BIG-IP Release Information

Version: 17.1.3
Build: 11

Note: This content is current as of the software release date
Updates to bug information occur periodically. For the most up-to-date bug data, see Bug Tracker.

The blue background highlights fixes

Cumulative fixes from BIG-IP v17.1.2.2 that are included in this release
Cumulative fixes from BIG-IP v17.1.2.1 that are included in this release
Cumulative fixes from BIG-IP v17.1.2 that are included in this release
Cumulative fixes from BIG-IP v17.1.1.4 that are included in this release
Cumulative fixes from BIG-IP v17.1.1.3 that are included in this release
Cumulative fixes from BIG-IP v17.1.1.2 that are included in this release
Cumulative fixes from BIG-IP v17.1.1.1 that are included in this release
Cumulative fixes from BIG-IP v17.1.1 that are included in this release
Cumulative fixes from BIG-IP v17.1.0.3 that are included in this release
Cumulative fixes from BIG-IP v17.1.0.2 that are included in this release
Cumulative fixes from BIG-IP v17.1.0.1 that are included in this release
Known Issues in BIG-IP v17.1.x

Vulnerability Fixes

Functional Change Fixes

TMOS Fixes

Local Traffic Manager Fixes

Global Traffic Manager (DNS) Fixes

Application Security Manager Fixes

Access Policy Manager Fixes

Service Provider Fixes

Advanced Firewall Manager Fixes

Policy Enforcement Manager Fixes

Anomaly Detection Services Fixes

Traffic Classification Engine Fixes

Device Management Fixes

iApp Technology Fixes

Protocol Inspection Fixes

In-tmm monitors Fixes

SSL Orchestrator Fixes

Bot Defense Fixes

Cumulative fixes from BIG-IP v17.1.2.2 that are included in this release


Vulnerability Fixes

Functional Change Fixes

None


TMOS Fixes

Cumulative fixes from BIG-IP v17.1.2.1 that are included in this release


Vulnerability Fixes

Functional Change Fixes

None



Cumulative fixes from BIG-IP v17.1.2 that are included in this release


Vulnerability Fixes

Functional Change Fixes

TMOS Fixes

Local Traffic Manager Fixes

Global Traffic Manager (DNS) Fixes

Application Security Manager Fixes

Access Policy Manager Fixes

Service Provider Fixes

Advanced Firewall Manager Fixes

Policy Enforcement Manager Fixes

Carrier-Grade NAT Fixes

Fraud Protection Services Fixes

Anomaly Detection Services Fixes

Traffic Classification Engine Fixes

Device Management Fixes

iApp Technology Fixes

Protocol Inspection Fixes

In-tmm monitors Fixes

Cumulative fixes from BIG-IP v17.1.1.4 that are included in this release


Vulnerability Fixes

Functional Change Fixes

None


TMOS Fixes

Cumulative fixes from BIG-IP v17.1.1.3 that are included in this release


Vulnerability Fixes

Functional Change Fixes

None


Application Security Manager Fixes

SSL Orchestrator Fixes

Cumulative fixes from BIG-IP v17.1.1.2 that are included in this release


Functional Change Fixes

None


TMOS Fixes

Local Traffic Manager Fixes

Cumulative fixes from BIG-IP v17.1.1.1 that are included in this release


Vulnerability Fixes

Functional Change Fixes

Cumulative fixes from BIG-IP v17.1.1 that are included in this release


Vulnerability Fixes

Functional Change Fixes

TMOS Fixes

Local Traffic Manager Fixes

Performance Fixes

Global Traffic Manager (DNS) Fixes

Application Security Manager Fixes

Access Policy Manager Fixes

Service Provider Fixes

Advanced Firewall Manager Fixes

Policy Enforcement Manager Fixes

Carrier-Grade NAT Fixes

Anomaly Detection Services Fixes

Device Management Fixes

iApp Technology Fixes

Protocol Inspection Fixes

In-tmm monitors Fixes

SSL Orchestrator Fixes

F5OS Messaging Agent Fixes

Cumulative fixes from BIG-IP v17.1.0.3 that are included in this release


Vulnerability Fixes

Functional Change Fixes

None


Access Policy Manager Fixes

Cumulative fixes from BIG-IP v17.1.0.2 that are included in this release


Vulnerability Fixes

Functional Change Fixes

None



Cumulative fixes from BIG-IP v17.1.0.1 that are included in this release


Vulnerability Fixes

Functional Change Fixes

None


TMOS Fixes

Local Traffic Manager Fixes

 

Cumulative fix details for BIG-IP v17.1.3 that are included in this release

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

---

Known Issues in BIG-IP v17.1.x


TMOS Issues

ID Number	Severity	Links to More Info	Description
701341-5	1-Blocking	K52941103, BT701341	If /config/BigDB.dat is empty or the file is corrupt, mcpd continuously restarts
979045-5	2-Critical	BT979045	The tpm-status-check service shows System Integrity Status: Invalid when Engineering Hotfix installed on certain platforms
967769-3	2-Critical	BT967769	During reset of high-speed interfaces, TMMs may mistakenly continue hardware watchdog checks
962729-5	2-Critical	BT962729	New User automatically unlocked when "Automatically enable locked-out users after" is not configured
935633-2	2-Critical	BT935633	VCMP guests or F5OS tenants may experience constant clusterd restart after host upgrade★
916553	2-Critical	BT916553	Certificate details are not added correctly to BIG-IP after license is assigned from BIG-IQ due to which IPS auto update fails on BIG IP
777389-9	2-Critical	BT777389	In rare occurrences related to PostgreSQL monitor, the mcpd process restarts
767473-3	2-Critical	BT767473	SMTP Error: Could not authenticate
758929-8	2-Critical	K10165235, BT758929	Bcm56xxd MIIM bus access failure
742764-6	2-Critical	BT742764	If two racoon daemon are spawned on startup, one fails and cores.
721591-3	2-Critical	K000141369, BT721591	Java crashes with core during with high load on REST API
712925-4	2-Critical	BT712925	Unable to query a monitor status through iControl REST if the monitor is in a non-default partition
652877-9	2-Critical	BT652877	Reactivating the license on a VIPRION system may cause MCPD process restart on all secondary blades
566756-1	2-Critical	BT566756	VCMP 4 cores on 3 blades : mcpd core when delete 255 dos profiles via tmsh command while machine is idle
2077297-2	2-Critical	BT2077297	HA Group List page in GUI shows a blank page
2064413	2-Critical	BT2064413	UCS File Download Failure via REST API Due to Byte-Range Handling Bug in BIG-IP
2037409-2	2-Critical	BT2037409	Tmctl tables are corrupted for large cluster size and tmm memory shows 0
2007705-2	2-Critical	BT2007705	HSL can incorrectly handle pending TCP connections leading to a TMM crash
1969949-1	2-Critical	BT1969949	Unable to recover root password on VE instance
1967681	2-Critical	BT1967681	17.1.2.2 OEM YK image does not fully boot as an F5OS tenant because mcpd does not start.★
1966589-1	2-Critical	BT1966589	Changes to fixup scripts breaks schema upgrade★
1943217-1	2-Critical	BT1943217	BGP - using 'no bgp default ipv4-unicast' might lead to a crash
1927513-3	2-Critical	BT1927513	SIGSEGV TMM core ikev2_encrypt_packet_construct at iked/ikev2_packet.c:334
1812349-3	2-Critical	BT1812349	IPsec phase 2 (IKEv1 Quick Mode) will not start after upgrade★
1787621	2-Critical	BT1787621	TMM may unexpectedly restart during IPsec tunnel negotiation
1757585-2	2-Critical	BT1757585	Unable to install a license on an AWS BIG-IP VE
1707921	2-Critical	BT1707921	Tenant upgrade fails with disk full error on BIG-IP 17.x created with T2 image★
1678105-1	2-Critical	BT1678105	F5OS tenant, TMM crashing after loading a UCS
1632745-1	2-Critical	BT1632745	Tmctl snapshots fail to work when slow_merge is enabled
1571817-1	2-Critical	BT1571817	FQDN ephemeral pool member user-down state is not synced to the peer device
1518997	2-Critical	BT1518997	Under extreme conditions (with full load) traffic fail over and TMM restart may happen due to internal Session DB malfunction
1403825-1	2-Critical	BT1403825	Lvm2 package upgrade from 2-2.02.166 to 2-2.02.187
1395349-2	2-Critical	BT1395349	The httpd service shows inactive/dead after "bigstart restart httpd"
1394445-1	2-Critical	BT1394445	Password-memory is not remembering passwords to prevent them from being used again
1327649-3	2-Critical	BT1327649	Invalid certificate order within cert-chain associated to JWK configuration
1305117-1	2-Critical	BT1305117	SSL profile "no-dtlsv1.2" option is left disabled while upgrading from v14.x or v15.x to 17.1.0★
1296925-1	2-Critical	BT1296925	Unable to create two boot locations using the 'ALL' F5OS tenant image at default storage size
1277389-2	2-Critical	BT1277389	HSB transmitter lockup
1093717-5	2-Critical	BT1093717	BGP4 SNMP traps are not working.
1077789-6	2-Critical	BT1077789	System might become unresponsive after upgrading.★
1067857-8	2-Critical	BT1067857	HSB completion time out causes unexpected reboot
1039609-4	2-Critical	BT1039609	Unable to poll Dynamic routing protocols SNMP OID's on non-default route domain
1024269-4	2-Critical	BT1024269	Forcing a file system check on the next system reboot does not check all filesystems.
1014361-3	2-Critical	BT1014361	Config sync fails after provisioning APM or changing BIG-IP license
994361-5	3-Major	BT994361	Updatecheck script hangs/Multiple updatecheck processes
992113-3	3-Major	BT992113	Page allocation failures on VIPRION B2250 blades
991829-5	3-Major	BT991829	Continuous connection refused errors in restjavad
988745-8	3-Major	BT988745	On reboot, 'could not find platform object' errors may be seen in /var/log/ltm
977953-6	3-Major	BT977953	Show running config interface CLI could not fetch the interface info and crashes the imi
969737-4	3-Major	BT969737	Snmp requests not answered if V2 traps are configured
962477-5	3-Major	BT962477	REST calls that modify GTM objects as a user other than admin may take longer than expected
959057-6	3-Major	BT959057	Unable to create additional login tokens for the default admin user account
958601-5	3-Major	BT958601	In the GUI, searching for virtual server addresses does not match address lists
945413-6	3-Major	BT945413	Loop between keymgmtd and mcpd causes BIG-IP to be out of sync or in constant automatic config sync
931629-6	3-Major	BT931629	External trunk fdb entries might end up with internal MAC addresses.
928389-7	3-Major	BT928389	GUI becomes inaccessible after importing certificate under import type 'certificate'
923745-7	3-Major	BT923745	Ctrl-Alt-Delete in virtual console reboots BIG-IP Virtual Edition
922053-3	3-Major	BT922053	inaccurate number of trunk members reported by bcm56xxd/bcmLINK
921069-4	3-Major	BT921069	Neurond cores while adding or deleting rules
915557-7	3-Major	BT915557	The pool statistics GUI page fails (General database error retrieving information.) when filtering on pool status.
915493-7	3-Major	BT915493	imish command hangs when ospfd is enabled
908453-7	3-Major	BT908453	Trunks with names longer than 32 characters update working-mbr-count in vCMP guests incorrectly
904401-6	3-Major	BT904401	Guestagentd or devmgmtd core
901989-9	3-Major	BT901989	Corruption detected in /var/log/btmp
894593-3	3-Major	BT894593	High CPU usage caused by the restjavad daemon continually crashing and restarting
883149-8	3-Major	BT883149	The fix for ID 439539 can cause mcpd to core.
867549-5	3-Major	BT867549	LCD touch panel reports "Firmware update in progress" indefinitely★
867253-5	3-Major	BT867253	Systemd not deleting user journals
838337-9	3-Major	BT838337	The BIG-IP system's time zone database does not reflect recent changes implemented by Brazil in regard to DST.
798885-7	3-Major	BT798885	SNMP response times may be long when processing requests
775845-8	3-Major	BT775845	Httpd fails to start after restarting the service using the iControl REST API
762097-6	3-Major	BT762097	No swap memory available after upgrading to v14.1.0 and above★
759258-8	3-Major	BT759258	Instances shows incorrect pools if the same members are used in other pools
757787-6	3-Major	BT757787	Unable to edit LTM/AFM Policies that belong to an Application Service (iApp) using the WebUI.
739904-5	3-Major	BT739904	/var/log/ecm log is not rotated
739118-7	3-Major	BT739118	Manually modifying a self IP address in bigip_base.conf file and reloading the configuration results in routing misconfiguration
725646-9	3-Major	BT725646	The tmsh utility cores when multiple tmsh instances are spawned and terminated quickly
721892-3	3-Major	BT721892	Pfmand on vCMP guests does not recover after service interruption
717174-6	3-Major	BT717174	WebUI shows error: Error getting auth token from login provider★
716140-5	3-Major	BT716140	Information in snmpd.conf files may be overwritten causing SNMP v3 queries to recieve 'Unsupported security level' errors
637827-1	3-Major	BT637827	VADC: after re-deploying a single-nic VM with multiple nics, a load can fail due to stp member 1.0
554506-4	3-Major	K47835034, BT554506	PMTU discovery from the management interface does not work
538283-7	3-Major	BT538283	iControl REST asynchronous tasks may block other tasks from running
499348-15	3-Major	BT499348	System statistics may fail to update, or report negative deltas due to delayed stats merging.
385013-8	3-Major		Certain user roles do not trigger config sync for the 'modify auth password' command
213618-3	3-Major		Resetting DB variable to default does not always work
2058541-1	3-Major	BT2058541	[BGP] BIG-IP does not follow updated section of rfc4724.html#section-4.2 when handling a new connection from peer.
2053489-2	3-Major	BT2053489	Config Sync events may not be recorded in audit log
2047429-2	3-Major	BT2047429	PostgreSQL should dump a corefile when not exiting
2035197	3-Major	BT2035197	TMM restart after modprobe causes TMM to go into restart loop
2014597-1	3-Major	BT2014597	Async session db ops are missing flow control
1993081-2	3-Major	BT1993081	SNMP traps are not being generated for bigipExternalLinkDown (.1.3.6.1.4.1.3375.2.4.0.218) and bigipExternalLinkUp (.1.3.6.1.4.1.3375.2.4.0.219).
1989033-1	3-Major	BT1989033	IPsec IKEv2 tunnel may fail to initiate or respond due to ERR_PORT
1974845-3	3-Major	BT1974845	Missing routes in 1nic allows access to GUI via self IP
1974701-2	3-Major	BT1974701	PVA stats may be double incremented when pva mode is dedicated
1972465-2	3-Major	BT1972465	LTM Syncookie always SW mode for a wildcard virtual server
1972273-1	3-Major	BT1972273	[F5OS tenant] Adjusting VLAN mtu (or description) throws MCP validation error VLAN /Common/vlan has an id of X, and customer-tag of none and it cannot be used by VLAN /Common/vlan
1967589-1	3-Major	BT1967589	Using tmsh to query iControl REST (tmsh list mgmt ...) commands consume an auth token and does not get removed immediately
1966941-1	3-Major	BT1966941	High CPU or increased translation errors following upgrade or restart when DAG distribution changes
1958033-2	3-Major	BT1958033	MCPD validates only one ssl profile when a virtual server attached to http/2 profile with enforce-tls-requirements enabled along with multiple clientssl profiles with anyone has renegotiation option enabled
1943669-1	3-Major	BT1943669	"Automatic Update Check & Automatic Phone Home features" settings is changed upon running 'load sys config current-partition' in other partition
1936469-2	3-Major	BT1936469	Multiple Ctrl-Alt-Delete signals in virtual console reboots BIG-IP Virtual Edition
1936233-2	3-Major	BT1936233	TMM mismanagement of IPsec connections can slowly leak memory and cause tunnel negotiation to fail
1935833-1	3-Major	BT1935833	Tmm cores with "ERR: Attempting to send MPI message to ourself"
1933105-2	3-Major	BT1933105	TMM does not fragment the output before encapsulating the payload
1922617-2	3-Major	BT1922617	BGP Multipath selection might be unpredictable.
1893989-2	3-Major	BT1893989	NTP truncates symmetric keys to 30 bytes
1890749-1	3-Major	BT1890749	In a multi-user scenario, the system is allowing users to create more authentication tokens than the maximum limit allowed per user.
1889877-2	3-Major	BT1889877	The tmrouted daemon scheduling multiple ZebOS processes might lead to delayed process starts
1881569-3	3-Major	BT1881569	Programs invoked by tmsh when session is interrupted may remain running
1856449-2	3-Major	BT1856449	[keymgmtd]OpenSSL: DRBG Continuous RNG test failed: DRBG stuck.
1854353-1	3-Major	BT1854353	Users with Resource admin role are not able to save the UCS.
1849265-1	3-Major	BT1849265	A VCMP guest may not exit hardware syncookie mode
1826273-1	3-Major	BT1826273	Mysql client uses TLS1.1 when connecting to mysql server running 5.7
1818361	3-Major	BT1818361	Per-VLAN TCAM rules are incorrectly created for empty "disable" IFC list by dynamic TCAM
1813593-1	3-Major	BT1813593	Monitor instances on non-Common partition cannot be displayed when "All [Read Only]" was selected at upper right partition drop-down box.
1813505-1	3-Major	BT1813505	Snmpd may seg fault on systems with large amounts of virtual memory
1788193-2	3-Major	BT1788193	[MCP] Request logging should only be allowed with supported protocol profiles
1784141-1	3-Major		Updatecheck returns obsolete downloads url
1784137-2	3-Major	BT1784137	Net stp-globals object config-name back to default value upon reboot
1772609-1	3-Major	BT1772609	Correct FPGA type and Turboflex profile may not be automatically applied when changing license
1759261-3	3-Major	BT1759261	OSPF might fail to install external routes after topology change.
1755413-1	3-Major	BT1755413	Fast scp file transfer may not display progress bar
1753489-1	3-Major	BT1753489	BFD Commands Missing in ZebOS Config After Reboot or Restart for large configurations
1708957-1	3-Major	BT1708957	Excessive debug logs can cause key management daemon failure
1690721-1	3-Major	BT1690721	Bgpd crashes on `write` config or running show running-config CLI, when trying to delete neighbor with wrong peer-group
1690441-1	3-Major	K96223265, BT1690441	IPsec traffic-selector selection algorithm in interface mode★
1679633-3	3-Major	BT1679633	Custom SNMP OID script using clsh/ssh fails due to SElinux permissions
1677429-3	3-Major	BT1677429	BFD: TMM might not agree on session ownership.
1671129-1	3-Major	BT1671129	Add support for TLSv1.2 in PHP package
1670625-2	3-Major	BT1670625	Incorrect set of TCAM rules
1670465-3	3-Major	BT1670465	TMMs might not agree on session ownership when multiple cluster geometry changes occur.
1644497-3	3-Major	BT1644497	TMM retains old Certificate Revocation List (CRL) data in memory until the existing connections are closed
1633925-3	3-Major	BT1633925	Neurond is crashing intermittently during the creation/deletion of Neuron rules.
1632925-1	3-Major	BT1632925	Sod does not update the value for sys DB failover.crcvalues
1629693-1	3-Major	BT1629693	Continuous rise in DHCP pool current connections statistics
1629465-1	3-Major	BT1629465	Configuration synchronization fails when there is large number of user partitions (characters in user partition names exceeds sixty five thousand)
1621269-2	3-Major	BT1621269	TMM restart loop when attaching large number of interfaces.
1620725-3	3-Major	BT1620725	IPsec traffic-selector modification can leak memory
1615081-1	3-Major	BT1615081	Remove SHA and AES Constraint Checks in SNMPv3
1603445-3	3-Major	BT1603445	Wccpd can have high CPU when transitioning from active to standby
1602209	3-Major	BT1602209	The bigipTrafficMgmt.conf file is not copied from UCS to /config/snmp★
1600617-3	3-Major	BT1600617	Few virtio driver configurations may result in excessive memory usage
1599841-2	3-Major	BT1599841	Partition access is not synced to Standby device after adding a remote user locally.
1596313-1	3-Major	BT1596313	Deleting and re-adding a LAG on F5OS causes a validation failure in mcpd, therefore the trunk on the tenant has no interfaces
1592485-1	3-Major	BT1592485	'tcp-psh-flood' attack vector is deleted after upgrade to v17.1.3 and failed to load the configuration★
1589753-3	3-Major	BT1589753	[BGP] IPv6 routes not installed/pushed after graceful restart when IPv6 peer-groups are configured.
1586745-1	3-Major	BT1586745	LACP trunk status became DOWN due to bcm56xxd failure
1580369-1	3-Major	BT1580369	MCPD thrown exception when syncing from active device to standby device.
1572577	3-Major		Certain user roles cannot modify the Address Lists in Shared Objects in normal flow
1562833-1	3-Major	BT1562833	Qkview truncates log files without notification
1560449-1	3-Major	BT1560449	Rest_logintegrity does not suppress output to stderr
1552517-1	3-Major	BT1552517	When F5OS tenants are part of a GTM sync group, rebooting one device may cause monitor flapping on the other
1549661-1	3-Major	BT1549661	Logs sent to syslog-ng on VIPRION devices utilize truncated hostname instead of FQDN
1496269-3	3-Major	BT1496269	VCMP guest on version 16.1.4 or above might experience constant TMM crashes.★
1491165-2	3-Major	BT1491165	TMM crashes when saving DAG setting and there are 7 or more blades
1490861-3	3-Major		"Virtual Server (/Common/xxx yyy)" was not found" error while deleting a virtual server in GTM
1469221-2	3-Major	BT1469221	SSH access issues due to line wrapping in known_hosts file
1462421-3	3-Major	BT1462421	PVA connections are not re-accelerated after a failover.
1461601-1	3-Major	BT1461601	SSH to localhost not working with SSH-RSA in Non FIPS mode
1455805-1	3-Major	BT1455805	MCPD unstable/inoperative after copying SNMP configuration from another BIG-IP
1408229-1	3-Major	BT1408229	VCMP guest deployment may fail on newly installed blade
1407929-2	3-Major	BT1407929	Virtual-wire HW offload statistics are incorrect
1403869-4	3-Major	BT1403869	CONNFLOW_FLAG_DOUBLE_LB flows might route traffic to a stale next hop
1403797	3-Major	BT1403797	Extending the username existence check for remote users
1401569-1	3-Major		Engineering Hotfix readme file refers to non-applicable "full_box_reboot" command★
1381629	3-Major	BT1381629	Config Sync Issues may arise after UCS restore/save and sync.
1348061-4	3-Major	BT1348061	[Dual Stack MGMT] - Upgrade of BIG-IP in HA with Dual stacked mgmt IP causes deletion of peers failover IPv4 unicast address★
1347861-1	3-Major	BT1347861	Monitor status update logs unclear for FQDN template pool member
1340513-1	3-Major	BT1340513	The "max-depth exceeds 6" message in TMM logs
1332473-1	3-Major	BT1332473	Configuring SNAT Origin IPv6 address through GUI in non RD0 incorectly expands subnet mask to '/32' causes error during configuration load
1330273-3	3-Major		When MAC masquerade is enabled on r5k/r10k/r12k systems with a live upgrade, an FDB entry is seen on Active and Standby
1322413-1	3-Major	BT1322413	After config sync, FQDN node status changes to Unknown/Unchecked on peer device
1319385-1	3-Major	BT1319385	Syncookies may always show as enabled if a listener address is changed while syncookies is on
1318041-1	3-Major	BT1318041	Some OIDs using type as counter instead of expected type as gauge
1316481-1	3-Major		Large CRL file update fails with memory allocation failure
1316113	3-Major		1nic VE reloads on every reboot
1312225-1	3-Major	BT1312225	System Integrity Status: Invalid with some Engineering Hotfixes
1311613-1	3-Major	BT1311613	UCS obtained from F5OS tenant with FPGA causes continuous TMM restarts when loaded to BIG-IP
1304801-1	3-Major		Sync Status: Disconnected. ARP replies suspected to be dropped at the innterface
1302101-1	3-Major	BT1302101	Sflow receiver flows are not established at TMM startup on sDAG platforms due to sDAG delay
1301897-4	3-Major	BT1301897	DAG transition does not complete when TMM starts in FORCED_OFFLINE mode
1298133-4	3-Major	BT1298133	BFD sessions using floating self IP do not work well on multi-blade chassis and HA environments.
1295353-1	3-Major	BT1295353	The vCMP guest is not sending HTTP flow samples to sFlow receiver
1291121-1	3-Major	BT1291121	BIG-IP tenants on F5OS r5000, r10000, and r12000 platforms don't pass traffic properly while in forced offline state
1288009-4	3-Major	BT1288009	Vxlan tunnel end point routed through the tunnel will cause a tmm crash
1283721-1	3-Major	BT1283721	Vmtoolsd memory leak
1271941-2	3-Major	BT1271941	Tomcat CPU utilization increased after upgrading to 15.1.6 and higher versions.★
1256757-2	3-Major	BT1256757	Suspect keymgmtd memory leak while using dynamic CRL.
1253449-4	3-Major	BT1253449	After publishing, the draft LTM policy configuration might not be updated (intermittently) into the bigip.conf
1230109-2	3-Major	BT1230109	Mcpd memory and CPU increase while getting route stats
1217473-1	3-Major	BT1217473	All the UDP traffic is sent to a single TMM
1211089-4	3-Major	BT1211089	Traffic to IPv6 all nodes address not received by TMM on VE with ixlv driver
1188817-3	3-Major	BT1188817	BIG-IP tenant on F5OS not allowed to modify VLAN tag value
1182729-4	3-Major		Java connection establishes from BIG-IP to BIG-IQ Management
1168245-2	3-Major	BT1168245	Browser is intermittently unable to contact the BIG-IP device
1137269-6	3-Major	BT1137269	MCPD fails to reply if a request is proxied to another daemon and the connection to that daemon closes
1126561-3	3-Major	BT1126561	Connections over IPsec fail when hardware acceleration in fastl4 is enabled
1126505-2	3-Major	BT1126505	HSB and switch pause frames impact data traffic
1124733-3	3-Major		Unnecessary internal traffic is observed on the internal tmm_bp vlan
1103953-3	3-Major	K60914243, BT1103953	Unable to connect to "localhost" port 25. err sSMTP[9797]
1090313-5	3-Major	BT1090313	Virtual server may remain in hardware SYN cookie mode longer than expected
1082133-4	3-Major	BT1082133	iSeries LCD displays "Host inaccessible or in diagnostic mode"
1072401-1	3-Major	BT1072401	Modification of certificate associated with a parent ssl profile will fail if the a child profile is part of an iApp with strict updates enabled
1070393-2	3-Major	BT1070393	The f5_api_com.crt certificate file may be removed by the load sys config command
1063237-7	3-Major	BT1063237	Stats are incorrect when the management interface is not eth0
1062901-5	3-Major	BT1062901	The 'trap-source' and 'network' SNMP properties are ineffective, and SNMP traps may be sent from an unintended interface.
1045277-6	3-Major	BT1045277	The /var partition may become 100% full requiring manual intervention to clear space
1043141-3	3-Major	K36822000, BT1043141	Misleading error 'Symmetric Unit Key decrypt failure - decrypt failure' when loading UCS from another BIG-IP
1040277-7	3-Major	BT1040277	Syslog-ng issue may cause logging to stop and possible reboot of a system
1036217-1	3-Major	BT1036217	Secondary blade restarts as a result of csyncd failing to sync files for a device group
1029173-5	3-Major	BT1029173	MCPD fails to reply and does not log a valid message if there are problems replicating a transaction to PostgreSQL
1026273-5	3-Major	BT1026273	HA failover connectivity using the cluster management address does not work on VIPRION platforms★
1022997-5	3-Major	BT1022997	TCP segments with an incorrect checksum are transmitted when the sock driver is used in AWS deployments (e.g., 1NIC)
1021925-5	3-Major	BT1021925	During bootup AWS BIG-IP endpoint was not licensed when custom gateway configured over management interface
1019829-8	3-Major	BT1019829	Configsync.copyonswitch variable is not functioning on reboot
1016433-3	3-Major	BT1016433	URI rewriting is incorrect for "data:" and "javascript:"
1013209-6	3-Major	BT1013209	BIG-IP components relying on ca-bundle.crt may stop working after upgrade★
1010341-5	3-Major	BT1010341	Slower REST calls after update for CVE-2021-22986
1010301-1	3-Major	BT1010301	Long-Running iCall script commands can result in iCall script failures or ceasing to run
1009337-6	3-Major	BT1009337	LACP trunk down due to bcm56xxd send failure
1006857-4	3-Major	BT1006857	Adding a source address list to a virtual server in a partition with a non-default route domain fails.
1003225-1	3-Major	BT1003225	'snmpget F5-BIGIP-LOCAL-MIB::ltmWebAccelerationProfileStat* returns zeroes
1002417-3	3-Major	BT1002417	Switch L2 forwarding entries learnt on multi-blade trunk in one blade needs to be synchronized to other blades of that trunk
995653-1	4-Minor	BT995653	Bigtop command is showing inaccurate 'Conn' value for NODE ip:port
977681-4	4-Minor	BT977681	Incorrect error message when changing password using passwd
976517-4	4-Minor	BT976517	Tmsh run sys failover standby with a device specified but no traffic group fails
939517-6	4-Minor	BT939517	DB variable scheduler.minsleepduration.ltm changes to default value after reboot
929173-6	4-Minor	BT929173	Watchdog reset due to CPU stall detected by rcu_sched
910645-3	4-Minor	BT910645	Upgrade error 'Parsing default XML files. Failed to parse xml file'★
895669-4	4-Minor	BT895669	VCMP host does not validate when an unsupported TurboFlex profile is configured
868801-1	4-Minor	BT868801	BIG-IP still sends STARTTLS if the 'No encryption' SNMP option is enabled
857045-5	4-Minor	BT857045	LDAP system authentication may stop working
803773-4	4-Minor	BT803773	BGP Peer-group route-maps are not applied to newly configured address-family ipv6 peers
789133-1	4-Minor	BT789133	iControl REST framework returns the chunks previously requested
755564-1	4-Minor	BT755564	No support of TMUI (GUI) in 1 or 2 CORE 2GB VE instance
753712-5	4-Minor	BT753712	Incorrect warning: Traffic Matching Criteria's inline source address has been set to any4 from any6 to match inline destination address' address family.
747823-3	4-Minor	BT747823	Drd utility can hang when generating qkview
745125-3	4-Minor	BT745125	Network Map page Virtual Servers with associated Address/Port List have a blank address.
714705-9	4-Minor	BT714705	Excessive 'The Service Check Date check was skipped' log messages.
696363-8	4-Minor	BT696363	Unable to create SNMP trap in the GUI
694765-8	4-Minor	BT694765	Changing the system's admin user causes vCMP host guest health info to be unavailable
659579-7	4-Minor	BT659579	Timestamps in icrd, restjavad, and restnoded logs are not synchronized with the system time
658943-7	4-Minor	BT658943	Errors when platform migration process is loading UCS using trunks on vCMP guest/F5OS Tenants
539648-5	4-Minor	K45138318, BT539648	Disabled db var Watchdog.State prevents vCMP guest activation.
2131597-1	4-Minor	BT2131597	BGP graceful restart might not accept a new connection immediatelly post neighbor failover.
2064225-2	4-Minor	BT2064225	FQDN nodes created when creating FQDN pool member have "address-family" set to "all"
2064209-2	4-Minor	BT2064209	FQDN node created from pool member via tmsh does not inherit "autopopulate" value
2050389-3	4-Minor	BT2050389	VIPRION cluster management IP may not appear in SNMP IP-MIB table
2012301-2	4-Minor		Upgrade the certificate to be compatible with the new upgraded gson package
1972321-1	4-Minor	BT1972321	"IP Reputation" option does not show up when creating a rule in LTM policy
1968193-2	4-Minor	BT1968193	Management Route name displayed incorrectly via API when the route name contains a forward slash (/)
1967293-2	4-Minor	BT1967293	Re-configuring BFD multihop for a BGP peer does not work reliably.
1966669	4-Minor	BT1966669	[PVA] Provide a DB variable disabling NAT46/64 snoop inserts.
1966053-2	4-Minor	BT1966053	MCPD memory leak in firewall
1959785-1	4-Minor	BT1959785	BIG-IP incorrectly marked as "Managed by BIG-IQ" by its BIG-IP HA peer
1953069-1	4-Minor		Monitor instance table is not updated with the correct transparent attribute
1934941-2	4-Minor	BT1934941	Assertion failure in aspath_intern for BGPD.
1934457-1	4-Minor	BT1934457	Cursor in BIG-IP Configuration Utility iRule editor appears in the incorrect position
1880009-2	4-Minor	BT1880009	The BIG-IP Sync-only group syncs the virtual server with the attached port-list
1828005-2	4-Minor	BT1828005	Syslog message does not carry log level when destination is remote
1813625	4-Minor	BT1813625	"tmsh show net ipsec-stat" command is not showing statistics - all values are zero.
1786309-1	4-Minor	BT1786309	[Hyper-V BIG-IP Virtual Edition] - Significant system clock skew after a reboot★
1785953-2	4-Minor	BT1785953	The 'cm device' information is not updated in in bigip_base.conf file after time-limited-module add-nn license was added or replaced
1778901-1	4-Minor	BT1778901	PPTP-GRE proxy need tmstat table for connection error analysis
1711945	4-Minor	BT1711945	Inconsistent SNMPv3 engineID after re-deployment of BIG-IP VE when using "engineIDType 2"
1709689-3	4-Minor	BT1709689	BGP 'no bgp default ipv4-unicast' might lead to config load problems and crashes.★
1701381-1	4-Minor	BT1701381	Silent failure when modifying members of a pool that does not exist.
1694109	4-Minor	BT1694109	VCMP guest software image install ( source image from vHost) with large number of VLANs causes lind restart★
1688545-1	4-Minor	BT1688545	PVA-processed traffic is not included in the route-domain stats via SNMP
1682101	4-Minor	BT1682101	Restjavad CPU goes close to 100% during telemetry pollers collect stats
1677409	4-Minor	BT1677409	Show auth login-failures does not show failures when remote auth falls back to local auth
1635013-4	4-Minor	BT1635013	The "show sys service" command works only for users with Administrator role
1629221-1	4-Minor	BT1629221	BWC menu is not available in UI when licensing DHD
1623597-1	4-Minor	BT1623597	Nat46/64 hardware connection re-offload is not optimal.
1621481-1	4-Minor	BT1621481	Tmrouted in a restart loop when large number of route-domains is configured.
1612561-3	4-Minor	BT1612561	The "Source Address" field on the Virtual Server configuration page does not accept IPv4-mapped IPv6 addresses
1600669-3	4-Minor	BT1600669	Inconsistency in iRule parsing for iControl REST and tmsh/WebUI
1600333-3	4-Minor	BT1600333	When using long VLAN names, ECMP routes with multiple nexthop addresses may fail to install
1596493	4-Minor	BT1596493	UCS load of VCMP guest fails on invalid Management Route
1590689-2	4-Minor	BT1590689	Loss of kernel routes occurs on 1NIC Virtual Edition when the DHCP lease expires.
1589421-2	4-Minor	BT1589421	LTM Monitor not shown in Pool Member "Health Monitors" if Transparent attribute changes
1579637-3	4-Minor	BT1579637	Incorrect statistics for LTM. Rewrite profile with rewrite_uri_translation mode
1560853-1	4-Minor	BT1560853	[GUI] error while updating the rewrite profile uri-rules name have both leading and trailing "/"
1550933-1	4-Minor	BT1550933	Gtm virtual server query_all related SNMP query could get wrong result
1493869-1	4-Minor	BT1493869	'Duplicate OID index found' warning observed while running snmpwalk for F5-BIGIP-SYSTEM-MIB::sysProcPidStatProcName periodically
1462337-1	4-Minor	BT1462337	Intermittent false PSU status (not present) through SNMP
1401961	4-Minor	BT1401961	A blade with a non-functional backplane may override the dag context for the whole system
1355309-1	4-Minor	BT1355309	VLANs and VLAN groups are not automatically saved to bigip_base.conf on first boot or modification of a tenants VLANs or virtual wire
1352445-1	4-Minor	BT1352445	Executing 'tmsh load sys config verify', changes Last Configuration Load Status value to 'config-load-in-progress'
1331037-4	4-Minor	BT1331037	The message MCP message handling failed logs in TMM with FQDN nodes/pool members
1317929-1	4-Minor	BT1317929	Updated ccmode script★
1314769-1	4-Minor	BT1314769	The error "No Access" is displayed when trying to remove Bundle Manager object from list
1311977-3	4-Minor	K000134901	IPsec interface mode tunnel not sending icmp unreachable fragmentation needed
1301865-4	4-Minor	BT1301865	OSPF summary might have incorrect cost when advertised by Standby unit.
1301317-1	4-Minor	BT1301317	Update Check request using a proxy will fail if the proxy inserts a custom header
1295217-2	4-Minor	BT1295217	When provision.1nic is set to forced_enable the mgmt interface does not respond to ICMP
1283749-1	4-Minor	BT1283749	Systemctl start and restart fail to start the vmtoolsd service
1282421-2	4-Minor	BT1282421	IS-IS protocol may discard Multi-Topology Reachable IPv6 Prefixes
1270989-1	4-Minor	BT1270989	REST MemcachedClient uses fixed TMM address 127.1.1.2 to connect to memcached
1229325-1	4-Minor	BT1229325	Unable to configure IP OSPF retransmit-interval as intended
1223589-5	4-Minor	BT1223589	Network Map page is unresponsive when a node name has the form "<IPv4>:<port>"
1217297	4-Minor	BT1217297	Removal of guestagentd service from the list of services running inside a tenant.
1217077-1	4-Minor	BT1217077	Race condition processing network failover heartbeats with timeout of 1 second
1142445-6	4-Minor	BT1142445	Multicast handling on wildcard virtual servers leads to TMM memory leak
1121169-5	4-Minor	BT1121169	Unable to resize the /appdata: /dev/mapper/vg--db--sda-dat.appdata when in use
1114253-5	4-Minor	BT1114253	Weighted static routes do not recover from BFD link failures
1089625-1	4-Minor	BT1089625	Java core dump with SIGABRT while high cpu load in BIG-IP
1080093-1	4-Minor	BT1080093	The Acct-Session-id attribute for audit, forwarding the RADIUS packets is always the same for all sessions
1074513-4	4-Minor	BT1074513	Traffic class validation does not detect/prevent attempts to add duplicate traffic classes to virtual
1064753-6	4-Minor	BT1064753	OSPF LSAs are dropped/rate limited incorrectly.
1060769-5	4-Minor	BT1060769	The /mgmt/tm/sys/performance/all-stats and /mgmt/tm/sys/performance/throughput iControl REST endpoints cannot be successfully parsed by common JSON libraries.
1047789-2	4-Minor	BT1047789	[APM] MCP err msg seen when editing/applying resource assign in VPE
1006449-4	4-Minor	BT1006449	High CPU utilization and slow SNMP response after upgrade★
818777-4	5-Cosmetic	BT818777	MCPD error - Trouble allocating MAC address for VLAN object
1969873-1	5-Cosmetic	BT1969873	IP reputation status is only available on primary blade
1361021-1	5-Cosmetic	BT1361021	The management interface media on a BIG-IP Tenant on F5OS systems does not match the chassis
1189949-4	5-Cosmetic	BT1189949	The TMSH sys core is not displaying help and tab complete behavior
1099621-2	5-Cosmetic	BT1099621	DAG context synchronization debug instrumentation

Local Traffic Manager Issues

ID Number	Severity	Links to More Info	Description
1825513-3	1-Blocking	BT1825513	ClientSSL profile with PQC group may cause TMM to crash
1785385-1	1-Blocking	BT1785385	Intermittent traffic failures when tenant is running BIG-IP v17.1.2 or above and host is on version prior to F5OS-A 1.8.0 or F5OS-C 1.8.0★
1691489	1-Blocking	BT1691489	Traffic does not pass through rSereis FIPS system
883089-1	2-Critical	BT883089	Excessive TMM memory consumption by "Anti-Replay" protection for TLS 1.3 0-RTT/Early Data
832153-1	2-Critical	BT832153	Crash due to incorrect format specifiers is fixed.
797573-4	2-Critical	BT797573	TMM assert crash with resulting in core generation in multi-blade chassis
758491-6	2-Critical	BT758491	When using NetHSM integration, after upgrade to 14.1.0 or later (or creating keys using fipskey.nethsm), BIG-IP cannot use the keys
632553-7	2-Critical	K14947100, BT632553	DHCP: OFFER packets from server are intermittently dropped
2038393-1	2-Critical	BT2038393	Looped dtls virtual can cause crash due to NULL dereference
1965329-2	2-Critical	BT1965329	TMM may crash when re-declaring an LTM policy with a data-group
1921085-3	2-Critical	BT1921085	Core file generated when using FTP::ftps_mode require without SSL profile in TCP filter
1921049-2	2-Critical	BT1921049	When L7 policy is updated, existing HTTP/2 connection using it gets a RST_STREAM
1854137-2	2-Critical	BT1854137	Verified accept and pool reselect-tries may cause TCP proxy to core
1825357-1	2-Critical	BT1825357	Possible tmm crash or traffic loss after making vlan interface changes with an empty trunk
1713881-1	2-Critical	BT1713881	On Azure BIG-IP VE, cannot pass traffic after TMM restart
1598405-1	2-Critical	BT1598405	Intermittent TCP RST error 'HTTP internal error (bad state transition)' occurs for larger files when the Explicit Proxy virtual server uses HTTP_REQUEST_SEND iRule event
1519001-1	2-Critical	BT1519001	After a crash, tmm may experience memory corruption
1518985	2-Critical	BT1518985	Periodic fetching of DOS stats might result in TMM crash under low memory conditions
1481889-1	2-Critical	BT1481889	High CPU utilization or crash when CACHE_REQUEST iRule parks.
1399369-1	2-Critical	BT1399369	While upgrading standby device, active device is going to standby mode for few seconds, and traffic loss is observed.★
1346101-2	2-Critical	BT1346101	SSL Orchestrator can crash TMM
1127725-2	2-Critical	BT1127725	Performance drop with the AES_CCM 128 cipher★
1100249-7	2-Critical	BT1100249	SNAT with FLOW_INIT firewall rule may core TMM due to wrong type of underlying flow structure
1091021-6	2-Critical	BT1091021	The BIG-IP system may not take a fail-safe action when the bigd daemon becomes unresponsive.
1087981-1	2-Critical	BT1087981	Tmm crash on "new serverside" assert
1073897-6	2-Critical	BT1073897	TMM core due to memory corruption
1070181-4	2-Critical	BT1070181	MCPD crash on the standby device
1009161-3	2-Critical	BT1009161	SSL mirroring protect for null sessions
976853-1	3-Major	BT976853	SNAT pool traffic-group setting may override non-floating self IP's traffic-group
975657-2	3-Major		With HTTP2 enabled, only partial sorry contents (< 32KB) can be sent to the client via HTTP::respond
967353-8	3-Major	BT967353	HTTP proxy should trim spaces between a header field-name and colon in its downstream responses.
963393-4	3-Major	BT963393	Key handle 0 is treated as invalid for NetHSM devices
937573-5	3-Major	BT937573	Connections drop in virtual server with Immediate Action On Service Down set to Drop
928445-10	3-Major	BT928445	HTTPS monitor is down when server_ssl profile cipher string is configured to TLSv1_2
912293-7	3-Major	BT912293	Persistence might not work properly on virtual servers that utilize address lists★
905477-7	3-Major	BT905477	The sdmd daemon cores during config sync when multiple devices configured for iRules LX
901569-6	3-Major	BT901569	Loopback traffic might get dropped when VLAN filter is enabled for a virtual server.
891565-3	3-Major	BT891565	The Subject Alternative Name (SAN) field in Certificates and Certificate Signing Requests is limited to 4095 bytes
887265-7	3-Major	BT887265	BIG-IP systems may fail to come online after upgrade with ASM and VLAN-failsafe configuration★
882725-7	3-Major	BT882725	Mirroring not working properly when default route vlan names not match.
881937-5	3-Major	BT881937	TMM and the kernel choose different VLANs as source IPs when using IPv6.
870349-3	3-Major	BT870349	Continuous restart of ntlmconnpool after the license reinstallation★
867985-7	3-Major	BT867985	LTM policy with a 'shutdown' action incorrectly allows iRule execution
857769-4	3-Major	BT857769	FastL4+HTTP or FastL4+Hash-Persistence virtual servers do not work correctly in DSR mode.
842137-7	3-Major	BT842137	Keys cannot be created on module protected partitions when strict FIPS mode is set
783077-3	3-Major	BT783077	IPv6 host defined via static route unreachable after BIG-IP reboot
779137-8	3-Major	BT779137	Using a source address list for a virtual server does not preserve the destination address prefix
767217-6	3-Major	BT767217	Under certain conditions when deleting an iRule, an incorrect dependency error is seen
751451-5	3-Major	BT751451	When upgrading to v14.0.0 or later, the 'no-tlsv1.3' option is missing from HTTPS monitors automatically created server SSL profiles
743444-1	3-Major	BT743444	Changing monitor config with SASP monitor causes Virtual to flap
740274-3	3-Major	BT740274	TMM stall during startup when syslog is not listening to tmm.pipe
739475-8	3-Major	BT739475	Site-Local IPv6 Unicast Addresses support.
673060-1	3-Major	BT673060	SSL handshake failure with Session Ticket enabled on the backend server
2130729-2	3-Major	BT2130729	HTTP::respond not working properly with HTTP3/quic - content not sent
2035277-2	3-Major	BT2035277	Modifying virtual-address 'enabled' setting might lead to unpredictable virtual-server availability
2035177-2	3-Major	BT2035177	Use of OCSP responder with SSL C3D enabled in virtual server may leak SSL handshake instances
2035129-3	3-Major	BT2035129	The CMP stream communication between tmms on different blades might stall after a tmm memory exhaustion event
2033781-2	3-Major	BT2033781	Memory allocation failed: can't allocate memory to extend db size
2011301	3-Major	BT2011301	TMM crash because corrupted MQTT queue
1989125-2	3-Major	BT1989125	TSval value of Ack packets sent by BIG-IP may roll back in time
1988981-1	3-Major	BT1988981	TMM crashes after detaching and reattaching a DoS profile on the DNS virtual server
1987405-2	3-Major	BT1987405	Virtual address ICMP and ARP setting might be inconsistent when traffic-matching-criteria is in use.
1987309-1	3-Major	BT1987309	Bigd may get stuck in legacy mode
1972541-2	3-Major	BT1972541	Tmsh load sys config verify leaks compiled ltm (CPM) policies
1969889-1	3-Major	BT1969889	Expired certificates sent to clients by tmm due to network time synchronization
1962813-3	3-Major	BT1962813	The csyncd daemon on one or more of the cluster's secondary blades does not synchronise RRD files from the primary★
1943257-2	3-Major	BT1943257	HTTP monitor "last error" string sends incorrect response
1935713-1	3-Major	BT1935713	TMM crash when handling traffic over vlangroup with autolasthop disabled
1934157-1	3-Major	BT1934157	Http2 monitor fails if a pool is used for routing to pool members
1929045-1	3-Major	BT1929045	TMM may core after HTTP::respond used for first request on iSession connection
1928169-2	3-Major	BT1928169	HTTP2 RST_STREAM NO_ERROR received by BIG-IP not interpreted correctly
1921069-1	3-Major	BT1921069	The error ERR_ARG occurs when using iRule HTTP::collect command without the parameter value in HTTP_REQUEST_DATA
1889861-2	3-Major	BT1889861	Passive monitoring with ASM might not log the server response.
1889741-1	3-Major	BT1889741	Need for the SYS DB variable to toggle ssl_crypto::queue_max
1826185-1	3-Major	BT1826185	Tenants on r2000 and r4000 series may drop packets larger than 9194 bytes
1824985-1	3-Major	BT1824985	In rare cases the Nitrox hardware compression queue may stop servicing requests.
1824521-1	3-Major	BT1824521	GUI: VLAN names are not populated while creating the vlan-group under Network Quick configuration
1821033-1	3-Major	BT1821033	Assertion "packet must already have an ethernet header" when using tcpdump
1818137-1	3-Major	BT1818137	Tmm IPv4 fragmentation handling distribution
1814821-1	3-Major	BT1814821	DHE groups present in profile's cipherlist with TLS1.3 enabled and tmm.ssl.useffdhe set to false simultaneously
1788065-2	3-Major	BT1788065	The rule cannot be deleted because it is in use by a rule
1785673-2	3-Major	BT1785673	F5OS r2000 and r4000 series configured with vlan-groups might fail to respond to ARP requests
1781949-3	3-Major	BT1781949	QUIC might drop a HS context packet during the initial handshake
1778793-1	3-Major	BT1778793	Database health monitors may use the wrong connection when attempting to connect to database
1758961-1	3-Major	BT1758961	TMM may core if proxy_common_init errors out due to inappropriate NAT configuration
1755181-1	3-Major	BT1755181	Not enough information when a TCP reset occurs due to compression error
1708309-1	3-Major	BT1708309	Dynconfd crash with invalid ephemeral pool member
1700005-1	3-Major	BT1700005	Unable to tunnel HTTP2 request through HTTP2 virtual server
1637797-3	3-Major	BT1637797	Memory leak in TMM of TCL memory when a procedure is called with too few arguments
1637477-1	3-Major	BT1637477	Negotiated Window scaling by HW SYN cookie not accounted by TMM
1636077-1	3-Major	BT1636077	Adding an operationally DOWN interface to existing LAG causes traffic disruption on r2k/r4k
1624557-1	3-Major	BT1624557	HTTP/2 with RAM cache enabled could cause BIG-IP to return HTTP 304 with content
1623921-2	3-Major	BT1623921	IPencap monitor probes from bigd are prone to connection re-use.
1602641-4	3-Major	BT1602641	Configuring verified-accept and SSL mirroring on the same virtual results in stalled connections.
1602629-3	3-Major	BT1602629	Tmm_mcpmsg_print can trigger SOD
1599597-1	3-Major		BD start failure
1598381-2	3-Major	BT1598381	Unable to set the key-usage setting while renewing the CSR
1585153-2	3-Major	BT1585153	SSL handshake failures with error message Profile <name> cannot load key/cert/chain
1581685-1	3-Major	BT1581685	iRule 'members' command counts FQDN pool members.
1577161-1	3-Major	BT1577161	BIG-IP tries to resume SSL sessions when session ID only matches partially
1572545-3	3-Major	BT1572545	Upgrade from version 14.X to version 15.X may encounter problems with L2 forwarding for some of the flows.★
1558869-1	3-Major	BT1558869	Tmsh generated config file which fails to load for VLAN specific non-default route-domain IPv6
1558857-2	3-Major	BT1558857	Pool command support functionality to be implemented in WS_REQUEST event
1555437-1	3-Major	BT1555437	QUIC virtual server with drop in CLIENT_ACCEPTED crashes TMM
1553169-1	3-Major	BT1553169	Parsing tcp payload using iRules can be inaccurate because of binary to string conversion
1549397-1	3-Major	BT1549397	Pool member from statically-configured node deleted along with ephemeral pool member using same IP address
1538689-1	3-Major	BT1538689	QUIC connections from the Chrome browser does not upgrade to HTTP/3
1505753-2	3-Major	BT1505753	Maximum Fragment Length extension is not visible in ServerHello even though it is present in ClientHello
1505081-1	3-Major	BT1505081	Each device in the HA pair is showing different log messages when a pool member is forced offline
1497633-3	3-Major	BT1497633	TMC incorrectly set /32 mask for virtual-address 0.0.0.0/0 when attached to a VS
1494137-3	3-Major	BT1494137	Translucent mode vlan-group uses wrong MAC when sending ICMP to client
1492769-3	3-Major	BT1492769	SPVA stats-related may cause memory leak
1474877-1	3-Major	BT1474877	Unable to download large files through VIP due RST Compression error.
1440409-4	3-Major	BT1440409	TMM might crash or leak memory with certain logging configurations
1434789	3-Major		Address List containing IP addresses with route domain IDs cannot be assigned as Default Allowedlist in DoS profiles
1411365-2	3-Major	BT1411365	CMP forwarded flows can be removed by other CMP forwarded flows incorrectly
1407949-1	3-Major	BT1407949	iRules using regexp or regsub command with large expression can lead to SIGABRT.
1391081-1	3-Major	BT1391081	TMM crash when running HTTP/3 and persist record
1380009-3	3-Major	BT1380009	TLS 1.3 server-side resumption resulting in TMM crash due to NULL session
1354289	3-Major	BT1354289	NAT64 virtual IP does not translate ICMPv6 to v4 after failover in mirrored connections
1353809-4	3-Major	BT1353809	HTTP/2 erroneously expects the body length to match the Content-Length in response to HEAD request
1344925-3	3-Major	BT1344925	TLS1.3 does not fall back to full handshake when Client Hello is missing the pre_shared_key
1330249-4	3-Major	BT1330249	Fastl4 can queue up too many packets
1325885-1	3-Major	BT1325885	TMM cores on BIG-IP
1316821-1	3-Major	BT1316821	HTTP::disable not allowed after HTTP::respond
1312041-2	3-Major	BT1312041	Connection RST with reason "STREAM max match size exceeded" after upgrading to v16.1.x★
1311053-1	3-Major	BT1311053	Invalid response may be sent to a client when a http compression profile and http analytics profile attached to a virtual server
1309637-1	3-Major	BT1309637	Mac masquerade not working after VLAN movement on host interfaces
1305609-4	3-Major	BT1305609	Missing cluster hearbeart packets in clusterd process and the blades temporarily leave the cluster
1284589-1	3-Major	BT1284589	HTTP CONNECT request from client is not successful with the iRule 'HTTP::disable discard' command
1284413-3	3-Major	BT1284413	After upgrade to 16.1.3.2 from 16.0.1.1, BIG-IP can send CONNECT requests when no proxy select agent is used★
1273161-4	3-Major	BT1273161	Secondary blades are unavailable, clusterd is reporting shutdown, and waiting for other blades
1271341-3	3-Major	BT1271341	Unable to use DTLS without TMM crashing
1231889-4	3-Major	BT1231889	Mismatched VLAN names (or VLANs in non-Common partitions) do not work properly BIG-IP tenants running on r2000 / r4000-series appliances
1215165-2	3-Major	BT1215165	Support added for Microsoft Azure Managed HSM
1205045-6	3-Major	BT1205045	WMI monitor does not put pool members into an offline/unchecked state when BIG-IP receives HTTP responses other than 200
1196505-1	3-Major	BT1196505	BIG-IP might RST HTTP2 connection with [F5RST:mrhttp_proxy bad transition] when ASM is in use.
1190753-2	3-Major	BT1190753	HTTP/2 Virtual Server ignores customized HTTP known-methods list
1189909-2	3-Major	BT1189909	Active SSL Connections Curve is always kept at Zero on Performance Graph
1166481-6	3-Major	BT1166481	The vip-targeting-vip fastL4 may core
1156045-1	3-Major	BT1156045	FastL4's Don't Fragment (DF) flag Clear is not working in all situations
1148181-1	3-Major	BT1148181	SSL TLS1.3 connection terminates with "empty persist key" error when SSL persistence is enabled and session tickets are disabled
1128033-1	3-Major	BT1128033	Neuron client constantly logs errors when TCAM database is full
1127481-1	3-Major		FIPS HSM password length issue
1125381-3	3-Major	BT1125381	Extraneous warnings recorded in when using only intermediate certificates
1121209-3	3-Major	BT1121209	MTU value update on VLAN in tenant launched on r2k and r4k systems needs tmm restart
1110485-5	3-Major	BT1110485	SSL handshake failures with invalid profile error
1091785-6	3-Major	BT1091785	DBDaemon restarts unexpectedly and/or fails to restart under heavy load
1087569-6	3-Major	BT1087569	Changing max header table size according HTTP2 profile value may cause stream/connection to terminate
1086473-6	3-Major	BT1086473	BIG-IP resumes a TLS session on the client-side but then proceeds to do a full handshake
1071385-4	3-Major	BT1071385	SSL session resumption is incorrectly logging handshake failure messages
1070957-5	3-Major	BT1070957	Database monitor log file backups cannot be rotated normally.
1064725-5	3-Major	BT1064725	CHMAN request for tag:19 as failed.
1051153-5	3-Major	BT1051153	DHCP fails intermittently when the connection is through BIG-IP.
1033937-2	3-Major	BT1033937	HTTP message router stats do not increment for virtual servers and pools
1026781-5	3-Major	BT1026781	Standard HTTP monitor send strings have double CRLF appended
1023529-5	3-Major	BT1023529	FastL4 connections with infinite timeout may become immune to manual deletion and remain in memory.
1019641-4	3-Major	BT1019641	SCTP INIT_ACK not forwarded
1017029-7	3-Major	BT1017029	SASP monitor does not identify specific cause of failed SASP Registration attempt
1014633-5	3-Major	BT1014633	Transparent / gateway monitors may fail if there is no route to a node
1012009-4	3-Major	BT1012009	MQTT Message Routing virtual may result in TMM crash
1004445-6	3-Major	BT1004445	Warning not generated when maximum prefix limit is exceeded.
1002969-6	3-Major	BT1002969	Csyncd can consume excessive CPU time★
932553-7	4-Minor	BT932553	An HTTP request is not served when a remote logging server is down
896565-3	4-Minor		Clusterd.peermembertimeout to set peer member timeout does not work all the time
857973-2	4-Minor	BT857973	GUI sets FQDN Pool Member "Auto Populate" value Enabled by default
804089-3	4-Minor	BT804089	iRules LX Streaming Extension dies with Uncaught, unspecified error event
669934-5	4-Minor	BT669934	Session commands may not work correctly in FLOW_INIT event.
603380-10	4-Minor	BT603380	Very large number of log messages in /var/log/ltm with ICMP unreachable packets.
2077357-1	4-Minor	BT2077357	Virtual-wire with proxy listener may generate packets with 00:00:00:00:00:00 source MAC.
2038309-2	4-Minor	BT2038309	After the full config sync, FQDN template node status changes to ‘fqdn-checking’ (Unknown) untill the DNS query is triggered
1964933-1	4-Minor	BT1964933	HTTP2 RST flood detection should allow for legitimate case
1953369-2	4-Minor	BT1953369	DB monitor queries repeatedly if recv string configured but response does not match
1933965-1	4-Minor	BT1933965	Unable to associate multiple cert/keys of different types to Certificate Key Chain via TMSH
1930841-2	4-Minor	BT1930841	Tmsh show sys conn virtual-server may report an incomplete set of flows after a virtual server modification
1926733-2	4-Minor	BT1926733	Tmm memory leak with L7 response policy
1921025-2	4-Minor	BT1921025	Need more information when http2 RST STREAM
1756697-1	4-Minor	BT1756697	Sec-WebSocket-Extensions header is not stripped when Compression is disabled
1670225-1	4-Minor	BT1670225	'Last Error' field remains empty after initial monitor Down status post-reboot
1622425	4-Minor	BT1622425	Float the management ip to the next available ip when the connectivity of primary blade is lost
1617329-3	4-Minor	BT1617329	GTM LDAP may incorrectly mark a pool member as DOWN when chase-referrals is enabled
1601581-3	4-Minor	BT1601581	Virtual-address settings are not restored properly when overlapping NAT policy with proxy-arp is removed.
1589629-3	4-Minor	BT1589629	An ICMPv6 Neighbor Solicitation sent to the last address on an IPv6 subnet is using the wrong Destination MAC address
1567013-1	4-Minor	BT1567013	Pool member stats are not reported for 2 of 10 pool-members in MRF diameter pool
1455781-3	4-Minor	BT1455781	Virtual to virtual SNAT might fail to work after an upgrade.
1366765-1	4-Minor	BT1366765	Monitor SEND string parsing "＼＼r＼＼n"
1350909-1	4-Minor	BT1350909	Statsd error condition is not logged
1341093-1	4-Minor	BT1341093	MCPD returns configuration error when attaching a client SSL profile containing TLS 1.3 to a virtual server with HTTP/2 profile
1329509-3	4-Minor	BT1329509	TCL error 'ERR_VAL (line 1) invoked from within "HTTP::path"'.
1326797-4	4-Minor	BT1326797	The Pool State of an offline pool with one or more user-disabled pool members depends on which pool member was marked down last by its monitor (non-deterministic behaviour)
1322117-4	4-Minor	BT1322117	FastL4 TCP PVA accelerated connection might not be cleared until idle timeout.
1314597-3	4-Minor	BT1314597	Connection on standby may stay until idle timeout when receiving ICMP error
1297521-1	4-Minor		Full sync failure for traffic-matching-criteria with port list update on existing object in certain conditions
1281405-2	4-Minor		"fipsutil fwcheck -f" command may not correct result
1238897-1	4-Minor	BT1238897	TMM TCL interpreter's non-TMM "compat" memcasechr broken in 64-bit build
1225857-3	4-Minor	BT1225857	Virtual server with FastL4 profile may drop connection when receives invalid RST packet from a client
1167609-4	4-Minor	BT1167609	The messages msg->ref > 0 are seen in TMM logs with websockets/ASM plugin
1034865-6	4-Minor	BT1034865	CACHE::enable failed on private/no-store content
1030093	4-Minor	BT1030093	An http2 to http2 virtual connection with translate-address disabled might only use one stream on the server side.
1011889-7	4-Minor		The BIG-IP system does not handle DHCPv6 fragmented traffic properly
1004953-6	4-Minor	BT1004953	HTTP does not fall back to HTTP/1.1★
926085-4	5-Cosmetic	BT926085	In WebUI node or port monitor test is not possible, but it works in TMSH
490139-8	5-Cosmetic	BT490139	Loading iRules from file deletes the last few comment lines

