As a result, when the user logs out, there is user context left for APM to determine what language to present to the user.
So, when user is using the localized logon page, after the refresh it turns to the default language.

Conditions:
After configuring the preferred language, When refreshing login page twice, language is changed to default Eng.

Impact:
APM page doesn't load the preferred language after refreshing twice.

Workaround:
N/A

---

382363-8 : min-up-members and using gateway-failsafe-device on the same pool.

Links to More Info: K30588577

Component: TMOS

Symptoms:
The system does not require setting a pool's min-up-members greater than 0 (zero) when also using gateway-failsafe-device on the same pool.

Conditions:
A pool's min-up-members is 0 when gateway-failsafe-device is set.

Impact:
Failure to set min-up-members greater than 0 when using gateway-failsafe-device might cause errors. The tmm might crash.

Workaround:
Set min-up-members greater than 0 when using gateway-failsafe-device.

---

369640-8 : iRules might return incorrect data when multiple partitions and/or folders contain objects with the same name

Links to More Info: K17195

Component: Local Traffic Manager

Symptoms:
iRules might return incorrect data when the BIG-IP configuration has folders or multiple administrative partitions that contain objects with the same name.

As a result of this issue, you may encounter one or more of the following symptoms:

 -- Client connections receive incorrect data.
 -- The BIG-IP system incorrectly load balances client connections.

Conditions:
This issue occurs when all of the following conditions are met:

 -- The configuration includes objects of the same name in different folders or administrative partitions
 -- An iRule references the object without using the fully-qualified path, e.g. "pool example_pool" instead of "pool /Common/folder1/example_pool"

Impact:
Client connections receive incorrect data, or are load balanced incorrectly.

Workaround:
To work around this issue, always specify full paths to objects referenced in iRules, e.g. instead of:
    pool example_pool
use:
    pool /Common/example_pool

---

349706-4 : NetworkAccess assigns 1.1.1.1 address to remote ppp endpoint APM VPN

Component: Access Policy Manager

Symptoms:
Network access sends 1.1.1.1 as X-VPN-serer-IP and Edge client reserves this IP for PPP communication with APM server.

Conditions:
-- VPN is configured on BIG-IP.
-- Edge Client/webtop is used to connect to VPN.

Impact:
If VPN is connected:
1. The user may not access the 1.1.1.1 address from the client machine.
2. if 1.1.1.1 is used as a dns server ip in Network Access configuration, DNS resolution may fail on the client machine.

Workaround:
NA

---

342319-1 : BIND forwarder server list and the recursion and forward options.

Component: TMOS

Symptoms:
When you add a Domain Name System (DNS) server to the BIND forwarder server list from the Configuration utility, the recursion option is set to no and the forward option is not set.

Conditions:
The parameters 'recursion yes' and 'forward only' are not being updated in named.conf when creating entries in the BIND Forwarder Server List from the GUI.

Impact:
This issue may cause some DNS queries that are sent to the BIG-IP system to fail.

Workaround:
You can work around this issue by setting the recursion and forward options. For more information, see SOL12224: Configuring the BIND forwarder server list does not correctly set additional options for the named.conf file, available here: http://support.f5.com/kb/en-us/solutions/public/12000/200/sol12224.html.

---

222220-8 : Distributed application statistics are not passed correctly.

Links to More Info: K11931

Component: Global Traffic Manager (DNS)

Symptoms:
Distributed application statistics include only requests passed to its first wide IP.

For BIG-IP versions 12.0.0 and later, distributed application statistics are always zero.

Conditions:
Viewing distributed application statistics on configurations with multiple wide-IP members.

Impact:
The system does not pass statistics for requests to all wide-IP members in the distributed application.

Note: For BIG-IP versions 12.0.0 and later, the system does not pass statistics for requests to any wide-IP-members in the distributed application.

Workaround:
None

---

1351493 : Invalid JSON node type while support-introspection enabled

Component: Access Policy Manager

Symptoms:
As per RFC 7519, the expected value “exp” in the JWT token is a numerical value. JSON itself does not have a native type for integers, so all numerical values are represented as either numbers (without quotes) or strings (with quotes). In our case, we throw an exception if it is not a number to consider the string value. We also have an additional check to ensure it is a valid type.

Conditions:
The issue occurs only when support-introspection is enabled.

Impact:
Support-introspection cannot be enabled.

Workaround:
Disable support-introspection.

---

1350985 : APM policy sync fails after deleting macro ending

Links to More Info: BT1350985

Component: Access Policy Manager

Symptoms:
Policy sync fails with error "01071202:3: Number of rules in macro call (/Common/Doble-sync-fail-tst_mac_authentication_4) must be equal to the number of macro terminalouts."

Conditions:
1)Devices should be in sync-only group.
2)The access policy should have a macro configured with terminals endings.
3)The access policy should be already synced and present on the other device. i.e problem is seen during subsequent policy syncs and not seen during the first sync.
4)The issue is seen only if macro terminal endings are deleted and then policy sync is performed.

Impact:
Policy sync is broken.

Workaround:
Delete the terminal outs even on the other device in the sync group and then perform the policy sync.

---

1350885-2 : TMM cored with SIGSEGV when using dtls by disabling the unclean shutdown flag

Links to More Info: BT1350885

Component: Local Traffic Manager

Symptoms:
TMM cores

Conditions:
This condition occurs when the DTLS + UNCLEAN SHUTDOWN is DISABLED.

Impact:
Traffic is disrupted while TMM restarts.

Workaround:
None

---

1350693-2 : Log publisher using replicated destination with unreliable destination servers may leak xfrags

Links to More Info: BT1350693

Component: TMOS

Symptoms:
Over time, xfrag usage increases and does not return to the previous level when traffic is stopped.

Conditions:
The issue occurs under the following conditions:
-- Log publisher with replicated destination.
-- Replicated destination with a pool of more than 1 member.
-- Pool members go up and down over time.

Impact:
F5 box encountered aggressive sweeper mode leading to loss of traffic.

Workaround:
None

---

1350273-2 : Kerberos SSO Failing for Cross Domain After Upgrade from 15.1.8.2 to 15.1.9.1

Links to More Info: BT1350273

Component: Access Policy Manager

Symptoms:
401 Unauthorised received from backend server even if SSO succeeds.

Conditions:
-- Kerberos SSO configured on 15.1.9

Impact:
Users unable to do SSO or basic auth using credentials.

---

1348945 : BD core is seen while setting "likely_false_positive_mode"

Links to More Info: BT1348945

Component: Application Security Manager

Symptoms:
Bd crashes.

Conditions:
Setting "likely_false_positive_mode" through /usr/share/ts/bin/add_del_internal add likely_false_positive_mode 1 causes bd to crash while sending any request

Impact:
Traffic disrupted while bd restarts.

Workaround:
Set likely_false_positive_mode to default "0"

---

1348869 : Hourly spike in the CPU usage and lasts for fraction of second causing delay in TLS connections

Links to More Info: BT1348869

Component: Local Traffic Manager

Symptoms:
1. Hourly spike in the CPU usage.
2. TMM Idle enforcer gets activated.

Conditions:
When the DHE is enabled in the cipher suite for the SSL Profile.

Impact:
TMM Idle enforcer gets activated and causes a delay in TLS traffic and CPU Usage goes high.

Workaround:
None

---

1348841 : TMM cored with SIGSEGV when using dtls by disabling the unclean shutdown flag

Links to More Info: BT1348841

Component: Local Traffic Manager

Symptoms:
TMM cores

Conditions:
This condition occurs when the DTLS + UNCLEAN SHUTDOWN is DISABLED.

Impact:
Traffic is disrupted while TMM restarts.

Workaround:
None

---

1348425-3 : Header name or parameter name is configured with space.

Component: Application Security Manager

Symptoms:
ASM may crash due to header/parameter configuration with space.

Conditions:
-- A header name or parameter name is configured with a space.
-- More than 37 custom headers and/or parameter header name (location header) is configured. One of the headers or parameter names has space.

Impact:
Traffic disrupted while bd restarts.

Workaround:
Do not configure header names or parameter names with a space.

---

1348061-2 : [Dual Stack MGMT] - Upgrade of BIG-IP in HA with Dual stacked mgmt IP causes deletion of peers failover IPv4 unicast address★

Links to More Info: BT1348061

Component: TMOS

Symptoms:
Before the upgrade, 'tmsh show cm failover' output will show the status as 'OK' in all BIG-IPs for both Ipv4 and Ipv6 management IPs configured as failover unicast addresses.
 
After the upgrade, a few BIG-IPs in the HA cluster stopped sending failover packets to the peer on ipv4 mgmt which caused the output of ''tmsh show cm failover' to show as "Error".

Conditions:
The issue occurs under the following conditions:
-- 3 or more BIG-IPs in the HA cluster.
-- 3 or more Traffic-Group configured.
-- IPv4 and IPv6 management address configured.
-- Upgrade from 14.1.x to the new version or MCPD forceload of BIG-IPs in cluster running 14.1.x or later.

Impact:
BIG-IPs stopped sending failover packets to the peer on ipv4 mgmt. Since only the Ipv4 mgmt address will show as an error but other failover unicast addresses will not be impacted so it should not cause broken failover connectivity.

Workaround:
Delete and re-add the 'management_address' in the failover network in all BIG-IPs and the status will be changed to 'OK'. It is suggested to also add self-ip as a failover unicast address along with management-IP.

---

1347861-2 : Monitor status update logs unclear for FQDN template pool member

Links to More Info: BT1347861

Component: TMOS

Symptoms:
When the state of an FQDN template node is changed (such as being forced offline by user action), one or more messages similar to the following may appear in the LTM log (/var/log/ltm):

notice mcpd[####]: 01070638:5: Pool /Common/poolname member /Common/nodename:## monitor status unchecked. [ ] [ was unknown for #hrs:##mins:##sec ]

Although such log messages indicate the current state of the FQDN template pool member, the prior status is indicated as "unknown" and does not accurately indicate the prior state of the FQDN template pool member.

Conditions:
This may occur when FQDN nodes and pool members are configured, and When the state of an FQDN template node is changed (such as being forced offline or re-enabled from an offline state by user action).

Impact:
Such messages may confuse users who are attempting to monitor changes in the BIG-IP system by not providing clear information.

Workaround:
The state of an FQDN template pool member is generally determined by the state of the referenced FQDN template node. The FQDN template node contains the configuration used to resolve the FQDN name to the corresponding IP addresses. FQDN template pool members are not involved in this process, and generally only reflect the status of the name resolution process centered on the FQDN template node.

Examining log messages related to to the associated FQDN template node can inform the interpretation of the FQDN template pool member state.
For example, if an FQDN template node is forced offline, messages similar to the following will be logged indicating the FQDN template node state change, which is subsequently reflected in FQDN template pool member state changes:

notice mcpd[####]: 01070641:5: Node /Common/nodename address :: session status forced disabled.
notice mcpd[####]: 01070638:5: Pool /Common/poolname member /Common/nodename:## monitor status forced down. [ ] [ was unknown for #hr:##min:##sec ]

notice mcpd[####]: 01070641:5: Node /Common/nodename address :: session status enabled.
notice mcpd[####]: 01070638:5: Pool /Common/poolname member /Common/nodename:## monitor status unchecked. [ ] [ was unknown for #hr:##min:##sec ]

---

1346461-3 : Bd crash at some cases

Component: Application Security Manager

Symptoms:
When bd uses an Openapi policy to handle a request, it may crash.

Conditions:
-- Openapi security policy;
-- Release contains fix of ID1190365.

Impact:
Traffic disrupted while bd restarts.

Workaround:
None

---

1345997-2 : Very large number of custom URLs in SWG can impact performance.

Links to More Info: BT1345997

Component: Access Policy Manager

Symptoms:
High TMM CPU usage. Inability to support expected number of connections.

Conditions:
- SWG and APM provisioned.
- Large numbers of glob pattern matches in custom URL categories, e.g. tens of thousands.
- Bulk of the matches are similar to "*://www.hostname.com" or "http://*.domain.com"

Impact:
Degraded TMM performance.

Workaround:
None

---

1345989 : "Rest framework is not available" being displayed when navigating to the "Device Management >> Overview" page

Links to More Info: BT1345989

Component: TMOS

Symptoms:
Com.f5.rest.workers.storage.ThreadPoolStorageRequestProcessorjava.lang.OutOfMemoryError: Java heap space

Conditions:
Under HA pair setup, over the period of 6 months or more, the device-discovery-tasks accumulate, causing restjavad to fail repeatedly, once every 20 seconds, logging the message: "com.f5.rest.workers.storage.ThreadPoolStorageRequestProcessorjava.lang.OutOfMemoryError: Java heap space".

Impact:
REST Framework not being available, causing the "Device Management >> View" screen to show failure.

Workaround:
Run clear-rest-storage once a week and try increasing the restjavad.extramb BIGdb variable from 192 to 768.

---

1341849 : APM- tmm core SIGSEGV in saml artifact usage

Links to More Info: BT1341849

Component: Access Policy Manager

Symptoms:
This can occur while processing SAML traffic.

Conditions:
SAML configured with artifact usage in idp.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

---

1340513-2 : The "max-depth exceeds 6" message in TMM logs

Links to More Info: BT1340513

Component: TMOS

Symptoms:
An error message similar to the following is seen in /var/log/ltm:

err tmmX[XXXXXX]: 01630002:3: (max-depth exceeds 6) ()

Conditions:
These errors may appear in the LTM log once for each TMM that starts up, often after a configuration action such as:
-- Modifying virtual server configuration.
-- Assigning an ASM policy or a bot profile to a virtual server.
-- Running a config merge command.

Impact:
These messages are benign, despite being logged at an "error" level.

---

1338837 : [APM][RADIUS] Support Framed-IPv6-Address in RADIUS Accounting STOP message

Links to More Info: BT1338837

Component: Access Policy Manager

Symptoms:
When the VPN tunnel is terminated, 'Radius Accounting-Request (STOP)' does not include AVP Framed-IP-Address when the Network Access resource is configured with IPv4 & IPv6.

Conditions:
This issue occurs under the following conditions:
-- Network Access resource is configured with both IPv4 and IPv6.
-- PPP IP address can be either static (obtained from RADIUS) or dynamic (obtained from the lease pool).
-- Using an Edge client or a browser.
-- VPN tunnel is terminated.

Impact:
APM sends a 'Radius Accounting-Request (STOP)' that does not include the AVP Framed-IP-Address.

Workaround:
Configure only IPv4 IP addresses for the Network Access resource.

---

1332473-2 : Configuring SNAT Origin IPv6 address through GUI in non RD0 incorectly expands subnet mask to '/32' causes error during configuration load

Links to More Info: BT1332473

Component: TMOS

Symptoms:
The SNAT Origin IPv6 address subnet mask incorrectly expands to '/32' causing an error during configuration load.

Conditions:
-- In GUI, create a SNAT list with Origin Set to IPv6 address.
-- Perform the command tmsh load sys config.

Impact:
Error is observed while loading the configuration (tmsh load sys config).

Workaround:
None

---

1331037-3 : The message MCP message handling failed logs in TMM with FQDN nodes/pool members

Links to More Info: BT1331037

Component: TMOS

Symptoms:
When an FQDN node or pool member is created, one or more messages of the following form may appear in the TMM logs (/var/log/tmm*):

notice MCP message handling failed in 0x<hex value>

Conditions:
This may occur when creating an FQDN node or pool member on affected versions of BIG-IP.

Impact:
There is no known impact of this issue, besides the appearance of "notice" level messages in the TMM logs.

Workaround:
None

---

1330473-2 : Response_log_rate_limit is not applied

Component: Application Security Manager

Symptoms:
Response_log_rate_limit is not applied in a certain scenario

Conditions:
Response logging is enabled

Impact:
Response_log_rate_limit is not applied to response logging in the certain scenario.

Workaround:
Disable response logging

---

1330249-3 : Fastl4 can queue up too many packets

Links to More Info: BT1330249

Component: Local Traffic Manager

Symptoms:
-- Excessive xdata memory usage.
-- SOD may kill TMM for being unresponsive.

Conditions:
The issue occurs under the following conditions:
-- fastl4 profile in use.
-- rate-limit is used in virtual.
-- server-side gets stuck trying to connect.
-- lots of incoming clientside packets.

Impact:
Packets can be queued without limit. In the worst case, this can lead to memory exhaustion or SOD killing TMM as it tries to process the packet queue. Traffic is disrupted while TMM restarts.

Workaround:
Do not use rate-limit.

---

1330213-3 : SIGABRT is sent when single quotes are not closed/balanced in TMSH commands

Links to More Info: BT1330213

Component: TMOS

Symptoms:
When a TMSH command is entered with only one single quote (unbalanced quotes), the TMSH aborts.

For example:

[root@test-mem-bigip:Active:Standalone] config # tmsh -c "list /net | grep 'foo"
terminate called after throwing an instance of 'CLI::SyntaxError'
what(): single quotes are not balanced
Aborted (core dumped)

Conditions:
When only one single quote is used in a TMSH command, the SIGABRT occurs.

For example:

# tmsh -c "list /net | grep 'foo"
or
# tmsh -c "list /net '"

Impact:
TMSH crashes and a core file is generated.

Workaround:
None

---

1329557-2 : The Attack Types and Violations reported in the incident do not match the incident subtype

Links to More Info: BT1329557

Component: Application Security Manager

Symptoms:
The Attack Types and Violations in the incident are computed incorrectly.

Conditions:
-- Event Correlation is enabled.
-- Incident is generated from the related requests.

Impact:
The incident generated shows incorrect Attack Types and Violations.

Workaround:
None

---

1329509-2 : TCL error 'ERR_VAL (line 1) invoked from within "HTTP::path"'.

Links to More Info: BT1329509

Component: Local Traffic Manager

Symptoms:
Under specific conditions, when the client accesses an HTTP(S) virtual server, an iRule execution error occurs. Client-side HTTP(S) connection is terminated by RST when an iRule execution error occurs.

  err tmm[xxxxx]: 01220001:3: TCL error: /Common/test-rule <HTTP_REQUEST> - ERR_VAL (line 1) invoked from within "HTTP::path"

Conditions:
This issue occurs under the following conditions:

-- HTTP::path command is used on an iRule.
-- The iRule is attached to an HTTP(S) virtual server.
-- Client's HTTP(S) request URI includes square bracket character, "[" (0x5b) or "]" (0x5d).
-- Client's HTTP(S) request URI includes only opening square bracket "[" or only closing square bracket "]", for example, "GET [ HTTP/1.0＼r＼n＼r＼n".

Impact:
iRule execution fails with a TCL error such as the following example, and the client will receive TCP RST from the virtual server when iRule execution fails.

  err tmm[xxxxx]: 01220001:3: TCL error: /Common/test-rule <HTTP_REQUEST> - ERR_VAL (line 1) invoked from within "HTTP::path"

Workaround:
Add "-normalized" command option to HTTP::path command.

ltm rule /Common/test-rule-normalized {
   when HTTP_REQUEST {
      if { [HTTP::path -normalized] contains "test" } {
         HTTP::respond 200 -content "OK !!!＼n"
      } else {
         HTTP::respond 200 -content "Hit ＼"else＼" statement !!!＼n"
      }
   }
}

Note: Adding "-normalized" command option may change the URI, so testing and verification before applying workaround on production environment is strongly recommended.

---

1329477-2 : Auto-initialization does not work with certain MRF connection-mode

Links to More Info: BT1329477

Component: Service Provider

Symptoms:
When using certain connection-mode, no connections are initiated automatically to the peer server.

Conditions:
The following connection mode will not take auto-initialization into account: per-peer-alternate-tmm

Only these will:
per-peer
per-blade
per-tmm

Impact:
Auto-init not working

Workaround:
If possible, use other connection-mode for which auto-initialization is working.

---

1329065 : Hostname violation when hostname starts with multiple 0's

Links to More Info: BT1329065

Component: Application Security Manager

Symptoms:
Request blocked with "bad hostname violation".

Conditions:
Enable bad hostname violation.

Impact:
Request is blocked.

---

1328893-1 : TMM core when processing invalid timer.

Links to More Info: BT1328893

Component: Local Traffic Manager

Symptoms:
TMM cores.

Conditions:
DTLS is configured on Network Access resource.

Impact:
Traffic disrupted while TMM restarts.

Workaround:
Use TLS on Network Access resource.

---

1328857-2 : GUI error when accessing hyperlink for associated gtm link object on a virtual server

Links to More Info: BT1328857

Component: Global Traffic Manager (DNS)

Symptoms:
GUI displays "An error has occurred while trying to process your request" while accessing gtm link object on a virtual server.

Conditions:
Trying to access gtm link object under LTM -> Virtual Servers -> virtual server properties.

Impact:
Unable to view gtm link information in GUI.

Workaround:
Modify links through dns -> gslb -> links

---

1328573 : Illegal repeated header violation is not enforced for cookie header

Links to More Info: BT1328573

Component: Application Security Manager

Symptoms:
When "Allow Repeated Occurrences" is disabled on Cookie header and Illegal Repeated Header violation is enabled in Learning and Blocking settings, the expectation is that any request with multiple Cookie headers will be flagged as alarm/block. However, this does not happen.

Conditions:
1) "Allow Repeated Occurrences" is disabled on Cookie header via Rest.
2) Illegal Repeated Header violation is enabled in Learning and Blocking settings.

Impact:
Illegal requests are allowed.

Workaround:
N/A

---

1328433 : TMM cores while using VPN with ipv6 configured

Links to More Info: BT1328433

Component: Access Policy Manager

Symptoms:
TMM cores.

Conditions:
VPN configured for both ipv4 and ipv6.

Impact:
Traffic disrupts when TMM cores.

---

1327961-1 : EAM plugin crashes

Links to More Info: BT1327961

Component: Access Policy Manager

Symptoms:
EAM process was restarting and kept coring.
Suspecting this as key collision. The key is generated using ftok and isn't guaranteed to avoid collisions on a large box with 18 TMMs, which creates the opportunity for collisions (more shared memory in use).

Conditions:
Errors come across when EAM plugin intialisation
eam: shmget name:/var/run/tmm.mp.eam16, key:0xff14561e, size:7, total:789184 : Invalid argument

Impact:
Impacts functionality.

Workaround:
Fixed the problem by restarting the BIG-IP
The fact that a reboot clears the condition also supports this - the underlying inode being used to generate key is changed due to the a new version of the key file being created.

---

1327933-1 : 'tmsh show sys ip-address' command throws 'Syntax Error: Invalid IP address' error when address space is added

Links to More Info: BT1327933

Component: Access Policy Manager

Symptoms:
You may observe 'Syntax Error: Invalid IP address' error when you run

'tmsh show sys ip-address'

Conditions:
-Address space configured.

Impact:
Unable to run 'tmsh show sys ip-address'.

---

1327649 : Invalid certificate order within cert-chain associated to JWK configuration

Links to More Info: BT1327649

Component: TMOS

Symptoms:
Validation exception and error throws while validating the certificate and certertificate chain in JSON web key configuration.

Internally, while validating the certificate with chain, after first iteration is complete with endpoint child and endpoint and in the next iteration the expected certificate is endpoint with next chain; here certificate is also changing to next with chain that caused in validation failure.

Conditions:
The certificate and certificate chain issuer order should be valid.
Issue occurs when the certificate chain contains three or more certificates.

The proper order in issuing
endpointchild
|
 endpoint
 |
  intermediate
   |
    ca

Impact:
Does not allow to create policy with key configuration for OAuth.

Workaround:
No impact when certificate chain is in valid order contain two certificates in the chain.

---

1326797-3 : The Pool State of an offline pool with one or more user-disabled pool members depends on which pool member was marked down last by its monitor (non-deterministic behaviour)

Links to More Info: BT1326797

Component: Local Traffic Manager

Symptoms:
When you have two or more pool members with one pool member being administratively disabled and the other(s) being enabled, and all pool members are marked down by their monitor, the pool status depends on which pool member was marked down last.

Specifically:
- the disabled pool member is marked down by the monitor last - pool is in "offline/disabled-by-parent" state
- one of the enabled pool members are marked down by monitor last - pool is in "offline/enabled" state

Conditions:
- LTM pool configured with two or more pool members
- One pool member administratively disabled and the other(s) enabled
- All pool members marked down by their monitors

Impact:
When all the pool members are marked down by their monitors, the State of the pool depends on which pool member was last marked down by its monitor.

Workaround:
None

---

1325721-3 : Oauth not allowed for old tokens after upgrade to 15.1.9

Links to More Info: BT1325721

Component: Access Policy Manager

Symptoms:
Users are not able to access the Oauth old tokens after the fix for vulnerability that is, removal of hard coded encryption keys in Oauth.

Conditions:
Oauth feature with Opaque tokens configured and upgrade the version to 15.1.9 from previous versions.

Impact:
Not able to use old tokens

Workaround:
From 15.1.9 the Oauth old tokens that were generated and used in earlier versions will not work.

Due to the vulnerability CWE-798 the hard coded key encryption functionality usage has been removed and now the token generation will be dynamic so the old tokens which were used earlier are displayed as inactive when client runs a introspection.

Suggestive workaround is to use purge now option in UI. (Access > Overview > OAuth Reports > Tokens)
users have to remove the older tokens in oauthDB for every reboot.

---

1325681-2 : VLAN tscookies with fastl4 timestamp preserve and PVA acceleration cause connection problems.

Links to More Info: BT1325681

Component: Advanced Firewall Manager

Symptoms:
Some connections might be reset by the client or server when VLAN timestamp cookies are configured.

Conditions:
-- Flow accelerated in PVA.
-- VLAN timestamp cookies configured for one side of the connection.
-- Bigproto timestamp preserve option (default).
-- Client and server sending timestamps.

Impact:
Unexpected flow RSTs from client/server due to incorrect timestamp echo received from BIG-IP.

Workaround:
Either:
- Set fastL4 profile option 'tcp-pva-whento-offload' to 'establish'
OR
- Disable VLAN timestamp cookies.
OR
- Change Bigproto timestamp option to rewrite (this disables PVA acceleration in a process).

---

1325649-2 : POST request with "Expect: 100-Continue" and HTTP::collect + HTTP::release is not being passed to pool member

Links to More Info: BT1325649

Component: Local Traffic Manager

Symptoms:
After upgrading from a BIG-IP version prior to v16.1.0 to BIG-IP v16.1.0 or later, one specific virtual-server is not working as expected and unable to forward the POST request towards the pool member.

Conditions:
1) Upgrade to v16.1.0 or later

2) Send a POST request from client with "Expect: 100-Continue".

3) Attach an irule using http::collect plus http::release to the Virtual Server.

Impact:
Cannot send POST requests from client to server

---

1325561 : Reboot should be prohibited in the middle of Terraform onboarding and the f5-bigip-runtime-init is not finished

Links to More Info: BT1325561

Component: TMOS

Symptoms:
A reboot occurs when the f5-bigip-runtime-init is not finished.

Conditions:
On Azure, and the VM is using Terraform onboarding.

Impact:
On Azure, the VM sometimes reboots in the middle of Terraform onboarding.

Workaround:
N/A

---

1325145-2 : SSRF DNS Lookup can cause memory leak

Links to More Info: BT1325145

Component: Application Security Manager

Symptoms:
Memory leak can occur when using SSRF DNS lookup.

Conditions:
1) SSRF violation is enabled
2) SSRF configuration is present for domain names with action Resolve

Impact:
Memory leak can occur leading to less memory available for handling traffic.

Workaround:
N/A

---

1325045 : Nexthop of mirrored flow is not updated when standby becomes active

Links to More Info: BT1325045

Component: Local Traffic Manager

Symptoms:
After failover, newly active BIG-IP does not refresh the server nexthop value when a routing change occurs. This is an intermittent issue.

Conditions:
BIG-IP in high availability (HA) scenario with connection mirroring. A network failure triggers a failover and also stops the newly active from reaching the server nexthop. A routing change (eg: bgp peering timeout) occurs which should trigger a recalculation of the server nexthop mac-address.

Impact:
Connection failure until the flow entry is deleted.

Workaround:
Clear the connflow entry from the table.

Remove connection mirroring.

Reconfigure network so that active and standby have equal access to the network in the event of failure.

Use VRRP/HSRP or similar on the downstream network.

---

1324777-1 : The get_file_from_link in F5::Utils::File should support HTTPS links also when proxy.host DB key is configured

Links to More Info: BT1324777

Component: Application Security Manager

Symptoms:
Import declarative policy is failing because of unsuccessful retrieval of the HTTPS external link for the open API file which is in use in the declarative policy, the response code 400 Bad Request is displayed.

Conditions:
The proxy server is in use and the proxy.host DB key is configured and the declarative policy is using an external HTTPS link for the open API file.

Impact:
Import declarative policy is failing.

Workaround:
Use a local file instead of using the external link.
For example, if you have a file “my_swagger_file.yaml”, you should use 'file-transfer' task to upload the Swagger file to the BIG-IP, and in the JSON policy it will be used like that:
"open-api-files": [
              {
              "link": "file://my_swagger_file.yaml"
              }
          ]

---

1324681-3 : Virtual-server might stop responding when traffic-matching-criteria is removed.

Links to More Info: BT1324681

Component: TMOS

Symptoms:
Due to a known issue virtual-server might stop responding to traffic when traffic-matching-criteria (TMC) is removed and ordinary address/port gets defined.

Conditions:
- Disabling traffic-matching-criteria on a virtual-server.

Impact:
Virtual-server stops responding to traffic.

Workaround:
TMM restart will fix this problem.

---

1323081 : Wrong Licensed Date is displayed after license activation

Links to More Info: BT1323081

Component: TMOS

Symptoms:
Sometimes License Date in configuration utility displays incorrect license activation date. The License Date has no significance in BIG-IP logic and creating confusion.

The service check date in license maintains the activation dates.

Conditions:
License activation.

Impact:
Incorrect license activation date displays in configuration utility.

Workaround:
None

---

1322937-2 : Tmm crash in Google Cloud during a live migration: Assertion `empty xfrag' failed.

Links to More Info: BT1322937

Component: Local Traffic Manager

Symptoms:
When the BIG-IP is involved in a live migration on Google Cloud, it may crash. There may be a log message in /var/log/tmm similar to the following

<13> Jul 19 05:45:53 bigip1 notice lib/c/xbuf.c:1431: xbuf_insert: Assertion `empty xfrag' failed.

Conditions:
Google Cloud VE
Live migration
The Virtio network driver

Impact:
Unexpected traffic disruption

Workaround:
Disable live migration

---

1322497-2 : GTM monitor recv string with special characters causes frequent iquery reconnects

Links to More Info: BT1322497

Component: Global Traffic Manager (DNS)

Symptoms:
Resources flap, frequent iquery reconnects occur.

Logs similar to this:

err gtmd[12952]: 011ae0fa:3: iqmgmt_receive: SSL error: SSL read (6)
err gtmd[12952]: 011ae0fa:3: During SSL shutdown: SSL error: SSL_ERROR_SYSCALL (5)
err gtmd[12952]: 011ae0fa:3: iqmgmt_receive: SSL error: SSL read (6)
err gtmd[12952]: 011ae0fa:3: During SSL shutdown: SSL error: SSL_ERROR_SYSCALL (5)

012b2004:4: XML parsing error not well-formed (invalid token) at line 3810
012b2004:4: XML parsing error not well-formed (invalid token) at line 7719
012b2004:4: XML parsing error not well-formed (invalid token) at line 16837
012b2004:4: XML parsing error not well-formed (invalid token) at line 298

Conditions:
GTM monitor recv string containing special characters like below:

recv "＼{＼x94status＼x94:＼x94UP＼x94"

Impact:
--Monitor flaps.
--Frequent iquery reconnects.

Workaround:
No special characters in GTM recv string.

---

1322413-2 : FQDN node status changes to Unknown/Unchecked on peer device after config sync

Links to More Info: BT1322413

Component: TMOS

Symptoms:
If changes are made to the configuration of an FQDN node which has a node monitor configured, and the configuration is synced to a device group, ephemeral nodes generated from the FQDN node may show an Availability of "unknown" and a Monitor Status of "unchecked".

Conditions:
This may occur on versions of BIG-IP with fixes for ID724824 and ID1006157, under the following conditions:
-- BIG-IP systems are configured in a device group
-- The device group is configured for Manual Sync (Full or Incremental)
-- One or more FQDN nodes are configured with a node monitor (which could be the Default Node Monitor)
-- A change is made to the configuration of the FQDN node
-- A Full configuration sync is performed (by a Manual sync with the device group configured for a Full sync, or using the "force-full-load-push" keyword:
   tmsh run cm config-sync to-group example-group force-full-load-push

Impact:
The affected nodes will be displayed with an Availability of "unknown" and a Monitor Status of "unchecked".

Workaround:
To recover from this condition, remove and re-add the node monitor:
-- Remove the node monitor from the FQDN node configuration (or from default-node-monitor):
   tmsh mod ltm node example monitor none
   (tmsh mod ltm default-node-monitor rule none)
-- Sync this change to the device group (Incremental sync)
-- Re-add the node monitor to the FQDN node configuration (or to default-node-monitor):
   tmsh mod ltm node example monitor my_node_monitor
   (tmsh mod ltm default-node-monitor rule my_node_monitor)
-- Sync this change to the device group (Incremental sync)

---

1322117-3 : FastL4 TCP PVA accelerated connection might not be cleared until idle timeout.

Links to More Info: BT1322117

Component: Local Traffic Manager

Symptoms:
Connection where client is re-using the source port connecting to a server in TIME_WAIT might not be cleared immediately from BIG-IP connection table after the closure.

Conditions:
-- FastL4 PVA acceleration at Embryonic.
-- Client re-using 4-tuple, hitting server in TIME_WAIT.

Impact:
Connection will remain in the BIG-IP connection table until idle-timeout is reached.

Workaround:
Set 'tcp-pva-whento-offload established' on a fastl4 profile.

---

1322009-2 : UCS restore fails with ifile not found error

Component: TMOS

Symptoms:
The loading configuration process failed.

Conditions:
This issue occurs when installing UCS without ifiles.

Impact:
The loading configuration process failed. UCS restore fails with ifile not found error.

Workaround:
Commenting the line `/bin/rm -rf /config/filestore/files_d/Common_d/ifile_d/*` in /usr/local/bin/install_ucs.pm resolves the issue.

---

1320889-3 : 1NIC AWS deployments might fail to forward some packets.

Links to More Info: BT1320889

Component: TMOS

Symptoms:
1NIC AWS might drop packets that require reassembly/re-segmentation on one side of the connection. For example, when client-side is configured with tcp-nagle and the server-side sends a stream of multiple small packets.

Drops can be monitored by running the following command:
'tmctl -d blade tmm/ndal_tx_stats -w 300' column 'drop_rej_dd'.

Conditions:
-- 1NIC AWS with sock driver. (See K10142141)
-- BIG-IP performing reassembly/re-segmentation on one side of the connection

Impact:
Some packets might never be forwarded by the BIG-IP system.

Workaround:
Disable Nagle Algorithm in TCP profile to avoid reassembly/re-segmentation.

---

1320389-1 : vCMP guest loses connectivity because of bad interface mapping

Component: TMOS

Symptoms:
A vCMP guest is no longer able to receive traffic when packets arrive on a trunk interface from other slots.

Conditions:
-- A vCMP guest has a trunk interface with one interface on the same slot as the guest and another interface on another slot.
-- Another Guest on the same slot is provisioned with more cores, triggering a reboot of that slot

Impact:
Traffic disrupted to the vCMP guest

Workaround:
A reboot will resolve the issue.

---

1319365-2 : Policy with external data group may crash TMM or return nothing with search contains

Links to More Info: BT1319365

Component: Local Traffic Manager

Symptoms:
TMM may crash or return no result found when there is one when using contains external data group.

Conditions:
External data group sets first to "starts-with" and then switch to "contains" may crash the TMM. If on the other hand, TMM is started with search "contains" from the start, no results may be found by policy even though there might be a result.
The is because, the external policy is not populated at all or entirely before the search happens. The starts-with works as it is populating on demand and is the reason and will partially populate it as needed, but when a switch to
 "contains" happens, it expects it to be entirely populated.

Impact:
TMM crashes or result not found when there should be a result.

Workaround:
A workaround is possible if starts-with could be used instead of "contains".

---

1319265-3 : Tmm crash observed in GCP after a migration

Links to More Info: BT1319265

Component: Local Traffic Manager

Symptoms:
Tmm may crash in Google Cloud Platform (GCP) after a migration.

The following logs were observed in kern.log

emerg kernel: NMI watchdog: BUG: soft lockup - CPU#3 stuck for 22s! [finish:5055]
warning kernel: [<ffffffffa01a21ff>] virtnet_send_command.constprop.34+0x10f/0x160 [virtio_net]
warning kernel: [<ffffffffa01a274f>] virtnet_set_queues+0x9f/0x100 [virtio_net]
warning kernel: [<ffffffffa01a38bd>] virtnet_probe+0x77d/0x858 [virtio_net]
warning kernel: [<ffffffffa002792f>] virtio_dev_probe+0x1cf/0x2d0 [virtio]
warning kernel: [<ffffffff81456165>] driver_probe_device+0xc5/0x460
warning kernel: [<ffffffff81456500>] ? driver_probe_device+0x460/0x460
warning kernel: [<ffffffff81456543>] __device_attach+0x43/0x50
warning kernel: [<ffffffff81453de5>] bus_for_each_drv+0x75/0xc0
warning kernel: [<ffffffff81455fa0>] device_attach+0x90/0xb0
warning kernel: [<ffffffff814551c8>] bus_probe_device+0x98/0xd0
warning kernel: [<ffffffff81452a6f>] device_add+0x4ff/0x7c0
warning kernel: [<ffffffffa0070370>] ? vp_finalize_features+0x40/0x40 [virtio_pci]
warning kernel: [<ffffffffa0070370>] ? vp_finalize_features+0x40/0x40 [virtio_pci]
warning kernel: [<ffffffff81452d4a>] device_register+0x1a/0x20
warning kernel: [<ffffffffa00273c9>] register_virtio_device+0xb9/0x100 [virtio]
warning kernel: [<ffffffffa006f8b7>] virtio_pci_probe+0xb7/0x140 [virtio_pci]
warning kernel: [<ffffffff8137856a>] local_pci_probe+0x4a/0xb0
warning kernel: [<ffffffff81379ca9>] pci_device_probe+0x109/0x160
warning kernel: [<ffffffff81456165>] driver_probe_device+0xc5/0x460
warning kernel: [<ffffffff81456500>] ? driver_probe_device+0x460/0x460
warning kernel: [<ffffffff81456543>] __device_attach+0x43/0x50
warning kernel: [<ffffffff81453de5>] bus_for_each_drv+0x75/0xc0
warning kernel: [<ffffffff81455fa0>] device_attach+0x90/0xb0
warning kernel: [<ffffffff81454139>] bus_rescan_devices_helper+0x39/0x60
warning kernel: [<ffffffff81454542>] store_drivers_probe+0x32/0x70
warning kernel: [<ffffffff81453a69>] bus_attr_store+0x29/0x30
warning kernel: [<ffffffff81290d22>] sysfs_kf_write+0x42/0x50
warning kernel: [<ffffffff812902f3>] kernfs_fop_write+0xe3/0x160
warning kernel: [<ffffffff81207bf0>] vfs_write+0xc0/0x1f0
warning kernel: [<ffffffff81208a1f>] SyS_write+0x7f/0xf0
warning kernel: [<ffffffff816cf741>] system_call_fastpath+0x48/0x4d

Conditions:
-- Google Cloud Platform
-- Virtio driver
-- A GCP migration is performed

Impact:
Traffic disrupted while tmm restarts.

Workaround:
-- Use the sock driver. For more information see K10142141: Configuring the BIG-IP VE system to use the SOCK network driver :: https://support.f5.com/csp/article/K10142141

---

1318653 : Upgrading or failover of APM with lot of access policies takes long time to become "really" active

Links to More Info: BT1318653

Component: Access Policy Manager

Symptoms:
When BIG-IP Administrator has lot of access policies, around 300 plus, after upgrade or failover a new unit becomes active. Users accessing one of the access policies experience error "(Your session could not be established. The session reference number: b0745df3. Access policy configuration has changed on gateway. Please login again to comply with new access policy configuration". Also, it takes lot of time, around 25 minutes for all the 347 access policies, to become really active.

Conditions:
After an upgrade or failover the snapshot creation process gets invoked. And while user accesses a virtual server with access policy whose snapshot is not yet created, errors occur mentioning failure in establishing the session.

Impact:
BIG-IP administrator having BIG-IP with a large number of access policies will have to wait for a long time, during and upgrade or failover, for the system to become really active.

Workaround:
-No-

---

1318625-2 : The gtm_add sync configuration is in the unintended direction with large GTM configuration

Links to More Info: BT1318625

Component: Global Traffic Manager (DNS)

Symptoms:
A wrong GTM configuration was pushed to the sync group members after using the script gtm_add.

Conditions:
-- Race condition to exhibit this behavior with large GTM configuration while performing gtm_add.
-- Following can be seen in GTM debug logs:

011a0200:7: MCP Message queued for resend. 1 backlogged messages.
.
.
.
011a0200:7:MCP Message queued for resend. 1125 backlogged messages.

Impact:
GTM devices loaded with the wrong or unintended configuration.

Workaround:
None

---

1318397-2 : Fails to sign Authentication Request in clientless-mode

Links to More Info: BT1318397

Component: Access Policy Manager

Symptoms:
The BIG-IP administrator fails to run a correctly configured SAML SP setup as TMM fails to sign the Authentication Request.

Conditions:
In clientless-mode, TMM fails to identify SAML Sign Authentication URI as it is sent in form of 'HTTP POST /'.

Impact:
The BIG-IP administrator will not be able to establish a successful SAML SP authentication setup and will experience a failure while signing Authentication Request.

Workaround:
None

---

1318377-3 : TMM memory leak when using http+fastl4 profile with 'rtt-from-client/rtt-from-server' enabled.

Links to More Info: BT1318377

Component: Local Traffic Manager

Symptoms:
TMM might experience a memory leak when using FastL4 'rtt-from-client/rtt-from-server' options in conjunction with HTTP profile.

Conditions:
A single virtual server configured with:
-- HTTP profile.
-- Fastl4 profile with 'rtt-from-client/rtt-from-server' enabled.

Impact:
Memory leak in TMM process.

Workaround:
Disable 'rtt-from-client/rtt-from-server' on Fastl4 profile.

---

1317773-3 : CGNAT / AFM NAT: "Clients Using Max Port Blocks" counter might be inaccurate

Links to More Info: BT1317773

Component: Carrier-Grade NAT

Symptoms:
When using CGNAT or AFM NAT in PBA mode (Port Block Allocation) the value of "Clients Using Max Port Blocks" might be wrong, not reflecting the actual number of total clients who have reached the max port blocks allocated to them.

The value of "Clients Using Max Port Blocks" can be seen in the output of the command "tmsh show ltm lsn" along with other statistics.

Conditions:
- BIG-IP running two or more TMM threads
- BIG-IP provisioned with CGNAT or AFM NAT
- LSN pool using PBA (Port Block Allocation) configured

Impact:
The value of "Clients Using Max Port Blocks" is increased when clients reach the max port blocks allocated to them but is not decreased when the clients don't have any more port blocks allocated.
As such, it keeps increasing over time.

Workaround:
None

---

1316529-3 : Upgrade from BIG-IP version 14.0.0 to 17.1.0 fails with hidden DOS

Component: Application Security Manager

Symptoms:
Upgrade from BIG-IP version 14.0.0 to 17.1.0 fails. The machine stays offline.

Conditions:
This issue occurs when the hidden DOS profile exists.

Impact:
The machine stays offline and the update fails.

Workaround:
Change the error response page body from default to custom.

---

1316481-2 : Large CRL file update fails with memory allocation failure

Links to More Info: BT1316481

Component: TMOS

Symptoms:
When updating a large CRL file in BIG-IP using tmsh, the file may be partially read due to internal memory allocation failure.

Please note that the size of the CRL file causing this issue varies across hardware types, network bandwidth and usage, and system resources.

Conditions:
1. Using tmsh, large CRL file is updated to an existing CRL.
2. This large CRL file is attached to multiple profiles.
3. The tmsh modify command is used multiple time in a short span of time that leads to the memory crunch.

Impact:
When large CRL file is attached to the profile which was partially read due to memory allocation failure, the profile gets successfully updated. Connections to VIP with this profile may have unexpected results. For e.g. client connecting to VIP with a revoked client certificate will succeed as the CRL was only partially read.

Workaround:
1. Dynamic CRL / CRLDP on client-ssl profile can be configured to dynamically verify SSL certificate revocation status.
2. OCSP can be enabled on client-ssl profile to validate SSL certificate revocation status.

---

1316113-2 : 1nic VE reloads on every reboot

Links to More Info: BT1316113

Component: TMOS

Symptoms:
When Virtual Edition (VE) is configured for 1NIC, you will see the following logs on reboot indicating that configuration has been loaded from file:

 notice tmsh[12232]: 01420002:5: AUDIT - pid=12232 user=root folder=/Common module=(tmos)# status=[Command OK] cmd_data=load sys config partitions all base
 notice tmsh[12392]: 01420002:5: AUDIT - pid=12392 user=root folder=/Common module=(tmos)# status=[Command OK] cmd_data=load sys config partitions all

Conditions:
- VE configured in 1NIC mode.
- Unit booted either through reboot or power on.

Impact:
This is unlikely to have any impact if the VE is in standalone mode but could result in an unexpected config if the configuration files differ.

If the VE is part of a device-group, then this will result in a commit id update and the units will show 'Changes pending'.

Workaround:
None.

---

1314769-2 : The error "No Access" is displayed when trying to remove Bundle Manager object from list

Links to More Info: BT1314769

Component: TMOS

Symptoms:
The error "No Access" is displayed when trying to remove a Bundle Manager object from the list using GUI.

Conditions:
When the checkbox next to the Bundle Manager is checked and clicks the Delete button at the bottom of the page, then "No Access" error appears.

Impact:
Unable to delete a Bundle Manager.

Workaround:
The issue has following two workarounds:
- Click on the Bundle Manager and click Delete at the bottom.
or
- Delete the Bundle Manager from TMSH CLI.

---

1314597-2 : Connection on standby may stay until idle timeout when receiving ICMP error

Links to More Info: BT1314597

Component: Local Traffic Manager

Symptoms:
When a pool member server returns an ICMP error, connections will persist on standby while they have been terminated on active.

Conditions:
When an ICMP error such as port unreachable is returned by a pool member, the packet will be dropped by the standby while the active will process it immediately and terminate the connection.

Impact:
The connection will stay on the standby until the idle timeout expires.

Workaround:
Lower idle timeout will reduce the time before it vanishes.

---

1313369-3 : Significant performance drop observed for DNS cache validating resolver for responses with indeterminate and insecure validation status

Component: Global Traffic Manager (DNS)

Symptoms:
Performance drop observed when changing DNS cache resolver to validating resolver for responses with indeterminate and insecure validation status.

To know more about the validation status, check RFC 4035 (section 4.3).

Conditions:
- Create a DNS cache validating resolver.
- Ensure the responses are with Indeterminate and Insecure validation status.
- Observe the performance as compared to responses with secured validation status.

Impact:
Performance of validating resolver will be less than expected.

Workaround:
None

---

1312225-2 : System Integrity Status: Invalid with some Engineering Hotfixes

Links to More Info: BT1312225

Component: TMOS

Symptoms:
After installing an Engineering Hotfix,
when to attempt to verify the TPM system integrity with either the "tpm-status" or "tmsh run sys integrity status-check" command, the following error massage may appear:
System Integrity Status: Invalid

Running the "tpm-status" command with a Verbosity of 1 (or greater) reveals the following detail:

Verifying system integrity...
...
The signature in 17 is valid
Output wrong commandline parameters
cmdline is *ro ima_hash=sha256 mce=ignore_ce *
The pcr value in 17 is invalid.
...
System Integrity Status: Invalid

Conditions:
This may occur if the Engineering Hotfix contains changes which cause the following packages to be included in the Engineering Hotfix ISO:
-- sirr-tmos
-- tboot
But the Engineering Hotfix ISO does not contain the following package:
-- nash-initrd

The contents of the Engineering Hotfix ISO can be checked using the 'isoinfo' utility:

isoinfo -Rf -i <path/to/Hotfix-*.iso> | grep -e sirr -e tboot -e nash

Impact:
The TPM System Integrity Status is shown as Invalid.
This may incorrectly suggest that system integrity has been compromised.

---

1312145-1 : Bcdatabase file gets truncated, deleted and re-downloaded in a loop

Links to More Info: BT1312145

Component: Policy Enforcement Manager

Symptoms:
Bcdatabase file gets truncated, deleted and re-downloaded in a loop due to BcMd5ChecksumFile function isn't calculating the expected checksum properly and causing the bcdatabase file to re-download in a continuous loop.

Conditions:
The expected checksum does not match the checksum calculated by BcMd5ChecksumFile function.

Impact:
The bcdatabase file downloading fails.

Workaround:
None

---

1312125 : MCPD crash on the changes of Device trust sync only group modification

Links to More Info: BT1312125

Component: Access Policy Manager

Symptoms:
MCPD crashes on policy sync when the APM module is enabled.

Conditions:
This issue occurs after upgrading to BIG-IP version 16.1.3.3 HF build 0.41.3.

Impact:
Unable to introduce a unit into the sync group, which jeopardizes production.

Workaround:
None

---

1312045 : The graph lines do not match the source translation request value

Links to More Info: BT1312045

Component: Application Visibility and Reporting

Symptoms:
There is a discrepancy between the source address translation request and the graph value.

Conditions:
Security->Reporting: Network Address Translation:Source: Translation
source address translation report details do not match the graph lines.

Impact:
The average source address translation requests value is not displaying properly on the page.

Workaround:
Removing the period value from the merge_formula shows correct results on both environments(Single and Multi slots) from testing results.

Workaround:
===========

In BIG-IP, open /etc/avr/monpd/monp_tmstat_fw_nat_measures.cfg#7 file.

merge_formula=round(sum(src_translation_requests)/period,2)

>>>>

merge_formula=round(sum(src_translation_requests),2)

restart the monpd.

---

1312041 : Connection RST with reason "STREAM max match size exceeded" after upgrading to v16.1.x★

Links to More Info: BT1312041

Component: Local Traffic Manager

Symptoms:
After upgrading from version 15.1.8.2 to version 16.1.3.4, connections reset with reason "STREAM max match size exceeded"

Conditions:
1. Configure a virtual server with rewrite profile.
2. Configure an iRule with the stream profile.

Impact:
Connection resets causes traffic disturbance.

Workaround:
None

---

1311997 : Disable the f5_cspm and f5_p words from the AVR cookie disclosure.

Links to More Info: BT1311997

Component: Application Visibility and Reporting

Symptoms:
AVR cookie disclosure shows f5_cspm and f5_p words after changing the avr.cspmcachecookiename cookie name.

Conditions:
While we curl the application used behind the F5 Big IP.

Impact:
Changing the avr.cspmcachecookiename won't disable the f5_cspm and f5_p words from the AVR cookie disclosure.

Workaround:
To selectively disable the AVR f5_cspm injection follow the below document.
https://clouddocs.f5.com/api/irules/AVR__disable_cspm_injection.html

---

1311977-4 : IPsec interface mode tunnel not sending icmp unreachable fragmentation needed

Links to More Info: BT1311977

Component: TMOS

Symptoms:
When the ESP packet is not fragmented.

Conditions:
- When the ESP packet is not fragmented.
- When the size of the packet is bigger than MTU.

Impact:
This issue causes data loss.

Workaround:
Configure a bigger value for MTU.

---

1311613-2 : UCS obtained from F5OS tenant with FPGA causes continuous TMM restarts when loaded to BIG-IP

Links to More Info: BT1311613

Component: TMOS

Symptoms:
--TMM restarts continuously after loading UCS taken from the F5OS tenant with FPGA hardware.

Conditions:
The UCS is taken from F5OS tenant with FPGA hardware (VELOS, r5k, r10k), and loaded to a non-F5OS tenant BIG-IP system (VE, vCMP guest, Hardware)

Impact:
Migrations or moving configurations across dissimilar platforms will not be successful.

Workaround:
Delete this file: /config/tmm_velocity_init.tcl

Use the following example command:
rm -fv /config/tmm_velocity_init.tcl

---

1311561-1 : Unable to add Geo regions with spaces into blacklist, Error: invalid on shun entry adding

Component: Advanced Firewall Manager

Symptoms:
Unable to add Geo regions with spaces into blacklist categories.
Ex: New South Wales, West Bengal.
However, we are able to add regions without spaces
Ex:Delhi.

Conditions:
Provision AFM license and try to add any geo regions having spaces into blacklist category.

Impact:
Cannot mitigate traffic from the above particular Geo regions.

Workaround:
No Workaround

---

1311253-3 : Set-Cookie header has no value (cookie-string) in server-side, due to asm.strip_asm_cookies

Component: Application Security Manager

Symptoms:
Set-Cookie header has no value (cookie-string) in server-side.

Conditions:
- asm.strip_asm_cookies is enabled.
- Cookie header from client has TS cookie(s) that are the only cookie.

Impact:
Cookie header without value (cookie-string) is sent to server-side

Workaround:
Use an iRule to delete Cookie header in the server-side.

---

1311169-3 : DNSSEC response is not signed when failure-rcode-response is enabled and no record is returned

Component: Global Traffic Manager (DNS)

Symptoms:
DNS response is not signed for DNSSEC zone for DNSSEC request.

Conditions:
1. A DNSSEC zone exists.
2. Return Code on Failure is enabled and SOA Negative Caching TTL is set to 0.
3. A query hits that wideIP and does not get a pool member selected.

Impact:
DNS response is not signed.

Workaround:
SOA Negative Caching TTL set to a number larger than 0.

---

1311125-3 : DDM Receive Power value reported by BCM56xxd is off by a factor of 10

Links to More Info: BT1311125

Component: TMOS

Symptoms:
The BCM56xxd process reports erroneous Receive Power value for an interface when Digital Diagnostics Monitoring (DDM) is enabled. The reporting within /var/log/ltm is erroneous by shifting a decimal point and is off by a factor of 10:

2023-06-14T17:10:35.282+00:00 bigip1 err bcm56xxd[11534]: 012c0017:3: DDM interface:2.2 receive power too high warning. Receive power:7.7933 mWatts


The "show /net interface-ddm" output for this interface displays a different value:

Digital Diagnostic Monitoring Interface:2.2
Laser Transmit and Receive Power Value
Receive Power1 0.7904mW -1.02dBm

Conditions:
DDM is enabled with the "ddm.bcm56xxd.enable" db variable:

sys db ddm.bcm56xxd.enable {
    value "enable"
}

Impact:
Incorrect Receive Power value is recorded in warning logs.

Workaround:
None

---

1308393-2 : Export security policy XML format fail with "too large and cannot be exported" message

Links to More Info: BT1308393

Component: Application Security Manager

Symptoms:
Extremely large policies may fail to export in XML format.

Conditions:
This is caused when an extremely large security policy is exported in XML format.

Impact:
The policy cannot be exported in XML format.

Workaround:
The policy may be exported in Binary or JSON format.

---

1307697-1 : IPI not working on a new device - 401 invalid device error from BrightCloud

Links to More Info: BT1307697

Component: Advanced Firewall Manager

Symptoms:
IPI update is failing with below error:
 
iprepd|ERR|Jun 09 15:52:59.261|9847|getipfile failed with status code: 401: Unauthorized: Invalid or missing credentials OEM, Device, or UID
iprepd|ERR|Jun 09 15:52:59.261|9847|Error code 1029: InvalidUserCredentials
iprepd|ERR|Jun 09 15:52:59.261|9847|Server message: Invalid Device (f5#ipintelligence-c130 from 202.187.110.1)

Conditions:
Only IPI update will stop working.

Impact:
IPI stop working.

Workaround:
No workaround

---

1307517-2 : Allow SIP reply with missing FROM

Component: Service Provider

Symptoms:
SIP Reply with a missing FROM in the header is dropped.

Conditions:
- SIP header not compliant with RFC requirement that a FROM must be present.

Impact:
SIP reply drop impacts the client not getting a response.

Workaround:
None

---

1307441 : Case APM as SAML IDP does not include all certs from bundle when metadata file is exported

Links to More Info: BT1307441

Component: Access Policy Manager

Symptoms:
Exported IDP/SP metadata file does not include multiple certificates.

Conditions:
1. BIG-IP configured as IDP/SP.
2. Certificate files containing multiple certificates are attached to the "Local SP/IDP service" configuration.
3. Perform metadata export of the "Local SP/IDP service" object.

Impact:
This issue may cause SAML functionality outage as 'corrupted'/'not correct' metadata from apm as saml idp is going to be shared with saml SPs.

Workaround:
Edit the metadata file to include other certificates also by adding them under additional XML tags <ds:X509Certificate> /ds:X509Certificate>.

---

1307385-2 : When blade replacement happens, signature config is lost in bigip.conf when IM is loading on a new blade

Links to More Info: BT1307385

Component: Protocol Inspection

Symptoms:
The bigip.conf file differs before and after blade replacement

Conditions:
It happens when one of the blades is replaced

Impact:
The bigip.conf does not list all the signatures added in the IM which is active

Workaround:
1) Try the command "tmsh save sys config"
2) If step 1 does not resolve the issue then try reloading the IM (Move to Factory Defaults IM and load the IM again). Then the bigip.conf will be updated with all the signatures supported by that IM)

---

1306249-1 : Hourly spike in the CPU usage and lasts for fraction of second causing delay in TLS connections

Links to More Info: BT1306249

Component: Local Traffic Manager

Symptoms:
1. Hourly spike in CPU usage.
2. TMM Idle enforcer gets activated.

Conditions:
When DHE is enabled in the cipher suite for the SSL Profile.

Impact:
TMM Idle enforcer gets activated and causes a delay in TLS traffic and CPU Usage goes high.

Workaround:
None

---

1305865-1 : Drop in performance with high throughput on BIG-IP 15.1.9 Virtual Edition or tenants on r2000 or r4000 hosts.

Links to More Info: BT1305865

Component: Local Traffic Manager

Symptoms:
Up to 30% drop in performance due to non-optimal DAG algorithm.

Conditions:
BIG-IP version 15.1.9 or 15.1.9.1 BIG-IP Virtual Edition or tenants on r2x00 or r4x00 systems.

Impact:
There is up to a 30% drop in the performance of the traffic.

The impact will be higher on systems where packet throughput is very high and a substantial amount of the CPU use was already used for servicing packet throughput.

Workaround:
None

---

1305697-3 : TMM may crash after performing a full sync, when in-tmm monitors are configured and ssl-profile is changed

Links to More Info: BT1305697

Component: Local Traffic Manager

Symptoms:
TMM may crash after performing a full sync

Conditions:
- In-tmm monitors are configured (bigd.tmm = enable)
- Full sync is performed
- Monitors are using a custom ssl profile
- The ssl profile was changed as part of the full sync.

Impact:
Traffic disrupted on the BIG-IP that recieved the config sync while tmm restarts.

Workaround:
Disable in-tmm monitors, and avoid performing a full sync after modifying in-tmm ssl monitors.

---

1305609-3 : Missing cluster hearbeart packets in clusterd process and the blades temporarily leave the cluster

Links to More Info: BT1305609

Component: Local Traffic Manager

Symptoms:
If two or more clusterd processes experience a long HAL timeout communicating with chmand, then either of those clusterd process will report a lack of cluster heartbeart packets and one or more blades will leave the cluster.

Here are two example log messages that will occur when this issue is encountered.

   # slot 3 marking itself as failed because of a partition event where the heartbeat timeout only occurred on the mgmt_bp interface.
    err clusterd[21260]: 013a0004:3: Marking slot 3 SS_FAILED due to partition detected on mgmt_bp from peer 4 to local 3

    # slot 2 marking slot 1 as failed due to a lack of cluster packets from slot1 on both mgmt and tmm bp interfaces.
    err clusterd[29069]: 013a0004:3: Local slot 2: not getting clusterd pkts from slot 1; timed out on mgmt_bp and tmm_bp after 10 seconds. Marking peer slot 1 SS_FAILED

These messages are not unique to this bug. There are other bugs and conditions that can cause clusterd to stop sending/receiving heartbeat packets.

Conditions:
1) Multi-blade chassis with a minimum of 5 blades. More blades increases the chances of encountering this bug.

2) A condition that causes long HAL delays between clusterd and chmand. One condition of long HAL delays that is specific to 14.1.x and prior is a full config sync. However that condition was fixed in 15.1.0 and higher with the changes for ID 721020 and ID 746122.

Impact:
A blade will temporarily leave the cluster but then re-join unless ID 1273161 or something similar also occurs.

If the # of blades leaving the cluster causes the number of online blades to be less then the min-up-members, min-up-members-enabled is set to 'yes' and the chassis is Active a failover will occur.

Workaround:
N/A

---

1305361-2 : Flows that are terminated by an ILX streaming plugin may not expire immediately

Links to More Info: BT1305361

Component: Local Traffic Manager

Symptoms:
Flows that are terminated from a plugin may not shutdown/expire properly until expiry timeout which leads to bloating of the flow table

Conditions:
-- ILX streaming plugin configured
-- Connection close initiated from the plugin (flow.client.end)

Impact:
Flows will stay in the table till expiry and may bloat up the flow table

Workaround:
None

---

1305329 : HTTP iRule event HTTP_REQUEST_DATA is triggered even though there is no data collected via HTTP::collect command.

Links to More Info: BT1305329

Component: Local Traffic Manager

Symptoms:
When an HTTP request does not have any payload, and nothing is collected from HTTP::collect but HTTP_REQUEST_DATA event is triggered on v16.1.x onwards but in v15.1.x it's not triggered.

Conditions:
-- iRule configured with HTTP::collect in HTTP_REQUEST event.
-- HTTP request does not contain any payload.

Impact:
Change in behavior due to unintended event trigger.

Workaround:
None

---

1304849-1 : iSeries LCD displays "Host inaccessible or in diagnostic mode"

Links to More Info: BT1304849

Component: TMOS

Symptoms:
On rare occasions, while booting up an iSeries BIG-IP system, the LCD may continuously display "Host inaccessible or in diagnostic mode" message for an extended period of time.

Conditions:
This can occur when booting up an iSeries BIG-IP system.

Impact:
LCD is unusable until the system is rebooted.

Workaround:
Wait for 5 minutes. If the LCD is still displaying the "Host inaccessible or in diagnostic mode" message after the specified time period, reboot the BIG-IP system.

---

1304289-2 : Pool member monitored by both GTM and LTM monitors may be erroneously marked Down

Links to More Info: BT1304289

Component: Local Traffic Manager

Symptoms:
A GTM or LTM pool member may occasionally be marked Down in error if it is being monitored by the same type of monitor with the same name as another LTM or GTM pool member with the same address and port.

Conditions:
This may occur if all of the following conditions are true:
-- A pool member for one module (GTM or LTM) has the same address and port as a pool member for a different module (LTM or GTM).
-- Both pool members are monitored by a monitor of one of the following types:
   -- Microsoft SQL
   -- MySQL
   -- Oracle
   -- PostgreSQL
   -- lDAP
   -- Radius
   -- Radius-Accounting
   -- Scripted
   -- SIP
   -- WAP
-- Both pool members are monitored by monitors of the same type (from the list above).
-- Both monitors have the same name (exact match).

Impact:
A GTM or LTM pool member may occasionally be marked Down in error.

Workaround:
To work around this issue, assign different names to GTM versus LTM health monitors of the same time (from the list of types above) that are used to monitor pool members for different modules with the same address and port values.

---

1304189-3 : Duplicate SYNs to a mirrored FastL4 virtual may result in connection failures

Links to More Info: BT1304189

Component: Local Traffic Manager

Symptoms:
If a duplicate SYN arrives on a connection before the SYN/ACK is processed and the connection is pushed into PVA, when it is evicted from PVA it may stop passing traffic and be reset with the RST cause "Handshake Timeout".

Conditions:
- PVA enabled
- Mirroring enabled
- Duplicate SYNs on the network

Impact:
Connection will stop passing traffic and resets when they are evicted from PVA.

Workaround:
Perform one of the following as a workaround:

- Disable PVA
- Disable mirroring
- Modify sys db tm.fastl4_ack_mirror value to Disable
- Modify sys db tm.fastl4_mirroring_taciturn value to Enable.

---

1303185-4 : Large numbers of URLs in url-db can cause TMM to restart

Links to More Info: BT1303185

Component: SSL Orchestrator

Symptoms:
TMM continuously restarts during startup.

Conditions:
This was seen when the url-db had about 64K glob URLs. Most of the globs were of the form "*foo*".

Impact:
TMM is unusable.

Workaround:
Large numbers of globs that start with the below should be OK:
   ".*://"
   ".*://.*＼＼."
Note that there should be no other special glob characters, so ".*://www.evil.com" would be OK but ".*://www.evil.com*" might not be.

---

1302925-2 : Failed to load detected bots list , when you clicked on Bot Category

Links to More Info: BT1302925

Component: Application Security Manager

Symptoms:
An error occurs while trying to access the bot event logs.

Conditions:
The bot events logs has N/A bot categories, and you clicked on one of them to see details.

Impact:
After clicking on the N/A bot categories, you will get an error when you click on a specific category in the event logs (for example, if you click on “Search Engine Masquerading” in Bot Categories)

Workaround:
"bigstart restart asm" will allow to click again and see details for a specific category.
But if you click again on the 'N/A' bot category in the events log, it will reproduce again the issue.

---

1302869 : AFM is not accounting Nxdomain attack for TCP query

Links to More Info: BT1302869

Component: Advanced Firewall Manager

Symptoms:
AFM is not accounting NXDOMAIN query with tcp.
At the device level, NXDOMAIN stats are incorrect.

Conditions:
-- DNS cache is activated
-- An NXDOMAIN DoS vector occurs

Impact:
NXDOMAIN flood attack is not detected.

Workaround:
None

---

1302689-3 : ASM requests to rechunk payload

Links to More Info: BT1302689

Component: Application Security Manager

Symptoms:
ASM requests TMM to rechunk payload in following scenarios:
- Content-Length header was not found on response headers.
- Response with headers only.

Conditions:
Content-Length header is missing during response.

Impact:
Transfer-Encoding: chunked header is being added to response.

Workaround:
In case response connection: close header exists, user can configure internal parameter is_disable_rechunk, then ASM would not ask to rechunk response.

---

1302677-4 : Memory leak in PEM when Policy is queried via TCL

Links to More Info: BT1302677

Component: Policy Enforcement Manager

Symptoms:
Memory leak of struct size ummem_alloc_112.

Conditions:
[PEM::session config policy get [IP::client_addr]]

If above configuration is present in irule/format script
and subscriber has ipv6 address.

Impact:
Memory leak of struct size ummem_alloc_112.
TMM may go out of memory, may restart and cause service disruption.

Workaround:
Avoid getting policy via tcl command for IPv6 subscriber.

Remove below configuration:
[PEM::session config policy get [IP::client_addr]]

---

1302353 : Duplicate OID index warnings observed in /var/log/ltm

Links to More Info: BT1302353

Component: TMOS

Symptoms:
Run snmpwalk receiving warning msg "Duplicate oid index found: bigip_l2_forward_stat.c:128" in ltm logs

Conditions:
Snmpwalk -v2c -Of -c public localhost .1.3.6.1.4.1.3375.2.1.2.5.1
or
snmpwalk -v2c -Of -c public localhost .1.3.6.1.4.1.3375.2.1.2.5.2

Impact:
Ltm logs with warning message "Duplicate oid index found:"

Workaround:
1.Log in to the Traffic Management Shell (tmsh) by typing the following command:

tmsh

 
2.Add the filter by typing the following command:

modify /sys syslog include "filter f_local0 { facility(local0) and not match(bigip_l2_forward_stat); };"

 
3.Save the changes by typing the following command:

save /sys config

---

1302077-4 : Virtual address statistics being counted for different virtual address after changing the destination address of a virtual server

Links to More Info: BT1302077

Component: Local Traffic Manager

Symptoms:
After modifying the destination address of a virtual server to a new address, the virtual address statistics for subsequent traffic are still being tracked in the original virtual address.

Conditions:
-- Create the virtual server with a destination address
-- Change the destination address of a virtual server to new address

Impact:
Incorrect statistics will fail to reflect actual virtual address load.

Workaround:
None

---

1301897-3 : DAG transition does not complete when TMM starts in FORCED_OFFLINE mode

Links to More Info: BT1301897

Component: TMOS

Symptoms:
When TMM restarts with force-offline enabled, it comes up waiting for a dag_transition. It never completes because CDP proxy never comes up due to no active traffic group in FORCE_OFFLINE mode.

Conditions:
Restarting TMM with force-offline enabled.

Impact:
Tenants show high CPU and idle enforcer constantly starting or exiting.

Workaround:
None

---

1301865-3 : OSPF summary might have incorrect cost when advertised by Standby unit.

Links to More Info: BT1301865

Component: TMOS

Symptoms:
OSPF summary might have incorrect cost when advertised by Standby unit.

Conditions:
- Other protocol redistribution into OSPF causing a summary route injection.

Impact:
Undesired traffic flow towards Standby unit.

Workaround:
Redistribute a summary route from static:

Use:
!
router ospf 1
 redistribute static metric-type 1
 network 10.10.10.0.32 0.0.0.255 area 0
!
ip route 192.168.0.0/16 Null


Instead of:
!
router ospf 1
 redistribute bgp metric-type 1
 network 10.10.10.0.32 0.0.0.255 area 0
 summary-address 192.168.0.0/16

---

1301317 : Update Check request using a proxy will fail if the proxy inserts a custom header

Links to More Info: BT1301317

Component: TMOS

Symptoms:
Update check fails.

Conditions:
-- Update check is checking for updates
-- A proxy is configured
-- The proxy inserts a header in its response

Impact:
Update check will fail.

Workaround:
Do not add any header in the proxy response.

---

1301197-3 : Bot Profile screen does not load and display large number of pools/members

Links to More Info: BT1301197

Component: Application Security Manager

Symptoms:
Bot Defense profile menu fails to display (it appears trying to load but it does not load).

Conditions:
Large number of pools, for example 2500 pools, and members configured on the box.

Impact:
Bot Profile screen cannot be loaded.

Workaround:
None

---

1300925-3 : Shared memory race may cause TMM to core

Links to More Info: BT1300925

Component: Local Traffic Manager

Symptoms:
TMM may core while managing shared memory segments.

Conditions:
Issue is observed during TMM startup.

Impact:
Rare shared memory related TMM cores.

Workaround:
None

---

1300665-3 : ASMCSD memory leak if tsconfd.loglevel is set for debug level

Links to More Info: BT1300665

Component: Application Security Manager

Symptoms:
ASMCSD memory size continue to grow and consumes all the available memory and triggers OOM-Killer.

Conditions:
- Debug level set with tsconfd.loglevel

- Changes on policies

Impact:
Memory leak that eventually triggers OOM-Killer.

Workaround:
- Do not set debug with tsconfd.loglevel to avoid the memory leak.

- Restart ASMCSD to clear the memory if the memory leak has been created and the system suffers from memory pressure.

---

1299085 : AVR shows Server Latency as 0 for http2 virtual with MRF enabled

Links to More Info: BT1299085

Component: Application Visibility and Reporting

Symptoms:
Statistics ›› Analytics : HTTP : Overview"

AVR shows Server Latency is 0.

Inaccurate reporting for some http2-enabled virtual servers.

Conditions:
Http2 virtual servers with MRF enabled shows server latency as 0

Impact:
Inaccurate reporting for some http2-enabled virtual servers.

Workaround:
No workaround.

---

1298161-2 : Ts_cookie_add_attrs is not effective with cookies that have non-root path or domain attribute

Component: Application Security Manager

Symptoms:
Add_cookie_attributes bd internal is not effective with TS cookie if the server cookie has non-root path attribute or domain attribute.

Conditions:
The server cookie has non-root path or domain attribute.

Impact:
An internal parameter configuration is not working in a specific condition which can create some issues.

Workaround:
Https://community.f5.com/t5/technical-articles/irule-to-set-samesite-for-compatible-clients-and-remove-it-for/ta-p/278650

---

1298133-3 : BFD sessions using floating self IP do not work well on multi-blade chassis

Links to More Info: BT1298133

Component: TMOS

Symptoms:
BFD sessions using floating self IP do not work well on multi-blade chassis. In an event of failure on a standby unit sessions might become unstable on an active unit.

Conditions:
- Multi-blade VIPRION chassis configured in high availability (HA) setup.
- BFD sessions configured from floating self IPs.
- Standby blade experiences any sort of failure. For example, tmm/tmrouted crash; cmp transistion.

Impact:
Standby blade might start sending BFD packets causing BFD session flaps on an active unit.

Workaround:
Restart tmrouted on a blade that is incorrectly sending BFD packets.

---

1298029-3 : DB_monitor may end the wrong processes

Links to More Info: BT1298029

Component: Local Traffic Manager

Symptoms:
If there are a lot of LTM or GTM database monitors in use, then the DB_monitor process may, in extremely rare circumstances, inadvertently end the processes that are not intended to be stopped.

Conditions:
Many database monitors, frequent PID reuse. This should be extremely rare.

Impact:
Some linux processes may unexpectedly end.

Workaround:
Preiodically clean up with PID files:

find /var/run/ -iname ＼*SQL__* -mtime +1 -exec rm -vf '{}' ';'

and/or increase the number of available Linux PIDs:

echo 4194304 > /proc/sys/kernel/pid_max

---

1297521-2 : Full sync failure for traffic-matching-criteria with port list update on existing object in certain conditions

Links to More Info: BT1297521

Component: Local Traffic Manager

Symptoms:
Performing a full configuration sync with traffic-matching-criteria (TMC) under specific conditions fails with errors similar to:

err mcpd[5781]: 01070710:3: Database error (13), Cannot update_indexes/checkpoint DB object, class:traffic_matching_criteria_port_update status:13 - EdbCfgObj.cpp, line 127.
err mcpd[5781]: 01071488:3: Remote transaction for device group /Common/HA to commit id 41 7225526260779940326 /Common/cugLB-B08-1.com 0 failed with error 01070710:3: Database error (13), Cannot update_indexes/checkpoint DB object, class:traffic_matching_criteria_port_update status:13 - EdbCfgObj.cpp, line 127..

Conditions:
This may occur on a full-load config sync (not an incremental sync)
Both Active and Standby on sync already
- a traffic-matching-criteria is attached to a virtual server
- the traffic-matching-criteria is using a port-list
- Update the port list (Add new port in the existing list)
Ex:
tmsh modify net port-list /Common/<> { ports replace-all-with { 80 { } 83 { } 84 { } } port-lists none }

Assume port list already with 80,83 and adding new port 84 in the list.

NOTE: No issue observed when we try to update the list with removing the port from the list.

Impact:
Unable to sync configurations.

---

1297257-2 : Pool member Forced Offline then Enabled is marked down on peer after Incremental sync

Links to More Info: BT1297257

Component: TMOS

Symptoms:
When a Pool Member in an high availability (HA) pair (Sync-Failover Device Group) has been marked Forced Offline, then later is marked Enabled on one member of the Device Groups, the Pool Member may be marked down on Device Group members other than the member where the Pool Member was marked Enabled.

On the BIG-IP system (Device Group member) where the Pool Member was marked Enabled, the Pool Member's status will be marked correctly according to its actual state, as determined by the Health Monitor configured for the affected Pool or Pool Member.

Conditions:
This issue occurs on BIG-IP versions with ID 1095217 is fixed, under the following conditions:

-- Multiple BIG-IP systems configured in a Sync-Failover Device Group
-- The Device Group is configured for Incremental sync
-- A Pool Member has been marked Forced Offline
-- A Health Monitor is configured for the Pool or Pool Member
-- The Pool Member is later marked Enabled on one member of the Device Group
-- This change is synced to the Device Group (either manually or automatically, via Incremental sync, not Full sync)

Impact:
The affected Pool Member will not receive traffic as expected on the other Device Group members.
-- If the Pool Member was re-enabled on the Standby member, traffic on the Active member will not be sent to the Pool Member.
-- If the Pool Member was re-Enabled on the Active member, traffic on the Standby member will not be sent to the Pool Member if the Active member fails over to the Standby member.

Workaround:
Perform one of the following actions as a workaround:

Option 1:
-- Perform a Full sync to the Device Group from the DG member with the correct pool member status

Option 2:
-- Mark the pool member Disabled
-- Sync this change to the Device Group
-- Mark the pool member Enabled
-- Sync this change to the Device Group

Option 3:
-- Remove the configured Health Monitor from the affected Pool or Pool Member
(Note: If removing the Health Monitor from the Pool, all members of the Pool may become unavailable, halting new connections to the pool members.)
-- Sync this change to the Device Group
-- Add the previously-configured Health Monitor back to the Pool or Pool Member
-- Sync this change to the Device Group

---

1295565-3 : BIG-IP DNS not identified in show gtm iquery for local IP

Links to More Info: BT1295565

Component: Global Traffic Manager (DNS)

Symptoms:
BIG-IP DNS is not identified in show gtm iquery for local IP.

Conditions:
The connection between local big3d and gtmd gets backlogged;
or
The connection between local big3d and gtmd gets reset.

Impact:
TMSH show gtm iquery does not show correct server type.

Workaround:
Restart big3d.

---

1295481-2 : FIPS keys are not restored when BIG-IP license is renewed after it expires

Links to More Info: BT1295481

Component: TMOS

Symptoms:
FIPS key are deleted

Conditions:
An expired license is renewed on the BIG-IP system.

Impact:
FIPS keys are deleted and cannot be used

Workaround:
None

---

1295353-2 : The vCMP guest is not sending HTTP flow samples to sFlow receiver

Links to More Info: BT1295353

Component: TMOS

Symptoms:
The vCMP clusters without configured slot-specific management-IP addresses will report 0.0.0.0 for: sFlow (Agent Address) resulted in missing HTTP flow samples to sFlow receiver.

Conditions:
- vCMP guest deployed on a chassis with only Cluster IP set, and no individual blade IP addresses configured.
- Configured with an available sFlow receiver.

Impact:
No monitoring information as there were no HTTP flow samples.

Workaround:
- Configure cluster blade IP addresses. For example, to set the slot-specific management IP address on a vCMP guest which runs on a single slot, use a command similar to the following:

tmsh modify sys cluster default members { 1 { address 198.51.100.2 } }

- The HTTP flow samples will be available on a vCMP guest.

---

1295057-3 : Installation of Attack Signatures file reported as fail after 1 hour

Links to More Info: BT1295057

Component: Application Security Manager

Symptoms:
Installation of Attack Signatures file reported as fail after 1 hour. Installation process finished successfully including apply new signatures to all active policies after more than 1 hour, but reported as fail because of 1 hour of timeout.

Conditions:
Installing attack signatures with high number of active policies or high number of user defined signature sets.

Impact:
ASU file installation failed while installation successfully finished.

Workaround:
None

---

1295009-1 : "JSON data does not comply with JSON schema" violation is raised when concurrent requests occur with same JSON data

Links to More Info: BT1295009

Component: Application Security Manager

Symptoms:
JSON schema validation fails when concurrent requests occur with the same JSON data.

Conditions:
Concurrent HTTP requests contain the same JSON data.

Impact:
JSON schema validation fails.

Workaround:
None

---

1294993 : URL Database download logs are not visible after bigip16.0.1.1

Links to More Info: BT1294993

Component: Access Policy Manager

Symptoms:
DB download happens at regular intervals or if explicitly requested by the user. Download status should be visible as part of apm logs and those are missing.

Conditions:
Version 16.0.1 or newer

Impact:
Database download status information will be unknown.

---

1294709-1 : SSL Orchestrator ICAP service changes do not propagate to TMSH (GUI/CLI)

Links to More Info: BT1294709

Component: SSL Orchestrator

Symptoms:
After changing settings for an existing ICAP service and deploying through SSL Orchestrator, the new changes are not reflected in the ICAP profiles visible through either the GUI or tmsh.

Conditions:
Trying to change settings for an existing ICAP service using SSL Orchestrator

Impact:
You are unable to change ICAP service settings through SSL Orchestrator.

Workaround:
Before deploying the changes, first click "Preview Merge Config". Than after clicking "Deploy", tick the additional "Overwrite Changes" box, and click "Deploy".

---

1294529 : APM webtop hardening

Links to More Info: BT1294529

Component: Access Policy Manager

Symptoms:
When the user is using an Access profile of type Modern, the attacker can craft a malicious URL and send it to an authenticated user to launch an XSS attack.

Conditions:
- APM is provisioned with a Modern framework.
- Webtop enabled.

Impact:
APM is Vulnerable to XSS attack.

Workaround:
When CLIENT_ACCEPTED {
ACCESS::restrict_irule_events disable
}
when HTTP_REQUEST {
if {[HTTP::uri] starts_with "/vdesk/webtop.eui" && [HTTP::query] contains "%"} {
HTTP::uri [HTTP::path]
}
}

---

1294381 : Variable assign handles some error cases disgracefully

Links to More Info: BT1294381

Component: Access Policy Manager

Symptoms:
1. Unable to add a Variable assign entry after correction which was first tried to add with incorrect syntax.
2. Existing variable assign entries are getting affected by showing in base64 encoding format even after deletion of incorrect entry added in point 1.

Conditions:
1. There should be existing Variable assign entries.
2. Newly added entry should contain space at the beginning or end of the session variable name.

Impact:
Existing variable assign entries are affected by changing to base64 format and we need to again add all the entries from the beginning which is incorrect.

Workaround:
None

---

1294301 : Tmm core when freeing pool name

Links to More Info: BT1294301

Component: Service Provider

Symptoms:
Tmm crashes.

Conditions:
This can occur while tmm is freeing the pool name.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

---

1294289-2 : SSL Persist leaks memory on when client and server hello exceeds MSS

Component: Local Traffic Manager

Symptoms:
TMM memory leak growing linearly with Aggressive Reaper activated.

Conditions:
This issue occurs under the following conditions:
- SSL persistence should be configured in the virtual server.
- Small client-side MSS.

Impact:
TMM cores are observed during memory leaks.

Workaround:
None

---

1294141-3 : ASM Resources Reporting graph displays over 1000% CPU usage

Links to More Info: BT1294141

Component: Application Visibility and Reporting

Symptoms:
The ASM resources graph which is present under Security > Reporting > ASM Resources > CPU Utilization displays over 1000% CPU usage when ASM is under load. The unit is percentage so it should be below 100.

Conditions:
- ASM should be under load and utilizing most of CPU cycles.

Impact:
Reporting graph displays incorrect percent value.

Workaround:
None

---

1294113-2 : During the attack, attack_id=0 is indicated in the AVR attack summary log

Component: Application Visibility and Reporting

Symptoms:
Dos_attack_id="0" is displaying in the AVR attack summary log from the ltm file.

Conditions:
The messages sent from admd includes the correct attack_id while periodical messages are generated by AVR include dos_attack_id=0.

Impact:
Correlation of mitigation stats messages to attack start/end messages in splunk must be done based on time range instead of simple search for attack ID.

Workaround:
No Workaround

---

1294109-3 : MCP does not properly read certificates with empty subject name

Links to More Info: BT1294109

Component: TMOS

Symptoms:
A certificate that is not a CA certificate that does not have subject populated is valid if it contains subject alternative name, but missing subject is treated as invalid.

Conditions:
- Create a certificate with an empty subject by setting the
 subject alternative name.

Impact:
MCP does not show certificate details and GUI details suggest that the certificate is self-signed.

Workaround:
None

---

1293805 : Access policies not in Partition Common are not applied in auto discovery process

Links to More Info: BT1293805

Component: Access Policy Manager

Symptoms:
When access profiles are setup with discovery tasks in non Common partitions, the access policies are not applied.

Conditions:
1. Switch to a non Common partition
2. Create an Access profile
3. Configure a DNS server, OAuth scope, OAuth Client, OAuth Provider and OAuth server
4. Go back to Provider and start the discovery process.

Impact:
Access Policies are not applied in Auto discovery task if they are not in partition Common.

---

1293261-3 : Subviolations (e.g., IP in host header violation) are not reported to the policy builder

Links to More Info: BT1293261

Component: Application Security Manager

Symptoms:
Evasion Technique and HTTP Protocol Compliance subviolations (e.g., IP in host header violation) are not reported to the policy builder.

Conditions:
When the policy is set to only learn (alarm and block are turned off).

Impact:
Learning suggestions to permanently disable the subviolation is not received.

Workaround:
A user should also enable the alarm to receive learning and suggestions for this subviolation.

---

1293237 : Page customization of Front image for standard Access profile fails for image uploaded from local disk

Links to More Info: BT1293237

Component: Access Policy Manager

Symptoms:
You are unable to upload a custom image from your local disk to the Logon page agent customization in VPE for access profile if the Type is set to standard

A popup error window occurs:
01b70117:3: local_path (/tmp/php/emc.png) starts with invalid directory. Valid directories are /var/config/rest/, /var/tmp/, /shared/tmp/, /var/system/tmp/.

Conditions:
-- Access profile of type "standard"
-- upload new image from your local disk to Front image in Logon page agent customization from VPE

Impact:
You are unable to use a custom image from the local disk as the front image for the Logon page agent

Workaround:
None

---

1293193-2 : Missing MAC filters for IPv6 multicast

Links to More Info: BT1293193

Component: TMOS

Symptoms:
Certain drivers are missing MAC filters for multicast preventing TMM from receiving messages sent to All Nodes and All Routers addresses.

Conditions:
- BIG-IP VE
- Using TMM's IAVF or IXLV driver

Impact:
TMM does not receive multicast messages and traffic sent to All Nodes and All Routers, dropping potentially vital packets.

Workaround:
None

---

1292685-2 : The date-time RegExp pattern through swagger would not cover all valid options

Links to More Info: BT1292685

Component: Application Security Manager

Symptoms:
Some valid hours option would not match the Regular Expression (RegExp).

Conditions:
Creating a policy using swagger file and uploading a swagger file which contains parameter in date time format.

Impact:
Valid hours options 10 and 19 would not match the RegExp.

Workaround:
Manually fix the regular expression in the parameter
from:
'^([12]＼d{3}-(0[1-9]|1[0-2])-(0[1-9]|[12]＼d|3[01]))T(0＼d|2[0-3]):([0-5]＼d):([0-5]＼d)(＼.＼d+)?(Z|((＼+|-)(0＼d|2[0-3]):([0-5]＼d)))$'
to:
'^([12]＼d{3}-(0[1-9]|1[0-2])-(0[1-9]|[12]＼d|3[01]))T(0＼d|1＼d|2[0-3]):([0-5]＼d):([0-5]＼d)(＼.＼d+)?(Z|((＼+|-)(0＼d|1＼d|2[0-3]):([0-5]＼d)))$'

---

1292141-1 : TMM crash while processing myvpn request

Links to More Info: BT1292141

Component: Access Policy Manager

Symptoms:
TMM crashes while processing traffic on the virtual server.

Conditions:
Network Access resource is configured.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

---

1290937 : 'contentWindow' of a dynamically genereated iframe becomes null

Links to More Info: BT1290937

Component: Access Policy Manager

Symptoms:
A web application using iframes may not work/render as expected using Portal Access.

Conditions:
A web application attempts to configure 'contentWindow' for an iframe while the Portal Access feature is in use.

Impact:
Web Application through Portal Access may fails to work/render as expected

Workaround:
Workaround: Using a customized irule/ifile to return un-patched 'contentWindow' from cache-fm*.js file. ifile has modern cache-fm file.

when CLIENT_ACCEPTED {
  ACCESS::restrict_irule_events disable
}

when HTTP_REQUEST {
 if {
   [HTTP::path] ends_with "/cache-fm-Modern.js"
 } {
   HTTP::respond 200 content [ifile get cachefmUploadIssueWorkaround]
 }
}

---

1289417 : SSL Orchestrator SEGV TMM core

Links to More Info: BT1289417

Component: SSL Orchestrator

Symptoms:
TMM crashes while passing SSL Orchestrator traffic.

Conditions:
This can occur when a service is added or when an existing connector node configuration is freed.

Impact:
TMM crash occurs. Traffic disrupted while TMM restarts. This issue occurs intermittently.

Workaround:
None

---

1289313-3 : Creation of wideip with alias would cause inconsistent zone data across GTM sync group

Links to More Info: BT1289313

Component: Global Traffic Manager (DNS)

Symptoms:
Loss of resource record.

Conditions:
-- Creation of a wideip with alias
and
-- synchronize-zone-files is set to yes

Impact:
Loss of resource record.

Workaround:
Set synchronize-zone-files to no.

---

1289009-2 : PA based Hosted content does not add implicit allowed ACL

Links to More Info: BT1289009

Component: Access Policy Manager

Symptoms:
Unable to download the hosted content from Portal Access.

Conditions:
ACLs with a default deny or reject rule

Impact:
Hosted content files are denied by ACL

Workaround:
Add 2 L4 ACLs similar to the rules below:
apm acl /Common/allow-hostedcontent {
   acl-order 20
   entries {
       {
           action allow
           dst-end-port 8080
           dst-start-port 8080
           dst-subnet ::1/128
           log packet
           protocol 6
           src-subnet 0.0.0.0/0
       }

       {
           action allow
           dst-end-port 8080
           dst-start-port 8080
           dst-subnet 127.1.1.0/24
           log packet
           protocol 6
           src-subnet 0.0.0.0/0
       }
   }

---

1288517-2 : Item filter does not work on /mgmt/tm/asm/tasks/export-suggestions/

Links to More Info: BT1288517

Component: Application Security Manager

Symptoms:
Filter is not applied for export suggestions task.

Conditions:
Having a policy with suggestions. try to export in declarative format:

restcurl -u admin:admin /mgmt/tm/asm/tasks/export-suggestions/ -d '{"policyReference":{"link":"https://localhost/mgmt/tm/asm/policies/uaDQEF3ndTdKkawROqwQow"},"filter":"status eq 'accept'","inline":true}'

Impact:
You are unable to get filtered suggestions in a declarative format.

Workaround:
None

---

1288009-3 : Vxlan tunnel end point routed through the tunnel will cause a tmm crash

Links to More Info: BT1288009

Component: TMOS

Symptoms:
Tmm generates a core file and restarts

Conditions:
A vxlan tunnel is configured and there is a route for the remote end point via the tunnel itself

Impact:
Traffic disrupted while tmm restarts.

Workaround:
Do not route the tunnel endpoint through the tunnel.

---

1287045-3 : In-TMM monitor may mark pool member offline despite its response matches Receive Disable String

Links to More Info: BT1287045

Component: In-tmm monitors

Symptoms:
Despite response matching monitor's Receive Disable String, pool member may by marked offline by the in-TMM monitor while the BIGD monitor would mark it as available/disabled. It is particularly likely if the matched pattern is located in the front of the pool member's response data.

Conditions:
-- HTTP, HTTP2, or TCP monitor is used.
-- In-TMM monitor is enabled.
-- Both Receive String and Receive Disable String are provided.

Impact:
Pool member is marked offline while it should be marked available/disabled by the in-TMM monitor.

Workaround:
Use BIGD instead of in-TMM monitor.

---

1284413 : After upgrade to 16.1.3.2 from 16.0.1.1, BIG-IP can send CONNECT requests when no proxy select agent is used★

Links to More Info: BT1284413

Component: Local Traffic Manager

Symptoms:
BIG-IP uses a CONNECT to forward requests regardless of the PRP branch in use.

Conditions:
-- Configure BIG-IP as Explicit Forward proxy with SSL Orchestrator or SWG.
-- Configure an access policy and a prp and apply to the forwarding Virtual Server.
-- In the PRP, use multiple branches where one branch contains a proxy select agent, and another branch does not.

Impact:
Requests fail intermittently

Workaround:
None

---

1284261-3 : Constant traffic on DHCPv6 virtual servers may cause a TMM crash.

Links to More Info: BT1284261

Component: Local Traffic Manager

Symptoms:
TMM may crash/core if there is a constant stream of DHCP traffic from the server towards the clients, not allowing a connection timeout.

Conditions:
Constant stream of traffic coming from DHCP server not allowing a connection timeout.

Very aggressive lease settings causing constant lease refresh may be a configuration example leading to the problem.

Impact:
Failover/crash.

---

1284073-3 : Cookies are truncated when number of cookies exceed "max_enforced_cookies"

Component: Application Security Manager

Symptoms:
When request contains more cookies than configured in "max_enforced_cookies", and if parameter "strip_asm_cookies" is enabled, then cookie header is truncated and not all cookies reach the server.

Conditions:
- ASM is provisioned.
- Request contains more cookies than configured in "max_enforced_cookies".
- Parameter "strip_asm_cookies" is enabled.

Impact:
Not all cookies reach server.

Workaround:
Disable internal parameter "strip_asm_cookies".

Disabling the database key makes the behavior similar to the behavior in BIG-IP version 14, for more information see article K30023210.

If the old behavior prior to BIG-IP version 14 is not desired, on top of disabling the sys db key, use the solution that is used to apply with versions prior to BIG-IP version 14 that is an iRule to remove TS cookie from server-side. For more information, see article K66438993.

---

1283749-2 : Systemctl start and restart fail to start the vmtoolsd service

Links to More Info: BT1283749

Component: TMOS

Symptoms:
Because of a non-existent dependency, systemctl start and restart failed to start the vmtoolsd service.

Following is the reported error:

# systemctl restart vmtoolsd.service
Failed to restart vmtoolsd.service: Unit not found.

systetmctl stop is not affected.

Conditions:
BIG-IP VE on VMware.

Impact:
Unable to start/restart the vmtoolsd service.

Workaround:
Systemctl restart --ignore-dependencies vmtoolsd.service

or

systemctl start --ignore-dependencies vmtoolsd.service

---

1283721-2 : Vmtoolsd memory leak

Links to More Info: BT1283721

Component: TMOS

Symptoms:
The Vmtoolsd service leaks memory on VMware BIG-IP VE guests when the Disk Type is IDE or any disk type other than SCSI.

Conditions:
VMware BIG-IP VE guest
Disk type of IDE or another type that is not SCSI.

Impact:
The VE will eventually run out of memory.

Workaround:
1. Create the file /etc/vmware-tools/tools.conf and add the following to the file:

[guestinfo]

# disable scan for disk device info
diskinfo-report-device=false


2. Restart the vmtoolsd service:

systemctl restart --ignore-dependencies vmtoolsd.service

NB "guestinfo" must be in lower case. The workaround will not work if any letter is not lower case including the following "guestInfo" which was the reported workaround in https://github.com/vmware/open-vm-tools/issues/452

---

1282769-2 : Localdb user can change the password of other user

Component: Access Policy Manager

Symptoms:
The user was able to change the password for another user in the logon page, when local DB authentication was used.

Conditions:
-- At least one user in the local DB instance is forced to change the password
-- the virtual server is tied in with the trusted CA certificates (that is, it would not happen if the virtual server for the SSL-VPN is associated with self-signed certificates).

Impact:
User authentication based on local DB will be impacted.

Workaround:
None

---

1282281-3 : Roll forward upgrade fails with policy that has unapplied changes and Threat Campaigns

Links to More Info: BT1282281

Component: Application Security Manager

Symptoms:
Roll forward upgrade fails.

The following error message in /ts/log/ts_debug.log and WAF enforcement is not complete:

----------------------------------------------------------------------
Can't locate object method "id_field" via package "F5::ASMConfig::Entity::ThreatCampaign" (perhaps you forgot to load "F5::ASMConfig::Entity::ThreatCampaign"?) at /usr/local/share/perl5/F5/ImportExportPolicy/Binary.pm line 2171.
----------------------------------------------------------------------

Conditions:
- Roll forward upgrade when there is a policy that has unapplied changes and Threat Campaigns.

Impact:
Incorrect enforcement until workaround is applied.

Workaround:
Perform an apply policy operation on all policies.

---

1281693 : Icons displayed on webtop are different from Storefront server when modified

Links to More Info: BT1281693

Component: Access Policy Manager

Symptoms:
When custom higher resolution images for Citrix resources are edited/modified to 32x32 pixels, they appear blurred on the APM webtop.

Conditions:
When higher resolution images are modified to 32x32 pixels

Impact:
Icons appear blurred on the APM webtop.

Workaround:
Default icon images provided by the Storefront can be used as they are displayed correctly on the APM webtop.

---

1281433-2 : Missing GTM probes on GTM server when an external monitor is attached to an additional pool

Links to More Info: BT1281433

Component: Global Traffic Manager (DNS)

Symptoms:
Incorrect probe behavior when an external monitor is attached to an additional pool.

Conditions:
On a GTM sync group, try to attach an external monitor to an additional pool.

Impact:
Incorrect GTM server monitoring.

Workaround:
None

---

1281405 : "fipsutil fwcheck -f" command may not correct result

Links to More Info: BT1281405

Component: Local Traffic Manager

Symptoms:
The "fipsutil fwcheck -f" command output shows as "Firmware upgrade available." even though now Firmware upgrade is not needed.

Conditions:
All FIPS platforms.

Impact:
Only a display issue with no functional impact. If we try to make a firmware upgrade, it may not work.

Workaround:
Use the command without the "-f" option like "fipsutil fwcheck".

---

1281397-1 : SMTP requests are dropped by ASM under certain conditions

Component: Application Security Manager

Symptoms:
When virus check is enabled on SMTP security profile, sometimes ASM drops the request even though no violation is reported.

Conditions:
- SMTP security profile is configured and applied with virus check on.
- ICAP server is configured

Impact:
ASM sometimes drops valid SMTP requests even when no violation is reported.

Workaround:
None

---

1281389-1 : Bot Defense can crash when using SMTP security profile

Links to More Info: BT1281389

Component: Application Security Manager

Symptoms:
Under certain conditions, Bot Defense can crash when SMTP security profile is being used.

Conditions:
- SMTP security profile is configured and applied with DNS check on.
- SPF record cannot be resolved by DNS servers.

Impact:
BD crashes leading to disruption of traffic.

Workaround:
None

---

1280813-1 : Illegal URL violation triggered for after upgrade due to due to missing content-profiles in DB

Component: Application Security Manager

Symptoms:
Illegal URL violation is triggered for valid/Allowed URLs.

Conditions:
NA

Impact:
Illegal violation for allowed URL, content profile for that URL is not seen in PLC.PL_OBJECT_CONTENT_PROFILES DB.

Workaround:
- Delete the problematic URL from Security ›› Application Security : URLs : Allowed URLs : Allowed HTTP URLs.
- Recreate the URL again.
- Apply the policy.

---

1280281-1 : SCP allow list may have issues with file paths that have spaces in them

Links to More Info: BT1280281

Component: TMOS

Symptoms:
SCP may error out.

Conditions:
A file path with a space that is allowlisted in /config/ssh/scp.whitelist.

This affects BIG-IP 14.x.x and BIG-IP 15.x.x only if running an EHF with BugID 819429 is included.

Impact:
May not copy files to a path present under allow list.

Workaround:
Remove spaces from any allowlisted file paths.

---

1277641-1 : DoS | i-series | After mitigation of bad destination at profile level, bd_hit is not incrementing for host unreachable vector.

Links to More Info: BT1277641

Component: Advanced Firewall Manager

Symptoms:
This is specific to iseries platform.
bd related DoS stats are incrementing but SPVA stat of bd_hit is not incremented.

Conditions:
Sending an ipv6 host unreachable traffic to iseries.

Impact:
You can see the dos stats but not in spva stats.

Workaround:
You can see the stats in dos table.

---

1274385-3 : BIGIP-DNS GUI delivery summary stats shows incorrect count for "Disabled" GTM listeners

Links to More Info: BT1274385

Component: Global Traffic Manager (DNS)

Symptoms:
Statistics >> Module Stats >> DNS >> Delivery >> Summary - shows the incorrect count for "Disabled" GTM listeners.

Conditions:
One or more virtual servers (which may or may not be GTM (DNS) listeners) exist on the BIG-IP device which are in a disabled state.

These virtual servers incorrectly count towards the count of "Disabled" virtual servers in the GTM Listeners statistics.

Impact:
Unexpected "Disabled" count in the GTM Listeners line in the DNS stats table (in any of the columns)

---

1273881-4 : TMM crashes while processing traffic on the virtual server

Links to More Info: BT1273881

Component: Access Policy Manager

Symptoms:
TMM crashes while processing traffic on the virtual server.

Conditions:
Network Access resource is configured.

Impact:
TMM crashes leading to disruption in traffic flow.

Workaround:
None

---

1273225 : Remove DNS Malformed vector at virtual server Level

Links to More Info: BT1273225

Component: Advanced Firewall Manager

Symptoms:
We are able to configure the DNS malformed at the virtual server level.

Conditions:
Configure the AFM license. See the DNS malformed at the profile level.

Impact:
We should not get option DNS malformed at the virtual server level.

Workaround:
None

---

1273161-3 : Secondary blades are unavailable, clusterd is reporting shutdown, and waiting for other blades

Links to More Info: BT1273161

Component: Local Traffic Manager

Symptoms:
On a multi-slot chassis, VCMP guest, or F5OS tenant, clusterd can enter a shutdown state causing some slots to become unavailable.

The event that can cause this is called a partition and occurs when clusterd stops receiving heartbeat packets from a slot over the mgmt_bp interface but is still receiving them over the tmm_bp interface.

Here is the error that is logged when this occurs:

Mar 17 10:38:28 localhost err clusterd[4732]: 013a0004:3: Marking slot 1 SS_FAILED due to partition detected on mgmt_bp from peer 2 to local 1

When this occurs, clusterd enters a shutdown state and at times will never recover.

Here is an example, tmsh show sys cluster command where clusterd is in the shutdown yet waiting state:

-----------------------------------------
Sys::Cluster: default
-----------------------------------------
Address 172.0.0.160/23
Alt-Address ::
Availability available
State enabled
Reason Cluster Enabled
Primary Slot ID 2
Primary Selection Time 03/17/23 10:38:30

  ----------------------------------------------------------------------------------
  | Sys::Cluster Members
  | ID Address Alt-Address Availability State Licensed HA Clusterd Reason
  ----------------------------------------------------------------------------------
  | 1 :: :: unknown enabled false unknown shutdown ShutDown: default/1 waiting for blade 2
  | 2 :: :: available enabled true standby running Run

Conditions:
Multi-slot chassis, VCMP guest, or F5OS tenant.
A blade determines there is a partition where it's receiving cluster packets over the tmm+bp interface but not the mgmt_bp interface.

Impact:
The unavailable slots/blades will not accept traffic.

Workaround:
Running tmsh show sys cluster will report the primary slot and all slot statuses.

For all blades reporting shutdown or less likely initializing and "waiting for blade(s)" restart clusterd on that slot with bigstart restart clusterd. Ensure you do not restart clusterd on the primary slot.

---

1272501 : Connections are being reset with the cause "F5RST:HTTP redirect rewrite failure"

Links to More Info: BT1272501

Component: Local Traffic Manager

Symptoms:
Application failures with reset-cause: "F5RST: HTTP redirect rewrite failure".

Conditions:
-- BIG-IP versions 16.0 and above.
-- HTTPS virtual server with redirect-rewrite of HTTP profile set to 'matching'.

Impact:
Connections are being reset with the cause "F5RST:HTTP redirect rewrite failure".

Workaround:
None

---

1271469-3 : Failed to install ASU file scheduled for install

Links to More Info: BT1271469

Component: Application Security Manager

Symptoms:
Live Update installation scheduled for installation for any specific day at time 12:01 AM to 12:14 AM will fail.

Conditions:
- ASU file installation scheduled at 12:01 AM to 12:14 AM (not automatic or manual installation).

Impact:
BIG-IP will not get latest ASU file updates.

Workaround:
Set the installation time after 12:15 AM.

---

1271341 : Unable to use DTLS without TMM crashing

Links to More Info: BT1271341

Component: Local Traffic Manager

Symptoms:
When DTLS is used, TMM gets crashed.

tm virtual /Common/VS_access.unisa.edu.au-4433 {
creation-time 2023-02-10:17:43:01
destination /Common/130.220.255.195:4433
ip-protocol udp
last-modified-time 2023-03-08:15:43:30
mask 255.255.255.255
profiles {
/Common/SSL_access.unisa.edu.au-20230208 <----clientssl
context clientside
}
/Common/UniSA_Oauth_Lab {
context clientside
}
/Common/ppp { }
/Common/udp { }
}
serverssl-use-sni disabled
source 0.0.0.0/0
translate-address enabled
translate-port enabled
}

Conditions:
NA

Impact:
TMM core has been seen.

Workaround:
Due to dynamic record sizing being enabled. So tx_min gets set to 0. This eventually results in tx_len being 0 as well and leads to the loop.

allow-dynamic-record-sizing should be disabled in the client-ssl.


For instance

ltm profile client-ssl /Common/SSL_access.unisa.edu.au-20230208 {
    allow-dynamic-record-sizing disabled

---

1270989-3 : REST MemcachedClient uses fixed TMM address 127.1.1.2 to connect to memcached

Links to More Info: BT1270989

Component: TMOS

Symptoms:
The RESTcurl command "restcurl -u admin:admin /mgmt/tm/access/session/kill-sessions" returns a "no route to host" error.

Conditions:
Run RESTcurl commands from a vCMP guest to try to kill the session.

Impact:
Attempting to kill sessions returns a 400 - "no route to host error" error.

Workaround:
None

---

1270849 : SSL Orchestrator enables "Bypass on Handshake Alert" and "Bypass on Client Certificate Failure" for Client SSL profiles

Links to More Info: BT1270849

Component: SSL Orchestrator

Symptoms:
The client profile options Bypass on Handshake Alert and Bypass on Client Certificate Failure are enabled, these options do not have an impact for Client SSL profiles.

Conditions:
Creating an SSL configuration through the SSL Orchestrator GUI with Bypass on Handshake Alert and Bypass on Client Certificate Failure options enabled from the advance settings.

Impact:
No impact due to these options for Client SSL profiles.

Workaround:
None

---

1270497-2 : MRF SIP/ALG Core dump observed while accessing trans_data in sipmsg_register_ingress_register_request_session_reply_common method

Links to More Info: BT1270497

Component: Service Provider

Symptoms:
TMM generates core file while MRF SIP handles register request.

Conditions:
- SIP ALG configuration with SNAT.

Impact:
TMM generates core file while running SIP traffic with ALG configuration. Traffic is disrupted.

Workaround:
None

---

1270133-3 : bd crash during configuration update

Component: Application Security Manager

Symptoms:
bd crash occurred during the configuration update.

Conditions:
This issue occurs during configuration update.

Impact:
bd crash that causes failover in High Availability (HA) pair. Intermittent offline with standalone system.

Workaround:
None

---

1269773-3 : Convert network-order to host-order for extensions in TLS1.3 certificate request

Links to More Info: BT1269773

Component: Local Traffic Manager

Symptoms:
The network-order length is sent as argument instead of host-order length.

Conditions:
- A signature algorithms extension is present in the certificate request message from the server.

Impact:
Handshake fails with illegal parameter alert.

Workaround:
None

---

1269709-1 : GUI should throw the error when the VS is configured with both vdi and HTTP/2 profiles

Links to More Info: BT1269709

Component: TMOS

Symptoms:
As the VDI profile is currently not supported in the HTTP/2 environment for which there is no warning message on the BIG-IP GUI about this limitation.

Conditions:
When both VDI Profile and HTTP/2 Profile is attached to the VS.

Impact:
The customer wants this error to be displayed on the BIGIP GUI if vdi and http/2 profiles both are attached to the VS together.

Workaround:
None

---

1269601-2 : Unable to delete monitor while updating DNS virtual server monitor through transaction

Links to More Info: BT1269601

Component: Global Traffic Manager (DNS)

Symptoms:
Unable to delete monitor while updating DNS virtual server monitor through transaction.

Following message displays:

Command added to the current transaction
Command added to the current transaction
transaction failed: 01070083:3: Monitor /Common/tcp_test is in use.

Conditions:
Using transaction of updating the virtual server monitor and deleting the earlier monitor which was untagged currently.

Following is an example:

echo 'create cli transaction; modify /gtm server generc_serv_test virtual-servers modify { test { monitor none }}; delete /gtm monitor tcp tcp_test; submit cli transaction' | tmsh

Impact:
Unable to delete the monitor.

Workaround:
None

---

1268373-4 : MRF flow tear down can fill up the hudq causing leaks

Links to More Info: BT1268373

Component: Service Provider

Symptoms:
TMM Memory leaks are observed when MRF flows were torn down at once and the hud queue was full.

Conditions:
When the message queue becomes full.

Impact:
TMM memory leak

Workaround:
None

---

1267845-3 : ISC's internal_current function asserted because ifa_name was NULL

Links to More Info: BT1267845

Component: Global Traffic Manager (DNS)

Symptoms:
Named restarting.

Conditions:
- MCPD is down, resulting the service restart.
- The slot interfaces are down.
- During restart named unable to find the interface and asserting.

Impact:
No Impact, this issue occurs when the services are restarting.

Workaround:
None

---

1267269-1 : The wr_urldbd crashes and generates a core file

Links to More Info: BT1267269

Component: Policy Enforcement Manager

Symptoms:
The wr_urldbd crashes and generates a core file.

Conditions:
The munmap function does cross mapping boundaries and it does not fail if the requested unmap contains unmapped memory, i.e. the unmapped segment does not have to be fully mapped

Impact:
Service is interrupted for few minutes and classification does not happen.

Workaround:
None

---

1256809-2 : The tmctl statistics for IPS library table shows unloaded.

Links to More Info: BT1256809

Component: Protocol Inspection

Symptoms:
In a few scenarios, when upgraded or downgraded the tmctl statistics for IPS library table shows unloaded.

Conditions:
- IM upgrade or downgrade

Impact:
Some of the signatures or compliance will not load into the BIG-IP.

Workaround:
Restarting the TMM will load the library correctly.

Use the following command:

bigstart restart tmm

---

1253621-1 : Remote logging SSL Orchestrator Audit logs when running in the Appliance mode

Links to More Info: BT1253621

Component: SSL Orchestrator

Symptoms:
In the Appliance mode, access to the advanced shell(bash)/root is removed. In this scenario, SSL Orchestrator writes audit logs to the local file system which is inaccessible in this mode.

Conditions:
BIG-IP system running in the appliance mode.

Impact:
You cannot access SSL Orchestrator Audit logs as the access to shell is restricted.

Workaround:
Configure syslog to write logs from the ssloAudit.log file to the remote logging server.

1. Run the syslog server on the remote destination
2. Log in to tmsh by entering the following command:

tmsh

3. Modify syslog configuration to write the audit logs to syslog server using UDP protocol

modify sys syslog include 'source s_sslo_audit { file("/var/log/restnoded/ssloAudit.log" follow_freq(1) flags(no-parse)); }; destination d_to_secure_syslog { syslog(<remote-server-ip> transport(udp) port(514) ); }; log { source(s_sslo_audit);destination(d_to_secure_syslog); };'

4. To save the configuration, enter the following command:

save /sys config

5. For BIG-IP systems in a high availability (HA) configuration, perform a ConfigSync to synchronize the changes to the other devices in the device group.

---

1253449-3 : After publishing, the draft LTM policy configuration might not be updated (intermittently) into the bigip.conf

Links to More Info: BT1253449

Component: TMOS

Symptoms:
Publishing LTM draft policy and "save config" operations are not atomic, hence there exists a race condition. When the latter happens first, then the issue is observed otherwise the LTM draft policy is successfully updated into the bigip.conf file.

Conditions:
- Execute the command "tmsh load /sys config current-partition" or the existing system configuration is loaded from bigip.conf after publishing the draft LTM policy.

Impact:
Published LTM draft policies are reverted to the draft state.

Workaround:
Perform any of the below-mentioned steps immediately after successfully publishing an LTM draft policy:

- Execute the command "tmsh save /sys config current-partition" on the BIG-IP shell.

or

Execute curl -sku $COLON_SEPARATED_USERNAME_PASSWORD https://$HOST/mgmt/tm/sys/config/ -X POST -H "Content-type: application/json" -d '{"command":"save"}'

or

Execute curl -sku $COLON_SEPARATED_USERNAME_PASSWORD https://$HOST/mgmt/tm/util/bash -X POST -H "Content-type: application/json" -d '{"command":"run", "utilCmdArgs":"-c ＼"tmsh save sys config current-partition＼""}'

---

1251173-1 : SNI based redirection using LTM policies is not working in BIG-IP

Links to More Info: BT1251173

Component: Local Traffic Manager

Symptoms:
When an LTM policy uses server-name as the condition to route traffic to different virtual servers, the expected virtual server is not always chosen.

Conditions:
The issue can be seen when the following are true:
1. BIG-IP has more than one virtual server.
2. There is an LTM policy with server-name based conditions and actions.

Impact:
The traffic is routed through a different virtual server than the expected one.

Workaround:
This issue only affects requests involving TLSv1 protocol negotiation. Enforcing usage of TLSv1.1 or higher protocol version can prevent the issue.

---

1251157-3 : Ping Access filter can accumulate connections increasing the memory use

Links to More Info: BT1251157

Component: Access Policy Manager

Symptoms:
The maximum HTTP header count value for ping access is 128. The connection to the backend is aborted if there are more than 128 headers.

Conditions:
- Ping access is configured.
- The HTTP header count is more than 128.

Impact:
Connection is aborted by the BIG-IP, users are unable to access the backend.

Workaround:
None

---

1251105-2 : DoS Overview (non-HTTP) - A null pointer was passed into a function

Links to More Info: BT1251105

Component: Advanced Firewall Manager

Symptoms:
In BIG-IP version all 15.1 builds, when protected object filter is selected in Security > DoS overview page, it displays following error:

Error : DoS Overview (non-HTTP) - A null pointer was passed into a function

Schema changes updated in BIG-IP version 15.1.8 which added context_name and context_type to the mcp_network_attack_data_stat_t structure used to report DoS attack stats.

The MCP code that fills in these fields in the structure when responding to the stats request was not inculded, thus an attempt to get the stats, result in detection of a NULL pointer.

Conditions:
Configure a protection profile.
Create a protected object by attaching the protection profile.
Select protected object filter in DoS Overview (non-HTTP) page.

Impact:
This issue avoids usage of GUI partially.

Workaround:
None

---

1251061-1 : apmd core caused by accessing null issuer from JWT

Links to More Info: BT1251061

Component: Access Policy Manager

Symptoms:
In the JWT configuration, missed adding the JWT to the provider while attempting to validate the issuer causes a NULL pointer.

Conditions:
In the JWT configuration, missed adding the JWT to the provider and configured it as below:

apm aaa oauth-provider /Common/duo_provider {
    authentication-uri https://api-c30441f1.duosecurity.com/oauth/v1/authorize
    introspect supported
    token-uri https://api-c30441f1.duosecurity.com/oauth/v1/token
    trusted-ca-bundle /Common/ca-bundle.crt
    type custom
}

Impact:
apmd restart with core dump.

Workaround:
Adding correct configuration for JWT.

apm aaa oauth-provider /Common/duo_provider {
    authentication-uri https://api-c30441f1.duosecurity.com/oauth/v1/authorize
    introspect supported
    manual-jwt-config-name /Common/duo_jwt
    token-uri https://api-c30441f1.duosecurity.com/oauth/v1/token
    trusted-ca-bundle /Common/ca-bundle.crt
    type custom
    use-auto-jwt-config false
}

The fix is to do proper NULL checks for JWT config before validating the issuer.

---

1251013-2 : Allow non-RFC compliant URI characters

Links to More Info: BT1251013

Component: Service Provider

Symptoms:
The MRF Parser fails if the URIs are not as per RFC.
It is required to not validate against the RFC for proper URI formatting, required message headers, and usage of defined method names.

Conditions:
- SIP URIs are not formatted as per RFC.

Impact:
MRF parser allows URI formats which are not comply with RFC.

Workaround:
None

---

1250077-4 : TMM memory leak

Links to More Info: BT1250077

Component: Global Traffic Manager (DNS)

Symptoms:
TMM leaks memory for Domain Name System Security Extensions (DNSSEC) requests.

Conditions:
DNSSEC signing process is unable keep pace with the incoming DNSSEC requests.

Impact:
TMM memory utilization increases over time and could crash due to Out of Memory (OOM) issue.

Workaround:
None

---

1249929-3 : Diameter MRF sends CER to pool-member even after peer sent DPR and force-offline the pool member

Links to More Info: BT1249929

Component: Service Provider

Symptoms:
If Disconnect Peer Action is configured to force-offline and when server peer sends Disconnect Peer Request (DPR), then MRF force-offline the pool-member as expected. However, MRF continues to send CER towards pool member, which means MRF is trying to connect the forced-offline peer and also it sends DPR towards pool member.

Conditions:
In diameter session profile, Disconnect Peer Action is configured to force-offline.

Impact:
Unnecessary CER and DPR messages towards down pool member.

Workaround:
Set auto-initialization to disabled in diameter peer if it does agree with the requirement.

---

1245221-1 : ASM Policy IP Intelligence configuration does not seem to synchronize when the device group is set to automatic sync

Links to More Info: BT1245221

Component: Application Security Manager

Symptoms:
Navigate to the Security > Application Security : Security Policies : Policies List > POLICY_NAME path.

In the IP Intelligence tab, click the ON/OFF switch to enable IPI. Therefore, any changes to the Alarm or Block for any category are not synced to the peer device.

Conditions:
Having High Availability (HA) pair in Sync-Failover DG w/ Autosync enabled and ASM sync enabled. Devices licensed with ASM and IPI.

Impact:
changes to the "Alarm" or "Block" for any category - are not synced to the peer device.

Workaround:
Use Manual (not Auto) sync on the DG and push the configuration.

---

1239297-2 : TMM URL web scraping limit not synced to secondary slot 2 in VIPRION chassis

Links to More Info: BT1239297

Component: Application Security Manager

Symptoms:
Web scraping requests will pass even when the threshold is reached in High Availability (HA) configuration. Some packets are blocked, while some others are passed.

Conditions:
Configure web scraping micro services in high availability (HA) mode in some F5 hardware. Send web scraping requests and check if they are blocked.

Impact:
Web scraping requests can pass even when the requests threshold is reached.

Workaround:
None

---

1238897-3 : TMM TCL interpreter's non-TMM "compat" memcasechr broken in 64-bit build

Links to More Info: BT1238897

Component: Local Traffic Manager

Symptoms:
The TMM's base TCL interpreter (tmm_tcl) is used both in TMM and in non-TMM environments like APMD. The TMM has it's own implementation of memcasechr which is preferred to the "compat" implementation in the TCL interpreter itself as TMM statically links tmm_tcl while non-TMM usage is dynamically linked.

Conditions:
Following VPE rule does not work (option -nocase):

expr {[string first -nocase "bid" [mcget {session.oauth.scope.last.jwt.scope}]] >= 0}

Impact:
The memcasechr is broken in 64-bit build.

Following VPE rule does not work (option -nocase):

expr {[string first -nocase "bid" [mcget {session.oauth.scope.last.jwt.scope}]] >= 0}

Workaround:
Change the VPE rule to the following:

expr {[string first -nocase "bid" [mcget {session.oauth.scope.last.jwt.scope}]] >= 0}

---

1238529-2 : TMM might crash when modifying a virtual server in low memory conditions

Links to More Info: BT1238529

Component: Local Traffic Manager

Symptoms:
Messages similar to the following are seen in the LTM log:
Feb 1 14:17:09 BIG-IP err tmm[1139]: 01010008:3: Listener config update failed for /Common/virtual: ERR:ERR_MEM

TMM restarts and writes a core file.

Conditions:
- Low memory available in TMM.
- A virtual server modification is made.

Impact:
Traffic is interrupted while TMM writes a core file and restarts.

Workaround:
None

---

1235337-1 : The 'JSON profile' with 'JSON schema validation' was not created for the body parameter in the OpenAPI URL

Links to More Info: BT1235337

Component: Application Security Manager

Symptoms:
The 'JSON profile' with 'JSON schema validation' was not created for the OpenAPI parameters with 'body' location and has 'schema' definitions in case the 'schema' type is 'array' (if the type is 'object' and the 'JSON profile' is created properly).

Conditions:
OpenAPI parameter with 'body' location having schema type 'array'.

Impact:
Some OpenAPI parameters will not include JSON content profile validation.

Workaround:
JSON content profile with JSON schema validation can be created manually after creating a security policy from the OpenAPI file.

---

1234953 : Multiple APs requested to apply changes after importing a new AP with HTTP auth agent

Links to More Info: BT1234953

Component: Access Policy Manager

Symptoms:
When we import an access policy with HTTP auth agent,
1)"Apply access policy" shows yellow(implying that changes have to be applied)for all the existing access policies which also have HTTP auth agent along with the newly imported access policy.

Conditions:
1)Newly Imported access policy should have HTTP auth agent.
2)The existing access policies on the BIG-IP should also have HTTP auth agent.

Impact:
Gives the BIG-IP user wrong information regarding the access policies which have pending changes to be applied.

Workaround:
None

---

1232649-1 : Unterminated POST requests never close and consume UMU buffers

Component: Application Security Manager

Symptoms:
When a request is sent with a body smaller than the Content-Length value, the connection is not terminated by BD. If a sufficient number of requests are sent, the long request buffers will become and stay exhausted, preventing further traffic processing.

Conditions:
Many unterminated POST requests are sent to BD.

Impact:
Requests can accmulate, reducing the throughput of BIG-IP.

Workaround:
The number of slow connections can be reduced by reducing the value of the internal BD variable: "max_slow_transactions".

---

1231697 : Configuration to ignore “URI Parameters” in the A10 category is not retained during upgrade from 16.1.x to higher versions.

Links to More Info: BT1231697

Component: Application Security Manager

Symptoms:
The ignore “URI Parameters” in A10 category configuration is not retained when upgrading from 16.1.x to higher versions.

Conditions:
Configure ignore for "URI Parameter" in A10 Category and upgrade version 16.1.x to a higher version.

Impact:
The ignore “URI Parameters” in A10 category configuration is not retained.

Workaround:
Do not configure ignore option of “URI Parameters” in A10 category while upgrading from 16.1.x to higher versions.

---

1231137-3 : During signature update, Bot signature from one user partition affecting the Bot profile created in another Partition

Links to More Info: BT1231137

Component: Application Security Manager

Symptoms:
Signature update is not allowed.

Conditions:
- In Security > Bot Defense > Bot Defense Profiles, when the field Signature Staging upon Update is set to Enabled.

Impact:
None

Workaround:
Set the field Signature Staging upon Update to Disabled.

---

1231001-2 : PEM flow-term-on-sess-delete can cause cores

Links to More Info: BT1231001

Component: Policy Enforcement Manager

Symptoms:
SOD sends a SIGABRT to TMM which then cores.

Conditions:
* PEM is provisioned.
* `pem global-settings session-mgmt-attributes flow-term-on-sess-delete` is enabled.

Impact:
TMM is restarted causing traffic interruption.

Workaround:
Disable `pem global-settings session-mgmt-attributes flow-term-on-sess-delete`.

---

1230833-2 : In the signature advanced mode, the Update button is kept disabled even after some changes in the rule

Component: Application Security Manager

Symptoms:
The Update button is kept disabled when you modify the signature rule string in advance mode.

Conditions:
Using advanced mode, update an existing user-defined signature rule.

Impact:
Additional operation is required to make a change. See the workaround section.

Workaround:
1. Modify the rule string.
2. Change any of the select buttons on the screen, such as Accuracy. At this point, the Update button gets enabled.
3. Revert the change on the select button you did in step 2.
4. The Update button is still kept enabled, click it to apply your change.