Performance Issues

ID Number	Severity	Links to More Info	Description
1115601-1	2-Critical	BT1115601	VE on VMware with VMXNET3 fails to work with Large Receive Offload (LRO)
911093-1	3-Major	BT911093	Virtual Edition on Hyper-V and Azure does not have SR-IOV support
1972369-2	3-Major	BT1972369	A specific performance improvement
1574521-1	5-Cosmetic	BT1574521	Intermittent high packet latency on R4000 and R2000 tenants

Global Traffic Manager (DNS) Issues

ID Number	Severity	Links to More Info	Description
2044381-2	2-Critical	BT2044381	Gtmd SIGSEGV core due to monitor status change
1821089-2	2-Critical	BT1821089	DNS64 and resolver cache may not function together as expected
1318625-1	2-Critical	BT1318625	The gtm_add sync configuration is in the unintended direction with large GTM configuration
1267845-5	2-Critical	BT1267845	ISC's internal_current function asserted because ifa_name was NULL
994221-8	3-Major	BT994221	ZoneRunner returns error 'Resolver returned no such record'
936777-8	3-Major	BT936777	Old local config is synced to other devices in the sync group.
918693-6	3-Major	BT918693	Wide IP alias validation error during sync or config load
911241-10	3-Major	BT911241	The iqsyncer utility leaks memory for large bigip_gtm.conf file when log.gtm.level is set to debug
862949-5	3-Major	BT862949	ZoneRunner GUI is unable to display CAA records
739553-6	3-Major	BT739553	Setting large number for Wide IP Persistence TTL breaks Wide IP persistence
2014509-1	3-Major	BT2014509	TMM crash while processing DNS RR set record
1970969-2	3-Major	BT1970969	Stale Record Answers counter increments for SERVFAIL responses from DNS resolver cache
1953273-2	3-Major	BT1953273	Big3d high CPU with thousands of https monitors with SNI
1857473-1	3-Major	BT1857473	A BIG-IP monitor may not get removed when changing product type from BIG-IP to Generic Host
1824113-1	3-Major	BT1824113	GTM iRule : [active_members <poolname>] command ignores any status effects applied by a parent.
1824009-2	3-Major	BT1824009	When DNS64 is enabled, resolver cache passes SERVFAIL responses to the client
1782137-1	3-Major	BT1782137	Management of Wide IPs using the GUI may fail when multiple monitors exist
1758985-1	3-Major	BT1758985	Tmm cored at dname_query_hash when out of memory
1757537-1	3-Major	BT1757537	RCA tmm core with ** SIGSEGV ** inside pick_qos
1756389-1	3-Major	BT1756389	CA certs could get deleted from server.crt after running bigip_add
1755441-1	3-Major	BT1755441	The gtm_add is unable to copy named files, a connection timed out error occurs
1754325-1	3-Major	BT1754325	Disabled status from manual resume on a BIG-IP DNS pool can sync to other BIG-IP DNS devices in synchronization-group
1711833-1	3-Major	BT1711833	Distributed Applications can't disable a data center through the GUI
1671545-1	3-Major	BT1671545	BIND no longer follows CNAME to populate A records in the reply
1641421-1	3-Major	BT1641421	Folders in the GTM synchronized group does not have same value as the inherited traffic group
1612201-1	3-Major	BT1612201	Malformed certificates found in local /config/httpd/conf/ssl.crt/server.crt
1606813-1	3-Major	BT1606813	Zone transfer fails for large zones when using TSIG key
1603605-1	3-Major	BT1603605	DNS response is malformed when the response message size reaches 2017 bytes
1602345-1	3-Major	BT1602345	Resource records are not always created when wideips are created in a bundle
1579805-1	3-Major	BT1579805	GTM load balancing decision logs contain truncated pool member details.
1464201-1	3-Major	BT1464201	GTM rule created with wildcard * from GUI results in configuration load error
1379649-1	3-Major	BT1379649	GTM iRule not verifying WideIP type while getting pool from TCL command
1378069-1	3-Major	BT1378069	DNS profile RPS spike every time when there is change in configuration of DNS profile
1328857-1	3-Major	BT1328857	GUI error when accessing hyperlink for associated gtm link object on a virtual server
1281433-1	3-Major	BT1281433	Missing GTM probes on GTM server when an external monitor is attached to an additional pool
1273141-1	3-Major	BT1273141	GTM pool members are not probed and multiple GTMs are reporting inconsistent status
1269601-1	3-Major	BT1269601	Unable to delete monitor while updating DNS virtual server monitor through transaction
1083405-6	3-Major	BT1083405	"Error connecting to named socket" from zrd
1082197-5	3-Major	BT1082197	RNAME and MNAME field order reversed for Synthetic SOAs sent for negative response
1044873-5	3-Major	BT1044873	Deleted GTM link is not removed from virtual server object and causes load failure.
1001101-6	3-Major	BT1001101	Cannot update/display GTM/DNS listener route advertisement correctly
2130329-2	4-Minor	BT2130329	[GTM] Deletion of topology records makes MCPD memory ramp up
1826485-1	4-Minor	BT1826485	Creating a GTM pool in a custom partition with a custom route domain via GUI can fail
1711813-1	4-Minor	BT1711813	Incorrect SOA serial number shown in zxfrd logs during zone transfer
1709845-1	4-Minor	BT1709845	NSEC3 bitmap is not right when allow-nxdomain-override is enabled
1701169	4-Minor	BT1701169	The requested monitor parameter SNI_SERVER_NAME was not found
1642301-3	4-Minor	BT1642301	Loading single large Pulse GeoIP RPM can cause TMM core
1636273-1	4-Minor		In BIND 9.18.28, a new configurable parameter (max-records-per-type) has been introduced with a default limit of 100 to address a security issue.
1468473-1	4-Minor	BT1468473	Statistics for DNS validating resolver not showing properly for Client hits and misses
1014761-5	4-Minor	BT1014761	[DNS][GUI] Not able to enable/disable pool member from pool member property page
1274385-1	5-Cosmetic	BT1274385	BIGIP-DNS GUI delivery summary stats shows incorrect count for "Disabled" GTM listeners

Application Security Manager Issues

ID Number	Severity	Links to More Info	Description
2053893-2	2-Critical	BT2053893	Incompletely-synced ASM configuration can be synced back to the original device or group
1952821-1	2-Critical	BT1952821	WAF guided configuration shows a warning message instead list of available configurations★
1934373-1	2-Critical	BT1934373	DoS attack is blocking while transparent
919917-7	3-Major	BT919917	File permission errors during bot-signature installation
902445-4	3-Major	BT902445	ASM Policy Event Logging stops working after 'No space in shmem' error disconnection mitigation
2017105-1	3-Major	BT2017105	Disk partition /var full after quick config changes★
2008573-2	3-Major	BT2008573	Login/Logout expected/unexpected string has no length validation
1992569-1	3-Major	BT1992569	Request body held despite "do nothing" content profile setting
1976705-2	3-Major	BT1976705	Threat Campaign installation fails due to timeout after an hour
1959709-2	3-Major	BT1959709	"Europe" IPs are allowed despite blocking all European countries
1938101-2	3-Major	BT1938101	Performance issue on specific parameters extractions
1938085-2	3-Major	BT1938085	Performance issue on specific parameters extractions
1856513-1	3-Major	BT1856513	Tomcat fails to write log messages to /usr/share/tomcat/logs/liveupdate.log
1827821-1	3-Major	BT1827821	isBase64 params and headers not blocking Attack Signatures
1824745-1	3-Major	BT1824745	Bd crash and generate core
1814413-1	3-Major	BT1814413	Dynamic parameters are not extracted and cookies are not generated
1813717-1	3-Major	BT1813717	Some blocked requests are not logged when filtered by response status codes
1787645-2	3-Major	BT1787645	BD process fail to startup on specific XML configuration
1772353-1	3-Major	BT1772353	Defaults for Associated Violations are re-added to a policy
1755113-1	3-Major	BT1755113	BD crash with specific JSON schema
1633573-1	3-Major		Active/Active Deployment Leads to DCC corruption due to duplicate sync files
1624625-1	3-Major	BT1624625	L7 policy for bot defense enable without profile name causes issues.
1621405-1	3-Major	BT1621405	Inactive policies are synced and removed
1601517-2	3-Major	BT1601517	BD daemon crash on specific scenario
1596481-2	3-Major	BT1596481	Staged signature IDs and name are not logged in remote logger for websocket traffic
1590085-1	3-Major	BT1590085	DoSL7D ICC errors are observed during higher throughput with DoS profile on Active-Active setup
1589213-2	3-Major	BT1589213	Content signatures are triggered for FileUploads even though check attack signature is disabled
1586877-1	3-Major	BT1586877	Behavior difference in auto-full sync virtual server and manual-incremental config sync
1429813-2	3-Major	BT1429813	ASM introduce huge delay from time to time
1410285-1	3-Major	BT1410285	Genesis bot signature file does not install after upgrade
1377205	3-Major	BT1377205	Content-based routing: Matched XML data being truncated to 1024 bytes
1350485-1	3-Major	BT1350485	When the parameter value contains '@', domain name is not properly extracted
1329557-3	3-Major	BT1329557	The Attack Types and Violations reported in the incident do not match the incident subtype
1324777-2	3-Major	BT1324777	The get_file_from_link in F5::Utils::File should support HTTPS links also when proxy.host DB key is configured
1316621-1	3-Major	BT1316621	Custom headers and cookies are by default configured with base64 decoding enabled
1301081-1	3-Major	BT1301081	Changing partitions top dropdown does not work on chrome/edge on ASM list pages
1280813-3	3-Major	BT1280813	'Illegal URL' violation may trigger after upgrade
1271469-5	3-Major	BT1271469	Failed to install ASU file scheduled for install
1239297	3-Major	BT1239297	TMM URL web scraping limit not synced to secondary slot 2 in VIPRION chassis
1225677-4	3-Major	BT1225677	Challenge Failure Reason is not functioning in ASM remote logging
1167589-1	3-Major		MCPD crashed during ASM stability test execution
1123157-1	3-Major		Single-page application AJAX does not work properly with page's navigation
1069137-7	3-Major	BT1069137	Missing AWAF sync diagnostics
1057557-6	3-Major	BT1057557	Exported policy has greater-than sign '>' not escaped to '>' with response_html_code tag.
1036969-7	3-Major	BT1036969	Chrome sometimes ignores cross-site bot-defense cookies
1017261-8	3-Major	BT1017261	Configuraton update triggers from MCP to ASM are ignored
974409-5	4-Minor		False Positive "Surfing Without Human Interaction"
638863-1	4-Minor	BT638863	Attack Signature Detected Keyword is not masked in the logs
2012801-1	4-Minor	BT2012801	"parser parameters" is enabled even though json schema is attached to the profile
2007429-1	4-Minor	BT2007429	Captcha button label displays in lowercase
1974837-2	4-Minor	BT1974837	MAIN|EROR|dosl7_hold_message:1004|trying to hold message already held
1970193-1	4-Minor	BT1970193	Case WAF policy IP address exception list on GUI: Missing Route Domain ID in the IP address
1966313-1	4-Minor	BT1966313	Websocket event logs show "N/A" for virtual server name except during upgrade request
1966305-1	4-Minor	BT1966305	JSON template-base export fails if the policy has a logout object configured
1933061-2	4-Minor	BT1933061	Changing "bot category" of an user-defined bot-signature should be validated and denied when the change is not appropriate
1900621-1	4-Minor	BT1900621	Missing client ip
1890997-2	4-Minor	BT1890997	TCP connection stall in TMM conn table with ASM policy and no websocket profile
1821353-1	4-Minor	BT1821353	Error on long wildcard configuration
1819617-1	4-Minor	BT1819617	Stalled FPS signature/engine update task causes LiveUpdate and Apply Policy to fail
1782057-1	4-Minor	BT1782057	BD crash related to dns lookup
1691369-1	4-Minor	BT1691369	"Bot Defense Profiles" screen does not display attached virtual servers under user partitions
1679661-3	4-Minor	BT1679661	Log messages in Session Awareness Data Point Sweep
1635829-1	4-Minor	BT1635829	Sint Maarten (SX) and Curacao (CW) are unavailable in Geolocation enforcement and event log filter
1617041-1	4-Minor	BT1617041	Latest installed update missing on secondary device in HA-Pair
1600265-2	4-Minor	BT1600265	Request_status is alerted in remote logging while local logging shows blocked
1591197-1	4-Minor		Specific JSON enforcement is not working
1505257-1	4-Minor	BT1505257	False positive with "illegal base64 value" for Authorization header
1400105-1	4-Minor	BT1400105	Replace policy function fails even though local and imported (JSON format) policies have the same encoding/applicationLanguage
1327245-1	4-Minor		Webhook notification for Apply Policy should be sent only from active devices
1308393-3	4-Minor		Export security policy XML format fail with "too large and cannot be exported" message
1300665-1	4-Minor	BT1300665	ASMCSD memory leak if tsconfd.loglevel is set for debug level
1230833-3	4-Minor		In the signature advanced mode, the Update button is kept disabled even after some changes in the rule
1211437-4	4-Minor	BT1211437	When mobile cookie is too long, Anti-Bot SDK is failing
1210569-1	4-Minor		User defined signature rule disappears when using high ASCII in rule
1210053-3	4-Minor		The cred_stuffing_fail_open Internal Parameter does not cause Leaked Credential violation in case of expiration or error
1135425-3	4-Minor	BT1135425	Created ASM policy does not appear in bigip.conf on the standby
1036289-2	4-Minor	BT1036289	Signature ID not displayed in Attack Signature details
1036221-1	4-Minor	BT1036221	"Illegal parameter value length" is reported with parsing product length.
1980601-2	5-Cosmetic	BT1980601	Number of associated signatures for a signature-set appears zero

Application Visibility and Reporting Issues

ID Number	Severity	Links to More Info	Description
1490125	1-Blocking		When performing failover between two chassis during mixed performance testing, it requires 1-5 minutes for traffic to completely recover.
1932965-2	2-Critical	BT1932965	AVRD may crash at startup due to non-thread-safe version of BOOST json Spirit parser
1848577-1	2-Critical	BT1848577	VCMP guest stats are not visible on vCMP host GUI nor CLI
939933-9	3-Major	BT939933	Monpd restarts every few seconds due to missing of AVR database
1959361-2	3-Major	BT1959361	When running a tenant with more than 72 VCPUs / cores, adminstall crashes
1294141-1	3-Major	BT1294141	ASM Resources Reporting graph displays over 1000% CPU usage
1110373-1	3-Major	BT1110373	Nitrox device error logs in /var/log/ltm
1040477-2	3-Major	BT1040477	Drop-Down menu shows white blank items in Reporting : DoS : URL Latencies
915005-4	4-Minor	BT915005	AVR core files have unclear names
1298225-2	4-Minor	BT1298225	Avrd generates core when dcd becomes unavailable due to some reason
1294905-1	4-Minor		Charts data is not populating in security analytics default view page.
1294113-3	4-Minor	BT1294113	During a DNS attack, summary log shows no attack ID

Access Policy Manager Issues

ID Number	Severity	Links to More Info	Description
945469-1	2-Critical		[APM][tmm core detected oauth_send_response in APM Oauth Token generation
2053549	2-Critical		Removal of conditional freeing cause double free errors
1991297	2-Critical	BT1991297	[APD][SAML-SSO]high memory due to SAML SSO leak
1957157-2	2-Critical	BT1957157	[nlad]OpenSSL: DRBG Continuous RNG test failed: DRBG stuck.
1819857	2-Critical	BT1819857	[APM][PRP] Session variables are not able to access within Oauth Client agent intermittently
1783549-1	2-Critical	BT1783549	TMM crash while accessing the sessionDB
1710805	2-Critical	BT1710805	VPE PRP errors not showing in the GUI and throws an error after reboot
1691385-1	2-Critical	BT1691385	Removed the ability to edit "kerberos_auth_config_default" access policy
1670041	2-Critical		[SWG] VCMP all secondary slots restart when URL categories are modified/deleted
1397001-1	2-Critical	BT1397001	Memory leak in websense when RTU is updated
1325721-4	2-Critical	BT1325721	Oauth not allowed for old tokens after upgrade to 15.1.9
1282769-1	2-Critical		Localdb user can change the password of other user
1207917-1	2-Critical	BT1207917	SSL Orchestrator - NTLM authentication may stop working after a TMM restart or upgrade
1205577-1	2-Critical	BT1205577	The platform_mgr core dumps on token renewal intermittently
976553-2	3-Major	BT976553	Portal Access: Chrome/Edge browser: cookie transport: sync XMLHttpRequests should not be used in onbeforeunload handlers
967185-3	3-Major		Increase the size limit of JWT for OAuth
893801-1	3-Major	BT893801	Launching resources that are published on an APM Webtop from multiple VMware servers will fail when the Native View client is selected
756698-1	3-Major	BT756698	After upgrade, nlad may not create an schannel to a domain controller★
738547	3-Major	BT738547	SAML Sax Parser returns error when importing metadata file that contains certain UTF-8 encoded characters other than ASCII
666845-5	3-Major	K08684622, BT666845	Rewrite plugin can accumulate memory used for patching very large files
634576-4	3-Major	K48181045, BT634576	TMM core in per-request policy
527119-10	3-Major	BT527119	An iframe document body might be null after iframe creation in rewritten document.
2064089	3-Major	BT2064089	APM: UI displays internal server error while updating Network Access (VPN) configuration
2053289	3-Major	BT2053289	Increased OAuth instances in TMM memory
2050177	3-Major		LDAP cache optimisation, required as session establishment, takes more time
2047137-1	3-Major	BT2047137	TMM core may occur while using APM VDI with Blast UDP
2034985-2	3-Major		Unable to forward NTLM SSO back-end cookies to front-end
2034753-1	3-Major	BT2034753	Domain name validation does not align with the error message on GUI
2011297	3-Major		Apmd Core generated during apmd cleanup
1998985	3-Major	BT1998985	Displays "Page Unresponsive" error message when editing AD group resource with large AD group count
1976557-1	3-Major	BT1976557	[APM][OAUTH][LOGGING]Error log needed misconfigured "audience" for apm oauth jwt-config
1968169-1	3-Major	BT1968169	[APM][CitrixIntegration]Apps do not launch unless "Accounts" is selected in Citrix Workspace App
1967261-2	3-Major	BT1967261	RDP Parameter "enablerdsaadauth" when added to RDP setting causes file to be corrupted
1928157	3-Major	BT1928157	[APM][SAML] constant SIGSEGV "in saml_sp_finish_message_signing" after upgrade to 17.1.x★
1917741-1	3-Major	BT1917741	[APM][TMM] memory growth in SAML SP while decoding assertion attributes
1848565-1	3-Major	BT1848565	Error during updating device details: Internal error (Json parser error)
1824629-3	3-Major	BT1824629	[APM] APMd is cored due to Deny agents that are not available
1818949	3-Major	BT1818949	[APM] BIG-IP as OAuth AS sending invalid grant error when refresh token expired.
1797861-1	3-Major	BT1797861	[APM] Portal Access is not working with spread operator (...)
1787909	3-Major	BT1787909	Sys db variable security.configpassword value is changed to not null when ng_export is interrupted
1786421-3	3-Major	BT1786421	Multiple App Tunnels against a layered virtual server using dst port range always hit first dst port
1783137-1	3-Major		Webtop link assignment via "iRule Event" (iRule) failed
1779921-1	3-Major	BT1779921	"Apply Access Policy" Status stays yellow for Access profiles using OAuth agent with "Dynamic Server" enabled during key updates in OAuth auto-discovery
1773213-2	3-Major	BT1773213	OAuth core fail due to buffer overflow
1772317	3-Major	BT1772317	[APM][SAML SP] sp fails authentication with error "SAML assertion is invalid, error: NameID is missing"
1756897-3	3-Major	BT1756897	[APM][PA]Failed to execute 'observe' on 'MutationObserver': parameter 1 is not of type 'Node'
1752873	3-Major	BT1752873	[APM][SAML SP] Order of SAML attribute values saml.last.attr.name is reversed★
1715153-1	3-Major	BT1715153	Log message "The connected network is vulnerable to tunnel crack as LocalIP falls under the public IP"
1710813	3-Major	BT1710813	Tmm error logs related to per-request policies are vague/difficult to understand
1701749	3-Major	BT1701749	APM throws an error when access policy has xsl in the name
1679869	3-Major	BT1679869	[APM][SAML] import IdP metadata with signing/encryption certificate only imports signing cert, not encryption cert
1621949-1	3-Major	BT1621949	[PA]Applications break when specific host is in rewrite control list of rewrite profile
1621317-1	3-Major	BT1621317	Uncaught (in promise) TypeError: Failed to construct 'MouseEvent': Please use the 'new' operator, this DOM object constructor cannot be called as a function.
1617037-1	3-Major	BT1617037	[PA]"navigator.userAgent" detects Chrome browser as Safari
1600229	3-Major	BT1600229	Sometimes, admin is unable to apply policies until failover
1600033	3-Major	BT1600033	Help text contains references to deprecated java tunnels
1593341	3-Major	BT1593341	[PA]Submit button throwing an error "Illegal invocation" in application.
1586405-2	3-Major	BT1586405	"/f5-h-$$/" repeatedly appened to URL's path every refresh of the page
1583701-1	3-Major		Access Policy Export does not write OCSP profile correctly to ng_export.conf
1579525	3-Major	BT1579525	TMM crash when memcached querying samlcryptodata
1576565-3	3-Major	BT1576565	Expect header is not forwarded to pool when PingAccess profile is applied to VS
1566893-1	3-Major	BT1566893	Configuration fails to load while upgrading from BIG-IP 14.0.x to BIG-IP 15.1.x or later★
1562669	3-Major		[APM]Access Policy Export does not write certificate authority profile correctly to ng_export.conf
1554961	3-Major	BT1554961	APM - Websso leeway time of 60 seconds
1495265-1	3-Major	BT1495265	[SAML][IDP] Modifying the Assertion by adding xmlns:xs namespace causes signature failure on SP side
1490977-1	3-Major	BT1490977	Websense URLDB download fails with IPv6 sys DNS
1489941	3-Major		PKCE 'code_challenge_methods_supported" to be included in openid-configuration well-know-uri
1485557-1	3-Major	BT1485557	OAuth token not found for OAuth server with Bearer SSO
1470085-2	3-Major	BT1470085	MDM has wrong links for Microsoft GCC High and DoD environments
1411061-3	3-Major	BT1411061	API Protection rate limiting can cause cores with high traffic
1355109	3-Major	BT1355109	[API Protection] TMM core after adding api-protection profile to VS
1345997-3	3-Major	BT1345997	Very large number of custom URLs in SWG can impact performance.
1327961-2	3-Major	BT1327961	EAM plugin crashes
1327933-2	3-Major	BT1327933	'tmsh show sys ip-address' command throws 'Syntax Error: Invalid IP address' error when address space is added
1296409-3	3-Major	BT1296409	TMM cored in ping access hudfilter due to ctx pointed to invalid address
1290937-1	3-Major		'contentWindow' of a dynamically genereated iframe becomes null
1289009-1	3-Major	BT1289009	PA based Hosted content does not add implicit allowed ACL
1224377-1	3-Major	BT1224377	[APM] Policy sync is not compatible with Network Acesss address spaces
1210025-2	3-Major	BT1210025	Address list discovery task does not trigger apply access policy automatically
1166929-1	3-Major	BT1166929	[AdminUI][Rewrite Profile][PA] Add "*://*" to to rewrite list if an RCL has been entered
1136905	3-Major	BT1136905	Request for Portal Access Hosted Content are RST with "No available SNAT addr"
1074285-3	3-Major	BT1074285	Apmd crashes while handling JWT tokens.
1071021-3	3-Major	BT1071021	Some URLs such as *cdn.onenote.net configured in the Office 365 dynamic address space are not processed by APM
937665-2	4-Minor	BT937665	Relaystate in SLO request results in two Relaystates in SLO Response
869541-4	4-Minor	BT869541	Series of unexpected <aborted> requests to same URL
869121-1	4-Minor	BT869121	Logon Page configured after OAuth client in access policy VPE, get error message Access policy evaluation is already in progress for your current session
800377-2	4-Minor	BT800377	Support for Referrer-Policy: origin to correctly return backend origin in virtual server requests
349706-5	4-Minor		NetworkAccess assigns 1.1.1.1 address to remote ppp endpoint APM VPN
1825249	4-Minor	BT1825249	read_until: end of file
1787701-1	4-Minor	BT1787701	[APM]Customization in German contains French language
1787649-2	4-Minor	BT1787649	Upgrade error "you can include category number <category> only once"★
1712005	4-Minor	BT1712005	Rest Storage does not sync with MCPD OAuth Provider
1634669-1	4-Minor	BT1634669	The CATEGORY::lookup iRule command prioritizes default categories over custom categories.
1578597-2	4-Minor	BT1578597	Religion URL Categories not found on SWG database download
1398961	4-Minor	BT1398961	External IDP Connector Certificate Settings disappears
1350417-2	4-Minor	BT1350417	"Per IP in-progress sessions limit (xxx) exceeded" message occurs before number of "In-Progress session" reaches the limit
1043249-1	4-Minor	BT1043249	Misconfigured CA bundle causes a misleading HTTP error message.

Wan Optimization Manager Issues

ID Number	Severity	Links to More Info	Description
863601-6	2-Critical	BT863601	Panic in TMM due to internal mirroring interactions

Service Provider Issues

ID Number	Severity	Links to More Info	Description
1268373-6	2-Critical	BT1268373	MRF flow tear down can fill up the hudq causing leaks
2077553-2	3-Major	BT2077553	SIP message in quote containing special character after two backslashes will be generate a SIP error message
1977057-2	3-Major	BT1977057	Memory leak when using an iRule to overwrite MR peer route
1971909-2	3-Major	BT1971909	TMM SIGFPE "master shouldn't receive a CMP nexthop" after Clusterd seeing 1 of 2 blades down
1690837-3	3-Major	BT1690837	Invalid username in URL of From or To in SIP ACK should be rejected with 4xx message
1688913-3	3-Major	BT1688913	BIG-IP returns SIP 480 when receiving invalid SIP username
1671917-3	3-Major	BT1671917	The 'received' field is unavailable in SIP VIA header when 'rport' is included in SIP request
1581653-1	3-Major	BT1581653	Unbounded GENERICMESSAGE queue growth
1578637-1	3-Major	BT1578637	TMM may drop MRF messages after a failover.
1474401-1	3-Major		[HA failover resulting in connections on new Active not being maintained via mirroring on Standby]
1249929-2	4-Minor	BT1249929	Diameter MRF sends CER to pool-member even after peer sent DPR and force-offline the pool member

Advanced Firewall Manager Issues

ID Number	Severity	Links to More Info	Description
609878-8	2-Critical	BT609878	Bad ACK Flood is not detected by AFM when loose-init is enabled on the virtual server
2014373	2-Critical	BT2014373	Fix for TMM Core SIGSEGV in spva_gl_ddos_find_tuples Due to NULL Grey List Flood Entry
1974869-1	2-Critical	BT1974869	Unable to load config after upgrading to v17.5.0 with the Syntax Error: "state" may not be specified more than once.★
1786325-2	2-Critical	BT1786325	Nxdomain stop blocking & nxdomain added into the allow list on rSeries
1692049-3	2-Critical	BT1692049	Modifying DOS TScookies impacts existing TCP connections with TCP TStamps enabled
1671149-3	2-Critical	BT1671149	Timestamp cookies may cause issue for PVA-accelerated connections
1410441-1	2-Critical	BT1410441	Large file transfer over SFTP/SSH proxy failure
1360221-4	2-Critical	BT1360221	Unable to view hardware DOS drops through SNMP
997433-1	3-Major	BT997433	When dos.logging interval is greater than 1, the log statistics are not accumulated
935769-6	3-Major	BT935769	Upgrading / Rebooting BIG-IP with huge address-list configuration takes a long time★
926417-4	3-Major	BT926417	AFM not using the proper FQDN address information
2077525-2	3-Major	BT2077525	Incomplete or missing IP Intelligence databases result in connection reset, high TMM CPU usage and/or TMM crash
2064333-1	3-Major		[AFM] v17.5.x, RCA on pccd crash and core
2015973-1	3-Major	BT2015973	Enabling tcp-ak-ts dos vector causes file transfer failure★
2008185-1	3-Major	BT2008185	The vectors threshold mode changes from Fully Automatic to Manual post upgrade★
1969945-1	3-Major	BT1969945	Stats_rate changes along with Detection Threshold for NXDOMAIN DoS vector
1968237-1	3-Major	BT1968237	Configuration fails to load post upgrade due to invalid DoS signature predicate 'ip flags'★
1957977-1	3-Major	BT1957977	Auto-learned DoS Vector attack is detected even with low rate of traffic on HA Pair during Failover★
1943593-1	3-Major	BT1943593	Inconsistent DoS Attack Status between tmctl/event logs and GUI
1934865-2	3-Major	BT1934865	Remove multiple redundant entries for port-list objects in configuration file
1825917-1	3-Major	BT1825917	Dynamic TCAM protocol error
1824097-1	3-Major	BT1824097	ARP is disabled in the virtual server listener when a DOS profile is configured via the Protected Object page
1820489-1	3-Major	BT1820489	Rule list order changes when modifying a rule using Filer Active Rules List
1818861-3	3-Major	BT1818861	Timestamp cookies are not compatible with fastl4 mirroring.
1772397-1	3-Major	BT1772397	FQDN entries in feed list for IP Intelligence is not implemented
1694181	3-Major		Firewall policy fails to match a virtual wire
1670445	3-Major	K000140367, BT1670445	Subsequently attached IPS log profile to a virtual server is not used when IPS is disabled on the firstly attached log profile
1623277-1	3-Major	BT1623277	TCP reset is dropped when AFM is provisioned and a PVA-accelerated flow and the client does not have timestamps enabled.★
1616629-1	3-Major	BT1616629	Memory leaks in SPVA allow list
1573601-4	3-Major	BT1573601	MCP query for fw_rule_stat takes ~23s to complete
1494773	3-Major	BT1494773	DHD (VELOS) - DHD does not load the network Quick Configuration - Virtual wire
1382389	3-Major	BT1382389	QDCOUNT LIMIT DoS vector Not working as expected.
1167969-2	3-Major	BT1167969	In DoS Profile level, the Flood attack Vectors with TCP and UDP, Hardware offloading is not working as expected
1114089-1	3-Major	BT1114089	Frequent SIGSEGV TMM crash/core in AFM FQDN | fw_iptbl_fqdn_ctx_check
926425-7	4-Minor	BT926425	Hardware SYN Cookies may not deactivate after the SYN attack ends and valid TCP traffic starts
2008605	4-Minor	BT2008605	TCP ACK vector does not increase for ACK/SYN packets
1917677-3	4-Minor	BT1917677	"show security ip-intelligence info address" may fail to query legacy IP Reputation database
1880441-1	4-Minor	BT1880441	Security log profile IPI options are visible for configuration in UI but not allowed
1465621-4	4-Minor	BT1465621	Destination and Service fields are empty on virtual server Security policies tab
1404253-1	4-Minor	BT1404253	[NAT-LOGS] PBA Lease Duration suffers from a 32-bit rollover after 50 days
1366269-4	4-Minor	BT1366269	NAT connections might not work properly when subscriber-id is confiured.
1277641	4-Minor		DoS | i-series | After mitigation of bad destination at profile level, bd_hit is not incrementing for host unreachable vector.
1251105-1	4-Minor	BT1251105	DoS Overview (non-HTTP) - A null pointer was passed into a function
1215401-2	4-Minor	BT1215401	Under Shared Objects, some country names are not available to select in the Address List
1162149-3	4-Minor	BT1162149	TCP 3WHS being reset due to "No flow found for ACK" while client have received SYN/ACK
1026965-1	4-Minor	BT1026965	Cannot change logging format from CSV to any other if facility is not LOG_LOCAL0

Policy Enforcement Manager Issues

ID Number	Severity	Links to More Info	Description
1399017-3	2-Critical	BT1399017	PEM iRule commands lead to TMM crash
829653-5	3-Major	BT829653	Memory leak due to session context not freed
2046553-2	3-Major	BT2046553	Memory leak when modifying PEM policies with flow-info-filters
1976001-5	3-Major		PEM::session TCL commands can cause cores
1932161	3-Major	BT1932161	PEM iRule usage memory leak
1584297	3-Major	BT1584297	PEM fastl4 offload with fastl4 leaks memory
1378869-2	3-Major	BT1378869	tmm core assert on pemdb_session_attr_key_deserialize: Session Rule key len is too short
1267269-2	3-Major	BT1267269	The wr_urldbd crashes and generates a core file

Carrier-Grade NAT Issues

ID Number	Severity	Links to More Info	Description
1971641	2-Critical	BT1971641	CGNAT PBA: Negative or incorrect "Active Port Blocks" statistics displayed in fw_lsn_pool_pba_stat
1819721	3-Major	BT1819721	LSN failed events details are ambiguous
1292273-2	3-Major	BT1292273	SNAT command in iRule fails to convert ICMPv6 requests to ICMPv4
1128429-7	4-Minor	BT1128429	Rebooting one or more blades at different times may cause traffic imbalance results High CPU
1016045-5	4-Minor	BT1016045	OOPS logging may appear while active ftp if the port command forces a cmp_redirection and a quit follows.

Fraud Protection Services Issues

ID Number	Severity	Links to More Info	Description
1820785-1	3-Major	BT1820785	[FPS] Payload is not handled on some of the TMM threads

Anomaly Detection Services Issues

ID Number	Severity	Links to More Info	Description
1361041	3-Major		Behavioral L7 DOS cannot learn if 'sys db merged.method' is set to 'slow_merge'

Traffic Classification Engine Issues

ID Number	Severity	Links to More Info	Description
1976429-1	3-Major	BT1976429	Webroot database file updates are failing to apply, preventing the creation of a new version of the database file
1824965	3-Major		Implement iRule support to fetch SNI from SSL, HTTP and QUIC traffic
1820573-1	3-Major	BT1820573	PEM Traffic Classification signatures are classifying the youtube videos with quic enabled as udp.quic instead of udp.quic.youtube.youtube_video.youtube_video_abr on windows using the latest chrome web browser
1604021-2	4-Minor	BT1604021	Using CLI, the creation of urlcat-id TMSH command with values 28671 and 65536 must fail, but it is getting created.
1556845-1	4-Minor	BT1556845	Tmm crash after modifying a virtual server

Device Management Issues

ID Number	Severity	Links to More Info	Description
718796-8	2-Critical	K22162765, BT718796	iControl REST token issue after upgrade★
996129-6	3-Major	BT996129	The /var partition is full as cleanup of files on secondary is not executing
880565-6	3-Major	BT880565	Audit Log: "cmd_data=list cm device recursive" is been generated continuously
563144-4	3-Major	BT563144	Changing the system's admin user causes many errors in the REST framework.
1750397	3-Major	BT1750397	The system reached the maximum wait time for gossip worker to sync-oAuth Discovery failure.
1474125-3	5-Cosmetic	BT1474125	iControl LX extension packages wrongly tagged as "IAPP" when synced to the HA peer unit

iApp Technology Issues

ID Number	Severity	Links to More Info	Description
842193-7	3-Major	BT842193	Scriptd coring while running long-running iApp script
1756521-1	4-Minor	BT1756521	Unable to access iApp Components tab in iApp

Protocol Inspection Issues

ID Number	Severity	Links to More Info	Description
1590517	2-Critical	BT1590517	High CPU utilization when enabling IPS + HTTP/2 Profile
2048001-1	3-Major	BT2048001	Memory leak in icrd_child process
1983029-1	3-Major	BT1983029	IPS Upgrade: err mcpd[5374]: 01070734:3: Configuration error: DB validation exception, unique constraint violation on table★
1967213-1	3-Major	BT1967213	Active contexts accumulate while HTTP is waiting for response
1854461-1	3-Major	BT1854461	Unable to delete file from "Available to Deploy" when removed from "Available to Install"
1824093-1	3-Major	BT1824093	Auto update not working for Protocol inspection
1793573-1	3-Major	BT1793573	Issue with relative matches in snort rules
1787413-1	3-Major	BT1787413	ID7312 matches on nearly all TXT DNS packets
1400337	3-Major	BT1400337	GTP compliances are deprecated after BIG-IP version upgrade
1307385-3	3-Major	BT1307385	When blade replacement happens, signature config is lost in bigip.conf when IM is loading on a new blade
1069977-2	3-Major	BT1069977	Repeated TMM SIGABRT during ips_flow_process_data
2058837	4-Minor	BT2058837	Signatures listening on port 8080 instead of 53
1975945-2	4-Minor	BT1975945	IPS signatures and compliance not loaded until the configuration is saved using tmsh save sys config
1756393	4-Minor	BT1756393	While creating an IPS profile system, the check values change to default values from 'Don't Inspect'
1696757	4-Minor	BT1696757	IPS CEF logging misses some values
1677137	4-Minor	BT1677137	Protocol-Inspection compliance http_non_crlf_line_break is not shown on show running-config

In-tmm monitors Issues

ID Number	Severity	Links to More Info	Description
1481969-1	3-Major	BT1481969	In-tmm monitor marks all pool members down
1019261-5	3-Major	BT1019261	In-TMM HTTPS monitor with SSL Profile set to None does not use serverssl profile.
1002345-5	3-Major	BT1002345	Transparent monitor does not work after upgrade★

SSL Orchestrator Issues

ID Number	Severity	Links to More Info	Description
1927829-2	3-Major	BT1927829	SSL Orchestrator resets connection with connection abort waiting for data from an inline service
1849829-1	3-Major	BT1849829	Deprecation of dnssec-lookaside and dnssec-enable Directives in latest BIND release
1589269-2	3-Major	BT1589269	The maximum value of sys db provision.extramb was reduced from 8192 to 4096 MB★
1934845-2	4-Minor	BT1934845	Transparent proxy loses APM session variables in SSL Orchestrator service
1294709	4-Minor	BT1294709	SSL Orchestrator ICAP service changes do not propagate to the GUI/CLI

Bot Defense Issues

ID Number	Severity	Links to More Info	Description
1820833	3-Major	BT1820833	General Database Error when creating a new profile
2077329-2	4-Minor	BT2077329	IBD profile is injecting the Javascript tag in non html pages

F5OS Messaging Agent Issues

ID Number	Severity	Links to More Info	Description
1758957-1	2-Critical	BT1758957	If two tenants share the same VLAN, TMM may egress broadcast traffic even when VLANs are disabled in F5OS
1623325-4	2-Critical	BT1623325	VLAN groups or VLAN group members may be deleted on F5OS tenant
1586717-2	2-Critical	BT1586717	[F5OS Changes] vlan members fails to populate inside the tenant if vlans attached to interface before deploying the tenant w/ feature from SYSEB-528
1881509-2	3-Major	BT1881509	Platform Agent not logging Trunk changes from F5OS
1714889-1	3-Major	BT1714889	F5OS - BIG-IP Tenant does not display VELOS Chassis slot serial number
1690005	3-Major	BT1690005	Masquerade Mac is not removed when F5OS is rebooted
1611109-1	3-Major	BT1611109	Trunk names exceeding 32 characters results in non-deterministic behavior
1603541-1	3-Major	BT1603541	Platform_agent crashes
1359817-2	3-Major	BT1359817	The setting of DB variable tm.macmasqaddr_per_vlan does not function correctly
1295113-1	3-Major	BT1295113	LACP Mode is always ACTIVE even though it is configured PASSIVE on the Host on R2x00/R4x00/R5x00/R10x00
2008409-2	4-Minor	BT2008409	MAC masquerade does not work on an F5OS tenant if there are no floating self-ips configured on the VLAN
1881537-2	5-Cosmetic	BT1881537	Platform Agent does not log diff of Feature Info Attributes
1280141-1	5-Cosmetic	BT1280141	Platform agent to log license info when received from platform

 

Known Issue details for BIG-IP v17.1.x

997433-1 : When dos.logging interval is greater than 1, the log statistics are not accumulated

Links to More Info: BT997433

Component: Advanced Firewall Manager

Symptoms:
Incorrect DoS statistics may be provide via logs.

Conditions:
DDoS log interval is set to more than 1 second

Impact:
Applications dependent on log provided DoS statistics may be impacted.

Workaround:
Do not change the default log interval value.

---

996129-6 : The /var partition is full as cleanup of files on secondary is not executing

Links to More Info: BT996129

Component: Device Management

Symptoms:
The system does not boot because the /var partition is full.

You see a large number of "storageXXXX.zip" files in /var/config/rest/

Conditions:
This may be observed on multi-blade vCMP guests and hosts, as well as on multi-blade tenants.

Impact:
The partition housing /var/config/ may become 100% full, impacting future disk IO operation and it may cause unexpected traffic disruption.

Workaround:
Important: This workaround is temporary, and may need to be periodically performed either manually or from a script.

Impact of Workaround: While these steps are performed, the BIG-IP REST API will be temporarily inaccessible, and higher disk IO may be seen.

Run the following commands, in sequence:

bigstart stop restjavad
rm -rf /var/config/rest/storage*.zip
rm -rf /var/config/rest/*.tmp
bigstart start restjavad

Manual application of these workaround steps clears the 100% utilized space condition and allows the partition to resume normal operation.

---

995653-1 : Bigtop command is showing inaccurate 'Conn' value for NODE ip:port

Links to More Info: BT995653

Component: TMOS

Symptoms:
In bigtop output, "Conn" value for "NODE ip:port" seen under "bits in prior n seconds" shows the same value as "Conn" value seen under "bits since" and "Total Connections" in show ltm node output.

Conditions:
There were connections established on server-side toward pool member.

Impact:
"Conn" value is not refreshed according to "bits in prior n seconds" interval.

Workaround:
None

---

994361-5 : Updatecheck script hangs/Multiple updatecheck processes

Links to More Info: BT994361

Component: TMOS

Symptoms:
Multiple updatecheck and 'rpm -qf' processes running simultaneously.

Updatecheck is not functional

Conditions:
Updatecheck is run periodically via a cronjob. Updatecheck runs 'rpm -qf' command.

Impact:
Due to that 'rpm -qf' command hangs. This causes multiple updatecheck and 'rpm -qf' processes. High CPU and memory usage.

The most likely explanation is that rpmdb has gotten corrupted.

Workaround:
To rebuild rpmdb:

1. Halt all running updatecheck and 'rpm -qf' processes.

2. Run these commands:
rm /var/lib/rpm/__db*
rpm --rebuilddb

---

994221-8 : ZoneRunner returns error 'Resolver returned no such record'

Links to More Info: BT994221

Component: Global Traffic Manager (DNS)

Symptoms:
ZoneRunner returns error 'Resolver returned no such record'.

Conditions:
When trying to retrieve TXT records with single backslash.

Impact:
Not able to manage TXT record.

Workaround:
Use double backslashes to retrieve TXT records.

---

992113-3 : Page allocation failures on VIPRION B2250 blades

Links to More Info: BT992113

Component: TMOS

Symptoms:
Page allocation failure warnings in kern.log similar to the following example:

kswapd0: page allocation failure: order:2, mode:0x104020

Conditions:
This issue is known to occur on the following VIPRION blade models:

- B2250 (A112)

but its other triggering conditions are not yet understood.

Impact:
The exact impact depends on which process becomes affected and how this process is designed to handle such a failure to allocate memory.

---

991829-5 : Continuous connection refused errors in restjavad

Links to More Info: BT991829

Component: TMOS

Symptoms:
Continuous connection refused errors observed in restjavad.

[com.f5.rest.workers..AsmConfigWorker] nanoTime:[879945045679087] threadId:[63] Exception:[org.apache.thrift.transport.TTransportException: java.net.ConnectException: Connection refused (Connection refused)

[8100/tm/asm/owasp/task OWASPTaskScheduleWorker] Unexpected exception in getting all the polcies: org.apache.thrift.transport.TTransportException: java.net.ConnectException: Connection refused (Connection refused)

Other symptoms include:
- VPN is inaccessible
- GUI is inaccessible, or SSLO GUI does not work
- Excessive CPU, memory utilization

Conditions:
The errors are observed regardless of ASM provisioning.

Impact:
-- This issue causes a noisy log file of restjavad.
-- This issue may cause the restart of restjavad due to out of memory error if the restjavad heap size is very low, such as 192MB.

Workaround:
None

---

988745-8 : On reboot, 'could not find platform object' errors may be seen in /var/log/ltm

Links to More Info: BT988745

Component: TMOS

Symptoms:
During a reboot, several error messages are logged in /var/log/ltm:

-- err mcpd[9401]: 01070710:3: Database error (0), get_platform_obj: could not find platform object - sys/validation/Platform.cpp, line 188.

-- err chmand[6578]: 012a0003:3: hal_mcp_process_error: result_code=0x1070710 for result_operation=eom result_type=eom

Conditions:
This occurs when either of the following conditions is met:
-- A fresh installation of a BIG-IP system.
-- A reboot after forcing the mcpd process to reload the BIG-IP configuration,

Impact:
There is no functional impact to these error messages.

Workaround:
None.

---

979045-5 : The tpm-status-check service shows System Integrity Status: Invalid when Engineering Hotfix installed on certain platforms

Links to More Info: BT979045

Component: TMOS

Symptoms:
After installing an Engineering Hotfix version of BIG-IP v14.1.0 or later, certain BIG-IP hardware systems. The Trusted Platform Module (TPM), status is showing as INVALID.

Conditions:
This may occur:
-- Running BIG-IP v14.1.0 or later.
-- Using Engineering Hotfixes containing fixes for the following bugs:
   - ID893885 (https://cdn.f5.com/product/bugtracker/ID893885.html)
   - ID946745 (https://cdn.f5.com/product/bugtracker/ID946745.html)
   - ID963017 (https://cdn.f5.com/product/bugtracker/ID963017.html)
-- The issue is observed only on the following platforms:
   - i11600 / i11800
   - i11400-DS / i11600-DS / i11800-DS

Impact:
The TPM status INVALID indicates that the system integrity is compromised when it is actually valid.

Workaround:
None.

---

977953-6 : Show running config interface CLI could not fetch the interface info and crashes the imi

Links to More Info: BT977953

Component: TMOS

Symptoms:
The confd command 'show running-config' does not display interface information if nsm and bgpd are the only processes running.

If you run 'show running-config interface', imi crashes.

Conditions:
1. nsm and bgpd are the daemons running.
2. Run the "show running-config" command

Impact:
Imish cannot retrieve interface information from the show running-config command.

Workaround:
* Enable OSPF. For example,

  # tmsh modify /net route-domain 0 routing-protocol add { BGP OSPFv3 }

  # ps -ef | egrep -i ospf
  root 11954 4654 0 11:25 ? S 0:00 ospf6d%0

---

977681-4 : Incorrect error message when changing password using passwd

Links to More Info: BT977681

Component: TMOS

Symptoms:
When using the 'passwd' utility from the command line to change a user password, the error message on why the new password is not accepted is wrong.
Instead of the actual reason why the new password is not accepted, the following message is printed:

"passwd.bin: Have exhausted maximum number of retries for service"

Conditions:
- Using the 'passwd' utility from the command line to change a user password.

- The new password is not accepted according to the configured tmsh auth password-policy.

Impact:
The real reason why the new password is not accepted is masked by the default error message:

"passwd.bin: Have exhausted maximum number of retries for service"

Workaround:
Instead of using the command line 'passwd' utility, change the user password using tmsh.
With tmsh, the real reason why a new password is not accepted is printed accurately:

root@(bigip)(cfg-sync Standalone)(Active)(/Common)(tmos)# modify auth password root
changing password for root
new password: default
confirm password: default
01070366:3: Bad password (root): BAD PASSWORD: it is too simplistic/systematic


Or, when using the 'passwd' utility from the command line, it's still possible to find the actual reason why the new password isn't accepted in the /var/log/ltm log file.

---

976853-1 : SNAT pool traffic-group setting may override non-floating self IP's traffic-group

Links to More Info: BT976853

Component: Local Traffic Manager

Symptoms:
A non-floating self IP fails to respond to ARP on the standby system.

Conditions:
An LTM SNAT translation address has been created which matches a non-floating self IP on the system, and the SNAT is configured in a floating traffic group.

Impact:
A standby device does not respond to ARP requests for floating IP addresses. If a SNAT is configured on the same IP as a non-floating self-ip on the standby, ARP responses will be disabled for that self-ip.

Even after deleting the snat, or configuring it for another IP, ARP response for that self-ip will remain disabled.

The effect of this will be that other IP devices will be unable to communicate with the self-ip after the ARP entry times out.

For example:


-- BIG-IP does not respond to ARP requests for the non-floating self-ip
-- ConfigSync no longer working (if the affected self IP is the ConfigSync address)
-- Health check traffic fails

Note that simply deleting the SNAT translation will not restore service to the self-ip.

Workaround:
Delete the SNAT address, and then move the self-ip back to the non-floating traffic group, and disable and re-enable the arp setting by creating a virtual-address with the same IP in the non-floating traffic-group, and then deleting it.

    tmsh create ltm virtual-address <self-ip> arp enabled traffic-group traffic-group-local-only
    tmsh modify ltm virtual-address <self-ip> arp disabled
    tmsh delete ltm virtual-address <self-ip>

Alternatively, after deleting the SNAT translation, reboot the device (or at least restart tmm). When using this approach on multi-blade chassis devices, all blades need to be restarted.

---

976553-2 : Portal Access: Chrome/Edge browser: cookie transport: sync XMLHttpRequests should not be used in onbeforeunload handlers

Links to More Info: BT976553

Component: Access Policy Manager

Symptoms:
Error message in browser console:

Uncaught DOMException: Failed to execute 'send' on VM41 cache-fm.js:618
'XMLHttpRequest': Failed to load ''https://appportal.omo.nl/private/fm/volatile.html': Synchronous XHR in page dismissal. See https://www.chromestatus.com/feature/4664843055398912 for more details.

Conditions:
Setting and/or getting cookies in onbeforeunload/onunload handlers defined by the web-application.

Impact:
Web-application does not function as expected. Behavior varies, depending on web-application control flow.

Workaround:
Important: This workaround will work until later versions of Chrome and Edge Browser are released. You can refer to the release notes for these browsers to determine when functionality is removed.


Use an iRule to allow sync requests from onbeforeunload, onunload, and other page dismissal events.

This is intended to inject into responses from the BIG-IP virtual server header, Origin-Trial, using a token obtained from the Google Chrome developer console. This token allows for use of synchronous requests in page dismissal events. It should work for Chrome and Microsoft Edge browsers where such sync requests are disabled now.

To obtain the token you need to use the following iRule with your virtual server:

1. Go to the Chrome Origin Trials page:
https://developers.chrome.com/origintrials/#/trials/active.

2. Click the 'REGISTER' button to the right of 'Allow Sync XHR In Page Dismissal'.

3. Enter the origin of your virtual server and other information:
https://domain_of_your_virtual_server.

4. Click REGISTER.

By doing this, you obtain a token to use in place of the token provided in the following iRule.

Note: For additional info about Origin Trials and how they work:
https://github.com/GoogleChrome/OriginTrials/blob/gh-pages/developer-guide.md


when HTTP_RESPONSE_RELEASE {
      HTTP::header insert Origin-Trial Aq5OZcJJR3m8XG+qiSXO4UngI1evq6n8M33U8EBc+G7XOIVzB3hlNq33EuEoXZQEt30Yv2W6YgFelr2aGUkmowQAAABieyJvcmlnaW4iOiJodHRwczovLzEwLjE5Mi4xNTIuMzk6NDQzIiwiZmVhdHVyZSI6IkFsbG93U3luY1hIUkluUGFnZURpc21pc3NhbCIsImV4cGlyeSI6MTU5ODk5NzIyMX0=
}

---

976517-4 : Tmsh run sys failover standby with a device specified but no traffic group fails

Links to More Info: BT976517

Component: TMOS

Symptoms:
The tmsh run /sys failiover standby device <device> command fails and returns an error if no traffic-group is specified:

Syntax Error: There is no failover device with a name (/Common/bigip2.localhost).

Conditions:
Two or more BIG-IPs configured with high availability (HA)

Impact:
You are required to specify all the traffic groups you want to failover to a peer.

Workaround:
For each traffic group that you want to failover to a peer run the tmsh run /sys failover standby.

For example if you want to fail over both traffic groups traffic-group-1 and traffic-group-2 to failover to bigip2.localhost, run the following:

tmsh run /sys failover standby device bigip2.localhost traffic-group traffic-group-1

tmsh run /sys failover standby device bigip2.localhost traffic-group traffic-group-2

If you want the device to be standby for all traffic groups but you don't care what device takes over as active, run the following command (note there is no traffic-group nor device):

tmsh run /sys failover standby

---

975657-2 : With HTTP2 enabled, only partial sorry contents (< 32KB) can be sent to the client via HTTP::respond

Component: Local Traffic Manager

Symptoms:
Partial content (<= max allowed "write-size" in HTTP2 profile i.e. 32KB) can be sent to client via the HTTP:respond iRule command.

Conditions:
-- HTTP2 enabled on virtual server
-- Content sent by the iRule exceeds 32KB

Impact:
Client fails to receive the whole content

---

974409-5 : False Positive "Surfing Without Human Interaction"

Component: Application Security Manager

Symptoms:
When using Bot Defense profile, and an application contains many HTML pages which are not qualified (not even accept: text/html), a "Surfing Without Human Interaction" anomaly is mis-counted and falsely raised.

Conditions:
-- Bot Defense Profile is attached to a virtual server.
-- The application contains many HTML pages which can be detected as such from the request.

Impact:
Real clients might or might not be blocked, it depends on the environment.

Workaround:
None.

---

969737-4 : Snmp requests not answered if V2 traps are configured

Links to More Info: BT969737

Component: TMOS

Symptoms:
SNMP requests are not answered except the ones sent to the localhost ip address.

Conditions:
V2 traps are configured, for example:

tmsh modify sys snmp v2-traps add { ...

Impact:
SNMP external requests fail

Workaround:
Move all traps configured under 'v2-traps' to 'traps' in the configuration

---

967769-3 : During reset of high-speed interfaces, TMMs may mistakenly continue hardware watchdog checks

Links to More Info: BT967769

Component: TMOS

Symptoms:
Tmm crashes and restarts. The following panic message is found in /var/log/tmm:

    notice panic: ../dev/hsb/if_hsb.c:6129: Assertion "HSB lockup, see ltm and tmm log files" failed.

Conditions:
-- Some error or glitch is detected on the high-speed bus (HSB).
-- Software commands a reset of the HSB and interface hardware.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

---

967353-8 : HTTP proxy should trim spaces between a header field-name and colon in its downstream responses.

Links to More Info: BT967353

Component: Local Traffic Manager

Symptoms:
Client receives no response along with a connection reset by the BIG-IP system.

Conditions:
-- HTTP profile is enabled on the BIG-IP system.
-- Server sends HTTP response with one or more header field names separated with the trailing colon by a space.

Impact:
HTTP responses that should be delivered to the client by the proxy are not being sent out.

Workaround:
None

---

967185-3 : Increase the size limit of JWT for OAuth

Component: Access Policy Manager

Symptoms:
The allowed payload size for JWT is 4K. Users whose claims of length exceed the limit are unable to authenticate.

Conditions:
OAuth is configured with JWT.

Impact:
Users whose claims of length are more than the limit are unable to authenticate.

Workaround:
None

---

963393-4 : Key handle 0 is treated as invalid for NetHSM devices

Links to More Info: BT963393

Component: Local Traffic Manager

Symptoms:
HTTPS pool members are marked down when they are up.

Conditions:
-- SafeNet HSM configured
-- HTTPS monitor uses the safenet keys
-- The key handle generated by the HSM is 0

Impact:
Pool members are marked down because bigd cannot connect to the pool member using the Safenet HSM key.

Workaround:
Use in-TMM monitors as an alternative to bigd monitors.

---

962729-5 : New User automatically unlocked when "Automatically enable locked-out users after" is not configured

Links to More Info: BT962729

Component: TMOS

Symptoms:
"Automatically enable locked-out users after" option takes effect even if it is not configured.

Conditions:
- There is a locked-out user in the BIG-IP system
- The option "Automatically enable locked-out users after" is not selected but there is a value present in it, the value being other than 0

Impact:
Locked-out users are automatically enabled to log-in even when the "Automatically enable locked-out user" option is not selected

Workaround:
In GUI:
Set 'Automatically enable locked-out users after X seconds' duration to 0 if the 'Manually enable locked-out user' feature is enabled.
In TMSH:
Set db variable password.unlock_time to 0 if systemauth.disablemanualunlock is false.

---

962477-5 : REST calls that modify GTM objects as a user other than admin may take longer than expected

Links to More Info: BT962477

Component: TMOS

Symptoms:
After performing a REST call to modify a GTM object, subsequent requests may take longer than expected to complete. Delays of 800-1000ms are possible for a brief time after a GTM object is modified.

Conditions:
Modifying a GTM object with a user other than "admin". When a device is part of a GTM sync group.

Impact:
Slower than expected REST performance. Scripts that perform a series of modifications and subsequent queries could be heavily impacted.

Workaround:
Use the admin account or use transactions.

---

959057-6 : Unable to create additional login tokens for the default admin user account

Links to More Info: BT959057

Component: TMOS

Symptoms:
When remote user authentication is configured, BIG-IP systems apply maximum active login token limitation of 100 to the default admin user account.

Conditions:
Remote Authentication is configured

Impact:
Unable to create more than 100 tokens for admin when remote authentication is configured

---

958601-5 : In the GUI, searching for virtual server addresses does not match address lists

Links to More Info: BT958601

Component: TMOS

Symptoms:
In the GUI, if you filter the virtual server listing using an IP address, or part of an IP address, if there are any virtual servers that are using an address list that contains an address that matches that search string, those virtual servers will not show up in the search results.

Similarly, if you filter the virtual server listing using an IP address, or part of an IP address, if there are any virtual servers that are using an address that matches the search string, but are using a port list, those virtual servers will not show up in the search results.

Conditions:
-- Using Address Lists or Port lists with a virtual server.
-- Using the GUI to search for virtual servers based on address.

Impact:
Virtual servers that should match a search are not found.

Workaround:
None.

---

945469-1 : [APM][tmm core detected oauth_send_response in APM Oauth Token generation

Component: Access Policy Manager

Symptoms:
Tmm crashes while passing APM traffic.

Conditions:
OAuth is configured and is used for Token generation.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

---

945413-6 : Loop between keymgmtd and mcpd causes BIG-IP to be out of sync or in constant automatic config sync

Links to More Info: BT945413

Component: TMOS

Symptoms:
The BIG-IP system constantly downloads the certificate bundle if the CA-bundle manager config includes a URL.

Symptoms are different depending on if BIG-IP systems is in a manual or automatic sync device group.

Manual sync device groups will not stay in sync.

Automatic sync device groups will constantly sync.

Conditions:
The CA-bundle manager is configured.

Impact:
The keymgmtd and mcpd process gets into a loop that causes constant config changes and if the ca-bundle-manager includes a URL, the BIG-IP system constantly downloads the bundle.

Workaround:
The ca-bundle manager should be configured without the update-interval(i.e. update-interval value set to 0) and while updating set the update-now to YES

For config sync between peers
1.If the config sync type is set to manual full/incremental
Then manually sync the devices either in GUI or TMSH

2.If the config sync type is set to Automatic
Then bundle manager will be synced without any manual intervention

---

939933-9 : Monpd restarts every few seconds due to missing of AVR database

Links to More Info: BT939933

Component: Application Visibility and Reporting

Symptoms:
Monpd reports that it is constantly restarting. A message similar to the following will appear at the console:

logger[2849]: Re-starting monpd

Conditions:
- There is a provisioned module that requires monpd
- Another module is de-provisioned which wipes the mysql database.
- May occur after an upgrade.

Impact:
Modules that rely on monpd will not be fully functioning.

Workaround:
Clearing AVR database will remove all existing statistics data.

1. Stop monpd: bigstart stop monpd
2. Clean data base: touch /var/avr/init_avrdb
3. Clean the statistics file are waiting to be loaded:
   cd /var/avr/loader
   rm -rf *
4. Start monpd: bigstart start monpd

---

939517-6 : DB variable scheduler.minsleepduration.ltm changes to default value after reboot

Links to More Info: BT939517

Component: TMOS

Symptoms:
Running the command 'tmsh list /sys db scheduler.minsleepduration.ltm'
shows that the value is -1.

The db variable 'scheduler.minsleepduration.ltm' is set to -1 on mcpd startup.

This overwrites a custom value.

Conditions:
-- The db variable 'scheduler.minsleepduration.ltm' has a non-default value set.
-- A reboot occurs.

Impact:
The db variable 'scheduler.minsleepduration.ltm' reverts to the default value. When the db variable reverts to the default value of unset -1, tmm may use either more or less CPU cycles when idle depending on whether the original DB variable value is bigger or less than the default value.

Workaround:
None

---

937665-2 : Relaystate in SLO request results in two Relaystates in SLO Response

Links to More Info: BT937665

Component: Access Policy Manager

Symptoms:
When BIG-IP APM acts as the SAML IdP and receives a redirect binding single logout (SLO) request that contains a relaystate, the BIG-IP APM generates an SLO response that contains two relaystates.

Conditions:
-- BIG-IP APM configured as IdP
-- Redirect binding SLO request contains a relaystate

Impact:
SLO processing on SP may not work.

Workaround:
None.

---

937573-5 : Connections drop in virtual server with Immediate Action On Service Down set to Drop

Links to More Info: BT937573

Component: Local Traffic Manager

Symptoms:
In a virtual server configured with Immediate Action On Service Down set to Drop and an iRule to pick a pool different from the one attached to the virtual server, if the default pool is attached in an offline state, connections are always dropped even when the default pool becomes available later.

Conditions:
- Virtual server configured with Immediate Action On Service Down set to Drop.
- An iRule selects a different pool from the one attached to the virtual server.

Impact:
Connections are silently dropped.

Workaround:
Change the virtual server's Immediate Action On Service Down setting to None.

---

936777-8 : Old local config is synced to other devices in the sync group.

Links to More Info: BT936777

Component: Global Traffic Manager (DNS)

Symptoms:
Newly added DNS/GTM device may sync old local config to other devices in the sync group.

Conditions:
Newly added DNS/GTM device has a more recent change than other devices in the sync group.

Impact:
Config on other DNS/GTM devices in the sync group are lost.

Workaround:
You can use either of the following workarounds:

-- Make a small DNS/GTM configuration change before adding new devices to the sync group.

-- Make a small DNS/GTM configuration change on the newly added device to re-sync the correct config to other DNS/GTM devices.

---

935769-6 : Upgrading / Rebooting BIG-IP with huge address-list configuration takes a long time★

Links to More Info: BT935769

Component: Advanced Firewall Manager

Symptoms:
Version upgrade takes more time than usual when the config contains address-lists with a lot of IP addresses. The same delay will be observed with 'tmsh load sys config' as well.

Conditions:
-- Configure address-list with 10K to 20K IP addresses or address ranges or subnets.
-- Configuration loading (e.g. Post upgrade, running tmsh load sys config, modification of the configuration and subsequent full load as in full config sync)

Impact:
Version upgrade / 'tmsh load sys config' process takes a long time than usual.

Workaround:
1) Convert continuous individual addresses in the address-lists to IP address ranges and subnets if possible.

2) Remove the huge address-lists from config before the upgrade and add back after the upgrade process is finished.

3) Upgrading to a release or EHF that contains the fix for 1209409. 1209409 does not eliminate the issue but it does reduce the time it takes to validate certain address lists.

---

935633-2 : VCMP guests or F5OS tenants may experience constant clusterd restart after host upgrade★

Links to More Info: BT935633

Component: TMOS

Symptoms:
Sometimes, when vCMP guests or F5OS tenants are started after the host has been upgraded, the guests or tenants may enter an unhealthy state due to clusterd constantly restarting.

Conditions:
-- vCMP guest or F5OS tenant has Mirroring IP configured.
-- vCMP guest or F5OS tenant is powered on after vCMP host upgrade.
-- vCMP guest or F5OS tenant is powered on and receives a new license file from the host during startup.

Impact:
-- This issue might prevent the guest or tenant from servicing traffic if the system fails to load the config and clusterd keeps restarting.
-- During startup of the guest or tenant, the following message is logged to /var/log/ltm:

 err mcpd[6519]: 0107146f:3: Self-device state mirroring address cannot reference the non-existent Self IP ([IP address]); Create it in the /Common folder first.

-- /var/log/ltm shows clusterd constantly restarting.
-- One or more slots are in INOPERATIVE state, while the host shows slots as RUN/Healthy.

Workaround:
-- To avoid the issue before it occurs:
1. Prior to shutting down vCMP guests or F5OS tenants before host upgrade, ensure guests or tenants have free space in the /var partition.
2. Ensure any license updates (e.g., reactivation) are applied before shutting down the vCMP guest or F5OS tenant.
3. Issue 'tmsh save sys config' on the vCMP guest or F5OS tenant.
4. Issue 'ls /var/db/mcp*' and confirm the presence of mcpdb.bin and mcpdb.info in the /var/db directory.
5. Proceed with vCMP guest or F5OS tenant shutdown and host upgrade as per standard F5 recommended process.


-- To mitigate after the issue has been experienced on a vCMP guest or F5OS tenant:
1. Set the vCMP guest or F5OS tenant to the Configured state and wait for it to complete transition to Configured.
2. Set vCMP guest or F5OS tenant to Deployed state.
3. Review startup logs and confirm 'Self-device state mirroring address cannot reference the non-existent Self IP' message is no longer present.
4. Review /var/log/ltm and confirm clusterd is no longer restarting.
5. If issue persists, delete and recreate the vCMP guest or F5OS tenant.

---

932553-7 : An HTTP request is not served when a remote logging server is down

Links to More Info: BT932553

Component: Local Traffic Manager

Symptoms:
BIG-IP systems provide an option to sanitize HTTP traffic via the http_security profile. When the profile is configured to alarm on a violation, it is possible that a connection to the violating client is reset if a remote logging server is marked down.

Conditions:
-- A BIG-IP system has an HTTP profile and and an http_security profile with the alarm option set.
-- A remote logging server is configured via a BIG-IP pool.
-- The pool has a monitor that marks all the pool members down.
-- A request with an HTTP violation is processed and triggers an alarm configured in the http_security profile.

Impact:
-- A TCP connection to a client is reset by the BIG-IP system.
-- The web page may not render, or may not render as expected.
-- Data are not delivered to a server with a POST request.

Workaround:
None.

---

931629-6 : External trunk fdb entries might end up with internal MAC addresses.

Links to More Info: BT931629

Component: TMOS

Symptoms:
The vCMP host might have external trunk with internal MAC addresses. This is visible via 'tmsh show net fdb'.

Conditions:
-- vCMP is provisioned and has guests deployed on it.
-- vCMP host uses trunks.
-- Create VLANs using trunks and assign it to guests.
-- Guests need to be in high availability (HA) configuration.

Impact:
Traffic processing is disrupted.

Workaround:
None.

---

929173-6 : Watchdog reset due to CPU stall detected by rcu_sched

Links to More Info: BT929173

Component: TMOS

Symptoms:
Rcu_sched detected CPU stall, which can cause vCMP host reboot. The device reboots without core and records "Host Watchdog timeout."

Typically there will logs in kern.log similar to:
err kernel: : [526684.876928] INFO: rcu_sched detected stalls on CPUs/tasks: ...

Conditions:
Host undergoing a watchdog reset in a vCMP environment.

Impact:
CPU RCU stalls and host watchdog reboots

---

928445-10 : HTTPS monitor is down when server_ssl profile cipher string is configured to TLSv1_2

Links to More Info: BT928445

Component: Local Traffic Manager

Symptoms:
HTTPS monitor is down when the Server SSL profile associated with the monitor utilises a cipher string containing a keyword such as '!TLSv1_1' or '!TLSv1_2' to disable TLS protocol version.

A configured cipher string, such as TLSv1_2 or TLSv1_1 is rejected by OpenSSL.

Conditions:
-- Pool member is attached to the HTTPS monitor.
-- HTTPS monitor is configured with a Server SSL profile.
-- Server SSL profile is configured with cipher string containing a keyword such as '!TLSv1_2' and/or '!TLSv1_1' to disable TLS protocol version.

Impact:
Pool status is down.

Workaround:
-- Enable 'in-tmm' monitoring.
-- Use the 'Options List' setting available in the Server SSL profile to disable TLS protocol version instead of cipher string.
-- Use the same cipher string with cipher group / cipher rule that is attached to the SSL profile.

---

928389-7 : GUI becomes inaccessible after importing certificate under import type 'certificate'

Links to More Info: BT928389

Component: TMOS

Symptoms:
After importing a new certificate, httpd goes down and the GUI becomes inaccessible.

Conditions:
Upload new certificate using Import-type 'Certificate' option.

Impact:
The GUI is inaccessible as soon as you import a new device certificate using import-type 'Certificate'.

Workaround:
Manually copy the matching key to /config/httpd/conf/ssl.key/server.key and restart apache (bigstart restart httpd)

If you do not have the matching key, generate a new key/cert pair from the command line by following K9114

---

926425-7 : Hardware SYN Cookies may not deactivate after the SYN attack ends and valid TCP traffic starts

Links to More Info: BT926425

Component: Advanced Firewall Manager

Symptoms:
Hardware SYN Cookies activated on a virtual server under a SYN attack may not deactivate after the SYN attack ends and valid TCP traffic starts. The non-supported TCP options under SYN Cookie protection continue to be unsupported until hardware SYN cookies are disabled.

Conditions:
SYN Cookie activated on Neuron-capable platforms:
  + VIPRION B4450N blade
  + BIG-IP iSeries devices (ix800) except the i850, ix2800, and ix4800:
     -- BIG-IP i5800 Series
     -- BIG-IP i7800 Series
     -- BIG-IP i11800 Series
     -- BIG-IP i15800 Series

Impact:
This can successfully cause hardware SYN cookies to be activated on the BIG-IP virtual server under attack. However, once the attack subsides and falls below the SYN check threshold, SYN cookies may not immediately deactivate.

Because SYN cookie protection is still active, and because under SYN cookie protection some TCP options are not supported, the options are not taken into account when processing traffic. For example, under SYN cookie protection, MSS is fixed to a few sizes. For traffic that arrives with a different MSS size, the system uses a supported size instead.

Workaround:
You can use any of the following to clear the HSB issue:
-- Restart neurond.
-- Restart TMM,
-- Reboot the device.

---

926417-4 : AFM not using the proper FQDN address information

Links to More Info: BT926417

Component: Advanced Firewall Manager

Symptoms:
Duplicate resolved entries in FQDN address-lists may cause FQDN to use incorrect address information until the next FQDN reload.

Conditions:
Any two FQDN address-lists having entries which DNS resolves to the same IP address present in the configuration, at any point since the last TMM restart/FQDN load.

Impact:
Even after one of the duplicate entries is removed, AFM does not use proper FQDN address information.

Workaround:
Remove the problematic rule and recreate the same rule again
or Remove one of the duplicate addresses, and run "tmsh load security firewall fqdn-entity all" command,
or restart TMM.

---

926085-4 : In WebUI node or port monitor test is not possible, but it works in TMSH

Links to More Info: BT926085

Component: Local Traffic Manager

Symptoms:
When attempting to test a newly created Pool Member monitor, node address field is disabled, you cannot enter a node address. This prevents from using the Test operation to test this type of monitor in the WebUI.

Conditions:
-- Create a new Pool Member monitor (not a Node Address monitor). For example, HTTP, HTTPS, FTP, TCP, or Gateway ICMP.
-- With the monitor configuration displayed in the WebUI, click the Test tab.
-- View the Address field, and try to run the test.

Impact:
The Address field is disabled, with *.* in the field. You cannot enter a node address. The test fails with following message:

invalid monitor destination of *.*:80.
invalid monitor destination of *.*:443. (:port used to test)

Workaround:
Run either of the following TMSH commands:

-- tmsh run ltm monitor <type> <name> destination <IP address>:<port>
-- tmsh modify ltm monitor <type> <name> destination *:*

For example, for HTTP:
-- tmsh run ltm monitor http my_http destination <IP address>:<port>
-- tmsh modify ltm monitor http my_http destination *:*

For example, for HTTPS:
-- tmsh run ltm monitor https my_https destination <IP address>:<port>
-- tmsh modify ltm monitor https my_https destination *:*

---

923745-7 : Ctrl-Alt-Delete in virtual console reboots BIG-IP Virtual Edition

Links to More Info: BT923745

Component: TMOS

Symptoms:
A device reboot occurs upon sending a Ctrl-Alt-Del signal to the console of a BIG-IP Virtual Edition (VE) virtual machine.

Conditions:
This occurs when pressing Ctrl-Alt-Del or sending the command to a BIG-IP Virtual Edition (VE) virtual console.
This signal may be sent in different ways according to the interface used to connect to the console of the BIG-IP virtual machine.

Impact:
Accidental reboots of the BIG-IP VE instance are possible. You should not reboot a BIG-IP VE instance using Ctrl-Alt-Del.

Workaround:
To disallow the effect of this key chord, run the following command from the advanced shell (bash):

systemctl mask ctrl-alt-del.target

---

922053-3 : inaccurate number of trunk members reported by bcm56xxd/bcmLINK

Links to More Info: BT922053

Component: TMOS

Symptoms:
The "bcmLINK" process (sometimes referred to as "bcm56xxd") may fail with a segmentation fault and be restarted, leaving behind a core-dump file for "bcmLINK".

An error message may be logged about the condition "max_mbrs > 0".

Conditions:
-- occurs in multi-blade VIPRION system with trunked interfaces
-- precise trigger is not known

Impact:
Momentary disruption of traffic handling by TMM.

Workaround:
None known.

---

921069-4 : Neurond cores while adding or deleting rules

Links to More Info: BT921069

Component: TMOS

Symptoms:
Neurond cores if it receives error while adding or deleting rules in neuron hardware.

Conditions:
Adding or deleting rules in neuron hardware

Impact:
Neurond cores

Workaround:
None

---

919917-7 : File permission errors during bot-signature installation

Links to More Info: BT919917

Component: Application Security Manager

Symptoms:
When you install Bot-Sig IM file through LU, /var/log/ltm shows file permission errors.

Cannot open lock file (/var/run/config_lock), permission denied.

Cannot open command history file (/root/.tmsh-history-root), Permission denied : framework/CmdHistoryFile.cpp, line 92.

Conditions:
Installing bot-signature.

Impact:
If the BIG-IP device is rebooted, or the mcpd process is restarted, following an automatic bot-signature installation, without the config first being saved, the bot-signature installation will be reverted.

Workaround:
Save the BIG-IP configuration manually after the automatic bot-signature update has completed.

---

918693-6 : Wide IP alias validation error during sync or config load

Links to More Info: BT918693

Component: Global Traffic Manager (DNS)

Symptoms:
DB validation exception occurs during GTM config sync or config load:

01070734:3: Configuration error: DB validation exception, unique constraint violation on table (gtm_wideip_alias) object ID (1 /Common/alias.test.com www.test.com). A duplicate value was received for a non-primary key unique index field. DB exception text (Cannot update_indexes/checkpoint DB object, class:gtm_wideip_alias status:13)
Unexpected Error: Loading configuration process failed.

Conditions:
-- A wideip alias is moved from one wideip to another
-- GTM sync occurs, or a gtm config is loaded manually.

This issue can occur any time a GTM config is loaded or synchronised where the new configuration has a wideip with an alias, which is already configured on a different wideip in the existing in-memory GTM configuration.

Impact:
You are unable to load config or full sync from peer GNS/GTM.

Workaround:
Follow this procedure:
1. Delete the wide IP alias on the destination device.
2. Try the sync or load config operation again.

---

916553 : Certificate details are not added correctly to BIG-IP after license is assigned from BIG-IQ due to which IPS auto update fails on BIG IP

Links to More Info: BT916553

Component: TMOS

Symptoms:
After a license is assigned from BIG-IQ the f5_api_com.crt information is not added when the data is received in the license file.

Conditions:
The license is installed from BIG-IQ and the license text contains the f5_api_com.crt information.

Impact:
IPS auto update does not work

Workaround:
None

---

915557-7 : The pool statistics GUI page fails (General database error retrieving information.) when filtering on pool status.

Links to More Info: BT915557

Component: TMOS

Symptoms:
When using the pool statistics GUI page, the page stops displaying and the GUI shows the following error:

General database error retrieving information.

Conditions:
You attempt to apply a Status filter (e.g., Available) to display only some pools.

Impact:
The Status filter is not usable. Additionally, the page continues not to display even after you navigate away from the page and later return to it.

Workaround:
There is no workaround to prevent the issue, but if you wish to access that page again (and not use the Status filter), you can do so by clearing your browser's cache.

---

915493-7 : imish command hangs when ospfd is enabled

Links to More Info: BT915493

Component: TMOS

Symptoms:
Running the imish command hangs when ospfd is enabled.

Conditions:
-- Dynamic routing enabled.
-- The ospfd protocol is enabled.
-- Running the imish command.

Impact:
The imish operation hangs.

Workaround:
Restart the ospfd daemon.

---

915005-4 : AVR core files have unclear names

Links to More Info: BT915005

Component: Application Visibility and Reporting

Symptoms:
If avrd fails a core file created in this case is named according to the thread name and has no indication that it belongs to avr, for example: SENDER_HTTPS.bld0.0.9.core.gz

Conditions:
Avrd fails with a core

Impact:
It is inconvenient for identifying the process that caused the core.

---

912293-7 : Persistence might not work properly on virtual servers that utilize address lists★

Links to More Info: BT912293

Component: Local Traffic Manager

Symptoms:
-- Connections to the virtual server might hang.
-- Increased tmm CPU utilization. This can occur after upgrading.

Conditions:
-- A virtual server is configured with a traffic-matching-criteria that utilizes a source-address-list and/or destination-address-list.

-- The virtual server utilizes certain persistence one of the following persistence types:
  + Source Address (but not hash-algorithm carp)
  + Destination Address (but not hash-algorithm carp)
  + Universal
  + Cookie (only cookie hash)
  + Host
  + SSL session
  + SIP
  + Hash (but not hash-algorithm carp)

Impact:
-- High tmm CPU utilization.
-- Stalled connections.

Workaround:
Enable match-across-virtuals in the persistence profile.

Note: Enabling match-across-virtuals might affect the behaviour of other virtual servers in the configuration that utilise persistence.

---

911241-10 : The iqsyncer utility leaks memory for large bigip_gtm.conf file when log.gtm.level is set to debug

Links to More Info: BT911241

Component: Global Traffic Manager (DNS)

Symptoms:
The iqsyncer utility leaks memory.

Conditions:
-- There is a large bigip_gtm.conf.
-- The log.gtm.level is set to debug.

Impact:
The iqsyncer utility exhausts memory and is killed.

Workaround:
Do not set log.gtm.level equal to or higher than debug.

---

911093-1 : Virtual Edition on Hyper-V and Azure does not have SR-IOV support

Links to More Info: BT911093

Component: Performance

Symptoms:
Hyper-V Standalone and Azure utilizes the sock driver and has no support for underlying VMBUS devices nor SR-IOV, which degrades system performance.

Conditions:
BIG-IP VE is deployed in Hyper-V standalone or Azure environment using Mellanox Connect-X 5 NICs with accelerated networking switched on for the NICs.

Impact:
- There is a lack of targeted driver support for VMBUS devices which leads to lack of high performance.

Workaround:
None

---

910645-3 : Upgrade error 'Parsing default XML files. Failed to parse xml file'★

Links to More Info: BT910645

Component: TMOS

Symptoms:
After upgrading BIG-IP APM, multiple error messages appear in /var/log/ltm:

-- err mcpd[5352]: 010713cf:3: Parsing default XML files. Failed to parse xml file (/var/sam/www/client/customization-source/Common/modern/secure_access_client/default_secure_access_client.xml) because Failed to stat file (/var/sam/www/client/customization-source/Common/modern/secure_access_client/default_secure_access_client.xml) errno(2) strerror(No such file or directory)
-- err mcpd[5352]: 010713cf:3: Parsing default XML files. Failed to parse xml file (/var/sam/www/client/customization-source/Common/modern/resource_app_tunnel/default_resource_app_tunnel.xml) because Failed to stat file (/var/sam/www/client/customization-source/Common/modern/resource_app_tunnel/default_resource_app_tunnel.xml) errno(2) strerror(No such file or directory)

Conditions:
-- APM configuration.
-- Upgrade the BIG-IP system to v15.1.0 or newer.

Impact:
These are benign messages that do not indicate a functional issue. There is no impact; the system works correctly.

The errors occur when the upgraded BIG-IP APM configuration attempts to load resource definitions for the modern customization schema. However, by design, the modern customization schema does not define resources. Only the standard customization schema defines resources found under '/var/sam/www/client/customization-source/Common/standard/'.

Workaround:
None.

---

908453-7 : Trunks with names longer than 32 characters update working-mbr-count in vCMP guests incorrectly

Links to More Info: BT908453

Component: TMOS

Symptoms:
When a trunk is configured with a name longer than 32 characters on a vCMP host, guests update the working-mbr-count for the trunk incorrectly when another trunk on the host changes. This might result in vCMP guests failing over unexpectedly.

Conditions:
-- Trunk configured with a name longer than 32 characters on vCMP host.
-- Trunk made available to guests for high availability (HA) Group scoring.
-- At least one other trunk configured on vCMP host.
-- Interface state changes in any other trunk.

Impact:
The vCMP guests may fail over unexpectedly.

Workaround:
Do not use trunk names longer than 32 characters.

---

905477-7 : The sdmd daemon cores during config sync when multiple devices configured for iRules LX

Links to More Info: BT905477

Component: Local Traffic Manager

Symptoms:
The iRules LX workspaces belong on only one device in a Device Service Cluster (DSC) (config sync device-group). If you have the same iRules LX workspace configured on multiple devices and then perform a config sync operation, the sdmd daemon cores.

Conditions:
-- Multiple devices configured with the same iRules LX workspace in a DSC.
-- Change one of the devices such that the configuration requires a config sync.
-- Perform the config sync.

Impact:
The sdmd daemon cores. Although having multiple devices configured with the same iRules LX workspace is an incorrect configuration, sdmd should not core.

Workaround:
When the iRules LX workspace is correctly configured, i.e., on only one device in a DSC, there is no need to config sync, so this issues does not occur.

---

904401-6 : Guestagentd or devmgmtd core

Links to More Info: BT904401

Component: TMOS

Symptoms:
Guestagentd or devmgmtd crashes on a vCMP guest.

Conditions:
This can occur during normal operation in a vCMP environment.

Impact:
Guestagentd crashes on the vCMP guest, and the vCMP host does not have accurate guest information, such as version, provisioning, high availability (HA) status, and tmm status.
Or if it is Devmgmtd that crashed on vCMP guest, the device management daemon will not establishes and maintains device trust group functionality.

Workaround:
None.

---

902445-4 : ASM Policy Event Logging stops working after 'No space in shmem' error disconnection mitigation

Links to More Info: BT902445

Component: Application Security Manager

Symptoms:
ASM event logging stops working.

Conditions:
This can occur during normal ASM operation. It occurs after ASM executes 'No space in shmem' error disconnection mitigation, and this error is logged.

Impact:
ASM Policy Event Logging stop working; new event is not saved.

Workaround:
Restart asmlogd and pabnagd:
pkill asmlogd
pkill pabnagd

---

901989-9 : Corruption detected in /var/log/btmp

Links to More Info: BT901989

Component: TMOS

Symptoms:
The boot_marker is written to /var/log/btmp, but /var/log/btmp is a binary file.

A message similar to:

Apr 21 09:19:52 bigip1 warning sshd[10901]: pam_lastlog(sshd:session): corruption detected in /var/log/btmp

... may be logged to /var/log/secure.

Conditions:
-- Rebooting a BIG-IP.

Impact:
Since this file is unknowingly corrupt after each boot, any potential investigation needing this data may be compromised.

Workaround:
After bootup you can truncate the file.
$ truncate --size 0 /var/log/btmp

This will remove any instances of failed logins from the file.

---

901569-6 : Loopback traffic might get dropped when VLAN filter is enabled for a virtual server.

Links to More Info: BT901569

Component: Local Traffic Manager

Symptoms:
Loopback traffic (local traffic) destined to a virtual server might get dropped when the incoming packet matches a terminating connection flow.

Conditions:
-- VLAN filter is enabled on the virtual server created for loopback traffic processing.
-- An incoming packet matches a terminating connection flow (i.e., the connection flow terminates because of timeout, being dropped by iRule, etc.).

Impact:
Traffic that is matched against a terminating connection flow of a virtual is not processed by the virtual server.

Workaround:
Because this filter is ignored for loopback traffic, removing the 'Enabled On VLAN' filter at the virtual server mitigates the issue.

---

896565-3 : Clusterd.peermembertimeout to set peer member timeout does not work all the time

Component: Local Traffic Manager

Symptoms:
Clusterd.peermembertimeout timeout does not work all the time. The default value (10s) might be used instead.

Conditions:
Clusterd.peermembertimeout is modified to a value other than default.

Impact:
New value of clusterd.peermembertimeout is not in use.

---

895669-4 : VCMP host does not validate when an unsupported TurboFlex profile is configured

Links to More Info: BT895669

Component: TMOS

Symptoms:
There is no validation error for when unsupported TurboFlex profiles are configured on vCMP hosts for relevant platforms. Due to this lack of validation, it can result in incorrect FPGA firmware being loaded on the host and thus a guest may fail to start or reboot constantly.

Conditions:
(1) Provision vCMP on the host and deploy 2x guests with 4 cores
(2) On the vCMP host, manually change TurboFlex profile type to be one that it does not support.

Impact:
Incorrect FPGA firmware is loaded on the host, which can cause problems with the data plane on the guest.

Workaround:
Only use supported turboflex profiles.

---

894593-3 : High CPU usage caused by the restjavad daemon continually crashing and restarting

Links to More Info: BT894593

Component: TMOS

Symptoms:
Restjavad may become unstable if the amount of memory required by the daemon exceeds the value allocated for its use.

Conditions:
The memory required by the restjavad daemon may grow significantly in system configurations with either a high volume of device statistics collection (AVR provisioning), or a with relatively large number of LTM objects managed by the REST framework (SSL Orchestrator provisioning).

Impact:
The overall system performance is degraded during the continuous restart of the restjavad daemon due to a relatively high CPU usage.

Workaround:
Please note that the information below is not relevant to versions from 15.1.9, 16.1.4 and 17.1.0 onwards. In those versions restjavad memory allocation is managed with system db variables provision.restjavad.extramb and provision.extramb (see https://my.f5.com/manage/s/article/K000133258 for more details).

Please don't apply the workarounds below if encountering issues after upgrade to 14.1.5.1-, 15.1.7-, 16.1.3.1- and 17.0.0.1 and you already have restjavad.useextramb set to true. If you have low restjavad memory under these conditions it is likely you are encountering a problem caused by the behaviour change introduced in ID 1025261 ( https://cdn.f5.com/product/bugtracker/ID1025261.html ). The linked article has suggestions on how to mitigate the issue.

If you have restjavad.usextramb set to false and need more memory after upgrade to a version above you will also need to set provision.restjavad.extramb to a sensible value as well as the commands below - typically something like 384 + 80% of MIN (provision.extramb | 2500), so 1984 MB for example below.
That's a high value and it may be possible to set it lower eg it may be worth trying 384 + 20% of MIN(provision.extramb|2500) which is 784 MB for example beneath. You can try different values quite quickly by changing provision.restjavad.extramb and restarting restjavad which should only effect availability of REST API for a few seconds. Generally 384 MB should be seen as the minimum.

Increase the memory allocated for the restjavad daemon (e.g., 2 GB), by running the following commands in a BIG-IP terminal.
 
tmsh modify sys db restjavad.useextramb value true
tmsh modify sys db provision.extramb value 2000
bigstart restart restjavad
Note changing provision.extramb is service affecting and systems may take several minutes to return to a state they could handle traffic. It also needs to be set on each peer of a service cluster.

Note this may lead to impact on multi-module systems with ASM as approximately only 50-60% of provision.extramb value would be allocated as extra host memory and restjavad may take up to 80% of provision.extramb. It also lowers the ASM specific host allocation resulting in some tighter memory constraints on ASM daemons. Try to use the smallest value that works.

---

893801-1 : Launching resources that are published on an APM Webtop from multiple VMware servers will fail when the Native View client is selected

Links to More Info: BT893801

Component: Access Policy Manager

Symptoms:
If APM is configured to publish multiple VMware resources (VCS servers) on an APM Webtop, and you select the Native View Client when you launch a resource, you can launch desktops and applications only from the first resource. Attempts to launch desktop or applications from other resources result in an error.

Conditions:
-- APM is configured to protect multiple VMware resources (VCS servers) and publish those resources on an APM Webtop.
-- You attempt to launch a desktop or application specifying the native VMware client on Linux and Mac.

Impact:
Cannot access desktops and applications from multiple VMware back-ends.

Workaround:
Use HTML5 client instead.

---

891565-3 : The Subject Alternative Name (SAN) field in Certificates and Certificate Signing Requests is limited to 4095 bytes

Links to More Info: BT891565

Component: Local Traffic Manager

Symptoms:
When creating a Certificate Signing Request (CSR) or when creating or using a Certificate (CRT), there is a limit of 4096 bytes in the Subject Alternative Names (SAN) field.

Since one byte is reserved, the value entered into that field cannot exceed 4095 bytes.

Note that if the SAN list is so long that it causes the entire SSL handshake (ie, all handshake messages combined) to exceed 32K, then the handshake will be aborted with the code "hs msg overflow" - see K40902150 for further details.

Conditions:
- Generation of a Certificate Signing Request with a large SAN list.
(or)
 - Use of a client-ssl profile with a virtual server, where an associated certificate contains a large SAN field

Impact:
Very long SAN values cannot be used

Workaround:
- Create multiple certificates, where each certificate has a sufficiently short SAN list, then create client-ssl profiles for each cert+key, then assign all of those profiles to the same virtual server.

- Reduce the length of the Subject Alternative Name field, if possible by collapsing multiple entries into one by using wildcards, for example '*.example.com', rather than 'one.example.com;two.example.com'

---

887265-7 : BIG-IP systems may fail to come online after upgrade with ASM and VLAN-failsafe configuration★

Links to More Info: BT887265

Component: Local Traffic Manager

Symptoms:
When booting to a boot location for the first time, the system does not come on-line.

Conditions:
-- There is a large configuration.
-- VLAN failsafe is configured, and the failsafe-action is something other than failover.
-- The BIG-IP system is an appliance.

Impact:
BIG-IP processes continually restart (VLAN failsafe-action failover-restart-tm), or the BIG-IP system continually reboots (VLAN failsafe-action reboot)

Workaround:
Either disable VLAN failsafe or set the failsafe-action to failover during an upgrade.

---

883149-8 : The fix for ID 439539 can cause mcpd to core.

Links to More Info: BT883149

Component: TMOS

Symptoms:
Mcpd cores during config sync.

Conditions:
This occurs on rare occasions when the device transitions from standby to active, and the connection between the BIG-IP peers stalls out.

Impact:
Mcpd cores. Traffic disrupted while mcpd restarts.

Workaround:
None

---

883089-1 : Excessive TMM memory consumption by "Anti-Replay" protection for TLS 1.3 0-RTT/Early Data

Links to More Info: BT883089

Component: Local Traffic Manager

Symptoms:
Incoming packets are dropped, connections are dropped.
"Aggressive mode sweeper" messages recorded in "ltm" log, such as:

    warning tmm[457]: 011e0003:3: Aggressive mode sweeper: /Common/default-eviction-policy (1cf1) (global memory) 99 Connections killed

The output of the following command shows a value of 2.3G for "Alloc (bytes)":

    # tmsh show sys memory | grep -E "SubSystem|EB.Tree"

Conditions:
-- At least one virtual server has a clientssl profile configured to enable the TLS 1.3 protocol, along with the advanced option setting "0-RTT/Early Data with Anti-Replay".

   (In the Configuration Utility, the field in Profile Properties is "Data 0-RTT" and the value would be "Enabled with Anti-Replay".)

Impact:
Dropping packets and connections impedes handling of network traffic. In extreme cases, the shortage of available TMM memory may trigger a greater disruption.

Workaround:
In the "clientssl" profile, set the TLS 1.3 option "Data 0-RTT" to "Disabled".

---

882725-7 : Mirroring not working properly when default route vlan names not match.

Links to More Info: BT882725

Component: Local Traffic Manager

Symptoms:
When using two BIG-IP systems to mirror traffic, mirroring occurs when the default gateway VLAN names match; however, if the default gateway VLAN names don't match, then the BIG-IP system does not mirror client-side packets to the peer, which causes the standby BIG-IP system to reset all client-side flows on failover.

Conditions:
-- Two BIG-IP LTM systems configured as a high availability (HA) pair.
-- Default gateway VLAN names don't match between them.

Impact:
BIG-IP system does not mirror client-side packets to the peer, which causes the next-active device to reset all client-side flows on failover.

Upon failover all flows are being RST just like a typical failover scenario without mirroring implemented.

Workaround:
Use same VLAN name on all external VLANs that might be used for mirroring.

---

881937-5 : TMM and the kernel choose different VLANs as source IPs when using IPv6.

Links to More Info: BT881937

Component: Local Traffic Manager

Symptoms:
IPv6 traffic generated from the host, either from a host daemon, monitors, or from the command line, can use a MAC and IPv6 source address from different VLANs.

Conditions:
-- Multiple VLANs configured with IPv6 addresses.
-- Multiple routes to the same destination, either the same or more specific, default routes, etc., that cover the traffic destination.
-- Changes are made to routes that cause the traffic to the destination to shift from one VLAN and gateway to another. This can be typically observed with dynamic routing updates.
- The db key snat.hosttraffic is set to disable.

Impact:
Traffic to the destination may fail because the incorrect source IPv6/MAC address is used, which might cause monitor traffic to fail.

Workaround:
tmsh list sys db snat.hosttraffic
tmsh modify sys db snat.hosttraffic value enable
tmsh save sys config

---

880565-6 : Audit Log: "cmd_data=list cm device recursive" is been generated continuously

Links to More Info: BT880565

Component: Device Management

Symptoms:
The system generates and logs the following message continuously every 30 seconds, in /var/log/audit:

-- bigip1 notice tmsh[47755]: 01420002:5: AUDIT - pid=47755 user=root folder=/ module=(tmos)# status=[Command OK] cmd_data=cd / ;
-- bigip1 notice tmsh[47755]: 01420002:5: AUDIT - pid=47755 user=root folder=/ module=(tmos)# status=[Command OK] cmd_data=list cm device recursive

Conditions:
This occurs during normal operation.

Impact:
Audit log file contains numerous 'cmd_data=list cm device recursive' messages.

Workaround:
-- To prevent the two messages from being logged to /var/log/audit:

1. Edit the 'include' section of syslog configuration to suppress audit logs of 'cmd_data=cd /' and 'cmd_data=list cm device recursive':

# tmsh
# edit /sys syslog all-properties

2. Replace 'include none' with the following syntax:
===
sys syslog {
- snip -
    include "
    filter f_audit {
        facility(local0) and message(＼"AUDIT＼") and not message(＼"cmd_data=list cm device recursive|cmd_data=cd /＼");
    };"
- snip -
}


-- To filter the messages sent to remote syslog servers only, do the following:

1. Set sys syslog remote-servers none:

# tmsh modify sys syslog remote-servers none

2. Edit the 'include' section of syslog configuration to suppress audit logs of 'cmd_data=cd /' and 'cmd_data=list cm device recursive':

# tmsh
# edit /sys syslog all-properties

3. Add the following filter:

    filter f_remote_loghost {
        not (facility(local0) and message(＼"AUDIT.*cmd_data=list cm device recursive|cmd_data=cd /＼"));
    };

Result: The system sends all messages that match the filter to the remote syslog server. It uses the "not" operand to filter the messages out.

4. Add destination and log directives. Below is a sample configuration, with the filter in step 3:

sys syslog {
    include "
    filter f_remote_loghost {
        not (facility(local0) and message(＼"AUDIT.*cmd_data=list cm device recursive|cmd_data=cd /＼"));
    };
    destination d_remote_loghost {
        udp(＼"10.0.0.1＼" port(514));
    };
    log {
        source(s_syslog_pipe);
        filter(f_remote_loghost);
        destination(d_remote_loghost);
    };
    "
}

---

870349-3 : Continuous restart of ntlmconnpool after the license reinstallation★

Links to More Info: BT870349

Component: Local Traffic Manager

Symptoms:
The ntlmconnpool process continuously restarts after reinstalling the license. The system reports a message in the BIG-IP console:

Re-starting ntlmconnpool.

The BIG-IP may show as 'Disconnected', and 'TMM outbound listener not yet created' messages may be present in /var/log/ltm.

Conditions:
This occurs when you upgrade your license such that the new license changes the number of available TMMs.

Impact:
The system requires a reboot and reports a ‘Re-starting ntlmconnpool’ message continuously in the BIG-IP console.

Workaround:
To resolve the issue, it is necessary to reboot. Once the system restarts, it operates as expected.

---

869541-4 : Series of unexpected <aborted> requests to same URL

Links to More Info: BT869541

Component: Access Policy Manager

Symptoms:
Series of unexpected <aborted> requests to same URL

Conditions:
Web-app using special code pattern in JavaScript.

For example:

     loc = window.location;

     obj = {}

     for (i in loc) {
        obj[i] = loc[i];
     }

Impact:
Page load is aborted

Workaround:
Following iRule can be used with customized SPECIFIC PAGE_URL value:

when REWRITE_REQUEST_DONE {
  if {
    [HTTP::path] ends_with "SPECIFIC_PAGE_URL"
  } {

    # log "URI=([HTTP::path])"
    # Found the file we wanted to modify

    REWRITE::post_process 1
    set do_fix 1
  }
}

when REWRITE_RESPONSE_DONE {
  if {[info exists do_fix]} {
    unset do_fix

    set strt [string first {<script>try} [REWRITE::payload]]

    if {$strt > 0} {
      REWRITE::payload replace $strt 0 {
        <script>
          (function () {
            var dl = F5_Deflate_location;
            F5_Deflate_location = function (o) {
              if (o.F5_Location) Object.preventExtensions(o.F5_Location)
              return dl(o);
            }
          })()
        </script>
      }
    }
  }
}

---

869121-1 : Logon Page configured after OAuth client in access policy VPE, get error message Access policy evaluation is already in progress for your current session

Links to More Info: BT869121

Component: Access Policy Manager

Symptoms:
When 'Logon Page' agent is configured after 'OAuth client' in access policy VPE, you see an error message that says 'Access policy evaluation is already in progress for your current session'

Conditions:
In access VPE, Logon page after OAuth client agent in standard customization type.

Impact:
Cannot process further to reach resources.

Workaround:
Try to configure the access policy in Modern customization if it's not already configured that way.

When message box configured after OAuth client and observing the same above Access policy evaluation error message

Workaround:
Use a 'Logon Page' agent instead of the 'Message Box' agent and configure it such as:

all fields Type will be set to 'none'
message for the users will be mentioned in the 'Form Header text' field
Logon Button value will be changed from 'Logon' to 'Continue'

This should simulate exactly the look and feel of a message box but will prevent the issue from happening.

---

868801-1 : BIG-IP still sends STARTTLS if the 'No encryption' SNMP option is enabled

Links to More Info: BT868801

Component: TMOS

Symptoms:
The SMTP 'No Encryption' configuration option is not honored by the BIG-IP device.