---

1229861-2 : Signature rule : regex "i" modifier should be translated into "nocase", instead of prepending "(?i)"

Links to More Info: BT1229861

Component: Application Security Manager

Symptoms:
The "i" modifier is translated into "(?i)" that does not corresponds with matchCase flag ("Case Sensitive" option in GUI) in the control plane. This may introduce a confusion when user writes a regex with "i" in advanced mode, and switch to simple mode. User would expect "Case Sensitive" option is unchecked to "i", but in GUI it displays as checked. The matching behavior is as configured with "i", case-insensitive.

Conditions:
In advanced mode, configure following pattern with "i" modifier.

re2:"/abc/Vi"; norm;

Impact:
Possible confusion in GUI.

Workaround:
Use "nocase" modifier instead.

---

1229813-2 : The ref schema handling fails with oneOf/anyOf

Links to More Info: BT1229813

Component: Application Security Manager

Symptoms:
In JSON schema validation, it fails in handling of a ref schema that is referenced from multiple places under oneOf/anyOf.

Conditions:
Using oneOf or anyOf, a ref schema is referenced multiple times from oneOf/anyOf section.

Impact:
JSON schema validation fails and request gets blocked.

Workaround:
Change schema structure so that the single ref schema is not referenced from multiple places under oneOf/anyOf.

---

1229325-3 : Unable to configure IP OSPF retransmit-interval as intended

Links to More Info: BT1229325

Component: TMOS

Symptoms:
The CLI configuration of OSPF retransmit-interval results in error when retransmit-interval value is less than 5 seconds.

Conditions:
- Configure IP OSPF retransmit-interval.

Impact:
The CLI error even when IP OSPF retransmit-interval value is within range.

Workaround:
None

---

1226585-2 : Some SSL Orchestrator rest endpoints not loading on startup after BIG-IP is rebooted when it is set to CC/STIP mode

Links to More Info: BT1226585

Component: TMOS

Symptoms:
Restnoded framework availability monitor times out while waiting for the dependencies(/mgmt/tm/*/** APIs/endpoints registration w.r.t all the provisioned modules) that are initialized during the restjavad startup.

Conditions:
STIP Mode is enabled, hence the below DB variables values are set to true,
tmsh list sys db security.commoncriteria
tmsh list sys db security.commoncriteria.stip

Impact:
Certain functionalities in SSL Orchestrator config GUI are not operational or operational in a limited manner.

---

1225941-2 : OLH Default Values on Notification and Early Retransmit Settings

Links to More Info: BT1225941

Component: Global Traffic Manager (DNS)

Symptoms:
Online Help description of the 2 settings, Explicit Congestion Notification and Early Retransmit, has incorrect default values.

Conditions:
Online Help description of the 2 settings, Explicit Congestion Notification and Early Retransmit setting is disabled by default.

Impact:
NO

Workaround:
None

---

1225797-4 : SIP alg inbound_media_reinvite test fails

Links to More Info: BT1225797

Component: Service Provider

Symptoms:
On BIG-IP versions that fixed ID 1167941, certain SIP ALG inbound media re-invite test cases fail.

Conditions:
This occurs for re-invites on inbound calls.

Impact:
The re-invite will be dropped.

Workaround:
None

---

1225677-2 : Challenge Failure Reason is not functioning in ASM remote logging

Links to More Info: BT1225677

Component: Application Security Manager

Symptoms:
Challenge Failure Reason is not functioning in ASM remote logging.

Conditions:
Using ASM remote logging.

Impact:
Lack of logging information in ASM remote logger.

Workaround:
None

---

1225061-3 : The zxfrd segfault with numerous zone transfers

Links to More Info: BT1225061

Component: Global Traffic Manager (DNS)

Symptoms:
the zxfrd restart loop with cores occasionally.

Conditions:
Numerous dns express zones are doing zone transfers at the same time.

Impact:
he zxfrd restart loops or cores.

Workaround:
Do not add large number of DNS express zones at the same time and also reduce the total number of DNS express zones.

---

1224377 : Policy Sync fails for a policy when default-all Address Space assigned to Network Access resource

Links to More Info: BT1224377

Component: Access Policy Manager

Symptoms:
Following error is observed during policy sync:
01b70105:3: System built-in APM resource address-space (/Common/default-all) cannot be modified.

Conditions:
Network Access resource has "default-all" address-space.

Impact:
Policy Sync failure.

Workaround:
Remove the 'default-all' address space from the network access configuration, sync the policy, then add it back on the source and destination devices.

---

1223589-3 : Network Map page is unresponsive when a node name has the form "<IPv4>:<port>"

Links to More Info: BT1223589

Component: TMOS

Symptoms:
The Network Map page does not load, the message "Loading..." continuously displayed on the page because the JavaScript throws an exception and does not terminate:

Uncaught (in promise) TypeError: Cannot set properties of undefined (setting 'isNameHighlighted')
    at NetworkMapPresenter.clearHighlight (NetworkMapPresenter.js:1417:17)
    at NetworkMapPresenter.cardFilter (NetworkMapPresenter.js:1322:14)
    at Array.filter (<anonymous>)
    at NetworkMapPresenter.filterCards (NetworkMapPresenter.js:1315:51)
    at NetworkMapPresenter.filterSortAndGroupCards (NetworkMapPresenter.js:1306:10)
    at NetworkMapPresenter._callee18$ (NetworkMapPresenter.js:1162:14)
    at tryCatch (runtime.js:65:40)
    at Generator.invoke [as _invoke] (runtime.js:303:22)
    at prototype.<computed> [as next] (runtime.js:117:21)
    at step (fetch.js:461:47)

Conditions:
- Node name should be of the form <IPv4:port>.
- Node should be associated to a pool and then to a virtual server.

Impact:
The Network Map loads all the virtual servers, pools, and nodes, but it throws an exception in the browser and the JavaScript never terminates, the message "Loading..." continuously displayed on the page and the page is unresponsive.

Workaround:
Avoid naming a node as "<IPv4>:<port>".

---

1218813-4 : "Timeout waiting for TMM to release running semaphore" after running platform_diag

Links to More Info: BT1218813

Component: Access Policy Manager

Symptoms:
The platform_diag might not complete properly leaving TMM in an inoperational state. The 'bigstart restart' is required to recover.

Conditions:
Running platform_diag tool on a platform licensed with URL filtering.

Impact:
Unable to run platform_diag tool. TMM remains inoperative.

Workaround:
Open /etc/bigstart/scripts/urldb and modify the dependency list to be:


# wait for processes we are dependent on
depend ${service} mcpd running 1 ${start_cnt}
require ${service} urldbmgrd running 1 ${start_cnt}
require ${service} tmm running 1 ${start_cnt}

Then restart urldb:

> bigstart restart urldb

---

1217549-3 : Missed ASM Sync on startup

Links to More Info: BT1217549

Component: Application Security Manager

Symptoms:
In few deployment environments, if a device is configured to be part of a device-group before the ASM startup has finished initializing, then it may miss the initial sync from its peer, and not re-request it until another event happens in the system.

Conditions:
Devices are in an auto-sync ASM enabled device-group and a new device is brought into the device-group while initializing the device settings.

Impact:
The devices are out of sync until another action occurs and the sync is requested again.

Workaround:
Restarting ASM on the affected device or causing another sync event will resolve the issue.

---

1217473-2 : All the UDP traffic is sent to a single TMM

Links to More Info: BT1217473

Component: TMOS

Symptoms:
BIG-IP dataplane's VMXNET3 driver implementation is missing the Receive Side Scaling (RSS) support for the User Datagram Protocol (UDP) available as part of the VMXNET3 version 4.

Conditions:
BIG-IP VE instance is running on a VMWare host and handling UDP traffic.

Impact:
The traffic distribution does not happen evenly across all TMMs but rather all of the UDP traffic is sent to a single TMM.

Workaround:
None

---

1217365-3 : OIDC: larger id_token encoded incorrectly by APM

Links to More Info: BT1217365

Component: Access Policy Manager

Symptoms:
APM Websso decrypts id_token incorrectly when OIDC id_token is larger than ~5mb. The generated token size can be larger when the user belongs to many groups.

Conditions:
1) configure BIG-IP as oauth client and Resource server and Authorization server as Azure AD
2) configure Azure AD such that it sends a large token.
)access policy start -> oauth client ->scope ->allow
3)create a oauth bearer sso in "passthrough" mode and send token on 4xx response
4)attach sso to access policy
5)attach the access policy to the virtual server

Impact:
Access to applications will fail due to incorrect processing of the access token.

Workaround:
None

---

1217077-2 : Race condition processing network failover heartbeats with timeout of 1 second

Links to More Info: BT1217077

Component: TMOS

Symptoms:
Unexpected failover or log messages similar to the following:
sod[1234]: 010c0083:4: No failover status messages received for 1.100 seconds, from device bigip02(192.0.0.1) (unicast: -> 192.0.0.2)

Conditions:
- HA configuration network failover configured
- DB variable 'failover.nettimeoutsec' set to a value of 1 second.

Impact:
A failover event could impact traffic flow.

Workaround:
Following recommended practices of configuring network failover addresses using both the Management IP and Self IP addresses will reduce the chances of initiating a failover. Log messages may still be observed.

Setting the DB variable 'failover.nettimeoutsec' to a value of 2 or greater should avoid the issue.

---

1216053-4 : Regular monitors do not use options from SSL profiles

Links to More Info: BT1216053

Component: Local Traffic Manager

Symptoms:
The HTTPS monitors do not use the options from the SSL profile it is set with.

Conditions:
The HTTPS monitor(s) are set with an SSL profile with Non-default options set.

Impact:
Pool members may be incorrectly marked up or down as the incorrect SSL options are used.

---

1215613-2 : ConfigSync-IP changed to IPv6 address and it cannot be changed back to IPv4 address

Links to More Info: BT1215613

Component: TMOS

Symptoms:
In var/log/ltm following error log is available:

0107146f:3: Self-device config sync address cannot reference the non-existent Self IP (10.155.119.13); Create it in the /Common folder first.

Conditions:
- In High Availability (HA) system ConfigSync-IP is set to IPv6 management address.
[root@00327474-bigip1:Standby:Disconnected] config # tmsh list cm device | grep -iE 'cm device|configsync-ip'
cm device 00327474-bigip1.lucas {
    configsync-ip 10.155.119.12
cm device 00327474-bigip2.lucas {
    configsync-ip 2001:dead:beef::13 <<-------


- Modifying the ConfigSync-IP to IPv4.

tmsh modify cm device 00327474-bigip2.lucas configsync-ip 10.155.119.13

Impact:
Device is not able to configure the ConfigSync-IP for IPv4 once IPv6 is configured.

Workaround:
None

---

1215165-1 : Support added for Microsoft Azure Managed HSM

Links to More Info: BT1215165

Component: Local Traffic Manager

Symptoms:
Azure Managed HSM integration with BIG-IP is now supported.

Conditions:
Using an Azure Managed HSM as HSM client with BIG-IP.

Impact:
Azure Managed HSM integration with BIG-IP is now supported.

---

1215161-2 : A new CLI option introduced to display rule-number for policy, rules and rule-lists

Links to More Info: BT1215161

Component: Advanced Firewall Manager

Symptoms:
If a large number of rules and rule-lists are configured, it takes more than 10 minutes to display the output with rule-numbers.
Ex:
tmsh - "list security firewall rule-list"
icrd - "restcurl -u admin /tm/security/firewall/rule-list"

AFM service discovery of BIG-IP fails in BIG-IQ when upgraded to a newer version.

Conditions:
- AFM license is enabled
- Large number of rules and rule-lists are configured

Impact:
AFM service discovery from BIG-IQ fails on upgrade.

Workaround:
-

---

1213277 : Certificate order manager configuration using DigiCert URL fails in the BIG-IP

Links to More Info: BT1213277

Component: TMOS

Symptoms:
When the certificate order manager is configured using DigiCert's URL we see failure with the below error log:

 DigiCert request-type:(4) URL:https://www.digicert.com/services/v2/order/certificate/1

Conditions:
Configuring DigiCert certificate order manager in the BIG-IP.

Impact:
DigiCert certificates can not be downloaded.

---

1212081-2 : The zxfrd segfault and restart loop due to incorrect packet processing

Links to More Info: BT1212081

Component: Global Traffic Manager (DNS)

Symptoms:
The zxfrd process becomes stuck in a crash/restart loop

Conditions:
During zone transfer, the zxfrd process may core when performing processing of an undisclosed packet.

Impact:
DNS express does not work properly.

Workaround:
None

---

1211985-4 : BIG-IP delays marking Nodes or Pool Members down that use In-TMM monitoring

Links to More Info: BT1211985

Component: In-tmm monitors

Symptoms:
When configured with a high number of In-TMM monitors and a high portion are configured as either Reverse monitors or as monitors using the Receive Disable field, the BIG-IP may not mark Nodes and Pool Members DOWN immediately once the configured timeout lapses for non-responsive targets.

Conditions:
This may occur when both:
- In-TMM monitoring is enabled through sys db bigd.tmm.
- A portion of the monitors are configured as Reverse monitors or use the Receive Disable field.

Impact:
Non-Responsive Nodes or Pool Members may not be marked DOWN.

Workaround:
You can work around this issue by disabling In-TMM monitoring, at the expense of decreased monitoring performance (higher CPU usage by the bigd daemon).

---

1211905-2 : Error occurs when importing ASM Policy in XML format with element "violation_ratings_counts"

Links to More Info: BT1211905

Component: Application Security Manager

Symptoms:
Unable to import the XML format policy.

Conditions:
Having an XML policy with violation_rating_counts elements.

Impact:
Unable to import XML policy.

Workaround:
1) Remove the elements from an exported policy file.

sed -i '/<violation_rating_counts＼/>/d' *xml

2) Import the policy again.

---

1211817 : AVRD may crash while modifying the global settings

Links to More Info: BT1211817

Component: Application Visibility and Reporting

Symptoms:
There are two different threads closing the same socket simultaneously.

Conditions:
During the modification of global settings from internal to external.

Impact:
AVRD core generated.

Workaround:
None

---

1211797-3 : MCPD CPU usage is 100% on updating long address-list through GUI

Links to More Info: BT1211797

Component: TMOS

Symptoms:
- Make sure you have added 10,000+ Address list objects in Shared Objects.
- Navigate to Shared Objects ›› Address Lists ›› MICITT_BlackList and add or delete any address, then click save.
- Browser process becomes un-responsive.

Conditions:
When there are huge number of address list objects in the Shared Objects >> Address Lists, users face challenge in adding or updating entries.

Impact:
Browser process becomes un-responsive.

Workaround:
None

---

1211437-2 : When mobile cookie is too long, Anti-Bot SDK is failing

Component: Application Security Manager

Symptoms:
When mobile (TS_72) cookie is longer then 511, it get truncated by BIG-IP and cannot be parsed.

Conditions:
- Bot Defense profile is attached to virtual server, with Mobile SDK enabled.
- Application name is long (causing the cookie to be long).

Impact:
Anti-Bot SDK is failing, clients cannot be handled as mobiles.

Workaround:
None

---

1211369-1 : [Validation] Do not allow AD/LDAP object pointing to the same IP:PORT

Links to More Info: BT1211369

Component: Access Policy Manager

Symptoms:
TMM core

Conditions:
AD and LDAP objects point to the same IP:PORT.

Impact:
Traffic disruption

Workaround:
Use unique names for AD and LDAP objects and those objects should not point to the same IP:PORT.

---

1211361-1 : Validate AD/LDAP object names

Links to More Info: BT1211361

Component: Access Policy Manager

Symptoms:
TMM core

Conditions:
AD and LDAP objects have the same names.

Impact:
Traffic disruption

Workaround:
Use unique names for AD and LDAP objects and those objects should not point to the same IP:port.

---

1211089-3 : Traffic to IPv6 all nodes address not received by TMM on VE with ixlv driver

Links to More Info: BT1211089

Component: TMOS

Symptoms:
Traffic sent to the IPv6 all nodes multicast address is not seen by TMM.

Conditions:
A virtual environment utilizing TMM's ixlv driver.
Traffic is sent to the IPv6 all nodes multicast address.

Impact:
TMM fails to receive and process traffic to the IPv6 all nodes multicast address.

Workaround:
None

---

1210569-3 : User defined signature rule disappears when using high ASCII in rule

Component: Application Security Manager

Symptoms:
WebUI display is empty.

Conditions:
When the configured rule has high ASCII (greater than 127) value.

Impact:
Unable to see the rule in webUI.

Workaround:
Use the following steps:

1. Navigate to Security > Options > Application Security > Attack Signatures.

2. Create a new signature in Advanced Edit Mode. After setting, confirm the setting value with the developer tool.

3. Add it to the signature set (backed by actual signature detection confirmation).

4. Remove the old signatures from signature set.

---

1210321-1 : Parameters are not created for properties defined in multipart request body when URL include path parameter

Links to More Info: BT1210321

Component: Application Security Manager

Symptoms:
Security policy parameters are not created for OpenAPI schema properties in multipart request body section.

Conditions:
Request body defined for URL that include path parameter.

Impact:
Some parameters defined by OpenAPI file will not be created in security policy.

Workaround:
Missed parameters should be created manually through GUI, REST, or TMSH.

---

1210053-1 : The cred_stuffing_fail_open Internal Parameter does not cause Leaked Credential violation in case of expiration or error

Component: Application Security Manager

Symptoms:
In case of Leaked Credential server error, there is an internal parameter to raise Leaked Credentials Violation:
cred_stuffing_fail_open (default value is not to raise violation)
Changing the internal parameter value does not trigger the violation.

Conditions:
- ASM is provisioned.
- WAF Policy is attached to virtual server with Credential Stuffing enabled.
- Internal Parameter cred_stuffing_fail_open is set to 0.
- A server error (or timeout) occurred during leaked credential check.

Impact:
Leaked Credential violation is not raised.

Workaround:
None

---

1210025-1 : Address list discovery task does not trigger apply access policy automatically

Links to More Info: BT1210025

Component: Access Policy Manager

Symptoms:
After discovery task, the Access Policy is not saved automatically.

Conditions:
Dynamic Address Spaces configuration.

Impact:
Unable to use Dynamic Address Spaces.

Workaround:
None

---

1209589-4 : BFD multihop does not work with ECMP routes

Links to More Info: BT1209589

Component: TMOS

Symptoms:
BFD multihop does not work with ECMP routes. TMMs are unable to agree on session ownership and dropping the session after 30 seconds.

Conditions:
On a multi-TMM box, configure BFD multihop peer reachable over ECMP route.

Impact:
BFD multihop does not work with ECMP routes and BFD session is getting dropped every 30 seconds.

Workaround:
None

---

1209465 : When vCMP host is rebooted, oldEngineID is not restored on guest

Links to More Info: BT1209465

Component: TMOS

Symptoms:
The oldEngineID is not restored on guest.

Conditions:
- vCMP host rebooted

Impact:
The snmpget and snmpwalk commands are not working.

Workaround:
Use the following steps:
1) Restart the SNMPD to regenerate engine ID.
2) Reboot the vCMP guest after the unclean shutdown recreates both usmUser and engine ID.
3) Recreate the SNMPv3 user from CLI to resolve the usmUser issue.

---

1209197-1 : Gtmd crash SIGSEGV - OBJ_sn2nid() in

Links to More Info: BT1209197

Component: Local Traffic Manager

Symptoms:
The crash occurs while importing or exporting a key or certificate to the BIG-IP.

Conditions:
While importing the exported buffer, an improper initialization of the variable may create a condition leading to the crash.

Impact:
Gtmd gets cored.

Workaround:
None

---

1207821-3 : APM internal virtual server leaks memory under certain conditions

Links to More Info: BT1207821

Component: Access Policy Manager

Symptoms:
Memory leaks are observed while passing traffic in the internal virtual server used for APM.

Client/Backend is slow in responding to packets from the BIG-IP. Congestion is observed on the network which prompts BIG-IP to throttle egress.

Conditions:
- Traffic processing in the internal virtual server used for APM.

Impact:
TMM memory grows over time, this will lead to out of memory for TMM and eventual restart. Traffic is disrupted when TMM restarts.

Workaround:
None

---

1207793-1 : Bracket expression in JSON schema pattern does not work with non basic latin characters

Links to More Info: BT1207793

Component: Application Security Manager

Symptoms:
Pattern matching in JSON schema has an issue of unable to match string in a specific pattern expression.

Conditions:
When all the following conditions are satisfied:

- a non-basic latin character is in bracket expression []
- the bracket expression is led by ^ or followed by $
- there is at least one character just before or after bracket expression

Following are examples for pattern that has issue:
- /^[€]1/
- /1[€]$/

The bracket would have multiple characters in real scenario.


Following are examples for patterns that do not have the issue:
- /^[€]/
- /[€]1/
- /^€1/

Impact:
The JSON content profile fails matching legitimate JSON token with JSON schema, resulting a false positive.

Workaround:
None

---

1205509-2 : Region cache fails to update appropriately after referenced region update

Links to More Info: BT1205509

Component: Global Traffic Manager (DNS)

Symptoms:
GSLB region object containing records which reference other GSLB regions fail to update its cache when the regions referenced by its records are updated.

Conditions:
- GSLB region object containing records which reference other GSLB regions.
- Region cache was not updated correctly after referenced region updates.

Impact:
DNS query resolution fails to return correct results.

Workaround:
Instead of creating two regions for "not regions", use one region and create following topology record:

gtm topology ldns: not region /Common/_usr_gslbRegion_internalNet server: pool /Common/_usr_gslbPool_alpha {
   order 2
}

gtm topology ldns: not region /Common/_usr_gslbRegion_internalNet server: pool /Common/_usr_gslbPool_bravo {
   order 1
...
}

---

1205061-2 : DNSSEC keys removed from the configuration before expiration date when iQuery connection goes down

Links to More Info: BT1205061

Component: Global Traffic Manager (DNS)

Symptoms:
DNSSEC keys removed from the configuration before expiration date.

Conditions:
On a GTM sync group, if the iQuery connection goes down, the DNSSEC keys are removed from the configuration before expiration date on DNS device with gtm.peerinfolocalid greater than zero.

Impact:
Removing KSK from the configuration before the expiration date can cause the outage if the user has not updated DS record.

Workaround:
None

---

1205045-4 : WMI monitor does not put pool members into an offline/unchecked state when BIG-IP receives HTTP responses other than 200

Links to More Info: BT1205045

Component: Local Traffic Manager

Symptoms:
With no credentials, WMI monitor status still displays "UP".

Conditions:
With no credentials or stale/expired credentials, the WMI monitor stats displays "UP".

Impact:
The user is misinformed about the status of the WMI monitor.

Workaround:
None

---

1200941-2 : PA version check causes page reloads

Links to More Info: BT1200941

Component: Access Policy Manager

Symptoms:
PA application reloads the application and it causes issues.

Conditions:
- Load the application in modern JS support (ILX or latest modern JS support).

Impact:
PA application may not work as expected.

Workaround:
Use custom iRule to replace special_object value in application's index page with the value in cache-fm-modern.js or cache-fm-Modern.js.

---

1199025-2 : DNS vectors auto-threshold events are not seen in webUI

Links to More Info: BT1199025

Component: Advanced Firewall Manager

Symptoms:
No option to see DNS auto-threshold event logs from webUI.

Conditions:
- DNS profile configured with fully automatic mode.

Impact:
DNS auto-threshold event logs are not visible from webUI.

Workaround:
None

---

1196053-3 : The autodosd log file is not truncating when it rotates

Links to More Info: BT1196053

Component: Advanced Firewall Manager

Symptoms:
The autodosd file size increasing continuously irrespective of log rotation occurring every hour.

Conditions:
- DOS profiles (at Device/VS) configured with fully automatic, autodosd daemon will calculate the thresholds periodically and updates the log file with relevant logs.

Impact:
Logs are not truncated as expected. The autodosd log file size continue to increase even though it is rotated every hour.

Workaround:
Restarting autodosd daemon will truncate the log file content to zero.

---

1194745 : The multi-thread use case in LDAP cache reads APMD crash

Links to More Info: BT1194745

Component: Access Policy Manager

Symptoms:
The LDAP server is held by multiple threads and other threads are waiting for the same function before first action completed and it had exceeded the maximum limit of AD/LDAP cache and subsequently APMD crash is observed.

Conditions:
- multi-thread use case in LDAP cache

Impact:
APMD crashes.

Workaround:
None

---

1194409-2 : Dropped messages seen in auditforwarder logging

Links to More Info: BT1194409

Component: TMOS

Symptoms:
Dropped message "255 State: PendingSend" is seen.

Conditions:
- Radius is configured.
- Audit forwarder is enabled.

Impact:
Although there is no problem in functionality of Radius, dropped messages are seen which is a false alarm.

Workaround:
None

---

1191349-2 : The dns_cache_derived_stat show corrupted values.

Links to More Info: BT1191349

Component: Global Traffic Manager (DNS)

Symptoms:
In few scenarios, attributes of dns_cache_derived_stat shows corrupted value. For example, server_max_wait_response as 18446744073709551615.

Conditions:
Checking the tmctl stats for dns_cache_derived_stat.

Impact:
Might create confusion for users.

Workaround:
None

---

1191137-3 : WebUI crashes when the localized form data fails to match the expectations

Links to More Info: BT1191137

Component: TMOS

Symptoms:
In the Chinese BIG-IP, when multicast rate limit field is checked (enabled) and updated, the webUI is crashing.

Conditions:
On the Chinese BIG-IP:
- Navigate to the System Tab > Configuration.
- In Configuration, select Local Traffic > General.
- In Multicast Section, enable Maximum Multicast Rate Checkbox and click on Update.

Impact:
Chinese BIG-IP webUI is crashing.

Workaround:
None

---

1191045 : AD/LDAP queue processing is stuck and being asserted by the session cleaner

Links to More Info: BT1191045

Component: Access Policy Manager

Symptoms:
In the current implementation of LDAP search which is using API "ldap_search_ext_s" where the IN parameter "timeout" is set to "NULL", it means the LDAP client will wait infinitely for the server response.
If we have not received any server response, new processing of the worker thread will not happen and it will get stuck which will cause an assert by the session cleaner.

Conditions:
In cases where the LDAP server response is not received.

Impact:
APMD crashes.

Workaround:
None

---

1190777-2 : Unable to add a device to a device trust when the BigDB variable icontrol.basic_auth is set to disable on target device

Component: TMOS

Symptoms:
When the DB variable "icontrol.basic_auth" is set to "disable" on a device, that device cannot be added to a device trust.

The system from which an administrator is attempting to add the new device will log an error:

err devmgmtd[5541]: 015a0000:3: getDeviceInfo failed: iControl authorization failed

Conditions:
DB variable "icontrol.basic_auth" is set to disable

Impact:
Unable to add a device to a device trust.

Workaround:
On the device being added to the trust:

1. Enable basic auth for iControl

tmsh modify /sys db icontrol.basic_auth value enable

2. Restart httpd on the device being added.

bigstart restart httpd

3. Add the device to the trust.

4. If you want mitigate ID1143073 (https://support.f5.com/csp/article/K94221585), disable basic authentication again.

tmsh modify /sys db icontrol.basic_auth value disable
bigstart restart httpd
    
The dbvar is synchronized if you add the new device to a sync/failover device group, so check each device in the device group.

Use the following to command to check if it's disabled.

# tmsh list /sys db icontrol.basic_auth
sys db icontrol.basic_auth {
    value "disable"
}

If any device has basic auth enabled, disable it and restart httpd on all devices in the device group.

---

1190025-2 : The OAuth process crash

Links to More Info: BT1190025

Component: Access Policy Manager

Symptoms:
The Oauth process crashes and you may observe the following log in /var/log/messages

Nov 4 06:24:56 <hostname> notice logger[16306]: Started writing core file: /var/core/oauth.bld0.175.14.core.gz for PID 20854

Conditions:
Unknown

Impact:
OAuth stopped working.

---

1189949-2 : The TMSH sys core is not displaying help and tab complete behavior

Links to More Info: BT1189949

Component: TMOS

Symptoms:
The help and tab complete options are not displayed when TMSH sys core commands are executed.

Conditions:
For example, execute following commands:

tmsh sys core modify tmm-manage ?

tmsh sys core modify tmm-manage TABC

Impact:
The help and tab complete options are not displayed.

Workaround:
None

---

1189877-4 : The option /dev/random is depreciated from rndc-confgen with the latest BIND 9.16

Links to More Info: BT1189877

Component: Global Traffic Manager (DNS)

Symptoms:
The option /dev/random is deprecated from the rndc-confgen after the BIND upgrade.
The keygen.sysinit scripts using the rndc-confgen with the deprecated option /dev/random leading to the failure in creation of the rndc.key file.
The ZRD daemon waits for the rndc.key but as the key creation failed the daemon waits for the key creation infinitely and will be in a down state.

Conditions:
Upgrade the BIND package from 9.11 to 9.16.

Impact:
The ZRD daemon will be down till the rndc.key is created.

Workaround:
Create the key manually without the deprecated option.


Run the following command:
bigstart stop zrd

rm -f /config/rndc.key
/usr/sbin/rndc-confgen -t /var/named -a -c /config/rndc.key
ln -sf /var/named/config/rndc.key /config/rndc.key
chown -f named:named /var/named/config/rndc.key

bigstart start zrd

---

1188857-4 : EPSEC RPM database is corrupted

Links to More Info: BT1188857

Component: TMOS

Symptoms:
You are unable to access the GUI after rebooting the device.

In the SSH/console, the following message is displayed in the LTM logs:

Failed to reset strict operations; disconnecting from mcpd.

Conditions:
-- APM provisioned.
-- Previous EPSEC packages which were deleted from the system from earlier BIG-IP versions are erroneously attempting to install upon boot due to a corrupt APM RPM database.

Impact:
The MCPD fails to fully load and the device fails to come up and cannot pass traffic.

An internal timer might cause the installation to be aborted and all daemons to be restarted through bigstart restart. Traffic is disrupted while TMM restarts.

Workaround:
You can recover by rebuilding the APM specific RPM database:

1. Delete the existing database
   # rm -rf /var/apm/lib/rpm

2. Refresh the database using the EPSEC bash script
   # epsec -f refresh​​​

---

1188837 : Server side timewait close state causes long establishment under port reuse on i15820DF

Links to More Info: BT1188837

Component: Local Traffic Manager

Symptoms:
When the server TCP connection is under timewait closing state, if a new client connection is initiated towards the server under the BIG-IP SYN-Cookie mode, the server will respond with ACK instead of SYN+ACK for the SYN received.

The BIG-IP system drops this ACK and retransmit the SYN, till timeout occurs.

Conditions:
- Running an i15820DF BIG-IP system.
- FastL4 profile with syn-cookie-enable set to "enabled".
- New client connection is reusing the port to get to the same server TCP connection.

Impact:
Longer establishment time and retry.

Workaround:
None

---

1188417-2 : SelfTest/Integrity test failure triggers reboot action

Links to More Info: BT1188417

Component: Access Policy Manager

Symptoms:
BIG-IP may reboot or become unresponsive with following error log in /var/log/apm

err websso.7[8608]: OpenSSL: DRBG Continuous RNG test failed: DRBG stuck.

Conditions:
-- WebSSO configured

Impact:
Traffic disrupted while the system reboots or becomes unresponsive.

Workaround:
None

---

1186789-2 : DNSSEC keys stored on an internal FIPS card do not work after upgrading to versions >= 16.x

Links to More Info: BT1186789

Component: Global Traffic Manager (DNS)

Symptoms:
DNSSEC signatures are not generated after the upgrade.

Conditions:
DNSSEC key stored on FIPS card;
and
Upgrade to versions >= 16.x.

Impact:
DNSSEC signing will not work.

Workaround:
Edit bigip_gtm.conf and update the key generation handles to match the first 32-hex characters of the key modulus and then run these commands:
# tmsh load sys config gtm-only
# bigstart restart gtmd

(OR)

Before the upgrade, modify the key handle as mentioned above and then reload the config with 'tmsh load sys config gtm-only'

---

1186649 : TMM keep crashing after vCMP Guest Upgrade to BIG-IP v16.1.3.2

Links to More Info: BT1186649

Component: TMOS

Symptoms:
TMM process keeps crashing after vCMP Guest Upgrade to BIG-IP v16.1.3.2.

Conditions:
Hosts running BIG-IP versions lower than 14.1.0, Guests running BIG-IP versions greater than 16.0.x.

Impact:
BIG-IP vCMP Guest will be down.

Workaround:
Downgrade to previous version, or upgrade the vCMP hypervisor to a higher version.

---

1185929-2 : Under rare circumstances, the TCL interpreter can crash TMM after a long time

Links to More Info: BT1185929

Component: Local Traffic Manager

Symptoms:
While using iRules with suspending commands, under rare circumstances, the TCL interpreter can crash TMM after a long time.

Conditions:
While using iRules with suspending commands, under rare circumstances, the TCL interpreter can crash TMM after a long time.

Impact:
TMM crashes.

Workaround:
None

---

1185605-3 : The iCall EventTriggeredHandler in non-common partition break after scriptd daemon restart

Links to More Info: BT1185605

Component: TMOS

Symptoms:
After scriptd daemon restart triggered, handler information become none/unknown in "show sys icall handler" output for the non-common partition.

Conditions:
1. Create triggered handler in non-common partition.
2. Restart the scriptd daemon or upgrade the device.

Impact:
The iCall Event Triggered Handler in non-common partition is not working after device upgrade from 15.1.2.1 to 15.1.5.1.

Workaround:
Configure iCall in common partition.

---

1184853-3 : Youtube video not classified in the BIG-IP version 16.1.0

Component: Traffic Classification Engine

Symptoms:
Youtube traffic getting classified as UDP only

Conditions:
NA

Impact:
Unable to classify the traffic.

Workaround:
NA

---

1184629-2 : Validate content length with respective to SIP header offset instead of parser offset

Links to More Info: BT1184629

Component: Service Provider

Symptoms:
The SIP parser is validating the content length of the SIP message with respective to the parser offset instead of SIP actual header. Validating the content length with parser offset is inaccurate.

Conditions:
The SIP message should have content length greater than zero and should have content.

Impact:
The SIP parser is calculating the SIP message body size inaccurately.

Workaround:
None

---

1183877-2 : CGNAT related links are unavailable in Statistics section

Links to More Info: BT1183877

Component: Carrier-Grade NAT

Symptoms:
Following webUI links are unavailable:

Statistics >> Analytics >> LSN Pools
Statistics >> Module Statistics >> Carrier Grade Nat

Conditions:
CGNAT enabled and provisioned

Impact:
CGNAT related statistical pages cannot be accessed from Statistics section.

Workaround:
None

---

1182993 : MCPD returns dossier error 01 after reboot

Links to More Info: BT1182993

Component: TMOS

Symptoms:
-BIGIP goes to an Inoperative state
-/var/log/ltm display below error
Dossier error: 01
The license is not operational (expired or digital signature does not match contents).

Conditions:
If the locking bit of the dossier mac address field is set to 1 for generated license and When the hardware mac address changes (mac address of hyper-v or VMware or BIGIP bare metal).

Impact:
The mcpd validation fails, and BIG-IP is set to an Inoperative state.

Workaround:
None

---

1182729-2 : Java connection establishes from BIG-IP to BIG-IQ Management

Links to More Info: BT1182729

Component: TMOS

Symptoms:
A TCP connection establishes from BIG-IP to BIG-IQ.

Conditions:
When refreshing the stats, BIG-IP also fetches the stats from BIG-IQ, to fetch the stats from BIG-IQ, a Java connection establishes from BIG-IP to BIG-IQ.

Here, the BIG-IQ is discovered in the BIG-IP. If BIG-IP is not discovered in BIG-IQ, there the issue does not exist.

Impact:
An extra Java connection is listed under netstat.

Workaround:
Updating the property "rest.common.device.automatic.refresh.enabled" to "true" from /etc/rest.BIG-IP.properties, the connection does not establish from BIG-IP to BIG-IQ.

Note: We do not have a workaround for SSL Orchestrator. Workaround is not applicable for SSL Orchestrator.

---

1182305-2 : Descriptions requested for IPS IDs

Links to More Info: BT1182305

Component: Protocol Inspection

Symptoms:
Few inspection IDs of signatures in IPS do not have a complete description.

Conditions:
Navigate to Security > Protocol Inspection and create a profile for any of the services like HTTP, DNS, or FTP and check the inspection IDs mentioned in the description.

Impact:
No functional impact.

Workaround:
None

---

1181833-2 : Content is not updating under respective tab of webUI when CSRF enabled

Links to More Info: BT1181833

Component: Application Security Manager

Symptoms:
The JS tabs under webUI are not functional and content is not being updated.

Conditions:
- When CSRF feature is enabled.

Impact:
- Content is not visible under individual tabs when clicked on any tab button in the webUI.

Workaround:
None

---

1181757-4 : BGPD assert when sending an update due to cq_wbuf mishandling

Links to More Info: BT1181757

Component: TMOS

Symptoms:
BGPD might trip an assert when sending an update due to buffer space mishandling.

Conditions:
No straightforward way to reproduce it. It requires a specific update layout to get triggered.

At a minimum you need 2 BGP peers (the more the better) sending at least 800 prefixes each (need to fill around 4096 bytes when sending a withdrawn update - 5 bytes/prefix + headers).
Also, send at least 800 prefixes towards these peers. Adding as-path prepending and/or communities when sending these routes towards remote peers will greatly increase the chances of hitting the problem.

Impact:
BGPD may get crash or core rarely.

Workaround:
None

---

1169141-3 : Bash tab-completion Issue

Links to More Info: BT1169141

Component: TMOS

Symptoms:
ID830361 introduced a regression in how tab completion works in bash for user directories.

With the fix of CVE-2012-6711 (ID830361), bash tab completion of ~ is auto-completing it to ＼~, which is resulting in not listing the directories under ~ and working as expected.

Conditions:
This issue is seen on the versions which have fix for Bug 830361 (https://cdn.f5.com/product/bugtracker/ID830361.html).

Impact:
Tab-completion of user home directories (~username) in bash does not work.

Workaround:
Do not attempt to tab-complete user home directories (e.g. ~root), and instead type out the path completely.

---

1169105-1 : Provide download links on BIG-IP for Linux ARM64 VPN Client

Links to More Info: BT1169105

Component: Access Policy Manager

Symptoms:
No download links are available in the welcome page in BIG-IP for Linux ARM64 VPN Client.

Conditions:
- Login to BIG-IP.

Impact:
None

Workaround:
None

---

1168309-2 : Virtual Wire traffic over trunk interface sometimes fail in Tenant based platforms

Links to More Info: BT1168309

Component: Local Traffic Manager

Symptoms:
Traffic does not flow through the virtual-wire trunk. Traffic through the interface is not impacted.

Conditions:
When there is an overlap between the DID values of the interface and trunk, virtual-wire traffic does not pass through the trunk.

Impact:
Traffic outage might occur.

Workaround:
None

---

1167953-2 : Issue with UI, while opening rule name in Packet Tester to check the rule for the drop reason

Links to More Info: BT1167953

Component: Advanced Firewall Manager

Symptoms:
Create a Firewall policy and add a rule list to it and simulate a trace using packet tester matching to the rule.

Conditions:
Firewall policy with rule list should be created, AFM should be provisioned.

Impact:
Unable to redirect to the rule on GUI - packet tester.

Workaround:
After simulating a trace using packet tester, see the rule name under virtual server rules and navigate to Security > Network Firewall > RuleLists page and access the rule.

---

1167609-2 : The messages msg->ref > 0 are seen in TMM logs with websockets/ASM plugin

Links to More Info: BT1167609

Component: Local Traffic Manager

Symptoms:
With web security enabled and ASM policies attached to virtual server, in an unknown scenario, msg->ref > 0 are appearing in TMM logs.

Conditions:
-- ASM is provisioned
-- ASM policy attached to virtual server
-- Web security configured

Impact:
The /var/log/tmm files may be flooded with the messages.

Workaround:
None

---

1166481-3 : The vip-targeting-vip fastL4 may core

Links to More Info: BT1166481

Component: Local Traffic Manager

Symptoms:
The TMM cores or VIP does not behave as expected.

Conditions:
- fastL4 virtual
- iRule uses virtual command to redirect flows to a second fastL4 virtual
- first virtual configuration is changed before a flow times out

Impact:
Configuration data is freed but continued to be used by the flow, leading to the configuration appearing to be corrupted causing cores or unexpected behavior.

Workaround:
Ensure that there are no active flows for the virtual being changed.

---

1162661-3 : The Bad Actor (BA) hit counter is not updating for ICMP vector during hardware mitigation

Links to More Info: BT1162661

Component: Advanced Firewall Manager

Symptoms:
The hardware mitigation was not proper due to spva ba_hit statistics not generated.

Conditions:
Configure BA with rate limits for ICMP vectors at virtual server level.

Impact:
Attack traffic will get pass through because of ba_hit is not updating.

Workaround:
None

---

1162221-2 : Probing decision will skip local GTM upon reboot if net interface is not brought up soon enough

Links to More Info: BT1162221

Component: Global Traffic Manager (DNS)

Symptoms:
Resources will be marked timed out.

Conditions:
iQuery connection between local gtmd and big3d is not established before probing decision is made.

Impact:
Resources be marked DOWN unexpectedly.

Workaround:
Modify max-synchronous-monitor-requests to a new value which will trigger probing decision re-evaluation.

---

1161241-5 : BIND default behavior changed from 9.11 to 9.16

Links to More Info: BT1161241

Component: Global Traffic Manager (DNS)

Symptoms:
The default behavior of BIND configurations for minimal-responses and dnssec-validation is changed in BIND 9.16 and leaving the issues for existing test cases and expected behavior.

Conditions:
Upgrade BIND package from version 9.11.36 to 9.16.27.

Impact:
Behavior change for minimal-responses and dnssec-validation.

Workaround:
None

---

1156149-1 : Early responses on standby may cause TMM to crash

Links to More Info: BT1156149

Component: Service Provider

Symptoms:
TMM cores with an early response and retransmit mechanism and has also happened during a failover event.

Conditions:
If the response of the request message reaches before the request on standby box.

Impact:
Causes a failover while TMM is restarting.

Workaround:
None

---

1155861-2 : 'Unlicensed objects' error message appears despite there being no unlicensed configuration

Links to More Info: BT1155861

Component: TMOS

Symptoms:
Following error message appears in the GUI:
This device is not operational because the loaded configuration contained errors or unlicensed objects. Please adjust the configuration and/or the license, and re-license the device.

Conditions:
- The primary blade disabled manually using the following TMSH command:

modify sys cluster default members { 1 { disabled } }

Impact:
Failed to load the license on disabled slot from primary slot.

Workaround:
Execute the following command on disabled slot:
 
bigstart restart mcpd

Note: This causes a system to go offline while services restart. Traffic disrupted while services restart.

or

Execute command "reloadlic" which reloads the license into the current MCPD object.

---

1154725-4 : Custom or predefined method is not changing the behavior while changing from GET to POST method

Component: Application Security Manager

Symptoms:
Changing the user defined method from GET to POST is not changing the behavior, it will change the behavior
once we delete the user defined method and add it back again.

Conditions:
Configure flows to URLs of Act as Method.

Impact:
Flow enforcement will not match the expected method.

Workaround:
Delete the custom method and recreate again with require GET
 or POST method.

---

1154381-4 : The tmrouted might crash when management route subnet is received over a dynamic routing protocol

Links to More Info: BT1154381

Component: TMOS

Symptoms:
The tmrouted might crash when management route subnet is received over a dynamic routing protocol.

Conditions:
- Management route subnet is received over a dynamic routing protocol.
- Multi-bladed VIPRION.
- Blade failover or IP address change occurs.

Impact:
Dynamic routes are lost during tmrouted restart.

Workaround:
Do not advertise a management subnet over a dynamic routing protocol towards BIG-IP. Use route-map to suppress incoming update.

---

1154313-2 : TMM crash due to rrsets structure corruption

Links to More Info: BT1154313

Component: Global Traffic Manager (DNS)

Symptoms:
Tmm crashes.

Conditions:
TMM handling dns request while another tmm thread is reloading dns db files.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

---

1153853-4 : Revision of default value for provision.restjavad.extramb to avoid OOM errors in restjavad

Links to More Info: BT1153853

Component: TMOS

Symptoms:
- restjavad may be out memory as determined from restjavad logs, /var/log/restjavad.X.log, showing 'java.lang.OutOfMemoryError'. This may lead to frequent restjavad restarts and high CPU.
- restjavad may instead, or as well, run many full garbage collection cycles one after another, causing high CPU. This will be shown by frequent logs with [FullGC] in /var/log/restjavad-gc.log.X.current

Conditions:
- Update to affected version: 14.1.5.1-, 15.1.7-15.1.8.2, 16.1.3.1-16.1.3.5, 17.0.0.1-17.0.0.2 or later versions.
- Value of sys db restjavad.useextramb is true.
- Value of sys db provision.restjavad.extramb is 192 or lower than previous restjavad heap size.
- Use of REST API calls that need a lot of memory. Heavy users of REST API, such as SSL Orchestrator, may be very affected.

Impact:
May have problems in TMUI with certain pages or tabs, such as network map with very config or SSLO or iLX related tabs.

Other services that use REST API, internal and external to BIG-IP, may be impacted with low performance or service instability

Workaround:
Before upgrade - if you set sys db restjavad.useextramb to value false before install of new version you will have more restjavad memory, the default 384MB, after upgrade.

  tmsh modify sys db restjavad.useextramb value false

If you restart restjavad you can see if that value works before upgrade. If you don't restart then it will come into effect after reboot.

If that no longer has issues after update then leave that setting at false. Otherwise set back to true (no restart) and increase provision.restjavad.extramb as in After upgrade section below.

After upgrade:
Set sys db provision.restjavad.extramb to an appropriate value and restart restjavad.

Run the following command:

  tmsh modify sys db provision.restjavad.extramb value X
  bigstart restart restjavad

Iterate as necessary.

The value of X is derived by using one of the following formulae:

- When updating from versions before 14.1.4 and 15.1.3, to affected versions, a value that preserves the maximum previous restjavad heap size is:
  192MB + 80% of MIN(provision.extramb|2500)
the minimum possible heap size was:
  192MB + 20% of MIN(provision.extramb|2500)
The actual restjavad heap size would be between those extremes. SSLO systems would typically need the maximum.

- When updating from 14.1.4-14.1.5, from 15.1.3-15.1.6.1 or from 16.0.x to affected versions:
  384MB + 80% of MIN(provision.extramb|2500)

- When updating from 16.1.0-16.1.3 or from 17.0.0.0 to affected versions:
  384MB + 90% of MIN(provision.extramb|4000)

---

1148181 : SSL TLS1.3 connection terminates with "empty persist key" error when SSL persistence is enabled and session tickets are disabled

Links to More Info: BT1148181

Component: Local Traffic Manager

Symptoms:
SSL TLS1.3 handshake fails.

Conditions:
- TLS1.3 should be enabled in the clientssl profile.
- session ticket should be disabled in the clientssl profile.
- Persistence should be enabled in the virtual server.

Impact:
TLS1.3 SSL handhshakes will fail.

Workaround:
Either disabling persistence in the virtual server or enabling session-ticket in the clientssl profile

---

1148065-2 : HTTP::header exists and value iRule commands will not return successful even if the header is present

Links to More Info: BT1148065

Component: Local Traffic Manager

Symptoms:
Virtual Servers configured with the fastHTTP profile will always have the iRule commands and HTTP::header exists and value return as not found, even if the header is present.

Conditions:
A virtual server configured with fastHTTP, and an iRule that makes use of either the HTTP::header exists or value commands.

Impact:
The iRules may not perform as expected when the HTTP header is already present, as HTTP::header exists and value will not find it.

Workaround:
None

---

1147621-2 : AD query do not change password does not come into effect when RSA Auth agent used

Links to More Info: BT1147621

Component: Access Policy Manager

Symptoms:
When RSA auth along with AD query is used the Negotiate login page checkbox "Do not change password" is not working as expected.

Even though "Do not change password" is checked the AD query is receiving F5_challenge post parameter with earlier RSA auth agent OTP content, And PSO criteria would not meet.

So when they click on "logon", it states 'The domain password change operation failed. Your new password must be more complex to meet domain password complexity requirements' and prompts for the fields "New password" and "verify password" again.

Conditions:
RSA Auth with OTP along with AD query agent with the negotiate logon page.

Impact:
User readability/experience even though "Do not change password" is checked it prompts as if user entered the logon credentials.

Workaround:
If you click on "logon" again in the Negotiate page, it goes to the webtop (next agent) with the previous logon or last logon credentials.

---

1146341-2 : TMM crashes while processing traffic on virtual server

Links to More Info: BT1146341

Component: Access Policy Manager

Symptoms:
TMM crashes while processing traffic on virtual server.

Conditions:
- Assigning a per-request policy to virtual server.
or
- Configuring Network Access resource.

Impact:
TMM crashes leading to disruption in traffic flow.

Workaround:
None

---

1145989-2 : ID token sub-session variables are not populated

Links to More Info: BT1145989

Component: Access Policy Manager

Symptoms:
When refresh token is used, ID token sub-session variables are not populated.

Conditions:
- Configured APM as OAuth Client in per-request policy.
- OIDC is enabled.
- After token expires and refresh token is used to fetch new token (grant_type=refresh_token).

Impact:
The sub-session variables related to the ID token are not populated when APM per-request policy uses a refresh token to request a new access token and ID token.

Workaround:
None

---

1145749-4 : Locally defined BIG-IP users can be lost during a failed config-sync

Links to More Info: BT1145749

Component: TMOS

Symptoms:
If a configuration sync to a BIG-IP devices fails, for example, due to an MCPD validation error, locally-defined users on the receiving BIG-IP device may be lost.

This issue applies to locally-defined users (for accessing the management UI or CLI), but does not affect the built-in "admin" or "root" logins.

The users will still be present in /config/bigip_user.conf, but will be missing from /etc/passwd and /etc/shadow, which prevents them from being able to log in to the device.

Messages similar to the following may be seen in /var/log/secure when those users attempt to log in to the BIG-IP device.

   "User 'exampleuser' (fallback: false) - not authenticated: User not known to the underlying authentication module"

Conditions:
- A third (or subsequent) BIG-IP device is added to an existing sync group.
- The config-sync operation fails to load the new configuration, for example, because it is performed in the wrong direction, and the new empty device tries to overwrite and remove configuration from the existing ones, which is blocked by non-shared object references.

Impact:
Locally defined users on the receiving BIG-IP device are removed.

Workaround:
Log in as admin or root, and manually reset the passwords on the affected local user accounts. This will repopulate the users into the unix passwd and shadow files.

---

1145729-3 : Partition description between GUI and REST API/TMSH does not match

Links to More Info: BT1145729

Component: TMOS

Symptoms:
When creating a partition with a description via the REST API, the description is not shown in the GUI.

For example:

[root@ltm1:Active:Standalone] config # curl -sku admin:<pass> -X POST https://localhost/mgmt/tm/auth/partition/ -H 'Content-Type: application/json' --data '{"name": "partition1", "description": "this is partition 1"}'
{
  "kind": "tm:auth:partition:partitionstate",
  "name": "partition1",
  "fullPath": "partition1",
  "generation": 154,
  "selfLink": "https://localhost/mgmt/tm/auth/partition/partition1?ver=14.1.5.2",
  "defaultRouteDomain": 0,
  "description": "this is partition 1"
}

The description "this is partition 1" is not visible when viewing the partition1 object in the GUI at System >> Users >> Partition List.

Similarly, a partition description entered via the GUI is not retrieved with a REST API call to /mgmt/tm/auth/partition.

A partition description updated via the GUI is not retrieved with TMSH.

Conditions:
-- Partition description
-- GUI
-- REST API
-- TMSH

Impact:
GUI and REST API partition descriptions are inconsistent.
GUI and TMSH partition descriptions are inconsistent.

Workaround:
None

---

1144845-4 : GARPs from a newly active unit may be bridged for a brief time while the peer chassis transitions to standby

Links to More Info: BT1144845

Component: Local Traffic Manager

Symptoms:
When a VIPRION chassis goes into Standby there is a brief period of time in which all the blades transition. If GARPs are sent from the newly Active device during this time, they may be bridged.

Conditions:
VIPRION, multiple blades, vlan-groups.

Impact:
Switches / routers may have incorrect ARP information after a failover.

Workaround:
Use proxy exclude list to exclude all virtual addresses.

---

1144729-4 : PVA stats may be incorrect when PVA offloaded flows have their nexthops changed to a different VLAN

Links to More Info: BT1144729

Component: TMOS

Symptoms:
The PVA stats and corresponding service graph may be inaccurate if there are multiple routes to a destination and those routes are on different VLANS.

Conditions:
Multiple routes to a destination that exist on different VLANS. A flow that changes from one route to another.

Impact:
PVA stats or service graph may show significantly higher numbers than expected.

Workaround:
Disable PVA acceleration for the affected traffic.

Create LTM profile fastl4 and other-pva-offload-direction server-to-client-only.

---

1144417 : DoS WL allowed in BIG-IP version 16.1.x if it was configured in a previous version 15.1.x

Links to More Info: BT1144417

Component: Advanced Firewall Manager

Symptoms:
BIG-IP is allowing DOS WL is version 16.1.x when it is upgraded from version 15.1.x with existing configuration.

Conditions:
- Upgrade BIG-IP from version 15.1.x.

Impact:
BIG-IP adds WL in version 16.1.x.

Workaround:
Before upgrading to BIG-IP version 16.1.x, delete the WL configuration in version 15.1.x.

---

1144353 : After creating a "Dynamic Exclude Address Spaces" or "Dynamic LAN Address Spaces" from inside a Network Access List object fails to redirect back to Network Access List object page

Links to More Info: BT1144353

Component: Access Policy Manager

Symptoms:
After creating a "Dynamic Exclude Address Spaces" or "Dynamic LAN Address Spaces" the error "Major problem with Linked Adds, look at log file" is displayed on the page instead of redirecting back to the Network Access List object page.

Conditions:
Should navigate to Address Space creation page using the "+" button beside "Dynamic Exclude Address Spaces" or "Dynamic LAN Address Spaces" fields in the Network Access List object page.

Impact:
NA

Workaround:
Create a "Dynamic Exclude Address Spaces" or "Dynamic LAN Address Spaces" directly from the Access menu (Access ›› Connectivity / VPN : Network Access (VPN) : Address Spaces)
and then select it in the Network Access list object page.

---

1144329-4 : Traffic Intel does not classify Microsoft app properly

Links to More Info: BT1144329

Component: Traffic Classification Engine

Symptoms:
Some of the Microsoft teams based URLs are marked uncategorized or categorized as SSL and http2 by traffic intelligence categorization.

Conditions:
Geolocation based traffic not classified.

Impact:
Incorrect classification of Microsoft application.

Workaround:
None

---

1143833-2 : ILX (iRules LX) may corrupt tmstat (profile statistics) memory

Links to More Info: BT1143833

Component: Local Traffic Manager

Symptoms:
iRulesLX do not show statistics after any changes made on the workspace and reload the plugin.

Conditions:
-- Using iRules LX

Impact:
iRulesLX do not show statistics after any changes made on the workspace and reload the plugin.

Workaround:
None

---

1143809-1 : Unable to modify SNMP monitors from webUI

Links to More Info: BT1143809

Component: TMOS

Symptoms:
While attempting to modify Interval, Timeout, and other SNMP monitors, following error is displayed:

Error: 'an error occurred while trying to process your request'

Conditions:
Modify SNMP monitor parameters from webGUI.

Impact:
Unable to modify any SNMP monitors from webUI.

Workaround:
Modify the SNMP monitors from TMSH , use the following command :
tmsh modify ltm monitor snmp-dca <monitor-name> cpu-coefficient <value>"

---

1142445-4 : Multicast handling on wildcard virtual servers leads to TMM memory leak

Links to More Info: BT1142445

Component: TMOS

Symptoms:
Multicast handling on wildcard virtual servers leads to TMM memory leak.

Conditions:
- Multicast license
- Multicast is enabled on a route-domain (ip multicast-routing)
- Wildcard virtual server matching multicast address space.

Impact:
TMM memory usage increasing over time.

Workaround:
None.

---

1142389-3 : APM UI report displays error "Error Processing log message ..." when the log contains some special character received in client request

Links to More Info: BT1142389

Component: Access Policy Manager

Symptoms:
Following message is displayed in APM Access Report:
"Error Processing log message. Original log_msg in database"

Conditions:
Checking APM Access Report while accessing VPN.

Impact:
Unable to see correct log messages in APM Access Report.

Workaround:
None

---

1142225-2 : Regular and In-TMM HTTPS monitors advertise different cipher suites with SSL profile is set to None

Links to More Info: BT1142225

Component: Local Traffic Manager

Symptoms:
The HTTPS monitors advertise different cipher suites if the SSL profile setting is set to None, irrespective of whether the in-TMM monitoring is enabled.

Conditions:
The Https monitor(s) are set with the default SSL profile of "None".

Impact:
Pool members may be marked down when switching between regular and in-TMM monitoring due to differing cipher suites.

Workaround:
Assign an SSL profile to HTTPS monitors.

---

1142153-2 : DNS Resource Records for Wide IPs are potentially misleading when creating or deleting a large number of Wide IPs

Links to More Info: BT1142153

Component: Global Traffic Manager (DNS)

Symptoms:
BIND records do not match configured Wide IPs and pools.

Conditions:
If the BIG-IP is a member of a DNS/GTM sync-group and "synchronize-zone-files" is enabled.

Impact:
Resources that are down in GTM do not receive appropriate answers from BIND, and clutter builds up in BIND database over time.

Workaround:
None

---

1141213-2 : Peer is aborting the connection when PEM client runs diameter traffic over SCTP

Links to More Info: BT1141213

Component: TMOS

Symptoms:
PEM is initiating connection with successful CER/CEA. But, every time the connection gets aborted by the peer and a new connection is opened when diameter traffic is being sent from PEM client over SCTP.

Conditions:
Configure PEM as Gx diameter endpoint and let PEM to connect with MRF Diameter VS.

Impact:
MRF is resetting the PEM connection.

Workaround:
None

---

1138101-2 : Tunnel connections might not come up when using pool routes

Links to More Info: BT1138101

Component: Local Traffic Manager

Symptoms:
When using a pool route with service-down action set to drop or reset, tunnel flows might not work properly after pool route gateway goes down and comes up.

Conditions:
- Tunnel flow using a pool route for nexthop resolution.
- Pool route with service-action-down set to drop or reset.
- Pool is marked down and then up.

Impact:
Traffic no longer goes through tunnel.

Workaround:
Do not use service-action-down feature.

---

1137569-3 : Set nShield HSM environment variable.

Links to More Info: BT1137569

Component: Global Traffic Manager (DNS)

Symptoms:
The HSM Management fail to set a makepath.

Conditions:
When nShield HSM is configured .

Impact:
GTM rfs-sync fail.

Workaround:
N/A.

---

1137521 : TLSv1.3 connections dropped when SSL Persistence is enabled

Links to More Info: BT1137521

Component: Local Traffic Manager

Symptoms:
A virtual server with an SSL persistence profile processing TLSv1.3 traffic may see dropped connections.

Conditions:
-- TLSv1.3 is enabled on ClientSSL profile on a virtual server.
-- SSL Persistence Mode is enabled on the virtual server.

Impact:
Traffic may be impacted as the optimizations due to SSL Persistence may not work for TLSv1.3

Workaround:
Do not enable SSL Persistence with TLSv1.3 on the affected versions.

---

1137269-4 : MCPD fails to reply if a request is proxied to another daemon and the connection to that daemon closes

Links to More Info: BT1137269

Component: TMOS

Symptoms:
MCPD does not reply to the request if the publisher's connection closes or fails. In this case, when bcm56xxd
is restarted, the perceivable signs of failure are:
- The snmpwalk failing with a timeout and
- The "MCPD query response exceeding" log messages.

Conditions:
1) Configure SNMP on the BIG-IP to run snmpwalk locally on the BIG-IP.
2) From the first session on the BIG-IP, run a snmpwalk in the while loop.
    
while true;do date; snmpwalk -v2c -c public 127.0.0.1 sysDot1dbaseStat;sleep 2;done
Sample output:
Sat Aug 21 00:57:23 PDT 2021
F5-BIGIP-SYSTEM-MIB::sysDot1dbaseStatResetStats.0 = INTEGER: 0
F5-BIGIP-SYSTEM-MIB::sysDot1dbaseStatMacAddr.0 = STRING: 0:23:e9:e3:8b:41
F5-BIGIP-SYSTEM-MIB::sysDot1dbaseStatNumPorts.0 = INTEGER: 12
F5-BIGIP-SYSTEM-MIB::sysDot1dbaseStatType.0 = INTEGER: transparentonly(2)

3) From a second session on the BIG-IP restart bcm56xxd

bigstart restart bcm56xxd

4) The snmpwalk will continually report the following:

Timeout: No Response from 127.0.0.1

      And snmpd will continually log "MCPD query response exceeding" every 30 seconds in /var/log/ltm.

Impact:
SNMP stopped responding to queries after upgrade.

Workaround:
Restart SNMP.

---

1137245-1 : Issue with injected javascript can cause an error in the browser.

Links to More Info: BT1137245

Component: Application Security Manager

Symptoms:
DosL7 module injected javascript causes an error on the browser when some conditions apply.

Conditions:
Specific response-side conditions can cause this error to appear in the browser console.

Impact:
Website malfunction with errors.

Workaround:
None

---

1137217-2 : DNS profile fails to set TC flag for responses containing RRSIG algorithm 13

Links to More Info: BT1137217

Component: Global Traffic Manager (DNS)

Symptoms:
DNS express sends a malformed response when UDP size limit is set to 512.

Conditions:
--The UDP size limit is set to exactly 512 and a zone that is signed with algorithm 13 (ECDSA Curve P-256 with SHA-256), the DNS express responds with a malformed packet.