Conditions:
The 'No Encryption' option is selected under the SMTP configuration object.

Impact:
BIG-IP disregards its SMTP configuration and attempts to initiate TLS.

Workaround:
None

---

867985-7 : LTM policy with a 'shutdown' action incorrectly allows iRule execution

Links to More Info: BT867985

Component: Local Traffic Manager

Symptoms:
BIG-IP systems provide manipulation tools over a connection with an LTM policy and/or iRule. LTM policy takes precedence over iRules and has an option to shutdown a connection based on satisfied conditions. When a connection is closing, an iRule should not be executed under the same conditions.

Conditions:
-- The BIG-IP system has a virtual server with an LTM policy and an iRule.
-- The LTM policy has action 'shutdown connection' under certain conditions.
-- The iRule has an event which is triggered under the same conditions.

Impact:
The iRule is executed before the connection is being reset.

Workaround:
None.

---

867549-5 : LCD touch panel reports "Firmware update in progress" indefinitely★

Links to More Info: BT867549

Component: TMOS

Symptoms:
After a software upgrade that includes an LCD firmware update, the LCD touch panel may remain stuck reporting an error indefinitely / for longer than 30 minutes:
Firmware update in Progress may take up to 30 minutes.

Conditions:
This issue occurs when all of the following conditions are met:

-- You have one of the following BIG-IP platforms:
 * i850
 * i2x00
 * i4x00
 * i5x00
 * i7x00
 * i10x00
 * i11x00
 * i15x00
 * HRC-i2x00
 * HRC-i5x00
 * HRC-i10x00

-- You perform a software upgrade that updates the firmware on the LCD touch panel, e.g. upgrading from BIG-IP v13.1.x to BIG-IP v14.1.x or newer.

Impact:
The system is functional, but the LCD displays the firmware update screen indefinitely. The LCD cannot be used while it is frozen on the firmware update warning screen.

Workaround:
Important: Before attempting this workaround, check that there are no indications the system is still performing a firmware update (such as a terminal prompt), and that the following messages can be found in /var/log/ltm after the most recent boot:

notice chmand[6302]: 012a0005:5: firmware update succeeded.
notice chmand[6302]: 012a0005:5: Firmware check finished.

These messages indicates that the firmware update has finished, and the LCD is displaying the warning screen in error, so it is safe to perform the workaround.

Reboot the BIG-IP system to return the LCD to normal operation.

After a reboot of the BIG-IP operating system, the LCD touch panel should be responsive.

---

867253-5 : Systemd not deleting user journals

Links to More Info: BT867253

Component: TMOS

Symptoms:
When setting 'SystemMaxUse' to any value, systemd does not honor this limit, and the specified size is exceeded.

Conditions:
Using a non-TMOS user account with external authentication permission.

Note: Systemd-journald is configured to create a user journal for every remote user that logs into the BIG-IP system.

Impact:
Journald filling up the file system. These journals are allocated with a minimum size of 4MiB and are not removed when the log entries age-out.

Workaround:
Option 1:
To immediately free up space, manually remove per-user journal logs from the following location:
  /var/log/journal/*/user-*

Option 2:
To prevent the system from creating these journal files going forward:

1. Edit /etc/systemd/journald.conf and add the following at the bottom of the file:
  SplitMode=none

2. Restart systemd-journal service
  # systemctl restart systemd-journald

3. Delete the existing user journal files from /var/log
  # rm /var/log/journal/*/user-*

Note:
-- You must apply this workaround separately to each blade of a VIPRION or vCMP guest running on a VIPRION.
-- You must reapply this workaround after performing software installations.

---

863601-6 : Panic in TMM due to internal mirroring interactions

Links to More Info: BT863601

Component: Wan Optimization Manager

Symptoms:
The Traffic Management Microkernel suddenly restarts due to a SIGSEGV segmentation fault.

Conditions:
-- APM is being used.
-- Connection mirroring is being used.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
Avoid configuring connection mirroring when APM is being used.

---

862949-5 : ZoneRunner GUI is unable to display CAA records

Links to More Info: BT862949

Component: Global Traffic Manager (DNS)

Symptoms:
Attempting to manage a CAA record via the GUI shows an error:

Resolver returned no such record.

Conditions:
-- Navigate to DNS :: Zones :: ZoneRunner :: Resource Record List :: Search All Records.
-- Click on record of type CAA.

Impact:
Unable to update CAA records via the GUI.

Workaround:
You can use either of the following workarounds:

-- Manually edit the BIND configuration.
-- Delete the record and create a new one with the desired changes.

---

857973-2 : GUI sets FQDN Pool Member "Auto Populate" value Enabled by default

Links to More Info: BT857973

Component: Local Traffic Manager

Symptoms:
In the GUI, the "autopopulate" value is Enabled by default when creating an FQDN template Pool Member, but Disabled by default when creating an FQDN template Node.

Conditions:
This is observed when using FQDN names to configure Pool Members and/or Nodes in the GUI.

Impact:
Differing default "autopopulate" values displayed in the GUI are confusing.
The "autopopulate" value for an FQDN Pool Member cannot be set to "enabled" if the "autopopulate" value of the corresponding FQDN Node is set to the default value of "disabled".
Attempting to do so via tmsh will generate an error similar to:
01070734:3: Configuration error: Cannot enable pool member to autopopulate: node (<fqdn node name>) has autopopulate set to disabled

Workaround:
Be careful to select the appropriate option for the "Auto Populate" parameter when configuring FQDN Pool Members using the GUI.

---

857769-4 : FastL4+HTTP or FastL4+Hash-Persistence virtual servers do not work correctly in DSR mode.

Links to More Info: BT857769

Component: Local Traffic Manager

Symptoms:
Given a long-lived TCP connection that can carry multiple client requests (for example, but not limited to, HTTP requests), the BIG-IP system fails to forward requests after the forty-eighth one.

The client will try re-transmitting the answered request, but the BIG-IP system will persist in dropping it.

Conditions:
This issue occurs when all of the following conditions are met:

1) The virtual server uses the FastL4 profile.
2) The virtual server also uses the HTTP or Hash-Persistence profiles.
3) The virtual server operates in DSR (Direct Server Return) mode (also known as N-Path).

Impact:
The BIG-IP system fails to forward traffic.

Workaround:
Do not use the HTTP or Hash-Persistence profiles with a FastL4 virtual server operating in DSR mode.

Note: It is fine to use an iRule that calls hash persistence commands (for example, "persist carp [...]") as long as the Hash-Persistence profile is not associated to the virtual server. This technique will allow you to persist on a hash based on L4 information that you can extract at CLIENT_ACCEPTED time. For example, the following iRule correctly persists a specific client socket to a pool member in a FastL4 DSR configuration:

when CLIENT_ACCEPTED {
   persist carp [IP::client_addr]:[TCP::client_port]
}

---

857045-5 : LDAP system authentication may stop working

Links to More Info: BT857045

Component: TMOS

Symptoms:
If the system daemon responsible for LDAP authentication crashes, the system will not automatically restart it, and remote LDAP authentication may stop working.

In /var/log/daemon.log, you may see the following:

warning systemd[1]: nslcd.service failed

Conditions:
Nslcd daemon crashed, and it fails to restart.

Impact:
System authentication stops working until nslcd is restarted.

Workaround:
Manually restart nslcd daemon:

systemctl start nslcd



nslcd can be reconfigured to restart automatically and create core files when it crashes, though these changes will be lost across software installs (and is not backed up as part of a UCS archive):

1. Run "systemctl edit nslcd", which will open a text editor (by default, nano).

2. In the text editor, add these contents:

[Service]

# Allow core files
LimitCORE=infinity
# Try to keep auth daemon running, even if it crashes
Restart=always

3. Exit the text editor and save the file

4. Check the output of "systemctl status nslcd" for any warnings/errors from systemd as a result of editing the file; there should not be any.

5. Restart nslcd:
   systemctl restart nslcd

---

842193-7 : Scriptd coring while running long-running iApp script

Links to More Info: BT842193

Component: iApp Technology

Symptoms:
When an iApp script should be terminated due to the max-script-run-time, the script still continues and finishes, sometimes with scriptd coring and posting error messages in /var/log/ltm:

-- err scriptd[13532]: 014f0004:3: script has exceeded its time to live, terminating the script <------ after 20 secs, it continues even after the scriptd core.

-- notice sod[3235]: 01140041:5: Killing /usr/bin/scriptd pid 13532.
-- warning sod[3235]: 01140029:4: high availability (HA) daemon_heartbeat scriptd fails action is restart.

Conditions:
An iApp runs a script which runs for longer than the configured max-script-run-time.

Impact:
Scriptd core.

Workaround:
Increasing the sys scriptd max-script-run-time higher then the default of 300 seconds might be helpful if the higher timeout allows the script to complete.

For example, if the script is saving a UCS and the save takes 400 seconds, then increasing the max-script-run-time to 430 seconds would allow the script to finish and would work around this issue.

---

842137-7 : Keys cannot be created on module protected partitions when strict FIPS mode is set

Links to More Info: BT842137

Component: Local Traffic Manager

Symptoms:
When the Hardware Security Module (HSM) FIPS mode is set to FIPS 140-2 Level 3 protection, new keys cannot be created in the module's protected partition.

Note: Although FIPS grade Internal HSM (PCI card) is validated by the Marvell company at FIPS 140-2 Level 3, the BIG-IP system is not 140-2 Level 3 validated.

Conditions:
-- FIPS 140-2 Level 3 protection is configured on a NetHSM partition.
-- You attempt to create a FIPS key using that partition.

Impact:
New Keys cannot be create.

Workaround:
Follow these steps to generate a new NetHSM key called 'workaround' and install it into the BIG-IP config:

1. Generate the key:

[root@bigip1::Active:Standalone] config # fipskey.nethsm --genkey -o workaround -c module
WARNING: fipskey.nethsm will soon be deprecated for use with Thales. Please switch to using tmsh commands instead.
tmsh commands...

Generate Key:
tmsh create sys crypto key <key_name> security-type nethsm [gen-certificate|gen-csr] ...
For an exhaustive list of options, please consult F5's tmsh documentation.
Generate CSR for existing key:
tmsh create sys crypto csr <csr_name> key <key name> ...
For an exhaustive list of options, please consult F5's tmsh documentation.
Generate Self-Signed Certificate for existing key:
tmsh create sys crypto cert <cert_name> key <key name> ...
For an exhaustive list of options, please consult F5's tmsh documentation.
Delete Key:
tmsh delete sys crypto key <keyname>


str[cd /shared/tmp && /opt/nfast/bin/generatekey -b pkcs11 certreq=yes selfcert=yes protect=module size=2048 embedsavefile="workaround" plainname="workaround" digest=sha256]
key generation parameters:
 operation Operation to perform generate
 application Application pkcs11
 protect Protected by module
 verify Verify security of key yes
 type Key type RSA
 size Key size 2048
 pubexp Public exponent for RSA key (hex)
 embedsavefile Filename to write key to workaround
 plainname Key name workaround
 x509country Country code
 x509province State or province
 x509locality City or locality
 x509org Organisation
 x509orgunit Organisation unit
 x509dnscommon Domain name
 x509email Email address
 nvram Blob in NVRAM (needs ACS) no
 digest Digest to sign cert req with sha256

Key successfully generated.
Path to key: /opt/nfast/kmdata/local/key_pkcs11_ua882aa9fadee7e440772cb6686358f4b283922622
Starting synchronisation, task ID 5de83486.6e9e32d7f367eaf4
Directory listing failed: No such file or directory


2. Confirm the presence of the key with the label 'workaround':

[root@bigip1::Active:Standalone] config # nfkminfo -l

Keys with module protection:

 key_pkcs11_ua882aa9fadee7e440772cb6686358f4b283922622 `workaround'

Keys protected by cardsets:
...


3. Install the key:

[root@bigip1::Active:Standalone] config # tmsh install sys crypto key workaround from-nethsm


4. Install the public certificate:

[root@bigip1::Active:Standalone] config # tmsh install sys crypto cert workaround from-local-file /config/ssl/ssl.crt/workaround

---

838337-9 : The BIG-IP system's time zone database does not reflect recent changes implemented by Brazil in regard to DST.

Links to More Info: BT838337

Component: TMOS

Symptoms:
In 2019, Brazil cancelled DST (Daylight Saving Time) and is now on standard time indefinitely. The BIG-IP system's time zone database needs to be updated to reflect this change.

Conditions:
None.

Impact:
BIG-IP systems configured to use "America/Sao_Paul" (or other applicable Brazilian localities) will still apply DST. Hence time will spring forward and backward on previously designated dates.

This will have no impact to application traffic handled by the BIG-IP system. However, logs, alerts, reports, cron jobs, etc. will use incorrect time.

Note: You can inspect the time changes your system is due to apply by running the following command from the BIG-IP system's advanced shell (bash):

zdump -v <timezone>

For example:

zdump -v America/Sao_Paulo

Workaround:
As a workaround, you can set the BIG-IP system's time zone to that of a different country with the same UTC offset and already not observing DST.

For example, instead of using "America/Sao_Paul", you could use "America/Buenos_Aires" to obtain the same result.

---

832153-1 : Crash due to incorrect format specifiers is fixed.

Links to More Info: BT832153

Component: Local Traffic Manager

Symptoms:
TMM crashes

Conditions:
This is handled internally in the code. Currently, the scenario is not possible, and the existing logic ensures that this issue is not triggered.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

---

829653-5 : Memory leak due to session context not freed

Links to More Info: BT829653

Component: Policy Enforcement Manager

Symptoms:
Memory increases slowly

Conditions:
A PEM iRule times out

Impact:
Memory could be exhausted depending on the frequency of the command timeouts

---

818777-4 : MCPD error - Trouble allocating MAC address for VLAN object

Links to More Info: BT818777

Component: TMOS

Symptoms:
You see the following errors in /var/log/ltm:

err mcpd[8985]: 0107071c:3: Trouble allocating mac address for vlan object /Common/external.

Conditions:
Conditions under which this occurs are unknown.

Impact:
There is no known impact to the system as a result of this log message.

Workaround:
If this reoccurs, you can try force reloading mcpd.

For more information, see K13030: Forcing the mcpd process to reload the BIG-IP configuration, available at https://support.f5.com/csp/article/K13030.

---

804089-3 : iRules LX Streaming Extension dies with Uncaught, unspecified error event

Links to More Info: BT804089

Component: Local Traffic Manager

Symptoms:
You are using a virtual with an ilx profile generated from an iRules LX Streaming extension and observed the following error or similar.
  
Sep 05 09:16:52 pid[5850] Error: Uncaught, unspecified "error" event. (ETIMEDOUT)
Sep 05 09:16:52 pid[5850] at ILXFlow.emit (events.js:163:17)
Sep 05 09:16:52 pid[5850] at ILXFlowWrap.ilxFlowErrorCb [as onIlxError] (/var/sdm/plugin_store/plugins/<pluginName>/extensions/<workspaceName>/node_modules/f5-nodejs/lib/ilx_flow.js:108:10)

Conditions:
Virtual server with an ilx profile generated from an iRules LX Streaming extension. The problem is aggravated if a web-acceleration profile is configured.

Impact:
Traffic may be disrupted until the sdmd daemon has respawned another node.js process.

---

803773-4 : BGP Peer-group route-maps are not applied to newly configured address-family ipv6 peers

Links to More Info: BT803773

Component: TMOS

Symptoms:
Inbound or outbound route-map configuration may not be applied properly to address-family ipv6 members of peer-group

Conditions:
This happens when route-map is applied to a peer-group before the neighbor gets configured as a peer-group member.

For example:

conf t
   no route-map test
   no router bgp 64512

   route-map test permit 10
      match ipv6 address 2001::1/128
      
   router bgp 64512
      neighbor pg1 peer-group
      neighbor pg1 remote-as 64512

      address-family ipv6
         neighbor pg1 activate
         neighbor pg1 route-map test out
         
         end

conf t
   router bgp 64512
   neighbor 2001::2 peer-group pg1
   end

Impact:
route-map configuration inherited from the peer-group (in or out) may not be applied to the BGP neighbor

Workaround:
After a peer is added:
- Remove peer-group route-map configuration.
- Re-add peer-group route-map configuration.
- Clear BGP sessions to apply new config.

---

800377-2 : Support for Referrer-Policy: origin to correctly return backend origin in virtual server requests

Links to More Info: BT800377

Component: Access Policy Manager

Symptoms:
When a Virtual Server (VS) includes a Referrer-Policy: origin response header and sends a request that relies on the Referrer header (e.g., to a .php file), the system incorrectly returns the client-side origin instead of the backend origin.

Conditions:
Issue occurs when Using portal access and has a resource that has a Referrer-Policy: origin response header.

Impact:
Virtual Server (VS) pages may encounter incorrect Referrer header values when using resources that depend on accurate backend origin data. Instead of the backend origin being returned as expected, the client (visitor) origin is returned.

Workaround:
None

---

798885-7 : SNMP response times may be long when processing requests

Links to More Info: BT798885

Component: TMOS

Symptoms:
SNMP queries to the BIG-IP system may take longer (up to 15% more time) to process on BIG-IP systems with large configurations. mcpd CPU usage increases by a small amount (up to 10%) during these queries.

Conditions:
-- Large configuration.
-- Using SNMP to query statistics on the BIG-IP system.

Impact:
A small increase in response time to SNMP requests to the BIG-IP. Some SNMP queries might fail due to timeouts. mcpd CPU usage is slightly elevated while processing these queries.

Workaround:
If the responses to SNMP queries are taking too long, MCPD and SNMPD may overburden the control plane. It may be necessary to lengthen the timeout and retry values used by the SNMP client. It may also be helpful to trim what is queried, for example, not repetitively walking large tables like the Virtual Server or LTM Pool Member tables for statistics.

---

797573-4 : TMM assert crash with resulting in core generation in multi-blade chassis

Links to More Info: BT797573

Component: Local Traffic Manager

Symptoms:
TMM crashes while changing settings.

Conditions:
Seen on multi-blade chassis with either one of the options:
-- Running system with DoS and other traffic.
-- Create a new vCMP guest and deploy it.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None.

---

789133-1 : iControl REST framework returns the chunks previously requested

Links to More Info: BT789133

Component: TMOS

Symptoms:
When a subsequent call requests for the range that overlaps with the previous call, the iControl REST framework returns the chunks previously requested.

Conditions:
Subsequent request content-range should be a superset of the first request content-range.

Impact:
You might not be able to re-request overlapping chunks.

Workaround:
None

---

783077-3 : IPv6 host defined via static route unreachable after BIG-IP reboot

Links to More Info: BT783077

Component: Local Traffic Manager

Symptoms:
Static route unreachable after BIG-IP system reboot.

Conditions:
-- Add a static route.
-- Issue a ping (works fine).
-- Reboot the BIG-IP system.
-- Issue a ping (cannot pint the route).

Impact:
Static route exists in both kernel and LTM routing table but unable to ping the route after rebooting the BIG-IP system.

Workaround:
Workaround-1:
Delete the IPv6 route entry and recreate the route by issuing the following commands in sequence:

tmsh delete net route IPv6
tmsh create net route IPv6 network 2a05:d01c:959:8408::b/128 gw fe80::250:56ff:fe86:2065 interface internal

Workaround-2:

net route /Common/IPv6 {
    gw fe80::456:54ff:fea1:ee02 <-- Change this address to unicast address from 2a05:d01c:959:8409::/64 network
    interface /Common/Internal
    mtu 1500
    network 2a05:d01c:959:8408::b/128
}

---

779137-8 : Using a source address list for a virtual server does not preserve the destination address prefix

Links to More Info: BT779137

Component: Local Traffic Manager

Symptoms:
Configuring a network virtual server with a source address list causes the system to treat the virtual server as a host.

Conditions:
-- Configure a source address list on the virtual server.
-- Configure a network address for the destination of the virtual server (not an address list).

Impact:
Traffic does not flow to the virtual server as expected.

Workaround:
See K58807232

---

777389-9 : In rare occurrences related to PostgreSQL monitor, the mcpd process restarts

Links to More Info: BT777389

Component: TMOS

Symptoms:
Possible indications include the following:

-- Errors such as the following may appear in ltm/log:

   - notice postgres[10872]: [466-1] WARNING: pgstat wait timeout.
   - notice sod[27693]: 01140041:5: Killing /usr/bin/mcpd pid 7144.
   - BD_CONF|ERR| ...failed to connect to mcpd after 5 retries, giving up...
   - BD_CONF|ERR| ...can't read message from mcp conn, status:16908291.
   - BD_MISC|CRIT| ...Received SIGABRT - terminating.

-- Errors such as the following may appear in the dwbld/log:

   - Couldn't send BLOB notification - MCP err 16908291.
   - Got a terminate/abort signal - terminating ...
   - Terminating mcp_bridge thread.

-- Processes may restart unexpectedly, including mcpd, bd, and postgresql.

Conditions:
-- The 'mcpd' process attempts to read monitoring data from the PostgreSQL server, but no data is available.

-- A contributing factor might be that the AFM module is licensed but not configured.

Impact:
Failing to receive a monitoring response from the SQL server, MCPD goes into an infinite loop and skips the heartbeat report, resulting in its restart. While MCPD is restarting, the system is offline and does not process traffic. After restart, system operation returns to normal.

Workaround:
The chance of occurrence can be minimized by making sure that control-plane processes have sufficient memory to run efficiently.

---

775845-8 : Httpd fails to start after restarting the service using the iControl REST API

Links to More Info: BT775845

Component: TMOS

Symptoms:
After restarting httpd using the iControl REST API, httpd fails to start, even with a subsequent restart of httpd at the command line.

Similar to the following example:

config # restcurl -u admin:admin /tm/sys/service -X POST -d '{"name":"httpd", "command":"restart"}'
{
  "kind": "tm:sys:service:restartstate",
  "name": "httpd",
  "command": "restart",
  "commandResult": "Stopping httpd: [ OK ]＼r＼nStarting httpd: [FAILED]＼r＼n(98)Address already in use: AH00072: make_sock: could not bind to address n.n.n.n:n＼nno listening sockets available, shutting down＼nAH00015: Unable to open logs＼n"
}

config # tmsh restart sys service httpd
Stopping httpd: [ OK ]
Starting httpd: [FAILED]

Conditions:
Restarting httpd service using iControl REST API.

Impact:
Httpd fails to start.

Workaround:
To recover from the failed httpd state, you can kill all instances of the httpd daemon and start httpd:

killall -9 httpd

tmsh start sys service httpd

---

767473-3 : SMTP Error: Could not authenticate

Links to More Info: BT767473

Component: TMOS

Symptoms:
When using a "sys smtp-server" object (System >> Configuration >> Device >> SMTP) to configure an SMTP mail server, mail may be rejected by the remote SMTP server, and clicking on the "Test Connection" button returns "SMTP Error: Could not authenticate"

Conditions:
The remote SMTP server requires TLS1.2 or higher.

Impact:
Unable to send mail for BIG-IP features that make use of the 'sys smtp-server' object, such as AVR and ASM reports.

Workaround:
Configure the BIG-IP to relay mail through a locally administered SMTP server that allows TLS 1.0 connections (which may mean creating an SMTP relay that only accepts mail from BIG-IP devices and relays it securely to another SMTP server)

---

767217-6 : Under certain conditions when deleting an iRule, an incorrect dependency error is seen

Links to More Info: BT767217

Component: Local Traffic Manager

Symptoms:
If an iRule is being referenced by another iRule, and the reference is then removed, attempts to delete the formerly referenced iRule will result in an error similar to the following:

01070265:3: The rule (/Common/irule1) cannot be deleted because it is in use by a rule (/Common/irule2).

Conditions:
-- An iRule referencing another iRule.
-- The referencing iRule is in use.

Impact:
Unable to delete the iRule.

Workaround:
Save and re-load the configuration.

---

762097-6 : No swap memory available after upgrading to v14.1.0 and above★

Links to More Info: BT762097

Component: TMOS

Symptoms:
After an upgrade to v14.1.0 or higher, swap memory may not be mounted. TMM or other host processes may restart due to lack of memory.

Conditions:
-- System is upgraded to v14.1.0 or above.

-- System has RAID storage.

Impact:
May lead to low or out-of-memory condition. The Linux oom killer may terminate processes, possibly affecting service.

Typically management activities may be impacted, for example, a sluggish GUI (config utility) or tmsh sessions.

Workaround:
Mount the swap volume with correct ID representing the swap device.

Perform the following steps on the system after booting into the affected software version:

1. Get the correct ID (RAID device number (/dev/md<number>)):
blkid | grep swap

Note: If there is no RAID device number, perform the procedure detailed in the following section.

2. Check the device or UUID representing swap in /etc/fstab.

3. If swap is not represented with the correct ID, modify the /etc/fstab swap entry to point to the correct device.

4. Enable the swap:
swapon -a

5. Check swap volume size:
swapon -s


If the blkid command shows there is no UUID associated with the swap RAID device, use the following procedure:

1. Generate a random UUID:
uuidgen

2. Make sure swap is turned off:
swapoff -a

3. Recreate the swap partition with UUID generated in step 1:
mkswap -U <uuid_from_step_1> <raid_device_from_step_1>

4. Run blkid again to make sure that you now have a UUID associated with the raid device:
blkid | grep swap

5. edit fstab and find the line
      <old_value> swap swap defaults 0 0

6. Replace the old value, whether it was an incorrect UUID or a device name, with the UUID generated in step 1, for example:
      UUID=8b35b30b-1076-42bb-8d3f-02acd494f2c8 swap swap defaults 0 0

---

759258-8 : Instances shows incorrect pools if the same members are used in other pools

Links to More Info: BT759258

Component: TMOS

Symptoms:
Monitor 'Instances' tab shows incorrect pools if the same members are used in other pools.

Conditions:
Steps to Reproduce:

1. Create custom monitor or use system default.
2. Assign that monitor to a test pool.
3. Navigate to Local Traffic :: Monitors, click the test monitor, then select the Instances tab.

Impact:
The test pool is displayed, as well any other pools that use the same member or members (but with other monitors assigned).

Workaround:
None.

---

758929-8 : Bcm56xxd MIIM bus access failure

Links to More Info: K10165235, BT758929

Component: TMOS

Symptoms:
Bcm56xxd daemon running on certain BIG-IP devices might experience MIIM bus access failure. The system posts a message similar to the following in the ltm log:

 info bcm56xxd: 012c0016:6: MiimTimeOut:soc_miim_write, timeout (id=0xc9 addr=0x1f data=0x0000)

Conditions:
Using one of the following platforms:
  + VIPRION B2250 Blade (A112)
  + VIPRION B2150 Blade (A113)
  + VIPRION B4300 Blade (A108)
  + BIG-IP 5250v
  + BIG-IP 7200S
  + BIG-IP 12250
  + BIG-IP i5600
  + BIG-IP i5820
  + BIG-IP i7800
  + BIG-IP i10800
  + BIG-IP i11400

Impact:
The affected BIG-IP system fails to pass traffic. If configured for high availability (HA) and the HA connection has not been disrupted, failover occurs.

Workaround:
Reboot the affected BIG-IP platform / VIPRION blade.

---

758491-6 : When using NetHSM integration, after upgrade to 14.1.0 or later (or creating keys using fipskey.nethsm), BIG-IP cannot use the keys

Links to More Info: BT758491

Component: Local Traffic Manager

Symptoms:
For Thales:
The ltm/log shows SSL handshake failures with similar lines (this is for Diffie-Hellman Key Exchange):

-- warning bigip1 tmm1[28813] 01260013 SSL Handshake failed for TCP 192.0.2.1:5106 -> 192.0.2.200:5607
-- warning bigip1 tmm1[28813] 01260009 Connection error: ssl_hs_vfy_sign_srvkeyxchg:13583: sign_srvkeyxchg (80)
-- debug bigip1 tmm1[28813] 01260036 FIPS acceleration device error: fips_poll_completed_reqs: req: 4 status: 0x1 : Cancel
-- err bigip1 pkcs11d[26259] 01680002 Key table lookup failed. error.

After enabling pkcs11d debug, the pkcs11d.debug log shows:

-- 2019-10-03 11:21:50 [6399] t00075a9a462b0000: pkcs11: 000008D9 D obj_match_attribute class CKO_PRIVATE_KEY attribute CKA_CLASS
-- 2019-10-03 11:21:50 [6399] t00075a9a462b0000: pkcs11: 000008D9 D obj_match_attribute type CKA_CLASS matches
-- 2019-10-03 11:21:50 [6399] t00075a9a462b0000: pkcs11: 000008D9 D obj_match_attribute class CKO_PRIVATE_KEY attribute CKA_ID
-- 2019-10-03 11:21:50 [6399] t00075a9a462b0000: pkcs11: 000008D9 D obj_match_attribute type CKA_ID does not match <===


For Safenet:
-- warning tmm1[17495]: 01260009:4: Connection error: ssl_hs_vfy_sign_srvkeyxchg:13544: sign_srvkeyxchg (80)
-- warning tmm1[17495]: 01260013:4: SSL Handshake failed for TCP 10.1.1.11:6009 -> 10.1.1.201:443
-- err pkcs11d[5856]: 01680002:3: Key table lookup failed. error.

Conditions:
1. Keys were created on earlier versions of BIG-IP software, no matter if using tmsh (Safenet) or using fipskey.nethsm (Thales, Safenet) and the device was upgraded to 14.1.0 or later.

2. Keys were created on BIG-IP v14.1.0 or later directly, using fipskey.nethsm (Thales). For Safenet, fipskey.nethsm was deprecated in 14.0.0.

Impact:
SSL handshake failures.

Workaround:
There are two workarounds:
-- Re-create the keys using tmsh command.

IMPORTANT: This workaround is suitable for deployments that are new and not in production.


-- Re-import the keys from nethsm using:
tmsh install sys crypto key <key_label> from-nethsm


You can find the key_label here:
-- The rightmost string in the output of the Thales command:
nfkminfo -l

-- The string after label= in the 'cmu list' command for Safenet.

---

757787-6 : Unable to edit LTM/AFM Policies that belong to an Application Service (iApp) using the WebUI.

Links to More Info: BT757787

Component: TMOS

Symptoms:
When creating a new rule or modifying an existing rule in a LTM/AFM Policy policy using the WebUI, the operation fails and an error similar to the following example is returned:

Transaction failed:010715bd:3: The parent folder is owned by application service (/Common/MyPolicy.app/MyPolicy), the object ownership cannot be changed to ().

Conditions:
-- The LTM/AFM Policy belongs to an Application Service (iApp).
-- The modification is attempted via the WebUI.

Impact:
Unable to make changes to existing LTM/AFM Policies.

Workaround:
Use the tmsh utility to make the necessary modifications to the LTM/AFM Policy. For example, the following command modifies an existing rule:

tmsh modify ltm policy myapp.app/Drafts/myapp_l7policy rules modify { 0 { conditions modify { 0 { http-method equals values { GET POST } } } } }

---

756698-1 : After upgrade, nlad may not create an schannel to a domain controller★

Links to More Info: BT756698

Component: Access Policy Manager

Symptoms:
Upgrading to v14.1.0 or later, the nlad daemon cannot create Microsoft Secure Channel (Schannel) connections to configured domain controllers after reboot. The system posts errors in the /var/log/apm logfile similar to the following:
 err eca[5290]: 0162000e:3: Failed to resolve DC FQDN (example.example.com), Name or service not known (-2).

Conditions:
-- Upgrading the BIG-IP system to v14.1.0 or later.
-- NTLM front-end authentication is configured.

Impact:
NTLM authentication might fail for APM end users. No NTLM communication to back-end Domain Controller while nlad restarts.

Workaround:
Run the following command to restart nlad:
bigstart restart nlad eca

---

755564-1 : No support of TMUI (GUI) in 1 or 2 CORE 2GB VE instance

Links to More Info: BT755564

Component: TMOS

Symptoms:
Cannot execute TMUI functions (such as activate license, configure net and LTM items etc.) because Tomcat has insufficient memory. TMUI shows the following error message:

Internal Server Error.
The server encountered an internal error or misconfiguration and was unable to complete your request.
...

Conditions:
BIG-IP Virtual Edition deployed with 1 or 2 virtual CPUs and 2 GB memory.

Impact:
You are unable to manage BIG-IP Virtual Edition using TMUI.

Workaround:
Configure more memory using the following command:

setdb Provision.Tomcat.extraMB 100

Note: Less or more extra memory might work too.

---

753712-5 : Incorrect warning: Traffic Matching Criteria's inline source address has been set to any4 from any6 to match inline destination address' address family.

Links to More Info: BT753712

Component: TMOS

Symptoms:
An incorrect warning message is given when the inline source/dest address is changed:

-- warning mcpd[6927]: 01071859:4: Warning generated : Traffic Matching Criteria's inline source address has been set to any4 from any6 to match inline destination address' address family.

Conditions:
This occurs after you create a traffic-matching-criteria (port-list, address-list) with different source and destination addresses.

Impact:
An incorrect and confusing warning message is given. This warning does not affect traffic processing. It is inadvertently triggered when reading the configuration of the traffic matching profile. Virtual servers should continue to work, and the config should load as expected, despite the warning.

Workaround:
None

---

751451-5 : When upgrading to v14.0.0 or later, the 'no-tlsv1.3' option is missing from HTTPS monitors automatically created server SSL profiles

Links to More Info: BT751451

Component: Local Traffic Manager

Symptoms:
If there are HTTPS monitor objects that were created using BIG-IP software v12.x, when the BIG-IP is upgraded directly to v14.0.0 or later, the operation automatically creates server SSL profiles for the HTTPS monitors as needed. Those server SSL profile objects do not have 'no-tlsv1.3' included in their 'options' configuration.

Conditions:
-- Having HTTPS monitors configured in v12.x before upgrading.
-- Directly upgrading from v12.x to v14.0.0 or later

Impact:
TLSv1.3 gets enabled on the server SSL profiles.

Workaround:
-- To avoid this issue, upgrade from v12.x to v13.x, and then upgrade to v14.0.0 or later


-- To mitigate this issue, modify the affected profile to disable TLSv1.3.

---

747823-3 : Drd utility can hang when generating qkview

Links to More Info: BT747823

Component: TMOS

Symptoms:
"qkview -v" shows qkview generation got stuck on qkafm.so module while executing /usr/sbin/drd:

Executing Module: [qkafm.so]
Executing /usr/bin/du -h /var/lib/mysql/logdb/ ...
Result: [0] Elapsed: 0.064386
Executing /usr/sbin/drd --readlong=/usr/sbin/readlong --all ...

Conditions:
AFM module is provisioned

Impact:
Impossible to create qkview.

Workaround:
# mount -o remount,rw /usr
# sed -i '/output.wait()/d; s/return output.stdout.readlines()/return output.communicate()[0].splitlines(True)/g' /usr/sbin/drd
# mount -o remount,ro /usr

---

745125-3 : Network Map page Virtual Servers with associated Address/Port List have a blank address.

Links to More Info: BT745125

Component: TMOS

Symptoms:
On the Local Traffic > Network Map page, some virtual servers have a blank address.

Conditions:
An address list or port list is associated with the virtual server

Impact:
The Network Map will display a blank address field.

---

743444-1 : Changing monitor config with SASP monitor causes Virtual to flap

Links to More Info: BT743444

Component: Local Traffic Manager

Symptoms:
If you change the monitor configuration for a pool or pool member to include the SASP monitor and add or remove an additional monitor (e.g., TCP), the pool members affected by this configuration change will be marked Down/Unavailable (RED) for some period of time (e.g., 5 seconds) after the change.

During this time, if all pool members are marked down, any virtual servers associated with the pool are also marked down, interrupting traffic.

Conditions:
This occurs when changing the configured monitor for a pool or pool member in one of the following ways:
1. From a SASP monitor to a SASP plus another monitor.
2. From a SASP monitor plus another monitor, to a SASP monitor.
3. From a SASP monitor plus another monitor, to a SASP monitor plus a different monitor.

Impact:
Pool members affected by the monitor change are marked down by the SASP monitor until the SASP monitor receives member weights from the SASP GWM.

If the monitor configuration change affects all pool members in a pool, any virtual servers configured to use that pool are also marked down during this period.

Workaround:
If some members of the pool are configured to use a different monitor than the other pool members, only a subset of pool members are marked down as the result of the monitor configuration change, and the corresponding virtual servers are not marked down due to the monitor configuration change.

---

742764-6 : If two racoon daemon are spawned on startup, one fails and cores.

Links to More Info: BT742764

Component: TMOS

Symptoms:
When a BIG-IP system becomes Active, tmipsecd starts a racoon daemon for each route domain, including the default RD 0.

If for any reason racoon fails to fully start, tmipsecd will start another instance of racoon.

When this occurs, one or both of them may crash and create a core file.

Conditions:
-- BIG-IP becomes Active or racoon is (re)started.
-- IPsec does not have to be configured for this failure to occur.

Impact:
IPsec IKEv1 tunnels might delay starting while racoon restarts.

Workaround:
N/A

---

740274-3 : TMM stall during startup when syslog is not listening to tmm.pipe

Links to More Info: BT740274

Component: Local Traffic Manager

Symptoms:
When TMM runs at multi-thread mode which is by default, at the startup phase, except tmm.0, all threads stall. This happens when syslog-ng does not listen on tmm.pipe (for example, syslog-ng crashed or was unable to load the configuration).

Conditions:
This issue occurs when Syslog-ng is not listening on /var/run/tmm*.pipe.

Impact:
Tmm threads stall at startup, except tmm.0.

Workaround:
Resolve problems with syslog-ng.

---

739904-5 : /var/log/ecm log is not rotated

Links to More Info: BT739904

Component: TMOS

Symptoms:
/var/log/ecm log is not rotated.

Conditions:
Log file /var/log/ecm exists in the /var/log directory.

Impact:
Log rotate does not work. May fill disk with logs over time.

Workaround:
Use tmsh sys log-rotate command to modify the logrotate settings to add /var/log.ecm.
The syntax is:
tmsh modify sys log-rotate common-include '"
/var/log/ecm {
compress
missingok
notifempty
}"'

---

739553-6 : Setting large number for Wide IP Persistence TTL breaks Wide IP persistence

Links to More Info: BT739553

Component: Global Traffic Manager (DNS)

Symptoms:
Wide IP persistence is not working. Previous Wide IP persistence records are cleared.

Conditions:
This occurs when the Wide IP Persistence TTL plus the persist-record creation time is greater than 4294967295.

Impact:
Wide IP persistence does not work.

Workaround:
There is no workaround other than not setting Wide IP Persistence TTL to a number greater than 4294967295.

---

739475-8 : Site-Local IPv6 Unicast Addresses support.

Links to More Info: BT739475

Component: Local Traffic Manager

Symptoms:
No reply to Neighbor Advertisement packets.

Conditions:
Using FE80::/10 addresses in network.

Impact:
Cannot use FE80::/10 addressees in network.

Workaround:
None

---

739118-7 : Manually modifying a self IP address in bigip_base.conf file and reloading the configuration results in routing misconfiguration

Links to More Info: BT739118

Component: TMOS

Symptoms:
Changing existing self IP addresses in bigip_base.conf file directly. After uploading the changed configuration file, BIG-IP routing service provides out of date Self IP route information to dependent services.

Conditions:
- Self IP address is configured on the BIG-IP system.
- Manually change the IP address of a self IP in bigip_base.conf file.
- Load changed configuration via tmsh.

Impact:
Different services have different route information:
-- tmsh table - has the old route.
-- Dynamic routing - hHas the old and new routes.
-- Kernel table - has the new route.

Workaround:
There are two workarounds, preventive and corrective.
Preventive:
Do not manually change self IP addresses in bigip_base.conf file. It is not recommended way to add/change BIG-IP configuration. Use GUI or tmsh instead.

Corrective:
If the altered BIG-IP configuration file has already been loaded, then use the GUI or tmsh, to delete the changed self IP address, and then create a self IP address with old IP address and delete it as well. Now, all the affected routes should be removed.

---

738547 : SAML Sax Parser returns error when importing metadata file that contains certain UTF-8 encoded characters other than ASCII

Links to More Info: BT738547

Component: Access Policy Manager

Symptoms:
When SAML metadata file that contains certain UTF-8 characters other than ASCII is imported, SAML SAX Parser returns error

Conditions:
When SAML metadata file contains certain UTF-8 characters other than the ASCII set,

Impact:
SAML metadata file is not imported, and the system reports an error. SAML configuration on BIG-IP systems is impacted.

Workaround:
Remove the non-ASCII UTF-8 characters, and try the import operation again.

---

725646-9 : The tmsh utility cores when multiple tmsh instances are spawned and terminated quickly

Links to More Info: BT725646

Component: TMOS

Symptoms:
A tmsh core occurs when multiple tmsh instances are spawned and terminated quickly

/var/log/kern.log:
info kernel: tmsh[19017]: segfault ...

system messages in /var/log/messages:
notice logger: Started writing core file: /var/core/-tmsh ...

/var/log/audit:
notice -tmsh[19010]: 01420002:5: AUDIT - pid=19010 ...

Conditions:
This issue occurs intermittently in the following scenario:

1. Open multiple instances of tmsh using the following command pattern:
tmsh
run util bash
tmsh
run util bash
tmsh
run util bash
tmsh
run util bash
...
2. Quickly terminate them using Ctrl-D or by closing terminal.

Impact:
The tmsh utility crashes and produces a core file in the /shared/core directory. The BIG-IP system remains operational.

Workaround:
Restart tmsh if the problem occurs.

To prevent the issue from occurring: Do not quickly terminate tmsh instances using Ctrl-D.

---

721892-3 : Pfmand on vCMP guests does not recover after service interruption

Links to More Info: BT721892

Component: TMOS

Symptoms:
If pfmand on a vCMP host shuts down and starts back up, pfmand running on any of the vCMP guests loses connection and does not recover.

Conditions:
- vCMP host and guest(s) both have pfmand.healthstatus set to "enable"
- pfmand on the host shuts down and starts up again. This can sometimes occur due to re-licensing on the host.

Impact:
Pfmand on vCMP guests loses connection:

warning pfmand[20332]: 01660005:4: No connection to hypervisor.

Workaround:
Rebooting the vCMP host will allow the pfmand connection to be be re-established.

---

721591-3 : Java crashes with core during with high load on REST API

Links to More Info: K000141369, BT721591

Component: TMOS

Symptoms:
Java crashes with core.

Conditions:
This is a random crash and there are no known conditions for reproducing it.

Impact:
This crash occurs randomly during normal operation and has following impact:
-- Stats are not available.

Workaround:
-- Restart the Java service with "bigstart restart restjavad" or "tmsh restart sys service restjavad".
-- Restart the BIG-IP system.

---

718796-8 : iControl REST token issue after upgrade★

Links to More Info: K22162765, BT718796

Component: Device Management

Symptoms:
When upgrading to version 13.1.0.x or later, users who previously had permissions to make calls to iControl REST lose the ability to make those calls.

Conditions:
You will notice this issue when you use iControl REST and are upgrading to version 13.1.0.x or later.

You can also detect if the user is impacted by this issue with the following steps

    1. Run below API to for impacted user account XYZ.

         # curl -ik -u username:XYZ -XPOST https://localhost/mgmt/shared/authn/login --data-binary '{"username":"XYZ", "password":"XYZpass", "loginProviderName":"tmos"}' -H "Content-Type: application/json"

    2. Find user XYZ's 'link' path under 'token' in previous output

       There are two formats possible for 'link'
       a. Path will have a UUID
          For example "token"->"link"->"https://localhost/mgmt/cm/system/authn/providers/tmos/1f44a60e-11a7-3c51-a49f-82983026b41b/users/<UUID>"

       b. Path will have a username (not UUID)
          For example "token"->"link"->"https://localhost/mgmt/shared/authz/users/<username>"

    3. Run below API to get list of user roles.

         # restcurl -u "admin:<admin-user-pass>" /shared/authz/roles | tee /var/tmp/rest_shared_authz_roles.json

    4. Check user XYZ's link path from step 2 in above output.

       Check under the "userReferences" section for group "iControl_REST_API_User" . You will see the link path in one of the two formats listed in 2a/2b. If you do not see the user link path then you are impacted by this bug

Impact:
A previously privileged user can no longer query iControl REST. In addition, some remotely authenticated users may lose access to the Network Map and Analytics view after the upgrade.

Workaround:
You can repair the current users permissions with the following process:

   1) Delete the state maintained by IControlRoleMigrationWorker and let it rerun by restarting restjavad process:
      # restcurl -X DELETE "shared/storage?key=shared/authz/icontrol-role-migrator"
     
   2) Restart services
      # bigstart restart restjavad *or* tmsh restart /sys service restjavad

   3) Now, the permissions should start in a healthy state. Re-try making an iControl REST call with an affected user.

   4) If this still does not resolve the issue you could update shared/authz/roles/iControl_REST_API_User userReference list to add all affected users' accounts using PUT. Here you may need to use the UUID path as described under 'Conditions'

      # restcurl shared/authz/roles/iControl_REST_API_User > role.json
      # vim role.json
          a. add { "link": "https://localhost/mgmt/shared/authz/users/[your-user-name]" } object to userReferences list
          OR
          b. add { "link": "https://localhost/mgmt/cm/system/authn/providers/tmos/1f44a60e-11a7-3c51-a49f-82983026b41b/users/<UUID>" } object to userReferences list
      # curl -u admin:admin -X PUT -d@role.json http://localhost/mgmt/shared/authz/roles/iControl_REST_API_User

---

717174-6 : WebUI shows error: Error getting auth token from login provider★

Links to More Info: BT717174

Component: TMOS

Symptoms:
Occasionally, the BIG-IP Admin Utility TMUI fails to function correctly and produces the following error:
Error getting auth token from login provider.

This occurs when the BIG-IP REST Daemon restjavad fails to start up properly.

Conditions:
This error most often occurs on the first or second boot after upgrade, and more often on Virtual Edition BIG-IP platforms running on oversubscribed or slow hypervisors.

Impact:
TMUI and any other BIG-IP system components that rely on REST Workers such as: OpenID Connect key rotation discovery, portions of the TMOS Web Configuration Utility, and Guided Configuration (AGC and WGC) fail to function properly.

Workaround:
Restarting the BIG-IP REST daemons restjavad and restnoded will usually correct the problem. To do so, connect to the SSH console and issue the following two commands:

bigstart restart restjavad
bigstart restart restnoded

---

716140-5 : Information in snmpd.conf files may be overwritten causing SNMP v3 queries to recieve 'Unsupported security level' errors

Links to More Info: BT716140

Component: TMOS

Symptoms:
During daemon startup, the snmpd daemon zeroes out sensitive data in the snmpd.conf files. This is done so that passwords are not available to be read on disk. This can cause problems when other daemons using the net-snmp shared libraries access snmpd.conf files for data that they need during startup.

If you have 'zeroed out' data under /config/net-snmp/snmpd.conf, the system reports 'Unsupported security level' errors in response to SNMP v3 query, for example:

snmpget -v 3 -u testuser -a SHA -A "testuser" -x AES -X "testuser" -l authPriv localhost sysSystemUptime.0
snmpget: Unsupported security level (Sub-id not found: (top) -> sysSystemUptime)

Conditions:
Custom SNMP v3 users created and exist in /config/net-snmp/snmpd.conf 'zeroed out' data:

Example from /config/net-snmp/snmpd.conf where user 'testuser' has some data that is 'zeroed out' (0x 0x):

  usmUser 1 3 0x80001f88808047605278d46d5b "testuser" "testuser" NULL .1.3.6.1.6.3.10.1.1.1 0x .1.3.6.1.6.3.10.1.2.1 0x 0x

Impact:
Daemons usually start in an orderly fashion and usually do not conflict with each other. However, it is possible that they might fail to load correctly due to the zeroing out of data.

For example this can cause SNMP v3 access errors for users with 'zeroed out' data under /config/net-snmp/snmpd.conf:

  snmpget -v 3 -u testuser -a SHA -A "testuser" -x AES -X "f5testuser" -l authPriv localhost sysSystemUptime.0.
  
  snmpget: Unsupported security level (Sub-id not found: (top) -> sysSystemUptime).

Workaround:
Use tmsh to configure SNMP users.

---

714705-9 : Excessive 'The Service Check Date check was skipped' log messages.

Links to More Info: BT714705

Component: TMOS

Symptoms:
Large numbers of these warnings are logged into the "ltm" file:

  warning httpd[12345]: 0118000a:4: The Service Check Date check was skipped.

The message appears whenever a new "httpd" instance is launched.

Conditions:
The BIG-IP instance has been installed with a "no service check" license. These licenses are sometimes provided with cloud pre-licensed VE software images.

Impact:
Log files are saturated with many useless warnings. This can hide actual problems and impede their diagnosis.

Workaround:
During manual troubleshooting, commands such as the following may be used to filter the excess warnings:

# grep -v 'Service Check Date check was skipped' ltm | less

The syslog-ng 'include' filter mechanism is another possibility, but this should be attempted only with assistance of the F5 Support team.

---

712925-4 : Unable to query a monitor status through iControl REST if the monitor is in a non-default partition

Links to More Info: BT712925

Component: TMOS

Symptoms:
It is not possible to query a monitor status through iControl REST if the monitor is in a non-default partition.

If the monitor is in the /Common partition it is possible to obtain the monitor status with following command:

[root@TEST_UNIT:Active:Disconnected] config # restcurl -u admin:admin /mgmt/tm/ltm/monitor/http/~Common~myHttpMonitor/stats
{
  "kind": "tm:ltm:monitor:http:httpstats",
  "generation": 0,
  "selfLink": "https://<localhost path>",
  "apiRawValues": {
    "apiAnonymous": "------------------------------------＼n LTM::Monitor /Common/myHttpMonitor ＼n------------------------------------＼n Destination: <IP address:port>＼n State time: down for 113hrs:38mins:54sec＼n | Last error: No successful responses received before deadline. @2023.09.21 22:56:54＼n＼n"
  }
}


If the monitor is in a non-default partition, the iContol REST interface returns a "404 - Object not found" error:

[root@TEST_UNIT:Active:Disconnected] config # restcurl -u admin:admin /mgmt/tm/ltm/monitor/http/~p1~myHttpMonitor/stats
{
  "code": 404,
  "message": "Object not found - /p1/myHttpMonitor",
  "errorStack": [],
  "apiError": 1
}

Conditions:
- A monitor is configured in a non-default partition

- Querying the status of the monitor in non-default partition using iControl REST

Impact:
It is not possible to query a monitor status through iControl REST if the monitor is in a non-default partition.

Workaround:
Use tmsh to query the status of the monitor.
Following is an example:

root@(TEST_UNIT)(cfg-sync Disconnected)(Active)(/Common)(tmos)# cd /p1
root@(TEST_UNIT)(cfg-sync Disconnected)(Active)(/p1)(tmos)# show ltm monitor http myHttpMonitor
----------------------------------
 LTM::Monitor /p1/myHttpMonitor
----------------------------------
   Destination: <IP address:port>
   State time: down for 1hr:20mins:5sec
   | Last error: No successful responses received before deadline. @2023.09.26 15:21:17

---

701341-5 : If /config/BigDB.dat is empty or the file is corrupt, mcpd continuously restarts

Links to More Info: K52941103, BT701341

Component: TMOS

Symptoms:
If an issue causes /config/BigDB.dat to be empty or its contents become corrupted, mcpd fails to start up.

System commands report errors about being unable to read DB keys. 'bigstart' outputs errors:

--dbval: Unable to find variable: [security.commoncriteria]

Conditions:
The event causing BigDB.dat to be truncated is unknown at this time.

Impact:
The system fails to start up, and mcpd continually restarts. The BIG-IP system fails to process traffic while the mcpd process is restarting.

Workaround:
To work around this issue, you can remove the empty or corrupted BigDB.dat file. To do so, perform the following procedure:

Impact of workaround: Performing the following procedure should not have a negative impact on your system.

1. Log in to bash.
2. To remove the zero-byte or corrupted BigDB.dat file, type the following command:
rm /config/BigDB.dat

---

696363-8 : Unable to create SNMP trap in the GUI

Links to More Info: BT696363

Component: TMOS

Symptoms:
Trying to create a SNMP trap may fail in the GUI with the following error message: An error has occurred while trying to process your request.

Conditions:
-- Trap destinations are configured using the GUI: When trap destinations are configured in the GUI, the trap name is generated using the destination IP address.
-- Traps of the same destination address were previously created and deleted.

Impact:
GUI parameter checking does not work as expected. BIG-IP Administrator is unable to create a SNMP trap session.

Workaround:
To work around this issue when using the GUI, remove all traps that have the same destination address as the new one that failed. Then re-add your destination.

Tip: You can use tmsh to create/delete/modify SNMP traps, which enables viewing of the generated names, making it easier to understand what error has occurred.

---

694765-8 : Changing the system's admin user causes vCMP host guest health info to be unavailable

Links to More Info: BT694765

Component: TMOS

Symptoms:
On the host, 'tmsh show vcmp health' does not display guest info.

The iControl REST log at /var/log/icrd contains entries similar to the following:

 notice icrd_child[32206]: 01420003:5: Cannot load user credentials for user "admin" Current session has been terminated.

Conditions:
The default admin user "admin" has been changed.

Note: You changed the default admin user by following the steps in the Article K15632: Disabling the admin and root accounts using the BIG-IP Configuration utility or the Traffic Management Shell: https://my.f5.com/manage/s/article/K15632.

Impact:
Many REST APIs do not function, and functionality such as vCMP guest health that depend on REST fails.

Workaround:
Rename the default system admin back to 'admin':
tmsh modify /sys db systemauth.primaryadminuser value admin

Note: If you are using the default 'admin' account, make sure you change the password as well.

---

673060-1 : SSL handshake failure with Session Ticket enabled on the backend server

Links to More Info: BT673060

Component: Local Traffic Manager

Symptoms:
SSL handshake failure occurs as a certificate is not issued (no certificate).

Conditions:
- Server SSL profile is enabled with the Session Ticket feature
- Backend server also supports Session Ticket

Impact:
- Service is disrupted because of a handshake failure.
- SSL handshake fails with no certificate issue.

Workaround:
Disable the Session Ticket feature on the Server SSL Profile or the backend server.

---

669934-5 : Session commands may not work correctly in FLOW_INIT event.

Links to More Info: BT669934

Component: Local Traffic Manager

Symptoms:
Data read or write via session-related commands (e.g., table) in an iRule's FLOW_INIT event does not match that in other events.

Conditions:
This occurs when using session-related commands from FLOW_INIT event.

Impact:
iRule does not function as expected.

Workaround:
None.

---

666845-5 : Rewrite plugin can accumulate memory used for patching very large files

Links to More Info: K08684622, BT666845

Component: Access Policy Manager

Symptoms:
Rewrite plugin memory usage is significantly higher than normal (up to 200 MB RSS) and does not decrease.

Conditions:
This happens because the plugin caches and reuses already allocated chunks of memory instead of releasing them to the operating system.

Impact:
Out-of-memory crashes on systems with low amounts of memory.

Workaround:
Use one or both of the following workarounds:
-- Restart rewrite when memory usage is too high.
-- Disable patching for large (15-20 MB uncompressed) files.

---

659579-7 : Timestamps in icrd, restjavad, and restnoded logs are not synchronized with the system time

Links to More Info: BT659579

Component: TMOS

Symptoms:
Logs on icrd, restnoded, and restjavad are in the UTC time zone and are not aligned to the system time, which makes it difficult to determine the time during troubleshooting operations.

Conditions:
Checking the icrd, restnoded, and restjavad logs timestamps.

Impact:
Difficult to troubleshoot as the logs are not aligned with system time.

Workaround:
None

---

658943-7 : Errors when platform migration process is loading UCS using trunks on vCMP guest/F5OS Tenants

Links to More Info: BT658943

Component: TMOS

Symptoms:
During the platform migration from a physical BIG-IP system to a BIG-IP vCMP guest/F5OS Tenant, the load fails with one of the following messages:

01070687:3: Link Aggregation Control Protocol (LACP) is not supported on this platform. Unexpected Error: Loading configuration process failed.

01070338:3: Cannot create trunk [name of trunk], maximum limit reached Unexpected Error: Loading configuration process failed.

Conditions:
-- The source device is a physical BIG-IP device with one or more trunks with or without LACP in its configuration.
-- The destination device is a vCMP guest/F5OS Tenant.

Impact:
The platform migration fails and the configuration does not load.

Workaround:
You can use one of the following workarounds:

-- Remove all trunks from the source configuration prior to generation of the UCS.

-- Before loading the UCS archive onto the target BIG-IP, edit the archive and remove the trunk configuration from ./config/bigip_base.conf, and then repack the UCS.

-- After the UCS load fails, edit the configuration manually on the destination to remove trunk references, and then reload the configuration.

-- K50152613

---

652877-9 : Reactivating the license on a VIPRION system may cause MCPD process restart on all secondary blades

Links to More Info: BT652877

Component: TMOS

Symptoms:
All services on one or all secondary blades in a VIPRION chassis restart, and MCPD logs errors similar to the following:

-- err mcpd[9063]: 01070734:3: Configuration error: DB validation exception, unique constraint violation on table (sflow_vlan_data_source) object ID (1168). A duplicate value was received for a non-primary key unique index field. DB exception text (Cannot update_indexes/checkpoint DB object, class:sflow_vlan_data_source status:13)
-- err mcpd[9063]: 01070734:3: Configuration error: Configuration from primary failed validation: 01070734:3:Configuration error: DB validation exception, unique constraint violation on table (sflow_vlan_data_source) object ID (1168). A duplicate value was received for a non-primary key unique index field. DB exception text (Cannot update_indexes/checkpoint DB object, class:sflow_vlan_data_source status:13)... failed validation with error 17237812.

In versions prior to v11.6.0, the error is: 'Can't save/checkpoint DB object,' rather than 'Can't update_indexes/checkpoint DB object'.

Conditions:
Multi-bladed VIPRION system, where the 'if-index' value for VLANs differs between blades.

You can check the 'if-index' value by running the following command on each blade: tmsh list net vlan all if-index.

Impact:
MCPD restart on all secondary blades results in partial service outage.

Workaround:
Reactivate the license only on a system that is standby/offline.

---

638863-1 : Attack Signature Detected Keyword is not masked in the logs

Links to More Info: BT638863

Component: Application Security Manager

Symptoms:
Attack Signature Detected Keyword is not masked in the logs

Conditions:
When the signature is matching a full request, and there is a sensitive keyword around the signature location, in some cases the signature appears in the logs and is not masked.

Impact:
Sensitive data may appear in the logs

Workaround:
None

---

637827-1 : VADC: after re-deploying a single-nic VM with multiple nics, a load can fail due to stp member 1.0

Links to More Info: BT637827

Component: TMOS

Symptoms:
The configuration fails to load with the following message:

01070523:3: No Vlan association for STP Interface Member 1.0
Unexpected Error: Loading configuration process failed.

Conditions:
In single-nic mode, the interface 1.0 exists and can be saved as a VLAN member. Upon re-deploying the virtual-machine from single nic mode to multi-nic, the 1.0 interface becomes pending and should no longer impact any configuration. However, a condition exists after a VLAN delete, where the associated (automatically created) stp member is not removed from the running config and can cause a load error.

Impact:
Load fails and requires manual intervention. Otherwise, the STP member is benign because vADC does not support STP.

Workaround:
Remove the STP interface member 1.0 and reload.

---

634576-4 : TMM core in per-request policy

Links to More Info: K48181045, BT634576

Component: Access Policy Manager

Symptoms:
TMM might core in cases when per-request policy encounters a reject ending and the server-side flow is not available.

Conditions:
APM or SWG per-request policy with reject ending.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None.

---

632553-7 : DHCP: OFFER packets from server are intermittently dropped

Links to More Info: K14947100, BT632553

Component: Local Traffic Manager

Symptoms:
With a DHCP relay virtual server, OFFER packets from DHCP server are intermittently not forwarded to the client and dropped on BIG-IP system.

Conditions:
It is not known exactly what triggers this condition, but it occurs intermittently when the DHCP relay virtual server is in use.

Impact:
Client machines joining the network do not receive DHCP OFFER messages.

Workaround:
Manually delete the serverside to force it to be recreated by the next DHCP request.

For example, if the flow to the DHCP server 10.0.66.222 is broken, issue the following tmsh command:

tmsh delete sys connection ss-server-addr 10.0.66.222 cs-server-port 67

---

609878-8 : Bad ACK Flood is not detected by AFM when loose-init is enabled on the virtual server

Links to More Info: BT609878

Component: Advanced Firewall Manager

Symptoms:
When loose-init is set, which has the implicit semantics of "every ACK packet can create a connection". Hence, there is never a "Bad ACK" to drop. This behavior is expected as per design, so while enabling this option one should aware of the side effects it will cause.

Conditions:
This issue will be seen when loose-init is enabled on the fastL4 profile and when the box is flooded with asymmetric ACK packets (or) Bad-Acks.

Impact:
Enabling loose initiation may make it more vulnerable to denial of service attacks.

Workaround:
When loose-init is set in the fastL4 profile, also turn on connection-limits on the virtual and also Eviction Policy to prevent flow-table exhaustion.

---

603380-10 : Very large number of log messages in /var/log/ltm with ICMP unreachable packets.

Links to More Info: BT603380

Component: Local Traffic Manager

Symptoms:
With ICMP unreachable packets, every packet generates a log message in /var/log/ltm. This results in a very large number of log messages, which takes up space without providing additional information.

Conditions:
You have a DNS virtual server with DNS resolver cache configured. The virtual server receives ICMP unreachable in response to the DNS query.

Impact:
You will see messages similar to the following in /var/log/ltm.

   err tmm[5021]: comm_point_tmm_recv_from failed: Software caused connection abort

Workaround:
None.

---

566756-1 : VCMP 4 cores on 3 blades : mcpd core when delete 255 dos profiles via tmsh command while machine is idle

Links to More Info: BT566756

Component: TMOS

Symptoms:
Mcpd crashes.

Conditions:
1.create 4 cores vcmp guest on vic 1+ with 3 blades
This platform has 15GB of mem
2. provision asm + ltm + AVR +FPS
3. create via script 255 dos profiles ( script attached)
4. delete it via tmsh command : delete security dos profile dos_*
5. result : Sometimes MCPD will crash

Impact:
Traffic and control plane disrupted while mcpd restarts.

Workaround:
None

---

563144-4 : Changing the system's admin user causes many errors in the REST framework.

Links to More Info: BT563144

Component: Device Management

Symptoms:
The iControl REST log at /var/log/icrd will have entries similar to the following:

 notice icrd_child[32206]: 01420003:5: Cannot load user credentials for user "admin" Current session has been terminated.

Conditions:
Change the default admin user, for example, by following the steps in the Article K15632: Disabling the admin and root accounts using the BIG-IP Configuration utility or the Traffic Management Shell: https://support.f5.com/csp/article/K15632.

Impact:
Many REST APIs do not function, and functionality that depends on REST fails.

Workaround:
There is no workaround. You must use the default admin in order for iControl REST calls to work.

---

554506-4 : PMTU discovery from the management interface does not work

Links to More Info: K47835034, BT554506

Component: TMOS

Symptoms:
Network connectivity issues to the BIG-IP management interface.

The management interface 'auto lasthop' feature (not to be confused with the auto lasthop setting on a virtual server) allows the BIG-IP to route responses to packets received on the management interface back to the MAC address of the layer-3 device that sent them, removing the need for static management-routes to be configured on the BIG-IP for communication beyond the management subnet.

The operation of the lasthop module interferes with the management interface's ability to dynamically learn Path MTU (PTMU) through ICMP unreachable messages.

Conditions:
The MTU on one section of the network path between a client device and BIG-IP management interface is lower than the BIG-IP management interface's configured MTU (for example, part of the path passes through a tunnel), and an intermediary router is sending 'ICMP unreachable, fragmentation required' packets back to the BIG-IP to instruct it to send smaller datagrams.

Impact:
Unable to complete a TLS handshake to the management interface IP, or other similar operations that require large frames.

Workaround:
BIG-IP management interface auto lasthop functionality can be disabled to allow the interface to function normally.

For more information see K52592992: Overview of the Auto Last Hop feature on the management interface, available at
https://support.f5.com/csp/article/K52592992.

---

539648-5 : Disabled db var Watchdog.State prevents vCMP guest activation.

Links to More Info: K45138318, BT539648

Component: TMOS

Symptoms:
If a vCMP guest user disables the watchdog using the db variable Watchdog.State, then the vCMP guest does not reach a running state as reported by the vCMP host.

Conditions:
This occurs when the user sets sys db Watchdog.State value disable.

Impact:
vCMP guest fails to be operational.

Workaround:
Do not change the Watchdog.State db variable. The vCMP host requires the watchdog to monitor the guest health.

---

538283-7 : iControl REST asynchronous tasks may block other tasks from running

Links to More Info: BT538283

Component: TMOS

Symptoms:
If an iControl REST asynchronous task is running, other iControl REST queries (synchronous or asynchronous) will wait until the asynchronous task completes before executing. If the asynchronous task is long-running, subsequent requests will block for a long time.

Conditions:
-- Executing an iControl REST task asynchronously.
-- Performing further iControl REST tasks (synchronous or asynchronous) while the asynchronous task is still running.

Impact:
Potential (and unexpected) long wait times while running a task asynchronously.

Workaround:
None.

---

527119-10 : An iframe document body might be null after iframe creation in rewritten document.

Links to More Info: BT527119

Component: Access Policy Manager

Symptoms:
Cannot use certain page elements (such as the Portal Access menu) in Google Chrome, and it appears that JavaScript has not properly initialized, and results in JavaScript errors on the following kinds of code:
    iframe.contentDocument.write(html)
    iframe.contentDocument.close()
    <any operation with iframe.contentDocument.body>

Conditions:
-- The body of a dynamically created iframe document might be initialized asynchronously after APM rewriting.

-- Using the Chrome browser.

Impact:
Some JavaScript applications might not work correctly when accessed through Portal Access. For example, one of applications known to contain such code and fail after APM rewriting is TinyMCE editor.

Workaround:
Revert rewriting of the document.write call with a post-processing iRule.

The workaround iRule will be unique for each affected application.

---

499348-15 : System statistics may fail to update, or report negative deltas due to delayed stats merging.

Links to More Info: BT499348

Component: TMOS

Symptoms:
Under some conditions, the BIG-IP system might fail to report statistics over time. This can manifest as statistics reporting unchanging statistics (e.g., all zeroes (0)), or as sudden spikes in traffic, or as negative deltas in some counters.

The system performance graphs will also appear to have gaps / be missing data at the times that this occurs.

Conditions:
This occurs when there are frequent changes occurring to the underlying statistics data structures. This might occur under the following conditions:

-- The system is spawning/reaping processes on a frequent basis (e.g., when there is a large number of external monitors).

-- iRules are frequently using 'SSL::profile' to select different SSL profiles on a virtual server (this can cause per-virtual server, per-profile statistics to be created and deleted on a regular basis).

Impact:
Statistics fail to merge, which results in incorrect view of system behavior and operation.

Workaround:
This issue has two workarounds:

1. Reduce the frequency of changes in the statistics data structures. The specific action to take depends on what is triggering them. To do so, use any or all of the following:

 -- Reduce the frequency of configuration changes.
 -- Reduce the use of 'SSL::profile' in iRules.
 -- Reduce the number/frequency of processes being spawned by the system.

2. The second workaround has two parts:

a) Switch statistics roll-ups to the 'slow_merge' method, which causes the system to spend more CPU merging statistics. To do so, set the 'merged.method' DB key to 'slow_merge' using the following command:

    tmsh modify sys db merged.method value slow_merge

b) Change the merge-interval value to 2 to reduce CPU usage when merge-method is slow-merge.

    tmsh modify /sys db merged.merge.interval {value "2"}

Note: Performing the second workaround has the side-effect of disabling tmstat snapshots on the device. The tmstat snapshots are intended for F5-internal use only: the lack of snapshots will have no bearing on the functionality of your system; however, F5 Support might be impacted in their ability to troubleshoot issues on your system.

---

490139-8 : Loading iRules from file deletes the last few comment lines

Links to More Info: BT490139

Component: Local Traffic Manager

Symptoms:
Loading iRules from the iRules file deletes the last few comment lines immediately preceding the closing bracket.

Conditions:
This occurs when loading an iRule file containing a comment after the last closing brace and then upgrading to a known affected version

Impact:
Although the comments are removed, this does not affect iRule functionality.

Workaround:
Add comments in places other than immediately above the closing bracket.

---

385013-8 : Certain user roles do not trigger config sync for the 'modify auth password' command

Component: TMOS

Symptoms:
If users with the certain roles change their password, the BIG-IP system does not detect that it is out-of-sync with its peer and does not trigger an automatic sync:

Conditions:
-- Multiple BIG-IP devices in a Device Service Cluster that sync configurations with each other.
-- A user with one of the following roles logs in and changes their password:
  + guest
  + operator
  + application-editor
  + manager
  + certificate-manager
  + irule-manager
  + resource-admin
  + auditor
  + administrator

Impact:
The system does not detect that it is out of sync with its peer, and does not report this condition. If automatic sync is enabled, a sync does not automatically occur.

Workaround:
Force a full config sync to the peer systems.

---

349706-5 : NetworkAccess assigns 1.1.1.1 address to remote ppp endpoint APM VPN

Component: Access Policy Manager

Symptoms:
Network access sends 1.1.1.1 as X-VPN-serer-IP and Edge client reserves this IP for PPP communication with APM server.

Conditions:
-- VPN is configured on BIG-IP.
-- Edge Client/webtop is used to connect to VPN.

Impact:
If VPN is connected:
1. The user may not access the 1.1.1.1 address from the client machine.
2. if 1.1.1.1 is used as a dns server ip in Network Access configuration, DNS resolution may fail on the client machine.

Workaround:
NA

---

213618-3 : Resetting DB variable to default does not always work

Component: TMOS

Symptoms:
When using the 'reset-to-default' option to set a DB variable to its default value, the DB variable may appear to be reconfigured for its default value, but the new value may not have any functional effect.

For example, if the DB variable 'log.mcpd.level' is configured with a value of 'debug', then the command 'tmsh mod sys db log.mcpd.level reset-to-default', the DB variable 'log.mcpd.level' will display a value of 'notice', but mcpd will continue logging at 'debug' level.

Conditions:
This may occur when:
-- A system DB variable is configured with a non-default value.
-- A command is issued to reset that DB variable to its default value using the following syntax:
  -- from a tmsh prompt:
     'modify /sys db <variable.name> reset-to-default'
  -- from a bash prompt:
     'tmsh modify sys db <variable.name> reset-to-default'

Impact:
The intended change in the system DB variable value does not have the desired effect.
For example, if system DB variable controlling logging levels is changed from 'debug' (or other verbose logging level) to its default (non-debug) value, debug logging continues, which may fill the file system unexpectedly and result in system failures.

Workaround:
To ensure that:
-- BIG-IP daemons implement the behavior expected by changing the system DB variable to its default value, and
-- The saved BIG-IP configuration reflects that the system DB variable is no longer configured with a non-default value,

Issue two commands to (1) explicitly configure the system DB variable to the desired value, and (2) make system DB variable as being configured with its default value, using the following format:
  -- from a tmsh prompt:
     'modify /sys db <variable.name> value <desired_value>'
     'modify /sys db <variable.name> reset-to-default'
  -- from a bash prompt:
     'tmsh modify sys db <variable.name> value <desired_value>'
     'tmsh modify sys db <variable.name> reset-to-default'

---

2131597-1 : BGP graceful restart might not accept a new connection immediatelly post neighbor failover.

Links to More Info: BT2131597

Component: TMOS

Symptoms:
When remote peer restarts and BGP graceful restart mechanism was advertised and received, BIG-IP might not immediately accept a new connection from a restarting peer.

Conditions:
- BGP graceful restart mechanism was advertised and received.
- Remote peer restarting.

Impact:
New connection might take longer to establish.

Workaround:
You can work the problem around by making sure BIG-IP local router-ID is lower than re-connecting peer ID.

---

2130729-2 : HTTP::respond not working properly with HTTP3/quic - content not sent

Links to More Info: BT2130729

Component: Local Traffic Manager

Symptoms:
irule for http/3 virtual server with
HTTP::respond that includes content will not send the content

Conditions:
The header sent to the client does indicate content with a content-length above 0
* Request completely sent off
< HTTP/3 200
< content-type: text/html
< server: BIG-IP
< content-length: 179

But no content is sent and the connection is terminated abnormally.

Impact:
Not able to use HTTP::respond with content

Workaround:
None

---

2130329-2 : [GTM] Deletion of topology records makes MCPD memory ramp up

Links to More Info: BT2130329

Component: Global Traffic Manager (DNS)

Symptoms:
The MCPD memory ramp-up might result in being killed by sod or out of memory.

Conditions:
Delete thousands of GTM topology records in a short period of time, and the full GTM sync is triggered.

Impact:
The MCDP memory is stuck or being killed by sod.

Workaround:
Do not delete a large number of GTM topology records in a short period of time.

---

2077553-2 : SIP message in quote containing special character after two backslashes will be generate a SIP error message

Links to More Info: BT2077553

Component: Service Provider

Symptoms:
Tmm resets connections with "SIP parser error (Illegal value)"

Conditions:
In the SIP message sent by the client, there is a string in quotes that contains two backslashes followed by a UTF8 character.

Impact:
Rejection of valid SIP message

Workaround:
Encode all characters with %
as in
%D0%A4%5C%5C%D0%A9%20
instead of
"Ф＼＼Щ "

---

2077525-2 : Incomplete or missing IP Intelligence databases result in connection reset, high TMM CPU usage and/or TMM crash

Links to More Info: BT2077525

Component: Advanced Firewall Manager

Symptoms:
Both of the following messages are frequently (several times per second) logged to /var/log/tmm*:
  <13> Sep 24 09:55:01 bigip1 notice Failed to open /var/IpRep/F5IpRep.dat
  <13> Sep 24 09:55:01 bigip1 notice Failed to open /var/IpRep/F5IpV6Rep.dat

Possible tmm SIGABRT

Conditions:
ip-intelligence is configured, and both IP intelligence databases are missing.

Impact:
A frequent log message might slow TMM.

This might result in TMM missing a heartbeat, which will trigger a tmm SIGABRT. Traffic is interrupted while TMM generates a core file and restarts.

Workaround:
Unconfigure ip-intelligence or ensure that the ip-intelligence databases are available.

---

2077357-1 : Virtual-wire with proxy listener may generate packets with 00:00:00:00:00:00 source MAC.

Links to More Info: BT2077357

Component: Local Traffic Manager

Symptoms:
In a case where a proxy listener intercepts traffic going over a virtual-wire and there is no server-side traffic (TCP re-transmit timeout), a RST generated towards the server might have 00:00:00:00:00:00 source MAC.

Conditions:
Proxy listener intercepts traffic going over a virtual-wire.
There is no server-side traffic for the flow.

Impact:
RST might not be delivered to the server.

Workaround:
None

---

2077329-2 : IBD profile is injecting the Javascript tag in non html pages

Links to More Info: BT2077329

Component: Bot Defense

Symptoms:
Setup IBD profile
Set up a backend server to serve js file with some HTML tags in string format

Example Javascript
function PrintPreview(htmlpage) {
    var page = "<script>function Print(){window.document.getElementById(＼"printtool＼").setAttribute(＼"style＼",＼"display:none＼");window.print();window.document.getElementById(＼"printtool＼").setAttribute(＼"style＼",＼"＼");}; function Close(){close();}</script>";
    htmlpage = "<html><head></header><body>" +htmlpage+ scp+ "</body></html>";
    myWindow.document.write(htmlpage);
     
}

Able to see js tags injected with non html pages with content-type= application/javascript in response

Conditions:
Virtual server with the IBD profile and a Javascript file with some HTML tags in string format

Impact:
Javascript tag injection is happening for response pages with content-type= application/javascript instead of happening with html pages with content-type = html or xhtml.

Workaround:
None

---

2077297-2 : HA Group List page in GUI shows a blank page

Links to More Info: BT2077297

Component: TMOS

Symptoms:
HA Group List page shows a blank page with no information on the screen

Conditions:
The system is configured for High Availability (HA)
1) Go to System > High Availability > HA Group List
2) Click the Create button or an existing entry in the list

Impact:
No information is visible in HA Group List page in GUI

Workaround:
None

---

2064413 : UCS File Download Failure via REST API Due to Byte-Range Handling Bug in BIG-IP

Links to More Info: BT2064413

Component: TMOS

Symptoms:
When downloading UCS files using the BIG-IP REST API with clients such as PowerShell 7, downloaded files are larger than expected and contain duplicate or corrupted data. The MD5 checksum of the downloaded file does not match the source UCS file on the BIG-IP system. This is due to the REST service returning the same portion of the file for every chunk request, resulting in failed or unusable UCS restore attempts

Conditions:
Affected when downloading UCS files over the REST API (using HTTP Range headers) from BIG-IP.
Most commonly seen with PowerShell 7 and other clients that download files in chunks.
Not observed with PowerShell 5 or when using SCP/SFTP.
Occurs on affected TMOS versions before the implementation of the fix.

Impact:
UCS file downloads via REST API are incomplete and corrupted.
MD5 checksum mismatch prevents UCS archive validation or restore.
Automated backups or migrations using REST API may fail.
Potential risk of data loss if corrupted UCS files are used for restore.

Workaround:
Use alternate file transfer methods such as SCP or SFTP to download UCS files directly from /var/local/ucs/ on the BIG-IP system.

---

2064333-1 : [AFM] v17.5.x, RCA on pccd crash and core

Component: Advanced Firewall Manager

Symptoms:
Pccd core occurs while restarting/upgrading

Conditions:
AFM provisioned with ehf changes.

Impact:
Crash occurs during process restart or upgrade, but does not appear to persist after initial event

---

2064225-2 : FQDN nodes created when creating FQDN pool member have "address-family" set to "all"

Links to More Info: BT2064225

Component: TMOS

Symptoms:
When creating an FQDN pool member and referencing an FQDN node that does not already exist, the FQDN node is created implicitly using values specified for the FQDN pool member.
In this scenario, the FQDN node is always created with its "address-family" option set to "all".
It is not possible to specify an "address-family" value for the FQDN node in this scenario.

Conditions:
This occurs when:
-- Creating an FQDN pool member, either via the tmsh command-line interface (CLI) or the TMUI GUI, and
-- Referencing a new (not existing) FQDN node.

Impact:
The FQDN node created cannot be configured with an "address-family" option set to anything but "all" (such as "ipv4" or "ipv6"). As a result, ephemeral nodes may be created with either IPv4 or IPv6 addresses (depending on DNS query results) which are not desired.

Workaround:
You can,
-- First, create the FQDN node with the desired "address-family" value.
-- Then create the FQDN pool member, referencing the previously-created FQDN node.

To correct the configuration of the FQDN node, the FQDN node and pool member must be deleted and re-created:
1. Delete FQDN pool member
2. Delete FQDN node
3. Create FQDN node with desired configuration
4. Create FQDN pool member with desired configuration

---

2064209-2 : FQDN node created from pool member via tmsh does not inherit "autopopulate" value

Links to More Info: BT2064209

Component: TMOS

Symptoms:
When using the tmsh command-line interface (CLI) to create an FQDN pool member, an FQDN node is created implicitly using values specified for the FQDN pool member.
However, if the "autopopulate" value is specified as "enabled" (instead of the default "disabled"), the FQDN node is created with the "autopopulate" value set to "disabled" (default).

Conditions:
This occurs when:
-- Creating an FQDN node implicitly by explicitly creating an FQDN pool member
-- Using the tmsh interface to perform this action.
-- Specifying a non-default value of "enabled" for the "autopopulate" option

Impact:
The FQDN node will be created with an "autopopulate" value of "disabled", which means that only a single ephemeral node will be created based on DNS resolution of the FQDN name.
Since only a single ephemeral node is created, only a single ephemeral pool member will be created, and the "autopopulate" option will not exhibit the "enabled" behavior.

Workaround:
To work around this issue using tmsh command-line interface (CLI):
-- First create the FQDN node with the desired configuration values.
-- Then create the FQDN pool member, referencing the previously-created FQDN node.

To correct the configuration of the FQDN node, the FQDN node and pool member must be deleted and re-created:
1. Delete FQDN pool member
2. Delete FQDN node
3. Create FQDN node with desired configuration
4. Create FQDN pool member with desired configuration

---

2064089 : APM: UI displays internal server error while updating Network Access (VPN) configuration

Links to More Info: BT2064089

Component: Access Policy Manager

Symptoms:
From UI, when attempting to modify Network Access resource settings or save them, the UI displays an Internal Server error, and the configuration operation fails.

Conditions:
In Network Settings, add an entry for DNS Exclude Address Space and when the system DNS server is not reachable and save the configuration.

Impact:
The UI page expires and displays an internal server error message after updating the configuration.

Workaround:
Ensure the DNS server is reachable.

---

2058837 : Signatures listening on port 8080 instead of 53

Links to More Info: BT2058837

Component: Protocol Inspection

Symptoms:
Some signatures such as 3460 and 3244 are grouped under the HTTP service instead of the DNS service, even though DNS traffic is processed irrespective traffic direction.

Conditions:
HTTP and DNS services are enabled.

Impact:
Incorrectly grouped, and the statistics is shown under the wrong service.

Workaround:
None

---

2058541-1 : [BGP] BIG-IP does not follow updated section of rfc4724.html#section-4.2 when handling a new connection from peer.

Links to More Info: BT2058541

Component: TMOS

Symptoms:
BIG-IP does not follow the updated section (https://www.rfc-editor.org/rfc/rfc4724.html#section-4.2) when handling a new connection from a peer. Instead, section https://datatracker.ietf.org/doc/html/rfc4271#section-6.8 is followed.

This leads to a new connection from a peer being dropped when Graceful Restart happens.

Conditions:
BGP is configured with graceful restart.
Peer restarts.

Impact:
BIG-IP will drop a new connection request and try to open a new connection right away.

---

2053893-2 : Incompletely-synced ASM configuration can be synced back to the original device or group

Links to More Info: BT2053893

Component: Application Security Manager

Symptoms:
The incomplete ASM configuration on the new device may be synced to the device group, overwriting the original and complete ASM configuration when an ASM configuration is in the process of being synced from an existing device or group to a new device joined to the group, and there is a request to sync the new device to the group.

Conditions:
This may occur when,
-- Multiple device groups are configured, including:
   -- a (non-ASM) Sync Failover device group
   -- an ASM Sync-Only device group
-- Both device groups are configured for Manual Full Sync.
-- The ASM configuration is large enough to require several minutes to apply the complete configuration.
-- A new device has joined the cluster and device groups, which has no existing ASM configuration (or, a much smaller subset of the cluster's existing ASM configuration.
-- The configuration is synced from an existing device to the non-ASM device group (and thus to the new device).
-- After the ASM configuration is synced from an existing device to the ASM device group (and thus to the new device).
-- After the ASM configuration is synced from the new device to the ASM device group (and thus to the existing devices).

Impact:
Depending on the size of the ASM configuration, system performance and network throughput, the ASM configuration may take a long time to sync to the new device, and may appear to be only partially synced in the meantime.
Depending on timing and other non-deterministic conditions, this partially-synced ASM configuration may be synced back to the device group.
When this occurs, the existing ASM configuration may be overwritten by the partial ASM configuration on the new device, resulting in a loss of ASM functionality.

Workaround:
To avoid this issue when multiple device groups are configured, which include both an ASM and non ASM device group, and both groups are configured for Manual Full Sync:
-- Sync the ASM device group first.
-- Wait to confirm that the full ASM configuration has been synced to the new device before initiating any further sync operations.
-- Be careful not to inadvertently select the new device (with incomplete ASM configuration) as the device to sync to the device group.

---

2053549 : Removal of conditional freeing cause double free errors

Component: Access Policy Manager

Symptoms:
TMM crash might occur.

Conditions:
OAuth configured under PRP on BIG-IP with conditional freeing

Impact:
TMM keeps crashing while trying to free OAuth Memory.

Workaround:
None

---

2053489-2 : Config Sync events may not be recorded in audit log

Links to More Info: BT2053489

Component: TMOS

Symptoms:
When a command is issued on a BIG-IP system to sync configuration to a Device Group from a given Device in the Device Group, the config sync command may not be recorded in the audit log on the device where the command was issued.
The audit log may not record this command, even though subsequent log messages in other log files may indicate successful completion of the config sync action.

Conditions:
This may occur when:
-- Issuing the command to sync configuration from a Device to a Device Group in which it is a member.
-- Issuing such a command from either the command-line interface (tmsh) or from the BIG-IP GUI (tmui).
-- Accepting the default/offered suggestion for the Device whose configuration is to be synced to the Device Group.
For example:
-- In the GUI, accepting the default selection indicated by the active radio button for which Device to sync to the Device Group, and clicking Sync.
-- In the CLI, issuing the "tmsh run cm config-sync" command with the "to-group" option from the Device which is suggested by the "tmsh show cm sync-status" command.

Impact:
When attempting to diagnose issues that occur in the context of syncing configuration across Devices in a Device Group, it may not be clear where, when, and by whom the command to initiate the config sync was issued.

---

2053289 : Increased OAuth instances in TMM memory

Links to More Info: BT2053289

Component: Access Policy Manager

Symptoms:
In a successful OAuth attempt a single M_OAUTH instance leak is observed.

Conditions:
OAuth Agents are configured in a per-request policy.

Impact:
Increased TMM memory usage.

Workaround:
None

---

2050389-3 : VIPRION cluster management IP may not appear in SNMP IP-MIB table

Links to More Info: BT2050389

Component: TMOS

Symptoms:
When a cluster management IP address (sys cluster default address x.x.x.x) is configured without also configuring individual blade IP addresses (sys cluster default members # { address x.x.x.x }), neither address with appear in the IP-MIB ipAddressIfIndex table.

Conditions:
A cluster management IP is configured, but individual blade management addresses are not.

Impact:
Unable to retrieve the cluster management IP from the VIPRION system using SNMP

Workaround:
Configure cluster management IP addresses on the individual blades. Doing so will allow the floating cluster management IP address to be populated into the IP MIB (as well as the individual blade IP addresses)

---

2050177 : LDAP cache optimisation, required as session establishment, takes more time

Component: Access Policy Manager

Symptoms:
When LDAP is configured with a larger number of groups, we may see delays in the session establishment rate. This happens only during cache buildup, and later when the sessions are created concurrently.

Conditions:
LDAP server is configured with large number of groups and sessions are created concurrently.

Impact:
User may observe slow session establishment rate.

Workaround:
None

---

2048001-1 : Memory leak in icrd_child process

Links to More Info: BT2048001

Component: Protocol Inspection

Symptoms:
Memory leak in icrd_child caused by listing Inspection Profiles using GUI.

Conditions:
Configured about 40 IPS profiles and opened IPS profiles in multiple browsers.

Impact:
Out of memory and killing the icrd_child process.

Workaround:
None

---

2047429-2 : PostgreSQL should dump a corefile when not exiting

Links to More Info: BT2047429

Component: TMOS

Symptoms:
When PostgreSQL does not exit gracefully, it does not create a core file.

Conditions:
PostgreSQL crashes.

Impact:
Diagnostic data missing.

Workaround:
None

---

2047137-1 : TMM core may occur while using APM VDI with Blast UDP

Links to More Info: BT2047137

Component: Access Policy Manager

Symptoms:
User may fail to access the remote desktop using APM vmware VDI, if a TMM core occurs due to the unavailability of one of the internal database variable.

Conditions:
The user attempts to connect to the desktop or app using VMware Client or a browser via the Blast protocol over UDP, and the session variable is deleted due to a timeout.

Impact:
TMM core may disrupt traffic temporarily.

Workaround:
None

---

2046553-2 : Memory leak when modifying PEM policies with flow-info-filters

Links to More Info: BT2046553

Component: Policy Enforcement Manager

Symptoms:
Tmm memory slowly grows over time.

Conditions:
Modifying PEM policies with flow-info-filters

Impact:
Tmm can run out of memory

Workaround:
Restart tmm before memory is exhausted. Subscriber traffic will be impacted while tmm restarts.

---

2044381-2 : Gtmd SIGSEGV core due to monitor status change

Links to More Info: BT2044381

Component: Global Traffic Manager (DNS)

Symptoms:
Gtm cored

Conditions:
-- Three GTMs in a sync group
-- A GTM pool has a monitor with "require 1 from 2 probes" configured
-- Resources are marked down due to iQuery traffic disruption between two of the GTMs, then come back up

Impact:
GSLB traffic disrupted while gtmd restarts.

Workaround:
None

---

2038393-1 : Looped dtls virtual can cause crash due to NULL dereference

Links to More Info: BT2038393

Component: Local Traffic Manager

Symptoms:
Tmm crashes while passing dtls traffic.

Conditions:
An iRule uses the 'virtual' command to loop into a dtls virtual as a second virtual, and using serverside dtls on the first virtual.

Impact:
Tmm crashes

Workaround:
Do not use the virtual command or any other form to loop into dtls virtual.

---

2038309-2 : After the full config sync, FQDN template node status changes to ‘fqdn-checking’ (Unknown) untill the DNS query is triggered

Links to More Info: BT2038309

Component: Local Traffic Manager

Symptoms:
The node’s availability changes to unknown, even though the DNS server is reachable and should have valid resolution data.

The FQDN resolver does not immediately send a DNS query upon receiving the sync, which delays recovery of the node status.

Node status returns to fqdn-up only after the next scheduled DNS query interval (For example, 240 seconds).

Conditions:
-- BIG-IP devices configured with FQDN template nodes.
-- Performing config sync with the force-full-load-push option.

The issue occurs on the sync receiver only. It does not reproduce without force-full-load-push.

Impact:
Temporary service visibility issue:

FQDN nodes incorrectly display 'fqdn-checking' or 'availability unknown' until the next DNS resolution cycle.

This can exist till the next FQDN interval configuration (For example, 4 minutes).

May confuse administrators monitoring node status.

Workaround:
To work around this issue, either:

-- After initiating the config sync force-full-load-push, initiate on the standby/sync receiver:
bigstart restart dynconfd

or:

-- Configure the FQDN template node with a shorter 'interval' value, so that the next DNS query occurs more quickly after the full config sync operation.

---

2037409-2 : Tmctl tables are corrupted for large cluster size and tmm memory shows 0

Links to More Info: BT2037409

Component: TMOS

Symptoms:
When a BIG-IP is deployed on a large cluster with 5 or more blades on VELOS chassis platforms, the following tables are shown as corrupted:
tmctl -d blade tmm/sdaglib_mirror_table
tmctl -d blade tmm/sdaglib_did_info
tmctl -d blade ipfix_destination_stats
tmctl -d blade tmm/sctp
tmctl -d blade tmm/lac

The command tmsh show sys tmm-info; shows 0 tmm memory
Memory (bytes)

tmsh show sys tmm-info

Conditions:
When using F5 VELOS Chassis platforms installed and deployed with BIG_IP with a number of blades 5 or above.

Impact:
Any data presented to user based on the impacted tables will be indicating incorrect data.

Workaround:
None

---

2035277-2 : Modifying virtual-address 'enabled' setting might lead to unpredictable virtual-server availability

Links to More Info: BT2035277

Component: Local Traffic Manager

Symptoms:
Virtual-server passes traffic when virtual-address is disabled.
The virtual-address 'enabled' setting is not always properly reflected on depending virtual-server configuration objects

Conditions:
-- Using traffic-matching-criteria.
-- Destination specified in traffic-matching-criteria list is the same as defined virtual-address.

remove the virtual server and re-add it or simply restart the TMM

Impact:
Virtual-server still passes traffic when virtual-address is disabled and inconsistent behavior is observed.

Workaround:
None

---

2035197 : TMM restart after modprobe causes TMM to go into restart loop

Links to More Info: BT2035197

Component: TMOS

Symptoms:
TMM in restart loop with 'tmm' logging saying that failed to initialize xnet driver

<13> Aug 12 05:21:05 localhost.localdomain notice xnet_dev [0000:00:0c.0]: Kernel driver is already unbound or no such device
<13> Aug 12 05:21:14 localhost.localdomain notice xnet_lib [pci:0000:00:0c.0]: Error: Failed to initialize driver
<13> Aug 12 05:21:14 localhost.localdomain notice xnet_dev [0000:00:0c.0]: Kernel driver is already unbound or no such device
<13> Aug 12 05:21:14 localhost.localdomain notice xnet_dev [0000:00:0c.0]: Error: Unsuccesful bind operation
<13> Aug 12 05:21:14 localhost.localdomain notice xnet[00:0c.0]: Error: Unable to attach to xnet dev
<13> Aug 12 05:21:14 localhost.localdomain notice xnet(1.3)[00:0c.0]: Error: Unable to initialize device
<13> Aug 12 05:21:14 localhost.localdomain notice xnet(1.3)[00:0c.0]: Waiting for tmm1 to reach state 4...
<13> Aug 12 05:21:14 localhost.localdomain notice ndal Error: Restarting TMM
<13> Aug 12 05:21:14 localhost.localdomain notice Initiating TMM shutdown.
<13> Aug 12 05:21:14 localhost.localdomain notice tap(tap)[00:00.0]: Waiting for tmm1 to reach state 4...
<13> Aug 12 05:21:20 localhost.localdomain notice ---------------------------------------------


Logging about receiving an unexpected message from PF may also be observed in 'tmm' log:
<13> Aug 12 05:19:56 localhost.localdomain notice iavf[0000:00:0a.0]: Received unexpected message 0 from PF

Conditions:
1) xnet-IAVF driver
2) TMM crashes or restarts after issuing multiple 'modprobe -r i40evf' commands within a short time (<30 seconds)

Impact:
Traffic disrupted as TMM never comes up

Workaround:
Restart VM host to reset the PF

---

2035177-2 : Use of OCSP responder with SSL C3D enabled in virtual server may leak SSL handshake instances

Links to More Info: BT2035177

Component: Local Traffic Manager

Symptoms:
SSL C3D with OCSP responder may cause SSL handshake instances to be leaked because of MPI dropping replies due to traffic bursts.

Conditions:
Traffic flows through a virtual server with C3D enabled, utilizing an OCSP responder to validate the status of the client's certificate.

Impact:
TMM ssl_hs_m memory usage grows over time, eventually causing memory pressure, and potentially a traffic disruption due to TMM restart.

Workaround:
None

---

2035129-3 : The CMP stream communication between tmms on different blades might stall after a tmm memory exhaustion event

Links to More Info: BT2035129

Component: Local Traffic Manager

Symptoms:
Issues with ARP or NDP resolution. Intermittent issues with the tmm session table.

Conditions:
BIG-IP is running on a chassis platform
tmm has run out of memory at some point but was able to recover

Impact:
CMP communication is impacted which may affect the tmm session table, ARP and NDP resolution, intra-chassis mirroring among other things.

Workaround:
It is difficult to determine which tmm(s) on which slot(s) might have been affected by the issue. Either restart tmm on the blades that experienced a memory exhaustion event or restart tmm on each blade in the chassis.

---

2034985-2 : Unable to forward NTLM SSO back-end cookies to front-end

Component: Access Policy Manager

Symptoms:
Unable to forward NTLM SSO back-end cookies to front-end.
NTLM has three HTTP round-trips and can set different sets of cookies in each trip. After successful NTLM SSO, APM does not forward some cookies from the back-end to the front-end.

Conditions:
-- NTLM SSO is configured.
-- The server side sends one or more 401 responses to the BIG-IP system during the transaction, followed by a 200 response.

Impact:
Cookies are not sent to the client side, and SSO negotiation fails.

---

2034753-1 : Domain name validation does not align with the error message on GUI

Links to More Info: BT2034753

Component: Access Policy Manager

Symptoms:
Domain names which include hyphens are not accepted, an error message is shown on GUI.

Conditions:
Domain names with hyphens or forward slashes will cause this issue.

Impact:
BIG-IP administrator will not be able to update DNS Exclude/Include Fields in Network Access settings if they include hyphens/dashes.

Workaround:
None

---

2033781-2 : Memory allocation failed: can't allocate memory to extend db size

Links to More Info: BT2033781

Component: Local Traffic Manager

Symptoms:
When tmm cannot expand the eXtremeDB database, it logs an error in /var/log/tmm:

err tmm1[21087]: 01010004:3: Memory allocation failed: can't allocate memory to extend db size

Conditions:
-- BIG-IP in operation
-- A configuration change is made that causes tmm to allocate more memory to eXtremeDB. Examples include:
  - Adding a clientssl or serverssl profile
  - Modifying a datagroup
  - A bot defense sync occurs

Impact:
Tmm does not crash but the eXtremeDB state is inconsistent with other tmms and could lead to unpredictable behavior such as virtual servers not working, iRules failing to work, bot defense failing to work

Workaround:
None

---

2017105-1 : Disk partition /var full after quick config changes★

Links to More Info: BT2017105

Component: Application Security Manager

Symptoms:
When a new configuration is applied, the previous data files are kept as long as they may be needed and also had a minimum age for deletion applied. When multiple config changes were made in quick succession this resulting in multiple generations that were under the minimum age for cleanup, and some duplicate data files that hadn't changed between generations. This can exhaust the available space in /var.

Conditions:
Many small config changes are applied in quick succession. This can occur during a version upgrade or EHF installation.

Impact:
Disk space was exhausted, leading to failure to apply configuration or configuration corruption.

---

2015973-1 : Enabling tcp-ak-ts dos vector causes file transfer failure★

Links to More Info: BT2015973

Component: Advanced Firewall Manager

Symptoms:
After upgrading, large file transfers to S3 endpoints start failing

Conditions:
-- Tcp-ack-ts with tscookie is enabled
-- You transfer a large file via the virtual server

Impact:
TLS connections to S3 endpoints are disrupted, resulting in stalled or failed connections

Workaround:
Disable the tscookie option in tcp-ack-ts

---

2014597-1 : Async session db ops are missing flow control

Links to More Info: BT2014597

Component: TMOS

Symptoms:
Tmm cores when
- Memory leakage from SSL handshakes piling up, due to mpi_data_queue getting filled fast and failing to trigger callbacks.
 
- Segmentation fault occurs due to a large delay in callbacks

Conditions:
- To many requests from one tmm thread to another tmm causes tmm_cmp_enqueue to drop replies as mpi_data_queue gets filled up.
- Longer delays in replies are causing drops, as the system is busy, or too many retries are causing the mpi_data_queue to fill up fast.

Impact:
TMM crashes

---

2014509-1 : TMM crash while processing DNS RR set record

Links to More Info: BT2014509

Component: Global Traffic Manager (DNS)

Symptoms:
TMM crash

Conditions:
A RR set record was updated or inserted while another TMM thread is updating or deleting the same RR set record. A missing lock prevented protecting the record from being NULLed by another thread while the first thread is accessing it.

Impact:
Operations stopped from the crash.

Workaround:
None

---

2014373 : Fix for TMM Core SIGSEGV in spva_gl_ddos_find_tuples Due to NULL Grey List Flood Entry

Links to More Info: BT2014373

Component: Advanced Firewall Manager

Symptoms:
TMM core analysis suggests that spva code received a FSD from HSB with type 14 (sPVA FSD). When the code was processing FSD, TMM crashed as the grey list flood entry was NULL. This entry was NULL on all TMM threads.

Conditions:
The issue occurs when sPVA code receives an FSD of type 14 from HSB, and during processing, the corresponding grey list flood entry is NULL across all TMM threads, causing a TMM crash.

Impact:
TMM crashed

Workaround:
None

---

2012801-1 : "parser parameters" is enabled even though json schema is attached to the profile

Links to More Info: BT2012801

Component: Application Security Manager

Symptoms:
"parser parameters" is enabled even though json schema is attached to the profile. The GUI shows the option as disabled and greyed out; however, internally it is enabled.

Conditions:
Unknown

Impact:
JSON is extracted and enforced as parameters because of the "parser parameters" setting being enabled. This results in unexpected enforcement even when a valid JSON body is sent.

Workaround:
Making and saving a spurious change to the profile corrects the unexpected state.

---

2012301-2 : Upgrade the certificate to be compatible with the new upgraded gson package

Component: TMOS

Symptoms:
After the Gson package upgrade to 2.10.1, we need to update the certificate in cacert so that the SSL handshake exception is not present, as the new Gson package needs an updated certificate for verification.

Conditions:
Where the Gson package is used.

Impact:
Fails all the related packages in the build

Workaround:
Update the cacert with the correct certificate

---

2011301 : TMM crash because corrupted MQTT queue

Links to More Info: BT2011301

Component: Local Traffic Manager

Symptoms:
Tmm crashes while passing APM traffic. Core file analysis indicates MQTT queue corruption.

Conditions:
APM/AFM/ASM/LTM configured. Other causes are unknown.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

---

2011297 : Apmd Core generated during apmd cleanup

Component: Access Policy Manager

Symptoms:
Apmd Core is generated.

Conditions:
Apmd restart is triggered.

Impact:
Core file generated during apmd shutdown.

Workaround:
None

---

2008605 : TCP ACK vector does not increase for ACK/SYN packets

Links to More Info: BT2008605

Component: Advanced Firewall Manager

Symptoms:
The TCP ACK vector dpes not accurately reflect all packets that contain the ACK flag, leading to incomplete or misleading DoS vector statistics.

Conditions:
When sending TCP packets with both the SYN and ACK flags enabled (SYN/ACK packets), the TCP ACK vector statistics do not increase.

Impact:
Relevant traffic is not being included in the expected statistics. Incomplete DoS vector statistics.

Workaround:
None

---

2008573-2 : Login/Logout expected/unexpected string has no length validation

Links to More Info: BT2008573

Component: Application Security Manager

Symptoms:
You can configure an inappropriately long string for the login/logout criteria.

Conditions:
Configuring the Login/Logout expected/unexpected string.

Impact:
Upon asm restarted bd goes into restart loop. ASM traffic disrupted while bd restarts.

Workaround:
None

---

2008409-2 : MAC masquerade does not work on an F5OS tenant if there are no floating self-ips configured on the VLAN

Links to More Info: BT2008409

Component: F5OS Messaging Agent

Symptoms:
Network traffic fails on a VLAN that is shared by multiple tenants.

Conditions:
-- F5OS tenants sharing a VLAN
-- MAC masquerade enabled on both tenants
-- No floating self-ips configured

Impact:
MAC masquerade may not work properly causing traffic failures such as packets not arriving on the tenant. Or excessive DLFs on the network.

Workaround:
Add floating self-ips to all traffic VLANs that are using MAC masquerade.

---

2008185-1 : The vectors threshold mode changes from Fully Automatic to Manual post upgrade★

Links to More Info: BT2008185

Component: Advanced Firewall Manager

Symptoms:
After upgrading BIG-IP from version 16.1.5.2 to 17.1.2.2, the DoS vector threshold mode for tcp-syn-flood unexpectedly changes from "fully automatic" to "manual."

Conditions:
Enable the vector eg: tcp-syn-flood in v16.1.5.2 with threshold mode as fully automatic, threshold set to infinite and bad actor enabled. upgrade to v17.1.2.2.

Device is running BIG-IP version 16.1.5.2 (or similar 16.x version) prior to upgrade.
The tcp-syn-flood DoS vector is configured with threshold-mode set to fully-automatic.
Additional vector settings include:
detection-threshold-pps infinite
bad-actor is enabled.
per-source-ip-detection-pps is set to 9000.
per-source-ip-limit-pps is set to 100000.

The device is upgraded from version 16.1.5.2 to 17.1.2.2.

Impact:
-- GUI inaccessibility, BIG-IP is in offline state.
-- The system does not use the intended DoS protection settings. This can lead to service disruption, as the device may not load the required configuration.

Workaround:
Manually revert the threshold mode to fully-automatic.
tmsh load sys config

---

2007705-2 : HSL can incorrectly handle pending TCP connections leading to a TMM crash

Links to More Info: BT2007705

Component: TMOS

Symptoms:
TMM core

Conditions:
A pool member is marked down or delete while there are TCP connection issues with some pool members

Impact:
TMM crash impacts the service.

Workaround:
None

---

2007429-1 : Captcha button label displays in lowercase

Links to More Info: BT2007429

Component: Application Security Manager

Symptoms:
The CAPTCHA challenge displays a "submit" button with lowercase text, which may not align with UI expectations.

Conditions:
-- CAPTCHA challenges triggered by bot defense or brute force protection modules.
-- Bot Defense with Captcha mitigation is attached to a virtual server
 OR
-- WAF policy with brute force using captcha mitigation is attached to a virtual server.

Impact:
Minor UI inconsistency that may affect user experience preferences.

Workaround:
None

---

1998985 : Displays "Page Unresponsive" error message when editing AD group resource with large AD group count

Links to More Info: BT1998985

Component: Access Policy Manager

Symptoms:
Page becomes unresponsive

Conditions:
AD Group Resource should be attached with AD server with Large AD Group Count

Impact:
AD Group Resource agent cannot be edited

Workaround:
Delete the existing AD Group Resource agent and recreate it by first adding the desired resources (e.g., VDI, RDP, Webtops, etc.) during the edit operation. After adding the resources, attach the AD server as the final step.

---

1993081-2 : SNMP traps are not being generated for bigipExternalLinkDown (.1.3.6.1.4.1.3375.2.4.0.218) and bigipExternalLinkUp (.1.3.6.1.4.1.3375.2.4.0.219).

Links to More Info: BT1993081

Component: TMOS

Symptoms:
Two SNMP traps bigipExternalLinkDown (.1.3.6.1.4.1.3375.2.4.0.218) and bigipExternalLinkUp (.1.3.6.1.4.1.3375.2.4.0.219) were added as part of ID807957 fix. However, currently, these two traps are not being generated.

Instead of bigipExternalLinkDown or bigipExternalLinkUp trap, when alertd.nokia.linktraps db key and alertd.nokia.alarm db key is both set to disabled (default), bigipExternalLinkChange trap (.1.3.6.1.4.1.3375.2.4.0.37) is being generated upon link status change (up/down).

When alertd.nokia.linktraps db key and alertd.nokia.alarm db key is both set to enable, Nokia specific snmp traps (.1.3.6.1.4.1.94.7.1.4.2.1) is generated upon link status change (down/up) and Nokia Alarm database is correctly updated with those snmp traps. Fix for ID807957 is still valid here.

Conditions:
- Running software version that has fix for ID807957 (16.1.0 or later / 17.x).
- SNMP trap destination is configured and link status change happens.
- alertd.nokia.linktraps db key and alertd.nokia.alarm db key is both disabled (default value).

Impact:
BigipExternalLinkDown trap and bigipExternalLinkUp trap is not being generated.

Workaround:
None.

---

1992569-1 : Request body held despite "do nothing" content profile setting

Links to More Info: BT1992569

Component: Application Security Manager

Symptoms:
Requests configured with the "Do Nothing" content profile may still have their body held until fully received, rather than being streamed directly to the server.

Conditions:
ASM is configured with the "Do Nothing" option and large or slow requests are sent.

Impact:
May lead to increased latency or timeouts for server-side applications expecting real-time data delivery, and unnecessary resource usage due to repeated ingress event handling.

Workaround:
None

---

1991297 : [APD][SAML-SSO]high memory due to SAML SSO leak

Links to More Info: BT1991297

Component: Access Policy Manager

Symptoms:
Tmm crashes due to out of memory while passing SAML-SSO traffic

Conditions:
SAML SSO configured with saml artifact sign.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

---

1989125-2 : TSval value of Ack packets sent by BIG-IP may roll back in time

Links to More Info: BT1989125

Component: Local Traffic Manager

Symptoms:
After BIG-IP replies to a SYN-ACK with one value of TSval in TCP timestamp, the next packet sent by BIG-IP might have a TSval that is behind. This results in some clients resetting the connection or timing out.