--Malformed responses were also seen without DNSSec, when message size is equal to the EDNS buffer size advertised by the client

Impact:
Malformed DNS express responses is received when UDP size limit set to exactly 512 and a zone is signed with algorithm 13.

Workaround:
None

---

1137133-2 : Stats rate is showing incorrect data for broadcast, multicast and arp flood vectors

Links to More Info: BT1137133

Component: Advanced Firewall Manager

Symptoms:
At tenant side stats_rate is almost double.

Conditions:
Appliance has two ATSE's.
AFM is enabled and licensed and broadcast or multicast packets are sent.

Impact:
Stats_rate is shown as double than sent traffic rate.
If vector is configured and traffic is passing with higher rate than mitigation value, stats_rate and int_drops_rate will be shown as double data rate.

Workaround:
None

---

1136905-1 : Request for Portal Access Hosted Content are RST with "No available SNAT addr"

Links to More Info: BT1136905

Component: Access Policy Manager

Symptoms:
RST with the following message in /var/log/apm:
- No available SNAT addr

Conditions:
- Portal Access with Hosted-Content.

Impact:
Unable to access hosted-content resources.

Workaround:
Use the following command:
- tmsh modify sys db ipv6.enabled value false

---

1136893-2 : Youtube classification fails

Links to More Info: BT1136893

Component: Traffic Classification Engine

Symptoms:
Youtube video is not classified as youtube_video.

Conditions:
Sending Youtube traffic from a browser.

Impact:
ABR not detected for PEM policy streaming rules.

Workaround:
None

---

1136837-4 : TMM crash in BFD code due to incorrect timer initialization

Links to More Info: BT1136837

Component: TMOS

Symptoms:
TMM crashes in BFD code due to incorrect timer initialization.

Conditions:
- BFD configured
- Multi-bladed system
- One of blades experiences failure.

Impact:
Crash or core.

Workaround:
None.

---

1136833-2 : Unparseable request content subviolation override cannot be configured on microservices

Links to More Info: BT1136833

Component: Application Security Manager

Symptoms:
A configuration option is missing for the unparseable request content subviolation override.

Conditions:
The option is missing in the UI and REST.

Impact:
It is not possible to configure an override for this subviolation on a microservice.

Workaround:
An iRule can be used to mitigate this condition. The specific iRule will be different according to the use case, the following is an example (psaudo code):

when ASM_REQUEST_DONE
{
       if {[ASM::microservice] eq "/foo/*a/"}
       {
           if { [HTTP::uri] length > X}
           #trigger ASM custom violation
}

---

1136781-2 : Incorrect parsing of 'bfd notification' CLI in IMI Shell (imish)

Links to More Info: BT1136781

Component: TMOS

Symptoms:
-- Cannot load a file containing 'bfd notifications enable'.
-- After restarting the Advanced Shell services or rebooting, the 'bfd notifications enable' command is missing in the show running-config.

Conditions:
-- In imish, configure "bfd notification enable".
-- Reboot or TMSH restart sys service tmrouted.
-- The "bfd notification enable" is not present in the show running-config.

Impact:
Unable to restore or survive the bfd notification CLI.

Workaround:
None

---

1136081-5 : HSM sync issue in high availability (HA) setups

Links to More Info: BT1136081

Component: Local Traffic Manager

Symptoms:
FIPS card sync can return error when trying to sync FIPS card in High Availability (HA) setups.

HSMs are initialized with old software are not compatible with HSMs which are initialized with recent software release. If one device in HA pair is replaced and new device is initialized with new software, then HSM sync can fail in few scenarios.

Conditions:
- Replacing a device in HA pair.

Impact:
HA pair will not be able to sync the FIPS keys which can cause the traffic impact if active device goes down.

Workaround:
Following are workaround steps for target device (RMAed or new device in high availability (HA) pair):
1. Downgraded the BIG-IP version to old releases.
2. Execute "tmsh stop sys service all".
3. Execute fipsutil reset.
4. Execute fipsutil init.
5. Execute bigstart restart.
6. Execute the following command to check the FIPS card health:
tmsh show sys crypt fips key

Following is an example output:
-------------------------------------------
FIPS 140 Hardware Device
-------------------------------------------
no private keys found

7. Upgrade the BIG-IP version to latest release where active device is present.
8. Reboot to upgraded volume.
9. Execute the fipscardsyn from source device.

---

1135961-7 : The tmrouted generates core with double free or corruption

Links to More Info: BT1135961

Component: TMOS

Symptoms:
A tmrouted core is generated.

Conditions:
The system is a multi-blade system.

Impact:
A tmrouted core is generated. There are no other known impacts.

Workaround:
None

---

1135393-1 : The pfmand support is not available on i15820-DF (D120)

Links to More Info: BT1135393

Component: TMOS

Symptoms:
The vCMP host is not running pfmand, while the vCMP guest is runiing. The guests logs the following error:
"pfmand[5334]: 01660005:4: No connection to hypervisor."

Conditions:
On vCMP guest, it is running the pfmand service and giving following error logs:
"pfmand[5334]: 01660005:4: No connection to hypervisor."

Impact:
No functional impact as device is processing the crypto and compression traffic to Nitrox5 device, but pfmand will not be able to monitor Nitrox5 device.

Workaround:
None

---

1134509-4 : TMM crash in BFD code when peers from ipv4 and ipv6 families are in use.

Links to More Info: BT1134509

Component: TMOS

Symptoms:
TMM crashes in BFD code when peers from ipv4 and ipv6 families are in use.

Conditions:
- BFD configured
- Mixed IPv4 and IPv6 peers.

Impact:
Crash or core

Workaround:
None.

---

1134441-2 : Inactive policy synced to peer results ASM removed from virtual server only for sync-only DG

Links to More Info: BT1134441

Component: Application Security Manager

Symptoms:
An ASM policy is suddenly detached from a virtual server and deactivated.

Conditions:
-- sync-only device group.
-- ASM sync enabled.
-- A policy is used on device ASM-A (attached to virtual server/device group).
-- The same policy is not used on device ASM-B (not attached to virtual server/device group).

Impact:
Inactive policy is synced to the peer, resulting in ASM being unassigned from the Virtual Server.

Workaround:
To prevent Policy Sweeper from deactivating any ASM policy, create a non-functioning device group and attach the unused ASM policies to that device group.

---

1134257-2 : TMM cores when pingaccess profile is modified multiple times and configuration is loaded

Links to More Info: BT1134257

Component: Local Traffic Manager

Symptoms:
TMM cores.

Conditions:
- The APM pingaccess profile is configured.
- Before configuration load, modify pingaccess profile multiple times.

Impact:
TMM cores.

Workaround:
None

---

1134057-4 : BGP routes not advertised after graceful restart

Links to More Info: BT1134057

Component: TMOS

Symptoms:
The BGP routes not advertised after a graceful restart.

Conditions:
The BGP with graceful restart configured.

Impact:
The BGP routes not advertised after graceful restart.

Workaround:
None

---

1133201-1 : Disabling a GTM pool member results in the same virtual server no longer being monitored in other pools

Links to More Info: BT1133201

Component: Global Traffic Manager (DNS)

Symptoms:
If you disable a GTM pool member in one of the pools, monitoring appears to be disabled for the members in the other pools.
Incorrect probe behavior when toggling or untoggling the monitor-disabled-objects GTM global setting.

Conditions:
- Same virtual server or monitor combination is used in multiple GTM pools.
- Disable the GTM pool member in one of the pool.

Impact:
Incorrect pool monitoring..

Workaround:
Enable the 'Monitor Disabled Objects' or, assign a different monitor to pools.

---

1132957-1 : Modifying IPsec tunnels tunnel object may result in TMM core

Links to More Info: BT1132957

Component: TMOS

Symptoms:
Changing the configuration of an IPsec interface mode tunnel may result in a TMM core.

Conditions:
- IPsec with ipsec-policy in interface mode.
- Configuration is changed for that tunnel.

Impact:
Traffic disrupted while TMM restarts.

Workaround:
Before reconfiguring an IPsec interface mode tunnel, disable the ike-peer associated with the tunnel.

---

1132949-4 : GUI reported error when changing password after mgmt port was changed

Links to More Info: BT1132949

Component: TMOS

Symptoms:
GUI reports an error, but the password can be changed successfully anyway:

An error has occurred while trying to process your request.

Conditions:
This issue is seen when an SSL port change happens, followed by password change for a given user.

Impact:
The BIG-IP system is unable to provide the following functionality:

1. Gossip Framework : REST high availability (HA) sync framework will not work.
2. Licensing via BIG-IQ
3. selfLinks will be wrong
4. iAppLx, SSL Orchestrator, Access Guided Configuration, AS3 will be affected as these modules depends on Gossip

Workaround:
This issue is seen only when the SSL port is other than 443 (which is default SSL port).

To work around this, keep 443 as SSL port.

---

1132705-3 : Failed on insert entry to DCC.ACCOUNT_LOGIN_OBJECT_ATTRIBUTES

Component: Application Security Manager

Symptoms:
When importing two policies that have the same url object configured, adding the url parameter to one on of the policies causes apply policy to fail.

Conditions:
1. Both policies use the same url parameter.
2. Type of parameters are different (one can be http and the other can be https for example).

Impact:
Apply policy fails.

Workaround:
Change the name of one of the policies.

---

1132449-2 : Incomplete or missing IPv6 IPI database results to connection reset and/or high TMM CPU usage

Links to More Info: BT1132449

Component: Advanced Firewall Manager

Symptoms:
Following IPv4 database load message is present in /var/log/ltm:
015c0010:5: Initial load of IPv4 Reputation database has been completed

Note the absence of:

015c0010:5: Initial load of IPv6 Reputation database has been completed

Some scenarios would result in elevated TMM CPU utilization, for example, when using IPI in global policy.

Conditions:
Failure to download IPv6 database from localdb-ipv6-daily.brightcloud.com.

Impact:
Any of the following:

- TCL error results when IPI is used in an iRule resulting in connection being reset.

- When using IPI in global policy, increased TMM CPU utilization may occur which leads to idle enforcer being triggered, TMM clock advanced messages appearing in LTM logs, or TMM restarting without core when MCPD is unable to communicate with TMM.

Workaround:
Ensure that BIG-IP is able to communicate using https with BrightCloud servers, including localdb-ipv6-daily.brightcloud.com. For more detailed troubleshooting steps, see K03011490.

---

1128429-5 : Rebooting one or more blades at different times may cause traffic imbalance results High CPU

Links to More Info: BT1128429

Component: Carrier-Grade NAT

Symptoms:
One or more TMMs are consuming more CPU cycles than the other TMMs. The increased CPU usage is caused by a significant number of internal TMM traffic redirections.

Conditions:
- LSN pools enabled.
- The sp-dag configured on the client-side and server-side VLANs (cmp-hash src-ip and cmp-hash dst-ip respectively).

Impact:
Increased TMM CPU usage on one or more TMMs.

Workaround:
- Set up an High Availability (HA) pair of VIPRIONs and make an active VIPRION cluster standby before doing any operation that involves the rebooting, insertion, or removal of one or more blades.

Or if the VIPRION is a stand-alone cluster:

- Stop all external traffic to the VIPRION before rebooting, inserting, or removing one or more blades.

- Restart or reboot all the blades at the same time from the primary, using the following "clsh" command:
"clsh reboot volume <NEW_VOLUME>" or "clsh bigstart restart".

---

1128405-3 : DNS overall Request/Second counter can be inaccurate

Links to More Info: BT1128405

Component: Global Traffic Manager (DNS)

Symptoms:
In the output of "tmsh show ltm profile dns" (which shows overall stats for all DNS profiles) can indicate an inaccurate value for the "Request/Second" counter.

The counters for individual DNS profiles will have accurate values.

Conditions:
A DNS profile is associated with a virtual server, and then later removed (or switched to use another DNS profile).

Impact:
The overall view showing statistics for DNS Requests/Second is inaccurate.

Workaround:
Reset the profile stats, although this will only be effective until the next time a DNS profile is removed from a virtual server.

---

1127881-2 : Deprecate sysClientsslStatFullyHwAcceleratedConns, sysClientsslStatPartiallyHwAcceleratedConns and sysClientsslStatNonHwAcceleratedConns

Links to More Info: BT1127881

Component: TMOS

Symptoms:
SSL Hardware Acceleration MIBs are still in use which are meant to be deprecated.

Conditions:
Run snmpwalk for these MIBS and it's active.

#snmpwalk -c public localhost -v2c F5-BIGIP-SYSTEM-MIB::sysClientsslStatFullyHwAcceleratedConns
F5-BIGIP-SYSTEM-MIB::sysClientsslStatFullyHwAcceleratedConns.0 = Counter64: 0

# snmpwalk -c public localhost -v2c F5-BIGIP-SYSTEM-MIB::sysClientsslStatPartiallyHwAcceleratedConns
F5-BIGIP-SYSTEM-MIB::sysClientsslStatPartiallyHwAcceleratedConns.0 = Counter64: 0

# snmpwalk -c public localhost -v2c F5-BIGIP-SYSTEM-MIB::sysClientsslStatNonHwAcceleratedConns
F5-BIGIP-SYSTEM-MIB::sysClientsslStatNonHwAcceleratedConns.0 = Counter64: 0

Impact:
SSL MIB not up-to-date

Workaround:
None

---

1127805-2 : Server.crt containing "<" will cause frequent reconnects between local gtmd and big3d

Links to More Info: BT1127805

Component: Global Traffic Manager (DNS)

Symptoms:
Resources flap, frequent reconnects occur between the local gtmd and big3d.
Logs similar to this:
Jul 15 22:56:32 GSLB2 warning gtmd[11773]: 011ae023:4: XML parsing error not well-formed (invalid token) at line 483

Jul 15 05:36:54 GSLB2 notice gtmd[6917]: 011ae01a:5: SSL handshake complete to 10.10.10.10
Jul 15 05:37LB2 notice gtmd[6917]: 011ae01a:5: SSL handshake complete to 10.10.10.10
Jul 15 05:37:24 GSLB2 notice gtmd[6917]: 011ae01a:5: SSL handshake complete to 10.10.10.10
Jul 15 05:37:34 GSLB2 notice gtmd[6917]: 011ae01a:5: SSL handshake complete to 10.10.10.10

Conditions:
Server.crt containing "<"

Impact:
-- GTMs frequently leave/join the GTM sync group
-- Resources are marked up and down.

Workaround:
1. On each GTM, run bigip_add for all defined BIG-IP servers.
Or
2. Remove "<" from the server.crt file.

---

1127725-1 : Performance drop with the AES_CCM 128 cipher★

Links to More Info: BT1127725

Component: Local Traffic Manager

Symptoms:
On all BIG-IP platforms with Coleto Creek - Intel Crypto and Coleto Creek DH8925CL chip present for Hardware cryptos like i10800, i11800, i5800, i7000, i15800, i4x00 platforms and VIPRION, when AES_CCM 128 ciphers such as TLS_RSA_WITH_AES_128_CCM are used, there will be a performance drop when compared to previous releases.

Conditions:
The AES_CCM 128 algorithm is configured.

Impact:
A performance drop of up to 30% and an increase in CPU utilization occurs.

Workaround:
None

---

1127241-1 : AS3 tenants don't sync reliably in GTM sync groups.

Links to More Info: BT1127241

Component: Global Traffic Manager (DNS)

Symptoms:
GTM AS3 tenants do not sync across GTM sync groups when using AS3 declarations.

Conditions:
-- GTM sync group.
-- Remove tenant in GTM1.
-- Sync does not happen and the tenant remains in GTM2.

Impact:
GTM sync fails to sync the AS3 tenants.

Workaround:
None

---

1126181-2 : ZebOS "no log syslog" configuration is not surviving reboot

Links to More Info: BT1126181

Component: TMOS

Symptoms:
ZebOS "log syslog" or "no log syslog" are not surviving reboot according to the user performed operations. Always revert to default setting, which is enabled.

Conditions:
-- Under Configure no log syslog.
-- Perform reboot or upgrade.

Impact:
If syslog logging has been disabled using 'no log syslog', and then ZebOS is restarted. For example, by rebooting or upgrading the BIG-IP, syslog logging will revert to the default setting, which is enabled.

Workaround:
None

---

1125733-3 : Wrong server-side window scale used in hardware SYN cookie mode

Links to More Info: BT1125733

Component: TMOS

Symptoms:
Client enables Window Scale in the first SYN packet with a specific factor value, however the BIG-IP system disables Window Scale in its SYN/ACK response.

Instead, disabling the Window Scale TCP option in both peer BIG-IPs, TMM honors the Window Scale presented by the client in the first SYN, whereas client assumes Window Scale is disabled. This will cause BIG-IP to send data payload bytes exceeding the client's Windows Size.

Conditions:
Below conditions must be met in order to match this issue:

- Client and server enables timestamp TCP option.
- Client enables Window Scale TCP option.
- SYN Cookie HW is activated in BIG-IP.

Impact:
This can cause performance issues because some packets could need to be retransmitted.

In rare cases where client TCP stack is configured to abort connection when it receives window overflow the connection will be RST by client.

Workaround:
The preferred workaround is changing to Software SYN Cookie mode.

---

1125381-2 : Extraneous warnings recorded in when using only intermediate certificates

Links to More Info: BT1125381

Component: Local Traffic Manager

Symptoms:
When client authentication is enabled on the client SSL profile but the trusted-ca file includes only an intermediate certificate and no CA root cert to build the whole cert chain, although the TLS connection is made, as expected, there is an error message reported.

Conditions:
Trusted-ca includes only inter-cert and no root CA-cert
is configured.

Impact:
Although the TLS handshake succeeds without any issue and the connection is processed, as expected, a confusing warning is reported.

Workaround:
Because the connection is made, you can safely ignore this message.

Note: This issue does not occur if the root CA cert is also configured in the CA-cert bundle.

---

1125161-2 : Wideip fails to display or delete in the Link Controller GUI.

Links to More Info: BT1125161

Component: Global Traffic Manager (DNS)

Symptoms:
Attempting to display (i.e. click on) a WideIP in the Link Controller GUI returns an error similar to the following example:

General error: Error parsing value of "null" of type "gtm_qtype_t" in statement [SELECT SINGLE *, gtm_pool.name as pool_name FROM gtm_wideip, gtm_pool WHERE (name = '/Common/example.com' AND type = '1' AND pool_name = 'null' AND pool_type = 'null')]

Attempting to delete a Wideip in the Link Controller GUI returns an error similar to the following example (and the delete operation fails):

01020036:3: The requested Pool (A /Common/example.com) was not found.

Conditions:
-- Link Controller system.

-- The Wideip in question has no associated Pool. This is likely the result of improperly creating the Wideip via the tmsh utility, or upgrading the system from an earlier version which caused your configuration to be automatically fixed up (such as creating distinct A and AAAA Wideips from an earlier unique Wideip entry).

Impact:
The GUI cannot be used to display or delete the Wideip.

Workaround:
Link Controller, unlike GTM, does not expose the concept of Pools. Link Controller only exposes WideIPs and Virtual Servers. Pools exist, but are managed automatically by the system on your behalf.

If a WideIPs created using the GUI, the WideIP will be assigned a Pool of the same type and name automatically. This also happens if you initially decide to assign no Virtual Servers to the WideIP (and things work as intended in the BIG-IP GUI).

However, the tmsh utility is not aligned with this Link Controller requirement, and allows you to create WideIPs with no associated Pool.

If you have experienced this issue:

1) Deleted the affected WideIP using the tmsh utility.

2a) Going forward, use the GUI to define more Link Controller WideIPs.

2b) Alternatively, if you must use the tmsh utility to do so, ensure each WideIP you create is assigned an identically named Pool of the same type, even if initially you decide to place no Virtual Servers in the Pool. For example, define something like the following:

gtm pool a /Common/example.com { }
gtm wideip a /Common/example.com {
    pools {
        /Common/example.com {
            order 0
        }
    }
}

---

1124793-1 : Space inserted for variable assigned in a custom expression in the GUI

Links to More Info: BT1124793

Component: Access Policy Manager

Symptoms:
A space character is inserted in a Custom Expression in UI

Conditions:
While creating a Custom expression in Variable Assign

Impact:
In some cases the space in the custom expression is propagating to bigip.conf and causing issues due to the extra space.

Workaround:
None

---

1124733-1 : Unnecessary internal traffic is observed on the internal tmm_bp vlan

Links to More Info: BT1124733

Component: TMOS

Symptoms:
Unnecessary internal traffic can be observed on the internal tmm_bp vlan. It is a UDP broadcast on 62965 port.

Conditions:
Always

Impact:
Unnecessary traffic that does not disrupt normal operation.

Workaround:
None

---

1124217-1 : Big3d cores on CTCPSocket::TCPReceive and connector

Links to More Info: BT1124217

Component: Global Traffic Manager (DNS)

Symptoms:
Big3d crashes.

Conditions:
Big3d keeps restarting and coring on gtm with a large quantity of monitors configured.

Impact:
Segmentation fault and big3d restarts.

Workaround:
None

---

1124085-4 : iRules command [info hostname] does not reflect modified hostname

Links to More Info: BT1124085

Component: Local Traffic Manager

Symptoms:
Result from [info hostname] iRules command does not change after modifying system hostname.

Conditions:
- iRules [info hostname] command is being used.
- System hostname is modified.

Impact:
iRules command [info hostname] might reflect incorrect/old hostname

Workaround:
Use $static::tcl_platform(machine) insted of [info hostname]

---

1123189-2 : De-Provisioning AFM does not disable SYN-ACK cookie generation

Links to More Info: BT1123189

Component: Advanced Firewall Manager

Symptoms:
The AFM de-provision is not in sync with TCP-SYNACK-FLOOD cookies with 'suspicious' enabled mode.

Conditions:
The TCP-SYNACK-FLOOD cookies with 'suspicious' enabled not getting disabled when AFM license is de-provisioned.

Impact:
Cookies (SYNACK) generations is happening even after AFM module is de-provisioned.

Workaround:
None

---

1123157-3 : Single-page application AJAX does not work properly with page's navigation

Component: Application Security Manager

Symptoms:
When a single-page application is enabled and the page's own navigation is triggered during the display of CAPTCHA, the CAPTCHA frame disappears.

Conditions:
-- Single-page application is enabled in ASM.
-- The single-page application's code performs its own navigation on top of the displayed CAPTCHA.

Impact:
ASM end users may not be able to pass the CAPTCHA challenge and therefore will not be able to access the application.

Workaround:
None

---

1122153-4 : Zonerunner GUI displaying incorrect error string "RRSig Covers Unsupported Record Type"

Links to More Info: BT1122153

Component: Global Traffic Manager (DNS)

Symptoms:
Zonerunner is displaying incorrect error information when it is unable to parse the value.

Conditions:
Zonerunner displays such errors when it is unable to parse the value when displaying records.

Impact:
The error message suggests it is a DNSSEC issue (RRSig) and is misleading.

Workaround:
None

---

1122021-3 : Killall command might create corrupted core files

Links to More Info: BT1122021

Component: TMOS

Symptoms:
When killing multiple processes via the 'killall' command, a single corrupted core file is created.

Conditions:
- using killall command
- killing multiple processes

Impact:
Corrupted core file is created.

Workaround:
Kill single specific processes instead

---

1121937-4 : ZoneRunner GUI is unable to display CAA records with "Property Value" set to ";"

Links to More Info: BT1121937

Component: Global Traffic Manager (DNS)

Symptoms:
If you try to view CAA record in ZoneRunner with "Property Value" set to ";", then "RRSig Covers Unsupported Record Type<none>:1: <none>:1: expected a string" message is displayed in GUI.

Conditions:
- Navigate to DNS :: Zones :: ZoneRunner :: Resource Record List :: Search All Records.

- Click on record of type CAA where the "Property Value" is set to ";".

Impact:
Unable to view or update CAA records through GUI where the "Property Value" is set to ";".

Workaround:
Manually edit or view the BIND configuration from the command line.

---

1121349-2 : CPM NFA may stall due to lack of other state transition

Links to More Info: BT1121349

Component: Local Traffic Manager

Symptoms:
When processing LTM policy rules as they apply to the incoming data, the CPM (Centralized Policy Matching) the state machine may incorrectly process the pattern, resulting in some of the policy rules not being applied

Conditions:
-- HTTP virtual server with LTM policy and iRule that triggers on "HTTP URI path contains" some value

Impact:
LTM policy rule does not trigger when it would be expected to

Workaround:
Change rule from "HTTP URI path contains" to "HTTP URI full string contains"

---

1121169-3 : Unable to resize the /appdata: /dev/mapper/vg--db--sda-dat.appdata when in use

Links to More Info: BT1121169

Component: TMOS

Symptoms:
On systems where ID1004833 has been fixed, the resizing instructions for /appdata from K74200262 no longer work.

Conditions:
When the jitterentropy-rngd is started by systemd which is the default state of the BIG-IP.

Impact:
A filesystem resize operation may fail with the following error:

# lvreduce --resizefs --size -40G /dev/mapper/vg--db--sda-dat.appdata
Do you want to unmount "/appdata"? [Y|n] y
fsck from util-linux 2.23.2
/dev/mapper/vg--db--sda-dat.appdata is in use.
e2fsck: Cannot continue, aborting.

resize2fs 1.42.9 (28-Dec-2013)
resize2fs: Device or resource busy while trying to open /dev/mapper/vg--db--sda-dat.appdata
Couldn't find valid filesystem superblock.
fsadm: Resize ext3 failed
  fsadm failed: 1
  Filesystem resize failed.

Workaround:
Unmount /appdata and restart the jitterentropy-rngd, using the following commands:

umount /appdata
systemctl restart jitterentropy-rngd

Then retry the resize operation.

---

1121085-3 : Some valid connections may get rejected in hardware SYN cookie mode

Links to More Info: BT1121085

Component: TMOS

Symptoms:
Due to an algorithm mismatch in software and hardware, valid TCP connections may get rejected with "No flow found for ACK' reset-cause when the hardware SYN cookie mode is active.

Conditions:
- BIG-IP iSeries appliances with ePVA support and the B2250 and B44xx VIPRION blades.
- Hardware SYN cookie mode is activated.

Impact:
Service degradation.

Workaround:
- Disable the hardware SYN cookie mode globally.
- After a reboot, restart the TMM for an additional time.

---

1120529-1 : Illegal internal request in multipart batch request

Links to More Info: BT1120529

Component: Application Security Manager

Symptoms:
Request parser for inner request is intolerant for a linefeed that results in a HTTP Protocol Compliance violation with the following details.

HTTP Validation Bad multipart parameters parsing
Details Illegal internal request in multipart batch request

Conditions:
- multipart/batch(ing) request
- inner requests use LF for end-of-line marker, instead of canonical marker CRLF

Impact:
Request gets blocked

Workaround:
None

---

1120345-6 : Running tmsh load sys config verify can trigger high availability (HA) failover

Links to More Info: BT1120345

Component: TMOS

Symptoms:
When running tmsh 'load sys config verify' on a config that contains both an high availability (HA) group and a traffic group referencing that high availability (HA) group, this will trigger an high availability (HA) fault and failover.

Conditions:
- Running 2 BIG-IP systems in an high availability (HA) pair
- Run tmsh 'load sys config verify' on a config with the following conditions:
- Config to be verified contains an high availability (HA) group
- Config to be verified also contains a traffic group referencing the high availability (HA) group

Impact:
HA fault and failover. high availability (HA) pair will enter a degraded state.

Workaround:
No workaround currently known, but the failover fault can be cleared by running tmsh 'load sys config' on the system that had 'load sys config verify' run on it.

---

1116513-1 : Route-domains should not be allowed on name server addresses via the GUI.

Links to More Info: BT1116513

Component: Global Traffic Manager (DNS)

Symptoms:
Route domains are allowed on nameserver address when configuring them via the GUI.

Conditions:
Create a DNS resolver via the GUI and include route domain for nameserver IP address.

Eg : Navigate to Network > DNS Resolvers > DNS Resolver List and can create a DNS resolver name server address with Route domain.

Impact:
Inconsistency between the GUI and TMSH for dns resolver namserver address.

Workaround:
None

---

1114253-4 : Weighted static routes do not recover from BFD link failures

Links to More Info: BT1114253

Component: TMOS

Symptoms:
If a BFD link fails and recovers, the weighted static route that should be preferred does not populate back into the routing table.

Conditions:
Weighted static routes with BFD configured, this is an example of the affected configuration:

ip route 0.0.0.0/0 10.8.8.4 100
ip route 0.0.0.0/0 10.8.8.34 200
ip static 0.0.0.0/0 10.8.8.4 fall-over bfd
ip static 0.0.0.0/0 10.8.8.34 fall-over bfd

After BFD session to 10.8.8.4 fails and recovers the default route will still be pointing to 10.8.8.34.

Impact:
Incorrect route nexthop.

Workaround:
Re-add route config statements.

---

1114137-4 : LibUV library for latest bind 9.16

Links to More Info: BT1114137

Component: TMOS

Symptoms:
The latest bind software requires the latest libuv for performance improvements and to support new protocol layers (for example, DNS over TLS).

Conditions:
The latest bind software requires the latest libuv for performance improvements and to support new protocol layers (for example, DNS over TLS).

Impact:
None

Workaround:
None

---

1112649 : FIPS 140-2/FIPS 140-3 compliant mode is incorrect after upgrade to 16.1.2.2★

Component: TMOS

Symptoms:
After upgrading a BIG-IP system that is licensed for FIPS 140-2 compliant mode or with the full-box FIPS license, the FIPS mode reported is FIPS 140-3 compliant mode, but FIPS 140-2 and FIPS 140-3 mode is not properly enabled.

Also, if you upgrade a BIG-IP system that is licensed for FIPS 140-2 compliant mode or with the full-box FIPS license, and upgrade to version 16.1.2.2 without first re-activating your license, after the upgrade is complete you will be prompted to reboot. After the reboot, FIPS mode will be disabled.

Conditions:
-- BIG-IP system running a software version earlier than 16.1.2.2, regardless of hardware or software platform type
-- The FIPS 140-2 compliant mode or full-box FIPS license is applied
-- Upgrade to version 16.1.2.2

Impact:
After the system reboots, the BIG-IP system reports that FIPS 140-3 compliant mode is enabled, but the FIPS mode is not FIPS 140-2 or FIPS 140-3 compliant in this version.

If you did not re-activate the license prior to upgrade, the BIG-IP system will prompt you to reboot, and then will start with FIPS mode disabled.

Workaround:
If you are upgrading a BIG-IP system that has a FIPS 140-2 compliant mode license applied, do not upgrade to version 16.1.2.2; instead, upgrade to BIG-IP version 16.1.3 or higher if your intention is to upgrade to version 16.x.

---

1112385-3 : Traffic classes match when they shouldn't

Links to More Info: BT1112385

Component: Local Traffic Manager

Symptoms:
Traffic classes may match when they should not.

Conditions:
* Fix for ID1074505 is present (without that fix this bug is hidden).
* Traffic class uses none (or equivalently all 0s) for source-address.

Impact:
Traffic is not categorized properly.

Workaround:
Specify a source address, e.g.

ltm traffic-class /Common/blah {
    source-address 1.1.1.1
    source-mask none
   ...
}

Note that because the mask is none this won't have any effect (other than working around this bug).

---

1112205-3 : HTTP/2 may garble responses if the client-side stream aborts while response headers are on the wire

Links to More Info: BT1112205

Component: Local Traffic Manager

Symptoms:
If the client-side stream aborts while response headers are on the wire, the subsequent requests may receive a garbled response.

Conditions:
- HTTP2 profile is used on both client and server side.
- The client terminates the stream while the response has not yet reached the BIG-IP system.

Impact:
The client will receive an obscure response

Workaround:
None

---

1112089-1 : Prevent zrd from rolling back named.conf file in wrong situations

Links to More Info: BT1112089

Component: Global Traffic Manager (DNS)

Symptoms:
The zrd process may roll name.conf back which may cause unexpected changes.

This shows up in the /var/log/gtm file or in the GUI with a message similar to the following:

err zrd[27809]: 01150306:3: Error connecting to named socket 'Connection refused'.
(or)
err zrd[16198]: 01150306:3: Error connecting to named socket 'Connection timed out'.

Conditions:
As of now list include the following scenarios:
-- One of the scenario is seen as part of ID1083405 - see https://cdn.f5.com/product/bugtracker/ID1083405.html
-- Named process isn’t running, updating wide IPs will cause the same symptom.

Impact:
Looking up or modifying zone records may fail. This will affect the other members in the gtm sync group as well.

Workaround:
None

---

1111993-2 : HSB tool utility does not display PHY settings for HiGig interfaces

Links to More Info: BT1111993

Component: TMOS

Symptoms:
When running the hsb_tool utility, PHY settings for HiGig interfaces are not displayed.

Conditions:
Run hsb_tool on a BIG-IP system with HSB functionality.

Impact:
None

Workaround:
None

---

1111361-3 : Refreshing DNS wide IP pool statistics returns an error

Links to More Info: BT1111361

Component: Global Traffic Manager (DNS)

Symptoms:
Refreshing the wide IP pool statistics results in the error message 'An error has occurred while trying to process your request'.

Conditions:
Go to "Statistics > Module Statistics > DNS > GSLB > Wide IPs > Statistic Pools", and click "Refresh".

Impact:
No results are returned, and the error message 'An error has occurred while trying to process your request' is displayed.

Workaround:
N/A.

---

1110949-2 : Updating certKeyChain of parent SSL profile using iControl does not change the cert and key outside certKeyChain of the child profile

Links to More Info: BT1110949

Component: Local Traffic Manager

Symptoms:
Invalid config after iControl call: the certificate and key of the child profile do not change as expected.

Conditions:
1. The SSL profile should default from a parent profile.
2. iControl REST is used to change the certkeychain of the parent profile.
3. The issue cannot be seen after the first call but from the second call, it's always reproducible.

Impact:
1. The child profile has an incorrect configuration.
2. The older certificate/key can not be deleted as they are still in use in the child profile.

Workaround:
Can use currently deprecated iControl call by using key and cert instead of certkeychain as follows:

curl -k -u admin:admin -H "Content-Type: application/json" -X PATCH https://10.155.75.246/mgmt/tm/ltm/profile/client-ssl/parent.example.com -d '{"key":"/Common/default.key","cert":"/Common/default.crt"}'

---

1110485-3 : SSL handshake failures with invalid profile error

Links to More Info: BT1110485

Component: Local Traffic Manager

Symptoms:
1. TMM reports SSL handshake failures with reason "hud_ssl_handler:1208: alert(40) invalid profile unknown on VIP"

2. There will be Certificate read errors in the ltm log "reading: Unknown error."

Conditions:
-- The certificates associated with the SSL profile are corrupted by modifying/adding/deleting them manually/Venafi

-- There are frequent unintentional Certificate updates

Impact:
-- The BIG-IP system will not be able process the traffic
-- All traffic to particular virtual servers fails

Workaround:
1. Correct the certificates which are corrupted and make them valid.

2. Deattach/Remove the corresponding SSL profile from all virtual servers to which it is applied.

3. In the GUI open the virtual server and click on update and make sure there are no errors shown on the screen.

4. Now re-apply the SSL profile to the virtual server

---

1110165-3 : Fasthttp connections infrequently fail

Links to More Info: BT1110165

Component: Local Traffic Manager

Symptoms:
BIG-IP can rarely send client payloads to servers before the connection has been fully established.

Conditions:
-- Fasthttp virtual server
-- Cookie persistence enabled
-- The payload is spread across multiple packets

Impact:
Some servers will reset the connection, causing client side HTTP requests to fail.

Workaround:
Use a fastl4/standard virtual server instead.

---

1108557-1 : DNS NOTIFY with TSIG is failing due to un-matched TSIG name

Links to More Info: BT1108557

Component: Global Traffic Manager (DNS)

Symptoms:
DNS NOTIFY messages are ignored.

Conditions:
The TSIG on the secondary needs to have the same algorithm and secret, but one or more characters in the name must be a different case.

Impact:
Failure to update the zone in a timely fashion.

Workaround:
Remove the offending TSIG on the secondary and re-create it with case matching the primary server.

---

1107605-1 : TMM crash reported with specific policy settings

Links to More Info: BT1107605

Component: Local Traffic Manager

Symptoms:
TMM crashes when HTTPS request for a non-existent document

Conditions:
1) Virtual server with HTTP Profile
2) LTM Policy with "shutdown connection" for 400/404 response codes
3) Request for non-existent document

Impact:
Traffic disrupted while tmm restarts.

Workaround:
Remove the policy and use an iRule with the same conditions as in the policy.

---

1107453 : Performance drop observed in some Ramcache::HTTP tests on BIG-IP i10800 platform

Links to More Info: BT1107453

Component: Local Traffic Manager

Symptoms:
Drop in TPS of around 6.5% observed for Ramcache::HTTP tests.

Conditions:
- BIG-IP i10800 l7-performance-fpga platform
- 5KB file size with 1 Request Per Connection
- 5KB file size with 100 Request Per Connection

Virtual server with the following profiles -
1. http
2. tcp profile with nagle disabled
3. web acceleration profile with following attributes -
   - cache-max-age 36000
   - cache-object-max-size 1500001
   - cache-object-min-size 1

Impact:
Delay in client side response during peak traffic flow due to lowered throughput.

Workaround:
None

---

1106673-3 : Tmm crash with FastL4 virtual servers and CMP disabled

Links to More Info: BT1106673

Component: Local Traffic Manager

Symptoms:
With CMP disabled, all traffic is forwarded to one TMM thread. A crash occurs when these flows are torn down.

Conditions:
The following is configured on a virtual server:
-- A fastL4 profile
-- CMP is disabled
-- An IPS firewall policy

Impact:
Traffic disrupted while tmm restarts.

Workaround:
Enable CMP on the virtual server.

tmsh modify ltm virtual <virtual_server_name> cmp-enabled yes

---

1105969-1 : Gratuitous ARP not issued for non-floating self-IP on clicking "Update" via the GUI

Links to More Info: BT1105969

Component: Local Traffic Manager

Symptoms:
A gratuitous ARP (GARP) is not issued as per K15858.

Conditions:
After the BIG-IP system is fully started and interfaces are online, select the non-floating self IP address in the Configuration utility and then select Update (without making any changes).

Impact:
You cannot force non-floating self-IPs to send a gratuitous ARP post-boot.

Workaround:
None

---

1105757-2 : Creating CSR with invalid parameters for basic-constraints, tmsh does not generate meaningful errors

Links to More Info: BT1105757

Component: TMOS

Symptoms:
A similar error as below is observed:
Key management library returned bad status: -45, No Error

Conditions:
Always observed.

Impact:
The error thrown is not meaningful hence it is difficult to identify the invalid parameters.

Workaround:
N/A

---

1105145-2 : Request body on server side egress is not chunked when it needs to be after HTTP processes a 100 continue response.

Links to More Info: BT1105145

Component: Local Traffic Manager

Symptoms:
After HTTP processes a 100 continue responses, the request body is incorrectly not chunked on egress to the server, whenever server-side chunking is expected.

Conditions:
- Basic HTTP virtual server with rechunking iRule.
- Incoming client requests containing 'Expect' header.

Impact:
Server may return an error response, for example, 400 Bad Request.

Workaround:
None

---

1105021-4 : F5OS BIG-IP tenants perform an MCPD "forceload" operation after a reboot

Links to More Info: BT1105021

Component: TMOS

Symptoms:
BIG-IP tenant software running on an F5OS device performs an MCPD "forceload" operation after a reboot which means the MCPD loads the configuration from the text config file rather than the binary database.

/var/log/ltm contains

chmand Hardware/Chassis change detected. Forcing db load from the file.

Conditions:
The management Mac address transfers from F5OS to BIG-IP tenant are not in sync.

Impact:
-- Devices report "changes pending" after the tenant is rebooted.
-- This may result in configuration loss if auto-sync is configured.
-- This may result in configuration loss as a result of operational foul-ups, regardless of which device had a newer configuration before one was rebooted, the newly-rebooted device will claim to have a newer configuration.

Workaround:
None

---

1104553-2 : HTTP_REJECT processing can lead to zombie SPAWN flows piling up

Links to More Info: BT1104553

Component: Local Traffic Manager

Symptoms:
In the execution of a specific sequence of events, when TCL attempts to execute the non-existing event, it follows a path which in turn makes SPAWN flow to become a zombie, which pile up over time showing up on the monitoring system.

Conditions:
-- http2, client-ssl, optimized-caching filters on the virtual server
-- HTTP::respond iRule with LB_FAILED event and set of iRules like HTTP_REQUEST, HTTP_RESPONSE, CLIENTSSL_HANDSHAKE, CACHE_RESPONSE, ASM_REQUEST_BLOCKING
-- send http2 request through the virtual server

Impact:
Clients may not be able to connect to the virtual server after a point in time.

---

1104517-2 : In SWG explicit proxy, some TCP connections are reset because of inconsistency between sessionDB and local IP2SessionId map

Links to More Info: BT1104517

Component: Access Policy Manager

Symptoms:
Some clients' TCP connections are reset with an error "cl sm driver error (Illegal value)" when the BIG-IP system is in this error state.

Conditions:
SWG explicit proxy is configured.

Impact:
Some clients are unable to access a service.

Workaround:
Disable sessionDB mirroring on both active and standby
# tmsh modify sys db statemirror.mirrorsessions value disable
# tmsh save sys config

Restart tmm on standby
# bigstart restart tmm

---

1103953-1 : SSMTP errors in logs every 20 minutes

Links to More Info: BT1103953

Component: TMOS

Symptoms:
An error is logged every 20 minutes to /var/log/maillog

err sSMTP[9797]: Unable to connect to "localhost" port 25.
err sSMTP[9797]: Cannot open localhost:25

The symptoms are similar to what you see in https://support.f5.com/csp/article/K60914243 but the solution in that article will not help. K60914243 talks about 15.x while current issue is on 16.x.

Conditions:
This occurs in one of the following happens

1. You have manually deleted restjavad or restnoded log files with following commands
   rm /var/log/restjavad*
   rm /var/log/restnonded*

2. One of the restjavad/restnoded log files is small and unable to rotate (rotation fails). This happens when file size does not exceed default "max-file-size"

Impact:
Log rotation for restjavad/restnoded will be stuck. You may see system emails about sSMTP errors every 20 minutes.

Workaround:
This issue subsides if you manually create a file for the stuck log file.

1. Open a command terminal
2. Run # ls -l /var/log/restnoded*
3. If you find that restnonded1.log is missing then manually create it
    # touch /var/log/restnoded/restnoded1.log
4. Run # ls -l /var/log/restjavad*.log
5. If you find that restjavad.1.log is missing then manually create it
    # touch /var/log/restjavad.1.log

---

1103833-2 : Tmm core with SIGSEGV in gtmpoolmbr_UpdateStringProc

Links to More Info: BT1103833

Component: Global Traffic Manager (DNS)

Symptoms:
Tmm cored with SIGSEGV.

Conditions:
-- iRule pool command with member which is determined at run-time
-- A pool member is used for the iRule
-- The previous pool member is deleted and then re-created using the same name
-- That pool member is picked again for the next iRule event.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
Use a string command to category the pool member variable like this:

  pool dnspool member [string trim $pool_member]

---

1103477-3 : Refreshing pool member statistics results in error while processing requests

Links to More Info: BT1103477

Component: Global Traffic Manager (DNS)

Symptoms:
Pool member statistics aren't displayed and the page shows an error message 'An error has occurred while trying to process your request'.

Conditions:
-- A GTM pool is configured with one or more pool members.
-- The 'Refresh' button or the timer is used to fetch the pool member statistics again.

Impact:
Refresh does not work as expected.

Workaround:
Although the refresh button or refresh timer is broken, you can refresh the page to see updated statistics.

---

1103245 : Policies not being applied

Links to More Info: BT1103245

Component: Traffic Classification Engine

Symptoms:
When two firewall policies are applied, one at a global level and one at the virtual server context, none of the policies are applied.

Conditions:
Apply two different policies, one at the virtual server context and the other at a global level.

Impact:
Policies are not applied

Workaround:
Attach the required policy either in global level or virtual server context, not in both

---

1103117-2 : iAppLX extension using express with httpserver script leaves lingering client-side flow on HTTP requests.

Links to More Info: BT1103117

Component: Local Traffic Manager

Symptoms:
While using an iAppLX extension using express with simple HTTP server script, tmsh show sys conn shows a lingering client-side flow that is eventually expired by the sweeper.

Conditions:
Virtual server with iAppLX extension using express with a simple httpserver script like below:

  app.use(express.static('public'));
  var plugin = new f5.ILXPlugin();
  plugin.startHttpServer(app);

Impact:
The connection table (tmsh show sys conn) shows a lingering client-side flow that is eventually expired by the sweeper.

Workaround:
None

---

1101741-2 : Virtual server with default pool down and iRule pool up will flap for a second during a full config-sync.

Links to More Info: BT1101741

Component: TMOS

Symptoms:
During a full manual config-sync, a virtual server with a default pool which is down and an iRule pool which is up will flap for a second on the receiving unit.

For instance:

Apr 22 13:52:31 bigip-ntr-b.local notice mcpd[7733]: 01071682:5: SNMP_TRAP: Virtual /Common/my_vs has become unavailable
Apr 22 13:52:31 bigip-ntr-b.local notice mcpd[7733]: 010719e7:5: Virtual Address /Common/10.0.0.71 general status changed from GREEN to RED.
Apr 22 13:52:31 bigip-ntr-b.local notice mcpd[7733]: 010719e8:5: Virtual Address /Common/10.0.0.71 monitor status changed from UP to DOWN.
<...>
Apr 22 13:52:32 bigip-ntr-b.local notice mcpd[7733]: 01071681:5: SNMP_TRAP: Virtual /Common/my_vs has become available
Apr 22 13:52:35 bigip-ntr-b.local notice mcpd[7733]: 010719e7:5: Virtual Address /Common/10.0.0.71 general status changed from RED to GREEN.
Apr 22 13:52:35 bigip-ntr-b.local notice mcpd[7733]: 010719e8:5: Virtual Address /Common/10.0.0.71 monitor status changed from DOWN to UP.

Conditions:
-- device-group configured for full manual sync
-- virtual server with default pool up and iRule pool down
-- a config sync is initiated

Impact:
There is no impact to application traffic during the flapping, as the virtual server continues to function correctly even when the unit receiving the config-sync is the Active one.

However, the logs (and the ensuing SNMP traps) may be confusing to BIG-IP Administrators and/or network operators monitoring alarms from the system.

Workaround:
You can work around this issue by configuring the device-group for incremental config-sync instead (either manual or automatic).

---

1101653-2 : Query Type Filter in DNS Security Profile blocks allowed query types

Links to More Info: BT1101653

Component: Advanced Firewall Manager

Symptoms:
When NXDomain is moved to active/enabled, a query response does not work in the GUI.

Conditions:
NXDomain field is in enable state in filtered-query-type in GUI.

Impact:
The query response fails.

Workaround:
NXDomain field should not be enabled using the GUI.
NXDomain is always response type.

---

1100721-2 : IPv6 link-local floating self-IP breaks IPv6 query to BIND

Links to More Info: BT1100721

Component: Local Traffic Manager

Symptoms:
A IPv6 link-local floating self-IP breaks IPv6 query to BIND.

Conditions:
1. Create a DNS record in BIND.
2. Create an IPv6 floating self-IP (for example, 2002::139) and place it into traffic-group-1.
3. Create an IPv6 DNS listener using the newly created self-IP (2002::139).
So far a DNS query should be answered properly by BIND and TMM.
4. Create a dummy IPv6 floating self-IP using a link-local IP (for example, fe80::4ff:0:0:202) and place it into traffic-group-1.
Now, the DNS query from outside will be timed out.

Impact:
DNS requests will get timed out.

Workaround:
None

---

1100561 : AAA: a trailing ampersand is added to serverside request when using HTTP forms based auth

Links to More Info: BT1100561

Component: Access Policy Manager

Symptoms:
An extra "&" is added to a request

Conditions:
A query is specified in a Form-Action field

Impact:
The server replies with an error due to the extra trailing & in the request from APM

Workaround:
None

---

1100249-2 : SNAT with FLOW_INIT firewall rule may core TMM due to wrong type of underlying flow structure

Links to More Info: BT1100249

Component: Local Traffic Manager

Symptoms:
Tmm crashes with SIGSEGV while passing firewall traffic.

Conditions:
-- SNAT + firewall rule
-- FLOW_INIT used in an iRule

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

---

1100197-2 : GTM sends wrong commit_id originator for iqsyncer to do gtm group sync

Links to More Info: BT1100197

Component: Global Traffic Manager (DNS)

Symptoms:
GTM may occasionally send the wrong commit_id_originator to other sync group members, causing a full sync to occur instead of an incremental one.

The following message may be seen in the /var/log/gtm log

   "Unable to do incremental sync, reverting to full load for device group /Common/gtm"

Conditions:
Frequent GTM group syncs.

Impact:
Unnecessary GTM full sync when an incremental sync would have been more efficient.

Workaround:
None

---

1100169-1 : GTM iQuery connections may be reset after SSL key renegotiation.

Links to More Info: BT1100169

Component: Global Traffic Manager (DNS)

Symptoms:
During routine iQuery SSL renegotiation, the iQuery connection will occasionally be reset.

Conditions:
This occurs occasionally during routine renegotiation. Renegotiation occurs once very 24 hours, per connection, by default (but can be controlled by the db key big3d.renegotiation.interval)

Impact:
It causes a brief disconnection between the GTMs in the sync group.

Workaround:
None

---

1099621-3 : DAG context synchronization debug instrumentation

Links to More Info: BT1099621

Component: TMOS

Symptoms:
The BIG-IP system lacks instrumentation for the exchange of tmm DAG state over the statemirror channels between high availability (HA) peers running on VELOS.

Conditions:
-- High availability (HA) pair running on VELOS

Impact:
When average application response latency increases and health checks flap and the DAG is suspected, instrumentation is unavailable.

Workaround:
None

---

1099373-2 : Virtual Servers may reply with a three-way handshake when disabled or when processing iRules

Links to More Info: BT1099373

Component: Local Traffic Manager

Symptoms:
Virtual servers may complete a three-way handshake before resetting a connection when they are disabled or when iRules process traffic for disabled virtual servers.

Conditions:
-- Virtual Server with a pool assigned
-- Pool is disabled administratively

Impact:
When a virtual server is marked as disabled and a client attempts to connect to it, tmm will normally send a reset to the first SYN packet. However, if you then administratively disable the pool ( disabled pool members - Not forced offline) tmm will complete the three-way handshake before sending resets. Additionally, when in this state, iRules will process and can pass traffic to pools if the iRule is configured to do that even though the virtual server status is disabled.

Workaround:
Avoid marking pools disabled or use forced offline for virtual servers that you want to administratively disable.

---

1097853-1 : Session Tracking screen may be missing the scroll bar after saving the configuration

Links to More Info: BT1097853

Component: Application Security Manager

Symptoms:
After pressing the Save button, the page may be refreshed without the ability to scroll down.

Conditions:
1. Go to Security ›› Application Security : Session Tracking screen.

2. Change the configuration, for example choose 'Use individual Login Pages' and move the login URL from available to Selected (under Session Tracking Configuration section).

3. Save.

Impact:
After the page is refreshed, the scroller may be not available.

Workaround:
Refresh the page again, and the scroll bar returns.

---

1096461-5 : TACACS system-auth Accounting setting has no effect when set to send-to-all-servers/send-to-first-server

Links to More Info: BT1096461

Component: TMOS

Symptoms:
If the destination address is a single server, then the accounting info is sent to only the particular server.
If the destination has multiple servers, then the accounting info is sent to all servers irrespective of the setting "auth tacacs system-auth accounting"

Conditions:
Select multiple destination addresses and change the "auth tacacs system-auth accounting" to send-to-first-server, the accounting information is sent to all the destination servers.

Impact:
You are unable to use send-to-first server functionality

Workaround:
None

---

1096317-4 : SIP msg alg zombie flows

Links to More Info: BT1096317

Component: Carrier-Grade NAT

Symptoms:
The SIP msg alg can disrupt the expiration of a connflow in a way that it stays alive forever.

Conditions:
SIPGmsg alg with suspending iRule commands attached.

Impact:
Zombie flow, which cannot be expired anymore.

Workaround:
Restart TMM.

---

1096165-4 : Tmm cored for accessing the pool after the gtm_add command is run

Links to More Info: BT1096165

Component: Global Traffic Manager (DNS)

Symptoms:
Tmm can crash

Conditions:
TMM process fails seconds after the gtm_add command is run.

Impact:
On very rare occasions, TMM can crash. Traffic disrupted while tmm restarts.

Workaround:
Reduce the number of pools and the number of region records.

---

1095973-3 : Config load failure when Trusted CA Bundle is missing and URL is present in the Bundle Manager

Links to More Info: BT1095973

Component: TMOS

Symptoms:
1. BIG-IP will come up but there will be a config load failure.
2. During the upgrade, config sync issues occur.

Conditions:
1. Bundle Manager contains URL( exclude-url/include-url)
2. Trusted CA Bundle is not populated in the Bundle Manager.

Impact:
1. BIG-IP will be in "Inoperative"/"Not All Devices Synced" state

Workaround:
Add the Trusted CA Bundle (default ca-bundle.crt) to the Bundle Manager.

OR

Remove the URLS (both exclude-url and include-url) from the Bundle Manager.

---

1095909-1 : DEBUG_NOTICE macro truncating log messages of size more than 1024

Links to More Info: BT1095909

Component: Access Policy Manager

Symptoms:
Truncated log messages are found in /var/log/apm

Conditions:
APM session variables that are large (e.g., policy_path, configVariableCatalogSessionKey)

Impact:
Some of the APM session variables are missing from /var/log/apm

---

1095205-4 : Config.auditing.forward.multiple db Variable with value "none" is not working as expected with multiple destination addresses in audit_forwarder.

Links to More Info: BT1095205

Component: TMOS

Symptoms:
When config.auditing.forward.multiple db is set to none, BIG-IP should restrict the system to send it to only one destination when multiple destination addresses are configured.

Conditions:
When configured to "none", logs are broadcasted to all the destination addresses. Working as "broadcast" mode.

Impact:
End user could not use "none" functionality

---

1094069-1 : iqsyncer will get stuck in a failed state when requesting a commit_id that is not on the target GTM

Links to More Info: BT1094069

Component: Global Traffic Manager (DNS)

Symptoms:
Too many GTM sync requests are exchanged with the devices and and the config sync may fail sometimes.

Conditions:
DNS/GTM licensed devices are configured in a sync Group. The requested commit_id is not present anymore on the target GTM device.

Impact:
Sync operations are extremely slow (5-8 minutes for a pool to show up) which may fail sometimes. Excessive network traffic.

Workaround:
None

---

1093973-7 : Tmm may core when BFD peers select a new active device.

Links to More Info: BT1093973

Component: TMOS

Symptoms:
Tmm cores.

Conditions:
-- BFD is in use
-- the active/owner BFD device changes

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

---

1093717-1 : BGP4 SNMP traps are not working.

Links to More Info: BT1093717

Component: TMOS

Symptoms:
BGP4 SNMP traps are not working and returning snmpwalk result of "BGP4-MIB::bgp = No Such Object available on this agent at this OID" or similar errors for all OIDs under the .1.3.6.1.2.1.15 MIB.

Conditions:
--Perform any BGP related event and check for snmp traps.
--Run snmpwalk -Of -Os -v 2c -c <community_name> localhost .1.3.6.1.2.1.15

Impact:
No BGP monitoring.

Workaround:
None

---

1093553-4 : OSPF "default-information originate" injects a new link-state advertisement

Links to More Info: BT1093553

Component: TMOS

Symptoms:
When configured with "default-information originate", the BIG-IP system might inject a new 0.0.0.0 link-state advertisement when receiving a default route from an OSPF neighbor.

This results in two 0.0.0.0 link-state advertisements being advertised from the box.

Conditions:
"default-information originate" is configured.

Impact:
Duplicate link-state advertisements

Workaround:
None

---

1093545-4 : Attempts to create illegal virtual-server may lead to mcpd crash.

Links to More Info: BT1093545

Component: Local Traffic Manager

Symptoms:
Mcpd crashes after the creation of virtual server with incorrect or duplicate configuration is attempted.

Conditions:
-- One or more attempts to create a virtual server with an illegal configuration are performed (i.e. attempts to create a virtual server that shares a configuration with an existing virtual server or has an incorrect configuration)

Impact:
Mcpd crashes with __GI_abort. Traffic disrupted while mcpd restarts.

Workaround:
None

---

1093313-2 : CLIENTSSL_CLIENTCERT iRule event is not triggered for TLS1.3 when the client sends an empty certificate response

Links to More Info: BT1093313

Component: TMOS

Symptoms:
When an SSL client connects to the BIG-IP system using TLS 1.3 and sends an empty certificate, the CLIENTSSL_CLIENTCERT iRule event is not triggered.

Conditions:
-- Virtual server configured on BIG-IP with SSL and iRule added
-- Client authentication for client certificates is set to "request"
-- iRule relying on CLIENTSSL_CLIENTCERT
-- A client connects to BIG-IP using TLSv1.3 protocol without a certificate(empty certificate)

Impact:
CLIENTSSL_CLIENTCERT irules aren't triggered.

Workaround:
None

---

1093061-2 : MCPD restart on secondary blade during hot-swap of another blade

Links to More Info: BT1093061

Component: Local Traffic Manager

Symptoms:
In rare instances, inserting a new blade into a VIPRION system can trigger a config error on another secondary blade due to attempting to delete the old blade's physical disk while it is still "in use":
err mcpd[7965]: 01070265:3: The physical disk (S3F3NX0J902788) cannot be deleted because it is in use by a disk bay (1).
err mcpd[7965]: 01070734:3: Configuration error: Configuration from primary failed validation: 01070265:3: The physical disk (S3F3NX0J902788) cannot be deleted because

This causes MCPD to restart on the secondary blade due to the config error.

Conditions:
-- VIPRION system with at least 3 blades
-- Remove a blade and replace it with a different one

Impact:
-- MCPD restarts on the secondary blade other than the blade that was replaced.

The config error triggering this is due to an issue with the cluster syncing process between blades; however, the config issue is temporary, and should be resolved after mcpd restarts on the secondary blade.

Workaround:
None

---

1091785-2 : DBDaemon restarts unexpectedly and/or fails to restart under heavy load

Links to More Info: BT1091785

Component: Local Traffic Manager

Symptoms:
While under heavy load, the Database monitor daemon (DBDaemon) may:
- Restart for no apparent reason
- Restart repeatedly in rapid succession
- Log the following error while attempting to restart:
   java.net.BindException: Address already in use (Bind failed)
- Fail to start (remain down) after several attempts, leaving database monitors disabled and marking monitored resources Down.

Conditions:
- One or more active GTM and/or LTM database monitors are configured with short probe-timeout, interval and timeout values (for example, 2, 5, or 16 respectively).
- A large number (for example, 2,000) of GTM and/or LTM database monitor instances (combinations of above monitor and pool member) are configured.
- Active GTM and/or LTM database monitors are configured with debug yes and/or count 0.

Impact:
The DBDaemon restarts for no apparent reason.
The DBDaemon fails to start (remain down) after several attempts, leaving database monitors disabled and marking monitored resources Down.

Workaround:
The conditions that are suspected to cause these symptoms include effects of ID1025089. Measures to prevent or reduce occurrences of ID1025089 (by reducing database monitor workload) will likely also prevent or reduce occurrences of these symptoms.

If the DBDaemon fails to restart, the following steps may allow DBDaemon to restart successfully upon the next database monitor probe:

-- Check for a running instance of DBDaemon with the following command:

ps ax | grep -v grep | grep DBDaemon

-- If DBDaemon is running, this command will return a set of parameters including the numerical process ID (PID) at the beginning of the line and a command line that begins with "/usr/lib/jvm/jre/bin/java" and includes the parameter "com.f5.eav.DBDaemon", such as:

24943 ? Ssl 46:49 /usr/lib/jvm/jre/bin/java -cp /usr/lib/jvm/jre/lib/rt.jar:/usr/lib/jvm/jre/lib/charsets.jar:/usr/share/monitors/postgresql-jdbc.jar:/usr/share/monitors/DB_monitor.jar:/usr/share/monitors/log4j.jar:/usr/share/monitors/mssql-jdbc.jar:/usr/share/monitors/mysql-connector-java.jar:/usr/share/monitors/ojdbc6.jar -Xmx512m -Xms64m -XX:-UseLargePages -DLogFilePath=/var/log/DBDaemon-0.log com.f5.eav.DBDaemon 1521 24943 0

-- If a running DBDaemon process is identified, use the "kill" command to terminate the running DBDaemon process:

kill #
(where # is the DBDaemon PID from the above "ps" command)

-- Repeat the above "ps" command to confirm that the DBDaemon process has been terminated. If a new DBDaemon process has not been started (with a different PID), proceed to the next steps.