Conditions:
The syncookie mode protection has been activated due to a SYN flood.

Impact:
Connectivity issue

Workaround:
None

---

1989033-1 : IPsec IKEv2 tunnel may fail to initiate or respond due to ERR_PORT

Links to More Info: BT1989033

Component: TMOS

Symptoms:
In very rare circumstances the BIG-IP may fail to initiate or respond to an IKEv2 tunnel.

When debug2 is enabled, the following log messages in the tmm log indicates a potential match for this bug. ERR_PORT is a critical indicator of the failure condition.

<13> <date> <hostname> notice ike_connect/3154: @F: ike flow created 172.16.61.100:172.16.61.200 rd: 0 owner=0.2 me=0.2
<13> <date> <hostname> notice ike_connect/3218: @F: ISAKMP_CONN local=172.16.61.100:500 remote=172.16.61.200:500
<13> <date> <hostname> notice ike_proxy_connect/1510: @E: flow_connect() ERR ERR_PORT
<13> <date> <hostname> notice ike_connect/3241: @E: ERR ERR_PORT
<13> <date> <hostname> notice pfkey_isakmp_reconnect/5231: @E: can't create isakmp flow to 172.16.61.100:500 172.16.61.200:500 %0, err ERR_PORT.
<13> <date> <hostname> notice pfkey_isakmp_reconnect/5241: @E: ERR ERR_PORT

The ipsec.log will contain different messages.

ipsec.log - BIG-IP attempts to start the connection, the INTERNAL_ERR is a critical indicator:

<date> <hostname> info tmm[1501]: 017c0000 [0.2] [IKE] [INFO]: rcf_remote_cite: (remote why='@B:deepcopy:MAKE' me=0x4000c6cbaa08#4035 pa=2643 name='/Common/<ike peer name>' ip='<remote IP>[500]')
<date> <hostname> info tmm[1501]: 017c0000 [0.2] [IKE] [INTERNAL_ERR]: ikev2_allocate_sa: ERR Invalid BIG-IP flow context for <local IP>[500]-><remote IP>[500] peer='/Common/<ike peer name>'
<date> <hostname> info tmm[1501]: 017c0000 [0.2] [IKE] [DEBUG]: ikev2_allocate_sa: @A: Insert ike_sa 0x4000c7aa2c88, SPI 1c96e4465b82fc39 0000000000000000 in list (peer='/Common/<ike peer name>')
<date> <hostname> info tmm[1501]: 017c0000 [0.2] [IKE] [INFO]: ikev2_state_transition: [ikev2_dh_generate] @I:ike_sa 0x4000c7aa2c88 SPI=1c96e4465b82fc39 0000000000000000 state IDLING -> DH_REQ
<date> <hostname> info tmm[1501]: 017c0000 [0.2] [IKE] [INFO]: ikev2_state_transition: [ikev2_dh_generate_callback] @I:ike_sa 0x4000c7aa2c88 SPI=1c96e4465b82fc39 0000000000000000 state DH_REQ -> DH_DONE
<date> <hostname> info tmm[1501]: 017c0000 [0.2] [IKE] [DEBUG]: ikev2_next_request_id: @A: send message (id 0) sa=0x4000c7aa2c88 (loc=<local IP>[500] rem=<remote IP>[500])
<date> <hostname> info tmm[1501]: 017c0000 [0.2] [IKE] [INFO]: ikev2_state_transition: [ikev2_set_state] @I:ike_sa 0x4000c7aa2c88 SPI=1c96e4465b82fc39 0000000000000000 state DH_DONE -> INI_IKE_SA_INIT_SENT
<date> <hostname> info tmm[1501]: 017c0000 [0.2] [IKE] (req at='@M:PUSH:ikev2_send_request' SPI='1c96e4465b82fc39 0000000000000000' gen=0x1 MID=0 pkt=0x4000c7ec9558)
<date> <hostname> info tmm[1501]: 017c0000 [0.2] [IKE] (payloads dir=SEND at=ikev2_send_request payl=0x4000c442ca88 len=432 crc=0x47699687
<date> <hostname> info tmm[1501]: 017c0000 [0.2] [IKE] @ . (v2_head i_spi=0x1c96e4465b82fc39 r_spi=0x0000000000000000 next=33:PAYLOAD_SA
<date> <hostname> info tmm[1501]: 017c0000 [0.2] [IKE] @ . . . ver=0x20 exch=34:IKE_SA_INIT flags=0x8:I-Q id=0 len=432 crc=0x47699687)
<date> <hostname> info tmm[1501]: 017c0000 [0.2] [IKE] @ . (hd type=33:PAYLOAD_SA next=34:PAYLOAD_KE byte=0 len=48 off=0x1c)
...

ipsec.log - BIG-IP retransmits a few more times:

<date> <hostname> info tmm[1501]: 017c0000 [0.2] [IKE] [DEBUG]: ikev2_retransmit: @M: retransmit 0x4000c7d77b78 pkt 0x4000c7ec9558 msg_id=0 req 0x4000c7d77b08 SPI 1c96e4465b82fc39 0000000000000000 count 0
<date> <hostname> info tmm[1501]: 017c0000 [0.2] [IKE] [DEBUG]: ikev2_retransmit: @M: retransmit 0x4000c7d77b78 pkt 0x4000c7ec9558 msg_id=0 req 0x4000c7d77b08 SPI 1c96e4465b82fc39 0000000000000000 count 1
<date> <hostname> info tmm[1501]: 017c0000 [0.2] [IKE] [DEBUG]: ikev2_retransmit: @M: retransmit 0x4000c7d77b78 pkt 0x4000c7ec9558 msg_id=0 req 0x4000c7d77b08 SPI 1c96e4465b82fc39 0000000000000000 count 2
<date> <hostname> info tmm[1501]: 017c0000 [0.2] [IKE] [DEBUG]: ikev2_retransmit: @M: retransmit 0x4000c7d77b78 pkt 0x4000c7ec9558 msg_id=0 req 0x4000c7d77b08 SPI 1c96e4465b82fc39 0000000000000000 count 3

ipsec.log - BIG-IP cancels the negotiation after a timeout:

<date> <hostname> info tmm[1501]: 017c0000 [0.2] [IKE] [INFO]: ikev2_negotiation_timeout_callback: ikev2_negotiation_timeout_callback1 ike_sa rmconf : 3335236104
<date> <hostname> info tmm[1501]: 017c0000 [0.2] [IKE] [INFO]: ikev2_negotiation_timeout_callback: ikev2_negotiation_timeout_callback2 rmconf ikev2 : 3343372872
<date> <hostname> info tmm[1501]: 017c0000 [0.2] [IKE] [INFO]: ikev2_negotiation_timeout_callback: ikev2_negotiation_timeout_callback3 ikev2 plog : 0
<date> <hostname> info tmm[1501]: 017c0000 [0.2] [IKE] [INFO]: ikev2_negotiation_timeout_callback: negotiation timeout: ike_sa (ick=0x1c96e4465b82fc39, rck=0x0000000000000000)
<date> <hostname> info tmm[1501]: 017c0000 [0.2] [IKE] [PROTO_ERR]: __ikev2_abort: ike_sa=0x4000c7aa2c88 ABORT, ERR errno='110', SPI 1c96e4465b82fc39 0000000000000000
<date> <hostname> info tmm[1501]: 017c0000 [0.2] [IKE] [INFO]: ikev2_state_transition: [ikev2_set_state] @I:ike_sa 0x4000c7aa2c88 SPI=1c96e4465b82fc39 0000000000000000 state INI_IKE_SA_INIT_SENT -> DYING
<date> <hostname> info tmm[1501]: 017c0000 [0.2] [IKE] (req at='@M:POP:ikev2_cancel_retransmit_req' SPI='1c96e4465b82fc39 0000000000000000' gen=0x1 MID=0 pkt=0x4000c7ec9558)
<date> <hostname> info tmm[1501]: 017c0000 [0.2] [IKE] [INFO]: ikev2_state_transition: [ikev2_set_state] @I:ike_sa 0x4000c7aa2c88 SPI=1c96e4465b82fc39 0000000000000000 state DYING -> DEAD
<date> <hostname> info tmm[1501]: 017c0000 [0.2] [IKE] [DEBUG]: ikev2_ha_send_sa_delete: high availability (HA) SA is already deleted from Session DB
<date> <hostname> info tmm[1501]: 017c0000 [0.2] [IKE] [INFO]: rcf_remote_cite: (remote why='@B:clean:FREE' me=0x4000c6cbaa08#4035 pa=2643 name='/Common/<ike peer name>' ip='<remote IP>[500]')

Conditions:
-- IPsec IKEv2
-- Tunnel may be newly configured
-- BIG-IP does not transmit or respond to any packets related to the configured tunnel.

Impact:
When this occurs, the tunnel will be down permanently.

Workaround:
If this is a High Availability (HA) peer and the config is sync'd with the Standby, failing over to the Standby may bring the tunnel up.

However, a second failover (fail back to the original high availability (HA) device) will lead to the tunnel down again. The original device once Active again, is still in the same failure mode.

One workaround is to failover, check the tunnel is up and then reboot or 'bigstart restart' the failing Standby device.

After that, the IKE SA should appear correctly mirrored on the Standby, use 'tmsh show net ipsec ike-sa' and check there is an SA with the peer's IP.

The second workaround is to delete all IPsec config objects, self IP and route-domain associated with the tunnel. In the case where the IPsec config, self IPs and routes exist entirely in route-domain 0 this is not a reasonable solution and rebooting is the most sensible recovery step.

---

1988981-1 : TMM crashes after detaching and reattaching a DoS profile on the DNS virtual server

Links to More Info: BT1988981

Component: Local Traffic Manager

Symptoms:
-- TMM stops functioning and crashes.
-- A core dump file is generated on the system.

Conditions:
During an ongoing DDoS attack, the DoS profile associated with a virtual server is detached, modified, and then reattached.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
Avoid detaching, modifying, or reattaching the DoS profile to the virtual server while the BIG-IP is actively detecting or mitigating a DDoS attack, if possible.

---

1987405-2 : Virtual address ICMP and ARP setting might be inconsistent when traffic-matching-criteria is in use.

Links to More Info: BT1987405

Component: Local Traffic Manager

Symptoms:
Using traffic-matching-criteria [TMC] destination IP lists and defining virtual-addresses matching TMC destinations might lead to unpredictable behavior on ARP/ICMP virtual-address settings.

Conditions:
-- Using traffic-matching-criteria.
-- Destination specified in traffic-matching-criteria list is the same as defined virtual-address.

Impact:
ICMP/ARP settings might not apply properly to configured virtual-addresses.

Workaround:
None

---

1987309-1 : Bigd may get stuck in legacy mode

Links to More Info: BT1987309

Component: Local Traffic Manager

Symptoms:
Https monitors may spuriously mark a pool member as down and it will fail to mark the pool member back up.

The monitor remains in legacy mode, and probes are sent using TLS 1.0.

Conditions:
-- Server supports version TLSv1.2 and above.
-- bigd is configured to monitor the server with SSL.
-- The monitor flips into legacy mode.

Impact:
Bigd is stuck in legacy mode.

Workaround:
None

---

1983029-1 : IPS Upgrade: err mcpd[5374]: 01070734:3: Configuration error: DB validation exception, unique constraint violation on table★

Links to More Info: BT1983029

Component: Protocol Inspection

Symptoms:
Err mcpd[5374]: 01070734:3: Configuration error: DB validation exception, unique constraint violation on table (ips_inspection_sig) object ID (/Common/linux_kernel_messenger_v2_c_segment_length_signedness_error_cve_2023_44466_1). A duplicate value was received for a non-primary key unique index field. DB exception text (Cannot update_indexes/checkpoint DB object, class:ips_inspection_sig status:13)

Conditions:
Upgrade bigip15.1.x to 17.1.x, the AFM Protocol Security was installed with PI update file pi_updates_15.1.0-20230301.1045.im

Impact:
IM package installation fails.

Workaround:
This is not a workaround, but rather a cautionary note to consider before performing an upgrade.

1. Deploy a newer version of PI update file prior to the upgrade
Ex: pi_updates_15.1.0-20230301.1045.im to pi_updates_15.1.0-20250324.1115 or Latest.

2. Then proceed with an upgrade to v17.1.2.1.

Workaround - 2
==========
1. Create ucs
2. Modify bigip.conf file in ucs using https://my.f5.com/manage/s/article/K13830181
3. Remove below signature's lines >> Re-packaged as ucs
   microsoft_windows_dns_server_integer_overflow_1
4. Load sys config default
4. Load the modified ucs
5. Deploy newer IM package.

---

1980601-2 : Number of associated signatures for a signature-set appears zero

Links to More Info: BT1980601

Component: Application Security Manager

Symptoms:
Number of associated signatures for a signature-set appears zero in REST API and GUI.

/mgmt/tm/asm/signature-sets/{UUID} returns 'signatureCount' of which value is incorrectly shown zero.

Signature set screen in the GUI shows list of signature-sets with number of signatures of each sets. This number is incorrectly displayed zero.

Security ›› Options : Application Security : Attack Signatures


This is a cosmetic issue. Signature enforcement is performed for the affected signature-set even though the number is reported as zero. By selecting an affected signature-set in the GUI, you can see the associated signatures.

Conditions:
Via REST API you sent PATCH request to the endpoint /mgmt/tm/asm/signature-sets/{UUID}

The JSON body is badly structured or you sent the same PATCH request twice.

Impact:
Number of signatures is reported as zero for an affected signature-set

Workaround:
Update the endpoint with correctly structured JSON, and change one of the attribute value.

---

1977057-2 : Memory leak when using an iRule to overwrite MR peer route

Links to More Info: BT1977057

Component: Service Provider

Symptoms:
Messagerouter memory consumption is excessive:

tmctl memory_usage_stat -w 300 | grep 'name＼|messagerou'
name allocated max_allocated size slop cur_allocs tot_allocs fail_allocs type caches_used
dns_qname_cache 0 0 1280 255 0 0 0 std:
messagerouter 5384040 5924240 1 0 3253 122000 0 var:

Conditions:
'MR::message route' is used to overwrite peer route.

Impact:
Memory leak possibly leading to system overload/crash.

Workaround:
None

---

1976705-2 : Threat Campaign installation fails due to timeout after an hour

Links to More Info: BT1976705

Component: Application Security Manager

Symptoms:
Threat Campaign installation fails. /var/log/tomcat/live_update_upload.log contains a timeout error:

apply_threat_campaigns|INFO|Jun 17 15:30:45.034|29563|F5::LiveUpdate::PayloadHandler::upload,,Start Threat Campaigns
apply_threat_campaigns|ERR|Jun 17 16:30:45.174|29563|F5::LiveUpdate::PayloadHandler::clean_fail,,Fail load update files: TSocket: timed out reading 1024 bytes from 127.0.0.1:9781

Conditions:
- Threat Campaign is licensed
- The larger configuration size it has, the longer the installation process takes, which can lead it reaching 1 hour and timeout
- High load to system resource can contribute as well

Impact:
Threat Campaign fails to be installed

Workaround:
# mount -o remount,rw /usr
# cp /usr/local/share/perl5/F5/ASMConfig/EasyClient.pm /usr/local/share/perl5/F5/ASMConfig/EasyClient.pm.bk
# sed -i 's/recvTimeout => 3600000,/recvTimeout => 7200000,/' /usr/local/share/perl5/F5/ASMConfig/EasyClient.pm
# mount -o remount,ro /usr
# pkill -f asm_config_server

---

1976557-1 : [APM][OAUTH][LOGGING]Error log needed misconfigured "audience" for apm oauth jwt-config

Links to More Info: BT1976557

Component: Access Policy Manager

Symptoms:
When "audience" for apm oauth jwt-config misconfigured, oauth scope fails with error log :
OAuth Scope: failed for jwt-provider-list '/Common/JWTProvider' , error: None of the configured JWK keys match the received JWT token, JWT Header:

This log does not provide the correct reason for failure.

Conditions:
OAuth with JWT keys configured.

1)configure wrong audience in apm oauth jwt-config
apm oauth jwt-config /Common/auto_jwt_Provider {
allowed-keys {
/Common/auto_jwk_Provider1 { }
/Common/auto_jwk_Provider2 { }
/Common/auto_jwk_Provider3 { }
}
allowed-signing-algorithms { RS256 }
audience { da21849e-b50c-4673-917f-cb11ef9a0891 } <------------wrong------------
auto-generated true
issuer <issuer_uri>
jwks-uri <jwks_uri>
}

Impact:
Logging clarity

Workaround:
None

---

1976429-1 : Webroot database file updates are failing to apply, preventing the creation of a new version of the database file

Links to More Info: BT1976429

Component: Traffic Classification Engine

Symptoms:
The Webroot database file version does not change because the Webroot database is partially updated and fails (even if the expectation is to update every 24 hours).

Conditions:
Webroot database file issue.

Impact:
The Webroot database is missing partial updates.
Any URL added, deleted, or updated as part of a partial update is not added to the Webroot database file.
Any security issue fixed in the Webroot database will also be absent from the database.

Workaround:
None

---

1976001-5 : PEM::session TCL commands can cause cores

Component: Policy Enforcement Manager

Symptoms:
Tmm cores, with a segmentation fault.

Conditions:
Occurs when
* PEM::session commands are used in an iRule.
* tmm is busy, and the queue_drops field in tmm/cmp stat table is not zero.

Impact:
Traffic interruption as tmm restarts.

Workaround:
None

---

1975945-2 : IPS signatures and compliance not loaded until the configuration is saved using tmsh save sys config

Links to More Info: BT1975945

Component: Protocol Inspection

Symptoms:
Signatures and compliances are not updated properly in bigip.conf

Conditions:
- Check the signatures and compliances count in bigip.conf
- Upgrade/downgrade IPS im package
- Check the signatures and compliances count in bigip.conf

Impact:
Updated signatures are not used until the configuration is saved.

Workaround:
Manually save the configuration:
tmsh save sys config

---

1974869-1 : Unable to load config after upgrading to v17.5.0 with the Syntax Error: "state" may not be specified more than once.★

Links to More Info: BT1974869

Component: Advanced Firewall Manager

Symptoms:
After upgrading a BIG-IP AFM device from version 16.1.5.1 to 17.5.0, the device fails to come online.

effected vectors:
bad-tcp-flags-malformed
tcp-ack-ts
tcp-flags-uncommon

Conditions:
Set the all network device-config vectors into detect-only state and then initiate upgrade from v16.1.5.1 to v17.5.0

Impact:
The BIG-IP device fails to load its configuration and does not come online after the upgrade.

Workaround:
-manually remove the duplicate state entry in bigip.conf.
-perform "tmsh load sys config verify" or reboot

---

1974845-3 : Missing routes in 1nic allows access to GUI via self IP

Links to More Info: BT1974845

Component: TMOS

Symptoms:
Can connect to GUI via self IP(s) when this should not be allowed.

Conditions:
1) BIG-IP VE using 1nic

Impact:
Able to connect to GUI from a location that should not be able to do normally

Workaround:
Manually add or reload the missing route

> list sys management-route
    sys management-route default {
        gateway 10.155.255.254
        network default
    }

---

1974837-2 : MAIN|EROR|dosl7_hold_message:1004|trying to hold message already held

Links to More Info: BT1974837

Component: Application Security Manager

Symptoms:
Error log messages appear /var/log/tmm:

tmm log "MAIN|EROR|dosl7_hold_message:1004|trying to hold message already held"

Conditions:
-- Bot defense profile is attached to a virtual server
-- A request is sent with a trusted bot signature and requires a rDNS.
-- During the verification, the connection is closed.

Impact:
Errors in logs.

Workaround:
None.

---

1974701-2 : PVA stats may be double incremented when pva mode is dedicated

Links to More Info: BT1974701

Component: TMOS

Symptoms:
Offloaded connections may be double counted for dedicated PVA flows.

Conditions:
PVA mode is set to dedicated in fastl4 profile.

Impact:
Incorrect stats.

Workaround:
None

---

1972541-2 : Tmsh load sys config verify leaks compiled ltm (CPM) policies

Links to More Info: BT1972541

Component: Local Traffic Manager

Symptoms:
When LTM (CPM) policies are in use on virtual servers and 'tmsh load sys config verify' is used, memory in /dev/shm is leaked each time the verify command is used.

With multiple uses and many virtual servers with policies this could lead to the BIG-IP system having low memory and suffering from low memory symptoms (see impact).

df -h may show /dev/shm/ having abnormally high use.
cat /proc/meminfo may show abnormally high shmem, and low memory indicated by low MemAvailable. These statistics are also available in qkviews loaded on iHealth.

Conditions:
-- LTM (CPM) policy attached to one or more virtual servers
-- Use of 'tmsh load sys config verify'

Impact:
The amount of shared memory leaked at each use of 'tmsh load sys config verify' is typically:

Number of virtual servers with attached policies * 4KB.

Very large or complex policies may be a multiple of 4KB.

The number of compiled LTM policies in shared memory is:
ls -1 /dev/shm | grep loipc_vs_ | wc -l

There should be one for each virtual server with LTM policies.

Low memory symptoms can include:
- sluggishness to loss of contact when managed via GUI (web interface) or tmsh/bash over ssh
- poor process scheduling which may lead to daemons being aborted by software watchdog leading to production of core files.
- oom killer activity, where processes are terminated by kernel to free memory as an emergency measure
- loss of service
- reboot if symptoms develop fully into protracted thrashing

Workaround:
Reboot of the system will clear the leaked memory.

---

1972465-2 : LTM Syncookie always SW mode for a wildcard virtual server

Links to More Info: BT1972465

Component: TMOS

Symptoms:
LTM Syncookie mode is stuck in software only for a virtual server.

Conditions:
- LTM provisioned, no AFM
- Two identical virtual servers listening on different VLANs
- SYN flood on both virtuals

Impact:
One virtual server is in hardware SYN cookie mode, the other is in software SYN cookie mode.

Workaround:
tmsh modify sys db pvasyncookies.preferhwlmode value true
reboot

---

1972369-2 : A specific performance improvement

Links to More Info: BT1972369

Component: Performance

Symptoms:
A specific performance issue that can be fixed is happening on a basic structure used throughout the bd.

Conditions:
ASM configured and passing traffic

Impact:
Higher than necessary CPU utilization.

Workaround:
None

---

1972321-1 : "IP Reputation" option does not show up when creating a rule in LTM policy

Links to More Info: BT1972321

Component: TMOS

Symptoms:
The dropdown menu does not contain the option "IP Reputation" when creating a rule in LTM policy from the GUI.

Conditions:
License shows "IPI" as the active module instead of "IP Intelligence".

Impact:
The user is unable to select "IP Reputation" when creating a rule in an LTM policy from the GUI.

Workaround:
The rule can still be created through tmsh.

create ltm policy Drafts/test rules add { rule1 { conditions add { 0 { iprep all client-accepted values { "Spam Sources" } } } } }

---

1972273-1 : [F5OS tenant] Adjusting VLAN mtu (or description) throws MCP validation error VLAN /Common/vlan has an id of X, and customer-tag of none and it cannot be used by VLAN /Common/vlan

Links to More Info: BT1972273

Component: TMOS

Symptoms:
Attempting to adjust the MTUs (or any other attribute) of VLANs in a virtual-wire on an F5OS tenant fails with an error message:
VLAN /Common/vlan has an id of X, and customer-tag of none, so it cannot be used by VLAN /Common/vlan

With both VLAN objects mentioned being the same VLAN.

Conditions:
Virtual-wire configuration on F5OS tenant.

Impact:
Unable to operationally manage device and add descriptions or adjust MTUs in virtual-wire configurations on the tenant due to MCPD validation.

Workaround:
Save the configuration, edit bigip_base.conf and add a "mtu <value>" in each of the VLANs, and then load the configuration.

---

1971909-2 : TMM SIGFPE "master shouldn't receive a CMP nexthop" after Clusterd seeing 1 of 2 blades down

Links to More Info: BT1971909

Component: Service Provider

Symptoms:
Tmm crashes while passing traffic. The stack trace has an error "master shouldn't receive a CMP nexthop".

/var/log/ltm contains an error
err clusterd[9555]: 013a0004:3: Local slot 1: not getting clusterd pkts from slot 2; timed out on mgmt_bp after 10 seconds. Marking peer slot 2 SS_FAILED
err clusterd[9555]: 013a0014:3: Blade 1: blade 2 FAILED

Conditions:
-- BIG-IP running as a tenant on VELOS
-- The VELOS system is running a version that fixes ID 1556173 and 1559525
 https://cdn.f5.com/product/bugtracker/ID1556173.html
 https://cdn.f5.com/product/bugtracker/ID1559525.html

Impact:
Traffic disrupted while tmm restarts.

Workaround:
The workaround for this core not to happen is to upgrade to F5OS-C-1.6.2-37604.EHF-8.

---

1971641 : CGNAT PBA: Negative or incorrect "Active Port Blocks" statistics displayed in fw_lsn_pool_pba_stat

Links to More Info: BT1971641

Component: Carrier-Grade NAT

Symptoms:
Tmctl fw_lsn_pool_pba_stat shows an incorrect negative value for active_port_blocks (for example, -320268).

port_block_deallocations exceeds port_block_allocations, causing active_port_blocks (derived as allocations − deallocations) to go negative.

Other counters (for example, active_clients_reached_limit) may appear inconsistent with actual usage.

Behaviour indicates data plane/NAT functionality is unaffected; the issue is limited to statistics/visibility.

Conditions:
NAT configuration using CGNAT Port Block Allocation (PBA) with:

PAT mode: pba
Mapping: address-pooling-paired
Port-block parameters (example):
block-size 256
client-block-limit 3
block-idle-timeout 120
block-lifetime 86400
Observed in environments with very high port block churn (hundreds of millions of allocations and deallocations).

Impact:
The active_port_blocks counter does not reflect the actual number of active port blocks and may display negative values.

This is a stats/visibility issue only; traffic translation and NAT functionality continue to work as expected.

May cause operational confusion or misreporting in monitoring/automation systems relying on this counter.

Workaround:
None

---

1970969-2 : Stale Record Answers counter increments for SERVFAIL responses from DNS resolver cache

Links to More Info: BT1970969

Component: Global Traffic Manager (DNS)

Symptoms:
Stale Record Answers counter increments incorrectly when no stale record is served and a SERVFAIL is sent.

Conditions:
-- Configure DNS cache resolver with a forwarder.
-- Make sure forwarder does not respond to DNS queries.
-- Enable 'ltm dns cache global-settings serve-expired'
-- Send a few DNS requests to DNS cache for a record which is to be handled by not responding forwarder.
-- Observe 'Stale Record Answers' counter for DNS cache.

Impact:
Leads to incorrect Stale Record Answers stat, potentially misleading monitoring, troubleshooting, and operational decisions.

Workaround:
None

---

1970193-1 : Case WAF policy IP address exception list on GUI: Missing Route Domain ID in the IP address

Links to More Info: BT1970193

Component: Application Security Manager

Symptoms:
WAF policy misses route domain ID in IP exception addresses list on the GUI.

Conditions:
Different WAF policies belonging to different partitions have route domain ID associated with IP addresses.

Impact:
Cosmetic, route domain ID not available in IP address exception list on GUI.

Workaround:
None

---

1969949-1 : Unable to recover root password on VE instance

Links to More Info: BT1969949

Component: TMOS

Symptoms:
Follow the procedure to recover the root password described in.
https://my.f5.com/manage/s/article/K35811337.
Even though a confirmation message displays that the password has been changed, the new password does not work. At this point, the previous password will also no longer work.

Conditions:
On a VE instance with v17.5.0 and v16.1.6 versions

Impact:
Neither the old nor the new password for the root user will work. Even the other user accounts will be affected. Due to this, users will be unable to access the VE instance.

Workaround:
None

---

1969945-1 : Stats_rate changes along with Detection Threshold for NXDOMAIN DoS vector

Links to More Info: BT1969945

Component: Advanced Firewall Manager

Symptoms:
Lowering the threshold reduces the stats_rate, and increasing the threshold increases the stats_rate.

Conditions:
The detection threshold for the NXDOMAIN Query vector is modified (e.g., from 2000 to 200 or vice versa).
Constant DNS traffic is being generated and sent to the BIG-IP device (e.g., using dnsperf)

Impact:
Inaccurate stats_rate values for the NXDOMAIN Query vector

Workaround:
None

---

1969889-1 : Expired certificates sent to clients by tmm due to network time synchronization

Links to More Info: BT1969889

Component: Local Traffic Manager

Symptoms:
Clients are receiving certificates that are expired or invalid, leading to SSL handshake failures accompanied by security warnings.

Conditions:
-- A virtual server configured with ClientSSL and ServerSSL profiles, both having SSL forward proxy enabled, experiences a change in system time (time advanced) due to a network glitch or issue.

Impact:
Clients receiving expired/invalid certificates causes traffic disruption.

Workaround:
From TMSH, Running the following command will delete the cached certificates associated with the specified virtual server and client SSL profile.

(tmos)# delete ltm clientssl-proxy cached-certs virtual <name> clientssl-profile <name>

---

1969873-1 : IP reputation status is only available on primary blade

Links to More Info: BT1969873

Component: TMOS

Symptoms:
When executing the tmsh show sys iprep command on secondary blades in a VIPRION setup, it does not show output. However, running the same command on the primary blade shows IP reputation statistics as expected.
Secondary blades are expected to act as workers, with all reporting intended to occur on the primary blade.

Conditions:
1) The system is configured for IP reputation database downloads.
2) The tmsh show sys iprep command is executed on secondary blades where the /var/tmstat/blade/iprepd_stats file is not available.

Impact:
On secondary blades, users cannot see the iprep status

Workaround:
IP reputation status can be checked on the primary blade.

---

1968237-1 : Configuration fails to load post upgrade due to invalid DoS signature predicate 'ip flags'★

Links to More Info: BT1968237

Component: Advanced Firewall Manager

Symptoms:
After upgrading from v16.1.4.1 to v17.1.2.2, both device slots remain in an offline state.
Configuration fails to load due to a DoS signature issue (/Common/dos_Sig).
The system throws the following error:
>01071cc8:3: Dos Signature (/Common/dos-common/Sig_69253_39_1737834503): Arg (Fragmented) for predicate 'IP Flags' is invalid for DNS/NETWORK signature.

Conditions:
-- DoS signatures are configured using persistence-based predicates such as ‘IP Flags’.
-- Configuration executed via tmsh commands as outlined in the documentation:
https://clouddocs.f5.com/cli/tmsh-reference/v15/modules/security/security_dos_dos-signature.html
-- This can be configured via the GUI as well
-- Issue occurs when upgrading from 16.1.4.1 to 17.1.2.2.

Impact:
Device will be in offline state Post Upgrade

Workaround:
None

---

1968193-2 : Management Route name displayed incorrectly via API when the route name contains a forward slash (/)

Links to More Info: BT1968193

Component: TMOS

Symptoms:
Management route names that include a forward slash (/) are displayed incorrectly when queried through the API, showing only the netmask instead of the full name. However, the route name displays correctly when viewed using tmsh.

Conditions:
- A management route is created with a name that contains a forward slash (/), commonly seen when incorporating the network and subnet mask into the name, such as "10.10.10.0/24". Any other attempt to specify forward slash in the name will return a validation error.

- When queried via API, the name is inaccurately truncated to display only the netmask rather than the full route name.

Impact:
This issue does not affect the operational functionality of the management route. However, administrative challenges may arise due to the API returning an incomplete route name.

Workaround:
To avoid this issue, refrain from using a forward slash (/) in the name when defining a management route.

---

1968169-1 : [APM][CitrixIntegration]Apps do not launch unless "Accounts" is selected in Citrix Workspace App

Links to More Info: BT1968169

Component: Access Policy Manager

Symptoms:
After entering credentials, the Citrix app does not launch unless clients select the "Account" in the Citrix Workspace App "Settings".

Conditions:
-- APM and Citrix integraton
-- Accessing Citrix Workspace app
-- The client is rebooted or changes networks

Impact:
Citrix apps are not downloading.

Workaround:
Clients that are affected can log out and back in.

You can work around this on the BIG-IP system by applying an iRule which adds the header "X-Citrix-Gateway: <value>" to the server side


when HTTP_REQUEST {
if {[HTTP::header exists "X-Citrix-Gateway"]} {
set origin_header [HTTP::header value "X-Citrix-Gateway"]
} else {
set origin_header ""
}
}

when HTTP_REQUEST_SEND {
if {$origin_header ne ""} {
HTTP::header insert "X-Citrix-Gateway" $origin_header
HTTP::header insert "X-Citrix-Via" $origin_header
}
}

---

1967681 : 17.1.2.2 OEM YK image does not fully boot as an F5OS tenant because mcpd does not start.★

Links to More Info: BT1967681

Component: TMOS

Symptoms:
BIGIP-OEM-YK-17.1.2.2-0.0.12.ALL-F5OS.qcow2.zip.bundle
 is missing critical files for F5OS tenant operation and does not fully boot.

Conditions:
F5OS tenant
BIGIP-OEM-YK-17.1.2.2-0.0.12.ALL-F5OS.qcow2.zip.bundle used to deploy the tenant.

Impact:
The tenant does not fully boot.

mcpd does not fully start with logs similar to the following in /var/log/ltm

Jun 13 02:59:31 localhost.localdomain notice promptstatusd[7701]: 01460006:5: semaphore mcpd.running(1) held
Jun 13 02:59:31 localhost.localdomain warning promptstatusd[7701]: 01460005:4: mcpd.running(1) held, wait for mcpd
Jun 13 03:00:02 localhost.localdomain warning diskmonitor[8436]: 011d0002:4: Cannot access the database because mcpd is not running.


[root@localhost:NO LICENSE:] config # bigstart status mcpd
mcpd down, Waiting for chmand start: 42 seconds

Workaround:
Use the 17.5.0 qcow image
Use the 17.1.2.1 qcow image and upgrade to 17.1.2.2 using the .iso image.

---

1967589-1 : Using tmsh to query iControl REST (tmsh list mgmt ...) commands consume an auth token and does not get removed immediately

Links to More Info: BT1967589

Component: TMOS

Symptoms:
Executing tmsh commands that interact with the REST configuration module (e.g. "tmsh list mgmt ...") consume a REST token. These tokens are not released automatically by tmsh once the command finishes executing.

Running commands like "tmsh list mgmt shared authz tokens" repeatedly can cause all 100 tokens to be consumed.

Conditions:
Execute command on terminal "tmsh list mgmt shared authz tokens"

Impact:
Once the token limit is exhausted, they will only expire after 20 minutes. If a configured token limit is reached, no users can log in until those tokens expire.

Workaround:
Workaround #1: use the REST API.
curl -sku user:password -X GET https://aa.bb.cc.dd/mgmt/shared/authz/tokens | jq .

Workaround #2:
Run the commands in an interactive tmsh session.

---

1967293-2 : Re-configuring BFD multihop for a BGP peer does not work reliably.

Links to More Info: BT1967293

Component: TMOS

Symptoms:
When changing the BFD multihop configuration of a BGP peer, the previously existing BFD session might not be cleared properly preventing a new session from getting established.

Conditions:
Change the BFD multihop configuration of a BGP peer.

Impact:
Unable to establish BFD session.

Workaround:
Remove the BFD completely, then apply a new config.

---

1967261-2 : RDP Parameter "enablerdsaadauth" when added to RDP setting causes file to be corrupted

Links to More Info: BT1967261

Component: Access Policy Manager

Symptoms:
When RDP parameter "enablerdsaadauth:i:1" is added to RDP custom settings in Remote desktop resource configuration, user is unable to access VDI resources due to signature validation failure on client.

Conditions:
1. APM VDI is configured for MSRDP
2. Custom parameter "enablerdsaadauth:i:1" is added in Remote desktop resource configuration.

Impact:
User is unable to access remote desktop using Microsoft RDP file, through APM.

Workaround:
None

---

1967213-1 : Active contexts accumulate while HTTP is waiting for response

Links to More Info: BT1967213

Component: Protocol Inspection

Symptoms:
Tmm crashes while processing 100-Continue.

Conditions:
This can occur while processing a 100-continue server response.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

---

1966941-1 : High CPU or increased translation errors following upgrade or restart when DAG distribution changes

Links to More Info: BT1966941

Component: TMOS

Symptoms:
Dagv2 tables are randomized and may change when a tmm is restarted. This can result in a change of traffic distribution, which in some cases may lead to traffic disruption.

The specific condition when this option was introduced is using a CGNAT pool that is not large enough.

Other ways of encountering include increased translation failed errors following an upgrade or restart or blade replacement.

Conditions:
Tenant tmm is restarted (or VELOS chassis rebooted)

Impact:
- dag distribution changes which may cause a traffic disruption.

Workaround:
You can restart tmm until the distribution is good, which can be checked using tools like cmp_dest.

---

1966669 : [PVA] Provide a DB variable disabling NAT46/64 snoop inserts.

Links to More Info: BT1966669

Component: TMOS

Symptoms:
Starting from version 16.X NAt64/46 traffic can be accelerated in PVA. Under some circumstances this is not desired. A DB variable is needed to disable NAt64/46 offload to hardware.

Conditions:
- Nat46/64 configured on virtual-servers eligible for hardware offload.
- Version 16.X or above.

Impact:
Hardware offload of Nat64/46 traffic is not desired in some cases.

Workaround:
None

---

1966589-1 : Changes to fixup scripts breaks schema upgrade★

Links to More Info: BT1966589

Component: TMOS

Symptoms:
Fixup scripts breaks schema upgrade

Conditions:
Upgrade BIG-IP from one version to another version

Impact:
Configuration fails to load

Workaround:
None

---

1966313-1 : Websocket event logs show "N/A" for virtual server name except during upgrade request

Links to More Info: BT1966313

Component: Application Security Manager

Symptoms:
Remote logging for WebSocket traffic may display "N/A" in the vs_name field for messages other than the initial upgrade request.

Conditions:
Occurs when using a remote logging profile in CSV format with ASM and WebSocket traffic on a configured virtual server.

Impact:
Log entries may lack clarity or traceability due to missing virtual server name information, potentially complicating monitoring and troubleshooting.

Workaround:
None

---

1966305-1 : JSON template-base export fails if the policy has a logout object configured

Links to More Info: BT1966305

Component: Application Security Manager

Symptoms:
Policy export via GUI as JSON template-base fails if the policy has a logout object configured.

Terraform BIG-IP provider 1.22.9 and higher uses template-base export method that fails due to this bug.

Conditions:
Logout object is configured in the policy

Impact:
Policy export as JSON template-base fails

Workaround:
Use other types of policy export

---

1966053-2 : MCPD memory leak in firewall

Links to More Info: BT1966053

Component: TMOS

Symptoms:
Viewing virtual server firewall policy rules leaks some memory in MCPD.

Conditions:
- BIG-IP AFM is provisioned
- Virtual server firewall policy rules are viewed, e.g. by running one of the following commands

'tmsh show security firewall policy rules { }'

Impact:
A memory leak occurs when the command is run.

Workaround:
None

---

1965329-2 : TMM may crash when re-declaring an LTM policy with a data-group

Links to More Info: BT1965329

Component: Local Traffic Manager

Symptoms:
TMM may crash when re-declaring an LTM policy with a data-group.

Conditions:
-- AS3 declaration that has a VIP with an LTM policy that uses a data-group.
-- The policy is re-declared while there is traffic on the VIP

Impact:
Traffic disrupted while tmm restarts.

Workaround:
Declare while no traffic is on the VIP
Use iRules instead of LTM policies to access the data-group

---

1964933-1 : HTTP2 RST flood detection should allow for legitimate case

Links to More Info: BT1964933

Component: Local Traffic Manager

Symptoms:
In some cases, an HTTP2 client might get its TCP connection terminated.

Conditions:
Client is sending RST STREAM with error code CANCEL for example, but it is sent after the server has completed sending its data for the associated stream.

All RST STREAM are subject to RESET stream flood detection.

Impact:
Performance impact.

Workaround:
None

---

1962813-3 : The csyncd daemon on one or more of the cluster's secondary blades does not synchronise RRD files from the primary★

Links to More Info: BT1962813

Component: Local Traffic Manager

Symptoms:
Following a boot into a different software volume, occasionally csyncd on one or more secondary blades stops syncing most of the RRD files from the primary blade's /var/rrd/ directory to the local /var/rrd/ .
The RRD files are used to generate the graphs in the BIG-IP GUI.

Conditions:
- Cluster running one of the affected versions.

- Boot into a newly installed software volume, or into an already existing but different software volume.

- Primary blade ownership change after the boot.

Impact:
Some of the RRD files stop being synchronised from the primary blade to one or more of the secondary blades.

After a primary blade ownership change, graphing data from the other blades (up to the point when the secondary blade became primary) is unavailable in the GUI and whenever a qkview is generated.

Workaround:
Restart the statsd daemon from the primary blade with:
"bigstart restart statsd".

---

1959785-1 : BIG-IP incorrectly marked as "Managed by BIG-IQ" by its BIG-IP HA peer

Links to More Info: BT1959785

Component: TMOS

Symptoms:
Managed by BIG-IQ" message on Standby BIG-IP is incorrectly displayed on the standby device that is not managed by BIG-IQ.

Conditions:
Steps to Reproduce:

- On BIG-IQ, navigate to "Devices >> BIG-IP DEVICES", only add the active BIG-IP device.
- The standby device will be marked as "Managed by BIG-IQ" on the top left corner of the GUI.


Expected Results:

When active device only managing by the BIG-IQ, standby device should not by shown as "Managed by BIG-IQ"

Impact:
The "Managed by BIG-IQ" message on Standby BIG-IP is misleading since it has not been added/managed by CM.

Workaround:
None

---

1959709-2 : "Europe" IPs are allowed despite blocking all European countries

Links to More Info: BT1959709

Component: Application Security Manager

Symptoms:
Blocked Europe IP being allowed to access the web service

Conditions:
In ASM policy, configure to block all European countries. Thus any IP from 'Europe' should be blocked.

Impact:
IP access to the web service is allowed, which was supposed to be blocked.

Workaround:
None

---

1959361-2 : When running a tenant with more than 72 VCPUs / cores, adminstall crashes

Links to More Info: BT1959361

Component: Application Visibility and Reporting

Symptoms:
When running a tenant with more than 72 VCPUs / cores, adminstall crashes.

Conditions:
When ASM provisioned and running a Tenant with more than 72 VCPUs / cores per blade.

Impact:
DOSL7 (BADOS) is not functioning. Core created.

Workaround:
None

---

1958033-2 : MCPD validates only one ssl profile when a virtual server attached to http/2 profile with enforce-tls-requirements enabled along with multiple clientssl profiles with anyone has renegotiation option enabled

Links to More Info: BT1958033

Component: TMOS

Symptoms:
Configuration of HTTP/2 profile with enforce-tls-requirements enabled and a client-ssl profile with renegotiation enabled is sometimes allowed, when it should throw an error.

When 'Enforce TLS Requirements' in a HTTP/2 profile is configured on a virtual server, the 'TLS Renegotiation' option needs to be disabled in the SSL profiles on that virtual server.

But in some cases, the configuration is accepted without error even when renegotiation option is enabled on the SSL profile.

Conditions:
-- Virtual server with HTTP/2, HTTP, and client SSL profiles (any one of the profiles has renegotiation enabled).

1. Enable the 'Enforce TLS Requirements' option in the HTTP/2 profile (by default it is enabled).
2. Add multiple client SSL profile with 'TLS Renegotiation' enabled.
3. Save the configuration.

Its not throwing the error.

Impact:
Configuration of http/2 profile with enforce-tls-requirements enabled and client SSL profile with renegotiation enabled and when these profiles are added to the virtual server, a configuration error occurs:

01070734:3: Configuration error: In Virtual Server (/Common/testVS) an http2 profile with enforce-tls-requirements enabled is incompatible with client ssl profile '/Common/testssl2'; renegotiation must be disabled

Workaround:
None

---

1957977-1 : Auto-learned DoS Vector attack is detected even with low rate of traffic on HA Pair during Failover★

Links to More Info: BT1957977

Component: Advanced Firewall Manager

Symptoms:
After upgrading BIG-IP AFM from 15.1.8 to 17.1.2, DoS vectors (especially "Non TCP connection") are triggered and start attack detected, even though there is no actual attack or stress (CPU usage is low). The detection threshold is set to 0, causing false positives.

Conditions:
-- Upgrade from 15.1.8 to 17.1.2 (with EHF/instrumented TMM).
-- Device becomes Active after upgrade/failover.
-- AFM Device DoS vectors in Fully Auto mode.

Impact:
Logs show attack detection with thresholds at 0, despite no actual stress or attack. This leads to immediate and incorrect attack detection, causing false alarm even when there is no actual attack or system stress.

Workaround:
None

---

1957157-2 : [nlad]OpenSSL: DRBG Continuous RNG test failed: DRBG stuck.

Links to More Info: BT1957157

Component: Access Policy Manager

Symptoms:
You may observe below logs in /var/log/ltm
ltm.1:May 17 17:42:28 sgb006-e-pr-lb01.77robinson.sg.westpac.com.au err nlad[31252]: OpenSSL: DRBG Continuous RNG test failed: DRBG stuck.
ltm.1:May 17 17:42:28 sgb006-e-pr-lb01.77robinson.sg.westpac.com.au err fips_monitor[19162]: 01da0011:3: SelfTest/Integrity test failure detected, triggering reboot action

Conditions:
Conditions are unknown

Impact:
Unexpected reboot causing disruption to traffic and failover.

Workaround:
None

---

1953369-2 : DB monitor queries repeatedly if recv string configured but response does not match

Links to More Info: BT1953369

Component: Local Traffic Manager

Symptoms:
A database monitor (mssql, mysql, oracle, postgresql) may send multiple queries to the database server in quick succession if the monitor is configured with a 'recv' string, but the response from the server does not contain the configured string.

Conditions:
-- A database monitor (mssql, mysql, oracle, postgresql) is configured with a 'recv' string.
-- The query to the database server completes successfully, but the response does not contain the configured 'recv' string.

Impact:
The database monitor correctly marks the configured pool member 'DOWN' as appropriate, but generates unnecessary queries to the database server.

Workaround:
None

---

1953273-2 : Big3d high CPU with thousands of https monitors with SNI

Links to More Info: BT1953273

Component: Global Traffic Manager (DNS)

Symptoms:
Big3d high CPU utilization occurs

Conditions:
Large volume of https monitors and monitored resources with SNI configured.

Impact:
Big3d high CPU utilization

Workaround:
None

---

1953069-1 : Monitor instance table is not updated with the correct transparent attribute

Component: TMOS

Symptoms:
The monitor instance table shows incorrect information.

Conditions:
A monitor is attached to a node assigned to a pool.
The transparent attribute for such a monitor is toggled between enabled and disabled.

Impact:
The transparent attribute of a monitor is displayed incorrectly in both GUI and shell.

Workaround:
Remove the monitor and re-assign

---

1952821-1 : WAF guided configuration shows a warning message instead list of available configurations★

Links to More Info: BT1952821

Component: Application Security Manager

Symptoms:
A warning message "Your BIG-IP version does not support the selected category of configuration templates. Please upgrade your BIG-IP system to configure them." Instead, the configurations list (categories) is available.

Conditions:
There is a mismatch versions between the Guided Configuration installed and the BIG-IP.

Impact:
You cannot choose any of the guided configuration categories that otherwise would be available.

Workaround:
Uninstall all iApps packages and return to Guided Configuration, allowing BIG-IP to reinstall the default packages as part of the GC release package. Alternatively, the "Upgrade Guided Configuration" option can be used to upload and install a newer version of GC. Since iApps packages are bundled within a GC release, these methods ensure compatibility and eliminate version mismatch problems.

---

1943669-1 : "Automatic Update Check & Automatic Phone Home features" settings is changed upon running 'load sys config current-partition' in other partition

Links to More Info: BT1943669

Component: TMOS

Symptoms:
'auto-check' and 'auto-phonehome' configurations are not updated on non-Common partitions.

Conditions:
1. Disable "auto-check" and "auto-phonehome"
2. Save the config
3. Check "auto-check" and "auto-phonehome" status.
4. Switch to non-Common partition.
5. Load the current config
6. Check the "auto-check" and "auto-phonehome"
7. Switch back to common partition and check the status.

Impact:
These features could be enabled if you load the configuration on the non-Common partitions.

Workaround:
Disable 'auto-check' and 'auto-phonehome' again after switching back to the Common partition.

---

1943593-1 : Inconsistent DoS Attack Status between tmctl/event logs and GUI

Links to More Info: BT1943593

Component: Advanced Firewall Manager

Symptoms:
GUI shows "Not Detected / Forwarded" for PPS even though tmctl reports detection.

Conditions:
PPS rate fluctuates around the threshold, often staying below it.

Impact:
Detection is triggered internally (tmctl), but not reflected in the GUI; this may mislead operators monitoring attacks via the GUI.

Workaround:
None

---

1943257-2 : HTTP monitor "last error" string sends incorrect response

Links to More Info: BT1943257

Component: Local Traffic Manager

Symptoms:
When a recv string is used with an HTTP/HTTP2 monitor, the HTTP status code is collected and in the event of failure, the most recent value (from before the failure) is retrieved and used as part of the log output. This can result in a message that is misleading.

Conditions:
- The BIG-IP system configured to monitor an HTTP/HTTP2 server.

Impact:
Generates a misleading log messages, difficulty in identifying the actual cause of the monitor failure.

notice mcpd[8371]: 01070638:5: Pool /Common/http-pool member /Common/172.16.1.87:80 monitor status down. [ /Common/my-http-monitor: down; last error: /Common/my-http-monitor: Response Code: 200 (OK) @2025/05/12 07:30:25. ] [ was up for 0hr:0min:46sec ]

Workaround:
None

---

1943217-1 : BGP - using 'no bgp default ipv4-unicast' might lead to a crash

Links to More Info: BT1943217

Component: TMOS

Symptoms:
Using 'no bgp default ipv4-unicast' might lead to a crash when saving a configuration.

Conditions:
'no bgp default ipv4-unicast' configured.

Impact:
Bgpd crash/core.

Workaround:
Do not use 'no bgp default ipv4-unicast' configuration statement.

---

1938101-2 : Performance issue on specific parameters extractions

Links to More Info: BT1938101

Component: Application Security Manager

Symptoms:
Performance degradation on specific pages

Conditions:
When there are dynamic parameters extractions using HTML

Impact:
Slowdown of the extraction page load time

Workaround:
None

---

1938085-2 : Performance issue on specific parameters extractions

Links to More Info: BT1938085

Component: Application Security Manager

Symptoms:
Performance degradation on specific pages

Conditions:
When there are dynamic parameters extractions using HTML

Impact:
Slowdown of the extraction page load time

Workaround:
None

---

1936469-2 : Multiple Ctrl-Alt-Delete signals in virtual console reboots BIG-IP Virtual Edition

Links to More Info: BT1936469

Component: TMOS

Symptoms:
A device reboot occurs when pressing Ctrl-Alt-Del multiple times in rapid succession.

Conditions:
This occurs when pressing Ctrl-Alt-Del or sending the command to a BIG-IP Virtual Edition (VE) virtual console more than 7 times within 2 seconds.

Impact:
Accidental or unauthorized reboots of the BIG-IP instance are possible.

Workaround:
None

---

1936233-2 : TMM mismanagement of IPsec connections can slowly leak memory and cause tunnel negotiation to fail

Links to More Info: BT1936233

Component: TMOS

Symptoms:
-- The BIG-IP cannot setup a specific IPsec tunnel.
-- The BIG-IP may eventually run out of memory, or core

Conditions:
-- IPsec IKEv2
-- Tunnel config changes, or tunnel never works from initial setup

Impact:
-- TMM may run out of memory after a very long time
-- TMM may core due to the leaked connections

Workaround:
None

---

1935833-1 : Tmm cores with "ERR: Attempting to send MPI message to ourself"

Links to More Info: BT1935833

Component: TMOS

Symptoms:
A TMM crash occurs, tmm_assert is triggered if an MPI message is sent to the same TMM (self).

Conditions:
New IPsec tunnel configured or deleted and High Availability config sync is started.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None.

---

1935713-1 : TMM crash when handling traffic over vlangroup with autolasthop disabled

Links to More Info: BT1935713

Component: Local Traffic Manager

Symptoms:
In certain circumstances, TMM may crash when handling traffic over a vlangroup with autolasthop disabled.

Conditions:
- Vlangroup.
- No self-IP addresses configured.
- Autolasthop is disabled.

Impact:
Traffic is disrupted while restarting TMM.

Workaround:
Enable autolasthop.

---

1934941-2 : Assertion failure in aspath_intern for BGPD.

Links to More Info: BT1934941

Component: TMOS

Symptoms:
Assertion failure in BGPD

Conditions:
BGP routing configured, enabled

Impact:
Assertion failure

Workaround:
None

---

1934865-2 : Remove multiple redundant entries for port-list objects in configuration file

Links to More Info: BT1934865

Component: Advanced Firewall Manager

Symptoms:
When a port-list object is created using one of the following TMSH CLIs (tmsh create net port-list, tmsh create security firewall port-list, or tmsh create security shared-objects port-list), redundant entries for the same object are generated in the configuration file under three contexts:

net port-list
security firewall port-list
security shared-objects port-list
For example, a port-list created using one CLI results in multiple entries referring to the same schema object, such as:
net port-list /Common/portListExample {
    ports {
        80 { }
        443 { }
    }
}

security shared-objects port-list /Common/portListExample {
    ports {
        80 { }
        443 { }
    }
}


security firewall port-list /Common/portListExample {
    ports {
        80 { }
        443 { }
    }
}

This behaviour causes unnecessary duplication in the configuration file.

Conditions:
Redundant entries occur in the configuration file when:
A port-list object is created using any one of the following TMSH CLIs:
1. tmsh create net port-list
2. tmsh create security firewall port-list
3. tmsh create security shared-objects port-list
All three CLI commands point to the same object and record three separate entries in the configuration file.

Impact:
Redundant entries in the configuration file lead to:
1. Increased configuration file size unnecessarily.
2. Risk of user confusion during manual editing or review of configuration files.

This issue does not impact runtime functionality or object behaviour, but it introduces maintenance overhead when users interact with their configurations.

Workaround:
None

---

1934845-2 : Transparent proxy loses APM session variables in SSL Orchestrator service

Links to More Info: BT1934845

Component: SSL Orchestrator

Symptoms:
Cannot access session variables

Conditions:
SSL Orchestrator Transparent Proxy configuration

Impact:
Unable to access session variables with Transparent Proxy

Workaround:
Attach a dummy swg_transparent

---

1934457-1 : Cursor in BIG-IP Configuration Utility iRule editor appears in the incorrect position

Links to More Info: BT1934457

Component: TMOS

Symptoms:
The cusrsor is at the incorrect position when using BIG-IP Configuration Utility iRule editor for long lines with unwrapped text.

Conditions:
1. Edge or Chrome on Windows
2. Zoom is set at 100%
3. "Wrap Text", "Show Print Margin", and "Ignore Signature/Checksum" are unchecked
4. For a long line in the editor, the cursor would appear in the wrong position.

Impact:
Editing the iRule becomes inconvenient and prone to errors.

Workaround:
Set the zoom in the browsers at 125%

---

1934373-1 : DoS attack is blocking while transparent

Links to More Info: BT1934373

Component: Application Security Manager

Symptoms:
A DoS attack is blocking while configured as transparent.
The blocking is only by resets

Conditions:
A transparent volumetric dosl7 and web acceleration profile are configured on the same virtual

Impact:
Blocking even though the configuration is transparent.

Workaround:
tmsh modify sys db dosl7d.static_uri_protection value disable

---

1934157-1 : Http2 monitor fails if a pool is used for routing to pool members

Links to More Info: BT1934157

Component: Local Traffic Manager

Symptoms:
Http2 monitoring reports all pool members as down

Conditions:
The TCP connection to the pool members are sent to the gateway instead of the pool members

Impact:
Http2 monitoring not possible

Workaround:
Use tcp monitoring or https if possible and acceptable.

---

1933965-1 : Unable to associate multiple cert/keys of different types to Certificate Key Chain via TMSH

Links to More Info: BT1933965

Component: Local Traffic Manager

Symptoms:
Below error is thrown when assigning RSA cert/key followed by ECDSA cert/key with below command

tmsh create ltm profile client-ssl /path/_ssl_server cert-key-chain replace-all-with {
  _cert_rsa_0 {
    cert /path/_cert_rsa.crt
    key /path/_cert_rsa.key
    chain none
    usage SERVER
  }
  _cert_ecdsa_0 {
    cert /path/_cert_ecdsa.crt
    key /path/_cert_ecdsa.key
    chain none
    usage SERVER
  }
}

Error:
010717e1:3: Client SSL profile (/path/_ssl_server): cannot contain more than one set of same certificate/key type.

Conditions:
Assigning RSA cert/key followed by ECDSA cert/key

Impact:
Unable to create the client SSL profile

Workaround:
Workaround 1: change the certificate chain order so the ECDSA cert/key occurs before the RSA cert/key.

tmsh create ltm profile client-ssl /path/_ssl_server cert-key-chain replace-all-with ＼{ _cert_ecdsa_0 ＼{ cert /path/_cert_ecdsa.crt key /path/_cert_ecdsa.key chain none usage SERVER ＼} _cert_rsa_0 ＼{ cert /path/_cert_rsa.crt key /path/_cert_rsa.key chain none usage SERVER ＼} ＼}

tmsh list ltm profile client-ssl /path/_ssl_server

ltm profile client-ssl /path/_ssl_server {
  app-service none
  cert-key-chain {
    _cert_ecdsa_0 {
      cert /path/_cert_ecdsa.crt
      key /path/_cert_ecdsa.key
    }

    _cert_rsa_0 {
      cert /path/_cert_rsa.crt
      key /path/_cert_rsa.key
    }
  }

  inherit-ca-certkeychain true
  inherit-certkeychain false
}

Workaround #2: Create a Client SSL and associate only 1 RSA cert/key. Thereafter, associate the next set of ECDSA cert/key to the same Client SSL profile.

1) Create SSL profile and associate only the RSA cert/key to Certificate Key Chain.

# tmsh create ltm profile client-ssl /path/_ssl_server cert-key-chain replace-all-with ＼{ _cert_rsa_0 ＼{ cert /path/_cert_rsa.crt key /path/_cert_rsa.key chain none usage SERVER ＼} ＼}
 

2) Associate existing ECDSA cert/key to Certificate Key Chain of the above SSL Profile

#tmsh modify ltm profile client-ssl /path/_ssl_server cert-key-chain add {_cert_ecdsa_0 { cert /path/_cert_ecdsa.crt key /path/_cert_ecdsa.key chain none usage SERVER }}
 
tmsh list ltm profile client-ssl /path/_ssl_server
ltm profile client-ssl /path/_ssl_server {
    app-service none
    cert-key-chain {
        _cert_ecdsa_0 {
            cert /path/_cert_ecdsa.crt
            key /path/_cert_ecdsa.key
        }
        _cert_rsa_0 {
            cert /path/_cert_rsa.crt
            key /path/_cert_rsa.key
        }
    }
    inherit-ca-certkeychain true
    inherit-certkeychain false
}

---

1933105-2 : TMM does not fragment the output before encapsulating the payload

Links to More Info: BT1933105

Component: TMOS

Symptoms:
Tmm does not fragment the traffic before it goes to encapsulation

Conditions:
- IPSec
-- Tmm receives fragmented payload

Impact:
Large packets are not fragmented on egress.

Workaround:
None

---

1933061-2 : Changing "bot category" of an user-defined bot-signature should be validated and denied when the change is not appropriate

Links to More Info: BT1933061

Component: Application Security Manager

Symptoms:
Disallowed configuration gets accepted. Subsequent full configuration load fail and unit remains offline.

Conditions:
A user-defined bot is configured under bot-signature
AND the bot is configured for mitigation exception

Then, bot category of the bot gets updated and new category is one of the categories that is under Unknown/Browser/Mobile Application class

After above operation are performed, subsequent config full load fails.

Impact:
Configuration load fail and unit remains offline.

Workaround:
- Do not perform the operation described in Conditions section

- If it has been performed but your unit is still online, use GUI or TMSH to revert the change of bot category

- If it has been performed and config load has failed and unit is offline state, manually revert the change of bot category as below

e.g:

MyBot was configured in mitigation exception. Bot category of MyBot was updated to be "Mobile App without SDK" that should not be accepted, but accepted due to this bug.

Manually modify /config/bigip.conf

// Before manual modification

security bot-defense signature /Common/MyBot {
    category "/Common/Mobile App without SDK"
    risk na
    user-agent {
        search-string MyBot
    }
}

// After manual modification

security bot-defense signature /Common/MyBot {
    category "/Common/Search Bot"
    risk na
    user-agent {
        search-string MyBot
    }
}


Save the change then
# bigstart restart

If this does not reflect the manual modification, perform force mcpd reload.

# rm -f /var/db/mcpdb.* ; touch /service/mcpd/forceload
# bigstart restart

---

1932965-2 : AVRD may crash at startup due to non-thread-safe version of BOOST json Spirit parser

Links to More Info: BT1932965

Component: Application Visibility and Reporting

Symptoms:
Avrd crashes while processing JSON

Conditions:
AVRD utilizes the BOOST Spirit-based JSON parser to parse JSON documents

Impact:
AVRD might crash impacting application performance and traffic analytics may stop being collected or processed while avrd restarts.

Workaround:
None

---

1932161 : PEM iRule usage memory leak

Links to More Info: BT1932161

Component: Policy Enforcement Manager

Symptoms:
When using PEM iRules there is a chance of a memory leak

Conditions:
Using PEM iRules

Impact:
TMM memory leak

Workaround:
None

---

1930841-2 : Tmsh show sys conn virtual-server may report an incomplete set of flows after a virtual server modification

Links to More Info: BT1930841

Component: Local Traffic Manager

Symptoms:
After modifying a virtual server, 'tmsh show sys connection virtual <virtual-server-name>' may not report connections already existing when the change occurred.

Conditions:
Use the command "tmsh show sys connection virtual <virtual-server-name>".

Impact:
The complete set of connections for the virtual server may not be reported.

Workaround:
Use 'tmsh show sys connection cs-server-addr' (or other selection criteria) instead.

---

1929045-1 : TMM may core after HTTP::respond used for first request on iSession connection

Links to More Info: BT1929045

Component: Local Traffic Manager

Symptoms:
TMM crashes while establishing an iSession tunnel.

Conditions:
- APM configured
- Tunnel being established

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

---

1928169-2 : HTTP2 RST_STREAM NO_ERROR received by BIG-IP not interpreted correctly

Links to More Info: BT1928169

Component: Local Traffic Manager

Symptoms:
Communication disrupted to the client when server sends a RST_STREAM NO ERROR

Conditions:
if the server has already sent a response (e.g., headers and body) and does not need additional data from the client (e.g., request body for POST or PUT requests), it might send a RST_STREAM with NO_ERROR to stop the stream and signal that no further data is required.

Impact:
Communication disrupted.

Workaround:
None

---

1928157 : [APM][SAML] constant SIGSEGV "in saml_sp_finish_message_signing" after upgrade to 17.1.x★

Links to More Info: BT1928157

Component: Access Policy Manager

Symptoms:
After upgrade, tmm crashes while passing SAML traffic.

Conditions:
-- SAML profile configured.
-- The profile doesn't have a signed certificate configured for the SP profile
-- The IDP profile does have a signed certificate

Impact:
Traffic disrupted while tmm restarts.

Workaround:
Add the signed certificate to the same profile

---

1927829-2 : SSL Orchestrator resets connection with connection abort waiting for data from an inline service

Links to More Info: BT1927829

Component: SSL Orchestrator

Symptoms:
Traffic flowing through topologies gets reset (RST) instead of waiting for data to flow from inline services.

Conditions:
A topology is configured to make use of at least one inline service.

Impact:
Connections get reset (RST) and the client does not get data.

Workaround:
None

---

1927513-3 : SIGSEGV TMM core ikev2_encrypt_packet_construct at iked/ikev2_packet.c:334

Links to More Info: BT1927513

Component: TMOS

Symptoms:
Crashes after many failovers when upgraded from 15.1.x to 17.1.x version.

Conditions:
Failover

Impact:
Crash and tmm restartsTraffic is disrupted when tmm restarts.

---

1926733-2 : Tmm memory leak with L7 response policy

Links to More Info: BT1926733

Component: Local Traffic Manager

Symptoms:
TMM slowly leaks memory.

During diagnosis, with the following diagnostic command:
tmctl -w192 -id blade memory_usage_stat | egrep "http_data|cur_"

http_data indicates the highest memory usage

Conditions:
-- Virtual Server with fastL4 + HTTP
-- L7 response policy attached (for example redirect-http-https)

Impact:
Http_data usage goes up over time and does not return to prior levels when traffic ceases.

Workaround:
None

---

1922617-2 : BGP Multipath selection might be unpredictable.

Links to More Info: BT1922617

Component: TMOS

Symptoms:
BGP Multipath selection might be unpredictable.

Conditions:
Four EBGP neighbors in two different AS, each sending the same route (NRLI) towards BIG-IP. Route might sometimes not be considered candidate for multipath.

Impact:
Route might not be considered candidate for multipath.

Workaround:
Set 'bgp bestpath as-path multipath-relax' to install all available paths.

---

1921085-3 : Core file generated when using FTP::ftps_mode require without SSL profile in TCP filter

Links to More Info: BT1921085

Component: Local Traffic Manager

Symptoms:
Tmm crashes while passing ftp traffic.

Conditions:
1. create a FTP virtual without SSL profile.
2. create a iRule to force FTP::ftps_mode require in FTP profile like
when CLIENT_ACCEPTED {
    FTP::ftps_mode require
}

3. Attempt FTP transfer via FTP virtual created.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
Attach appropriate SSL profile to the FTP virtual.

---

1921069-1 : The error ERR_ARG occurs when using iRule HTTP::collect command without the parameter value in HTTP_REQUEST_DATA

Links to More Info: BT1921069

Component: Local Traffic Manager

Symptoms:
The iRule HTTP::collect command without the parameter value in HTTP_REQUEST_DATA returns an error.

Conditions:
The error occurs when the HTTP::collect does not have any value.

Impact:
The iRule fails with ERR_ARG error.

Workaround:
Always enter value to HTTP::collect. Refer HTTP::collect iRule command page, https://clouddocs.f5.com/api/irules/HTTP__collect.html.

This workaround will depend on the specific iRule being used.

---

1921049-2 : When L7 policy is updated, existing HTTP/2 connection using it gets a RST_STREAM

Links to More Info: BT1921049

Component: Local Traffic Manager

Symptoms:
HTTP/2 connections sometimes get a RST_STREAM

Conditions:
L7 policy that is being used by HTTP/2 connections is updated or changed.

Impact:
Lost of connectivity on a HTTP/2 stream.

Workaround:
Avoid updating L7 Policy while Http/2 connections are active.

---

1921025-2 : Need more information when http2 RST STREAM

Links to More Info: BT1921025

Component: Local Traffic Manager

Symptoms:
Sometimes, finding the root cause of an http2 RST STREAM is more difficult

Conditions:
Troubleshooting issues with HTTP2

Impact:
Difficulty in debugging.

Workaround:
None

---

1917741-1 : [APM][TMM] memory growth in SAML SP while decoding assertion attributes

Links to More Info: BT1917741

Component: Access Policy Manager

Symptoms:
Tmm crashes due to out of memory while passing SAML traffic

Conditions:
-- SAML SP configured with assertion attributes.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

---

1917677-3 : "show security ip-intelligence info address" may fail to query legacy IP Reputation database

Links to More Info: BT1917677

Component: Advanced Firewall Manager

Symptoms:
When using the command "show security ip-intelligence info address", Query Legacy IP Reputation Database may not get queried.

Explicit documentation outlining how to configure a policy to enable IP reputation database queries in association with this command is missing.

Conditions:
- System provisioned with either ASM or AFM.
- IP Intelligence license activated.
- An IP Intelligence policy configured in the system.

Impact:
The command does not work with the database as intended.
Although the output of the command shows legacy in the IP Intelligence Sources, it does not return the lookup results of the IP reputation database.

Workaround:
None

---

1900621-1 : Missing client ip

Links to More Info: BT1900621

Component: Application Security Manager

Symptoms:
Client ip address not available for some dosl7 attack ids

Conditions:
Remote logging configured

Impact:
Source ip missing for some attack ids on remote server/dos dashboard

Workaround:
Check attack info in lcoal log_db which contains client ip in on another event

---

1893989-2 : NTP truncates symmetric keys to 30 bytes

Links to More Info: BT1893989

Component: TMOS

Symptoms:
The Network Time Protocol (NTP) server, where symmetric keys were used for cryptographic operations, was truncated to 30 bytes. This limitation restricted the effective length of symmetric keys even when longer keys were provided. As a result, it reduced the expected level of security for configurations utilizing keys longer than 30 bytes. (For example, using SHA256 symmetric keys will fail)

Conditions:
When NTP uses a symmetric key size of 30 bytes or more.

Impact:
- Truncating symmetric keys to 30 bytes in NTP significantly reduces security by limiting entropy, diminishing compliance with cryptographic standards, and opening systems to a range of attack vectors.
- The truncation silently weakens configurations, affecting user trust and operational reliability.

Workaround:
None

---

1890997-2 : TCP connection stall in TMM conn table with ASM policy and no websocket profile

Links to More Info: BT1890997

Component: Application Security Manager

Symptoms:
Virtual server configured with and ASM policy but no websocket profile. After a 101 response and the TCP 4-way teardown, the connection isn't removed from TMM connection table.

Conditions:
Virtual server with ASM policy, no websocket profile

Impact:
Connection is not removed from the TMM connection table

Workaround:
Add a websocket profile to the virtual server configuration.

---

1890749-1 : In a multi-user scenario, the system is allowing users to create more authentication tokens than the maximum limit allowed per user.

Links to More Info: BT1890749

Component: TMOS

Symptoms:
In a multi-user scenario, users are able to create more tokens than the max allowed setting allows.

Conditions:
-- User1 creates 100 tokens
-- User2 creates 100 tokens
-- restart restjavad process
-- User1 try to create new token
-- User1 can create new token without an error

Impact:
No limitation for using tokens.

Workaround:
None

---

1889877-2 : The tmrouted daemon scheduling multiple ZebOS processes might lead to delayed process starts

Links to More Info: BT1889877

Component: TMOS

Symptoms:
No BFD sessions will be established.

Conditions:
When multiple BGPD processes are scheduled for startup by the tmrouted daemon, a condition can occur when tmrouted initiates the startup of several daemons simultaneously. This triggers a thread handling issue on the BGPD side, where one process progresses successfully, but the others get stuck and fail to advance.

Impact:
Processes are starting and getting rescheduled, repeatedly.

---

1889861-2 : Passive monitoring with ASM might not log the server response.

Links to More Info: BT1889861

Component: Local Traffic Manager

Symptoms:
Passive monitoring with ASM might not log the server response.

Conditions:
Passive monitoring with ASM deployed. Similar to https://techdocs.f5.com/en-us/bigip-14-1-0/big-ip-asm-implementations-14-1-0/working-with-passive-monitoring.html

Impact:
Server response is not getting logged.

Workaround:
None

---

1889741-1 : Need for the SYS DB variable to toggle ssl_crypto::queue_max

Links to More Info: BT1889741

Component: Local Traffic Manager

Symptoms:
While ssl_crypto::queue_max can be configured using TCL commands, a corresponding TMSH equivalent is required.

Conditions:
When the system handles a large number of concurrent SSL handshakes or cryptographic operations

Impact:
-- SSL handshake failures
-- Inability to configure the ssl_crypto::queue_max via tmsh

Workaround:
None

---

1881569-3 : Programs invoked by tmsh when session is interrupted may remain running

Links to More Info: BT1881569

Component: TMOS

Symptoms:
If an interactive user session is interrupted while a tmsh process is executing another command (e.g. bash), under particular circumstances the child process may continue executing.

This occurs if the bash process is itself executing a long-running command (e.g. 'watch' or 'tcpdump' or similar), and then the SSH connection is interrupted.

Conditions:
-- An interactive tmsh process runs another program (e.g. bash)
-- That bash process is executing another command that will not generally exit on its own without user intervention (e.g. 'watch' or 'tcpdump')
-- The user session is interrupted

Impact:
Processes remain executing even after they should have been terminated because the user session disconnected.

If the long-running command the bash process is executing tries to invoke tmsh, the LTM log file may contain repeated logs similar to the following:

Mar 25 12:10:00 hostname notice tmsh[22420]: 01420003:5: Cannot load user credentials for user "username"
Mar 25 12:10:00 hostname notice tmsh[22420]: 01420003:5: The current session has been terminated.

Workaround:
Avoid unclean shutdown/interruption of user sessions if possible. Otherwise, identify the long-running processes that are still running, and then kill them.

---

1881537-2 : Platform Agent does not log diff of Feature Info Attributes

Links to More Info: BT1881537

Component: F5OS Messaging Agent

Symptoms:
Whenever a change is made in F5OS, platform agent dumps the complete list of feature info attributes. Update the platform agent log to show the attribute changes to highlight relevant changes to ease debugging.

Conditions:
- F5OS change on hypervisor such as trunk change.
- Platform agent outputs feature info attributes list.

Impact:
Log messages could be more clear to ease debugging.

Workaround:
None

---

1881509-2 : Platform Agent not logging Trunk changes from F5OS

Links to More Info: BT1881509

Component: F5OS Messaging Agent

Symptoms:
When trunk changes are made in F5OS, they are not explicitly logged on the tenant.

Conditions:
F5OS tenant making a trunk change.

Impact:
Hard to debug trunk changes made live on F5OS.

Workaround:
None

---

1880441-1 : Security log profile IPI options are visible for configuration in UI but not allowed

Links to More Info: BT1880441

Component: Advanced Firewall Manager

Symptoms:
In the AFM UI (Security ›› Event Logs : Logging Profiles ›› Edit Logging Profile), the user can edit IPI section and enable the following checkboxes:

Log Shun Events Enabled
Log Geo Events Enabled
Log RTBH Events Enabled
Log Scrubber Events Enabled

However, enabling any of them may result in an error: « The <OPTION NAME> option can only be enabled on the global-network log profile.»

Conditions:
Using the AFM UI to enable the logging profile for IPI options

Impact:
The IPI logging options are not configurable in the UI

Workaround:
None

---

1880009-2 : The BIG-IP Sync-only group syncs the virtual server with the attached port-list

Links to More Info: BT1880009

Component: TMOS

Symptoms:
A virtual server in a sync-only device group is synced to the other device(s).

Conditions:
- Sync-only device group with at least 2 members
- A port list is created in a partition
- A virtual server is created in the partition that uses the port list
- Config sync occurs

Impact:
Traffic objects such as the virtual server, pools, port-list are inadvertently synced to the other device(s)

Workaround:
None

---

1857473-1 : A BIG-IP monitor may not get removed when changing product type from BIG-IP to Generic Host

Links to More Info: BT1857473

Component: Global Traffic Manager (DNS)

Symptoms:
A BIG-IP monitor may not get removed when changing product type from BIG-IP to Generic Host.

Conditions:
- A generic-host is added to the GTM config as type BIG-IP.
- The User then manually changes the product-type to generic-host

Impact:
The BIG-IP monitor is not removed. Running 'tmsh load sys config gtm-only' will then fail because validation will not permit a server of type generic-host with a monitor of type /Common/bigip

Workaround:
None

---

1856513-1 : Tomcat fails to write log messages to /usr/share/tomcat/logs/liveupdate.log

Links to More Info: BT1856513

Component: Application Security Manager

Symptoms:
You only see this message in /var/log/tomcat/liveupdate.log file. No other log messages are written, which impedes troubleshooting Live Update.

liveupdate.script file is corrupted, live update repository initialized with default schema

Conditions:
You are running on a version which has a fix for ID 907025.

For more information see https://cdn.f5.com/product/bugtracker/ID907025.html

Impact:
Difficult to troubleshoot issues that occur with Live Update

Tomcat memory growth can cause tomcat to run out of memory, be slow, and use higher than usual CPU due to increased garbage collection activity.

Workaround:
Run the following commands:

chown tomcat:tomcat /var/log/tomcat/liveupdate.log
 /usr/share/tomcat/logs/liveupdate.log

bigstart restart tomcat

---

1856449-2 : [keymgmtd]OpenSSL: DRBG Continuous RNG test failed: DRBG stuck.

Links to More Info: BT1856449

Component: TMOS

Symptoms:
You may observe below logs in /var/log/ltm

err keymgmtd[31381]: OpenSSL: DRBG Continuous RNG test failed: DRBG stuck.
err fips_monitor[18007]: 01da0011:3: SelfTest/Integrity test failure detected, triggering reboot action

Conditions:
Conditions are unknown

Impact:
Unexpected reboot causing disruption to traffic and failover.

Workaround:
None

---

1854461-1 : Unable to delete file from "Available to Deploy" when removed from "Available to Install"

Links to More Info: BT1854461

Component: Protocol Inspection

Symptoms:
When deleting an IPS policy, the GUI reports an error "Unable to delete file", but the file is deleted.

Conditions:
After deleting the IM package from the "Available to install", followed by saving the save sys config and reboot the BIG-IP device. Unable to delete the IM package from the "available to deploy" and which leads to the GUI error

Impact:
No functionality impact, only the GUI error, which is cosmetic.

Workaround:
None

---

1854353-1 : Users with Resource admin role are not able to save the UCS.

Links to More Info: BT1854353

Component: TMOS

Symptoms:
When creating a UCS file, an error occurs:

Data Input Error: Invalid partition ID request, partition does not exist ([All])
Error during config save.
Unexpected Error: UCS saving process failed.

Conditions:
-- Creating a UCS file
-- The user role that initiated the UCS save is Resource Admin

Impact:
Users in a Resource Admin role are unable to save a UCS file.

Workaround:
Other admin type roles are able to save the UCS file.

---

1854137-2 : Verified accept and pool reselect-tries may cause TCP proxy to core

Links to More Info: BT1854137

Component: Local Traffic Manager

Symptoms:
Tmm crashes and restarts

Conditions:
-- TCP Virtual server with verified-accept enabled
-- Some form of asynchronous persistance
-- Flaky pool members at precisely the right time in the verified accept sequence.
-- Delayed ACK on serverside, thus allowing the pool member to be taken down and the sweeper to expire the server-side flow.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

---

1849829-1 : Deprecation of dnssec-lookaside and dnssec-enable Directives in latest BIND release

Links to More Info: BT1849829

Component: SSL Orchestrator

Symptoms:
The directives dnssec-lookaside and dnssec-enable previously used in the named.conf configuration file are now deprecated and no longer supported by latest BIND versions.
If these directives are present in the named.conf file:
Error messages appear in DNS server logs when starting the named service.
The DNS server fails to start or exhibit unexpected behaviour due to the presence of unsupported directives.

Conditions:
1. SSL Orchestrator L3 explicit topology
2. Check bind version with below command
# named -v
BIND 9.18.28 (Extended Support Version) <id:f77fadb>

This version of BIND is not supporting mentioned dns tokens.

Impact:
DNS queries will fail if the BIND configuration (named.conf) contains unsupported directives (e.g., dnssec-lookaside, dnssec-enable).
As a result:
The DNS resolver will fail to process queries.
This will cause traffic relying on name resolution to fail, leading to potential disruptions in services that depend on DNS.

Workaround:
1. Remove the deprecated directives dnssec-lookaside and dnssec-enable from the BIND configuration file located at: /var/named/config/named.conf
2. After making the changes, restart the named service to apply the updated configuration: bigstart restart named

---

1849265-1 : A VCMP guest may not exit hardware syncookie mode

Links to More Info: BT1849265

Component: TMOS

Symptoms:
On a VCMP guest, if a virtual server enters hardware syncookie mode due to a syn flood, and the virtual server is passing a significant amount of valid traffic, it may not exit syncooke mode.

Conditions:
-- VCMP guest
-- Hardware syncookie mode

Impact:
Syncookies may continue to be issued even though the attack has stopped.

Workaround:
Remove traffic from the virtual server until syncookies deactivates.
This can be accomplished by using cli transaction to alter the first virtual server and create an identical new virtual server.
Example:
Assume my_vs1 is the existing virtual server listening on port 80
tmsh
create /cli transaction
delete ltm virtual my_vs1
create ltm virtual my_vs2 destination 10.10.10.16:80 pool pool1 profiles add { fastL4 http } source-address-translation { type automap }
submit /cli transaction

This will, delete the first virtual server but existing TCP connections will be maintained. And then the new virtual server will be created which will accept new transaction. Since syncookie are enabled per virtual server, this new virtual server will not be in hardware syncookie mode.

---

1848577-1 : VCMP guest stats are not visible on vCMP host GUI nor CLI

Links to More Info: BT1848577

Component: Application Visibility and Reporting

Symptoms:
- Issuing the command 'tmsh show analytics vcmp report view-by guest measures { average-guest-cpu-usage }' returns 'No data available'
- Graphs on 'Statistics ›› Analytics : vCMP : CPU Usage' says "There is no data to display either due to the lack of relevant traffic or due to the settings of the filter." even after the vCMP guest has been running for more than 10 minutes.

Conditions:
- vCMP host running v17.1.x
- The following tables are missing when issuing the command tmctl -f /var/tmstat/blade/vcmp_union_tables' from the vCMP host:
  vcmp_tmm_stat_union
  vcmp_pva_stat_union
  vcmp_proc_pid_stat_union
  vcmp_host_info_stat_union

Impact:
No stats (eg. CPU, Network, Disk Usage) can be seen for the vCMP guests when looking from the vCMP host.

Workaround:
Run this Bash one-liner from the vCMP host:

 bigstart restart merged ; sleep 600 ; bigstart restart avrd ; sleep 600 ; bigstart restart avrd merged ; sleep 600 ;

Thereafter, check the tables and analytics with these commands:

 tmctl -w$COLUMNS -f /var/tmstat/blade/vcmp_union_tables
 tmsh show analytics vcmp report view-by guest measures { average-guest-cpu-usage }

---

1848565-1 : Error during updating device details: Internal error (Json parser error)

Links to More Info: BT1848565

Component: Access Policy Manager

Symptoms:
Mdmsyncmanager reports errors for every query from the MDM DB:

Error in /var/log/apm:

notice mdmsyncmgr[24645]: 019dffff:5: (null)::00000000: {} /Common/mdm: Start querying devices from https://mysite.com/TrafficGateway/TrafficRoutingService/ResourceAccess/ComplianceRetrievalService

err mdmsyncmgr[24645]: 019dffff:3: (null)::00000000: {} /Common/mdm: Error during updating device details: Internal error (Json parser error)

Conditions:
MDM is configured.

Impact:
Errors are logged by mdmsyncmanager due to JSON errors. Other causes or impacts are unknown, this does not seem to impact traffic.

Workaround:
None

---

1828005-2 : Syslog message does not carry log level when destination is remote

Links to More Info: BT1828005

Component: TMOS

Symptoms:
When a syslog include filter includes a local log source, the log level filter is ignored for the remote syslog server.

Conditions:
Add an include filter with source,filter,destination and configure source as local:

include "
filter f_remote_loghost {
facility(local0) and level(info..emerg);
};
destination d_remote_loghost {
udp(＼"<ip>＼" port(514));
};
log {
source(local);
filter(f_remote_loghost);
destination(d_remote_loghost);
};
"

Impact:
Log level is not displayed. This makes it difficult to understand the priority of the logs on the remote system.

Workaround:
Include s_syslog_pipe as source in the include filter

Steps to apply:
1. Login to tmsh and execute the command to edit the config : tmsh edit /sys syslog all-properties
2.Add the below include config:
include "
filter f_remote_loghost {
facility(local0) and level(info..emerg);
};
destination d_remote_loghost {
udp(＼"<ip>＼" port(514) );
};
log {
source(s_syslog_pipe);
filter(f_remote_loghost );
destination(d_remote_loghost);
};
"
3.Save the file and restart syslog with the command: bigstart restart syslog-ng
4. This will reflect the logs with priority in the remote server

---

1827821-1 : isBase64 params and headers not blocking Attack Signatures

Links to More Info: BT1827821

Component: Application Security Manager

Symptoms:
The parameter value in GET requests are considered as base64 even when the calculated score is below 'base64_max_score'

Params and headers configured as "Base64Decode=required" do not detect base64 encoded attack signatures.

Conditions:
-- Create a parameter named "param" configured as "Base64Decode=required".
-- Send Request to URL /?param=PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==

Impact:
No Violations Detected, while the parameter included an attack signature (PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg== is the base64 encoded value of <script>alert(1)</script>)

Workaround:
None

---

1826485-1 : Creating a GTM pool in a custom partition with a custom route domain via GUI can fail

Links to More Info: BT1826485

Component: Global Traffic Manager (DNS)

Symptoms:
Creating a GTM pool in a custom partition with a custom route domain via GUI can fail with the following error message:

"The specified IP address(es) specified by (0.0.0.0%1) cannot be a route domain address(es) (fallback "IP address)."

Conditions:
Using a custom partition and custom route domain

Impact:
A GTM pool will not be created via the GUI

Workaround:
The same pool can be created using the TMSH command "create gtm pool"

---

1826273-1 : Mysql client uses TLS1.1 when connecting to mysql server running 5.7

Links to More Info: BT1826273

Component: TMOS

Symptoms:
Connection is always negotiated with TLS1.1

Conditions:
The mqsql client in BIG-IP's version is 5.1.47, which hardcode's the TLS version used to connect with mysql server versions which supports TLS1.1. TLS1.1 is not a supported version in mysql server 8.0.0.4 onwards and client successfully connects to those servers with TLS 1.2.

Impact:
Client should negotiate with TLS1.2

Workaround:
None

---

1826185-1 : Tenants on r2000 and r4000 series may drop packets larger than 9194 bytes

Links to More Info: BT1826185

Component: Local Traffic Manager

Symptoms:
F5OS tenants have a supported maximum MTU of 9198 bytes as per K6399. Tenants running on 2000 and r4000 series may drop packets larger than 9194 bytes.

The tmm/xnet/iavf/per_vf_stats.rx_discards stat increments when this occurrs.

Conditions:
R2000 or r4000 platform.
Jumbo frames

Impact:
Dropped jumbo frames

Workaround:
Lower the MTU such that packets are not exceeding 9194 bytes.

---

1825917-1 : Dynamic TCAM protocol error

Links to More Info: BT1825917

Component: Advanced Firewall Manager

Symptoms:
Below error log is printed by TMM
crit tmm[2544]: 01010289:2: Oops @ 0x3267aa2:2594: Dynamic TCAM protocol error

Conditions:
TCAM database is full

Impact:
A message is logged but there is no functional impact

Workaround:
Bigstart restart of services

---

1825513-3 : ClientSSL profile with PQC group may cause TMM to crash

Links to More Info: BT1825513

Component: Local Traffic Manager

Symptoms:
TMM or system services may restart unexpectedly due to memory pressure.

In /var/log/tmm:

warning tmm[24255]: 01260013:4: SSL Handshake failed for TCP 10.20.2.115:44404 -> 10.20.40.191:443
err tmm[24255]: 01230140:3: RST sent from 10.20.40.191:443 to 10.20.2.115:44404, [0x3076761:2571] SSL handshake timeout exceeded
err tmm3[24255]: 01010282:3: Crypto codec error: sw_crypto-3 RSA private encrypt error OpenSSL error:03078069:bignum routines:BN_EXPAND_INTERNAL:expand on static bignum data
err tmm2[24255]: 01010282:3: Per-invocation log rate exceeded; throttling.
 err tmm6[24255]: 01010282:3: Resuming log processing at this invocation; held 53 messages.

Conditions:
Cipher rule DH group X25519KYBER768 is enabled.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
There is no workaround, disable X25519KYBER768 to mitigate the issue.

---

1825357-1 : Possible tmm crash or traffic loss after making vlan interface changes with an empty trunk

Links to More Info: BT1825357

Component: Local Traffic Manager

Symptoms:
Tmm crashes and generates a core file.

or

Network traffic via a trunk does not work.

Conditions:
Platform i2600, i2800, i4600, i4800, r2800, r4800 or VADC

All trunk members are removed from a trunk attached to a vlan.
Then, the trunk is removed from one or more vlans.
Then, the trunk is deleted.
This could result in a tmm crash.

or

A trunk with no members is added to a vlan.
Then, one or more members are added to the trunk.
This will result in traffic on that vlan not being being sent over that trunk.

Impact:
Traffic disrupted while tmm restarts
or
Traffic is not sent out via the trunk

Workaround:
Do not remove and a trunk with no members from a vlan.
It will be necessary to restart tmm to correct this situation.

Do not add a trunk with no members to a vlan.
If a trunk with no members was added to the vlan, the issue can be corrected by removing the trunk from the vlan, ensuring that there are members in the trunk and adding it back to the vlan.

---

1825249 : read_until: end of file

Links to More Info: BT1825249

Component: Access Policy Manager

Symptoms:
The Configuration Utility displays an error: "read_until: end of file."

Conditions:
-- Viewing a virtual server in the GUI
-- The Virtual Server does not have an HTTP profile attached

Impact:
The GUI prints a "read_until: end of file" error

Workaround:
None

---

1824985-1 : In rare cases the Nitrox hardware compression queue may stop servicing requests.

Links to More Info: BT1824985

Component: Local Traffic Manager

Symptoms:
In rare cases, the Nitrox hardware may stop servicing requests.

When this issue occurs the tmctl compress table shows a high number of cur_enqueued entries and the number of requests handled in software (zlib) will be growing.

Conditions:
-- Nitrox compression hardware.
-- HTTP compression in use.

Impact:
Some connections may fail, and higher than expected CPU usage will be observed since requests will be handled in software.

Workaround:
Remove traffic from the device, or disable compression until the queues are completely drained.

---

1824965 : Implement iRule support to fetch SNI from SSL, HTTP and QUIC traffic

Component: Traffic Classification Engine

Symptoms:
You can not use an iRule to look up the SNI/hostname from SSL, HTTP, and QUIC traffic.

Conditions:
You need to look up the SNI/hostname in an iRule

Impact:
You are unable to look up the SNI or hostname.

Workaround:
None

---

1824745-1 : Bd crash and generate core

Links to More Info: BT1824745

Component: Application Security Manager

Symptoms:
Bd crashes

Conditions:
Unknown

Impact:
Traffic disrupted while bd restarts.

Workaround:
None

---

1824629-3 : [APM] APMd is cored due to Deny agents that are not available

Links to More Info: BT1824629

Component: Access Policy Manager

Symptoms:
Apmd crashes - the deny agent shared object has been unloaded - thus APMD attempts to execute code in the location where the deny agent used to be. The allow agent shared object is still present

Conditions:
-- Apmd is provisioned, passing traffic
-- Other conditions are unknown

Impact:
Access traffic disrupted while apmd restarts.

Workaround:
None

---

1824521-1 : GUI: VLAN names are not populated while creating the vlan-group under Network Quick configuration

Links to More Info: BT1824521

Component: Local Traffic Manager

Symptoms:
VLAN names are not present as a dropdown option in the Quick configuration GUI.

Conditions:
On a tenant device, navigate to Network -> Quick Configuration -> Create -> VLAN Group Properties -> Tag

Impact:
We may be unable to configure the vlangroup from the Quick configuration GUI on the tenant

Workaround:
VLAN groups can be configured through the following path:
Network > VLANs > VLAN Groups > Create

This interface provides a list of available VLANs from which you can select members to add to the VLAN group.

You can also configure VLAN Groups via the CLI.

---

1824113-1 : GTM iRule : [active_members <poolname>] command ignores any status effects applied by a parent.

Links to More Info: BT1824113

Component: Global Traffic Manager (DNS)

Symptoms:
Disabling a pool or virtual server that is referenced by a pool member affects how pool <poolname> selects a response, but [active_members <poolname>] still returns a value that ignores these status effects.

Conditions:
-- GTM pool
-- An iRule that checks the available_members of the pool is greater than zero before selecting the pool
-- Disable the pool

The pool is still selected for client queries to the wideIP

Logs show that the available_members is equal to the number of pool members, even though the pool is disabled.

Impact:
Unable to manage availability by disabling the pool.

Workaround:
None

---

1824097-1 : ARP is disabled in the virtual server listener when a DOS profile is configured via the Protected Object page

Links to More Info: BT1824097

Component: Advanced Firewall Manager

Symptoms:
After assigning a transparent DOS profile to a virtual server, the virtual server may suddenly stop processing traffic and will not respond to ARPs.

Conditions:
The DOS profile is applied via Security >> DoS Protection >> Protected Object

Impact:
The virtual server stops accepting traffic (no route to host) due to ARP disabled

Workaround:
Manually enable ARP(and icmp-echo) on the virtual-address:

#tmsh modify ltm virtual-address <ip address> arp enabled (icmp-echo enabled)

---

1824093-1 : Auto update not working for Protocol inspection

Links to More Info: BT1824093

Component: Protocol Inspection

Symptoms:
Automatic hitless upgrade for protocol inspection fails on tenant.

Conditions:
A BIG-IP system deployed as a tenant on rSeries

Impact:
Hitless upgrade fails for protocol inspection on tenant.

Workaround:
Install the hitless upgrade IM package manually.

---

1824009-2 : When DNS64 is enabled, resolver cache passes SERVFAIL responses to the client

Links to More Info: BT1824009

Component: Global Traffic Manager (DNS)

Symptoms:
When a DNS profile is configured with both Secondary DNS64 (with a prefix) and a resolver cache, any response from an authoritative server to a AAAA query with RCODEs such as SERVFAIL or SERVFAIL(Timeout due to no response from external resolver), FORMERR, NOTIMP, REFUSED, YXRRSET, NXRRSET, YXDOMAIN , NOTAUTH, or NOTZONE will be cached as SERVFAIL and sent directly to the client.

Conditions:
- DNS64 enabled in the DNS profile
- DNS resolver cache configured

Impact:
SERVFAIL response is directly send back to the client

Workaround:
None

---

1821353-1 : Error on long wildcard configuration

Links to More Info: BT1821353

Component: Application Security Manager

Symptoms:
When a wildcard url is configured with a size above 1023, the system can't start up.

Conditions:
The wildcard URL length exceed 1023 bytes.

Impact:
Bd goes into restart loop.

Workaround:
Reduce the length of the wildcard URL.

---

1821089-2 : DNS64 and resolver cache may not function together as expected

Links to More Info: BT1821089

Component: Global Traffic Manager (DNS)

Symptoms:
Wirth DNS64 enabled and also a resolver cache, the first AAAA query for a name that has only an A record and no AAAA record is correctly translated to the configured prefix. However, subsequent queries return only NOERROR to the client instead of the AAAA response.

Conditions:
-- DNS64 enabled with resolver cache
-- AAAA queries

Impact:
Subsequent queries return NOERROR and no record responses

Workaround:
None

---

1821033-1 : Assertion "packet must already have an ethernet header" when using tcpdump

Links to More Info: BT1821033

Component: Local Traffic Manager

Symptoms:
Tmm crashes when running tcpdump.

Conditions:
1. A virtual server references another virtual server with an iRule
2. The destination virtual server has an iRule with reject inside FLOW_INIT
3. Use tcpdump while hitting the reject rule

Impact:
Traffic disrupted while tmm restarts.

Workaround:
Use either remote tcpdump or avoid using reject rule in FLOW_INIT.

---

1820833 : General Database Error when creating a new profile

Links to More Info: BT1820833

Component: Bot Defense

Symptoms:
When creating a custom bot defense profile, after clicking Finished an error occurs: "General Database Error"

Conditions:
-- Creating a custom mobile bot defense profile
-- The profile enables mobile endpoints
-- The parent profile has been modified

Impact:
The profile is not created and a General Database Error is reported.

Workaround:
None

---

1820785-1 : [FPS] Payload is not handled on some of the TMM threads

Links to More Info: BT1820785

Component: Fraud Protection Services

Symptoms:
You may notice messages such as "content-length=0, chunked=1, err=0" in the /var/log/tmm* logs.

Conditions:
FPS profile configuration

Impact:
Intermittent login failures.

Workaround:
None

---

1820573-1 : PEM Traffic Classification signatures are classifying the youtube videos with quic enabled as udp.quic instead of udp.quic.youtube.youtube_video.youtube_video_abr on windows using the latest chrome web browser

Links to More Info: BT1820573

Component: Traffic Classification Engine

Symptoms:
Classification is not happening properly

Conditions:
YouTube video playing on the latest version of Chrome web browser

Impact:
Classification is incorrect

Workaround:
None

---

1820489-1 : Rule list order changes when modifying a rule using Filer Active Rules List

Links to More Info: BT1820489

Component: Advanced Firewall Manager

Symptoms:
Firewall Policy rule ID changes when Modifying a rule using "Filer Active Rules List" and commit the changes.

Conditions:
- AFM licensed and provisioned.
- Create a rule-list with 4-5 rules in it.
- Create a Policy and add rule-list under it.
- Now Filer any of 2 Active Rules from rule List and then the Rule ID order changes, Now do any modification on filtered rules and commit the changes.
- Now remove the filter and observe the Rule ID changes for all the rules once after commit the changes.

Impact:
May lead to a change in the rule order and priority.

Workaround:
Remove the filter before committing the changes.

---

1819857 : [APM][PRP] Session variables are not able to access within Oauth Client agent intermittently

Links to More Info: BT1819857

Component: Access Policy Manager

Symptoms:
The request object which contains custom session variables which are filled through iRule and variable assign agent are empty in oauth redirect urls

At the time of oauth Request object creation i.e from mcp to tmm oauth_request_item_table is not getting populated in all tmm instances and every time issue identified in a single tmm instance.

Conditions:
-- BIG-IP APM as OAuth Client, inside Per-Request-Policy.
-- Some custom session variables are filled thru variable assign agent and irules.

custom session variables are used in oauth request in auth redirect and token redirect params.

Impact:
Not able to perform oauth

Workaround:
None

---

1819721 : LSN failed events details are ambiguous

Links to More Info: BT1819721

Component: Carrier-Grade NAT

Symptoms:
When an LSN translation failure occurs, the logs show ""NAPT - Translation failed" which does not give enough details to narrow down potential root causes.

Conditions:
A LSN translation failure occurs

Impact:
Narrowing down potential root causes of the failure may be difficult.

Workaround:
None

---

1819617-1 : Stalled FPS signature/engine update task causes LiveUpdate and Apply Policy to fail

Links to More Info: BT1819617

Component: Application Security Manager

Symptoms:
- LiveUpdate .IM install does not complete
- ASM's Apply Policy does not complete

Conditions:
FPS is provisioned

Impact:
Affects ASM operations

Workaround:
- Identify PID of the stalled FPS update

# lsof sigfile_update.lock
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
update_fp 14246 root 3wW REG 253,8 0 6212 sigfile_update.lock <<<<

- Kill the process

# kill 14246

---

1818949 : [APM] BIG-IP as OAuth AS sending invalid grant error when refresh token expired.

Links to More Info: BT1818949

Component: Access Policy Manager

Symptoms:
As per RFC states that, the provided authorization grant (e.g., authorization code, resource owner credentials) or refresh token is invalid, expired, revoked, does not match the redirection URI used in the authorization request, or was issued to another client then should send a 400 Bad Request status code and a error json response
{"error": "invalid_grant", ...}

currently BIG-IP sending as {"error": "access_denied", ...}
with 400 status code.

Conditions:
OAuth configured.
using the refresh token to get the access token, when refresh token is expired. (ex: using postman)

Impact:
Returns Invalid error

Workaround:
None

---

1818861-3 : Timestamp cookies are not compatible with fastl4 mirroring.

Links to More Info: BT1818861

Component: Advanced Firewall Manager

Symptoms:
DOS tcp-ack-ts vector with tscookies option enabled is not compatible with fastl4 (L4) mirroring.

Conditions:
- DOS tcp-ack-ts vector with tscookies option enabled
- Mirroring configured on fastL4 TCP virtual.
- FastL4 profile with timestamp 'preserve' option configured.

Impact:
Existing connections hang due to tsval not being transformed properly on a newly active device.

Workaround:
Set fastl4 timestamp option to strip/rewrite.

---

1818361 : Per-VLAN TCAM rules are incorrectly created for empty "disable" IFC list by dynamic TCAM

Links to More Info: BT1818361

Component: TMOS

Symptoms:
An excessive number of TCAM rules are created for a virtual.

Conditions:
- single route domain
- virtual with empty disable IFC list

Impact:
In some instances, the TCAM rules database may become exhausted.

Workaround:
None

---

1818137-1 : Tmm IPv4 fragmentation handling distribution

Links to More Info: BT1818137

Component: Local Traffic Manager

Symptoms:
BIG-IP VE handles fragmented IPv4 traffic on the first tmm thread/tmm0. With this change the ability to spread the fragmented IPv4 traffic is introduced.

Conditions:
Handling of fragmented IPv4 traffic.

Impact:
Handling of fragmented IPv4 traffics distribution.

Workaround:
None

---

1814821-1 : DHE groups present in profile's cipherlist with TLS1.3 enabled and tmm.ssl.useffdhe set to false simultaneously

Links to More Info: BT1814821

Component: Local Traffic Manager

Symptoms:
You might observe CRIT-level logs of configuration issues in the TMM logs but there is no impact to the traffic. Example log message:

crit tmm4[17746]: 01260000:2: Profile /Common/serverssl-secure: DHE groups present in profile's cipherlist with TLS1.3 enabled and tmm.ssl.useffdhe set to false simultaneously.

Conditions:
1. The db variable tmm.ssl.useffdhe set to false
2. Virtual server configured to use DH groups

Impact:
Crit-level logs are logged to /var/log/tmm

Workaround:
Leave the tmm.ssl.useffdhe value to default which is true

---

1814413-1 : Dynamic parameters are not extracted and cookies are not generated

Links to More Info: BT1814413

Component: Application Security Manager

Symptoms:
Dynamic parameters are not extracted and cookies are missed.

Conditions:
Create a parameter in extraction and in the Extracted Items configuration.

Impact:
Unable to extract dynamic parameters due to which false positives are generated.

Workaround:
Include the file type in the Extracted Items configuration.

---

1813717-1 : Some blocked requests are not logged when filtered by response status codes

Links to More Info: BT1813717

Component: Application Security Manager

Symptoms:
Blocked requests with status code N/A are not logged when filtered by response code

Conditions:
-- Using a custom logging profile with request type set to all requests or blocked requests, logic operation AND and Response status code set to ONLY

Impact:
Missing logs of some blocked requests

Workaround:
None

---

1813625 : "tmsh show net ipsec-stat" command is not showing statistics - all values are zero.

Links to More Info: BT1813625

Component: TMOS

Symptoms:
Output of "tmsh show net ipsec-stat" shows all zeros for values of "Packets In", "Bytes In", "Packets Out" and "Bytes Out".

Conditions:
"tmctl ipsec_data_stat" displays separate statistics for encrypted and plain data but tmsh show zero values.

Impact:
Tmsh can't be used to display IPSec statistics

Workaround:
Data can be displayed with "tmctl ipsec_data_stat"

---

1813593-1 : Monitor instances on non-Common partition cannot be displayed when "All [Read Only]" was selected at upper right partition drop-down box.

Links to More Info: BT1813593

Component: TMOS

Symptoms:
Monitor instances on non-Common partition is not displayed on GUI when "All [Read Only]" option is set at upper right partition drop-down box. "No records to display." message will be displayed even though there is monitor instances.

Conditions:
- Monitor instances and monitored objects reside on non-Common partition.
- On GUI, "All [Read Only]" option is selected at upper right partition drop-down box.

Impact:
Cannot see monitor instances of non-Common partition on GUI.

Workaround:
Monitor instances on non-Common partition can be confirmed by TMSH.

# tmsh -c "cd /mypartition1 ; show ltm monitor http mypartition1_http_mon"

Or alternatively, select specific partition at upper right partition drop-down box, and monitor instances on that partition will be displayed on GUI.

---

1813505-1 : Snmpd may seg fault on systems with large amounts of virtual memory

Links to More Info: BT1813505

Component: TMOS

Symptoms:
Snmpd cores

Conditions:
* systems with large amounts of virtual memory (e.g. 3.5 TB)
* attempt to access dot3StatsTable

Impact:
Snmp unavailable when snmpd restarts

Workaround:
Avoid using dot3StatsTable.

---

1812349-3 : IPsec phase 2 (IKEv1 Quick Mode) will not start after upgrade★

Links to More Info: BT1812349

Component: TMOS

Symptoms:
IPsec IKEv1 tunnels fail half way through tunnel negotiation. As a result the tunnel never comes up.

Conditions:
-- BIG-IP with IKEv1 IPsec tunnel
-- ISAKMP traffic to the remote peer is not in route-domain 0 (RD0)
-- Upgrade to version 16.x or 17.x

Impact:
IPsec tunnels are not able to connect remote peer networks.

Workaround:
There are two options:

-- Use IKEv2, this will require that the remote peer is also reconfigured to IKEv2.

-- Alternatively, move the IPsec peer's configuration to RD0.

---

1797861-1 : [APM] Portal Access is not working with spread operator (...)

Links to More Info: BT1797861

Component: Access Policy Manager

Symptoms:
Application does not load with rewrite errors like below

error rewrite - fm_patchers/jsParser.cpp:91 (0x3028a20): jsParser::Tokenize(): There was an error: [Oops - MODERN failed to parse at line 18, context after error: (el)),Za})}return Po=Po.then(()=]

Conditions:
-- Application uses the spread operator (...)

Impact:
Unable to access application via Portal Access

Workaround:
Use the custom iRule to workaround this issue.


================================

Save New Duplicate & Edit Just Text Twitter
when HTTP_REQUEST {
if {[HTTP::has_responded]} {
        return
    }


    set match 0
    if { "[HTTP::path]" ends_with "<file which has spread operator>" } {
      
       set match 1
       if { [HTTP::version] eq "1.1" } {
          if { [HTTP::header is_keepalive] } {
             HTTP::header replace "Connection" "Keep-Alive"
          }
        HTTP::version "1.0"
        }
    }
}

when HTTP_RESPONSE {
    if { [info exists match] && $match == 1} {
        if { [HTTP::header exists "Content-Length"] and [HTTP::header "Content-Length"] <= 1048576 } {
           
            HTTP::collect [HTTP::header Content-Length]
        } else {
           
            HTTP::collect 15485760 # 1.5 MiB
        }
        
        
    }
}

when HTTP_RESPONSE_DATA {
    if { [info exists match] && $match == 1} {
       set payload_size [HTTP::payload length]
       set data [HTTP::payload]
       set start [string first {Ei.push(...new Uint8Array(el))} $data]
      
       if { $start > 0} {
        HTTP::payload replace $start 30 {Array.from(new Uint8Array(el)).forEach(v => Ei.push(v))}
       }
       HTTP::release
    }
}
================================

---

1793573-1 : Issue with relative matches in snort rules

Links to More Info: BT1793573

Component: Protocol Inspection

Symptoms:
False positive rule match. For example, false positive reports for php_php_parserr_dns_txt_heap_buffer_overflow_cve_2014_4049_1.

Conditions:
- Snort rule contains an overlapping relative match.
- This applies to php_php_parserr_dns_txt_heap_buffer_overflow_cve_2014_4049_1.
- May apply to other signatures.