-- Check the /var/run directory for the presence of any files with names beginning with "DBDaemon", such as:

/var/run/DBDaemon-0.lock
/var/run/DBDaemon-0.pid
/var/run/DBDaemon-0.start.lock

Note: The numeric value in the above example filenames corresponds to the Route Domain of pool members monitored by database monitors. If the database monitors are only applied to pool members in the default route domain (RD 0), that value will be "0" as seen above. If database monitors are applied to pool members in a non-default route domain (RD 7, for example), the numeric value will correspond to that route domain, such as:
/var/run/DBDaemon-7.lock
/var/run/DBDaemon-7.pid
/var/run/DBDaemon-7.start.lock

-- If no DBDaemon process is running, delete any /var/run/DBDaemon* files. It is especially important to delete:
/var/run/DBDaemon-#.start.lock (indicates DBDaemon restart is in progress and that no further restart actions should be attempted)
/var/run/DBDaemon-#.pid (indicates current DBDaemon PID)

-- If the above actions do not result in DBDaemon restarting upon the next database monitor ping, then a complete BIG-IP restart will likely be required to recover from unknown conditions within the Java subsystem that may prevent successful DBDaemon operation:

bigstart restart

or:

reboot

---

1091509-3 : SAML Artifact resolution service fails to resolve artifacts on same IP after reboot

Links to More Info: BT1091509

Component: Access Policy Manager

Symptoms:
Unable to authenticate, following error message in the APM log will occur:

<DATE> <HOSTNAME> err apmd[13026]: 0149021a:3: /Common/SPTesting_ap:Common:524ba34e: SAML Agent: /Common/SPTesting_ap_act_saml_auth_ag failed to process SAML artifact, error: Failed to resolve Artifact
<DATE> <HOSTNAME> err apmd[13026]: 01490000:3: modules/Authentication/Saml/SamlSPAgent.cpp func: "sendSAMLArtifactResolveRq()" line: 6328 Msg: Failed to connect to artifact resolution service. Error (56): Failure when receiving data from the peer
<DATE> <HOSTNAME> err apmd[13026]: 01490000:3: modules/Authentication/Saml/SamlSPAgent.cpp func: "resolveSAMLArtifact()" line: 6380 Msg: Error resolving artifact

Conditions:
- APM as SP with Artifact Resolution
- ARS service uses internal IP
- Configured serverssl profile for Artifact Resolution Service in IDP connector

Impact:
ARS will fail to resolve and users will not be able to authenticate.

Workaround:
Disable the 'serverssl-profile-name' in the IDP connector configuration.

---

1091505 : In AGC 8.0 you cannot choose from existing SSL profiles

Links to More Info: BT1091505

Component: iApp Technology

Symptoms:
In AGC, during Zero Trust >> Identity Aware Proxy configuration, in the Virtual Server Properties, the Client SSL Profile has the Use Existing selected by default and the drop-down is used to select a profile.

Profiles created at Local Traffic ›› Profiles : SSL : Client are not available in this drop-down.

Conditions:
You wish to assign a different SSL profile to the virtual server.

Impact:
SSL profiles created at Local Traffic ›› Profiles : SSL : Client are not available in the drop-down in AGC.

Workaround:
Create a SSL profile while in the AGC using the Create New option in drop-down and this will be available in future deployments.

---

1091021-2 : The BIG-IP system may not take a fail-safe action when the bigd daemon becomes unresponsive.

Links to More Info: BT1091021

Component: Local Traffic Manager

Symptoms:
You may observe LTM monitors malfunctioning on your system. For instance, you may notice some probes are not sent out on the network, and some monitored objects are showing the wrong status.

Conditions:
-- The bigd daemon consists of multiple processes (which you can determine by running "ps aux | grep bigd").

-- One or more of the processes (but not all of them) become disrupted for some reason and stop serving heartbeats to the sod daemon.

Under these conditions, sod will not take any fail-safe action and the affected bigd processes will continue running impaired, potentially indefinitely.

Impact:
LTM monitoring is impacted.

Workaround:
If you suspect this issue is occurring in your system, you can resolve it by killing all bigd processes using the following command:

pgrep -f 'bigd＼.[0-9]+' | xargs kill -9

However, this does not prevent the issue from manifesting again in the future if the cause for bigd's disruption occurs again.

Monitoring may become further disrupted as bigd restarts, and a failover may occur depending on your specific configuration.

Another work around is to set only one bigd if that is possible.
modify sys db bigd.numprocs value 1
If only a single bigd is available, sod will detect when it is down.

---

1090313-3 : Virtual server may remain in hardware SYN cookie mode longer than expected

Links to More Info: BT1090313

Component: TMOS

Symptoms:
A virtual server may remain in hardware SYN cookie mode longer than expected after the SYN flood attack has stopped. The TMSH 'show ltm virtual' command shows that the virtual has already exited SYN Cookie mode, but the SYN packets are still responded from hardware for a few minutes longer.

Conditions:
The problem is a result of a race condition in TMM, so the issue might show up intermittently.

Impact:
Discrepancy between the actual SYN Cookie mode and the reported SYN Cookie mode for a short period of time after a SYN flood attack.

Workaround:
Disable hardware SYN Cookie mode.

---

1089685-1 : [APM]Webtop loading issue when 'oneconnect' profile is attached to a virtual server

Links to More Info: BT1089685

Component: Access Policy Manager

Symptoms:
The webtop hangs intermittently.

Conditions:
-- Virtual server with 'oneconnect' profile
-- BIG-IP Version v16.1.2.1

Impact:
Unable to use resources on webtop

Workaround:
Removing 'oneconnect' profile from virtual server resolves this issue.

---

1089293 : Backend password reset is not working in Webtop when sso is disabled.

Links to More Info: BT1089293

Component: Access Policy Manager

Symptoms:
Backend password change does not work if initial credential (username) is different than the credential used for backend VMware servers.

Conditions:
1) Logon to APM webtop with user1
2) Go to VMware server application login with different user like user2, before that set the password reset option for user2 in AD
3) once the password reset is clicked you encounter an error " login to your resource failed)"

Impact:
User is unable to reset password, if the credentials are expired for backend VMware servers.

Workaround:
None

---

1089005-4 : Dynamic routes might be missing in the kernel on secondary blades.

Links to More Info: BT1089005

Component: TMOS

Symptoms:
Dynamic routes might be missing in the kernel on secondary blades.

Conditions:
- Long VLAN names (16+ characters).
- MCPD was unable to load configuration from the binary database (software update/forceload was performed).

Impact:
Kernel routes are missing on secondary blades.

Workaround:
Restart tmrouted on the affected secondary blade. Note, that this will also briefly affect TMM dynamic routes.
<bigstart restart tmrouted>

---

1088597-2 : TCP keepalive timer can be immediately re-scheduled in rare circumstances

Links to More Info: BT1088597

Component: Local Traffic Manager

Symptoms:
In rare circumstances, the TCP timer is rescheduled immediately due to the utilization of the interval encompassing also the idle_timeout.

Conditions:
Virtual Server with:

- TCP Profile
- SSL Profile with alert timeout configured

Another way this can occur is by manually deleting connections, which effectively only sets the idle timeout to 0.

Impact:
High CPU utilization potentially leading to reduced performance.

Workaround:
If the alert timeout is not re-enabled in the SSL Profile that should be sufficient.

---

1087981-2 : Tmm crash on "new serverside" assert

Links to More Info: BT1087981

Component: Local Traffic Manager

Symptoms:
TMM cores with "new serverside" assert.

Conditions:
This can occur while passing UDP traffic while tmm is under memory pressure.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

---

1087569-4 : Changing max header table size according HTTP2 profile value may cause stream/connection to terminate

Links to More Info: BT1087569

Component: Local Traffic Manager

Symptoms:
BIG-IP initializes HEADER_TABLE_SIZE to the profile value and thus when it exceeds 4K (RFC default), the receiver's header table size is still at the default value. Therefore, upon receiving header indexes which has been removed from its table, receiver sends GOAWAY (COMPRESSION_ERROR)

Conditions:
-- HTTP2 profile used in a virtual server
-- In the HTTP2 profile, 'Header Table Size' is set to a value greater than 4096

Impact:
Stream/connection is terminated with GOAWAY (COMPRESSION_ERROR)

Workaround:
Issue can be avoided by restoring the header-table-size value to the default of 4096

---

1087005-2 : Application charset may be ignored when using Bot Defense Browser Verification

Links to More Info: BT1087005

Component: Application Security Manager

Symptoms:
In some cases, when using Bot Defense Browser Verification, the application <meta charset> tag may be ignored.

Conditions:
-- Bot Defense Profile is attached to a virtual server.
-- Bot Defense "Browser Verification" is configured to "Verify Before Access" or "Verify After Access"
-- Backend application uses non-standard charset.

Impact:
Random meta chars are viewed in the web page.

Workaround:
Run the command:
tmsh modify sys db dosl7.parse_html_inject_tags value "after,body"

---

1086473-3 : BIG-IP resumes a TLS session on the client-side but then proceeds to do a full handshake

Links to More Info: BT1086473

Component: Local Traffic Manager

Symptoms:
When a client attempts to resume the TLS session using the Session-ID in its Client Hello from a previous session, the BIG-IP agrees by using the same Session-ID in its Server Hello, but then proceeds to perform a full handshake (Server Hello, Certificate, Server Key Exchange, Certificate Request, Server Hello Done) instead of an abbreviated handshake (Server Hello, Change Cipher Spec, Server Hello Done).

This is a violation of the TLS RFC.

Conditions:
- High availability (HA) pair of two BIG-IP units.
- LTM virtual server with a client-ssl profile.
- Mirroring enabled on the virtual server

Impact:
Client-side TLS session resumption not working.

Workaround:
Disable mirroring on the virtual server

---

1086393-1 : Sint Maarten and Curacao are missing in the GTM region list

Component: TMOS

Symptoms:
Sint Maarten and Curacao are missing in the GTM region list.

Conditions:
- Create a GTM region record.
- Create a GTM region of Country Sint Maarten or Curacao.

Impact:
Cannot select Sint Maarten and Curacao from the GTM country list.

Workaround:
None

---

1084965-3 : Low visibility of attack vector

Links to More Info: BT1084965

Component: Local Traffic Manager

Symptoms:
The DoS vector FIN 'Only Set' is not triggered and causes lack of visibility of the attack vector.

Conditions:
-- Using BIG-IP Virtual Edition

Impact:
There is reduced visibility of possible attacks on the BIG-IP.

Workaround:
Check 'drop_inv_pkt' with the tmctl table, "tmm/ndal_rx_stats".

---

1084901-1 : Updating the firewall rule list for IPv6 with route domain throws an error in the GUI, works from tmsh

Links to More Info: BT1084901

Component: Advanced Firewall Manager

Symptoms:
You are unable to modify IPV6 + Route domain for Network Firewall Rule Lists using the GUI

Conditions:
-- AFM is provisioned
-- IPv6 with route domain is being used in an address list

Impact:
Unable to create/manage Firewall rule lists for IPv6 with a route domain.

Workaround:
Use tmsh to create/manage firewall rule lists for IPv6 with a route domain.

---

1084133-1 : At device level ICMP frags are not counting for BA and BD

Links to More Info: BT1084133

Component: Advanced Firewall Manager

Symptoms:
BD stats are not counting due to this attack was not opened at BD level.

Conditions:
Configure BD for ICMP at device level.

Impact:
Stats not incrementing and attack will not be detected.

Workaround:
None

---

1083621-1 : The virtio driver uses an incorrect packet length

Links to More Info: BT1083621

Component: Local Traffic Manager

Symptoms:
In some cases, tmm might drop network packets.

In rare circumstances, this might trigger tmm to crash.

Conditions:
BIG-IP Virtual Edition using the virtio driver. You can see this in /var/log/tmm ("indir" is zero):
  notice virtio[0:5.0]: cso: 1 tso: 0 lro: 1 mrg: 1 event: 0 indir: 0 mq: 0 s: 1

Impact:
Tmm might drop packets.

In rare circumstances, this might trigger tmm to crash. Traffic disrupted while tmm restarts.

Workaround:
None

---

1083589-3 : Some connections are dropped on chained IPv6 to IPv4 virtual servers.

Links to More Info: BT1083589

Component: Local Traffic Manager

Symptoms:
IPv6 virtual servers targeting IPv4 virtual servers (for example, using the 'virtual' iRule command) might drop traffic coming from some clients unexpectedly.

Note: See also ID1002945 (https://cdn.f5.com/product/bugtracker/ID1002945.html), which is a closely related issue.

Conditions:
- IPv6 to IPv4 virtual server chaining.

Impact:
Traffic is dropped.

Workaround:
Apply a SNAT with an IPv4 address to the IPv6 virtual server.

---

1083405-3 : "Error connecting to named socket" from zrd

Links to More Info: BT1083405

Component: Global Traffic Manager (DNS)

Symptoms:
After an mcpd restart, zrd may not be able to re-establish a connection to named. This shows up in the /var/log/gtm file or in the GUI with a message similar to the following:

err zrd[27809]: 01150306:3: Error connecting to named socket 'Connection refused'.
(or)
err zrd[16198]: 01150306:3: Error connecting to named socket 'Connection timed out'.

Conditions:
After an mcpd restart

Impact:
Looking up or modifying zone records may fail.

Workaround:
Restart zrd and named

tmsh restart sys service zrd named

---

1083053-2 : Apmd memory grows over time in AD auth scenarios

Links to More Info: BT1083053

Component: Access Policy Manager

Symptoms:
Apmd memory grows over time. It is not a memory leak. It is mainly due to memory fragmentation due to memory sharing among apmd threads.

Conditions:
The access policy in use has Active Directory auth as one of the agents

Impact:
Apmd memory grows over time. After it grows beyond a limit, oom killer might kill apmd thereby lead to a traffic disruption.

Workaround:
None

---

1082197-1 : RNAME and MNAME field order reversed for Synthetic SOAs sent for negative response

Links to More Info: BT1082197

Component: Global Traffic Manager (DNS)

Symptoms:
Synthetic SOA returned by BIG-IP has the MNAME and RNAME fields reversed, resulting in the wrong values being noted as the primary name server and mailbox of administrator, respectively.

Conditions:
-- Set the failure-rcode-response enabled and failure-rcode-ttl on a down WIP.
-- Perform a DNS query.
-- Observe the SOA.

Impact:
Per RFC (rfc1035) the order of the fields is significant and MNAME must come before RNAME. When reversed, consumers of the synthetic SOA will associate the wrong values with the wrong fields.

---

1082193-3 : TMSH: Need to update the version info for SERVER_INIT in help page

Links to More Info: BT1082193

Component: TMOS

Symptoms:
The SERVER_INIT iRule event was introduced in version 14.0.0. But in tmsh help it is showing as version 13.1.0.

Conditions:
-- Using tmsh to configure an iRule event
-- The BIG-IP version is 13.1.0 and you use tab complete for 'tmsh help ltm rule event SERVER_INIT'

Impact:
The tmsh help makes it appear as if SERVER_INIT is supported in version 13.1.0 when it is not.

Workaround:
None

---

1082133-3 : iSeries LCD displays "Host inaccessible or in diagnostic mode"

Component: TMOS

Symptoms:
On rare occasions, when booting up an iSeries BIG-IP system, the LCD may continuously display "Host inaccessible or in diagnostic mode" for an extended period of time

Conditions:
This can occur when booting up an iSeries BIG-IP system.

Impact:
LCD is unusable until the system is rebooted.

Workaround:
Wait 5 minutes.
If the LCD is still displaying "Host inaccessible or in diagnostic mode" after this time period, reboot the BIG-IP system.

---

1081473-5 : GTM/DNS installations may observe the mcpd process crashing

Links to More Info: BT1081473

Component: Global Traffic Manager (DNS)

Symptoms:
1) The mcpd process may crash, potentially leading to failover/momentary traffic disruption while system components restart

2) Log entries refering to the 'iqsyncer' module similar to the following may be observed prior to the crash

notice mcpd[32268]: 01070751:5: start_transaction received without previous end_transaction - connection 0x62773308 (user %iqsyncer)
notice mcpd[6269]: 010714a0:5: Sync of device group /Common/gtm to commit id 17072 7051583675817774674 /Common/abcd.xyz 0 from device %iqsyncer complete.
notice mcpd[6269]: 01070418:5: connection 0x64c0c008 (user %iqsyncer) was closed with active requests

3) Log entries similar to the following may be observed indicating failure and restart in the mcpd component:

err icr_eventd[11664]: 01a10003:3: Receive MCP msg failed: Can't recv, status: 0x1020046
warning snmpd[8096]: 010e0004:4: MCPD query response exceeding 270 seconds.
err icr_eventd[11664]: 01a10003:3: Receive MCP msg failed: Can't recv, status: 0x1020046
notice sod[9497]: 01140041:5: Killing /usr/bin/mcpd pid 12325.
warning sod[9497]: 01140029:4: high availability (HA) daemon_heartbeat mcpd fails action is restart.
crit tmsh[31348]: 01420001:2: The connection to mcpd has been lost, try again. : framework/RemoteMcpConn.cpp, line 74
crit tmsh[31434]: 01420001:2: The connection to mcpd has been lost, try again. : framework/RemoteMcpConn.cpp, line 74
info sod[9497]: 010c0009:6: Lost connection to mcpd - reestablishing.
err mysqlhad[17260]: 014e0006:3: MCP Failure: 1.

Conditions:
DNS/GTM installation with syncgroup members actively exchanging configuration items.

The issue happens rarely unless a lot of configuration changes occur on one of the syncgroup members, which needs to be carried over.

Impact:
Traffic disrupted while mcpd restarts.

Workaround:
None

---

1081285-1 : ASM::disable iRule command causes HTTP2 RST_STREAM response when MRF is enabled

Links to More Info: BT1081285

Component: Application Security Manager

Symptoms:
Requests are reset and an error is observed in /var/log/ltm

"ASM::enable is not supported in a child context"

Conditions:
-- HTTP2 client and server enabled on a virtual server
-- MRF profile (httprouter) attached to the virtual server
-- ASM policy and DoS profile attached to the virtual server

Impact:
Web application functionality fails

Workaround:
N/A

---

1080985-1 : Route Domain ID specified in Address list does not take effect on virtual server IP via TMC.

Component: Local Traffic Manager

Symptoms:
An incorrect virtual server is created because of a non-existent virtual address.

Conditions:
-- Address list is created with an IP addresses on a non-default route domain.
-- Traffic matching criteria is created by assigning the above address list without specifying a route domain.
-- Assign the above traffic matching criteria (TMC) object to the virtual server.

Impact:
The virtual server that is created does not function properly due to the incorrect virtual address.

Workaround:
Set the route-domain of the traffic-matching criteria to an appropriate route-domain value.

(tmos)# modify ltm traffic-matching-criteria <TMC_name> route-domain <route_domain_name>.

---

1080957-4 : TMM Seg fault while Offloading virtual server DOS attack to HW

Links to More Info: BT1080957

Component: Advanced Firewall Manager

Symptoms:
TMM crashes during virtual server DOS attack scenarios.

Conditions:
-- HSB-equipped hardware platforms.
-- The attack is detected on configured virtual server Dos Vector and trying to offload to hardware.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

---

1080925-3 : Changed 'ssh-session-limit' value is not reflected after restarting mcpd

Links to More Info: BT1080925

Component: TMOS

Symptoms:
Change 'ssh-session-limit' field from 'disabled' to 'enable'. Save the config . Restart the mcpd and check the value of the field 'ssh-session-limit'. It appears to be the same 'disabled'.

Conditions:
The issue occurs when MCPD restores the configuration from its binary database file.

Impact:
Enabling and disabling "ssh-session-limit" will have an undesirable effect when creating ssh sessions, and you will not be able to edit the field.

Workaround:
None

---

1079985-3 : int_drops_rate shows an incorrect value

Links to More Info: BT1079985

Component: Advanced Firewall Manager

Symptoms:
int_drops_rate shows an incorrect value, it shows a cumulative value instead of an avg value, same as int_drops and syncookies.hw_syncookies.

Conditions:
A tcp-halfOpen attack or similar SYN attack where SYNs are flooded into the BIG-IP system.

Impact:
It is difficult to figure out the drop rate per second

Workaround:
None

---

1079237-1 : After certain configuration tasks are performed, TMM may run with stale SNAT translation parameters.

Links to More Info: BT1079237

Component: Local Traffic Manager

Symptoms:
A SNAT translation object instantiated by performing specific configuration tasks (see Conditions) does not work.

For example:

- Connections might be reset with cause "No available SNAT addr".

- An unexpected IP address might be used to SNAT the outgoing traffic.

Conditions:
This issue is known to occur when one of the following operations is performed:

- Restoring a UCS or SCF archive in which a SNAT translation with a specific name specifies a different IP address or route domain.

- Performing a config-sync between redundant units in which the sender changes a SNAT translation with a specific name to use a different IP address or route domain.

- Performing specific tmsh CLI transactions involving SNAT translation modifications.

Impact:
The system does not use the configured SNAT translation address. Traffic will be impacted as a result (for example, reset connections or incorrect source IP address in outgoing traffic).

Workaround:
Restart TMM (bigstart restart tmm) on affected units.

---

1079053-1 : SSH Proxy feature is not working in FIPS Licensed platforms

Links to More Info: BT1079053

Component: Advanced Firewall Manager

Symptoms:
AFM SSH is not working when FIPS license is enabled.

Conditions:
When you configure AFM SSH Proxy and enable FIPS License.

Impact:
AFM SSH-related features such as, SCP and SFTP cannot be used.

Workaround:
NA

---

1078741-2 : Tmm crash

Links to More Info: BT1078741

Component: Local Traffic Manager

Symptoms:
Tmm crashes while processing an iRule while handling traffic.

Conditions:
-- HTTP virtual server
-- HTTP profile with explicit proxy having default-connect-handling allowed
-- iRule with SERVER_CONNECTED event

Impact:
Traffic disrupted while tmm restarts.

---

1078357-2 : HTTP_REJECT processing can lead to zombie SPAWN flows

Links to More Info: BT1078357

Component: Local Traffic Manager

Symptoms:
Due to the presence of a specific set of events in the iRule, the Bloom filter may cause TCL to execute an event that is not implemented in the iRule.

In the execution of a sequence of events, when TCL attempts to execute the non-existing event, it follows a path which in turn makes SPAWN flow to become a zombie.

Conditions:
-- http2, client-ssl, optimised-caching filters on the virtual server
-- HTTP::respond iRule with LB_FAILED event and set of iRules like HTTP_REQUEST, HTTP_RESPONSE, CLIENTSSL_HANDSHAKE, CACHE_RESPONSE, ASM_REQUEST_BLOCKING
-- send http2 request through the virtual server

Impact:
Causes issues with monitoring system

---

1077789-4 : System might become unresponsive after upgrading.★

Links to More Info: BT1077789

Component: TMOS

Symptoms:
After upgrading, the system encounters numerous issues:

-- Memory exhaustion (RAM plus swap) with no particular process consuming excessive memory.
-- High CPU usage with most cycles going to I/O wait.
-- System is unresponsive, difficult to log in, slow to accept commands.
-- Provisioning is incomplete; there is a small amount of memory amount assigned to 'host' category.

Conditions:
-- The configuration loads in the previous release, but does not load successfully on the first boot into the release you are upgrading to.
-- Device is upgraded and the configuration is rolled forward.
-- There may be other conditions preventing the configuration from loading successfully after an upgrade.

Exact conditions that trigger this issue are unknown and could be varied. In the environment in which it occurs, a datagroup is deleted, but an iRule still references it.

Impact:
-- System down, too busy to process traffic.
-- Difficulty logging in over SSH might require serial console access.

Workaround:
Reboot to an unaffected, pre-upgrade volume.

-- If the system is responsive enough, use 'tmsh reboot volume <N>' or switchboot to select an unaffected volume.

-- If the system is completely unresponsive, physically powercycle a physical appliance or reboot a BIG-IP Virtual Edition (VE) from an applicable management panel, and then select an unaffected volume from the GRUB menu manually.

Note: This requires that you have console access, or even physical access to the BIG-IP device if you are unable to SSH in to the unit. On a physical device, a non-responsive system might require that you flip the power switch.

For more information, see:
-- K9296: Changing the default boot image location on VIPRION platforms :: https://support.f5.com/csp/article/K9296
-- K5658: Overview of the switchboot utility :: https://support.f5.com/csp/article/K5658
-- K10452: Overview of the GRUB 0.97 configuration file :: https://support.f5.com/csp/article/K10452.

---

1077293-2 : APPIQ option still showing in BIG-IP GUI even though its functionality migrated to BIG-IQ.

Links to More Info: BT1077293

Component: TMOS

Symptoms:
AppIQ is still visible in the System :: Configuration screen.

Conditions:
Navigating to the System :: Configuration : AppIQ page.

Impact:
AppIQ appears to be able to be provisioned but it has been removed from the BIG-IP system.

Workaround:
N/A

---

1076801-4 : Loaded system increases CPU usage when using CS features

Component: TMOS

Symptoms:
When the BIG-IP system is under heavy load, datasyncd might create multiple java obfuscator processes running at the same time, which increases load even more.

Conditions:
-- CPU utilization on the BIG-IP system is high.

And one or more of the following conditions:

-- Bot Defense profile is attached to a virtual server
-- DoS profile with CS/Captcha mitigation is attached to the virtual server
-- ASM policy with brute force configuration is attached to the virtual server

Impact:
System load is increased.

Workaround:
None.

---

1076477-2 : AFM allows deletion of a firewall policy even if it's being used in a route domain.

Links to More Info: BT1076477

Component: Advanced Firewall Manager

Symptoms:
AFM allows you to delete a firewall policy that is still applied to a route domain.

Conditions:
A firewall policy is created and assigned to a route domain.

Impact:
The firewall policy can be deleted without warning or error.

Workaround:
Before deleting a firewall policy check to make sure it is not being used in any route domain.

---

1076165-1 : GRPC traffic does not work with DoSL7.

Links to More Info: BT1076165

Component: Application Security Manager

Symptoms:
GRPC trailers are not passing from server to client.

Conditions:
DoSL7 profile is attached to a gRPC virtual server.

Impact:
GRPC traffic is not passing correctly.

Workaround:
N/A

---

1075905-3 : TCP connections may fail when hardware SYN Cookie is active

Links to More Info: BT1075905

Component: TMOS

Symptoms:
When an object is in hardware SYN Cookie mode, some of the valid connections are also rejected with a "No flow found for ACK" reset cause.

Conditions:
VELOS and rSeries platforms.

Impact:
Service degradation.

Workaround:
Disable hardware SYN Cookie on all objects (virtual server, VLAN, and so on).

---

1075545 : Changing the datasyncd activation-epoch results in high CPU usage for 24 hours

Links to More Info: BT1075545

Component: Fraud Protection Services

Symptoms:
Changing the datasync activation time by creating a new datasync profile results in double the amount of obfuscation processes running simultaneously.

Conditions:
Creating a new datasync profile with a different activation-epoch

Impact:
High CPU usage for up to 24 hours

---

1075469-1 : DNS GUI: Refreshing a DNS Express record sometimes fails to populate the server.

Links to More Info: BT1075469

Component: Global Traffic Manager (DNS)

Symptoms:
Although there are name servers for the non-common partition, the Server field populates as "None".

Conditions:
-- Updating the DNS express record by performing enable/disable operations.

Impact:
DNS express Server is shown as None for a DNS zone record.

Workaround:
Refresh the page and it will display the correct value.

---

1075045-1 : Proxy initialization failed, Defaulting to DENY, after applying additional profile to a virtual server

Links to More Info: BT1075045

Component: Local Traffic Manager

Symptoms:
Connections are reset when accessing a virtual server, with an F5 reset cause of "Port denied".

Messages in /var/log/ltm:

err tmm[<PID>]: 01010008:3: Proxy initialization failed for <virtual server>. Defaulting to DENY.
err tmm[<PID>]: 01010008:3: Listener config update failed for <virtual server>: ERR:ERR_MEM

Conditions:
-- Virtual server configured with many profiles
-- Adding an additional profile to the virtual server

Impact:
All connections to the virtual server are immediately reset.

Workaround:
Reduce the number of profiles applied to the virtual server.

---

1075001-2 : Types 64-65 in IPS Compliance 'Unknown Resource Record Type'

Links to More Info: BT1075001

Component: Protocol Inspection

Symptoms:
Protocol Inspection compliance type 'Unknown Resource Record Type' (ID 10002) lists ranges of type ID numbers (62-98, 110-248, 259-32767, 32770-65535) that are considered 'unknown'. The hard-coded ranges include 64 (SVCB) and 65 (HTTPS), which is not accurate for some types of configurations. The inability to specify the ranges in 'Unknown Record Type' may impact some traffic because there are increasing numbers of DNS queries with Type ID of 64 - SVCB and 65 - HTTPS - (still in draft) observed with the introduction of iOS 14 and macOS 11.

Conditions:
When DNS profile in IPS 'Unknown Resource Record Type' is configured as Rejected.

Impact:
DNS request records with 64 and 65 are blocked. The severity of this impact depends on your traffic.

Workaround:
Although there is no workaround, you can install an updated Protocol Inspection IM package (pi_updates_15.1.0-20220215.0652.im or later) from the F5 Downloads site under the ProtocolInspection-LatestUpdate entry on the version-specific downloads page.

---

1074841-1 : Invalid syslog configuration kills syslog-ng after restarting syslog-ng.

Links to More Info: BT1074841

Component: TMOS

Symptoms:
Syslog-ng is stopped after restarting syslog-ng with an invalid syslog configuration.

Conditions:
--Invalid syslog-ng configuration.
--bigstart restart syslog-ng

Impact:
Syslog-ng is stopped.

Workaround:
N/A

---

1074513-3 : Traffic class validation does not detect/prevent attempts to add duplicate traffic classes to virtual

Links to More Info: BT1074513

Component: TMOS

Symptoms:
Tmm crashes after adding a traffic class.

Conditions:
-- Virtual server with two traffic classes
-- A third traffic class is added via tmsh

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

---

1074053-1 : Delay in displaying the "Now Halting..." message while performing halt from LCD.

Links to More Info: BT1074053

Component: TMOS

Symptoms:
While halting the system from LCD panel, the "Now Halting..." message takes 90 seconds to appear.

Conditions:
Perform the system halt operation from the LCD front panel.

Impact:
Delay in processing the halt operation.

Workaround:
N/A

---

1073965-1 : IPsec IKEv2 tunnel may report huge "life" for IKE SA.

Links to More Info: BT1073965

Component: TMOS

Symptoms:
The output of "tmsh show net ipsec ike-sa" will report an impossibly high life value.

tmsh show net ipsec ike-sa | grep Life
  Life/Active Time: 18446744073709551028/6 seconds

Decrypting the IKE AUTH payload will show something similar to this:

        Decrypted Data (160 bytes)
            Contained Data (156 bytes)
                Payload: Identification - Responder (36)
                Payload: Authentication (39)
                Payload: Security Association (33)
                Payload: Traffic Selector - Initiator (44) # 1
                Payload: Traffic Selector - Responder (45) # 1
                Payload: Notify (41) - AUTH_LIFETIME
                    Next payload: NONE / No Next Payload (0)
                    0... .... = Critical Bit: Not Critical
                    .000 0000 = Reserved: 0x00
                    Payload length: 12
                    Protocol ID: RESERVED (0)
                    SPI Size: 0
                    Notify Message Type: AUTH_LIFETIME (16403)
                    Notification DATA: fffffdb4
                    Authentication Lifetime: 4294966708 seconds (1193046 hour(s) 18 minute(s) 28 second(s))
            Padding (3 bytes)
            Pad Length: 3

Conditions:
-- IKEv2
-- BIG-IP is initiator
-- Responder sends very high value (close to maximum possible in 4 byte payload) for Authentication Lifetime in IKE AUTH phase.

Impact:
In general this is not a problem unless the DPD/liveness is disabled and the remote peer silently goes away. Under perfect conditions, the remote peer would send a delete for the IKE SA to the BIG-IP and cause the BIG-IP (as initiator) to start a new IKE SA as required.

Workaround:
Ensure the remote peer sends a more reasonable value such as 1 day for the IKE AUTH lifetime.

Strongswan devices have been observed to send a very high value when configured with an unreasonably low "ikelifetime" (in the order of a few minutes).

---

1073897-2 : TMM core due to memory corruption

Links to More Info: BT1073897

Component: Local Traffic Manager

Symptoms:
Tmm restarts

Conditions:
Unknown

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

---

1073673-1 : Prevent possible early exit from persist sync

Links to More Info: BT1073673

Component: Global Traffic Manager (DNS)

Symptoms:
When a new GTM is added to the Sync group, it takes a significant amount of time, and the newly added GTM won't become ready.

Conditions:
-- GTMs in a cluster with a large number of persist records
-- A new GTM device is added

Impact:
Clients of the BIG-IP GTM do not receive an answer, and application failures may occur.

Workaround:
None

---

1073429-1 : Auth partition definition is incorrectly synchronized to peer and then altered.

Links to More Info: BT1073429

Component: TMOS

Symptoms:
An auth partition definition with "device-group none" and "traffic-group none" is incorrectly synchronized to other devices during a full config-sync.

Specifically, the partition is incorrectly synchronized to all other devices that belong to the device-group to which the /Common partition is associated.

Furthermore, the receiving devices incorrectly alter the definition of said partition, in such a way that the definition no longer specifies "device-group none" and "traffic-group none". Instead, this partition will now have inheritance (from the root folder) enabled for both the device-group and traffic-group properties.

Conditions:
Creating an auth partition (for example /Example) which specifies "device-group none" and "traffic-group none" on redundant units, and then issuing a full config sync to the device-group.

Note that even if your device-group is configured to perform incremental syncs, sometimes performing a full sync between devices is a natural and unavoidable event.

Impact:
The definition of an auth partition that was meant to remain local to a given BIG-IP system is incorrectly synchronized to peer devices. Additionally, its device-group and traffic-group properties are altered so that inheritance from the root folder is now enabled.

Initially, this has no other negative consequences, as the configuration objects contained in the "local partition" of the source device are not synchronized. However, a further config sync from the initial receiving device to the initial source device will overwrite the device-group and traffic-group properties there. Once in this state, the unit that contains configuration objects in the "local partition" will synchronize them to the peers during the next config-sync. This can impact the application traffic based on the objects synchronized.

Workaround:
You cannot work around this issue.

However, you may be able to achieve your goal of having a repository for local-only objects by creating a subfolder to the /Common partition rather than creating a new partition.

For example:

tmsh create sys folder /Common/local device-group none traffic-group none

---

1073273-1 : RESOLVER::name_lookup not returning truncated responses

Links to More Info: BT1073273

Component: Global Traffic Manager (DNS)

Symptoms:
The iRule RESOLVER::name_lookup function will not return DNS answers when the query response is larger than 4096 bytes.

Conditions:
Send a query through RESOLVER::name_lookup where the expected answer returned would be greater than 4096 bytes.

Impact:
Even if there are valid answers to be returned, no answers will be returned if the size of the response packet is greater than 4096 bytes.

---

1072397-1 : VLAN failsafe failover does not occur in three-node device group

Links to More Info: BT1072397

Component: Local Traffic Manager

Symptoms:
VLAN failsafe fails to activate the next-active device in a device group.

Conditions:
-- Three devices in a sync/failover device group
-- A VLAN goes down on the active device, or is unable to communicate with the device group

Impact:
-- VLAN failsafe does not trigger and the next-active device does not become active

---

1072377-3 : TMM crash in rare circumstances during route changes

Links to More Info: BT1072377

Component: Local Traffic Manager

Symptoms:
TMM might crash in rare circumstances when static/dynamic route changes.

Conditions:
Dynamic/static route changes.

Impact:
TMM can crash or core. Traffic processing stops during process restart.

Workaround:
None

---

1072173-1 : The BIG-IP system incorrectly presents legacy ways of defining mirroring properties

Links to More Info: BT1072173

Component: TMOS

Symptoms:
The 'sys state-mirroring' section in tmsh, as well as the following db keys, are deprecated and should not be used to define the mirroring properties of a device:

sys db statemirror.ipaddr
sys db statemirror.peeripaddr
sys db statemirror.secondary.ipaddr
sys db statemirror.secondary.peeripaddr
sys db statemirror.state

If you wish to configure the mirroring properties of a BIG-IP device, please use the 'cm' section in tmsh, or use the configuration utility under Device Management > Devices.

Each device only needs to set its own properties, for instance:

tmsh modify cm device bigip-ntr-a.local mirror-ip 10.0.0.60
tmsh modify cm device bigip-ntr-a.local mirror-secondary-ip 192.168.1.60

Conditions:
BIG-IP Administrator configuring mirroring properties.

Impact:
Using one of the deprecated ways to configure mirroring will not achieve the intended result. These may be removed from the product in a future version to avoid confusion and errors.

Workaround:
None

---

1072081-1 : Imish segmentation fault when running 'ip pim sparse-mode ?' on interface config.

Links to More Info: BT1072081

Component: TMOS

Symptoms:
Imish crahses and produces a core file.

Conditions:
-- Add PIM to a route-domain
-- Run 'ip pim sparse-mode ?' while on imish configuration mode on interface level

Impact:
No real impact.

Workaround:
N/A

---

1071701-1 : VE rate limit should not count packet that does not have a matched vlan or matched MAC address

Links to More Info: BT1071701

Component: Local Traffic Manager

Symptoms:
Virtual Edition (VE) Rate limit counts packets that are not intended for BIG-IP.

Conditions:
-- Rate-limited license in BIG-IP Virtual Edition (VE)
-- Promiscuous mode is enabled

Impact:
If you do not have an unlimited license for a Virtual Edition device, you cannot use VLAN tags or MAC Masquerading without a greatly increased risk of running out of licensed bandwidth. Even if you are not using any service, BIG-IP counts all traffic seen on the interface against the license. Due to VMWare's switch design you have to expose the device to all of the traffic to use those two features.

---

1071385-3 : SSL session resumption is incorrectly logging handshake failure messages

Links to More Info: BT1071385

Component: Local Traffic Manager

Symptoms:
Handshake failure messages are logged when the handshake was successful.

Conditions:
-- Client establishes connection with session resumption option

Impact:
Inaccurate information in log.

Workaround:
None

---

1071021-1 : Some URLs such as *cdn.onenote.net configured in the Office 365 dynamic address space are not processed by APM

Links to More Info: BT1071021

Component: Access Policy Manager

Symptoms:
Dynamic address space parser not accepting few patterns(*cdn.example.net) which are added at the DNS address space field.

Conditions:
When the user configures Office 365 Dynamic Address Space with URLs formats like:

 *-admin.sharepoint.com
 *cdn.onenote.net
 *-files.sharepoint.com
 *-myfiles.sharepoint.com

Impact:
Due to the above pattern DNS relay proxy is not compatible with them.

Workaround:
N/A

---

1070957-1 : Database monitor log file backups cannot be rotated normally.

Links to More Info: BT1070957

Component: Local Traffic Manager

Symptoms:
Debug log files used by the BIG-IP database monitor daemon (DBDaemon) do not exhibit the log-rotation behavior of other BIG-IP log files.
- The active DBDaemon log file is /var/log/DBDaemon-0.log
- DBDaemon log file size is limited to approximately 5MB. DBDaemon log files are backed up/rotated upon reaching this size.
- Exactly 9 (nine) DBDaemon log file backups are retained (/var/log/DBDaemon-0.log.[1-9])
- DBDaemon log file backups are not compressed.
- DBDaemon log file backup/rotation behavior is not user-configurable.

Conditions:
This issue applies when using BIG-IP database monitors:
-- mssql
-- mysql
-- oracle
-- postrgresql

Impact:
-- DBDaemon log file backups may consume more space under /var/log than desired.
-- When troubleshooting database monitor issues, DBDaemon log file rotation may occur so rapidly that older DBDaemon events may be lost, limiting the ability to capture meaningful diagnostic data.

Workaround:
It may be possible to work around this issue by periodically archiving DBDaemon log files, such as in a script with the following core functionality:
pushd /var/log;tar -czf DBDaemon_$(date +%Y%m%d%H%M).tgz DBDaemon-0.log*;popd

---

1070953-4 : Dnssec zone transfer could cause numerous gtm sync events.

Links to More Info: BT1070953

Component: Global Traffic Manager (DNS)

Symptoms:
GTM syncs for zone transfers that happen on other GTMs.

Conditions:
Dnssec zone transfer to client on peer GTM in the same GTM sync group.

Impact:
Numerous GTM sync and possible sync storm.

Workaround:
N/A

---

1070393-1 : The f5_api_com.crt certificate file may be removed by the load sys config command

Links to More Info: BT1070393

Component: TMOS

Symptoms:
The BIG-IP downloads an f5_api_com.crt certificate file when a production BIG-IP license is installed, but a subsequent "load sys config" reverts to the pre-certificate config, and deletes (tidies up) the file.

Conditions:
-- Activate a BIG-IP license in either the GUI or tmsh (this causes the f5 API certificate to be downloaded and installed into the config)
-- Run 'tmsh load sys config'
-- Observe that the f5_api_com.crt object is no longer present in the BIG-IP config.

Impact:
F5_api_com.crt certificate file is not present on the BIG-IP system.

Workaround:
- Ensure that "tmsh save sys config" is run after installing a new BIG-IP license.

- If the certificate has been removed from the BIG-IP configuration, but is still present in the filesystem, you can import it with the expected name (f5_api_com.crt): "tmsh create sys file ssl-cert f5_api_com.crt source-path file:///config/ssl/ssl.crt/f5_api_com.crt"

- If the certificate has been lost, you can re-activate the license, to cause a new API certificate to be pulled down from the F5 license server.

---

1070181-3 : Secondary MCPD crashes with Configuration error

Links to More Info: BT1070181

Component: Local Traffic Manager

Symptoms:
MCPD crashes with an error:
Configuration error: In Virtual Server (/Common/vip-test) an http2 profile with enforce-tls-requirements enabled is incompatible with client ssl profile '/Common/test-reneg-2'; renegotiation must be disabled

Conditions:
Virtual server with
-> http2 profile - 'enfore-tls-requirements' enabled
-> client-ssl profile 1 - 'renegotiation' disabled
-> client-ssl profile 2 - 'renegotiation' enabled

Impact:
MCPD crashes on the non-active device.

Workaround:
Disable 'enforce-tls-requirements' of http2 profile

---

1070141-1 : The SNAT Automap and self IP address selection.

Links to More Info: BT1070141

Component: Local Traffic Manager

Symptoms:
When a snat pool member is deleted, POOL_FLAG_HOMOGENEOUS is not re-set properly when the pool member is deleted.

Conditions:
-- SNAT pool with two members in multiple networks
-- One pool member is deleted such that all SNAT pool members are on the same network.

Impact:
The pool is not treated as homogenous after the change. This can cause a potential performance degradation or incorrect selection of SNAT pool members.

Workaround:
N/A

---

1069441-3 : Cookie without '=' sign does not generate rfc violation

Links to More Info: BT1069441

Component: Application Security Manager

Symptoms:
If a request includes a Cookie header that only contains the name of the cookie without an equal sign (=) and a corresponding value, it might not result in a violation as expected according to the RFC (Request for Comments) specifications.

Conditions:
-Set Cookie not RFC-compliant to 'Block'
-Request with Cookie header with name only, for example 'Cookie:a'

Impact:
The request is not blocked.

---

1069137-2 : Missing AWAF sync diagnostics

Links to More Info: BT1069137

Component: Application Security Manager

Symptoms:
Complex issues related to Policy Synchronization over Device Sync Groups are difficult to diagnose.
More detailed logging is needed if errors occur.

Conditions:
Device Group Sync is enabled.

Impact:
Root cause analysis is lengthy and difficult.

Workaround:
Enable debug logs in the environment:
> tmsh modify sys db log.asm.asmconfiglevel value debug
> tmsh modify sys db log.asm.asmconfigvent.level value debug
> tmsh modify sys db log.asm.asmconfigverbose.level value debug

---

1069113-1 : ASM process watchdog should be less aggressive

Links to More Info: BT1069113

Component: Application Security Manager

Symptoms:
During standard operation a process is expected to exit and be restarted once it has exceeded a certain memory limit. As a failsafe, the watchdog forcefully kills the process if it exceeds a higher threshold. But if the handler was running close to the memory limit before a resource-intensive event like a full sync load, this operation could push it over both limits.

Conditions:
An ASMConfig handler is running close to the memory limit before a resource intensive event, like a full sync load.

Impact:
A process may be killed in the middle of a data-integrity sensitive action, like a device-group sync, which can leave the system in a corrupt state.

Workaround:
Modify the memory limits in nwd.cfg to raise it by 100 MB.

To load the configuration change, restart the asm_config_server process.

Impact of workaround: Performing the following procedure should not have a negative impact on your system:

1. Log in to the BIG-IP system command line.
2. To restart the asm_config_server process, type the following command:
"pkill -f asm_config_server"

Note : Restarting the asm_config_server process does not disrupt traffic processing.

The BIG-IP ASM watchdog process automatically restarts the asm_config_server process within 10 to 15 seconds.

---

1069001 : TMM crash in TLS/SSL processing

Links to More Info: BT1069001

Component: Local Traffic Manager

Symptoms:
TMM crashes with a SIGSEGV.

Conditions:
Unknown.

Impact:
Traffic disrupted while TMM restarts.

Workaround:
None

---

1067917-1 : Attaching iRule DOSL7::enable when mitigation is not enabled at dosl7 profile, it is not showing warning in GUI.

Links to More Info: BT1067917

Component: Application Security Manager

Symptoms:
Attaching iRule DOSL7::enable to virtual server when same virtual server attached to dosl7 profile without mitigation enables. It is able to attach iRule the successful but same steps is giving error in 13.1.3.6
"1070151:3: Rule [/Common/<iRulename>] error: Unable to find profile_dos (<dos profile name>) referenced at line 3: [DOSL7::enable <dosl7 profile name>]"

Conditions:
Create dosl7 profile without any mitigation enabled and have iRule
when HTTP_REQUEST {

 DOSL7::enable test
}

Attach iRule to virtual server.

Impact:
No warning is shown, but the rule causes an error in the logs and does not apply.

Workaround:
Enable the mitigation in order to attach this DOSL7::enable method.

---

1067857-7 : HSB completion time out causes unexpected reboot

Links to More Info: BT1067857

Component: TMOS

Symptoms:
A bad_tlp_status message closely follows a completion_time_out_status message in the /var/log/sel file, Following is an example:
CPU 0 PCI/DMI Error B:D.F 0:3.2: corerrsts: bad_tlp_status
CPU 0 PCI/DMI Error B:D.F 0:3.2: rperrsts: error_fatal_nonfatal_received
CPU 0 PCI/DMI Error B:D.F 0:3.2: rperrsts: non_fatal_error_messages_received
CPU 0 PCI/DMI Error B:D.F 0:3.2: uncerrsts: completion_time_out_status

Conditions:
This issue is known to occur on the following platforms:

- i2600
- i2800
- i4600
- i4800

Impact:
The device unexpectedly reboots.

Workaround:
None

---

1067821-1 : Stats allocated_used for region inside zxfrd is overflowed

Links to More Info: BT1067821

Component: Global Traffic Manager (DNS)

Symptoms:
No visible symptoms.

Conditions:
Large resource record addition and deletion for dns express zones.

Impact:
Internal zxfrd stats are incorrect.

---

1067653-2 : Ndisc6 is not working with non-default route domain.

Links to More Info: BT1067653

Component: TMOS

Symptoms:
Ndisc6 within a Route-Domain (rdexec <rd-id> ndisc6
<ipv6-address> <interface-name>) does not work if the route domain ID passed is not the default route domain.

Conditions:
A non-default route domain is used and a VLAN is assigned to it.

Impact:
Neighbor discovery for the non-default route domain will not work.

Workaround:
N/A

---

1067469-4 : Discrepancy in virtual server stats with LRO enabled.

Component: Local Traffic Manager

Symptoms:
The virtual_server_stat table has a discrepancy in clientside.bytes_out and serverside.bytes_in with LRO enabled.

Conditions:
LRO is enabled (sys db tm.tcplargereceiveoffload value "enable").

Impact:
The virtual_server_stat table shows a difference in clientside.bytes_out and serverside_bytes_in when LRO is enabled.

Workaround:
Disable LRO using the following command:
tmsh modify sys db tm.tcplargereceiveoffload value disable

After modifying that variable, the virtual server stats need to be reset in order to clear historical stats using the following command: tmsh reset-stats ltm virtual

Otherwise TMM can be restarted to clear the stats.

---

1067405-3 : TMM crash while offloading / programming bad actor connections to hardware.

Links to More Info: BT1067405

Component: Advanced Firewall Manager

Symptoms:
TMM crashes while passing traffic. From the core analysis, this issue looks specific to some platforms(i4800 c115).

Conditions:
This might occur when bad actor detection is enabled in BIG-IP platforms.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
This issue is platform specific and seen only when BA actor detection is enabled.

---

1067309-1 : GTMD cored followed by TMM core SIGSEGV due to illegal GTM server reference.

Links to More Info: BT1067309

Component: Global Traffic Manager (DNS)

Symptoms:
TMM, gtmd cores while passing traffic.

Conditions:
A rare race condition between TMM and GTMD occurs while passing traffic.

Impact:
Traffic disrupted while tmm and gtmd restarts.

Workaround:
N/A

---

1067025-4 : Rate-shaping + immediate timeout causing connection to stall.

Links to More Info: BT1067025

Component: Local Traffic Manager

Symptoms:
Server-side connection stalls if rate-limit is reached for a connection that has a timeout value set to immediate.

Conditions:
-- Rate-limit configured and reached.
-- Profile has immediate timeout configured.

Impact:
No packets are sent to the server.

Workaround:
Configure a timeout value on a protocol profile.

---

1066397-1 : GTM persists to last resort pool members even when primary pool members become available.

Links to More Info: BT1066397

Component: Global Traffic Manager (DNS)

Symptoms:
DNS Queries are persisted to the last resort pool members after the primary pool comes back.

Conditions:
-- WideIP with persistence enabled
-- Disable primary pool members with the queries answered from the last resort pool
-- Now re-enable the primary pool members

Impact:
DNS Queries are persisted to the last resort pool members after the primary pool comes back.

Workaround:
N/A

---

1065821-4 : Cannot create an iRule with a newline between event and opening brace.

Links to More Info: BT1065821

Component: TMOS

Symptoms:
POST-ing to the BIG-IP REST API fails when creating an iRule.

Conditions:
iRule body has a newline after the event name.

For example:
"apiAnonymous": "when HTTP_REQUEST＼n {...}"

Working:
"apiAnonymous": "when HTTP_REQUEST {...}"

Impact:
The iRule fails to create and you receive a warning about an unknown property.

{
    "code": 400,
    "message": "＼"{＼" unknown property",
    "errorStack": [],
    "apiError": 26214401
}

Workaround:
Format the iRule to not use newlines between the event name and opening brace.

Change from:
"apiAnonymous": "when HTTP_REQUEST＼n {...}"

To:
"apiAnonymous": "when HTTP_REQUEST {...}"

---

1065681-1 : Sensitive data is not masked under certain conditions.

Links to More Info: BT1065681

Component: Application Security Manager

Symptoms:
Sensitive data (or part of it) is visible in the request logs or the remote log.

Conditions:
A parameter that is defined as a JSON profile. That profile has the parse parameters flag set.

Impact:
Sensitive data is visible in the log.

Workaround:
There are 2 possible workarounds:
1. Make the parameter that contains the json a sensitive parameter.
2. In the json profile attached to the parameter, uncheck the parse parameters flag. You will see a tab of sensitive data added in the UI. In that tab, explicitly add the JSON element as a sensitive element.

---

1065353-1 : Disabling ciphers does not work due to the order of cipher suite.

Links to More Info: BT1065353

Component: Local Traffic Manager

Symptoms:
You are not able to disable a list of ciphers.

Conditions:
The cipher list is given in an order in the tmsh command 'tmm --clientciphers'

Impact:
Inconsistent behavior of the command "tmm --clientciphers".

Workaround:
Reorder the ciphers in the list and pass the reordered list to "tmm --clientciphers".

---

1065013-4 : Tmm crash with iRuleLX plugin in use

Links to More Info: BT1065013

Component: Local Traffic Manager

Symptoms:
Tmm runs out of memory and crashes.

Conditions:
Exact conditions that trigger this are unknown:

-- iRuleLX provisioned and configured in one or more virtual servers
-- Network traffic is passing

Impact:
Traffic disrupted while tmm restarts.

---

1064893-1 : Keymgmtd memory leak occurrs while configuring ca-bundle-manager.

Links to More Info: BT1064893

Component: TMOS

Symptoms:
Keymgmtd leaks memory and the RES/RSS value increases over time.

Same issue can be observed using top -p `pidof keymgmtd` or tmctl proc_pid_stat proc_name=keymgmtd -s proc_name,vsize,rss monitor keymgmtd resident memory size.

Conditions:
Configure sys crypto ca-bundle-manager to periodically update the ca bundle on the system.

Impact:
If keymgmtd causes a system wide out of memory condition, this could cause a traffic disruption, if mcpd is chosen to be killed.

Workaround:
N/A

---

1064753-4 : OSPF LSAs are dropped/rate limited incorrectly.

Links to More Info: BT1064753

Component: TMOS

Symptoms:
Some LSAs are dropped on BIG-IP with a log similar to:
"LSA is received recently".

Conditions:
Tuning OSPF min LSA arrival has no effect on some LSA handling.

Impact:
OSPF LSAs are dropped/rate limited incorrectly.

Workaround:
N/A

---

1064725-4 : CHMAN request for tag:19 as failed.

Links to More Info: BT1064725

Component: Local Traffic Manager

Symptoms:
The following log is seen in /var/log/ltm when a qkview is generated:

warning chmand[6307]: 012a0004:4: CHMAN request (from qkview) for tag:19 failed.

or when a tcpdump capture is started:

warning chmand[792]: 012a0004:4: CHMAN request (from bigpcapq33E5-24) for tag:19 failed

or when get a dossier from GUI/CLI:

warning chmand[4319]: 012a0004:4: CHMAN request (from get_dossier) for tag:19 failed

or when reboot:

warning chmand[8263]: 012a0004:4: CHMAN request (from mcpd) for tag:19 failed
warning chmand[8263]: 012a0004:4: CHMAN request (from DossierValidator) for tag:19 failed
warning chmand[8263]: 012a0004:4: CHMAN request (from LACPD_USER) for tag:19 failed
warning chmand[8263]: 012a0004:4: CHMAN request (from get_dossier) for tag:19 failed

Conditions:
Any one of the following:

-- Generate a qkview file from the GUI/CLI
-- Start a tcpdump command from the CLI
-- Get a dossier from GUI/CLI
-- Reboot

Impact:
No functional impact.

Workaround:
None

---

1064649-2 : Tmm crash after upgrade.★

Links to More Info: BT1064649

Component: Local Traffic Manager

Symptoms:
After upgrading and provisioning the ASM module, TMM starts to crash and core.

Conditions:
-- BIG-IP system is upgraded to version 15.1.4.1.
-- The ARL table is empty (transparent VLAN group) and traffic is passed.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
N/A

---

1064257-2 : Bundled SSL certificates may not get revalidated successfully over OCSP after stapling parameters have been modified.

Links to More Info: BT1064257

Component: TMOS

Symptoms:
Bundled SSL certifcates fail to validate with an OCSP responder, and they are marked invalid in the GUI and tmsh.

Conditions:
1. One or more bundled certificates (containing intermediate certificates in addition to the subject one) are stored on the BIG-IP.
2. The certificates are configured for monitoring over OCSP.
2. The OCSP stapling parameter "Trusted Responders" is set to 'none'.

Impact:
Client SSL traffic may become disrupted if the affected certificates are used to process it.

Workaround:
1. Do not use OCSP status monitoring on subject certificates.
OR
2. Do not use bundled certificates.
OR
3. Set the Trusted Responders OCSP stapling parameter to the certificate of the OCSP responder used by the certificates.

---

1064205-1 : GSLB virtual server's status can't be changed from the drop-down selection box on its properties page.

Links to More Info: BT1064205

Component: Global Traffic Manager (DNS)

Symptoms:
The status of the GSLB virtual server associated with the GSLB server does not get changed through selection in the drop-down box in front of "Status".

Conditions:
1. Open the properties page of one GSLB virtual server after reaching from DNS ›› GSLB : Servers : Server List ›› Virtual Servers.
2. Change the value in the drop-down box in front of the "Status" field and click the "Update" button.

Impact:
The status of the GSLB virtual server can't be changed from its own properties page.

Workaround:
The status of one or multiple virtual servers can be changed on page DNS ›› GSLB : Servers : Server List ›› Virtual Servers by selecting the desired ones and selecting "Enable" or "Disable" buttons.

---

1063865-7 : Blade remains in an INOPERATIVE state after being moved to new chassis.

Links to More Info: BT1063865

Component: Local Traffic Manager

Symptoms:
When moving a blade to a new chassis, it can remain in an INOPERATIVE state upon startup. The following errors can be found in /var/log/ltm:

slot2 notice mcpd[7042]: 01071029:5: Master Key not present.
slot2 err csyncd[8163]: 013b0004:3: Unable to subscribe to mcpd, disconnecting...

Conditions:
- Multi-bladed BIG-IP systems
- Move a blade from one chassis to an open slot in the other chassis

Impact:
The moved blade will not properly sync up with the rest of the system, and remain INOPERATIVE.

Workaround:
This occurs due to the master key not being propagated to the moved blade. You can manually circumvent this by doing the following (this assumes slot 1 is primary and slot 2 has the moved blade):

Back up the master keys first (optional):
1. On the primary slot:
cp /config/bigip/kstore/master /var/tmp/master_slot1
2. On the moved slot:
cp /config/bigip/kstore/master /var/tmp/master_slot2

Copy the master key to the moved slot:
1. On the primary slot:
scp /config/bigip/kstore/master root@slot2:/config/bigip/kstore/master
2. On the moved slot:
bigstart restart mcpd

---

1063829-1 : Zxfrd could run out of memory because zone db files are not efficiently recycled.

Links to More Info: BT1063829

Component: Global Traffic Manager (DNS)

Symptoms:
Zxfrd is killed because of "Out of memory".

Conditions:
Dns express zones are updated continuously.

Impact:
Zxfrd keeps restarting.

Workaround:
Delete zxfrd files and restart zxfrd.
If sys db dnsexpress.hugepages is 0, run:
# rm -rf /shared/zxfrd/*
# bigstart restart zxfrd

 
If sys db dnsexpress.hugepages is 1, run:
# rm -rf /dev/mprov/zxfrd/*
# bigstart restart zxfrd

---

1063681-2 : PCCD cored, SIGSEGV in pc::cfg::CMessageProcessor::modify_fqdn.

Links to More Info: BT1063681

Component: Advanced Firewall Manager

Symptoms:
Pccd (Packet Correlation Classification Daemon) generates a core while adding a fqdn during testing.

Conditions:
Conditions to trigger the core are unknown.

Impact:
Pccd crashes and creates a core file.

Workaround:
Restart PCCD

---

1063609 : "Failed to start Jitterentropy Gatherer Daemon" encountered during boot

Links to More Info: BT1063609

Component: TMOS

Symptoms:
During PXE installation or software upgrade, the following is logged at first-time boot:
[[1;31mFAILED[0m] Failed to start Jitterentropy Gatherer Daemon.
[ 11.071830] See 'systemctl status jitterentropy-rngd.service' for details.systemd-fsck

Conditions:
-- First boot after PXE install.
-- First boot after software upgrade.

Impact:
The device will reboot itself after the first boot after PXE installation or software upgrade.

Workaround:
None

---

1063597-1 : Memory leak in rewrite in some cases when no pool is selected on virtual server

Links to More Info: BT1063597

Component: TMOS

Symptoms:
In some cases a memory leak may occur in rewrite when none of the pools are selected on a virtual server

Conditions:
-- Rewrite profile added to a virtual server
-- LTM pool not selected

Impact:
Memory allocated to rewrite will not be released resulting in exhaustion of all the available memory and system becoming us-stable

Workaround:
Ensure that a pool is always selected, this can be done by adding a default pool to the virtual server.

---

1063261-4 : TMM crash is seen due to sso_config objects.

Links to More Info: BT1063261

Component: Access Policy Manager

Symptoms:
Observed a TMM crash once which is due to unfreed sso_config objects in SAML.

Conditions:
Conditions are unknown, this was only seen once.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
N/A

---

1063173-2 : Blob size consistency after changes to pktclass.

Links to More Info: BT1063173

Component: Performance

Symptoms:
Blob size grows after making changes to pktclass that should reduce the size.

Conditions:
Making changes to pktclass.

Impact:
The BIG-IP system premature hits blob size limits while making changes which can result in validation issues preventing the pktclass from loading.

Workaround:
Change sys db key "pccd.alwaysfromscratch" to true.

---

1062901-1 : The 'trap-source' and 'network' SNMP properties are ineffective, and SNMP traps may be sent from an unintended interface.

Links to More Info: BT1062901

Component: TMOS

Symptoms:
The BIG-IP system sends SNMP traps from an unintended interface (likely a TMM VLAN instead of the management port).

Conditions:
This issue occurs when the configuration:

- Includes a 'trap-source' property which matches the BIG-IP system's management IP address.

- Includes a SNMP trap destination which specifies 'mgmt' as the 'network' property.

- Includes routes to the aforementioned SNMP trap destination via both tmm and the management port (and the routes are such that the tmm one wins).

Impact:
Outgoing snmp traps fail to bind to the management IP address and to leave from the management port. Instead, they will bind to a self-ip matching TMM's route to the destination and leave from a TMM VLAN.

This can cause issues (or not work at all) depending on the configuration of the host system meant to receive the traps and/or of the surrounding network devices.

Workaround:
N/A

---

1062857-3 : Non-tmm source logs stop populating after a system time change.

Links to More Info: BT1062857

Component: TMOS

Symptoms:
Syslog-ng service functionality leads to failures like no daemon logs being captured in files like
- /var/log/ltm and
- /var/log/messages.

Conditions:
Change the system date and time to future or past, and then reboot the system.

Impact:
Expected TMM logs rest all daemons logs are not captured at /var/log/ltm, due to syslog-ng failure.

Workaround:
None

---

1062105-3 : For specific configurations (Auto-Added Signature Accuracy and Case Sensitive parent policy), child security policy fails to create.

Links to More Info: BT1062105

Component: Application Security Manager

Symptoms:
1. Creation of child security policy fails when it should not.
2. GUI shows wrong value for Auto-Added Signature Accuracy in creation page of the child policy.

Conditions:
1. Create a parent policy with the following settings:

   - Policy is Case Sensitive set to disable.
   - Auto-Added Signature Accuracy set to low.

Note: these values are not the default values related to the template used in the policy. For example: Fundamental, Comprehensive, and RDP templates.

2. Try to create a policy using the above parent policy.

Impact:
Creation of child policy

Workaround:
Send REST command with minimumAccuracyForAutoAddedSignatures field under 'signature-settings' and not from the outer level.

---

1061929-2 : Unable to perform IPI update (through proxy) after upgrade to 15.1.4.★

Links to More Info: BT1061929

Component: Advanced Firewall Manager

Symptoms:
After upgrading, the IPI database fails to update. During system start, iprepd logs an error:
"Cannot connect to host api.bcti.brightcloud.com: No route to host".

Conditions:
IPI update occurs through a proxy server.

Impact:
IPI update fails.

Workaround:
N/A

---

1061905-3 : Adding peer unit into device trust changes the failover address family.

Links to More Info: BT1061905

Component: TMOS

Symptoms:
In Device Management >> Devices >> [self device] > Failover Network.
Address Family Mode resets back to "IPv4 & IPv6" instead of already set configuration i.e. IPv4 when a new peer unit is added.

Conditions:
-- Add a new device into the device trust.
-- Set both devices to "IPv4".
-- Join the devices in device trust.

Impact:
Inconsistent configuration

Workaround:
Modify the address family to IPv4 manually after adding the peer.

---

1060833-2 : After handling a large number of connections with firewall rules that log or report translation fields or server side statistics, TMM may crash.

Links to More Info: BT1060833

Component: Advanced Firewall Manager

Symptoms:
TMM crashes.

The 'virt_cnt' column in the tmctl 'string_cache_stat' table continues to grow over time, and diverges significantly from the 'phys_cnt' column.

Conditions:
-- Enforced AFM firewall policies configured in multiple contexts (global, route domain, virtual server)

-- Large number of connections that matches rules in multiple contexts

-- AFM configured in at least one of the following ways:

--+ Stats collection enabled and collecting server-side stats enabled. Stats collection is enabled by default. Collecting server-side statistics ("security analytics settings acl-rules { collect-server-side-stats }") is not enabled by default.
--+ ACL logging enabled, and the logging of translation fields enabled.

Impact:
Traffic is disrupted while TMM restarts.

Workaround:
Disable logging and reporting of server-side information in AFM firewall ACLs.

After making these changes, it may be necessary to restart TMM once.

---

1060769-1 : The /mgmt/tm/sys/performance/all-stats and /mgmt/tm/sys/performance/throughput iControl REST endpoints cannot be successfully parsed by common JSON libraries.

Links to More Info: BT1060769

Component: TMOS

Symptoms:
Because of identically-named key/value pairs in the "entries" object returned by the /mgmt/tm/sys/performance/all-stats and /mgmt/tm/sys/performance/throughput iControl REST endpoints, the output of these endpoints cannot be successfully parsed by common JSON-parsing libraries.

Only the key/value pair appearing last for a given name is returned by common JSON-parsing libraries.

As a result, the In/Out/Service sections of the output, which should show both Throughput(bit) and Throughput(packets) only shows Throughput(packets).

Conditions:
Querying the /mgmt/tm/sys/performance/all-stats or /mgmt/tm/sys/performance/throughput iControl REST endpoints.

Impact:
Common JSON-parsing libraries are unable to extract all of the information contained in the JSON blob (only a subset of the information is returned).

Workaround:
If possible, use the TMSH utility from the CLI of the BIG-IP system to display the complete information.

---

1060721-2 : Unable to disable auto renew in Certificate order manager via GUI.

Links to More Info: BT1060721

Component: TMOS

Symptoms:
From the GUI, you are unable to disable auto-renew on the certificate order manager.

Conditions:
In the GUI navigate to System > Certificate Management > Traffic Certificate Management > Certificate Order Manager List > Create.
Then select the any certificate Authority items, then disable Auto-renew.

Impact:
In Certificate order manager, auto-renew can not be disabled from the GUI.

Workaround:
Issue the following command from tmsh to disable auto-renew in cert-order manager.

tmsh modify sys crypto cert-order-manager <cert_order_manager_name> auto-renew no

---

1060541-1 : Increase in bigd CPU utilization from 13.x when SSL/TLS session resumption is not utilized by HTTPS pool members due to Open SSL upgrade

Links to More Info: BT1060541

Component: Local Traffic Manager

Symptoms:
The bigd process uses more CPU than it did in previous versions when HTTPS monitors are used for pool members and the pool members do not resume the SSL/TLS session. This is due to upstream changes in the OpenSSL library.

Conditions:
-- HTTPS monitors.
-- Pool members that do not allow or are not using TLS/SSL session resumption.

Impact:
High CPU utilization.

Workaround:
Ensure the pool members have SSL/TLS session resumption enabled.

---

1060393-1 : Extended high CPU usage caused by JavaScript Obfuscator.

Links to More Info: BT1060393

Component: Fraud Protection Services

Symptoms:
The Obfuscator process (compiler.jar) consumes excessive CPU for an extended period.

Conditions:
Any one of these conditions:

-- FPS is provisioned
-- ASM is provisioned and a Bot profile is attached to a virtual server
-- ASM Policy with a ClientSide feature enabled is attached to a virtual server
-- DoS profile with Captcha/CSI mitigation is attached to a virtual server

Impact:
High CPU usage on the device.

Workaround:
None

---

1060369-1 : HTTP MRF Router will not change serverside load balancing method

Links to More Info: BT1060369

Component: Local Traffic Manager

Symptoms:
Selecting a different load balancing mechanism (i.e. an iRule or Local Traffic Policy selecting a different pool/node, the "virtual" command, etc) does not work for subsequent HTTP/1.x requests on a keep-alive connection.

Conditions:
-- "HTTP MRF Router" virtual server (virtual server has an "httprouter" profile attached)
-- Virtual server is handling HTTP/1.x traffic

Impact:
Traffic is load-balanced to incorrect destination.

Workaround:
None.

---

1060181-3 : SSL handshakes fail when using CRL certificate validator.

Links to More Info: BT1060181

Component: TMOS

Symptoms:
Some SSL handshakes are reset with "SSL Handshake timeout exceeded" reset.

Conditions:
Client SSL profile with CRL certificate validator.
Client SSL certificate authentication enabled.

Impact:
SSL handshakes fail.

Workaround:
None

---

1059573-4 : Variation in a case insensitive value of an operand in LTM policy may fail in some rules.

Links to More Info: BT1059573

Component: Local Traffic Manager

Symptoms:
LTM policy engine compiles a policy into a state machine. If there is a variation of the same case insensitive value for an operand, the state machine may fail to properly build all rules, using this value. An example of a variation is a list of words like "Myself", "myself", "MYself", "mySElf", "MYSELF".

Conditions:
-- LTM policy is configured and attached to a virtual server.
-- The policy has variation in a case insensitive value of an operand.

Impact:
An expected rule does not apply: either a wrong rule is applied, or no rule is applied, causing incorrect traffic processing.

Workaround:
Eliminate variation in any case insensitive value of any operand. For example, replace all variations in the mentioned list with "myself".

---

1059421-4 : Bot Signature is not updated when the signature rule is updated.

Component: Application Security Manager

Symptoms:
In some cases, when you update a user-defined Bot Signature rule, the new rule is not applied.

Conditions:
-- Bot Defense profile is attached to virtual server
-- A user-define bot signature is updated

Impact:
Updated signature is not enforced.

Workaround:
-Delete the Bot Signature rule
-Add another Bot Signature rule
-Check to see that all changes are applied

---

1059293-1 : During DPD config changes, the IKEv2 tunnel may not start.

Links to More Info: BT1059293

Component: TMOS

Symptoms:
One peer does not come up.

Conditions:
Continuously changing the timer values, i.e. phase1, phase2 and DPD values.

Impact:
The BIG-IP system may be unable to establish a tunnel for one peer.

Workaround:
N/A

---

1058873 : Configuring source address as "address list" in a virtual server causes APMD to restart

Links to More Info: BT1058873

Component: Access Policy Manager

Symptoms:
APMD continue to restart with a denied message.

The following errors are logged in /var/log/apm:

01490000:5: ha_util.cpp func: "getTgInfoByVAddrName()" line: 292 Msg: MCP query failed (error 0x1020036)

01490000:3: DeviceHA.cpp func: "checkApmTrafficGroup()" line: 35 Msg: high availability (HA) util returns err 3

01490000:3: ApmD.cpp func: "main_loop()" line: 851 Msg: Check APM traffic group failed

Conditions:
The source or destination address is configured as "address list" in at least one virtual server configured to use APM.

Impact:
Unable to connect to the BIG-IP.

Workaround:
Do not use "address list" while configuring the source or destination IP address of a virtual server that has an access policy attached.

---

1058789-2 : Virtual addresses are not created from an address list that includes an IP address range.

Links to More Info: BT1058789

Component: TMOS

Symptoms:
The virtual address is listed as offline regardless of the status of the virtual server. This makes understanding virtual-address status very difficult.

Conditions:
Create virtual server using a traffic-matching-criteria (TMC) address list.

Impact:
The virtual addresses are created but the BIG-IP system shows all of them as offline enabled regardless of the status of the virtual server.

Workaround:
None

---

1058765-2 : Virtual Addresses created from an address list with prefix all say Offline (enabled)

Links to More Info: BT1058765

Component: TMOS

Symptoms:
Virtual Addresses created from an address list with prefix all say Offline (enabled)

Conditions:
Using the prefix in the address-list which is used for virtual server configuration.

Impact:
Improper status of the virtual address.

---

1058665-1 : Bot signature with a semicolon followed by a space is not detected.

Component: Application Security Manager

Symptoms:
When creating a user-defined Bot Signature, semicolon followed by space cannot be used.

Conditions:
-- Using a user-defined Bot Signature in Simple mode.
-- There is a semicolon followed by a space in the User-Agent or URL sections.

Impact:
The signature is not detected.

Workaround:
Escaping the semicolon in the signature created as "|3B|".

---

1058645-2 : ipsecalg blocks Sophos ISAKMP negotiation during tunnel setup.

Links to More Info: BT1058645

Component: Advanced Firewall Manager

Symptoms:
Sophos IPsec clients cannot connect to a Sophos firewall when ipsecalg is configured on the forwarding virtual server.

The Sophos client initially attempts to start the tunnel using aggressive mode. The Sophos firewall does not support remote users attempting aggressive mode and responds with Notify Message Type INVALID-PAYLOAD-TYPE. The tunnel setup cannot proceed correctly after that point.

Conditions:
-- Sophos client is installed on remote user devices.
-- Sophos firewall is the remote endpoint in the IPsec tunnel.

Note: The Sophos client and firewall combination is the only known failing use-case.

Impact:
Sophos clients cannot start an IPsec tunnel.

Workaround:
The Sophos client cannot be configured to use main mode instead of starting with aggressive mode. The Sophos firewall does not support aggressive mode for remote user IPsec tunnels.

Therefore, create an iRule and add the iRule to the ipsecalg virtual server. The iRule simply contains this:

when SERVER_DATA {
# Only execute on first server side packet of conflow.
event disable

if { [UDP::payload length] < 40 } { return; }
binary scan [UDP::payload] x8x8cH2cx9x10S payload_type ver exch_type noti_type

# Depending on throughput, the amount of logging here may be problematic
#log local0. "payload_type : $payload_type"
#log local0. "ver : $ver"
#log local0. "exch_type : $exch_type"
#log local0. "noti_type : $noti_type"

if { $payload_type == 11 && $ver == 10 && $exch_type == 5 && $noti_type == 1 } {
log local0. "Closing ipsecalg connection"
after 1 { reject }
}
}

---

1058349-3 : Requirement of new signatures to detect IMO and Google Duo service.

Component: Traffic Classification Engine

Symptoms:
Google Duo voice call and IMO applications are not blocking.

Conditions:
On Latest IM with PEM policy and TC policy.

Impact:
Traffic throttling will not work on IMO and DUO app.

Workaround:
N/A

---

1057925-4 : GTP iRule generates a warning.

Links to More Info: BT1057925

Component: TMOS

Symptoms:
Merging GTP config generates a warning.

cat ltm rule GTP_Rate_Limmit {
when CLIENT_DATA {

        set gtp_message [GTP::parse [UDP::payload]]
        set ie_list [GTP::ie get list -message $gtp_message -type 87]
        #set ie_list [GTP::ie get list -type 97 -message $gtp_message]


        foreach ie $ie_list {

                set fteid_value [lindex $ie 5]
                set interface_type [lindex $fteid_value 2]
                set ipv4_addr [lindex $fteid_value 4]

                log local0. "$fteid_value,$interface_type,$ipv4_addr"

        }

}
}
ltm rule GTP_Rate_Limmit {
when CLIENT_DATA {

        set gtp_message [GTP::parse [UDP::payload]]
        set ie_list [GTP::ie get list -type 87 -message $gtp_message]

        foreach ie $ie_list {

                set fteid_value [lindex $ie 5]
                set interface_type [lindex $fteid_value 2]
                set ipv4_addr [lindex $fteid_value 4]

                log local0. "$fteid_value,$interface_type,$ipv4_addr"

        }

}
}


root@(sr)(cfg-sync Standalone)(Active)(/Common)(tmos)# load sys config merge file gtprule.conf
Merging GTP rule config generates warning.

 /var/local/scf/gtprule.conf
There were warnings:
/Common/GTP_Rate_Limmit:4: warning: [The following errors were not caught before. Please correct the script in order to avoid future disruption. "invalid '-type'; expected:-message"93 47][GTP::ie get list -type 87 -message $gtp_message]

Conditions:
This error occurs every the time the GTP config is merged.

Impact:
Config merge shows a warning.

Workaround:
Change
set ie_list [GTP::ie get list -type 87 -message $gtp_message]
to
set ie_list [GTP::ie get list -message $gtp_message -type 87]

---

1057713-2 : "South Sudan" is missing from the ASM Geolocation Enforcement list.

Component: Application Security Manager

Symptoms:
South Sudan is not available as a selection in ASM's Geolocation Enforcement configuration.

Conditions:
South Sudan was not added into ASM database.

Impact:
There is no way to set the country code for "South Sudan" under 'Allowed Geolocations.'

Workaround:
N/A

---

1057709-4 : Invalid Certificate for all BIG-IP VE OVA images on vCenter 7.0U2.

Links to More Info: BT1057709

Component: TMOS

Symptoms:
When deploying all BIG-IP VE OVA/OVF images, vCenter 7.0U2 will display an invalid certificate (not trusted) warning message. This is due to enhanced signing certificate verifications for expiry, and other validity checks for the entire chain of the signing certificate against the VECS store (known vCenter issue https://kb.vmware.com/s/article/84240).

Conditions:
Login to vCenter 7.0U2, deploy a BIG-IP VE using an OVF template, select the Local File option, upload the OVA template from your local directory, and then follow the prompts to complete the deployment. In the review details section, "The certificate is not trusted" warning message appears.

Impact:
You can ignore the message and continue with the deployment, or add the missing signing certificate(s) to the VECS store.

Workaround:
To avoid this warning, do the following to add the signing certificate to the VECS store:

1. Get the OVF/OVA signing certificate's chain (root CA and intermediate certificates, if any). You can use any certificate chain resolver to find the missing certificates from the chain.
2. To add the intermediate and root certificates to VECS store:
    a. login to vCenter as administrator.
    b. From drop-down menu select administration -> Certificates -> Certificate Management.
    c. Click ADD next to Trusted Roots Certificates.
    d. Browse and select the certificate(s) found in step 1.

---

1057561 : Occasional Nitrox5 zip engine hang.

Links to More Info: BT1057561

Component: Local Traffic Manager

Symptoms:
Occasionally the Nitrox5 zip engine hangs.

In /var/log/ltm:
crit tmm12[24794]: 01010025:2: Device error: n5-compress1 Nitrox 3, Hang Detected: compression device was reset (pci 09:01.5, discarded 1).

Conditions:
BIG-IP appliance that uses the Nitrox 5 hardware compression chip: i11800.

You can check if your platform has the nitrox5 by running the following command:

tmctl -w 200 compress -s provider

provider
--------
bzip2
lzo
nitrox5 <----
qat-com
zlib

Impact:
The Nitrox5 hardware compression system becomes unavailable and the compression mode switches to software compression. This can lead to high CPU usage.

Workaround:
Disable http compression

---

1057557-5 : Exported policy has greater-than sign '>' not escaped to '&gt;' with response_html_code tag.

Links to More Info: BT1057557

Component: Application Security Manager

Symptoms:
The greater-than sign '>' is not escaped/converted to '&gt;' with response_html_code tag.

Having an un-escaped greater-than sign can cause issues when re-importing the policy, if the greater-than sign appears in a specific sequence, ']]>'. In other words, if the greater-than sign does not appear in the specific sequence, you can successfully re-import the policy without problem.

The specific sequence can be possible with a custom response page configuration. If you modify the custom response page in the way it has a sequence of characters ']]>', as the greater-than sing won't be escaped due to this bug, the exported policy has the sequence of characters ']]>' as is. Note: what it should be is ']]&gt;'

']]>' in xml is CDATA End delimiter and not allowed. The exported policy causes parser error and can not be re-imported.

Conditions:
This issue occurs if you modify the default custom response page where this specific character sequence is observed ']]>'.

Impact:
The exported policy cannot be re-imported.

Workaround:
This workaround forces the greater-than sing to be escaped to '&gt;' so that that policy can be re-imported without problem.

- make /usr writable
# mount -o remount,rw /usr

- backup
# cp /usr/local/share/perl5/F5/ExportPolicy/XML.pm /usr/local/share/perl5/F5/ExportPolicy/XML.pm.orig

- see this line exists
# grep "gt;" /usr/local/share/perl5/F5/ExportPolicy/XML.pm
            $xml =~ s/&gt;/>/g;

- delete the line and verify
# sed -i '/$xml =~ s＼/&gt;.*/d' /usr/local/share/perl5/F5/ExportPolicy/XML.pm

- should not see the line
# grep "gt;" /usr/local/share/perl5/F5/ExportPolicy/XML.pm

- move /usr read-only
mount -o remount,ro /usr

- make the change in effect
# pkill -f asm_config_server

---

1057501-4 : Expired DST Root CA X3 resulting in http agent request failing.

Links to More Info: BT1057501

Component: TMOS

Symptoms:
When the DST Root CA X3 is expired, any HTTP agent request fails with the error:

err tmm2[19302]: Rule /Common/my_rule <HTTP_REQUEST>: Client - <address>, failure :proxyInterstitialPage: FetchError: request to <url> failed, reason: certificate has expired.

Conditions:
The DST Root CA X3 certificate is expired, see
https://letsencrypt.org/docs/dst-root-ca-x3-expiration-september-2021/.

Impact:
ILX plugins that reply on outbound HTTP client/agent requests to remote servers fail.

Workaround:
Create a /var/tmp/isrgrootx1.pem with contents of https://letsencrypt.org/certs/isrgrootx1.pem.txt.

The Node.js script:
# cat /var/tmp/CustomCA-2.js
var fs = require('fs');
var https = require('https');
var options = {
    hostname: 'letsencrypt.org',
    port: 443,
    path: '/',
    method: 'GET',
    ca: fs.readFileSync('/var/tmp/isrgrootx1.pem') <<<<<<<<<<<<<<< incorporated CA thus bypassing the CA embedded in the EOL version of Node.js
};
var req = https.request(options, function(res) {
    res.on('data', function(data) {
        console.log("PASS");
    });
});
req.end();

---

1057305-1 : On deployments that use DPDK, "-c" may be logged as the TMM process/thread name.

Links to More Info: BT1057305

Component: TMOS

Symptoms:
"-c" may be logged as the process/thread name on deployments that use DPDK:

notice -c[17847]: 01010044:5: Gx feature is not licensed
notice -c[17847]: 01010044:5: LTM Transparent feature is licensed
notice -c[17847]: 01010044:5: NAT feature is licensed

Conditions:
- BIG-IP Virtual Edition using XNET with DPDK. This can be AWS, Mellanox, or Cisco eNIC.

Impact:
Confusing logging.

Workaround:
N/A

---

1057121-3 : MQTT Over Websockets in Websocket Termination mode is not working

Links to More Info: BT1057121

Component: Local Traffic Manager

Symptoms:
Request is not forwarded to server-side, the server-side connection will not be established.

Conditions:
MQTT Over Websockets virtual server configuration in Websockets Termination mode.

Impact:
MQTT Over Websockets in Websocket Termination mode does not work.

Workaround:
None

---

1057061-2 : BIG-IP Virtual Edition + security-log-profile (HSL) performance issue with Log Translation Fields.

Links to More Info: BT1057061

Component: Advanced Firewall Manager

Symptoms:
When using a security log profile that has Log Translation Fields enabled, CPU usage is unusually high.

Conditions:
-- AFM provisioned
-- One or more security log profiles has “Log Translation Fields” enabled

Impact:
Excessive CPU utilization when compared to the same configuration with Log Translation Fields disabled.

Workaround:
N/A

---

1056941-2 : HTTPS monitor continues using cached TLS version after receiving fatal alert.

Links to More Info: BT1056941

Component: Local Traffic Manager

Symptoms:
After an HTTPS monitor completes successfully, the TLS version is cached and used for subsequent monitor probes.
If the back end server TLS version changes between monitor polls and no longer allows the cached TLS version, the back end server correctly sends a fatal alert to the BIG-IP in response to the no longer allowed TLS version.
The BIG-IP will continue to use the cached, now prohibited, version in all subsequent probes resulting in a false down resource until the cached information is cleared on the BIG-IP.

Conditions:
ClientSSL profile is changed on backend BIG-IP device's virtual server,

Impact:
BIG-IP continues to send prohibited TLS version and reports the member as down.

Workaround:
-- Delete and re-add pool member.
-- Change HTTPS monitor to any other monitor (including another HTTPS monitor) and then back.
-- Restart bigd with "bigstart restart bigd" - Note that this impacts all monitoring on the BIG-IP.
-- Restart BIG-IP - Note that this impacts all traffic on the BIG-IP.

---

1055077-1 : Modifying the datacenter does not check GTM server configuration for prober-pool.

Links to More Info: BT1055077

Component: Global Traffic Manager (DNS)

Symptoms:
If GTM is in a bad configuration state, the reload can fail with an error similar to this:

01071b63:3: The prober fallback value for server /Common/server1 cannot be the same as the inherited prober preference value.
Unexpected Error: Validating configuration process failed.

or

01071b62:3: The prober preference value for server /Common/server2 cannot be the same as the inherited prober fallback value.
Unexpected Error: Validating configuration process failed.

Conditions:
1. GSLB server has a prober-pool and inherits the datacenter selected for prober preference or prober fallback (it does not matter which prober configuration has which value).
2. GSLB datacenter is modified such that the prober configuration inherited by the constituent GSLB server is changed from a non-pool method to prober-pool.

This results in the GSLB server having a prober-pool probe configuration manually configured and another prober-pool probe configuration inherited from the GSLB datacenter.

Impact:
Two prober-pool configurations for a GSLB server is a prohibited state. Once this state is reached, any action that tries to validate the configuration (like a configuration load) will fail. This can cause the BIG-IP to fail to load configuration or cause a UCS restore to fail.

Workaround:
Review the configured and inherited prober configuration state of all GSLB servers whose parent GSLB datacenter has a prober-pool configured for it's prober preference or prober fallback. If any GSLB servers are affected, change their prober configuration so that only a single prober-pool configuration exists; or, you can change the parent GSLB server to no longer use the prober-pool method.

---

1055053-4 : "tmsh load sys config default" does not clear Zebos config files.

Links to More Info: BT1055053

Component: TMOS

Symptoms:
Typing the command: "tmsh load sys config default" does not clear Zebos config files.

Conditions:
- Dynamic routing in use.
- Loading default configuration with "tmsh load sys config default"

Impact:
Zebos configuration files still contain configuration after restoring default config.

Workaround:
Manually delete the Zebos configuration before running "tmsh load sys config default".

---

1054677-1 : Ng_export fails for users with the 'pager' option enabled in their 'cli preference' configuration.

Links to More Info: BT1054677

Component: Access Policy Manager

Symptoms:
For users with pager enabled, some lines are missing in the ng-export.conf file.

Conditions:
For your CLI preference, the 'pager' option is set to enabled.

Impact:
When 'pager' is set to enabled, you will be unable to export Access policies.

Workaround:
Disable the 'pager' option in 'cli preference' config for the affected user.

---

1054497-1 : Tmsh command "show sys fpga" does not report firmware for all blades.

Links to More Info: BT1054497

Component: TMOS

Symptoms:
After upgrading or forcing a reload of the configuration, the tmsh command "show sys fpga" does not report the firmware for all blades.

Conditions:
- Mutli-blade VIPRION or vCMP guest.
- Upgrade or forced reload of the configuration

Impact:
The tmsh command "show sys fpga" does not report firmware information for all blades.

Workaround:
Use the following command to restart chmand on the blade that is not reporting the firmware information:
bigstart restart chmand

---

1053949-3 : AFM SSH proxy offering weak ciphers, the ciphers must be removed

Links to More Info: BT1053949

Component: Advanced Firewall Manager

Symptoms:
AFM SSH Proxy is offering following weak ciphers:
- hmac-sha1
- diffie-hellman-group14-sha1
- 3des-cbc

Conditions:
- Configure virtual server with AFM SSH profile attached.

Impact:
Selection of weak ciphers can break the the encryption scheme.

Workaround:
None

---

1053605-2 : When you use NAT, the iQuery status displays 'BIGIP' instead of 'BIGIP-DNS'.

Links to More Info: BT1053605

Component: Global Traffic Manager (DNS)

Symptoms:
Use the 'show gtm iquery' command. The 'Server Type' for the connection to its own box may show as "BIGIP" rather than "BIGIP-DNS", even though DNS is provisioned on that device.


   # tmsh show gtm iquery
   ----------------------------------------
   Gtm::IQuery: 10.0.0.1
   ----------------------------------------
   Server GTM1
   Server Type BIG-IP <--
   ...
   ...
   ...


Note: Other BIG-IP DNS devices in the same sync group will correctly show the status as 'BIGIP-DNS'.

Conditions:
This occurs in the following conditions:

 - The gtm server has both an address and a translation defined.
 - The BIG-IP running the command is the same device being viewed (that is, it is showing its own status).
 

For example:

   gtm server GTM1 {
      devices {
         GTM1 {
            address { 10.0.0.1 { translation 192.168.1.1 } }
         }
      }
      ...
   }

Impact:
This is purely cosmetic, and does not affect the operation of the iQuery protocol.

Workaround:
N/A

---

1053037-7 : MCP error on loading a UCS archive with a global flow eviction policy

Links to More Info: BT1053037

Component: TMOS

Symptoms:
Attempting to load a UCS archive with a global flow eviction policy results in an error like the following.

loaddb[3609]: 01080023:3: Error return while getting reply from mcpd: 0x1070911, 01070911:3: The requested flow_eviction_policy object (/Common/otters) does not exist for global_flow_eviction_policy in ltm (/Common/ltm)
Error 0x1070911 occurred: 01070911:3: The requested flow_eviction_policy object (/Common/otters) does not exist for global_flow_eviction_policy in ltm (/Common/ltm)

Despite this error, restoring the UCS archive continues on, and may succeed.

Conditions:
-- Loading a UCS archive with a non-default global-flow-eviction-policy configured.
-- The existing configuration on the BIG-IP system does not define the same eviction policy.

Impact:
The above mentioned error message is printed to the logs.
It should be safe to ignore the error if the UCS otherwise loads successfully.

Workaround:
Ignore the error message.

---

1052317-3 : The BIG-IP system does not output the show security nat source-translation command.

Links to More Info: BT1052317

Component: Advanced Firewall Manager

Symptoms:
The tmsh show security nat source-translation command contains no output.

Conditions:
-- Static NAT is enabled

Impact:
An error occurs:
01020002:3: A null pointer was passed into a function.

Workaround:
None

---

1051589-1 : Missing configuration after upgrade★

Component: Application Security Manager

Symptoms:
After a successful UCS load, some parts of the security configuration are missing.

Conditions:
-- ASM provisioned
-- Limited disk space in /shared
-- Upgrade or create and then install a UCS

Impact:
A device after upgrade or UCS install is missing some of the security configuration.

Workaround:
Clear out disk space in /shared before attempting an upgrade or creating a UCS

---

1051153-4 : DHCP fails intermittently when the connection is through BIG-IP.

Links to More Info: BT1051153

Component: Local Traffic Manager

Symptoms:
DHCP DISCOVER packets are received, load balanced to the back end DHCP server, a DHCP OFFER reply is received from the server to BIG-IP, but this packet is dropped.

Conditions:
A BIG-IP system is between the DHCP client and DHCP server.

Impact:
DHCP OFFER is never passed on to the client, and as such, the client keeps sending DHCP DISCOVER packets, which are all dropped the same way.

---

1051125-1 : GTM marks virtual servers offline even when LTM virtual servers are available.

Links to More Info: BT1051125

Component: Global Traffic Manager (DNS)

Symptoms:
GTM virtual servers have a status of offline when they should be marked as available.

Conditions:
-- Sync group of two GTM devices with a large number of virtual servers (2k).
-- All the LTM virtual servers corresponding to GTM Virtual servers are available.
-- Add a third GTM into the sync group.

Impact:
LTM virtual servers are marked offline.

---

1050661-1 : Warning message with UDP on DOH server side.

Links to More Info: BT1050661

Component: Global Traffic Manager (DNS)

Symptoms:
DOH with server side flow using UDP results in a DoH server that is unable to deliver DNS replies larger than 4096 bytes to the DoH client (a truncated (TC) response will be sent instead).

Conditions:
1. A DNS profile that has all the internal DNS resolution features turned off (gslb, cache, dns-express, local-bind), so that DNS requests are load balanced to the pool
   tmsh create ltm profile dns dns-pool-only enable-dns-express no enable-dnssec no enable-gtm no process-rd no use-local-bind no

2. A pool pointing to a DNS server
   tmsh create ltm pool dns-pool-only members add {x.x.x.x:53}

3. An LTM virtual server that has TCP on the clientside (DoH server) and UDP on the server-side flow.
   tmsh create ltm virtual vs-doh-server destination x.x.x.x:443 ip-protocol tcp profiles add {doh-server tcp { context clientside } udp_gtm_dns { context serverside } http2 http clientssl-secure dns-pool-only }

Trigger by sending a DoH request to the virtual-server for a DNS resource record that is larger than 4096 bytes. A truncated response will be returned to the DoH client. Since the client is already using TCP (and HTTPS) to send the query, it can not retry the query using TCP like a traditional client could do.

Impact:
DNS responses with the TC (truncated) bit are received via the BIG-IP DoH virtual server.

Note that this is correct behavior, per RFC8484, for this configuration.

Workaround:
1. Use TCP on the server-side flow (this is the default if you don't specifically set the serverside to use UDP). The use of TCP will mean that each DNS request requires a TCP 3WHS and 4-way close.

(or)

2. Instead of configuring DNS servers as pool members, configure them as forward-zone nameservers for dns-cache, and enable dns cache in the DNS profile.

(or)

3. Ensure that the configuration is only used when you can be certain that no replies larger than 4096 bytes will ever be provided by the DNS server (pool member)

---

1050457-1 : The "Permitted Versions" field of "tmsh show sys license" only shows on first boot

Links to More Info: BT1050457

Component: TMOS

Symptoms:
As of BIG-IP Virtual Edition version 15.0.0, running "tmsh show sys license" should show the Permitted Versions. After the system is rebooted, this information is no longer displayed by TMSH.

Conditions:
-- Running the 'tmsh show sys license' command after a reboot

Impact:
Unable to see the permitted versions for the license.

Workaround:
The list of permitted versions can be seen in the /config/bigip.license file, by looking for Exclusive_version:

config # grep Exclusive_version /config/bigip.license
Exclusive_version : 11.6.*
Exclusive_version : 12.*.*
Exclusive_version : 13.*.*
Exclusive_version : 14.*.*
Exclusive_version : 15.*.*
Exclusive_version : 16.*.*
Exclusive_version : 5.*.*
Exclusive_version : 6.*.*
Exclusive_version : 7.*.*

---

1050413-4 : Drive model HGST HUS722T1TALA604 must be added to pendsect drives.xml

Links to More Info: BT1050413

Component: TMOS

Symptoms:
When using the hard drive model HGST HUS722T1TALA604, the pendsect does not recognize the hard drive and skips during sector checks.

Conditions:
The issue occurs under the following conditions:
-- Using a HGST HUS722T1TALA604 hard drive on a BIG-IP system.
-- Pendsect runs a sector check.

Impact:
Warning messages like the following will be logged to /var/log/messages:
-- warning pendsect[31898]: skipping drive -- Model: HDC WD1005FBYZ-01YCBB2
-- warning pendsect[31898]: No known drives detected for pending sector check. Exiting

Pendsect can't properly check the hard drive.

Workaround:
Give write permissions to modify files:
chmod u+w /etc/pendsect/drives.xml

Open the file and add the following at the end of the file, before default:
<snip>
         <HUS722T1TA>
            <offset firmware="RAGNWA09">0</offset>
            <offset firmware="default">0</offset>
            <family> "HA210"</family>
            <wd_name>"Ultrastar"</wd_name>
         </HUS722T1TA>
         <DEFAULT>
              <firmware version="default">
                     <offset>0</offset>
              </firmware>
              <name> "UNKNOWN"</name>
              <family> "UNKNOWN"</family>
              <wd_name>"UNKNOWN"</wd_name>
         </DEFAULT>
   </model>
  </drives>

Save and close the file.

Remove write permissions so that no one accidentally modifies this file:
chmod u-w /etc/pendsect/drives.xml



Run the following command and check /var/log/messages to verify no errors are seen:
/etc/cron.daily/pendsect

---

1050153 : Unknown browscap value sent by the client.

Links to More Info: BT1050153

Component: Access Policy Manager

Symptoms:
APM logs 'Unknown browscap' messages:

Unknown browscap value 'x86_64' sent by the client.
Unknown browscap value 'MacOS' sent by the client.

Conditions:
-- An access policy implements different actions for different platforms
-- Certain APM clients connect

Impact:
'Unknown browscap' messages are logged and certain clients are not classified as expected.

---

1050089-5 : TMM crash in certain cases

Component: Application Security Manager

Symptoms:
TMM crash in certain cases

Conditions:
Bot defense profile is used in TMM

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

---

1049085-3 : Booting into a newly installed hotfix volume may stall on RAID-capable platforms★

Links to More Info: BT1049085

Component: TMOS

Symptoms:
Upon booting into a RAID volume containing a newly installed instance of BIG-IP system software which is an Engineering Hotfix, the following messages may appear, after which the boot process stalls:

[...]
[ 11.705219] dracut-initqueue[324]: mdadm: Duplicate MD device names in conf file were found.
[ 133.844644] dracut-initqueue[324]: Warning: dracut-initqueue timeout - starting timeout scripts
[ 133.932885] dracut-initqueue[324]: mdadm: Devices UUID-012345678:9abcdef0:12345678:9abcdef0 and UUID-abcdef01:23456789:abcdef01:23456789 have the same name: /dev/md4
[...]
[ *** ] A start job is running for dev-disk...

Conditions:
1) a hardware platform is configured to use RAID for redundancy
2) duplicate RAID array declarations are introduced into /etc/mdadm.conf
3) a hotfix installation is performed to one of the RAID volumes

Impact:
Impossible to boot into the volume of the new installation, it is necessary to physically reboot the device and revert to a previously working volume to rectify the problem.

Workaround:
Instead of installing the hotfix directly, first install the plain base version on which the hotfix is based and boot into it - this will resolve the problem with the duplicate entries in /etc/mdadm.conf.
Then install the hotfix as normal.

---

1048989-2 : Slight correction of button titles in the Data Guard Protection Enforcement

Links to More Info: BT1048989

Component: Application Security Manager

Symptoms:
A button title read as "Ignored URLs / Enforced URLs" instead of "Ignore URLs / Enforce URLs".

Conditions:
1. On the Security > Application Security > Security Policies > Policies List > <selected_policy> screen, click the Data Guard tab.

2. Look on the Data Guard Protection Enforcement (Wildcards Supported) button fields. The button title should appear as Ignore/Enforce URLs.

Impact:
The title of the button is misleading.

Workaround:
None

---

1048617-3 : Nice level BigDB paramter is not applied for BD

Component: Application Security Manager

Symptoms:
Nice level BigDB parameter is not applied for BD when BIG-IP is using split-planes

Conditions:
BIG-IP supports split-planes and nice level DB variable is set to non-zero.

Impact:
BD niceness level does not change.

Workaround:
None

---

1047933-1 : Virtual server security policy - An error has occurred while trying to process your request

Links to More Info: BT1047933

Component: Advanced Firewall Manager

Symptoms:
While loading the security tab page in the virtual server configuration page, you see an error: "An error has occurred while trying to process your request"

Conditions:
This is encountered when clicking the security tab in the virtual server configuration page, when there are a large number of virtual servers on the BIG-IP system (~2500).

Impact:
Delay in security tab page loading times and possible page timeout.

Workaround:
None

---

1046469-1 : Memory leak during large attack

Links to More Info: BT1046469

Component: Anomaly Detection Services

Symptoms:
ADMD daemon memory consumption increases over several days until it causes OOM.

Conditions:
A large DoS attack occurs and is not mitigated.

Impact:
ADMD daemon will get killed and restarted. Due to the restart, the BADoS protection might be disabled for a couple of seconds.

Workaround:
To workaround the issue before installing the fix, ADMD could be monitored by a script and restarted as needed. This is similar to the current behavior, but it will avoid reaching OOM which might affect other daemons.

---

1046261-1 : Asynchronous REST task IDs do not persist across process restarts

Links to More Info: BT1046261

Component: TMOS

Symptoms:
If an asynchronous task is started via REST and the iControl REST process(es) restart, the task ID is lost and queries regarding its state will result in "Task not found" responses.

Conditions:
-- Starting an asynchronous process via REST.
-- The iControl REST process(es) restart.

Impact:
Unable to get the status of an asynchronous task. If you are using iControl REST to load a UCS, you will be unable to determine the status of the UCS load.

---

1045277-4 : The /var partition may become 100% full requiring manual intervention to clear space

Links to More Info: BT1045277

Component: TMOS

Symptoms:
The /var partition might become completely full on the disk due to files being written to /var/config/rest. This condition may be accompanied by console error messages similar to the following:
011d0004:3: Disk partition /var (slot #) has only 0% free on secondary blade.

Additionally, there may be periodic restjavad and bigd daemons restarts related to disk space exhaustion.

Conditions:
Process traffic while DoS Dashboard is open

Impact:
The partition housing /var/config/rest may become 100% full, impacting future disk IO to the partition.

Workaround:
Important: This workaround is temporary, and may need to be periodically performed either manually or from a script.

Impact of Workaround: While these steps are performed, the BIG-IP REST API will be temporarily inaccessible, and higher disk IO may be seen.

Run the following commands, in sequence:

bigstart stop restjavad
rm -rf /var/config/rest/storage*.zip
rm -rf /var/config/rest/*.tmp
bigstart start restjavad

Manual application of these workaround steps clears the 100% utilized space condition and allows the partition to resume normal operation.

---

1045065-3 : Enable traffic group modification in source-translation object

Links to More Info: BT1045065

Component: Advanced Firewall Manager

Symptoms:
You are unable to modify the traffic group in an address translation policy using tmsh.

Conditions:
This is encountered if you wish to use tmsh to change the traffic group.

Impact:
Traffic group can be modified in NAT source translation object using tmsh.

Workaround:
None

---

1044893 : Kernel warnings from NIC driver Realtek 8139

Links to More Info: BT1044893

Component: TMOS

Symptoms:
Excessive kernel logs occur from the NIC driver Realtek 8139

Conditions:
-- Realtek 8139 driver is used
-- Packets with partial checksum and protocol IPPROTO_TCP/IPPROTO_UDP arrives

Impact:
The Realtek 8139 driver logs excessive kernel warnings.

---

1044873-1 : Deleted GTM link is not removed from virtual server object and causes load failure.

Links to More Info: BT1044873

Component: Global Traffic Manager (DNS)

Symptoms:
The configuration fails to load with an error:

01070712:3: Values (/Common/Link_to_delete) specified for Virtual Server (/Common/vs1 /Common/HTTPP): foreign key index (explicit_link_FK) do not point at an item that exists in the database.
Unexpected Error: Loading configuration process failed.

Conditions:
-- Create GTM link
-- Assign specific link to any virtual server object
-- Delete link object
-- Run tmsh load sys config gtm-only (or create a sync group and the sync will fail)

Impact:
GTM config fails to load or config sync.

Workaround:
Remove any assigned virtual servers from the link prior to deleting it.

---

1044457-3 : APM webtop VPN is no longer working for some users when CodeIntegrity is enabled.

Links to More Info: BT1044457

Component: Access Policy Manager

Symptoms:
Users are unable to use the BIG-IP VPN in Edge, Internet Explorer, Firefox, and Chrome.
Microsoft believes the issue is because the Network Access webtop is using MSXML 2.0a which is blocked by their desktop policy

Conditions:
-- Attempting to connect to Network Access VPN using Edge, Internet Explorer, Chrome and Firefox.
-- CodeIntegrity is enabled

Impact:
Users are not able to connect to F5 VPN through APM Browser.

Workaround:
Workaround is to use the BIG-IP Edge client.

---

1044281-1 : In some cases, cpcfg does not trigger selinux relabel, leaving files unlabeled

Links to More Info: BT1044281

Component: TMOS

Symptoms:
Under certain circumstances, if a configuration is copied to a boot location that has has already been booted into, files restored by the UCS archive remain unlabeled. After booting to the target volume, the BIG-IP will not function and will have the status "INOPERATIVE".

Conditions:
-- APM is provisioned.
-- Performing a cpcfg copy to another volume.

Impact:
-- APM localdbmgr restarts, and fails to restore configuration from UCS archive
-- Spurious system permissions failures as a result of SELinux

Workaround:
After booting into the affected boot location, force an SELinux relabeling:

# touch /.autorelabel && reboot

---

1044021-2 : Searching for IPv4 strings in statistics module does not work.

Links to More Info: BT1044021

Component: TMOS

Symptoms:
In Statistics :: Module statistics : Local Traffic : Pools, in "Display Options", if you choose "Statistics Type" as "Pools" and search for some IPv4 ip with partial words, the search will not return expected results.

Conditions:
Searching for an IPv4 address in the "Statistics" module.

Impact:
It is not possible to filter for IPv4 addresses.

Workaround:
None

---

1043985-1 : After editing an iRule, the execution order might change.

Links to More Info: BT1043985

Component: Local Traffic Manager

Symptoms:
After modification, the iRule execution order may change for events with the same priority.

Conditions:
Virtual server has an iRule that contains multiple events with the same priority.

Impact:
Unexpected behavior can cause virtual server malfunction.

Workaround:
Add desired priorities for iRules that contain the same event.
For example: when <event_name> priority nnn

---

1043141-1 : Misleading 'Symmetric Unit Key decrypt failure - decrypt failure' when loading UCS from another BIG-IP

Links to More Info: BT1043141

Component: TMOS

Symptoms:
Loading a UCS file from another BIG-IP results in an error message similar to:

"/usr/bin/tmsh -n -g -a load sys config partitions all platform-migrate" - failed. -- 010713d0:3: Symmetric Unit Key decrypt failure - decrypt failure

The error message is misleading as the issue is unrelated to master key decryption.

Conditions:
-- Loading a UCS archive from a different BIG-IP.
-- The UCS archive does not contain a ".unitkey" file.
-- The target system does have the correct master key value configured.
-- There is some other MCPD validation issue in the configuration.

Impact:
Platform migration fails with a misleading error message.

Workaround:
Once the issue has happened, you can either:

- Examine the LTM log file for other error messages from MCPD and then correct the configuration issue(s).

OR:

- Re-start MCPD.

---

1042589-1 : Wrong trunk_id is associated in bcm56xxd.

Links to More Info: BT1042589

Component: TMOS

Symptoms:
When a set of interfaces are moved from one trunk to another, the now empty trunk is left with a valid association in bcm56xxd, and deleting that trunk can cause a valid trunk to be removed in the BCM hardware.

'tmsh show net trunk MY_TRUNK' shows the trunk is UP, but in fact the trunk is unconfigured in hardware.

Conditions:
Moving the interfaces across trunks.
i.e.
tmsh modify net trunk MY_OLD_TRUNK interfaces none
tmsh modify net trunk MY_NEW_TRUNK interfaces add { 1.1 1.2 }
tmsh delete net trunk MY_OLD_TRUNK

Impact:
May cause an L2 traffic loop.

---

1042153-2 : AFM TCP connection issues when tscookie-vlans enabled on server/client side VLAN.

Links to More Info: BT1042153

Component: Advanced Firewall Manager

Symptoms:
The BIG-IP system is unable to restore the Timestamp (by replacing the TS cookie) when the packet is offloaded to hardware. This happens only when TS cookie enabled on either of the VLANS (client/server), when the TS cookie enabled on both the VLAN no issues are seen.

Conditions:
Configure TCP BADACK Flood DDoS vector to start mitigation at a given value and enable TS cookies on the server VLAN.

Impact:
The TS cookie will not be restored to its original value when the SYN packet is processed by software in BIG-IP and the SYNACK will be handled by the hardware in BIG-IP. As s result, end-hosts (client/server) RTT calculation is incorrect and causes various issues (ex : blocks the Internet access from hosts in the backend infrastructure).

Workaround:
Use fastL4 profile with EST mode i.e. change the 'pva-offload-state to EST'

---

1041989-4 : APM Portal Access does not add automatically the / after the URL encoded (after the '$$'), Redirect breaks

Links to More Info: BT1041989

Component: Access Policy Manager

Symptoms:
If the Location header does not end with '/' in direct case, the rewritten URL misses the forward slash character '/'.

APM does not add automatically the / after the URL encoded(after $$)?

e.g https://website Is rewritten as https://apm/f5-w-<hex encoded scheme,host,port>$$ instead of https://apm/f5-w-<hex encoded scheme,host,port>$$/.

If the caption URI is https://website without / at the end, APM will rewrite it as https://apm/f5-w-<hex encoded scheme,host,port>$$/

Conditions:
-- APM Portal Access
-- Redirect response Location header does not end with '/' - after the {scheme://host:port}

Impact:
Missing / after redirection - Page does not load

Workaround:
Add '/' through iRule in redirect response header.

---

1041889-2 : RRSIG missing for CNAME with RDATA in different zone

Links to More Info: BT1041889

Component: Global Traffic Manager (DNS)

Symptoms:
RRSIG missing for CNAME.

Conditions:
-- CNAME record with RDATA in different zone.
-- One zone dynamically signed.
-- The other zone in local BIND (ZoneRunner) with static DNSSEC records.

Impact:
DNSSEC validation failure.

---

1041657-1 : PEM and Analytics tabs are displayed when accessing DoH Proxy/Server profiles.

Links to More Info: BT1041657

Component: Global Traffic Manager (DNS)

Symptoms:
The BIG-IP GUI displays the PEM and Analytics tabs for DNS over HTTPS (DoH) Proxy/Server profiles. These tabs should not be present.

Conditions:
This occurs when viewing the DoH proxy or server profile. A PEM and analytics tab is visible when it should not be.

Impact:
Wrong display of PEM and Analytics profile tabs in the GUI.

Workaround:
None.

---

1041625-5 : Virtual server flapping when the active and standby devices have different configuration.

Links to More Info: BT1041625

Component: Global Traffic Manager (DNS)

Symptoms:
The virtual server status flaps.

Conditions:
1. Virtual server auto discovery enabled.
2. Configured GTM server is configured for high availability (HA).
3. The active and standby devices have different IP addresses for the same virtual server.

Impact:
The virtual server status flaps and traffic might be interrupted.

Workaround:
Make the active and standby devices have the same configuration.

---

1041317-1 : MCPD delay in processing a query_all message if the update_status bit is set

Links to More Info: BT1041317

Component: TMOS

Symptoms:
When there are a significant number of virtual servers or pools, mcpd can take a several seconds to respond to query_all messages, if the update_status is set to 1 in the message.

Conditions:
Update_status is set to 1 in the message. This could occur, for example, with the following snmp command

snmpget -v2c -c public localhost ltmVsStatusNumber.0

Impact:
While mcpd is busy updating the status for each virtual server or pool, mcpd will not able to to respond to any messages. Control plane operations might timeout.

---

1041113 : BIG-IP Admin role credentials are not usable for getting device discovered by BIG-IQ

Links to More Info: BT1041113

Component: Device Management

Symptoms:
BIG-IQ is unable to discover BIG-IP with admin role user (not default admin user).

Conditions:
The admin of BIG-IQ is attempting to add a BIG-IP using its an account with admin role (that is not the default admin account).

Impact:
BIG-IQ fails to discover BIG-IP.

Workaround:
Restart the restjavad process on BIG-IP and reattempt device discovery from BIG-IQ.

---

1040957-1 : The ipother profile can be used with incompatible profiles in a virtual server

Links to More Info: BT1040957

Component: Local Traffic Manager

Symptoms:
The BIG-IP system does not prevent the ipother profile from being used with incompatible profiles in a virtual server.

-- Log messages such as the following in the LTM log file:

err tmm[28670]: 01010008:3: Proxy initialization failed for /Common/example_vs. Defaulting to DENY.
err tmm[28670]: 01010008:3: Listener config update failed for /Common/example_vs: ERR:ERR_ARG

-- Log messages such as the following in TMM's log file:

notice hudchain contains precluded clientside filter: IPOTHER

Conditions:
Creating or modifying a virtual server to use the ipother profile with an incompatible profile.

Impact:
Invalid configuration. TMM traffic passing does not behave the way virtual server configuration dictates it should.

Workaround:
Remove the incompatible profile(s) from the virtual server.

---

1040573-4 : REST operation takes a long time when two different users perform tasks in parallel

Links to More Info: BT1040573

Component: TMOS

Symptoms:
A considerable delay is observed when different users attempt to execute multiple REST(iCR) requests in parallel.

Conditions:
Multiple iControl REST operations are performed by different users in parallel.

When attempting multiple requests by single or multiple users with and without bulk config , following behaviors are observed:

5 ICRD children getting spawned successfully and same are being observed in logs and noticed that these children are serving multiple rest requests fired by multiple users


Observed expected results for all below scenarios, except the last scenario which has a caveat:

1. Verify multiple rest requests fired with single user
2. Verify multiple rest requests fired with multiple users(5 users )
3. Verify single rest request fired with multiple users (5 users)
4. Verify multiple rest requests fired from multiple users with Bulk config(5 users)
5. Verify single rest request fired from multiple users with Bulk Config(5 users)

    Scenario5 has a Caveat with the current fix , since this fix limits up to 4 concurrent requests , the connection may be refused for some of the requests if the concurrent requests are more than 4.

Impact:
BIG-IP system performance is impacted.

Workaround:
Use only one user to process the multiple requests.
OR
Use an iControl REST transaction containing multiple requests.

---

1040465-3 : Incorrect SNAT pool is selected

Links to More Info: BT1040465

Component: Local Traffic Manager

Symptoms:
An incorrect SNAT pool is selected when an SSL Forward Proxy is configured and BYPASS is enabled along with an iRule to choose the SNAT pool.

Conditions:
-- Virtual Server has SSL Forward Proxy Deployment with BYPASS enabled
-- iRule configured to decide the SNAT pool members
-- Virtual Server passes the traffic

Impact:
Traffic diverted to incorrect SNAT pool when BYPASS happens.

---

1040277-4 : Syslog-ng issue may cause logging to stop and possible reboot of a system

Links to More Info: BT1040277

Component: TMOS

Symptoms:
A syslog-ng issue with remote logging to an invalid remote syslog server may lead to logging via syslog-ng to stop.

For software version 13.1 only it may lead to BIG-IP unexpectedly rebooting due to host watchdog timeout, typically within hours to day or two after syslog-ng gets hung up.


The cessation of logging happens at the time of the last 'Syslog connection broken' in /var/log/messages before reboot.
That message will appear without a preceding 'Syslog connection established' just before it with same timestamp.

At this time syslog-ng typically spins, using near 100% CPU.

Conditions:
Invalid syslog-ng server configuration or broken connection from BIG-IP toward configured syslog-ng remote server.

A server is configured as a remote syslog destination on the BIG-IP, but it or an intervening system responds to stream of log messages by breaking connection eg by sending ICMP port unreachable to BIG-IP.

Syslog-ng will note the connection attempt and that it has broken usually in the same second, and do so every 60s when it retries.
There may be many of these log pairs, repeating every minute in /var/log/messages, such as:

  Nov 25 03:14:01 localhost.localdomain notice syslog-ng[12452]: Syslog connection established; fd='14', server='AF_INET(192.168.1.1:514)', local='AF_INET(0.0.0.0:0)'
  Nov 25 03:14:01 localhost.localdomain notice syslog-ng[12452]: Syslog connection broken; fd='14', server='AF_INET(192.168.1.1:514)', time_reopen='60'

The final log will of a broken connection only, usually one minute after the last established/broken pair in the very rare event that syslog-ng hangs.

  Nov 25 03:15:01 localhost.localdomain notice syslog-ng[12452]: Syslog connection broken; fd='14', server='AF_INET(192.168.1.1:514)', time_reopen='60'

Impact:
Very rarely syslog-ng hangs in a non-functional state. Sometimes, this may lead to an unexpected reboot of BIG-IP. Loss of logs before restart and traffic disrupted while BIG-IP restarts.

Workaround:
Ensure syslog-ng server configuration is valid, and that the server is reachable. If a remote server is not reachable remove it from the BIG-IP syslog configuration.

---

1040153-1 : Topology region returns narrowest scope netmask without matching

Links to More Info: BT1040153

Component: Global Traffic Manager (DNS)

Symptoms:
BIG-IP returns malformed packets or the narrowest scope not matching the request.

Conditions:
Mixed sub networks with different mask length.

Impact:
Malformed packets.

Workaround:
Do not put mixed subnets in one region.

---

1040117-2 : BIG-IP Virtual Edition drops UDP packets

Links to More Info: BT1040117

Component: TMOS

Symptoms:
BIG-IP Virtual Edition drops padded UDP packets when the hardware will accept and forward these same packets.

Conditions:
-- BIG-IP Virtual Edition
-- Padded UDP packets are sent

Impact:
UDP packets are dropped, potentially disrupted traffic

---

1040045-3 : Unable to delete trunk member on a VCMP guest

Links to More Info: BT1040045

Component: Local Traffic Manager

Symptoms:
After deleting a trunk member on a VCMP hypervisor, the change may not propagate to the guest.

Conditions:
-- VCMP guest
-- A trunk member that is UP
-- The trunk member is deleted on the hypervisor

Impact:
The guest does not have the current trunk information

Workaround:
Down the interface on the VCMP hypervisor before removing it (tmos)# modify net interface 2/3.1 disabled
(tmos)# modify net trunk trunk_1 interfaces del { 2/3.1 }

---

1039609-1 : Unable to poll Dynamic routing protocols SNMP OID's on non-default route domain

Links to More Info: BT1039609

Component: TMOS

Symptoms:
You are either:
  - unable to extract the dynamic routing protocols configuration information via an SNMP walk or
  - dynamic routing protocols configuration information retrieved by SNMP walk belongs instead to the default route-domain

Conditions:
Example taken below is for BGP:

-- Create BGP config in non-default route-domain, establish peer with some router.
-- Create snmp community in non-default route domain
-- Run snmp walk for BGP4 mib (1.3.6.1.2.1.15).

Certain key MIB OIDs from the BGP configuration like bgpPeerRemoteAddr,bgp4PathAttrIpAddrPrefixLen are missing.

Impact:
Dynamic routing protocols SNMP OID polling not working when they are in a non-default route-domain.

---

1039361-1 : [GraphQL] In case of more than one malformed violation, the first is reported multiple times

Links to More Info: BT1039361

Component: Application Security Manager

Symptoms:
In a scenario where the incoming GraphQL request has more than one malformed violation, the details of the reported malformed violations will include the first reported string only.

Conditions:
GraphQL request has more than one malformed violation.

Impact:
Missing information from Request Log.

---

1039349-1 : HTTP statistics not updated

Links to More Info: BT1039349

Component: Local Traffic Manager

Symptoms:
HTTP redirect stats are not incremented when a redirect occurs.

Conditions:
The virtual server to which the client will be connecting is configured with "fallback" setting on http profile and pool member is intentionally disabled to get the traffic redirect to another virtual.

Impact:
HTTP statistics are not updated

---

1039145-1 : Tenant mirroring channel disconnects with peer and never reconnects after failover.

Links to More Info: BT1039145

Component: Local Traffic Manager

Symptoms:
`tmctl -d blade ha_stat` shows missing mirroring connections.

Conditions:
This occurs with high availability (HA) pair. This is a VELOS hardware-specific issue.

Impact:
High availability (HA) mirroring does not function correctly.

Workaround:
N/A

---

1038689-3 : "Mandatory request body is missing" violation should trigger for "act as a POST" methods only

Component: Application Security Manager

Symptoms:
If a request is configured "Body is Mandatory", any request with "act as a GET" method with no body triggers a "Mandatory request body is missing" violation

Conditions:
- Create default "/index.php" URL with "Any" method and enabled "Body is Mandatory" setting
-Request with GET or 'act as GET' method with no body

Impact:
The request is blocked with "Mandatory request body is missing" violation

---

1037645-4 : TMM may crash under memory pressure when using iRule 'AES::key' command

Links to More Info: BT1037645

Component: Local Traffic Manager

Symptoms:
TMM crashes and generates core file.

Conditions:
-- TMM is under memory pressure
-- iRule using 'AES::key' command

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

---

1037617-1 : Switching between bare-metal and vCMP modes can leave HSM with poorly deployed accelerator engine counts

Links to More Info: BT1037617

Component: Performance

Symptoms:
FIPS performance does not reach 10k TPS.

Conditions:
-- i15820 platform with FIPS configured

Impact:
Lower than expected performance, but the system otherwise functions normally.

Workaround:
While vCMP is provisioned, resize the PARTITION_1 partition using:

    # fipsutil ptnresize

And when prompted as in the following:

    "Enter max accel devs (1-63)"

Enter 63.

---

1037257-2 : SSL::verify_result showing wrong output for revoked cert during Dynamic CRL check

Links to More Info: BT1037257

Component: Local Traffic Manager

Symptoms:
In logs the result of Dynamic CRL validation using SSL::verify_result is appearing as 0, which is not correct.

Conditions:
1. Use Dynamic CRL
2. Use a REVOKED certificate

Impact:
Incorrect information that certification validation is successful for a revoked certificate is logged.

Workaround:
Static CRL method of certificate validation can be used.

---

1037153-1 : iRule "log" command to remote destinations may cause TMM to leak memory

Links to More Info: BT1037153

Component: Local Traffic Manager

Symptoms:
TMM leaks memory in the errdefs component.

TMM may leak memory in the xdata and xhead components if the system does not have routes to the specified syslog servers.

Conditions:
-- iRule that uses "log" to target a remote destination, e.g.: "log 192.0.2.1 'log message'"

Impact:
TMM leaks memory.

Eventually, TMM may disrupt legitimate connections as a result of memory pressure, or even crash and restart.

Workaround:
One of the following:

1. Log to local syslog, and configure syslog-ng to log to remote servers.

2. Use High-Speed Logging (https://clouddocs.f5.com/api/irules/HSL.html), instead of the "log" command.

---

1036969-1 : Chrome sometimes ignores cross-site bot-defense cookies

Links to More Info: BT1036969

Component: Application Security Manager

Symptoms:
Chrome ignores cross-site bot-defense cookies when bot-defense is sending 307 redirect.

Conditions:
A site is using another site/domain resources that are also protected by bot-defense

Impact:
The other site/domain resource will not display correctly on Chrome

Workaround:
iRule work-around based on:https://devcentral.f5.com/s/articles/iRule-to-set-SameSite-for-compatible-clients-and-remove-it-for-incompatible-clients-LTM-ASM-APM.

Or, disabling simple redicret via TMSH:
tmsh modify sys db dosl7.proactive_defense_simple_redirect { value "disable" }
tmsh modify sys db dosl7.proactive_defense_simple_redirect_on_grace { value "disable" }

---

1036873-2 : Pre-shared key extension sometimes is not the last extension in ClientHello in TLS1.3

Links to More Info: BT1036873

Component: Local Traffic Manager

Symptoms:
Under some conditions, the BIG-IP's TLS 1.3 Client Hello sometimes does not have the pre-shared key extension as the last extension in the Client Hello. This is contrary to a requirement in the TLS 1.3 RFC, and causes servers to fail the connection.

A backend server may log a message such as:

SSL_do_handshake() failed (SSL: error:141B306E:SSL routines:tls_collect_extensions:bad extension)

Conditions:
-- Server SSL profile (BIG-IP operating as client) with TLS 1.3 enabled.
-- A Client Hello message size that falls between 256 and 512 bytes (without padding), which causes the BIG-IP to introduce a padding extension at the end of the Client Hello.

This issue can be seen via use of the "single-dh-use" or "session-tickets" options in the SSL profile.

Impact:
The TLS handshake fails.

Workaround:
Adjust the configuration of the Server SSL profile by either:

-- Disable Session Tickets
or
-- Disable the single-dh-use option

---

1036613-3 : Client flow might not get offloaded to PVA in embryonic state

Links to More Info: BT1036613

Component: TMOS

Symptoms:
The client flow is not offloaded in embryonic state, but only is only offloaded once the flow transitions to an established state.

Conditions:
-- FastL4 profile configured to offload TCP connections in embryonic state (this is the default)
-- Clientside and serverside ingress traffic is handled by different TMMs
-- Running on a platform with multiple HSB modules per TMM, i.e.:
--+ BIG-IP i11600 Series
--+ BIG-IP i15600 Series

Impact:
- minor performance degradation;
- PVA traffic counters show unexpectedly high values;

---

1036557-1 : Monitor information not seen in GUI

Links to More Info: BT1036557

Component: TMOS

Symptoms:
GUI displays "An error has occurred while trying to process your request" when deleting/creating a monitor with the same name under the same transaction.

Conditions:
(a) Create a TCP monitor, then in a single transaction delete the TCP monitor + create an HTTP monitor with same name as the TCP monitor. Example below:

# tmsh create ltm monitor tcp <Name of the monitor>
# echo 'create cli transaction; delete ltm monitor tcp <Name of the monitor> ; create ltm monitor http <Name of the monitor>; submit cli transaction' | tmsh
# tmsh save sys config

This could also occur when reconfiguring an iApp, or changing a configuration via AS3.


(b) Login to the GUI and click on the monitor (GUI > Local Traffic > Monitors > (Monitor created)) you'll see "An error has occurred while trying to process your request"

Impact:
Unable to view monitor parameters in GUI.

Workaround:
Any one of the following workarounds help:
- do not use the same monitor name
- do not perform the delete+create actions on a single transaction
- save and load the configuration:
  tmsh save sys config && tmsh load sys config

---

1036541-4 : Inherited-traffic-group setting of floating IP does not sync on incremental sync

Links to More Info: BT1036541

Component: TMOS

Symptoms:
When a floating IP object is created, and its inherited-traffic-group property is set, this property does not sync to other devices.

Conditions:
This is relevant for any setup with multiple devices in a sync/failover device group.

Impact:
This will impact incremental syncing to other peers in the device group.

Workaround:
Do a full config sync if possible.

---

1036461-4 : icrd_child may core with high numbers of open file descriptors.

Links to More Info: BT1036461

Component: TMOS

Symptoms:
icrd_child core generated.

Conditions:
Have over 1024 open file descriptors.

Impact:
REST API usage for BIG-IP configuration will be impacted.

Workaround:
N/A

---

1036265-4 : Overlapping summary routes might not be advertised after ospf process restart.

Links to More Info: BT1036265

Component: TMOS

Symptoms:
Overlapping summary routes might not be advertised after ospf process restarts.

Conditions:
Add an overlapping /32 entry for a summary route and restart ospf process.

Impact:
Summary routes are not advertised.

---

1036097-4 : VLAN failsafe does not trigger on guest

Links to More Info: BT1036097

Component: TMOS

Symptoms:
VCMP guest VLAN failsafe does not trigger as expected.

Conditions:
-- VCMP host configured
-- VLAN failsafe enabled on a VLAN
-- One or more VCMP guests enabled that use that VLAN.
-- A trunk member of a trunk connected to the vCMP guest is flapping.

Impact:
Since the neighbor messages for the IPv6 link-local addresses continue to be successfully passed from host to guest upon a trunk member change, VLAN failsafe does not trigger even if the upstream switch goes down that's connected to the VLAN.

Workaround:
None

---

1036093-4 : Tmm sends out neighbor advertisements for the link local addresses even if IPv6 is disabled

Links to More Info: BT1036093

Component: Local Traffic Manager

Symptoms:
When a trunk member state changes and IPv6 is disabled, BIG-IP still sends neighbor advertisements for the link-local addresses on each VLAN

Conditions:
- IPv6 is disabled (ipv6.enabled=false)
- change in a trunk member state occurs

Impact:
Link-local addresses are still in the vaddr hash even after ipv6 is disabled.

---

1036013-3 : BIG-IP systems may terminate connections prematurely when a TLS close-notify alert is received

Links to More Info: BT1036013

Component: Local Traffic Manager

Symptoms:
When a backend server sends a TLS close-notify alert, BIG-IP may terminate the connection prematurely without forwarding the HTTP response.

Conditions:
ServerSSL receives a TLS Close-notify alert after a TLSv1.3 session is established.

Impact:
Server responses may be dropped.

Workaround:
Use TLSv1.2.

---

1035757-4 : iRulesLX restart leaves stale files in /var/tmstat/blade/tmplugin_ilx_*

Links to More Info: BT1035757

Component: Local Traffic Manager

Symptoms:
After restarting the ilx plugin, new tmplugin_ilx_rpc_* stat files are being created, but old files are not being deleted.

Conditions:
- ilx configured
- ilx plugin restarted

Impact:
The presence of too many of these leftover files might prevent merged from rolling up stats and providing graphs and cause such errors:

err merged[8523]: 011b0900:3: TMSTAT error tmstat_remerge: Cannot allocate memory.

Workaround:
Delete stale tmplugin_ilx_* files manually

---

1035741-1 : Wrong default value for lacp-port-priority.

Links to More Info: BT1035741

Component: Local Traffic Manager

Symptoms:
Wrong default value set for lacp-port-priority and also in description of tmsh help interface

Conditions:
Run the following commands to see wrong default value for lacp-port-priority:

--tmsh help interface

-- tmsh list net interface <interface number> lacp-port-priority

Impact:
Confusion with wrong default value seen.

Workaround:
N/A

---

1035661-4 : REST Requests return 401 Unauthorized when using Basic Auth

Links to More Info: BT1035661

Component: TMOS

Symptoms:
REST Requests are intermittently failing with a 401 error.

The restjavad-audit.*.log shows these requests are closely preceded by a 503 response from /mgmt/tm/auth/source.

Conditions:
Triggered when a REST request comes in using Basic Auth while an asynchronous task is executing on the BIG-IP.

An example of an asynchronous task is the BIG-IP processing an AS3 declaration.

Impact:
REST requests will fail with a misleading response code and for no readily apparent reason.

Workaround:
Use token based authentication for REST requests.

---

1035017-6 : Remove unused CA-bundles

Component: TMOS

Symptoms:
Some of the certificate bundles shipped on BIG-IP devices are not used and aren't updated. In particular, there are legacy bundles which aren't needed.

Conditions:
This affects certain internal certificate bundles on the BIG-IP file system:

Impact:
There is a chance that there might be failures when "internal certificates" expires.

Workaround:
None

---

1034953-3 : In explicit proxy, HTTP_STATCODE missing from syslog

Links to More Info: BT1034953

Component: Local Traffic Manager

Symptoms:
HTTP_STATCODE missing from logs captured using request logging profile when HTTP request is made to explicit proxy virtual server.

Conditions:
- Configure explicit proxy virtual server
- Apply request logging on the same virtual server
- Send HTTP request to connect to a Host via the explicit virtual server

Impact:
HTTP_STATCODE not found in the logs captured from request logging

---

1034865-1 : CACHE::enable failed on private/no-store content

Links to More Info: BT1034865

Component: Local Traffic Manager

Symptoms:
BIG-IP provides a possibility to cache HTTP responses with RAMCACHE feature. When a response has either "Cache-Control: private" or "Cache-Control: no-store", the CACHE::enable setting allows the content to be cached. This option was removed when a fix to ID 360047 was introduced.

Conditions:
-- A virtual server has a web-acceleration profile without a policy.
-- An iRule has CACHE::enable command, overwriting Cache-Control header's values "no-store" and/or "private".

Impact:
BIG-IP always requests for a response from the origin web server even when a response is cacheable, putting extra load on the origin web server.

---

1034509-6 : Sensor read errors on VIPRION C2200 chassis

Links to More Info: BT1034509

Component: TMOS

Symptoms:
Due to LOP sensor read errors, the command 'tmsh show sys hardware' can list an RPM of 0 for some chassis fans.

Conditions:
- Running a C2200 VIPRION chassis
- Other conditions unknown

Impact:
Messages such as the following appear in /var/log/ltm:

warning chmand[7629]: 012a0004:4: hal_if_media_poll: media SVC exception: media: getLopReg error
err chmand[7629]: 012a0003:3: getSensorData: sensor read fault for Chassis fan 1, LOP return code -1 : File sensor/LopSensSvc.cpp Line 2315
err chmand[7629]: 012a0003:3: getSensorData: sensor read fault for Chassis fan 2, LOP return code -1 : File sensor/LopSensSvc.cpp Line 2315
err chmand[7629]: 012a0003:3: getSensorData: sensor read fault for Chassis fan 3, LOP return code -1 : File sensor/LopSensSvc.cpp Line 2315
err chmand[7629]: 012a0003:3: getSensorData: sensor read fault for Chassis fan 4, LOP return code -1 : File sensor/LopSensSvc.cpp Line 2315
warning chmand[7629]: 012a0004:4: getLopReg Sock error: send to lopd failed [lopd addr:/var/run/lopdsvr] [client addr:/var/run/hwctl.hal.sock] (errno:2) No such file or directory
warning chmand[7629]: 012a0004:4: GET_STAT failure (status=0xc) page=0x21 reg=0x50
err chmand[7629]: 012a0003:3: getSensorData: sensor read fault for Chassis 3.3V main voltage, LOP return code -1 : File sensor/LopSensSvc.cpp Line 2315
notice chmand[7629]: 012a0005:5: Tmstat::updateSensorTbls: HAL SenSvc error: send to lopd failed [lopd addr:/var/run/lopdsvr] [client addr:/var/run/hwctl.hal.sock] (errno:2) No such file or directory
warning chmand[7629]: 012a0004:4: getChassisPwrSup err: send to lopd failed [lopd addr:/var/run/lopdsvr] [client addr:/var/run/hwctl.hal.sock] (errno:2) No such file or directory
warning chmand[7629]: 012a0004:4: getChassisPwrSup err: send to lopd failed [lopd addr:/var/run/lopdsvr] [client addr:/var/run/hwctl.hal.sock] (errno:2) No such file or directory

Tmsh show sys hardware will list an RPM of 0 for chassis fans affected by the sensor read errors

Workaround:
No workaround currently known.

---

1034009-4 : CGNAT+Subscriber Discovery - NAT IP with wrong route domain on the CGNAT Log

Links to More Info: BT1034009

Component: Carrier-Grade NAT

Symptoms:
The route domain ID for the translated IP is incorrect in the log message.

Conditions:
This issue will be seen when the different route domain are configured for incoming and outgoing traffic.

Impact:
Log messages will have an incorrect domain-id.

Workaround:
None

---

1033969-4 : MPLS label stripping needs next protocol indicator

Links to More Info: BT1033969

Component: TMOS

Symptoms:
MPLS label stripping does not participate in the MPLS control-plane, and MPLS does not have a next protocol indicator.

Conditions:
This is encountered when attempting to pass IPv6 packets to GRE-encapsulated MPLS on BIG-IP systems.

Impact:
GRE/MPLS packets with IPv6 traffic encapsulated are not forwarded to the egress VLAN.

Workaround:
None

---

1033937-1 : HTTP message router stats do not increment for virtual servers and pools

Links to More Info: BT1033937

Component: Local Traffic Manager

Symptoms:
The HTTP MR stats for virtual servers and pools do not increment

Conditions:
- BIG-IP system with HTTP using httprouter and passing traffic.
- View the MRF stats

Impact:
Virtual server and pool stats do not increment.

---

1033689-1 : BGP route map community value cannot be set to the required range when using AA::NN notation

Links to More Info: BT1033689

Component: TMOS

Symptoms:
The community value for BGP route map entries should allow values of 1-65535 for both components, but it is not allowing 65535 for either component when using AA::NN notation.

Conditions:
-- Using BGP route map community values.
-- Attempting to set one or both components to 65535 with
   using AA::NN notation

Impact:
Unable to use the full range of BGP route map community values.

Workaround:
None

---

1033333-4 : FIPS: importing a stub SSL key file results in 2 keys that share the same FIPS device

Component: TMOS

Symptoms:
The 'tmsh list sys crypto key' command lists multiple keys with the same FIPS ID.

Conditions:
-- BIG-IP using a FIPS HSM
-- Import the stub FIPS key file contents (the filestore certificate_key file object) into the system as a new file object.

Impact:
Two object points to same key stored in the FIPS HSM. If one of the two objects are deleted, the key stored in the HSM will be deleted. This will result in traffic failures, i.e. TLS handshake failures.

Workaround:
Do not create a second MCP SSL key object by importing the stub key file content from the filestore.

---

1033025-4 : TMM might crash when unsupported bot iRule is used

Links to More Info: BT1033025

Component: Application Security Manager

Symptoms:
TMM crashes.

Conditions:
Bot defense iRule with async commands is attached to virtual server, for example:

when BOTDEFENSE_ACTION
{
        after 7000 {
            if { ([BOTDEFENSE::device_id] eq "0") }
                {
                    log local0. "Violations Names: [BOTDEFENSE::device_id];"
                    BOTDEFENSE::action browser_challenge
                }
           }

}

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

---

1033021-2 : UI: Partition does not work when clicking through security zones

Links to More Info: BT1033021

Component: Advanced Firewall Manager

Symptoms:
1. Zones UI is not refreshed when the partition changes
2. You are unable to administer zones while using partitions

Conditions:
Change the partition in GUI, then view the corresponding mapped zones.

Impact:
All zones are displayed for every partition instead of just the mapped zones

Workaround:
None

---

1032921-4 : VCMP Guest CPU usage shows abnormal values at the Host

Links to More Info: BT1032921

Component: TMOS

Symptoms:
CPU usage is represented as 100% for each CPU core, so for instance top may report CPU usage above 100%
for a two CPU system, given that in that case 200% would actually represent the full CPU capacity.

Here for vCMP with 'n' CPUs reporting more than n*100% for CPU utilization.

Conditions:
VCMP provisioned on BIG-IP

Impact:
CPU utilization is incorrectly shown.

Workaround:
NA

---

1032329-1 : A user with low privileges cannot open the Rule List editor.

Links to More Info: BT1032329

Component: Advanced Firewall Manager

Symptoms:
When a low privilege user attempts to access the Rule List editor page, they receive the error message "General database error retrieving information."

Conditions:
Attempting to access the Rule List editor as a user with a lower privilege, for example Firewall Manager.

Impact:
You cannot see the details of the Rule List via UI/tmsh

Workaround:
Use TMSH to view Rule List details

---

1032257-1 : Forwarded PVA offload requests fail on platforms with multiple PDE/TMM

Links to More Info: BT1032257

Component: TMOS

Symptoms:
Forwarded PVA requests use a static bigip_connection that does not have its pva_pde_info initialized, which results in offload failure on platforms that have multiple PDEs per TMM.

Conditions:
Pva_pde_info is not initialized and Forwarded PVA requests occur.

Impact:
Hardware offload does not occur.

---

1032001-2 : Statemirror address can be configured on management network or clusterd restarting

Links to More Info: BT1032001

Component: TMOS

Symptoms:
- Able to create statemirror address on the same network as management or cluster network.
- Validation issues when attempting to remove a management address.
- Clusterd process restarts constantly.

Conditions:
- Management/cluster address set up with IPv6 and statemirror address is configured with IPv4.

Impact:
- Unable to make configuration changes to the management or cluster address until the statemirror address is removed.
- Clusterd process restarts constantly causing the blade or cluster to report as offline.

---

1031945-4 : DNS cache configured and tmm stuck in 'not ready' state indefinitely after TMM restart or reboot★

Links to More Info: BT1031945

Component: Global Traffic Manager (DNS)

Symptoms:
Clusterd reports "TMM not ready" right after "Active"

Jun 23 18:21:14 slot2 notice sod[10084]: 010c0019:5: Active
Jun 23 18:21:14 slot2 notice clusterd[10920]: 013a0019:5: Blade 2 turned Yellow: TMM not ready

All blades are showing 'unavailable'

Conditions:
1. Multiple dns cache-resolver and/or net dns-resolver objects configured with names that only differ in letter case, e.g. /Common/example-dns-cache and /Common/Example-DNS-cache

2. Occurs after rebooting/upgrading

Impact:
The system remains inoperative.

---

1031909-2 : NAT policies page unusable due to the page load time

Links to More Info: BT1031909

Component: Advanced Firewall Manager

Symptoms:
You cannot work with the NAT polices page because the page takes too long to load.

Conditions:
-- The device has a large number of VLANs and virtual servers
-- The device has a large number of NAT policies and partitions
-- From GUI navigate to the NAT policies page

Impact:
NAT policies page takes a long time to load.

---

1031461-2 : Session awareness entries aren't mirrored to both sides of an active-active deployment.

Component: Application Security Manager

Symptoms:
Session awareness entries aren't mirrored to both sides of an active-active deployment.

session db entries remain in bd (ASM) daemon until manually removed

Conditions:
- ASM provisioned
- Security policy attached to a virtual server
- Session tracking and Login Page enabled in the policy

Impact:
ASM session tracking feature isn't properly functioning on active-active deployment.

---

1031117-1 : The mcpd error for virtual server profiles incompatible needs to have more details

Links to More Info: BT1031117

Component: TMOS

Symptoms:
The mcpd error message MCPDERR_VIRTUAL_SERVER_INCOMPAT_PROFILE_PROTO currently has text which does not provide detail information.
-The error text should also list which profile is problematic, and the protocol that the virtual server is using. This will help Support pinpoint the issue much faster.

Conditions:
- Configure a virtual server with a profile that is invalid for its protocol.

Impact:
The error text not listing which profile is problematic, and the protocol that the virtual server is using.

Workaround:
None.

---

1031025-3 : Nitrox 3 FIPS: Upgrade from v12.1.x to v14.1.x results in new .key.exp files for the FIPS keys created before upgrade.★

Links to More Info: BT1031025

Component: TMOS

Symptoms:
During upgrade from v12.1.x to v14.1.x, New ".key.exp" export file is created for the FIPS keys present in the card.

Conditions:
This happens during the upgrade from v12.1.x to v14.1.x for the existing keys with ".key" extension to it in the label.

It occurs only if the key is deleted/not present in the FIPS card (e.g. a faulty card), and BIG-IP has the configuration / metadata for the missing keys.

Impact:
The upgrade fails while loading the configuration.

Workaround:
Delete the missing key's configuration from config file, then perform the upgrade.

---

1030237-1 : Zxfrd core and continual restart when out of configured space

Links to More Info: BT1030237

Component: Global Traffic Manager (DNS)

Symptoms:
Zxfrd is in restart loop and occasionally cores.

Conditions:
Zxfrd is out of the configured space.

Impact:
Dns express and rpz does not work properly.

Workaround:
1. locate any zone that is suspiciously large and delete that zone from dns zones if unexpected;
2. Allocate more space for zxfrd using dnsexpress huge pages.
tmsh modify sys db dnsexpress.hugepages { value "8000" }
8000 should be adjusted accordingly.

---

1030129-4 : iHealth unnecessarily flags qkview for H701182 with mcp_module.xml

Links to More Info: BT1030129

Component: Application Security Manager

Symptoms:
iHealth unnecessarily flags the uploaded qkview for Heuristic H701182 "Non-ASCII characters removed from Qkview XML files".

Conditions:
Qkview generated from an unit with asm provisioned is uploaded to iHealth

Impact:
Inaccurate Heuristic on iHealth

Workaround:
None.

---

1030093-1 : An http2 to http2 virtual connection with translate-address disabled might only use one stream on the server side.

Links to More Info: BT1030093

Component: Local Traffic Manager

Symptoms:
When there is no pool object available, this issue results in only stream ID 1 succeeding to the server-side. All subsequent streams fail.

Conditions:
With the following configuration:
-- client side HTTP2
-- server side HTTP2
-- HTTP2 MRF enabled
-- translate-address disabled

Impact:
Connection only works for stream 1. All other streams fail.

Workaround:
If you set "translate-address enabled" on the virtual server, then all streams work fine.

---

1029373-4 : Firefox 88+ raising Suspicious browser violations with bot defense

Links to More Info: BT1029373

Component: Application Security Manager

Symptoms:
Bot-defense might block legal traffic arriving from Firefox version 88

Conditions:
- ASM provisioned
- bot-defense profile assigned on a virtual server

Impact:
Legal traffic is blocked

Workaround:
Tmsh modify sys db botdefense.suspicious_js_score value 60

---

1029173-4 : MCPD fails to reply and does not log a valid message if there are problems replicating a transaction to PostgreSQL

Links to More Info: BT1029173

Component: TMOS

Symptoms:
In rare circumstances Master Control Program Daemon (MCPD) fails to reply to a request from TMSH, GUI, or any daemon, for example, SNMPD.

Following is an example error message:

Mar 29 00:03:12 bigip1 err mcpd[15865]: 01070734:3: Configuration error: MCPProcessor::processRequestNow: std::exception

Conditions:
- AFM is provisioned.
- MCPD fails to connect PostgreSQL.

Impact:
TMSH command save sys config might be hung.
SNMPD stops replying to SNMP GET requests.

Workaround:
If there are any hung TMSH commands, then quit.

If SNMPD stops responding to SNMP requests, then use the command bigstart restart snmpd to restart SNMPD.

---

1029069-2 : Non-ASCII characters are not displayed correctly.

Links to More Info: BT1029069

Component: Local Traffic Manager

Symptoms:
1. Add a new address IP with a value that includes non-ASCII characters in the data group list.
2. Go back to GUI->Local Traffic ›› iRules : Data Group List and click it.
The value field does not display entered values.

After clicking update several times you may encounter an error such as:
01070712:3: MCP call 'mcpmsg_set_string_item(m_msg, CID2TAG(cid), val.c_str())' failed with error: 16908375, 01020057:3: The string with more than 65535 characters cannot be stored in a message.

Conditions:
Adding non-ASCII characters to the value field in data group lists.

Impact:
Impacts the functioning of the address record. For example, when the datagroup is called by an iRule.

Workaround:
Do not add non-ASCII characters to the value field.

---

1028493-1 : Live Update genesis file for Server Technologies installation fails

Links to More Info: BT1028493

Component: Application Security Manager

Symptoms:
Installation of the Live Update genesis file (file included in BIG-IP) fails.

Conditions:
Live Update genesis file version is different than the BIG-IP version.

Impact:
"Server Technologies" will not be properly updated

Workaround:
Install latest "Server Technologies" update manually or upload the latest "Server Technologies" file.

---

1027961-2 : Changes to an admin user's account properties may result in MCPD crash and failover

Links to More Info: BT1027961

Component: TMOS

Symptoms:
-- The mcpd process fails with a segmentation fault and restarts, leaving a core-dump file.
-- Active sessions in the Configuration Utility report "unable to contact BIG-IP device".
-- Various processes may record entries into the "ltm" log saying "Lost connection to mcpd."

Conditions:
-- Changes to properties of administrative user-login accounts are occurring.
-- A user account being changed has a current, active session in the Configuration Utility GUI.

Impact:
The failure and restart of mcpd will trigger a restart of many other processes, including the TMM daemons, thus interrupting network traffic handling. In high availability (HA) configurations, a failover will occur.

Workaround:
Before making changes to the account properties of an administrative user, where the changes affect the role, make certain that all GUI Configuration Utility sessions opened by that user are logged out.

---

1027481-3 : The log messages 'error: /bin/haloptns unexpected error -- 768' generated on A110 and D112 platforms

Links to More Info: BT1027481

Component: TMOS

Symptoms:
The message 'error: /bin/haloptns unexpected error -- 768' is logged by system commands, including some startup scripts and the software installation process.

Running /bin/haloptns manually displays the following output:
'Expected 32 bit OPTN field, found field "" instead.'

Conditions:
-- One of the following platforms:
  - D112 (10350v-F (FIPS) or 10150s-N (NEBS))
  - A110 (VIPRION B4340N (NEBS) blades)

-- The system does not use RAID.

Impact:
Excessive "error: /bin/haloptns unexpected error -- 768" error messages in log files, and command output (for example, "cpcfg").

There is no other impact, and the messages can be ignored.

Workaround:
Ignore the error messages.

---

1027477-3 : Virtual server created with address-list in custom partition non-RD0 does not create listener

Links to More Info: BT1027477

Component: TMOS

Symptoms:
After creating a virtual-server in a partition with a non RD0 route-domain attached, the virtual address listener does not get associated with the virtual server and the virtual address stays offline.

Conditions:
-- An address list (traffic matching criteria) is used when creating the virtual server in the GUI.
-- The virtual server is created with a route domain other than the default route domain.

Impact:
The virtual address remains in an offline state.

Workaround:
None.

---

1027237-1 : Cannot edit virtual server in GUI after loading config with traffic-matching-criteria

Links to More Info: BT1027237

Component: TMOS

Symptoms:
After creating a virtual server with a traffic-matching-criteria and then loading the configuration, you are unable to make changes to it in the GUI. Attempting to do so results in an error similar to:

0107028f:3: The destination (0.0.0.0) address and mask (::) for virtual server (/Common/test-vs) must be be the same type (IPv4 or IPv6).

Conditions:
-- A virtual server that has traffic-matching-criteria (i.e., address and/or port lists).
-- The configuration has been saved at least once.
-- Attempting to edit the virtual server in the GUI.

Impact:
Unable to use the GUI to edit the virtual server.

Workaround:
Use TMSH to modify the virtual server.

---

1026989-1 : More specific dynamic or static routes created for application traffic processing can erroneously replace the route to the management subnet.

Links to More Info: BT1026989

Component: TMOS

Symptoms:
When a dynamic or static route is instantiated for application traffic processing, protection exists at configuration-validation time to ensure that the new route does not overwrite how the management port's subnet is accessed.

To do so, the destination of the new route is compared to the management port's subnet. If the two match, the new route is only instantiated in TMM, but not in the Linux host's routing table.

The issue is this logic fails when the new route is a subset of the management port's subnet. For example, if the new route is to destination 10.215.50.0/25, and the management port's subnet is 10.215.50.0/24, the new route will be added to both TMM and the Linux host, bypassing the aforementioned protection.

Instead, the logic should check for overlapping subnets, not just strict equality.

Conditions:
- A dynamic or static route whose destination partially overlaps with the management port's subnet is added to or learnt by the system.

Impact:
A new and more specific route for part of the management port's subnet is added to the Linux host's routing table.

Part of the management port traffic can fail or be misrouted via a TMM interface.

If multiple routes of this kind are instantiated (e.g. 10.215.50.0/25 + 10.215.50.128/25), the whole management port's subnet can be overtaken.

Workaround:
Redesign your network and then reconfigure the BIG-IP system so that TMM does not need access to the management port's subnet or part of it (thus negating the need to create a route to that destination in the first place).

If this is not possible, you can temporarily resolve the issue by using the `route` or `ip` utility on the Linux host subsystem to manually fix the routing table. However, the issue will occur again the next time the problematic route is loaded or learnt by the system.

---

1026973-1 : Static routes created for application traffic processing can erroneously replace the route to the management subnet.

Links to More Info: BT1026973

Component: TMOS

Symptoms:
If a static route is added via "tmsh create net route" (or equivalent configuration ingestion system), and this route's destination matches the management port's subnet, the protection that prevents the new route from being propagated to the Linux kernel will initially work, but will fail after mcpd is restarted or the system is rebooted.

Conditions:
- A static route whose destination matches the management port's subnet is added to the system.

- The system is rebooted or mcpd is restarted.

Impact:
The directly-connected route for the management port's subnet appearing in the Linux host's routing table is replaced, or complemented, by a new and unnecessary route.

In either case, management port traffic can fail or be misrouted via a TMM interface.

Workaround:
Align your network and the BIG-IP system so that TMM does not need access to the management port's subnet (thus negating the need to create a route to that destination in the first place).

If this is not possible, you can temporarily resolve the issue by using the `route` or `ip` utility on the Linux host subsystem to manually fix the routing table. However, the issue will occur again the next time mcpd or the system restarts.

---

1026861-3 : Live Update of Browser Challenges and Anti-Fraud are not cleaned up

Links to More Info: BT1026861

Component: TMOS

Symptoms:
When installing live updates of either Browser Challenges (ASM) or Anti-Fraud (FPS), the update file remains in the system, taking up disk space and increasing config sync size.

Conditions:
Installing Live Update files of either Browser Challenges (part of ASM) or Anti-Fraud (part of FPS).

Impact:
Increased disk size, config size, and config-sync size.

Workaround:
It is possible to manually clean up old, unused Live Update files using TMSH or REST:
tmsh delete security datasync update-file datasync-global/<file>

Important: Use caution, as deleting update-files that are in use could cause the system to go offline or get out of sync. The in-use update files can be observed under the GENERATION PROFILES section of the /var/log/datasyncd.log file.

Note: There is no auto-completion on the 'update-file' keyword.

---

1026813-7 : LCD IP address is missing from /etc/hosts on iSeries

Links to More Info: BT1026813

Component: Global Traffic Manager (DNS)

Symptoms:
On iSeries platforms, /etc/hosts is missing an entry for the LCD IP address, 127.4.2.2.

Conditions:
Run any iSeries appliance.

Impact:
- BIG-IP generates reverse DNS requests for the LCD.
- /var/log/touchscreen_lcd lists the IP address "127.4.2.2" as the hostname

Workaround:
Add an entry for the LCD to /etc/hosts by modifying the 'remote-host' global settings, by running the following tmsh command:

tmsh modify sys global-settings remote-host add { lcd { addr 127.4.2.2 hostname lcd } }
tmsh save sys config

Or, in the BIG-IP GUI, System >> Configuration : Device : Hosts

---

1026781-3 : Standard HTTP monitor send strings have double CRLF appended

Links to More Info: BT1026781

Component: Local Traffic Manager

Symptoms:
Standard (bigd-based, not In-TMM) HTTP monitors have a double CRLF appended (＼r＼n＼r＼n) to the send string. This does not comply with RFC1945 section 5.1 which states requests must terminate with a single CRLF (＼r＼n). This non-compliant behavior can lead to unexpected results when probing servers.

Conditions:
Standard bigd (not In-TMM) HTTP monitors

Impact:
Servers probed by these non-RFC-compliant HTTP monitors may respond in an unexpected manner, resulting in false negative or false positive monitor results.

Workaround:
There are several workarounds:

1. If running 13.1.0 or later, switch monitoring from bigd-based to In-TMM. In-TMM monitors properly follow RFC1945 and will send only a single CRLF (＼r＼n)

2. Remain with bigd-based monitoring and configure probed servers to respond to double CRLF (＼r＼n＼r＼n) in a desired fashion

Depending on server configuration, a customized send string, even with the double CRLF, may still yield expected responses.

---

1026621-1 : DNS cache resolver could not connect to remote DNS server with snatpool if multiple routes exist

Links to More Info: BT1026621

Component: Global Traffic Manager (DNS)

Symptoms:
DNS query could not be resolved properly.

Conditions:
1. dnscache.matchwildcardvip is enabled
2. Multiple possible routes to destination DNS server exist. This can be triggered by either using a gateway pool, or using dynamic routing with multiple equal paths available.

Impact:
Unable to use snatpool for cache resolver.

Workaround:
Ensure only a single route to destination exists, or disable dnscache.matchwildcardvip

NOTE: With dnscache.matchwildcardvip disabled, snatpool will not be used.

---

1026581-4 : NETFLOW/IPFIX observationTimeMilliseconds Information Element value is not populated correctly.

Links to More Info: BT1026581

Component: TMOS

Symptoms:
When logging Carrier Grade NAT Port Port Block Allocation (CGNAT PBA) events using NetFlow/IPFIX log destinations,
if the AFM module is not enabled, the observationTimeMilliseconds Information Element value is incorrectly reported as zero in reported events.

Conditions:
Using CGNAT PBA, logging to a NetFlow/IPFIX log destination, and AFM is not enabled.

Impact:
CGNAT PBA events containing the observationTimeMilliseconds Information Element will report incorrect values for this field.

Workaround:
1) Enable AFM module, or
2) Enable lsn-legacy-mode in the log profile

---

1026273-4 : HA failover connectivity using the cluster management address does not work on VIPRION platforms★

Links to More Info: BT1026273

Component: TMOS

Symptoms:
Upon upgrade to an affected version, failover communication via the management port does not work. You may still see packets passing back and forth, but the listener on the receiving end is not configured, and therefore the channel is not up.

Here are a few symptoms you may see:
-- Running 'tmsh show cm failover-status' shows a status of 'Error' on the management network.

-- Running 'tmctl' commands reports the disconnected state:
Example:
$ tmctl -l sod_tg_conn_stat -s entry_key,last_msg,status
entry_key last_msg status
----------------------------- ---------- ------
10.76.7.8->10.76.7.9:1026 0 0 <--- Notice there is no 'last message' and 'status' is 0, which means disconnected.
10.76.7.8->17.1.90.2:1026 1623681404 1

-- Looking at 'netstat -pan | grep 1026 command output, you do not see the management port listening on port 1026:
Example (notice that the management IP from the above example of 10.76.7.9 is not listed):
# netstat -pan | grep 1026
udp 0 0 10.10.10.10:1026 0.0.0.0:* 6035/sod

-- Listing /var/run/ contents shows that the chmand.pid file is missing:
 # ls /var/run/chmand.pid
ls: cannot access /var/run/chmand.pid: No such file or directory

Conditions:
-- Running on VIPRION platforms
-- Only cluster management IP address is configured: No cluster member IP addresses are configured
-- Install a software version where ID810821 is fixed (see https://cdn.f5.com/product/bugtracker/ID810821.html)
-- Management IP is configured in the failover configuration

Impact:
If only the management is configured for failover or there are communication issues over the self IP (such as misconfigured port lockdown settings), then the devices may appear to have unusual behavior such as both going active.

Workaround:
-- Configure a cluster member IP address on each individual blade in addition to the Cluster management IP address.

---

1025965-1 : Audit role users cannot see folder properties under sys-folder

Links to More Info: BT1025965

Component: TMOS

Symptoms:
Users with auditor role cannot create, modify, or delete any data, nor can they view SSL keys or user passwords. Users with the Auditor role have access to all partitions on the system, and this partition access cannot be changed.

Conditions:
Run tmsh command to check the access under sys folder

Impact:
Tmsh does not allow sys folder component for auditor.
no-ref-check, traffic-group, device-group

---

1025513-1 : PAM Authenticator can cause authorization failure if it fails to lock /var/log/tallylog

Links to More Info: BT1025513

Component: TMOS

Symptoms:
The following JSON content can be seen in the HTTP 401 response. (By looking at the capture or RESTful client)

{"code":401,"message":"Authorization failed: no user authentication header or token detected. Uri:http://localhost:8100/mgmt/tm/ltm/pool/?expandSubcollections=true Referrer:<ip_address> Sender:<ip_address>,"referer":<ip_address>,"restOperationId":12338804,"kind":":resterrorresponse"}


Contention for /var/log/tallylog lock might result in users failing to authenticate correctly. As a result of this issue, you might see the following message:

PAM Couldn't lock /var/log/pam/tallylog : Resource temporarily unavailable.

Conditions:
High concurrent authentication attempts may trigger this issue. For example, opening a connection, using basic authentication, performing a query (for example, get node list, get virtual address list, and set pool min active members), and then closing the connection. If done frequently enough, there is an occasional authentication failure.

Impact:
This intermittent auth issue results in the failure of some auth requests.

Workaround:
Since this is an intermittent authentication failure, wait a few seconds and then attempt to rerun auth request.

For automation tools, please use token-based authentication.

---

1025089-1 : Pool members marked DOWN by database monitor under heavy load and/or unstable connections

Links to More Info: BT1025089

Component: Local Traffic Manager

Symptoms:
BIG-IP database monitors (mssql, mysql, oracle, postgresql) may exhibit one of the following symptoms:

- Under heavy, sustained load, the database monitoring subsystem may become unresponsive, causing pool members to be marked DOWN and eventually causing the database monitoring daemon (DBDaemon) to restart unexpectedly.

- If the network connection to a monitored database server is unstable (experiences intermittent interruptions, drops, or latency), pool members may be marked DOWN as the result of a momentary loss of connectivity. This is more likely to occur when a database monitor is used to monitor a GTM pool member instead of an LTM pool member, due to differences between how monitors are configured for GTM versus LTM.

Conditions:
These symptoms may occur under the following conditions:

- The database monitoring subsystem may become unresponsive, and the database monitoring daemon (DBDaemon) may restart unexpectedly, if a large number of LTM or GTM pool members are being monitored by database monitors, and/or with short polling intervals ("interval" of 10 seconds or less), or when GTM pool members are monitored by database monitors with a short "probe-timeout" value (10 seconds or less).

- The GTM pool members may be marked DOWN after a single interrupted connection if they are monitored by a database monitor, configured with a short "probe-timeout" value (10 seconds or less) and "ignore-down-response" configured as "disabled" (default).

Impact:
-- High CPU utilization is observed on control plane cores.

-- The database monitoring daemon (DBDaemon) may restart unexpectedly, causing GTM or LTM pool members monitored by a database monitor to be marked DOWN temporarily.

-- GTM or LTM pool members monitored by a database monitor may be marked DOWN temporarily if the network connection to the database server is dropped or times out.

Workaround:
Perform one of the following actions:

-- Configure the database (mssql, mysql, oracle, postgresql) monitor with a "count" value of "1". This prevents the caching or reuse of network connections to the database server between probes. Thus there is no cached connection to time out or get dropped. However, the overhead of establishing the network connection to the database server will be incurred for each probe and will result in generally higher (but more consistent) CPU usage by the database monitoring daemon (DBDaemon).

-- Configure the database monitor "interval" and "timeout" values (for an LTM monitor), or the "interval", "timeout", "probe-attempts", "probe-interval" and "probe-timeout" values (for a GTM monitor) such that multiple failed monitor probes are required before the monitored member is marked DOWN, and with a minimum value of 10 seconds or greater.

Note: A restart of bigd (and consequently the DBDaemon) might be necessary to properly clear any currently stale/stuck database connections.

---

1024905-1 : GTM monitor times out if monitoring a virtual server with translation address

Links to More Info: BT1024905

Component: Global Traffic Manager (DNS)

Symptoms:
GTM monitor flaps between UP and DOWN.

Conditions:
1. GTM configured with two type of IP addresses, one IPv4 with translated address and IPv6 without translated address, or the other way around.
2. The monitored resource is with the translated address of the other type. If step 1, IPV4 translated, then step with IPV4 translated address.

Impact:
Monitor flaps.

Workaround:
Configure both with translated address.

---

1024553-1 : GTM Pool member set to monitor type "none" results in big3d: timed out

Links to More Info: BT1024553

Component: Global Traffic Manager (DNS)

Symptoms:
A pool member is marked down with a 'none' type monitor attached.

Conditions:
-- GTM pool member with a 'none' monitor configured

Impact:
Setting a pool member to have "none" monitor should result in a blue "checking" status but it may mark the pool member as down/unavailable.

Workaround:
NA.

---

1024421-2 : At failover, ePVA flush leads to clock advancing and MPI timeout messages in TMM log

Links to More Info: BT1024421

Component: TMOS

Symptoms:
TMM log shows clock advancing and MPI timeout messages:

notice slot1 MPI stream: connection to node aborted for reason: TCP RST from remote system (tcp.c:5201)
notice slot1 tmm[42900]: 01010029:5: Clock advanced by 6320 ticks

Conditions:
-- pva.standby.flush DB key set to 1 (enabled). The default is 0.
-- Processing high traffic volume for some time

Impact:
Upstream switch could receive flow response from both active and standby units and cause a traffic disturbance.

---

1024301-1 : Missing required logs for "tmsh modify disk directory" command

Links to More Info: BT1024301

Component: TMOS

Symptoms:
In case of failure of "tmsh modify disk directory" command, log which help to find reason for failure are getting missed.

Conditions:
Attempt to resize some volumes via the "tmsh modify disk directory" command

Impact:
Not able to find failure reason for resize of volumes.

Workaround:
Manually running the resize2fs command, can give the reason for failure.

---

1024269-1 : Forcing a file system check on the next system reboot does not check all filesystems.

Links to More Info: BT1024269

Component: TMOS

Symptoms:
Forcing a file system check on the next system reboot, as described in K73827442, does not check all filesystems. This should not be the case and is a regression compared to previous BIG-IP versions.

After the reboot, you can inspect which filesystems were checked by running the following command:

journalctl --all --no-pager | grep -i fsck

Conditions:
A BIG-IP Administrator follows the procedure to force a file system check on the next system reboot.

Impact:
Some filesystems will not be fixed, and will continue to be corrupted. This can have a number of negative consequences. For instance, enlarging a filesystem (via the 'tmsh modify sys disk directory' command) can fail when a filesystem is dirty.

Workaround:
You can boot the system from the Maintenance Operating System (MOS), and perform all needed file system check operations from there. To boot the system into MOS, simply type 'mosreboot'. Note that once the system reboots into MOS, you will need video console access (for VE systems) or serial console access (for hardware systems) to be able to run fsck and the reboot the system into a regular BIG-IP boot location.

For more information on MOS, please refer to K14245.

---

1023817-2 : Misleading "Enabling NAT64 for virtual server with security NAT policy configured is redundant/not required." warning

Links to More Info: BT1023817

Component: TMOS

Symptoms:
While loading the configuration or specifying that NAT64 should be disabled on a virtual server, a warning is displayed or logged:

"Enabling NAT64 for virtual server with security NAT policy configured is redundant/not required."

This warning should only be displayed when a virtual server has both NAT64 enabled and a security NAT policy present, but may occur incorrectly even when NAT64 is disabled.

Conditions:
This warning may be incorrectly generated when all of these conditions are met:

-- a multi-bladed VIPRION
-- virtual servers in the configuration security NAT policies
-- receiving a ConfigSync from a peer, or running "tmsh load sys config" on the primary blade

Impact:
An erroneous warning is logged. It can be safely ignored.

---

1023529-2 : FastL4 connections with infinite timeout may become immune to manual deletion and remain in memory.

Links to More Info: BT1023529

Component: Local Traffic Manager

Symptoms:
Command "tmsh show sys tmm-traffic" reports non-zero number of current connections but "tmsh show sys connection" shows nothing.

Conditions:
-- A virtual sever with fastL4 profile with infinite timeout enabled and an iRule containing "after" command. Having "-periodic" argument makes the problem more prominent.
-- Aggressive sweeper activated due to low memory conditions.

Impact:
Connections that were supposed to be removed by aggressive sweeper but were waiting for completion of an iRule may end up in a state where they are not reported by "tmsh show sys connection." Because of this issue, these connections cannot be deleted manually using 'tmsh del sys connection", but remain in memory. Their presence can be confirmed by non-zero number of current connections shown by "tmsh show sys tmm-traffic". Because of the infinite timeout setting, they will not timeout by themselves either.

Workaround:
N/A

---

1023461-2 : Multiple entries for CGNAT when PBA pools allocation is defined: for each request, a new entry is created

Links to More Info: BT1023461

Component: Carrier-Grade NAT

Symptoms:
Two pools are configured, for example:
A: any destination
B: destination 8.8.8.8

1. Making connections and utilizing port block allocation (PBA) pool A works as expected; pools are correctly allocated and released as needed.
2. When a client has active PBA pool A allocated and requests pool B (because of connectivity to specific destination IP), then each subsequent connection request from that client results in new PBA pool B allocation.

Conditions:
Multiple rules are defined to configure PBA.

Impact:
If a request does not belong to the first pool then it will not belong any other, so the system creates a new pool.

Workaround:
None

---

1023229-1 : False negative on specific authentication header issue

Links to More Info: BT1023229

Component: Application Security Manager

Symptoms:
Blocking does not occur on a specific authentication header issue when a non-default internal parameter is set.

Conditions:
ignore_authorization_header_decode_failure is not set to 0

Impact:
A request with an authentication header issue can pass.

Workaround:
None

---

1022997-1 : TCP segments with an incorrect checksum are transmitted when the sock driver is used in AWS deployments (e.g., 1NIC)

Links to More Info: BT1022997

Component: TMOS

Symptoms:
Deployments on AWS that use the sock driver (1NIC, for example) transmit packets with bad checksums when TSO/GSO is required. This causes significant delays as TMM re-segments the packets with correct checksums for retransmission, and may cause some operations to time out (such as configsyncs of large configurations).

Conditions:
-- BIG-IP Virtual Edition (VE) using the sock driver on AWS (all 1NIC deployments use this)
-- TSO/GSO required due to MTU limitations on one or more VLANs

Impact:
-- Delayed packets.
-- Possible timeouts for some operations (configsyncs, for example).

Workaround:
Modify (or create, if not present) the file /config/tmm_init.tcl on the affected BIG-IP systems, and add the following line to it:

ndal force_sw_tcs off 1d0f:ec20

Then restart TMM:

bigstart restart tmm

Note: Restarting TMM will cause a failover (or an outage if there is no high availability (HA) peer available).

---

1022973-2 : Sessiondb entries related to Oauth module not cleaned up in certain conditions

Links to More Info: BT1022973

Component: Access Policy Manager

Symptoms:
When an OAuth AS is configured with a refresh lifetime of '0', this implies that the refresh token lifetime is infinite. This leads to all sessiondb entries related to this refresh token (including associated access token entries in sessiondb) to have infinite lifetime.

Conditions:
Refresh token lifetime is set to '0'.

Impact:
User will see consistent and persistent increase in memory consumption by TMM, potentially leading to out-of-memory situation.

Workaround:
Do not set refresh token lifetime to '0'.

---

1022877-3 : Ping missing from list of Types for OAuth Client

Links to More Info: BT1022877

Component: Access Policy Manager

Symptoms:
Ping is missing from the 'Type' dropdown menu in Access ›› Federation : OAuth Client / Resource Server : OAuth Server ›› New OAuth Server Configuration...

Conditions:
-- Affected BIG-IP version
-- Add new Oauth server configuration from Access :: Federation : OAuth Client / Resource Server : OAuth Server :: New OAuth Server Configuration...

Impact:
Oauth client configuration for the server of type 'Ping' cannot be created via GUI

Workaround:
Use tmsh to create the configuration, e.g.:

tmsh create apm aaa oauth-server <server name> provider-name Ping dns-resolver-name <dns-resolver-name>

---

1022613-1 : Cannot modify Security "global-network" Logging Profile

Links to More Info: BT1022613

Component: Advanced Firewall Manager

Symptoms:
When attempting to update the settings of the Security Logging profile, the window displays a modal dialog box titled "Saving Logging Profile" and never completes the update Action

Conditions:
"global-network" logging profile is selected for update

Impact:
You are unable to update the log settings for the "global-network" profile via UI

Workaround:
Use tmsh

---

1022421-4 : Pendsec utility incorrectly starts on i2x00/i4x00 platform with NON WD disk

Links to More Info: BT1022421

Component: TMOS

Symptoms:
The pendsec utility recognizes that the disk is a HDD and attempts to run a smart check against it but it does not recognize or support the disk type that is in the system and therefore you will see log messages like this in /var/log/messages when the cron job attempts to run:

   May 14 15:34:04 fqdn.device.com notice pendsect[11461]: skipping drive --
   May 14 15:34:04 fqdn.device.com notice pendsect[11461]: No known drives detected for pending sector check. Exiting

Conditions:
- i2x00 or i4x00 platform with the Seagate brand HDD

Impact:
Cosmetic

Workaround:
You can mitigate the cosmetic log issue by suppressing the pendsec utility.

Login to BIG-IP using SSH
 
 Navigate to /etc/cron.daily
# cd /etc/cron.daily
 
Create new directory called suppress
# mkdir suppress
 
Move the pendsect cron job to suppres
# mv pendsect suppress

---

1022297-4 : In BIG-IP GUI using "Select All" with filters is not working appropriately for policies

Links to More Info: BT1022297

Component: TMOS

Symptoms:
In BIG-IP GUI using "Select All" with filters is not working appropriately for policies. When you attempt to delete policies after using filtering, all policies are deleted.

Conditions:
In BIG-IP GUI policies page, apply filter and using select all, for an action is selecting all objects and filter not applied.

Impact:
All policies objects are affected for an action, and filter is not applied

---

1022213-4 : DDOS: BDOS: Warning messages related to high availability (HA) watchdog seen on system bring up

Component: Advanced Firewall Manager

Symptoms:
When the BDoS log message level is set to "Warning", some high availability (HA) watchdog messages are logged:

info bdosd[14184]: BDoS: May 27 03:51:40|loadState|460|HA Watchdog was not found <DNS_CLASS_L>

Conditions:
-- DDoS is used.
-- Dynamic signature is enabled on vectors
-- Default BDoS log level is changed to Warning.

Impact:
Unwanted log messages displayed. They can be safely ignored.

---

1021925-4 : During bootup AWS BIG-IP endpoint was not licensed when custom gateway configured over management interface

Links to More Info: BT1021925

Component: TMOS

Symptoms:
AWS-based BIG-IP instance with a static IP assigned to the mgmt interface and a custom gateway configured, the box fails to load its license during startup.

Conditions:
BIG-IP configured with static IP address and customize gateway for default route.

Impact:
BIG-IP fails to load license.

Workaround:
Once BIG-IP boots up, execute reloadlic command which installs the license.

---

1021873-1 : TMM crash in IPIP tunnel creation with a pool route

Links to More Info: BT1021873

Component: TMOS

Symptoms:
In rare circumstances, the Traffic Management Microkernel (TMM) process may produce a core file in the /shared/core directory while processing traffic.

Conditions:
1)Virtual server attached with an ipip encapsulation enabled pool
2)Multiple paths to pool members
(pool route to pool member)

Impact:
Traffic disrupted while tmm restarts.

---

1021837-3 : When a virtual server has an inline service profile configured, connections will be reset with cause "No server selected"

Links to More Info: BT1021837

Component: Local Traffic Manager

Symptoms:
Connections are reset with "No server selected" cause.

Conditions:
-- An inline service profile ("ltm profile service") attached to a normal virtual server

Impact:
TCP connections are reset

Workaround:
Delete and recreate the virtual server without the inline service profile associated with it.

Simply removing the service profile from the virtual server is not sufficient.

---

1021609-1 : Improve matching of URLs with specific characters to a policy.

Links to More Info: BT1021609

Component: Application Security Manager

Symptoms:
Request with a URL containing specific characters is not matched to the correct policy.

Conditions:
URL of request contains specific percent-encoded characters.

Impact:
The request will not be matched by an expected policy rule.

Workaround:
Add an additional rule with explicit decoded characters.

---

1021109-4 : The cmp-hash VLAN setting does not apply to trunked interfaces.

Links to More Info: BT1021109

Component: TMOS

Symptoms:
-- CPU usage is increased.
-- Throughput is reduced.
-- Packet redirections occur (visible when using 'tmctl -d blade tmm/flow_redir_stats')

Conditions:
-- Traffic is received on trunked interfaces.
-- The cmp-hash setting has a non-default value.
-- The platform is BIG-IP Virtual Edition (VE).

Impact:
Performance is reduced. Output from 'tmctl -d blade tmm/flow_redir_stats' shows redirections.

Workaround:
-- Use the default cmp-hash setting.
-- Do not trunk interfaces.

---

1020881-1 : TMM crashes while passing APM traffic.

Links to More Info: BT1020881

Component: Access Policy Manager

Symptoms:
TMM crashes while passing APM traffic.

Conditions:
-- LTM + APM deployment.
-- Allow list in use.
-- iRules in use.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
#--- logout_irule starts
when HTTP_REQUEST {
  if { ([string tolower [HTTP::uri]] contains "closeconnection.aspx"
    || [string tolower [HTTP::uri]] contains "signout.aspx")
    && [ACCESS::session exists -state_allow -sid [HTTP::cookie MRHSession]] } {
      HTTP::respond 200 content {<html><body><h1>You are now logged out.</h1></body></html>}＼
      "Set-Cookie" "F5_ST=deleted;expires=Thu, 01-Jan-1970 00:00:01 GMT;path=/"＼
      "Set-Cookie" "MRHSHint=deleted;expires=Thu, 01-Jan-1970 00:00:01 GMT;path=/"＼
      "Set-Cookie" "F5_HT_shrinked=deleted;expires=Thu, 01-Jan-1970 00:00:01 GMT;path=/"＼
      "Set-Cookie" "F5_fullWT=deleted;expires=Thu, 01-Jan-1970 00:00:01 GMT;path=/"＼
      "Set-Cookie" "LastMRH_Session=deleted;expires=Thu, 01-Jan-1970 00:00:01 GMT;path=/"＼
      "Set-Cookie" "MRHSession=deleted;expires=Thu, 01-Jan-1970 00:00:01 GMT;path=/"

      ACCESS::session remove
      log local0. "iRule logout triggered: Removing access session for [ACCESS::session sid]"
      # disable HTTP_REQUEST events for all other iRules
      event disable
  }
}
#--- logout_irule ends

---

1020277-1 : Mcpd may run out of memory when build image is missing★

Links to More Info: BT1020277

Component: TMOS

Symptoms:
After installing a new blade, if the BIG-IP does not have the appropriate images to install all volumes onto the new blade, it can get stuck waiting to install. This may cause mcpd to eventually run out of memory.

Running "tmsh show sys software" shows a message similar to this for a prolonged period of time:

HD1.2 3 BIG-IP 12.1.3.5 0.0.10 no waiting for product image (BIG-IP 12.1.3)

Conditions:
-- Installing a new blade into a chassis-based system.
-- Missing BIG-IP image(s) necessary to update all volumes on the new blade.

Impact:
Mcpd eventually runs out of memory and cores.

Workaround:
Either delete the affected volume if it is no longer necessary, or copy the appropriate BIG-IP image to /shared/images.

---

1020149-4 : Bot Defense does not support iOS's WKWebView framework

Links to More Info: BT1020149

Component: Application Security Manager

Symptoms:
When using the Bot Defense Profile, mobile apps which use iOS's WKWebView framework may get blocked from accessing the website.

Conditions:
-- Using the Bot Defense Profile
-- Mobile apps which use iOS's WKWebView framework try to access the website

Impact:
Mobile apps which use iOS's WKWebView framework may get blocked from accessing the website.

Workaround:
None

---

1020129-2 : Turboflex page in GUI reports 'profile.Features is undefined' error★

Links to More Info: BT1020129

Component: TMOS

Symptoms:
The System :: Resource Provisioning : TurboFlex page is unusable, and the BIG-IP GUI reports an error:

An error occurred: profile.Features is undefined.

Conditions:
-- BIG-IP iSeries appliance
-- Upgrade to:
--- v15.1.3 or later within v15.1.x
--- v16.0.1.2 or later within v16.0.x
--- v16.1.0 or later
-- Accessing the System :: Resource Provisioning : TurboFlex page in the BIG-IP GUI

Impact:
Unable to manage TurboFlex profile via the BIG-IP GUI.

Workaround:
Use tmsh or iControl REST to manage TurboFlex profile configuration.

---

1020109-1 : Subnet mask property of virtual addresses not displayed in management GUI

Links to More Info: BT1020109

Component: TMOS

Symptoms:
You cannot determine the subnet mask for a displayed virtual address using only the BIG-IP management GUI.

Conditions:
-- A virtual address (automatically created by any virtual server) exists in the configuration.
-- Using the management GUI.

Impact:
Potential difficulty in troubleshooting and verifying config due to having to use other methods (accessing the CLI) to check a virtual address's netmask.

Workaround:
Use tmsh to determine the subnet mask.

---

1020089-1 : MCP validation should prevent defining multiple virtual servers with the same virtual address but with different subnet masks

Links to More Info: BT1020089

Component: TMOS

Symptoms:
Multiple virtual servers with the same virtual address but with different subnet masks are allowed.

Conditions:
Creation of multiple virtual servers with the same virtual address but with different subnet masks.

Impact:
Latest virtual server instantiation implicitly and silently modifies the subnet mask of the virtual address, making the system not behave as the user thinks or intended.

Workaround:
None.

---

1020069-1 : Equinix SmartKey HSM is not working with nethsm-partition 'fortanix'

Links to More Info: BT1020069

Component: Local Traffic Manager

Symptoms:
Setting up the Equinix SmartKey HSM with nethsm-partition 'fortanix' (or anything other than 'auto') pkcs11d logs an error:

err pkcs11d[21535]: 01680040:3: netHSM: Failed to find partition with label 'fortanix' on the netHSM.

Conditions:
Configuring a nethsm-partition other than 'auto'.

Impact:
BIG-IP does not connect to the HSM and SSL traffic is disrupted.

Workaround:
Use the nethsm-partition 'auto'
tmsh create sys crypto fips nethsm-partition 'auto'

---

1020005-1 : OOM errors after upgrade and VE instance unresponsive★

Links to More Info: BT1020005

Component: TMOS

Symptoms:
VE is unstable or unresponsive and Out of Memory (OOM) errors after the upgrade.

Conditions:
- Configuration failures during upgrades.

Impact:
VE instance may go unstable or unresponsive.

Workaround:
Resolve configuration error and load the configuration where provisioning will setup enough memory to host.

---

1019793-2 : Image2disk does not work on F5OS BIG-IP tenant.★

Links to More Info: BT1019793

Component: TMOS

Symptoms:
Image2disk fails to recognize the correct disk to install and installation fails.

Conditions:
This occurs with BIG-IP tenants that are running in F5OS partitions.

Impact:
Installation fails.

Workaround:
None

---

1019749-2 : Enabling DHCP for management should not be allowed on vCMP guest

Links to More Info: BT1019749

Component: TMOS

Symptoms:
Options to enable DHCP for the management interface are available on vCMP guests.

Conditions:
-- BIG-IP vCMP guest running on an appliance

Impact:
VCMP guest can be configured with options that are incompatible with VCMP operation.

This might result in a loss of management IP in the guest after a reboot

Workaround:
Do not attempt to DHCP on the management interface of a vCMP guest.

---

1019709-1 : Modifying mgmt-dhcp options should not be allowed on VCMP guest

Links to More Info: BT1019709

Component: TMOS

Symptoms:
Option to modify mgmt-dhcp to dhcpv4 or dhcpv6 is available on VCMP guest.

Conditions:
This is encountered with the following tmsh command

modify sys global-settings mgmt-dhcp
Values:
  dhcpv4 dhcpv6 disabled enabled

Impact:
VCMP guest can be configured with options that are incompatible with VCMP operation.

This might result in a loss of management IP in the guest after a reboot

Workaround:
N/A

---

1019641-3 : SCTP INIT_ACK not forwarded

Links to More Info: BT1019641

Component: Local Traffic Manager

Symptoms:
After SCTP link down/up (not physical IF link down up), SCTP session can't be established.

Conditions:
-- CMP forwarding enabled (source-port preserve-strict)
-- The BIG-IP system is encountering heavy traffic load
-- A connection is deleted from the connection table

Impact:
Flow state can become out of sync between TMMs

Workaround:
Once the problem occurs, execute "tmsh delete sys connection", and the SCTP session will be re-established.

---

1019557-1 : Bdosd does not create /var/bdosd/*.json

Links to More Info: BT1019557

Component: Advanced Firewall Manager

Symptoms:
JSON files for historical data are not created for each virtual server in /var/bdosd.

BDOS for DDoS works on current data in memory but cannot to depend on the historical data for all virtual servers

Conditions:
BDOS is configured for any virtual server

Impact:
Custom signature or BDDoS-generated signature for the virtual server does not work correctly.

Workaround:
None

---

1019481-1 : Unable to provision PEM on VELOS platform

Links to More Info: BT1019481

Component: Policy Enforcement Manager

Symptoms:
Unable to provision PEM on VELOS platform

Conditions:
When trying to provision PEM

Impact:
PEM functionality cannot be achieved

Workaround:
Change sys db provision.enforce value to false and load sys config

---

1019453-1 : Core generated for autodosd daemon when synchronization process is terminated

Links to More Info: BT1019453

Component: Advanced Firewall Manager

Symptoms:
Autodosd cores on SIGSEGV.

Conditions:
-- AFM DoS vectors configured
-- This can occur during normal operation but the specific conditions that trigger it are unknown

Impact:
Autodosd is restarted, but up to 15 seconds of history may be lost.

Workaround:
None

---

1019429-1 : CMP Forwarded flows do not get syncache counter decremented when only server-side is PVA accelerated

Links to More Info: BT1019429

Component: TMOS

Symptoms:
Virtuals with CMP forwarded flows and PVA acceleration may see a higher than expected syncache counter which can lead to permanent syncookie activation.

Also, under certain conditions the internal listeners used for config-sync may have syncookies activated. Logs will show the syncookie counter increasing after every activation.

bigip1 warning tmm1[18356]: 01010038:4: Syncookie counter 9830 exceeded vip threshold 2496 for virtual = 192.168.1.1:4353
bigip1 warning tmm1[18356]: 01010038:4: Syncookie counter 9834 exceeded vip threshold 2497 for virtual = 192.168.1.1:4353

Conditions:
-- Virtual servers with CMP forwarded flows - commonly occurring when the FTP profile is in use.
-- A platform with PVA acceleration enabled.
-- Only the server-side flow of a connection is offloaded to hardware.

Impact:
Elevated syncache_curr, epva_connstat.embryonic_hw_conns, epva_connstat, embryonic_hw_tcp_conns stas. Improper syncooke activation. Syncookie activation on the config-sync listener may cause config-sync to fail.

Workaround:
Remove the ftp profile or disable PVA acceleration:

modify sys db pva.acceleration value none

---

1019285-1 : Systemd hangs and is unresponsive

Links to More Info: BT1019285

Component: TMOS

Symptoms:
When memory is exhausted on the system and systemd tries to fork to start or stop a service, systemd fails and enters "freeze" mode.

Conditions:
Following log messages can be seen in the daemon.log log file:

err systemd[1]: Failed to fork: Cannot allocate memory
crit systemd[1]: Assertion 'pid >= 1' failed at src/core/unit.c:1997, function unit_watch_pid(). Aborting.
emerg systemd[1]: Caught <ABRT>, cannot fork for core dump: Cannot allocate memory
emerg systemd[1]: Freezing execution.

Impact:
Systemd does not provide service anymore.

Workaround:
Reboot the system to restore the systemd services.

---

1019261-1 : In-TMM HTTPS monitor with SSL Profile set to None does not use serverssl profile.

Links to More Info: BT1019261

Component: In-tmm monitors

Symptoms:
HTTPS monitors with SSL profile set to None (default) will not use the default ServerSSL profile of "serverssl" when In-TMM monitoring is enabled. Instead, another internal ServerSSL profile is used which has different values from "serverssl".

Conditions:
-- In-TMM monitoring is enabled
-- HTTPS monitor(s) with SSL profile field is set to the default of "None"

Impact:
The TLS settings for the HTTPS monitor monitor probes will not match those of the ServerSSL "serverssl" profile and may cause unexpected behavior such as utilizing TLS 1.3 (disabled by default in the "serverssl" profile) or random session IDs.

Workaround:
Specify a ServerSSL profile in every HTTPS monitor when using In-TMM monitoring.

Attaching the profile "serverssl" will result in the same behavior that SSL Profile "none" should provide, given that the "serverssl" profile should be the default.

---

1019129-4 : Changing syslog remote port requires syslog-ng restart to take effect

Links to More Info: BT1019129

Component: TMOS

Symptoms:
Modified remote port in syslog configuration takes effect only after restart of the syslog-ng.

Conditions:
-- Configure the remote syslogs and allow some time to pass.
-- Change the local IP or remote port in syslog config.

Impact:
Change does not occur until you reboot or restart syslog-ng.

Workaround:
To cause the change to occur, restart syslog-ng:
bigstart restart syslog-ng

---

1018765-1 : Changing the sshd port breaks some BIG-IP utilities on a multi-bladed system

Links to More Info: BT1018765

Component: Local Traffic Manager

Symptoms:
After using "sys sshd port" to change the default port for sshd, some utilities may no longer work properly on the BIG-IP, such as:

"tmsh reboot slot ..."

or

qkview

or

any command using clsh

or

ssh slot<slot number>

Conditions:
-- Chassis system with multiple blades.
-- Default sshd port was modified.

Impact:
Unable to run commands on secondary blades.

Workaround:
-- Reconfigure SSHD to run on the default port, 22.

or

-- Specify an explicit port when using ssh and log in to each blade to run the desired commands, e.g. "ssh -p 40222 slot2"

---

1018673-1 : Virtual Edition systems replicate host traffic to all TMMs when a multicast MAC address is the traffic's nexthop

Links to More Info: BT1018673

Component: TMOS

Symptoms:
When BIG-IP Virtual Edition receives a host packet that has a multicast MAC address as its nexthop, it will disaggregate this by forwarding it to all TMMs. This results in all TMMs egressing the packet.

Conditions:
-- BIG-IP Virtual Edition
-- A route is configured to a multicast MAC address
-- Host traffic (e.g. non-TMM monitors, ping, etc.) is routed to the multicast MAC address

Impact:
Extraneous packets are egressed from the BIG-IP.

Workaround:
Partial workaround for the case of monitors: use in-TMM monitors where possible. Otherwise, there is no workaround for this.

---

1018165-1 : GUI display of DHCPv6 profile not correct for virtual server in non-default route-domain

Links to More Info: BT1018165

Component: TMOS

Symptoms:
A virtual server created in a non-default route-domain with a DHCPv6 profile shows as using a DHCPv4 profile 'None' in the GUI.

Conditions:
-- Virtual server using a DHCPv6 profile.
-- Virtual server must be in a non-default route-domain.
-- Using the GUI to view the virtual server.

Impact:
Incorrect view of the configuration.

Workaround:
None

---

1017897-1 : Self IP address creation fails with 'ioctl failed: No such device'

Links to More Info: BT1017897

Component: TMOS

Symptoms:
Creating a self IP address after a route-domain using TMSH reports an error:

01070712:3: Cannot get device index for Backend in rd2 - ioctl failed: No such device.

Conditions:
Using tmsh, create a Trunk, create a VLAN on the trunk, create a route-domain, then create a self IP address.

Impact:
Self IP address creation fails after route-domain creation.
Unable to run declarative-onboarding declaration.

Workaround:
Add a short delay after modifying/creating the route domain before creating the self IP address.

Note: Self IP address should be created after route-domain creation.

---

1017885-5 : Wildcard server-name does not match multiple labels in FQDN

Links to More Info: BT1017885

Component: Local Traffic Manager

Symptoms:
Wildcard server-name does not match multiple labels in FQDN
for example: *.domain.com matches a.domain.com or a.bc.domain.com, but it does not match domain.com but here multiple labels(a.bc.domain.com) are not matched to the wildcard (*.domain.com).

Conditions:
Client-ssl is configured with a wildcard server-name with the virtual server configured with multiple client-ssl profiles. The correct ssl profile (and therefore certificate) is chosen based on SNI from the client Hello.

Impact:
Generates default profile/certificate when trying to match with multiple labels using wildcard, when it should generate correct certificate matched to the wildcard in server name.

Workaround:
Add additional SAN values to the certificate with the relevant second-level domain elements, for example:

When serving "site.test.example.com" using a certificate that matches just *.example.com, add a second SAN element to the certificate of *.test.example.com

---

1017857-1 : Restore of UCS leads to incorrect UID on authorized_keys★

Links to More Info: BT1017857

Component: TMOS

Symptoms:
After restoring a UCS from a different BIG-IP device, the admin user is unable to log in via SSH using SSH public key authentication.

Conditions:
-- Create a UCS on one BIG-IP system where a UCS archive has been restored in the past (including by an upgrade)
-- Import the UCS to a different BIG-IP system and load it

Impact:
You are unable to log in as the admin user via SSH using key-based authentication.
NOTE: Password authentication works without any issues.

Workaround:
Change the owner of /home/admin/.ssh/authorized_keys to 'root', by running the following command:

    chown root /home/admin/.ssh/authorized_keys

This command can also be run via iControl REST using the /mgmt/tm/util/bash endpoint.

---

1017801-1 : Internal listeners (cgc, ftp data, etc) all share the same listener_key stats

Links to More Info: BT1017801

Component: Local Traffic Manager

Symptoms:
Internal stats are not accurate because they are shared across multiple listener types

Conditions:
This can occur when multiple virtual server types are in use and passing traffic.

Impact:
Internal listener stats are not accurate.

---

1017421-4 : SASP Monitor does not log significant error conditions at default logging level

Links to More Info: BT1017421

Component: Local Traffic Manager

Symptoms:
Most error conditions encountered by the SASP monitor are not logged at the default logging level ("error"). Most of the meaningful error conditions, including Exceptions, are logged at "info" or "debug" levels. Obtaining details to diagnose the SASP monitor issues requires reconfiguring sys db saspd.loglevel for a value of "info" or "debug".

Conditions:
-- Using the SASP monitor to monitor LTM pool members
-- Leaving the saspd.loglevel system DB variable configured at the default value of "error"

Impact:
Errors which occur intermittently or once while monitoring LTM pool members using the SASP monitor may not be diagnosable.

Workaround:
Configure the saspd.loglevel system DB variable with a value of "info" (for normal operations) or "debug" (if problems are occurring repeatedly).

---

1017261-7 : Configuraton update triggers from MCP to ASM are ignored

Links to More Info: BT1017261

Component: Application Security Manager

Symptoms:
If a stale/incorrect but running PID is present in /var/ts/var/install/ucs_install.pid, then ASMConfig will think it is in the middle of a UCS or Sync load event and ignore updates from MCP.

Conditions:
A UCS load event such as an upgrade or a config sync is interrupted and ASM is not restarted until another process reuses the process id from the upgrade.

Impact:
Updates from MCP are ignored which can cause:
* Missed sync events
* Missed updates for logging or pool configuration
* Missing security policies

Workaround:
Delete /var/ts/var/install/ucs_install.pid

---

1017149-1 : User-defined bot sigs that are created in tmsh don't overlap staged factory bot sigs

Component: Application Security Manager

Symptoms:
User-defined bot signatures that are created in tmsh are not enforced if there are similar factory bot signatures even when they are staged.

Conditions:
User-defined bot signature is created in tmsh and is matched also by staged factory bot signature.

Impact:
User-defined signature is not enforced correctly

Workaround:
Define user-defined bot signature using the GUI and if signature domain are needed but can't be configured by the GUI, define the domain in tmsh after the signature is created with:
tmsh mod security bot-defense signature <sig_name> domains replace-all-with { domains }

---

1017029-5 : SASP monitor does not identify specific cause of failed SASP Registration attempt

Links to More Info: BT1017029

Component: Local Traffic Manager

Symptoms:
On affected BIG-IP versions, upon startup, the SASP monitor sends a single Registration Request to the SASP GWM (Group Workload Manager) to initiate monitoring of configured LTM pool members. This Registration Request contains all configured LTM pools (SASP Groups) and members (SASP Group Members).

If an error is encountered by the SASP GWM with one of the SASP Groups in the request, the registration of all groups fails.
However, the GWM does not provide any indication of *which* Group or member does not match the GWM configuration, hindering troubleshooting efforts.

The current BIG-IP behavior does not allow identification of the specific pool/member or monitor that is misconfigured and thus responsible for the failed SASP Registration attempt.

Conditions:
This behavior occurs on affected BIG-IP versions when the LTM SASP monitor is configured to monitor members of multiple LTM pools, and when BIG-IP start/restarts/reboots or the configuration is loaded.

Impact:
If a single Registration Request fails, the GWM terminates the connection with the Load Balancer (BIG-IP SASP monitor). This behavior is defined by the SASP protocol and SASP GWM implementation.

As a result, the SASP monitor will mark all pool members DOWN that are monitored by the SASP monitor, halting traffic from flowing to all pools monitored by the SASP monitor.

When an error occurs during registration of the LTM pools (SASP Groups), the GWM does not provide any indication of *which* Group or member does not match the GWM configuration.
Since a single error message is returned by the SASP GWM for the entire Registration Request (for all SASP Groups), the SASP monitor cannot indicate which Group (pool/member) or monitor caused the error.

This hinders efforts to troubleshoot the cause of the failure, while all traffic has stopped flowing to the SASP-monitored pools.

Workaround:
To diagnose this issue, first enable saspd debug logging:
tmsh mod sys db saspd.loglevel value debug_msg
(Optional alternative values include deep_debug and debug, but provide less detail.)

With saspd debug logging enabled, a message like the following in /var/log/monitors/saspd.log confirms that an error occurred during the Registration step:
SASPProcessor::processRegistrationReply: received error registering workloads with GWM ##.##.##.###:3860: 69 'InvalidGroup'

If the above message is found to confirm this issue, the primary path to resolution should be for the BIG-IP administrator to very carefully compare the BIG-IP pool/member and sasp monitor configuration with the SASP GWM configuration, to identify any mismatches or inconsistencies between the configurations.

On the BIG-IP system, to help isolate the misconfigured LTM pool(s)/member(s) causing the SASP Registration failure:
1. Remove the sasp monitor from configured LTM pools/members one at a time, and observe whether any pool members still monitored by the sasp monitor are marked UP.
2. Add the sasp monitor back to configured LTM pools/members one at a time, in the same order as removed, except for the last LTM pool/member from which it was removed.
3. Save and reload the configuration, and check whether the LTM pools/members monitored by the sasp monitor are still marked UP.
4. Repeat as necessary if there appear to be multiple LTM pools/members causing a SASP Registration failure.


Alternately, it may be possible to choose a different monitor (using a more fault-tolerant protocol) to monitor the status of affected pool members.

---

1016921-3 : SSL Connection mirroring - session resumption does not occur on standby when the session ticket is enabled

Links to More Info: BT1016921

Component: Local Traffic Manager

Symptoms:
Eight-second delays occur on traffic through an SSL connection mirroring virtual server, and errors occur on the standby device:

crit tmm7[11598]: 01010025:2: Device error: crypto codec Couldn't create an OpenSSL EC group object OpenSSL error:0906D06C:PEM
err tmm7[11598]: 01010282:3: Crypto codec error: sw_crypto-7 Couldn't initialize the elliptic curve parameters.
crit tmm7[11598]: 01010025:2: Device error: crypto codec No codec available to initialize request context.

Conditions:
All of these conditions:
-- SSL connection mirroring enabled
-- Session tickets are enabled
-- High availability (HA) environment

and one of the following:
-- Running BIG-IP v14.1.4.1 or above (in the v14.1.x branch)
or
-- Engineering hotfix applied to v14.x/v15.x that has the ID760406 fix (see https://cdn.f5.com/product/bugtracker/ID760406.html)

Impact:
SSL traffic is significantly delayed and errors are thrown on the standby device.

Workaround:
Any one of the following could prevent the problem.

-- client-ssl profile cache-size 0.
-- client-ssl profile session-ticket disabled (default).
-- disable SSL connection mirror on virtual server.

---

1016909-1 : BIG-IP iRule commands FLOW::this or FLOW::peer can create zombie flows.

Links to More Info: BT1016909

Component: Local Traffic Manager

Symptoms:
Keeping a variable reference to FLOW::this or FLOW::peer in iRules can result in zombie connection flows that are never removed.

TMM memory use for 'connflow' and 'tclrule_pcb' are high, and do not match the number of current connections reported by the system.

Conditions:
-- iRule that uses FLOW::this or FLOW::peer, and stores the result of one of those commands into a variable.

Impact:
Increased memory use in TMM, which can eventually result in a TMM crash or traffic disruption while connections are removed using the connection sweeper.

Workaround:
Do not retain the result of 'FLOW::this' or 'FLOW::peer' in a variable in an iRule. Instead, either:

1. Use the variable directly, i.e.:
    log local0.warning: "The flow is [FLOW::this]"

2. Unset the variable when done, i.e.:
    set flow [FLOW::this]
    log local0.warning: "The flow is $flow"
    unset flow


If a system is already affected by this issue, the only way to free that memory is to restart TMM.

---

1016589-1 : Incorrect expression in STREAM::expression might cause a tmm crash

Links to More Info: BT1016589

Component: Local Traffic Manager

Symptoms:
Tmm restarts and generates a core file

Conditions:
An iRule uses STREAM::expression that contains certain strings or is malformed.

Stream expressions use a string representing a series of search/replace or search components. If there is more than one search-only component, this might cause tmm to crash.

The delimiter character used is the first character of each component search/replace pair. This example uses the '@' character as the delimiter, but it is malformed.

Given
  STREAM::expression "@dog@dot@cat@car@uvw@xyz@"
This would be interpreted as three items:
  search for "dog" replace with "dot"
  search for "at@"
  search for "r@uvw@xyz@"

This string should likely be:
  STREAM::expression "@dog@dot@@cat@car@@uvw@xyz@"
Which would be interpreted as
  search for "dog" replace with "dot"
  search for "cat" replace with "car"
  search for "uvw" replace with "xyz"

Impact:
Traffic disrupted while tmm restarts.

Workaround:
Ensure that strings in STREAM::expression iRule statements do not have more than one search-only component and are well formed.

---

1016481-1 : Special JSON characters in Dom Signatures breaks configuration

Links to More Info: BT1016481

Component: Fraud Protection Services

Symptoms:
FPS modules malfunction.

Conditions:
Unescaped special JSON characters used in Dom Signatures.

Impact:
FPS client-side JS unable to load configuration JSON.

Workaround:
Manually escape all special JSON characters in Dom Signatures.

---

1016433-2 : URI rewriting is incorrect for "data:" and "javascript:"

Links to More Info: BT1016433

Component: Local Traffic Manager

Symptoms:
In case of LTM rewrite, HTML content having attribute values like "javascript:", "mailto:", "data:" etc are incorrectly rewritten as URI. This can cause web applications to fail.

Conditions:
-- LTM rewrite profile in URI translation mode.
-- HTML contents of web application contains attribute values like "javascript:abc", "data:" etc.

Impact:
Incorrect URI rewriting may cause web application to fail.

---

1015817-1 : Flows rejected due to no return route do not increment rejection stats

Links to More Info: BT1015817

Component: Local Traffic Manager

Symptoms:
When flows are rejected due to no return route being present, the BIG-IP does not increment the appropriate statistics to indicated this.

Conditions:
Flows are rejected due to no return route.

Impact:
There is no indication of the real problem when viewing the statistics.

---

1015793-1 : Length value returned by TCP::payload is signed and can appear negative

Links to More Info: BT1015793

Component: Local Traffic Manager

Symptoms:
When an iRule uses TCP::collect, if the amount of received data being buffered exceeds 2147483647 octets, the value returned from [TCP::payload length] will appear as a negative integer.

Conditions:
An iRule has been written to use TCP::collect with a very high-volume input stream.

Impact:
The unanticipated negative value may confuse the iRule's logic, with unpredictable effects. In extreme cases, a disruption of the TMM could occur.

Workaround:
Convert the result of "TCL::payload length" to an unsigned integer before using it, e.g.:

    set curlen [expr { 0xffffffff & [TCP::payload length] }]

Note: the amount of accumulated payload still must not exceed 4,294,967,295 bytes (2^32-1).

---

1015501-3 : Changes to DHCP Profile are not used by tmm

Links to More Info: BT1015501

Component: Policy Enforcement Manager

Symptoms:
After changing the authentication settings of a DHCP profile, the old authentication settings are still used.

Conditions:
Modify ltm profile dhcpv4 Discovery_DHCPv4_profile authentication { enabled true virtual RadiusAAA }

Impact:
New connections use existing listeners.

Workaround:
Restart tmm.

Impact of workaround: traffic disrupted while tmm restarts.

---

1015453-1 : In few circumstances, the Local Traffic menu in System > Configuration is inaccessible in the GUI

Links to More Info: BT1015453

Component: TMOS

Symptoms:
The Local Traffic menu in System > Configuration is inaccessible in the GUI.

Conditions:
-- LTM is licensed or provisioned.
-- GTM is licensed or provisioned.
-- AFM, DNS, and DoS are not provisioned.
-- Other modules (such as APM) are provisioned

Impact:
Unable to configure SYN cookies.

Workaround:
Use TMSH to configure SYN cookies.

---

1015117-5 : Headers are corrupted during modification/insertion if a mix of end-of-line markers <CRLF> and <LF> are used

Links to More Info: BT1015117

Component: Local Traffic Manager

Symptoms:
HTTP header corruption occurs after insertion/modification using an iRule in HTTP Headers which contain mixed end-of-line markers <CRLF> and <LF>.

Conditions:
- HTTP virtual server
- An iRule, policy or profile inserts an HTTP Request header - Such as x-forwarded-for
- An HTTP request contains some lines that end with <CRLF> and some that end with <LF>

Impact:
Inserted headers get concatenated in such a way that the HTTP request header gets corrupted.

Workaround:
Use HTTP headers with proper end-of-line markers in compliance with HTTP RFC

---

1015093-1 : The "iq" column is missing from the ndal_tx_stats table

Links to More Info: BT1015093

Component: TMOS

Symptoms:
When viewing the ndal_tx_stats statistics table, the "iq" column is not present.

Conditions:
-- BIG-IP Virtual Edition.
-- Viewing statistics tables.

Impact:
Missing statistic; less information available.

---

1014761-2 : [DNS][GUI] Not able to enable/disable pool member from pool member property page

Links to More Info: BT1014761

Component: Global Traffic Manager (DNS)

Symptoms:
You are unable to enable/disable DNS pool members from the pool member property page.

Conditions:
Making changes via the DNS pool member property page.

Impact:
You can submit the changes but the changes do not persist.

Workaround:
1. tmsh
or
2. enable/disable pool member from list of pool members instead of 'general properties' page

---

1014633-4 : Transparent / gateway monitors may fail if there is no route to a node

Links to More Info: BT1014633

Component: Local Traffic Manager

Symptoms:
Transparent or gateway monitors may fail.

Conditions:
-- Transparent or gateway monitor configured.
-- Route does not exist to destination.

Impact:
The monitor fails and the node / pool member is marked unavailable.

Workaround:
Add a route to the destination.

---

1014361-2 : Config sync fails after provisioning APM or changing BIG-IP license

Links to More Info: BT1014361

Component: TMOS

Symptoms:
Clustered high availability (HA) devices cannot establish ConfigSync connection, and the prompt status reports disconnected.

MCPD is logging a message similar to this repeatedly, even though all TMMs are up and running:

err mcpd[4247]: 0107142f:3: Can't connect to CMI peer 192.0.2.1, TMM outbound listener not yet created

Conditions:
This can occur under either of the following conditions:

-- Some provisioning operations (i.e. provisioning APM), when TMM restarts during the provisioning. This has primarily been seen with BIG-IP instances running in Google Cloud.

-- Changing the license of a BIG-IP VE when the new license changes the number of TMM instances that will run on the BIG-IP (i.e. upgrading from a 1Gbps to 3Gbps VE license)

Impact:
BIG-IP devices are not able to perform ConfigSync operations.

Workaround:
Restart MCPD on the affected system.

Note: This will disrupt traffic while system services restart.

---

1014285-5 : Set auto-failback-enabled moved to false after upgrade★

Links to More Info: BT1014285

Component: TMOS

Symptoms:
In a traffic group, auto-failback-enabled is changed from true to false after config save and upgrade.

During the upgrade, the following log can be observed:

info: Warning: Invalid configuration - Traffic Group has high availability (HA) Group "test_HA_Group" assigned and auto-failback-enabled set to true. Resetting auto-failback-enabled to false.

Conditions:
-- auto-failback-enabled is set to true and high availability (HA) groups are configured and assigned to traffic-group
-- The device is upgraded.

Impact:
Auto-failback-enabled is set from true to false and auto failback is disabled.

Workaround:
After upgrade, set the auto-failback-enabled to true.

---

1013937-1 : In-TMM HTTP and HTTPS monitors require RFC-compliant send strings to work.

Links to More Info: BT1013937

Component: Local Traffic Manager

Symptoms:
Pool members that should be marked UP are incorrectly marked DOWN. No monitor traffic is seen on the wire.

If pool member monitor logging is enabled, an entry similar to the following example can be seen in the logs:

[0][1399] 2021-02-11 11:11:34.709360: ID 44 :TMM::handle_message(TMA_Message<tma_msg_args_notify>*): tmm monitor failed to connect [ tmm?=true td=true tr=false tmm_mid=0:1 addr=::ffff:192.168.10.100:80 srcaddr=none ]

If tma debug logging is enabled, an entry similar to the following example can be seen in the logs:

Feb 11 11:12:14 bigip1.local debug tmm[2259]: 01ad0019:7: Monitor Agent TMM 0: received probe response: MID 1, reason TMA_RESULT_FAIL(Probe response lost due to transient failure), info 0

Conditions:
- In-tmm monitoring is enabled (the bigd.tmm db key is set to enable).

- A HTTP or HTTPS monitor has been configured with a send string which is not RFC-compliant. For instance, the following string incorrectly includes a space before the Host header:

"GET / HTTP/1.1＼r＼n Host: example.com＼r＼nConnection: Close＼r＼n＼r＼n"

Impact:
Pool member monitoring is impacted and unreliable.

Workaround:
Ensure that you specify a send string which is fully RFC-compliant (for instance, in the example above, remove the space before the Host header).

---

1013777-4 : An error is encountered when enabling reset-learning to all the signatures of a protocol inspection profile in the GUI.

Links to More Info: BT1013777

Component: Protocol Inspection

Symptoms:
An error is displayed in the GUI when reset-learning is applied to all the signatures of a protocol inspection profile in the GUI.

The actual error is “414 Request-URI Too Long” because the HTTP request URI length generated in this case exceeds the system limit.

Conditions:
-- "Reset-learning" action is applied to all signatures and compliances of a protocol inspection profile.
-- Once a certain number of signatures are selected, The GUI throws a “414 Request-URI Too Long” error.

Impact:
- Bulk "reset-learning" action can't be applied from the GUI when the "414 Request-URI Too Long" is returned.

Workaround:
- The TMSH command "delete security protocol-inspection learning-stats <profile-name>" can be used to apply reset-learning to all the signatures of a protocol inspection profile.

---

1013597-2 : `HTTP2::disable serverside` can reset flows

Links to More Info: BT1013597

Component: Local Traffic Manager

Symptoms:
If `HTTP2::disable serverside` is called on a flow that has no HTTP2 configured on the server-side then it can incorrectly report an error and RST the flow.

Conditions:
1) iRule calls `HTTP2::disable serverside` on HTTP_REQUEST.
2) No HTTP2 configured on server-side.
3) server-side has already handled a flow.

Impact:
Traffic interruption, potential for a core (see ID1012533). Traffic disrupted while tmm restarts.

Workaround:
Don't call `HTTP2::disable serverside` if there is no HTTP2 on server-side.

---

1013209-5 : BIG-IP components relying on ca-bundle.crt may stop working after upgrade★

Links to More Info: BT1013209

Component: Local Traffic Manager

Symptoms:
After upgrading, the BIG-IP system components may stop working due to missing CA certificates in ca-bundle.crt.

Conditions:
CA cert which is expired/will expire in 6 months (or 182 days) after upgrade is removed from ca-bundle.crt.

Impact:
The BIG-IP components such as TMM, APM etc. may stop working due to missing CA certificates in ca-bundle.crt.

Workaround:
Download the blended-bundle.crt from the F5 download site. It is located at
https://downloads.f5.com/esd/product.jsp?sw=Certificate-Authority-Bundle&pro=Certificate-Authority-Bundle

---

1012601-4 : Alarm LED and LCD alert cleared prematurely on startup for missing PSU input

Links to More Info: BT1012601

Component: TMOS

Symptoms:
Occasionally when starting up a BIG-IP system, if one PSU is connected but not supplying power, the corresponding amber alarm LED and "PSU status input lost" alert in the LCD menu can be incorrectly cleared after selecting System -> Power On from the LCD menu.

Conditions:
-- iSeries platforms
-- The BIG-IP device is powered on with one PSU connected and not supplying power

Impact:
The alarm LED is incorrectly turned off, and navigating to alerts on the LCD menu no longer shows a "PSU status input lost" alert after powering on.

Workaround:
Before powering on the BIG-IP device, check the alarm LED and navigate to alerts on the LCD screen. If there is a "PSU status input lost" alert, the corresponding power LED should be amber.

If the power LED is still amber after powering the system on but the alarm LED and LCD alert are cleared, please disregard the alarm LED and LCD in this case. The amber power LED is correct, and the PSU is still not supplying power.

Additionally, if you are logged into the console, running "bigstart restart chmand" will force a new "PSU status input lost" alert to be generated on the LCD and should also correct the alarm LED color to amber.

---

1012493-5 : Systemauth.primaryadminuser set to anything but 'admin' causes internal error for mcp-state check

Links to More Info: BT1012493

Component: TMOS

Symptoms:
When polling the endpoint /mgmt/tm/sys/mcp-state you get an error:

{
  "code": 500,
  "message": "MCP Session terminated",
  "errorStack": [],
  "apiError": 32768003
}

Conditions:
-- A user other than 'admin' polls /mgmt/tm/sys/mcp-state

Impact:
An error is returned for users that are not the admin user. Systems which are subject to special security rules that require disabling the admin user may lose functionality in iControl/REST.

Workaround:
You can use either of these workarounds:

-- Make the API call as user "admin"
-- Use tmsh
   tmsh show sys mcp-state

---

1012449-1 : Unable to edit custom inband monitor in the GUI

Links to More Info: BT1012449

Component: TMOS

Symptoms:
Attempting to edit a custom inband monitor in the GUI results in an error:

An error has occurred while trying to process your request.

Conditions:
Editing a custom inband monitor in the GUI.

Impact:
Unable to make changes to inband monitors in the GUI.

Workaround:
Use TMSH to modify the monitor, for example:

tmsh modify ltm monitor inband <monitor name> ...

---

1012413-1 : Tmm performance impact for DDoS vector on virtual server when hardware mitigation is enabled

Links to More Info: BT1012413

Component: Advanced Firewall Manager

Symptoms:
When a DoS profile is attached to a virtual server, the mitigation limit is set to the system limit and not the HSB limit. This causes more packets to be handled by software. Depending on attack size, it could pass up to 200% of the set mitigation limit. This can impact tmm performance.

Conditions:
-- Dos profile is configured on virtual server.
-- Hardware platform that has HSB
-- Hardware mitigation is enabled

Impact:
Tmm performance may be degraded.

Workaround:
None

---

1012377-2 : Unable to display/edit 'management route' via GUI

Links to More Info: BT1012377

Component: TMOS

Symptoms:
Unable to display/edit 'management route' via GUI

Conditions:
-- Viewing the management route in the GUI via System -> Platform
-- The management route is configured manually

Impact:
The management route field is blank, and you cannot make changes.

Workaround:
Display/edit the management route via tmsh:

tmsh list sys management-route
tmsh modify sys management-route <settings>

---

1012061-1 : Link Controller auto-discovery does not remove deleted virtual servers

Links to More Info: BT1012061

Component: Global Traffic Manager (DNS)

Symptoms:
Removed virtual servers are still displayed as available in link controller configuration.

Conditions:
1. GTM server representing Link Controller is configured for high availability (HA)
2. There is no working iQuery session with one of the units

Impact:
Virtual servers linger in bigip_gtm.conf configuration after they are deleted.

Workaround:
Make sure that there is at least one working iQuery channel with all devices configured under GTM server object.

---

1012049-1 : Incorrect virtual server list returned in response to status request

Links to More Info: BT1012049

Component: TMOS

Symptoms:
Returned list of virtual servers shows all virtual servers rather than no servers, or a specific list of servers.

Conditions:
-- Navigate through the GUI to Local Traffic :: Virtual Servers : Virtual Server List page.
-- Click the 'Status' drop down and select a status that returns no virtual servers or a specific subset of the virtual servers.
-- Modify the resulting request to insert ' --' url-encoded.

Impact:
The returned list shows all virtual servers instead of the ones specifically queried.

Workaround:
None

---

1012009-3 : MQTT Message Routing virtual may result in TMM crash

Links to More Info: BT1012009

Component: Local Traffic Manager

Symptoms:
The BIG-IP system provides an option to use Message Routing virtual servers for MQTT traffic. It uses a different approach to associate a client side and a server side than a standard virtual server. In some instances, a server side is incorrectly handled.

Conditions:
-- A Message Routing virtual with MQTT protocol.
-- A client attempts to reconnect.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

---

1011889-6 : The BIG-IP system does not handle DHCPv6 fragmented traffic properly

Links to More Info: BT1011889

Component: Local Traffic Manager

Symptoms:
In the following two scenarios, packets may get dropped by the BIG-IP device.

- [client MTU 1500]<--->(vlan1)<--->[MTU 1500BIG-IP MTU 9000]<--->(vlan2)<--->[MTU 1500server]
If the response from the server is large enough to be fragmented, the BIG-IP system is not able to process the packets.

- [client MTU 1500]<--->(vlan1)<--->[MTU 1500BIG-IP MTU 9000]<--->(vlan2)<--->[MTU 9000server]
Large response coming in a single packet is not fragmented properly on the client-side, then packets may be dropped.

Conditions:
DHCPv6 MTU size is greater than or equal to 1500.

Impact:
Packets are dropped, traffic is disrupted.

---

1011265-3 : Failover script cannot read /config/partitions/ after upgrade★

Links to More Info: BT1011265

Component: TMOS

Symptoms:
After upgrading, failover does not work correctly. An error is encountered in /var/log/audit/log:

type=AVC msg=audit(1617263442.711:206): avc: denied { read } for pid=17187 comm="active" name="partitions" dev="dm-11" ino=259 scontext=system_u:system_r:f5config_failover_t:s0 tcontext=system_u:object_r:f5config_t:s0 tclass=dir

Conditions:
-- High availability (HA) environment configured
-- Devices are upgraded to version 14.1.4
-- A failover occurs

Impact:
Failover does not complete. Floating IP addresses do not move to the active device.

Workaround:
Tmsh modify sys db failover.selinuxallowscripts enable

---

1011133 : Protocol Inspection compliance check 10208 gtp_disallowed_message_types does not take GTP version into account

Links to More Info: BT1011133

Component: Protocol Inspection

Symptoms:
GTP version 1 and GTP version 2 disagree on message type designations, so blocking a given message type has a different meaning depending on the GTP version.

Conditions:
Compliance check 10208 is configured in an environment where different versions of GTP traffic might be encountered.

Impact:
The device might drop GTP message types that are not intended to be dropped.

Workaround:
If the environment supports/expects only GTP version 1 or version 2 traffic, use compliance check 10223 gtp_disallowed_version to exclude all traffic from the unexpected GTP type to eliminate the message type ambiguity.

---

1011081-3 : Connection lost to the Postgres client during the BIG-IP bootup process

Links to More Info: BT1011081

Component: TMOS

Symptoms:
During the boot process of BIG-IP, mcpd loses the connection to the Postgres with FATAL error with a "Broken Pipe" error.

Conditions:
-- BIG-IP devices are configured in high availability (HA).
-- BIG-IP configuration has the keys configured in Postgres Database.

Impact:
Mcpd loses the connection to the Postgres with FATAL error with a "Broken Pipe" error

---

1010785-3 : Online help is missing for CRL in client SSL profile and server SSL profile

Links to More Info: BT1010785

Component: TMOS

Symptoms:
Help tab does not show any documentation for CRL in client SSL profile and server SSL profile.

Conditions:
This can be seen in the online help for the client SSL and server SSL profiles.

Impact:
There are no online help instructions to configure CRLs.

Workaround:
None

---

1010761-3 : Missing TMSH help description for client-ssl profile 'CRL'

Links to More Info: BT1010761

Component: TMOS

Symptoms:
Running the command "tmsh help ltm profile client-ssl" shows that certificate revocation list (CRL) is not present/described.

Conditions:
Run tmsh help ltm profile client-ssl

Impact:
The CRL is not present/described.

Workaround:
None

---

1010717-1 : Default DoS profile creation from tmsh is incorrectly interpreted by DoS profile GUI

Links to More Info: BT1010717

Component: Anomaly Detection Services

Symptoms:
Creating a DoS profile from tmsh makes the Bados feature appear to be enabled in the GUI, which is incorrect.

Conditions:
Create DoS profile from tmsh, and not from GUI.

Impact:
Inconsistency between the DoS profile and what you see in the GUI.

Workaround:
Disable BADOS in the GUI after creating a DoS profile from tmsh.

---

1010341-4 : Slower REST calls after update for CVE-2021-22986

Links to More Info: BT1010341

Component: TMOS

Symptoms:
As a result of changes were introduced to increase security around the REST API, REST calls that use HTTP basic authentication may take longer to execute that they did previously.

Conditions:
- REST API calls
- HTTP basic authentication used for the REST calls

Impact:
- Degraded performance of the REST API

Workaround:
Update automation scripting to use token based authentication, which is both faster and more secure than HTTP basic authentication

---

1010209-1 : BIG-IP configuration allows literal CR and LF characters in LTM monitor send and recv strings

Links to More Info: BT1010209

Component: Local Traffic Manager

Symptoms:
It is possible, using REST or tmsh (vi the 'tmsh edit' command) to embed literal carriage return (CR) or line feed (LF) characters in an mcpd object's parameters, rather than the two-byte sequence ＼r or ＼n. This can be done with a monitor send or receive string. When the configuration is loaded, the CR characters are stripped off of the strings, resulting in invalid HTTP in the monitor strings.

Conditions:
-- Using HTTP monitors.
-- Embedding literal CR/LF characters in the monitor's send or receive string.

Impact:
Monitors stop working; pool members being monitored are considered inaccessible.

Workaround:
Do not use embedded unprintable characters in monitor send or receive strings.

---

1009921-3 : 'SSL::verify_result' iRule command may return incorrect value when combined with dynamic CRL check

Links to More Info: BT1009921

Component: Local Traffic Manager

Symptoms:
'SSL::verify_result' iRule command may return '0' (validation check success) even if the client certificate has already been revoked. The expected return value on a revoked certificate is '23' (certificate revoked).

Conditions:
-- Dynamic CRL check is configured on the client SSL profile.

-- An iRule checks client certificate validity by 'SSL::verify_result' command. Here is example.

  when HTTP_REQUEST {
     set cert [SSL::cert 0]
     set cert_string [X509::verify_cert_error_string [SSL::verify_result]]
     set code [SSL::verify_result]
     if { [SSL::verify_result] == 0 }{
        log local0. "success $cert_string $code" return
     }
     else {
        log local0. "failed $cert_string $code" HTTP::respond 403 content "<html>Invalid client certificate:</html>＼n" }
  }

Note: SSL::cert command is in fact the trigger for the behavior as it causes a rebuild of the certificate chain and fetches the status from the cache, which is 0. The reason it is 0 in the cache is that, when dynamic CRLs are used, the system verifies the cert, receives a code 23 (revoked), but the system does not update the SSL session cache with the result.

Impact:
The iRule 'SSL::verify_result' command may return unexpected values. Traffic can be unexpectedly load-balanced to the backend pool member when the end user client requests the virtual server with the revoked certificate.

Workaround:
You can use any of the following workarounds:

-- Remove the SSL::cert command from the iRule (it is not needed in HTTP_REQUEST since the system still has the verify result in runtime code).

-- Set cache-size 0 (zero) on client SSL profiles:
# tmsh modify ltm profile client-ssl [client-ssl profile name] cache-size 0

-- Use authentication frequency 'always' on client SSL profiles:
# tmsh modify ltm profile client-ssl [client-ssl profile name] authenticate always

---

1009793-2 : Tmm crash when using ipsec

Component: TMOS

Symptoms:
Tmm crashes.

Conditions:
Set sys db variable IPsec.RemoveRedundantSA to enable.
set sys db variable ipsec.removeredundantsa.delay to one.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
Set sys db variable IPsec.RemoveRedundantSA to disable.
set sys db variable ipsec.removeredundantsa.delay to zero.

---

1009337-2 : LACP trunk down due to bcm56xxd send failure

Links to More Info: BT1009337

Component: TMOS

Symptoms:
Lacp reports trunk(s) down. lacpd reports having trouble writing to bcm56xxd over the unix domain socket /var/run/uds_bcm56xxd.

Conditions:
Not known at this time.

Impact:
An outage was observed.

Workaround:
Restart bcm56xxd, lacpd, and lldpd daemons.

---

1008233-1 : The gtm_add command fails but reports no error

Links to More Info: BT1008233

Component: Global Traffic Manager (DNS)

Symptoms:
Running the command 'gtm_add' does not add the local GTM to the remote GTM sync group, and it does not display an error message.

Conditions:
The remote GTM has a GTM iRule that references an LTM datagroup that does not exist on the local GTM.

Impact:
The gtm_add command fails silently.

Workaround:
Add the remote LTM datagroup to the local LTM.

---

1008169-1 : BIG-IP systems disconnect the DIAMETER transport connection if it receives an answer message without a Result-Code AVP

Links to More Info: BT1008169

Component: Service Provider

Symptoms:
If the BIG-IP system receives a DIAMETER answer message without a Result-Code AVP (and/or Experimental-Result-Code AVP), it terminates the connection at the transport (L4) level.

Conditions:
-- Using DIAMETER.
-- Processing an answer message that is missing both Result-Code and Experimental-Result-Code AVPs.

Impact:
The connection is terminated without properly notifying the DIAMETER peer.

Workaround:
None

---

1007909-1 : Tcpdump with :p (peer flow) flag does not capture forwarded between TMMs

Links to More Info: BT1007909

Component: TMOS

Symptoms:
When using tcpdump with the :p flag, it does not capture all packets that are processed by multiple TMMs.

Conditions:
Traffic flows are handled by multiple TMMs, e.g., one of the following:

-- 'preserve strict' set on virtual servers
-- a CMP-demoted virtual server
-- Service Provider (SP) DAG configured, but using custom mappings for some client IP addresses, or some traffic flows using VLANs without SPDAG configured.

Impact:
Causes confusion since there will be packets missing from tcpdump captures.

Workaround:
Use a packet capture filter to capture clientside and serverside flows directly, without relying on the peer flow flag (":p").

---

1007869-1 : Upgrade from v14.1.x to v15.1.2.1 or later fails for app-tunnel, RDP and config migration★

Links to More Info: BT1007869

Component: Access Policy Manager

Symptoms:
Config load fails with the following error.

01070712:3: Failed: name (/Common/<customization resource name>) Cache path (/config/filestore/files_d/Common_d/customization_group_d/:Common:<customization resource name with revision>) does not exist and there is no copy in trash-bin to restore from.
Unexpected Error: Loading configuration process failed.

An upgraded config may show RDP resources missing from the Advanced resource assign agent:

# tmsh list apm policy agent resource-assign
apm policy agent resource-assign test-simple-ap-01_act_full_resource_assign_ag {
    rules {
        {
            portal-access-resources { /Common/test-pa-01 }
            remote-desktop-resources { /Common/test-rdp-01 } !!! this line may go missing in v15.1.2.1 !!!
            webtop /Common/test-full-wt-01
        }
    }
}

Conditions:
Upgrade to v15.1.2.1 or later with AppTunnel and RDP resources.

Impact:
The configuration fails to load following the upgrade.

Workaround:
Modify the revision numbers resources, customization path for missing webtop links.

Example:
=======

(1) The following AppTunnel config causes config loading failure:

01070712:3: Failed: name (/Common/Example_resource_app_tunnel_customization) Cache path (/config/filestore/files_d/Common_d/customization_group_d/:Common:Example_resource_app_tunnel_customization_1) does not exist and there is no copy in trash-bin to restore from.

(2) Modify as follows:

In TMSH:
#cp /config/filestore/files_d/Common_d/customization_group_d/＼:Common＼:Example_resource_app_tunnel_customization_1 /config/filestore/files_d/Common_d/customization_group_d/＼:Common＼:Example_resource_app_tunnel_customization_2

In bigip.conf under customization configuration:
Rename Example_resource_app_tunnel_customization_1 to Example_resource_app_tunnel_customization_2 (modifying revision numbers from _1 to _2)

#tmsh load sys config

(3) For a missing RDP resource: use VPE to edit access profiles and find the appropriate 'Advanced Resource Assign' agents. Add the appropriate RDP resources in the 'Advanced Resource Assign' agent.
==============

---

1006857-1 : Adding a source address list to a virtual server in a partition with a non-default route domain fails.

Links to More Info: BT1006857

Component: Local Traffic Manager

Symptoms:
Adding a source address list to a virtual server in a partition with a non-default route domain fails with an error similar to:

0107176c:3: Invalid Virtual Address, the IP address 10.10.10.20%2 already exists.

Conditions:
-- A partition with a non-default route domain.
-- A virtual server and address list in said partition.
-- Modifying the virtual server to use the address list as its source address.

Impact:
Unable to use a source address list in a partition with a non-default route domain.

Workaround:
Manually create a traffic-matching-criteria object in TMSH with the desired configuration, and then create the virtual server using that traffic-matching-criteria.

Steps to help with this process can be found in F5 solution article K41752699.

---

1006509-1 : TMM memory leak★

Links to More Info: BT1006509

Component: Access Policy Manager

Symptoms:
After upgrading to 15.1.0.4, tmm memory grows and tmm may restart or the BIG-IP system may reboot.

Conditions:
-- APM provisioned
-- Other conditions are unknown but it linked to single sign-on functionality

Impact:
Tmm memory grows and tmm may restart. Traffic disrupted while tmm restarts.

---

1006449-1 : The default size of the subagent object cache possibly leading to slow snmp response time and high mcpd CPU use★

Links to More Info: BT1006449

Component: TMOS

Symptoms:
After upgrading from a 13.1.x release to a later release (such as 15.1.x), BIG-IP CPU utilization increases and SNMP is slow to respond.

Conditions:
SNMP client repeatedly polls BIG-IP for OIDs in multiple tables over a short period of time.

Impact:
SNMP queries take an unusually long time to return data, and BIG-IP CPU utilization is higher.

Workaround:
To the file /config/snmp/bigipTrafficMgmt.conf, add one line with the following content:

  cacheObj 16

This could be accomplished by executing the following command line from bash:

  # echo "cacheObj 16" >> /config/snmp/bigipTrafficMgmt.conf

After the above config file has been modified and saved, the "snmpd" daemon must be restarted, using one of two command variants:

  (on a BIG-IP appliance or VE system)

  # bigstart restart snmpd

  (on a a multi-slot VIPRION or vCMP guest)

  # clsh bigstart restart snmpd

(However, this adjustment will be lost when the BIG-IP software is next upgraded.)

---

1006345-4 : Static mac entry on trunk is not programmed on CPU-only blades

Links to More Info: BT1006345

Component: TMOS

Symptoms:
More traffic egressing out from primary link of lacp when there is DLFs (destination lookup failures) since static mac is not present on CPU-only blades

Conditions:
Static mac configured on trunk on all platforms except i4000, i850/i2000, 2000/2200, 4000/4200,4100

Impact:
DLFs (destination lookup failures) will cause the first interface in the trunk to egress all DLF'd traffic

---

1005309-4 : Additional Tcl variables showing information from the AntiBot Mobile SDK

Links to More Info: BT1005309

Component: Application Security Manager

Symptoms:
When using the Bot Defense iRules together with the AntiBot Mobile SDK, there are several variables missing. These missing variables would be useful for correct troubleshooting and pattern matching.

Conditions:
Using the AntiBot Mobile SDK together with Bot Defense iRules

Impact:
Some variables that are required for troubleshooting and pattern matching of the AntiBot Mobile SDK are missing.

Workaround:
None

---

1005181-4 : Bot Defense Logs indicate the mobile debugger is used even when it is not

Links to More Info: BT1005181

Component: Application Security Manager

Symptoms:
When using the AntiBot Mobile SDK, the Bot Defense Request Log may indicate that the mobile debugger is enabled, even when it is not.

Conditions:
Using the AntiBot Mobile SDK with the Bot Defense Profile

Impact:
Request log is showing an incorrect value.

Workaround:
None

---

1004953-5 : HTTP does not fall back to HTTP/1.1★

Links to More Info: BT1004953

Component: Local Traffic Manager

Symptoms:
After upgrading, the BIG-IP system's HTTP profile no longer falls back to HTTP/1.1 if a client sends a corrupted URI.

Conditions:
-- Client sends a corrupted URI (for example a URI containing a space).

Impact:
The BIG-IP system treats the URI as an HTTP/0.9 request (as per RFC) and forwards only the first request line. In previous releases, the BIG-IP system treated the URI as a HTTP/1.1 request.

Workaround:
None.

---

1004929-1 : During config sync operation, MCPD restarts on secondary blade logging 01020012:3: A unsigned four-byte integer message item is invalid.

Links to More Info: BT1004929

Component: TMOS

Symptoms:
While receiving a config sync operation, mcpd on a secondary blade may restart, logging:

err mcpd[6383]: 01070734:3: Configuration error: Configuration from primary failed validation: 01020012:3: A unsigned four-byte integer message item is invalid.... failed validation with error 16908306

Conditions:
-- A VIPRION system (or cluster-based vCMP guest) with more than one blade processes a full configuration load, i.e. as a result of running "tmsh load sys config" or receiving a full-load config sync from peer BIG-IP.

-- The system generates a large number of warning messages during a configuration load, whose total length is larger than 65,535 bytes.

These warnings can be seen in the output of "tmsh load sys config" or "tmsh load sys config verify", or are logged under message ID 01071859

An example of such a warning is:

SSLv2 is no longer supported and has been removed. The 'sslv2' keyword in the cipher string of the ssl profile (/Common/ssl-profile-1) has been ignored.

Impact:
MCPD on secondary blades restart. Those blades are inoperative while services restart.

Workaround:
Address the warnings reported by the system.

---

1004845-1 : Accessing attribute using attributeNode value does not work with Portal Access

Links to More Info: BT1004845

Component: Access Policy Manager

Symptoms:
URI normalization issue when using attributeNode to access attribute values.

Conditions:
Using attributeNode to access attribute value in web applications

Impact:
Web application does not work as expected.

Workaround:
Use custom iRule to fix this issue. There is no generic iRule for this issue, but here is a sample iRule:

XXXX is the file which usage attributeNode.

when REWRITE_REQUEST_DONE {
  if {
    [HTTP::path] ends_with "XXXX"
  } {

    # log "URI=([HTTP::path])"
    # Found the file to modify

    REWRITE::post_process 1
  }
}

when REWRITE_RESPONSE_DONE {
  set strt [string first {<script>try} [REWRITE::payload]]

  if {$strt > 0} {
    REWRITE::payload replace $strt 0 {
      <script>
        (function (){
         var old_F5_Inflate_value = F5_Inflate_value;
         F5_Inflate_value = function (o,sw,incr,v) {
            if (o && o.ownerDocument) {
                if (o.name == 'action') {
                  if (o.ownerElement) {
                    F5_Inflate_action(o.ownerElement,incr,v);
                  }
                }
            }
            return old_F5_Inflate_value.apply(this,arguments)
         }
        })();
      </script>
    }
  }
}

---

1004801-2 : In the violation details for Max Parameter Protocol Compliance, the incorrect number of parameters is shown.

Links to More Info: BT1004801

Component: Application Security Manager

Symptoms:
Incorrect number of parameter is shown in the violation details for Max Parameter Protocol Compliance.

Conditions:
Alarm or block flag is enabled on Max Parameter Protocol Compliance violation, and the request contains more than the maximum specified.

Impact:
Request event displays inaccurate number of parameters: the maximum number, plus 1 (e.g., if you specify 7, the maximum shown will be 8).

This occurs because the system stops parsing parameters when the violation is triggered, which occurs when receiving a request with more than the value specified in Max Parameter Protocol. So if you enable the alarm or block flag on requests with 5 parameters, a request with more than 5 parameters will be alarmed/blocked, and the number reported will be 6. If the system receives requests with more than 6 parameters, the number of parameters is still reported as 6.

Workaround:
None

---

1004609-6 : SSL forward proxy virtual server may set empty SSL session_id in server hello.

Links to More Info: BT1004609

Component: Local Traffic Manager

Symptoms:
End user clients are unable to establish a TLS connection. Further investigation indicates that the Session ID length field is set to 0, but there is no session ID.

   TLSv1.2 Record Layer: Handshake Protocol: Server Hello
           Content Type: Handshake (22)
           Version: TLS 1.2 (0x0303)
           Length: 59
           Handshake Protocol: Server Hello
               Handshake Type: Server Hello (2)
               Length: 55
               Version: Version: TLS 1.2 (0x0303)
               Random: aa957f92a5de4cedcf9750b60b3efab6b345da6c32189e93…
               Session ID Length: 0 <=== !!!
   .....
   TLSv1.2 Record Layer: Change Cipher Spec Protocol: Change Cipher Spec
   .....
   TLSv1.2 Record Layer: Handshake Protocol: Encrypted Handshake Message
   .....

Conditions:
-- SSL forward proxy virtual server.
-- This can occur intermittently with normal HTTPS traffic. It occurs more frequently if the session cache's cache-timeout value is set to a low value.

Impact:
After receiving the invalid server hello message from the BIG-IP system, the client may generate unexpected_message (10) TLS alerts and the client may terminate SSL connection.

Workaround:
None

---

1004517-1 : BIG-IP tenants on VELOS cannot install EHFs

Links to More Info: BT1004517

Component: TMOS

Symptoms:
BIG-IP tenants created on VELOS using v14.1.4 software earlier than v14.1.4.3 cannot accept engineering hotfixes (EHF).

Conditions:
Installing EHF updates to BIG-IP tenants on VELOS running BIG-IP v14.1.4 software earlier than v14.1.4.3.

Impact:
EHF installation fails.

Workaround:
None

---

1004469-1 : SNMP OID ltmSipsessionProfileStatVsName and ltmSiprouterProfileStatVsName returns empty string

Links to More Info: BT1004469

Component: TMOS

Symptoms:
SNMP polling fails for ltmSipsessionProfileStatVsName and ltmSiprouterProfileStatVsName.

Conditions:
Run the snmpwalk for ltmSipsessionProfileStatVsName :

[root@d1:Active:Standalone] tmp # snmpwalk -c public localhost ltmSipsessionProfileStatVsName
F5-BIGIP-LOCAL-MIB::ltmSipsessionProfileStatVsName."/Common/test-sip"."" = STRING:
F5-BIGIP-LOCAL-MIB::ltmSipsessionProfileStatVsName."/Common/sipsession"."" = STRING:
F5-BIGIP-LOCAL-MIB::ltmSipsessionProfileStatVsName."/Common/sipsession-alg"."" = STRING:

----------
Run the snmpwalk for ltmSiprouterProfileStatTable

[root@ltm1:Active:Standalone] config # snmpwalk -c public localhost ltmSiprouterProfileStatTable
F5-BIGIP-LOCAL-MIB::ltmSiprouterProfileStatName."/Common/siprouter"."" = STRING: /Common/siprouter
F5-BIGIP-LOCAL-MIB::ltmSiprouterProfileStatName."/Common/siprouter-alg"."" = STRING: /Common/siprouter-alg
F5-BIGIP-LOCAL-MIB::ltmSiprouterProfileStatVsName."/Common/siprouter"."" = STRING:
F5-BIGIP-LOCAL-MIB::ltmSiprouterProfileStatVsName."/Common/siprouter-alg"."" = STRING:
F5-BIGIP-LOCAL-MIB::ltmSiprouterProfileStatTotMessgesIn."/Common/siprouter"."" = Counter64: 0
F5-BIGIP-LOCAL-MIB::ltmSiprouterProfileStatTotMessgesIn."/Common/siprouter-alg"."" = Counter64: 0
F5-BIGIP-LOCAL-MIB::ltmSiprouterProfileStatTotMessagesInRetry."/Common/siprouter"."" = Counter64: 0
F5-BIGIP-LOCAL-MIB::ltmSiprouterProfileStatTotMessagesInRetry."/Common/siprouter-alg"."" = Counter64: 0

Impact:
Returns empty. Cannot extract the virtual server name of a SIP session and SIP router profile through SNMP.

Workaround:
None

---

1003629 : PAYG license becomes invalid when swapping associated NICs for instances in both Azure and AWS.

Links to More Info: BT1003629

Component: TMOS

Symptoms:
If swapping management and data plane NICs using the onboarding Terraform template, you will receive a, “License is not operational (expired or digital signature does not match contents)” message.

Conditions:
- A multi-NIC instance deployed in Azure or AWS using a PAYG license.

- Use the onboarding Terraform template to swap the management (1st NIC) and the data plane NICs.

Impact:
After swapping NICs and rebooting the instance, BIG-IP cannot successfully validate the PAYG license.

Workaround:
Due to Azure and AWS metadata service calls restricted to using the primary IP address, avoid swapping NICs, as it is currently NOT supported in those Clouds.

---

1003469-1 : The BIG-IP GUI fails to reset the statistics for an IPv6 pool member and returns an error.

Links to More Info: BT1003469

Component: TMOS

Symptoms:
When trying to reset the statistics for an IPv6 pool member using the GUI, the operation fails and the system returns one of the following errors (depending on the software version in use):

01030010:3: eXtremeDB - search operation failed

Unable to complete request

Conditions:
This issue occurs when you attempt to use the BIG-IP GUI to:

-- Reset the statistics of one or more IPv6 pool members you have selected individually.

-- Reset the statistics of all pools by using the 'Select All' checkbox (provided the system contains IPv6 pool members).

Impact:
Inability to reset the statistics using the GUI.

Workaround:
You can use the tmsh utility to reset the pool member's statistics from the CLI. Example command:

tmsh reset-stats ltm pool my-pool members { 2001:DB8::1.80 }

---

1003233-2 : SNMP Polling can cause inconsistencies in gtm link stats.

Links to More Info: BT1003233

Component: Global Traffic Manager (DNS)

Symptoms:
If the uplink router does not allow SNMP polling, and snmp_link monitor is applied, then GTM stats becomes inconsistent.

Conditions:
The router is not being probed using SNMP.

Impact:
Status values will be inconsistent.

Workaround:
N/A

---

1003225-2 : 'snmpget F5-BIGIP-LOCAL-MIB::ltmWebAccelerationProfileStat* returns zeroes

Links to More Info: BT1003225

Component: TMOS

Symptoms:
The values returned during an SNMP get are incorrect for the ltmWebAccelerationProfileStat.

The values should match what is displayed by running the tmsh command.

Conditions:
Performing an SNMP get:

snmpget -v 2c -c public localhost F5-BIGIP-LOCAL-MIB::ltmWebAccelerationProfileStatCacheSize.＼"/Common/test＼"

Impact:
The system reports inaccurate information for ltmWebAccelerationProfileStat stats.

Workaround:
None

---

1003081-3 : GRE/TB-encapsulated fragments are not forwarded.

Links to More Info: BT1003081

Component: TMOS

Symptoms:
IP fragments that arrive over a GRE/TB tunnel are not reassembled, and are not forwarded through the BIG-IP system.

Conditions:
This occurs if all of the following conditions are true:

-- BIG-IP system with more than one TMM instance running.
-- Running a version or Engineering Hotfix that contains a fix for ID997541 (https://cdn.f5.com/product/bugtracker/ID997541.html).
-- GRE Round Robin DAG (the DB variable dag.roundrobin.gre) is enabled.
-- IP fragments arrive over GRE tunnel.

Impact:
BIG-IP system fails to process fragmented IP datagrams.

Workaround:
None

---

1002969-4 : Csyncd can consume excessive CPU time★

Links to More Info: BT1002969

Component: Local Traffic Manager

Symptoms:
Following a configuration change or software upgrade, the "csyncd" process becomes always busy, consuming excessive CPU.

Conditions:
-- occurs on a multiblade VIPRION chassis
-- may occur with or without vCMP
-- may occur after configuring F5 Telemetry Streaming, but may also occur in other circumstances
-- large numbers of files are contained in one or more of the directories being sync'ed between blades

Impact:
The overuse of CPU resources by "csyncd" may starve other control-plane processes. Handling of payload network traffic by the data plane is not directly affected.

Workaround:
To mitigate the processing load, identify which directory or directories contain excessive numbers of files being replicated between blades by "csyncd". If this replication is not absolutely needed (see below), such a directory can be removed from the set of directories being sync'ed.

For example: if there are too many files being generated in the "/run/pamcache" directory (same as "/var/run/pamcache"), remove this directory from the set being acted upon by "csyncd" by running the following commands to comment-out the associated lines in the configuration file.
[Note it is better to follow the more complete workaround from ID 1103369, https://cdn.f5.com/product/bugtracker/ID1103369.html ]

# clsh "cp /etc/csyncd.conf /etc/csyncd.conf.$(date +%Y%m%d_%H%M%S)"

# clsh "sed -i '/run＼/pamcache/,+2s/^/#/' /etc/csyncd.conf"

# clsh "bigstart restart csyncd"



If the problem was observed soon after the installation of F5 Telemetry Streaming, the configuration can be adjusted to make csyncd ignore the related files in a subdirectory of "/var/config/rest/iapps". Run the following commands:

# clsh "cp /etc/csyncd.conf /etc/csyncd.conf.$(date +%Y%m%d_%H%M%S)"

# clsh "sed -i '/＼/var＼/config＼/rest＼/iapps/a ＼ ＼ ＼ ＼ ＼ ＼ ＼ ＼ ignore f5-telemetry' /etc/csyncd.conf"

# clsh "bigstart restart csyncd"


----

The impact of disabling replication for the pamcache folder is that in the event of a primary blade failover, the new primary blade would not be aware of the existing valid auth tokens, so the user (eg, a GUI user, or a REST script already in progress at the time of the failover) would need to authenticate again.

---

1002417-2 : Switch L2 forwarding entries learnt on multi-blade trunk in one blade needs to be synchronized to other blades of that trunk

Links to More Info: BT1002417

Component: TMOS

Symptoms:
In a chassis, when the switch needs to forward a packet where the destination MAC address does not exist in the L2 forwarding table (DLF, destination lookup failure), the packet is forwarded to blade one and flooded there. This can lead to interfaces on blade one being more heavily used.

Conditions:
Altering of trunk vlan memberships after failovers will lead to traffic imbalance on egress ports.

Impact:
It may lead to an out of bandwidth condition on interfaces.

---

1002345-4 : Transparent DNS monitor does not work after upgrade★

Links to More Info: BT1002345

Component: In-tmm monitors

Symptoms:
DNS Pool state changes from up to down following an upgrade.

Conditions:
A transparent DNS monitor is configured to use the loopback address.

Impact:
The DNS pool is marked down.

Workaround:
None

---

1001129-1 : Maximum Login Failures lockout for root and admin

Component: TMOS

Symptoms:
The root/admin account does not lock out when multiple login failures occur.

Conditions:
Local accounts such as root and admin occur multiple login failures.

Impact:
The root or admin account is not locked out. Other accounts are locked out after multiple login failures.

Workaround:
None

---

1001101-1 : Cannot update/display GTM/DNS listener route advertisement correctly

Links to More Info: BT1001101

Component: Global Traffic Manager (DNS)

Symptoms:
Not able to update/display GTM/DNS listener route advertisement correctly.

Conditions:
Operating from the GUI GTM/DNS listener page.

Impact:
Not able to manage route advertisement from GUI GTM listener page.

Workaround:
Instead of GTM/DNS GUI, use LTM virtual address operations to manage GTM/DNS listener route advertisement.

---

1000325-1 : UCS load with 'reset-trust' may not work properly if base configuration fails to load★

Links to More Info: BT1000325

Component: TMOS

Symptoms:
When loading a UCS archive using the 'reset-trust' option, if the system fails to load the base configuration from the UCS archive, the system may fail to regenerate new device trust certificates and keys.

This can result in subsequent issues, including configuration load failures after an upgrade, such as:

01070712:3: Values (/Common/dtca.key) specified for trust domain (/Common/Root): foreign key index (key_fk) do not point at an item that exists in the database.
Unexpected Error: Loading configuration process failed.

Conditions:
-- Loading a UCS file using the 'reset-trust' option.
-- The system fails to load the base configuration (bigip_base.conf) in the UCS archive for any reason.
-- The base configuration is corrected, and subsequently loaded (e.g., with 'tmsh load sys config').

Impact:
-- The system does not regenerate critical device trust keys and certificates.
-- After a subsequent upgrade, the BIG-IP system goes to INOPERATIVE state, and reports this error:

01070712:3: Values (/Common/dtca.key) specified for trust domain (/Common/Root): foreign key index (key_fk) do not point at an item that exists in the database.
Unexpected Error: Loading configuration process failed.

Workaround:
Remove trust-domain from the bigip_base.conf file and reload the configuration.

---

★ This issue may cause the configuration to fail to load or may significantly impact system performance after upgrade