Impact:
Signature reports false positive match.

Workaround:
None

---

1788193-2 : [MCP] Request logging should only be allowed with supported protocol profiles

Links to More Info: BT1788193

Component: TMOS

Symptoms:
Request Logging can only log HTTP requests. Other protocol profiles are not supported. Configuring request logging on a MQTT virtual server will cause tmm to crash.

Conditions:
Request logging profile is configured on MQTT virtual server

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

---

1788065-2 : The rule cannot be deleted because it is in use by a rule

Links to More Info: BT1788065

Component: Local Traffic Manager

Symptoms:
When trying to delete two iRules in same transaction with one is calling the proc defined in another the deletion fails with below error.

mcpd[6467]: 01070265:3: The rule (/Common/Shared/library_irule) cannot be deleted because it is in use by a rule (/Common/Shared/example_irule).

The rules are
- "library_irule" containing procedure do_nothing
- "example_irule" that calls proc do_nothing
- Virtual "my_vs1" that attaches "example_irule"

Conditions:
-- Two iRules exist.
-- One iRule calls a procedure defined in the other iRule.
-- You attempt to delete both iRules at the same time.

Impact:
Unable to delete the iRule.

Workaround:
Try to delete the iRules in different transactions.

---

1787909 : Sys db variable security.configpassword value is changed to not null when ng_export is interrupted

Links to More Info: BT1787909

Component: Access Policy Manager

Symptoms:
AAA authentication starts failing after exporting/importing an access policy.

Conditions:
When 'ng_export <access policy name> <new access policy name>' is interrupted, for example by pressing CTRL-C.

Impact:
A change to the AAA password does not take effect and AAA authentication fails.

Workaround:
You are affected by this issue if you expect security.configpassword to be null but the output of 'tmsh list sys db security.configpassword' is non-null.

You can run the following command to set it back to null.
tmsh modify /sys db security.configpassword value "<null>"

---

1787701-1 : [APM]Customization in German contains French language

Links to More Info: BT1787701

Component: Access Policy Manager

Symptoms:
Observe "Change password" contains a French word "Modifier le mot de passe" in Logon Page agent.

Conditions:
Access policy with German language.

Impact:
It is confusing to see a different language in customization.

Workaround:
None

---

1787649-2 : Upgrade error "you can include category number <category> only once"★

Links to More Info: BT1787649

Component: Access Policy Manager

Symptoms:
During the upgrade, the configuration load fails with an error

err mcpd[5783]: 01070734:3: Configuration error: In url-filter (/Common/Limited_URL_Filters), you can include category number /Common/Human_Interests only once. This category number is entered in both allowed-categories and blocked-categories.

Conditions:
-- You have a custom filter that matches one of the following names
     "/Common/LGBTQIA";
     "/Common/Widely_Known_Religions";
     "/Common/Lesser_Known_Religions";
     "/Common/Human_Interests";
     "/Common/Illegal_or_Unethical";
-- The system is upgraded

Impact:
Configuration load will fail

Workaround:
If this is encountered during the upgrade, rename the affected filter. If you have not upgraded yet, ensure that there are no custom filters with conflicting names prior to upgrading.

---

1787645-2 : BD process fail to startup on specific XML configuration

Links to More Info: BT1787645

Component: Application Security Manager

Symptoms:
BD does not start up (restart loop).

Conditions:
An XML configuration with specific configuration in the profile.

Impact:
System does not start up.

Workaround:
Remove the specific configuration in the profile.

---

1787621 : TMM may unexpectedly restart during IPsec tunnel negotiation

Links to More Info: BT1787621

Component: TMOS

Symptoms:
Tmm crashes while handling IPSec traffic

Conditions:
-- IPsec IKEv2 tunnel configured and in use
-- The IPsec attempts to establish a tunnel with the remote peer

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

---

1787413-1 : ID7312 matches on nearly all TXT DNS packets

Links to More Info: BT1787413

Component: Protocol Inspection

Symptoms:
The snort rule for ID7312 will match against any DNS TXT response that has data length < 256.

Conditions:
Running short rule ID7312 against DNS TXT responses.

Impact:
Generating the false positives for the TXT DNS packets

Workaround:
Disabling ID7312 will reduce the false positives.

---

1786421-3 : Multiple App Tunnels against a layered virtual server using dst port range always hit first dst port

Links to More Info: BT1786421

Component: Access Policy Manager

Symptoms:
If you define multiple Application Tunnels using IP:port (say 192.168.1.1:10000, 192.168.1.1:10001, etc.) and they are matching (on purpose) a wider layered virtual defined with a port range (say 192.168.1.1:10000-10100), then all your Application Tunnels will be hitting that virtual server with same destination first port only.

Conditions:
- Multiple Application Tunnels are defined with same IP but different ports
- Application Tunnels IP:port are matching a layered virtual configured with same IP and a port range containing the Application Tunnels defined ports

Impact:
Application Tunnel will not establish with the appropriate port on the backend server.

Workaround:
You must define a layered virtual server per Application Tunnel IP:port

---

1786325-2 : Nxdomain stop blocking & nxdomain added into the allow list on rSeries

Links to More Info: BT1786325

Component: Advanced Firewall Manager

Symptoms:
Nxdomain domain eg:nxdomain.example.com is added into allow list. This causes tmctl nxdomain vector stats to not be accounted for, even when the client receives a response as nxdomain.

Conditions:
-- An nxdomain DoS vector is triggered
-- The nxdomain is later added to the allow list

Impact:
Tmctl stats for nxdomain vector is not accurate.

Workaround:
None

---

1786309-1 : [Hyper-V BIG-IP Virtual Edition] - Significant system clock skew after a reboot★

Links to More Info: BT1786309

Component: TMOS

Symptoms:
On Microsoft Hyper-V BIG-IP Virtual Editions and on TMOS versions from 14.1.0 and more recent, if the configuration file /etc/adjclock is configured with the "LOCAL" keyword, after a reboot the VE system clock picks the wrong time zone from the hypervisor (hardware) clock.

This might result in a big system clock time skew on the VE, that lasts until the VE synchs its time with the correct time from the NTP servers configured under "tmsh sys ntp".

Symptoms:

After a reboot:

- the /var/log/dmesg configuration log file contains a line similar to this one:

[ 1.754030] systemd[1]: RTC configured in localtime, applying delta of -360 minutes to system time;


- the system time is changed to one or more hours in the future.

Conditions:
- BIG-IP Virtual Edition running on a Microsoft Hyper-V hypervisor.

- The Virtual Edition is upgraded from a TMOS version older than 14.1.0 to a version equal or newer than 14.1.0 .
As a consequence of the upgrade, the "/etc/adjclock" system file is configured with the "LOCAL" setting when it shouldn't.

- The Virtual Edition is rebooted.

Impact:
A significant system clock time skew, that lasts until the VE synchs its time with the correct time from the NTP servers configured under "tmsh sys ntp".

Some services like bigd monitoring can be affected.

Workaround:
Edit the "/etc/adjtime" configuration file and remove the "LOCAL" line.

---

1785953-2 : The 'cm device' information is not updated in in bigip_base.conf file after time-limited-module add-nn license was added or replaced

Links to More Info: BT1785953

Component: TMOS

Symptoms:
The 'cm device' object in the /config/bigip_base.conf is not updated

Conditions:
Replacing or adding a new time-limited add-on license like IP Intelligence.

Impact:
Time-limited-modules information has not updated in /config/bigip_base.conf

Workaround:
Run tmsh save /sys config

---

1785673-2 : F5OS r2000 and r4000 series configured with vlan-groups might fail to respond to ARP requests

Links to More Info: BT1785673

Component: Local Traffic Manager

Symptoms:
The BIG-IP system does not respond to ARP requests. It will resolve the ARP request but might not forward the response to the client device.

Conditions:
-- A tenant on an r2600, r2800, r4600 or r4800
-- A transparent or translucent vlan-group
-- Certain traffic patterns, typically low volume, across the vlan-group.
-- An ARP request is made for a device on the other side of the vlan-group.

Impact:
Locally attached devices might fail to resolve ARP for devices on the other side of a vlan-group.

Workaround:
None

---

1785385-1 : Intermittent traffic failures when tenant is running BIG-IP v17.1.2 or above and host is on version prior to F5OS-A 1.8.0 or F5OS-C 1.8.0★

Links to More Info: BT1785385

Component: Local Traffic Manager

Symptoms:
Intermittent traffic failures for a tenant running BIG-IP v17.1.2 or above.

This often manifests as ICMP monitors failing.

Conditions:
- Tenant running BIG-IP v17.1.2 or above

- Host is one of the following platforms:
-- r5000, r10000, or r12000-series appliance
-- VELOS

- Host is running a version prior to F5OS-A 1.8.0 (rSeries appliance) or F5OS-C 1.8.0 (VELOS chassis)

Impact:
Intermittent traffic disruption. This often manifests as ICMP monitors intermittently failing, but will also impact virtual server traffic and other protocols (e.g. UDP and TCP).

Workaround:
Upgrade F5OS to version 1.8.0 or higher.

---

1784141-1 : Updatecheck returns obsolete downloads url

Component: TMOS

Symptoms:
The updatecheck utility generates an outdated downloads.f5.com URL, which prevents the software image download from functioning properly.

Conditions:
When using the updatecheck utility to verify the latest available software image

Impact:
Updatecheck receives an obsolete software image download URL, and the software download fails.

Workaround:
None

---

1784137-2 : Net stp-globals object config-name back to default value upon reboot

Links to More Info: BT1784137

Component: TMOS

Symptoms:
Net stp-globals config-name is reset to default "base mac" in running config, while bigip_base.conf has custom config-name.

This behavior is seen after upgrade to v17.1.1.3 and also when reboot the device when its in v17.

Conditions:
1. Upgrade to v17.1.1.3
2. Reboot the device after changing the config-name in stp-globals.

Impact:
Any changes to net stp-globals will revert to default after reboot.

Workaround:
Configure via startup script after MCPD is found running when the BIG-IP system starts up.

---

1783549-1 : TMM crash while accessing the sessionDB

Links to More Info: BT1783549

Component: Access Policy Manager

Symptoms:
TMM crashes when tmm.access.policytrace value is enabled.

The session variable for the apm_per_request_policy_path token is not available in sessionDB.

Following is an example:

config # tmsh list sys db tmm.access.policytrace
sys db tmm.access.policytrace {
    value "enable"
}

Conditions:
The tmm.access.policytrace and PRP should be configured.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

---

1783137-1 : Webtop link assignment via "iRule Event" (iRule) failed

Component: Access Policy Manager

Symptoms:
User observes iRule error and failure to assign the webtop

Conditions:
-- iRule event agent is used
-- Webtop assignment is required by the iRule event agent

Impact:
Webtop will not be displayed

Workaround:
When ACCESS_POLICY_AGENT_EVENT {
 if { [ACCESS::policy agent_id] eq "set_webtop-links" }{
  log local0. "Starting iRule: set_webtop-links"
  set sid [ACCESS::session sid]
  log local0. "Session ID is $sid"
  log local0. "Brfore: Assined Webtop Links are [ACCESS::session data get session.assigned.webtoplinks]"
 # set resource_webtoplink "/Common/<name1> /Common/<name2>"
  ACCESS::session data set "session.custom.webtop_id" "/Common/<name1> /Common/<name2>"
  log local0. "After: Assined Webtop Links are [ACCESS::session data get session.assigned.webtoplinks]"
 }
}

---

1782137-1 : Management of Wide IPs using the GUI may fail when multiple monitors exist

Links to More Info: BT1782137

Component: Global Traffic Manager (DNS)

Symptoms:
When multiple monitor instances exist, the GUI may become unresponsive when managing Wide IPs.

Conditions:
- GTM configuration contains a sufficiently high number of monitors (> 4000).
- Using the GUI to manage Wide IPs.

Impact:
Configuration changes through the GUI may not be effective. Unable to use the GUI for configuration management.

Workaround:
Use TMSH

---

1782057-1 : BD crash related to dns lookup

Links to More Info: BT1782057

Component: Application Security Manager

Symptoms:
A bd daemon crash

Conditions:
Related to DNS lookup scenarios

Impact:
ASM traffic disrupted while bd restarts.

Workaround:
None

---

1781949-3 : QUIC might drop a HS context packet during the initial handshake

Links to More Info: BT1781949

Component: Local Traffic Manager

Symptoms:
If asynchronous crypto operations on a QUIC connection complete in a specific order, a HS context packet can be dropped instead of buffered for later processing.

Conditions:
Asynchronous crypto operations on a QUIC connection complete in a specific order.

Impact:
A HS context packet is dropped and retransmitted, causing the handshake to take an extra RTT to complete.

Workaround:
None

---

1779921-1 : "Apply Access Policy" Status stays yellow for Access profiles using OAuth agent with "Dynamic Server" enabled during key updates in OAuth auto-discovery

Links to More Info: BT1779921

Component: Access Policy Manager

Symptoms:
Newly discovered keys are not updated to access profiles with "dynamic server" enabled. As a result, they will be using older keys.

Conditions:
-- BIG-IP HA pair
-- BIG-IP system is configured as a OAuth client/Resource server
-- Access profile has OAuth agent(OAuth client/OAuth scope) with "dynamic server" enabled
-- Keys are updated on the OAuth authorization server which will be discovered on the OAuth client during discovery task

Impact:
-- When you apply the access policy, the status remains yellow.
-- OAuth fails as the access profile still uses the old keys.

Workaround:
None

---

1778901-1 : PPTP-GRE proxy need tmstat table for connection error analysis

Links to More Info: BT1778901

Component: TMOS

Symptoms:
BIG-IP is unable to create a GRE flow, the connection fails to complete.

Conditions:
This can happen for various reasons, for example:
- CMP communication with another TMM failed.
- Remote end (server) to which one client is already connected, responded with a call-reply containing a call-id which was already used by that server in a previous, existing(still alive) call setup.
- BIG-IP uses translated call-id in the outgoing call request which was already sent to the server and the GRE connection for that setup is still UP, and validation fails when the server accepts a connection.

Impact:
BIG-IP uses a duplicate translated call-id when communicating with the server, but there are no stats in the tmstat table to perform additional troubleshooting of the cause.

Workaround:
None

---

1778793-1 : Database health monitors may use the wrong connection when attempting to connect to database

Links to More Info: BT1778793

Component: Local Traffic Manager

Symptoms:
Database monitors fail periodically and mark a pool member down.

Conditions:
- Multiple database health monitor instances exist to probe a given node.

- The monitor instances share the same values for the following parameters:
 - destination IP address
 - destination port
 - database name.

Impact:
Healthy pool members are not selected to receive traffic.

Workaround:
You can work around this issue by using a BIG-IP EAV external monitor to probe the health of your database. An example for MySQL is available on DevCentral at https://community.f5.com/kb/codeshare/mysql-monitor/273565.
 
For PostgreSQL and Microsoft SQL Server, you may also work around this issue by adding a unique connection property as a suffix to the database name. This ensures a unique JDBC connection string is constructed for each monitor in order to avoid this issue.
 
For example you can use the connection properties "ApplicationName=<monitor_name>" or "applicationName=<monitor_name>" in PostgreSQL or Microsoft SQL Server respectively to provide the name of the calling monitor to the database.
 
Note that the PostgreSQL monitor requires a "?" character as a separator between the database name and the connection property, while MS SQL Server requires a ";" as separator.
 
Example tmsh commands to disambiguate monitorA and monitorB which both probe database "samedb" on the same node:
 
- PostgreSQL monitors:
  - tmsh modify ltm monitor postgresql monitorA database samedb?ApplicationName=monitorA
  - tmsh modify ltm monitor postgresql monitorB database samedb?ApplicationName=monitorB
 
- MS SQL Server:
  - tmsh modify ltm monitor mssql monitorA database '"samedb;applicationName=monitorA"'
  - tmsh modify ltm monitor mssql monitorB database '"samedb;applicationName=monitorB"'

Note that the extra quoting in the example command for MS SQL Server is required to preserve the ";" separator in the database name.

---

1773213-2 : OAuth core fail due to buffer overflow

Links to More Info: BT1773213

Component: Access Policy Manager

Symptoms:
The SessionDB query result includes the additional columns (userinfo_claims, id_token_claim_data, and id_token_claims, oidc) which OAuth does not expect.
This leads to memory corruption in the OAuth memory allocated to column lists, further causing an OAuth core to fail.

Conditions:
OAuth is configured.

Impact:
OAuth traffic is disrupted when OAuth restarts.

Workaround:
None

---

1772609-1 : Correct FPGA type and Turboflex profile may not be automatically applied when changing license

Links to More Info: BT1772609

Component: TMOS

Symptoms:
When changing the license for an iSeries appliance from a Throttled (lower performance) license to an Unthrottled (higher performance) license, the corresponding expected FPGA type and Turboflex profile may not be automatically applied.
Upon rebooting, the Turboflex profile may updated to match the requirements of the license, but the FPGA type may not be updated.

Conditions:
This may occur when:
-- Upgrading the performance license an iSeries appliance (for example, from an i7600 to an i7800 license)
-- AFM is provisioned, requiring a turboflex-security Turboflex profile

This does not occur when:
-- Downgrading the performance license an iSeries appliance (for example, from an i7800 to an i7600 license)
-- AFM is not provisioned

Impact:
The FPGA type and Turboflex profile in use may not be the correct/desired/expected type for the intended usage.

Workaround:
To apply the correct FPGA type and Turboflex profile after a licensing change:
-- Save the configuration (tmsh save sys config)
-- Reboot the appliance

---

1772397-1 : FQDN entries in feed list for IP Intelligence is not implemented

Links to More Info: BT1772397

Component: Advanced Firewall Manager

Symptoms:
FQDN entries in a feed list for IP Intelligence are not working.

Conditions:
Implement FQDN entries in a feed list

Impact:
Using FQDN entries in a feed list for the IP Intelligence feature will not work.

Workaround:
None

---

1772353-1 : Defaults for Associated Violations are re-added to a policy

Links to More Info: BT1772353

Component: Application Security Manager

Symptoms:
When Associated Violations is empty ("Selected" list is empty), and the policy is exported to XML or JSON format, and reimported, the default elements are re-added to the list.

Conditions:
Associated Violations is empty ("Selected" list is empty), and the policy is exported to XML or JSON format, and reimported

Impact:
The default Session Awareness Violations are set back to delay blocking unexpectedly.

Workaround:
Use binary format export and import.

---

1772317 : [APM][SAML SP] sp fails authentication with error "SAML assertion is invalid, error: NameID is missing"

Links to More Info: BT1772317

Component: Access Policy Manager

Symptoms:
SAML authentication fails and following log is seen on BIG-IP as sp: "SAML Agent: /Common/web_auth_act_saml_auth_subsession_ag SAML assertion is invalid, error: NameID is missing, but idp-connector's identity location is set to subject"

Conditions:
-- SAML auth is configured as SP on BIG-IP as part of per-request policy
-- assertion has an encrypted subject "<saml2:Subject><saml2:EncryptedID><xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"...."

Impact:
Authentication fails

Workaround:
Disable "encrypt-subject " in idp config

---

1759261-3 : OSPF might fail to install external routes after topology change.

Links to More Info: BT1759261

Component: TMOS

Symptoms:
OSPF might fail to install external routes after topology change. Only a subset of routes might be affected.

Conditions:
The problem is more likely to occur with a large number of external type-5 routes being pushed to the BIG-IP system. The problem is time and packet-sequence dependent.

Impact:
Routes are present in OSPF DB but are not in the routing table (RIB).

Workaround:
None

---

1758985-1 : Tmm cored at dname_query_hash when out of memory

Links to More Info: BT1758985

Component: Global Traffic Manager (DNS)

Symptoms:
Tmm cored.

Conditions:
TMM is out of memory and DNS cache deployed.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

---

1758961-1 : TMM may core if proxy_common_init errors out due to inappropriate NAT configuration

Links to More Info: BT1758961

Component: Local Traffic Manager

Symptoms:
TMM core is generated and tmm is restarted.

Conditions:
When proxy_common_init() fails due to incorrect configuration of a transparent HTTP proxy in non-standard HTTP and pass-through mode, it only occurs when an ACK and data are received during the connection setup.

Impact:
The core will be generated, and the TMM will be restarted accordingly. Traffic disrupted while TMM restarts.

Workaround:
None

---

1758957-1 : If two tenants share the same VLAN, TMM may egress broadcast traffic even when VLANs are disabled in F5OS

Links to More Info: BT1758957

Component: F5OS Messaging Agent

Symptoms:
In certain scenarios, such as restoring a UCS on an F5OS tenant, if the VLANs in F5OS are disabled, the TMM may egress broadcast traffic such as gratuitous ARPs onto the disabled VLANs.

Conditions:
-- VLAN is currently assigned to any tenant.
-- An F5OS tenant where VLANs were assigned and then removed.
-- An F5OS tenant where TMM is not in forced-offline mode.
-- An action occurs on the tenant (such as restoring a UCS or restarting TMM, or loading the config) that results in gratuitous ARPs.

Impact:
This could cause IP address conflicts on the network or other issues related to unexpected broadcast traffic such as gratuitous ARPs on the network.

Workaround:
- In F5OS, remove the affected VLANs from the LAG or interface.

- In F5OS, ensure there is at least one VLAN still attached to the tenant. This could be a temporary VLAN.

- On the tenant, use forced offline to prevent traffic egress.

- If you are restoring a UCS from another BIG-IP such as for a platform migration, put the source BIG-IP into a forcedoffline state before taking the UCS.

- Delete the tenant, and recreate without any VLANs assigned.

- In F5OS, remove the VLAN from all tenants.

---

1757585-2 : Unable to install a license on an AWS BIG-IP VE

Links to More Info: BT1757585

Component: TMOS

Symptoms:
- Dossier creation fails with the following errors in the BIG-IP VE LTM log file:

   err chmand[4610]: 012a0003:3: DossierReq exception: VirtDossier Service: Instance identity retrieval from the metadata failed. Check network connectivity to the instance metadata before retrying
   warning get_dossier[10914]: 012a0004:4: hal_request_dossier: request failed
   err get_dossier[10914]: 01170003:3: halGetDossier returned error (1): Dossier generation failed.

- Installing a license from a BIG-IQ returns with an error similar to the following:

  Licensing failed Assignment of regkey pool license {license_pool_name} (License for XXXXX-XXXXX-XXXXX-XXXXX-XXXXXXX) to N.N.N.N ended with INSTALLATION_FAILED status and message: Failed to install license to device N.N.N.N (Not a valid F5 License)

Conditions:
Any of these license removal scenarios trigger the issue on a Single NIC (1nic) AWS BIG-IP VE :

 - Previous license has expired
 - License was revoked using iControl REST command "DELETE /tm/shared/licensing/registration"
 - License was revoked using BIG-IQ

Impact:
- BIG-IP fails to generate a dossier and load a license
- BIG-IQ is unable to re-license the VE

Workaround:
Fix by deleting and resetting IP routing.
1) tmsh delete net route default
2) bigstart restart dhclient

Alternatively manually modify and fix ip route
1) ip route change default via <gateway> dev internal

Where <gateway> is IP address seen in 'ip route' output for 'default'.
Ex: for following, <gateway> is 172.31.0.1

# ip route
default via 172.31.0.1 dev mgmt
default via 172.31.0.1 dev mgmt proto none metric 4096
...

---

1757537-1 : RCA tmm core with ** SIGSEGV ** inside pick_qos

Links to More Info: BT1757537

Component: Global Traffic Manager (DNS)

Symptoms:
Tmm core inside pick_qos

Conditions:
Race condition of rapid deletion and creation of the same virtual server.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

---

1756897-3 : [APM][PA]Failed to execute 'observe' on 'MutationObserver': parameter 1 is not of type 'Node'

Links to More Info: BT1756897

Component: Access Policy Manager

Symptoms:
Application fails to load with below console error in developer tools.

Uncaught TypeError: Failed to execute 'observe' on 'MutationObserver': parameter 1 is not of type 'Node'.

Conditions:
Portal Access configured.

Impact:
Unable to load application via portal access.

Workaround:
Customized cache-fm-Modern.js ifile workaround is available for this.

---

1756697-1 : Sec-WebSocket-Extensions header is not stripped when Compression is disabled

Links to More Info: BT1756697

Component: Local Traffic Manager

Symptoms:
When compression mode is 'Typed' and compression is 'disabled' in websocket profile, BIG-IP should strip Sec-WebSocket-Extensions header but it is not happening.

Conditions:
Compression mode is 'Typed' and compression is 'disabled' in websocket profile

Impact:
Sec-WebSocket-Extensions header is seen in server side.

Workaround:
None

---

1756521-1 : Unable to access iApp Components tab in iApp

Links to More Info: BT1756521

Component: iApp Technology

Symptoms:
While accessing the iApp Components tab, the system displays the following error:

An error has occurred while trying to process your request.

Conditions:
1. The custom iApp is configured but not in the Common Partition.
2. The iApp has a policy that refers to a pool from the Common partition.

Impact:
Unable to view or modify iApps using GUI iApps > Application Services > Applications screen.

Workaround:
There is no workaround to actaully view the components of the iApp, however it is still possible to reconfigure the iApp by

1. Navigate to the following location in the GUI:
Local Traffic -> Virtual Server List

2. Click the Application Link > Reconfigure.

---

1756393 : While creating an IPS profile system, the check values change to default values from 'Don't Inspect'

Links to More Info: BT1756393

Component: Protocol Inspection

Symptoms:
When creating the IPS profile, all system check values are set to 'Don’t Inspect’. If the value is not modified, or the value is not created during profile creation, then the non-modified value is changed to the default value without a warning message.

Conditions:
Create a new IPS profile and see the SYSTEM CHECKS.

Impact:
While creating a profile the user expects that traffic will not be inspected. However, due to the change in default action value, the traffic is inspected when the changes are submitted to the system.

Workaround:
Set the value of the SYSTEM CHECKS action to 'Don’t Inspect' after submitting the changes to the system.

---

1756389-1 : CA certs could get deleted from server.crt after running bigip_add

Links to More Info: BT1756389

Component: Global Traffic Manager (DNS)

Symptoms:
In certain cases, the /config/gtm/server.crt could be deleted after running the bigip_add script.

Conditions:
Running the bigip_add script

Impact:
The iQuery connnection(s) will be impacted until the CA certs are restored.

Workaround:
None

---

1755441-1 : The gtm_add is unable to copy named files, a connection timed out error occurs

Links to More Info: BT1755441

Component: Global Traffic Manager (DNS)

Symptoms:
The gtm_add fails to copy named files. An error similar to
'Connection to <address>:4353 failed: Connection timed out' is displayed.

Conditions:
The GTM has a large config file of over 17 Megabytes.

Impact:
GTMs can not be added to the GTM sync group.

Workaround:
None

---

1755413-1 : Fast scp file transfer may not display progress bar

Links to More Info: BT1755413

Component: TMOS

Symptoms:
- Missing progress bar on scp file transfer.

Conditions:
- Includes fix for CVE-2019-6109.

Impact:
The progress bar indicating download progress of scp file transfer is missing in the output.

Workaround:
None

---

1755181-1 : Not enough information when a TCP reset occurs due to compression error

Links to More Info: BT1755181

Component: Local Traffic Manager

Symptoms:
TCP RST with compression error does not provide additional details.

Conditions:
When inflate ratio exceeded
tmm.deflate.inflate.max.ratio
or the size of the data once decompress is larger than
tmm.deflate.memory.threshold

a TCP Reset is sent, but it does not say why.

Impact:
Difficult to diagnostic

Workaround:
None

---

1755113-1 : BD crash with specific JSON schema

Links to More Info: BT1755113

Component: Application Security Manager

Symptoms:
BD crash

Conditions:
Using specific JSON schema in the JSON content profile applied on the ASM policy

Impact:
ASM traffic disrupted while bd restarts.

Workaround:
None

---

1754325-1 : Disabled status from manual resume on a BIG-IP DNS pool can sync to other BIG-IP DNS devices in synchronization-group

Links to More Info: BT1754325

Component: Global Traffic Manager (DNS)

Symptoms:
BIG-IP DNS pool with the manual resume feature enabled loses its iQuery connection and loses its network path to monitor the manual resume, the pool will mark pool members associated with that pool down and disabled.

When the BIG-IP DNS device that lost the iQuery connection re-establishes a connection, it will continue to leave pool members disabled on pools with manual resume configured and the disabled status may sync to other devices in the synchronization-group if their config timestamp is older then this disconnected/reconnected BIG-IP DNS device.

Conditions:
-- BIG-IP DNS pool with the manual resume feature enabled
-- The iQuery connection is lost

Impact:
Pool is disabled for all BIG-IP DNS devices in the synchronization-group

Workaround:
Manually re-enable disabled pool members on the BIG-IP DNS system and the re-enabled status will sync to the other BIG-IP DNS devices in the synchronization-group

---

1753489-1 : BFD Commands Missing in ZebOS Config After Reboot or Restart for large configurations

Links to More Info: BT1753489

Component: TMOS

Symptoms:
BFD session commands are missing from the ZebOS configuration after a BIG-IP reboot or bigstart restart.

Conditions:
Occurs consistently with 40+ route domains, intermittently with 20+ route domains, and varies based on configuration size or the number of BFD commands.

Impact:
BFD session configurations are not retained after reboot/restart, causing instability in routing protocols relying on BFD.

Workaround:
None

---

1752873 : [APM][SAML SP] Order of SAML attribute values saml.last.attr.name is reversed★

Links to More Info: BT1752873

Component: Access Policy Manager

Symptoms:
After upgrading, the order of SAML attribute values parsed from assertion are stored in reverse order.

Conditions:
-- BIG-IP as SAML SP,
-- Upgrade to 17.1.0

Impact:
The SAML assertion values are parsed in reverse order, which can cause iRules or policies to fail if they expect the values to arrive in a certain order.

Workaround:
None

---

1750397 : The system reached the maximum wait time for gossip worker to sync-oAuth Discovery failure.

Links to More Info: BT1750397

Component: Device Management

Symptoms:
OAuth auto-discovery stops working after failover. Eventually an error occurs on the standby device "The system reached the maximum wait time for gossip worker to sync".

Conditions:
A failover occurs while the OAuth auto discovery task is in SLEEP_AND_RUN_AGAIN state

restcurl -X GET tm/access/oidc/discover

Impact:
Fails to sync between active and stand by devices.

Workaround:
To resolve gossip conflicts you can use any of below 3 workarounds.

1. Use the ha-sync/sslofix script

2. Run the following commands on both active and standby.

restcurl -X DELETE shared/gossip-conflicts - clear gossip cache. do it on both the device at this point of time.
restcurl -X DELETE shared/resolver/device-groups/tm-shared-all-big-ips/devices - clear sync cache
bigstart restart restjavad -wait 60 seconds to make sure restjavad has had full time to restart
restcurl -X POST -d '{}' tm/shared/bigip-failover-state - rediscover/resync devices for gossip

 

3. Update the lowest generation device storage with the latest generation info.

a. Get the Task ID of OIDCDiscoveryTask

restcurl -u admin: tm/access/oidc/discover/ | grep selfLink
 "selfLink": "https://localhost/mgmt/tm/access/oidc/discover/<Task ID>"
 "selfLink": "https://localhost/mgmt/tm/access/oidc/discover"

b. Get current status of this task from rest storage of both active and standby

Standby:

restcurl /shared/storage?key=tm/access/oidc/discover/55feb1ad-52d8-4a83-b0b2-d0981e00c5be

{

 "step": "SLEEP_AND_RUN_AGAIN",
 "providerName": "/Common/reist-provider",
 "id": "55feb1ad-52d8-4a83-b0b2-d0981e00c5be",
 "status": "STARTED",
 "startTime": "2024-11-13T03:02:43.201+0000",
 "ownerMachineId": "c601d4c6-5a24-4a94-b46e-c465512cab68",
 "generation": 2324,
 "lastUpdateMicros": 1731566304972999,
 "kind": "tm:access:oidc:discover:oidcdiscovertaskitemstate",
 "selfLink": "https://localhost/mgmt/tm/access/oidc/discover/55feb1ad-52d8-4a83-b0b2-d0981e00c5be"

}
 
Active:

restcurl /shared/storage?key=tm/access/oidc/discover/55feb1ad-52d8-4a83-b0b2-d0981e00c5be

{

 "step": "SLEEP_AND_RUN_AGAIN",
 "providerName": "/Common/reist-provider",
 "id": "55feb1ad-52d8-4a83-b0b2-d0981e00c5be",
 "status": "STARTED",
 "startTime": "2024-11-13T03:02:43.201+0000",
 "ownerMachineId": "c601d4c6-5a24-4a94-b46e-c465512cab68",
 "generation": 14574,
 "lastUpdateMicros": 1732093908449526,
 "kind": "tm:access:oidc:discover:oidcdiscovertaskitemstate",
 "selfLink": "https://localhost/mgmt/tm/access/oidc/discover/55feb1ad-52d8-4a83-b0b2-d0981e00c5be"

}

c. Send a HTTP POST to the out of date device (standby) that includes the output from the up to date device (active) as the post body.

restcurl -X POST -u admin: /shared/storage -d '{ "step": "SLEEP_AND_RUN_AGAIN",

> "providerName": "/Common/reist-provider",
> "id": "55feb1ad-52d8-4a83-b0b2-d0981e00c5be",
> "status": "STARTED",
> "startTime": "2024-11-13T03:02:43.201+0000",
> "ownerMachineId": "c601d4c6-5a24-4a94-b46e-c465512cab68",
> "generation": 14574,
> "lastUpdateMicros": 1732093908449526,
> "kind": "tm:access:oidc:discover:oidcdiscovertaskitemstate",
> "selfLink": "https://localhost/mgmt/tm/access/oidc/discover/55feb1ad-52d8-4a83-b0b2-d0981e00c5be"}'


{

 "generation": 14573,
 "lastUpdateMicros": 1732093908449526,
 "kind": "tm:access:oidc:discover:oidcdiscovertaskitemstate",
 "selfLink": "https://localhost/mgmt/tm/access/oidc/discover/55feb1ad-52d8-4a83-b0b2-d0981e00c5be"

}


restcurl -u admin: https://localhost/mgmt/tm/access/oidc/discover/55feb1ad-52d8-4a83-b0b2-d0981e00c5be

{

 "step": "SLEEP_AND_RUN_AGAIN",
 "providerName": "/Common/reist-provider",
 "id": "55feb1ad-52d8-4a83-b0b2-d0981e00c5be",
 "status": "STARTED",
 "startTime": "2024-11-13T03:02:43.201+0000",
 "ownerMachineId": "c601d4c6-5a24-4a94-b46e-c465512cab68",
 "generation": 14574,
 "lastUpdateMicros": 1732093908449526,
 "kind": "tm:access:oidc:discover:oidcdiscovertaskitemstate",
 "selfLink": "https://localhost/mgmt/tm/access/oidc/discover/55feb1ad-52d8-4a83-b0b2-d0981e00c5be"

}


d. The gossip conflict "GENERATION_MISSING" should be resolved and both the active and standby will have the same generation number for OIDCDiscoveryTask.

---

1715153-1 : Log message "The connected network is vulnerable to tunnel crack as LocalIP falls under the public IP"

Links to More Info: BT1715153

Component: Access Policy Manager

Symptoms:
You may observe below log in f5report

"The connected network is vulnerable of tunnel crack as LocalIP falls under the public IP"

Conditions:
-- VPN is configured
-- A client connects from a publicly routable address.

Impact:
VPN is established despite the message "The connected network is vulnerable of tunnel crack as LocalIP falls under the public IPs"

Workaround:
None

---

1714889-1 : F5OS - BIG-IP Tenant does not display VELOS Chassis slot serial number

Links to More Info: BT1714889

Component: F5OS Messaging Agent

Symptoms:
F5OS BIG-IP Tenant does not display the serial number for the slot ("Host Board Serial") under "System Information" section

Conditions:
BIG-IP tenant is operating on a chassis, and the command "tmsh show sys hardware" is executed from the tenant.

Impact:
There is a delay in displaying the slot number to the user.

Workaround:
-- For CLI, log in to the partition and run the command "show components component state serial-no."

-- For GUI, log in to the active controller, then navigate to System Settings -> System Inventory.

The blade's serial number will be displayed.

---

1713881-1 : On Azure BIG-IP VE, cannot pass traffic after TMM restart

Links to More Info: BT1713881

Component: Local Traffic Manager

Symptoms:
On first boot up of Azure, traffic can be passed. After TMM shut down or restart, TMM stops passing traffic.

Conditions:
-- Using BIG-IP VE on Azure
-- Restarting tmm

Impact:
BIG-IP self IPs are unable to be pinged from connected hosts (client, server). Vice versa, connected hosts (client, server) cannot be pinged from BIG-IP VE.

Workaround:
None

---

1712005 : Rest Storage does not sync with MCPD OAuth Provider

Links to More Info: BT1712005

Component: Access Policy Manager

Symptoms:
When an OAuth Provider is deleted, the discovery task related to it still exists in the rest storage.

Conditions:
An OAuth Provider for which the discovery task is active is deleted.

Impact:
Discovery tasks of deleted OAuth providers remain in rest storage until they are deleted manually using restcurl.

Workaround:
Delete discovery task manually using restcurl.

---

1711945 : Inconsistent SNMPv3 engineID after re-deployment of BIG-IP VE when using "engineIDType 2"

Links to More Info: BT1711945

Component: TMOS

Symptoms:
With Engine ID type 2, the engine ID is not generated from the v6 IP address on the management interface. It contains MAC Address of the interface.

Conditions:
- IPv6 management IP is configured
- sys snmp include contains "engineIDType 2"

Impact:
SNMPv3 engineID contains MAC address of mgmt port. The engineID may change when mgmt port MAC address changes after re-deployment of BIG-IP VE.

Workaround:
None

---

1711833-1 : Distributed Applications can't disable a data center through the GUI

Links to More Info: BT1711833

Component: Global Traffic Manager (DNS)

Symptoms:
The Disable Distributed Application Traffic button under DNS dashboard Distributed Applications does not disable traffic.

Conditions:
-- Go to DNS ›› GSLB : Distributed Applications : Application List ›› Data Centers
-- Click button "Disable Distributed Application Traffic"

Impact:
The distribution application traffic for datacenter is not disabled.

Workaround:
Use tmsh as workaround to disable datacenter

modify gtm distributed-app test disabled-contexts add { datacenter <name> }

---

1711813-1 : Incorrect SOA serial number shown in zxfrd logs during zone transfer

Links to More Info: BT1711813

Component: Global Traffic Manager (DNS)

Symptoms:
SOA serial is incorrect in the zxfrd logging.

zxfrd[4526]: 0153102c:5: IXFR Transfer of zone xyz.net with SOA Serial -1884747279 from 1.1.1.1 succeeded.

Conditions:
After performing the zone transfer, observe the zxfrd logging, where an incorrect serial number is seen once the number exceeds the signed integer limit.

Impact:
Difficult to troubleshoot zone transfer issues via the logs.

Workaround:
None

---

1710813 : Tmm error logs related to per-request policies are vague/difficult to understand

Links to More Info: BT1710813

Component: Access Policy Manager

Symptoms:
Per-request policy error logs make it difficult to identify syntax errors

EX:
info tmm1[18482]: 01220002:6: Rule /Common/_sys_APM_Expression_Evaluation: syntax error in expression "[string tolower [mcget {perflow.branching.url}]] starts_with...": extra tokens at end of expression while compiling "expr {[string tolower [mcget {perflow.branching.url}]] starts_with "https://my.example.com/nweb/preregistration＼" || [string tolower ..." while compiling "return [ expr {[string tolower [mcget {perflow.branching.url}]] starts_with "https://my.example.com/nweb/preregistration＼" || [string..." (compiling body of proc "accessv2_proc317", line 1)

Conditions:
-- Per-request policy configured
-- A syntax error exists

Impact:
It is difficult to correct the VPE syntax using the error message report.

Workaround:
Check the corresponding ltm logs when the issue is observed.

---

1710805 : VPE PRP errors not showing in the GUI and throws an error after reboot

Links to More Info: BT1710805

Component: Access Policy Manager

Symptoms:
If VPE agents contain syntax error, they are not triggered while saving the access policy, and a runtime error occurs when the policy is applied to network traffic.

Tmm log:
info tmm1[21588]: 01220002:6: Rule /Common/_sys_APM_Expression_Evaluation: syntax error in expression "[string tolower [mcget {perflow.branching.url}]] starts_with...": character not legal in expressions while compiling "expr {[string tolower [mcget {perflow.branching.url}]] starts_with ＼"<url>＼" || [string tolower..." while compiling "return [ expr {[string tolower [mcget {perflow.branching.url}]] starts_with ＼"<url>＼" || [strin..." (compiling body of proc "accessv2_proc2184", line 1)

APM log:
Per request access policy item (/Common/working_act_url_branching_perrq) from per request policy (/Common/working) not found.

Conditions:
-- Per-request policy attached to a virtual server
-- You make a change to the policy and the change contains a syntax error

Impact:
You are able to save the policy that contains the syntax error, but tmm will log an error at runtime.

Workaround:
None

---

1709845-1 : NSEC3 bitmap is not right when allow-nxdomain-override is enabled

Links to More Info: BT1709845

Component: Global Traffic Manager (DNS)

Symptoms:
NSEC3 bitmap uses dnssec.nsec3apextypesbitmap and does not remove qtype from the list.

Conditions:
Allow-nxdomain-override is enabled and there is no corresponding resource record for the wideip being queried.

Impact:
DNS responses contain wrong information.

Workaround:
None

---

1709689-3 : BGP 'no bgp default ipv4-unicast' might lead to config load problems and crashes.★

Links to More Info: BT1709689

Component: TMOS

Symptoms:
BGP 'no bgp default ipv4-unicast' might lead to config load problems and/or BGPd daemon crashes.

Conditions:
'no bgp default ipv4-unicast' statement is used in BGP configuration.

Impact:
Configuration cannot be loaded. BGPd might experience a crash/core.

Workaround:
None

---

1708957-1 : Excessive debug logs can cause key management daemon failure

Links to More Info: BT1708957

Component: TMOS

Symptoms:
During the upgrade, when there are a large number of folders and the configuration is loading, due to logging for each folder creation, the key management daemon (KeyMgmtDaemon) fails and can result into upgrade failure.

Conditions:
- A large number of folders present in the device before upgrade.
- Logging level is set to "Debug"
- Initiate the upgrade.

Impact:
Device upgrade fails.

Workaround:
Change the log level to a value higher than "Debug" before initiating the upgrade.

---

1708309-1 : Dynconfd crash with invalid ephemeral pool member

Links to More Info: BT1708309

Component: Local Traffic Manager

Symptoms:
If the BIG-IP configuration becomes corrupted in such a way that an ephemeral pool member exists with no corresponding FQDN template pool member, ephemeral node or FQDN template node, the dynconfd daemon may crash repeatedly.

Conditions:
This issue has only been encountered when corruption of the MCP database resulted in an ephemeral pool member existing with no corresponding FQDN template pool member, ephemeral node or FQDN template node. This is an invalid configuration which cannot be created through user action, and can only occur due to corruption of the MCP database. Such corruption is extremely rare, and the cause is not known.

Impact:
The dynconfd daemon performs the action of resolving node FQDN names to IP addresses and creating ephemeral nodes and pool members with those addresses. When this issue occurs, dynconfd will be unable to resolve FQDN names in any existing FQDN template nodes (and FQDN template pool members) to their corresponding IP addresses. This can result in a lack of available pool members to process traffic.

Workaround:
To recover from the MCP database corruption, perform the actions described in the following F5 knowledge article:
K13030: Forcing the mcpd process to reload the BIG-IP configuration

---

1707921 : Tenant upgrade fails with disk full error on BIG-IP 17.x created with T2 image★

Links to More Info: BT1707921

Component: TMOS

Symptoms:
Upgrade failed with "disk full" error in 17.1.x version.

-----------------------------------------------------------------------------------------------------------
Sys::Software Status
Volume Product Version Build Active Status Allowed Version
-----------------------------------------------------------------------------------------------------------
HD1.1 BIG-IP 17.1.1.4 0.0.9 yes complete yes
HD1.2 BIG-IP 17.1.1.3 0.0.5 no failed (Disk full (volume group). See SOL#10636)

Conditions:
- Deployed BIG-IP tenant with v17.x.x T2 image
- Trying to create an additional boot location

Impact:
Creation of additional boot location fails with "disk full" error.

Workaround:
Expand the tenant's virtual disk (storage-size) from F5OS to accommodate an additional boot location in the tenant.

Values of 46G/47G have worked well in lab testing.

---

1701749 : APM throws an error when access policy has xsl in the name

Links to More Info: BT1701749

Component: Access Policy Manager

Symptoms:
When an access policy name has a substring 'xsl', it leads to a 404 error for the VPE link.

Conditions:
-- An access policy has the letters 'xsl' in the name.
-- Using the policy in the visual policy editor.

Impact:
The page returns 404 not found. Access policies are not allowed to have a substring 'xsl'.

Workaround:
None

---

1701381-1 : Silent failure when modifying members of a pool that does not exist.

Links to More Info: BT1701381

Component: TMOS

Symptoms:
When you attempt to modify the members of a non-existent LTM pool, the command completes as if there is no error but no changes are made and no error occurs.

Example command:
modify ltm pool non-exist-pool members modify { all { session user-disabled state user-down }

Conditions:
-- Modifying members of a LTM pool that does not exist

Impact:
An error message should be displayed

Workaround:
None

---

1701169 : The requested monitor parameter SNI_SERVER_NAME was not found

Links to More Info: BT1701169

Component: Global Traffic Manager (DNS)

Symptoms:
When you attempt to modify the sniServerName of a HTTPS monitor via the GUI, an error occurs:

The requested monitor parameter (/Common/my-monitor SNI_SERVER_NAME=) was not found

Conditions:
-- GTM (DNS) HTTPS monitor
-- The monitor was created using the iControl REST API
-- When the monitor was created, the sniServerName field was not set
- You attempt to modify the sniServerName from the GUI

Impact:
An error is thrown in the GUI and you are unable to modify the sniServerName.

Workaround:
Use tmsh to modify sniServerName.

Ex:

modify gtm monitor https my-monitor sni-server-name www.example.com

---

1700005-1 : Unable to tunnel HTTP2 request through HTTP2 virtual server

Links to More Info: BT1700005

Component: Local Traffic Manager

Symptoms:
Client sends HTTP2 CONNECT request without URI as per RFC9113, but BIG-IP is erroneously expects a URI in the request, which causes the request to fail.

Conditions:
-- Virtual server with HTTP2 on client-side
-- Explicit proxy
-- Connect request from client

Impact:
Unable to complete the transaction

Workaround:
None

---

1696757 : IPS CEF logging misses some values

Links to More Info: BT1696757

Component: Protocol Inspection

Symptoms:
When configuring CEF logging the fields device vendor, device product and device version are not shown. So at the beginning of the log entry it reads:

CEF:0||||27590657|test|

Instead of:

CEF:0|F5|Advanced Firewall Module|17.1.1.3.0.0.5|27590657|test|

Conditions:
CEF logging configured for IPS.

Impact:
Constant values from the AFM device, vendor, product and version, are missing in the IPS log.

Workaround:
None.

---

1694181 : Firewall policy fails to match a virtual wire

Component: Advanced Firewall Manager

Symptoms:
Traffic is not matching the zone specified in the firewall policy when vWire is in use.

Conditions:
-- A firewall policy is using a zone
-- Two or more virtual wire VLANs are in the matching zone

Impact:
Traffic is not matching the zone specified in the firewall policy when vWire is in use.

Workaround:
None

---

1694109 : VCMP guest software image install ( source image from vHost) with large number of VLANs causes lind restart★

Links to More Info: BT1694109

Component: TMOS

Symptoms:
Lind restarts shortly after install starts, resulting in either a failed install or boot volumes showing as "audited"

Conditions:
- on VCMP guest delete HF1.3, if it exists
- on VCMP guest install 17.1.1.3.iso in HD1.3 using the "Image Source" "Host"

Impact:
The upgrade fails. The 'show sys software status' command might report the volume status as 'audited'.

Workaround:
Workaround 1 (preferred):
-------------
- Install from a local ISO (copy
  the ISO file(s) from /var/tmp/ to /shared/images/ and try)

Workaround 2:
--------------
- on VCMP host delete VLANs
- on VCMP guest delete the affected volume
- on VCMP guest install 17.1.1.3.iso in HD1.3 using the
  "Image Source" "Host"

---

1692049-3 : Modifying DOS TScookies impacts existing TCP connections with TCP TStamps enabled

Links to More Info: BT1692049

Component: Advanced Firewall Manager

Symptoms:
Modifying DOS timestamp Cookies impacts existing TCP connections with TCP timestamps enabled.

Conditions:
- Existing TCP connection with TCP timestamps enabled.
- TCP ACK (TS) DOS vector 'Timestamp Cookie' option is modified. (v17.1 or later)
- TCP BADACK Flood DOS vector 'Timestamp Cookie VLAN' option is modified. (v15.1, v16.1)

Impact:
Segments are lost for existing connections, this might lead to connection closure.

Workaround:
None

---

1691489 : Traffic does not pass through rSereis FIPS system

Links to More Info: BT1691489

Component: Local Traffic Manager

Symptoms:
SSL handshake fails.

Conditions:
Using cipher suites that have RSA as a Key exchange mechanism.

Impact:
Users must use cipher suites which do not have RSA as a key exchange algorithm.

Workaround:
Use cipher suites which do not use RSA as a key exchange algorithm.

---

1691385-1 : Removed the ability to edit "kerberos_auth_config_default" access policy

Links to More Info: BT1691385

Component: Access Policy Manager

Symptoms:
The access policy "kerberos_auth_config_default" was still editable resulting in NTLM fallback not working as intended.

Conditions:
-Click on Access -> Profiles/ Policies.
-Click on "kerberos_auth_config_default" in the access profile list
-Make changes and save the access policy

Impact:
Would result in NTLM fallback not working as intended.

Workaround:
None

---

1691369-1 : "Bot Defense Profiles" screen does not display attached virtual servers under user partitions

Links to More Info: BT1691369

Component: Application Security Manager

Symptoms:
"Bot Defense Profiles" screen does not display attached virtual servers that are configured in other partitions

Conditions:
Using multiple partitions

Impact:
Usability with GUI

Workaround:
None

---

1690837-3 : Invalid username in URL of From or To in SIP ACK should be rejected with 4xx message

Links to More Info: BT1690837

Component: Service Provider

Symptoms:
Invalid username such as one which contains an invalid character like "sip:sipp#@10.1.1.1" are not rejected by the BIG-IP

Conditions:
The client sends a SIP ACK with invalid character in the username of the URL for From and or TO
sip:sipp#@10.1.1.1

Impact:
The username is accepted by the BIG-IP system and passed along to the SIP server. This could cause issues for the downstream SIP server.

Workaround:
None

---

1690721-1 : Bgpd crashes on `write` config or running show running-config CLI, when trying to delete neighbor with wrong peer-group

Links to More Info: BT1690721

Component: TMOS

Symptoms:
If you delete a neighbor with the wrong peer-group and save the config, bgpd will crash.

Conditions:
-- Try deleting the bgp neighbor with wrong peer-group
-- Save the config by doing 'write' or run the 'show running-configuration CLI.

Impact:
Bgpd crashes. Routing may be affected while bgpd restarts.

Workaround:
While deleting the neighbor give the right peer-group.

---

1690441-1 : IPsec traffic-selector selection algorithm in interface mode★

Links to More Info: K96223265, BT1690441

Component: TMOS

Symptoms:
IPsec traffic goes down after upgrade, IKE peers start failing health checks, there are issues with traffic selectors.

Conditions:
-- Peer sends multiple traffic selectors
-- The first traffic selector is ICMP using ports 0-65535

This also occurs when an IPSec policy is configured in Interface Mode.

Impact:
BIG-IP returns the wrong SA and traffic gets dropped.

Workaround:
None

---

1690005 : Masquerade Mac is not removed when F5OS is rebooted

Links to More Info: BT1690005

Component: F5OS Messaging Agent

Symptoms:
Masquerade Mac is not removed when F5OS is rebooted.
It can be observed using the 'show fdb' command in confd

Conditions:
- A HA pair of tenants is used
- A traffic group uses a masquerade mac
- The Active tenant is rebooted

Impact:
Active and Standby act as if they are the owners of Floating MAC and IP.

Workaround:
The masquerade mac's fdb can be manually deleted using the F5OS CLI.
From the standby F5OS system CLI:
config
no fdb mac-table entries entry <mac masquerade address>
commit

---

1688913-3 : BIG-IP returns SIP 480 when receiving invalid SIP username

Links to More Info: BT1688913

Component: Service Provider

Symptoms:
When a client sends a SIP Invite message that contains an invalid character in the username of the From or To:
From: <sip:alice#@10.1.1.1...
BIG-IP returns 480 error message rather than 400 Bad Request

Conditions:
SIP Invite contains an invalid character in the From or To

Impact:
Rather than 400 error message, it is 480 Temporarily unavailable.

Workaround:
None

---

1688545-1 : PVA-processed traffic is not included in the route-domain stats via SNMP

Links to More Info: BT1688545

Component: TMOS

Symptoms:
PVA traffic sent to the VIP is not reflected in the route-domain statistics within SNMP.

Conditions:
Viewing ltmRouteDomainStat* route domain statistics in F5-BIGIP-LOCAL-MIB

Impact:
Discrepancy between the throughput statistics and traffic statistics on per-VLAN basis

Workaround:
None

---

1682101 : Restjavad CPU goes close to 100% during telemetry pollers collect stats

Links to More Info: BT1682101

Component: TMOS

Symptoms:
Restjavad CPU utilization approaches 100% when telemetry endpoints are accessed, such as
/mgmt/shared/telemetry/pullconsumer/metrics

Conditions:
Telemetry operations endpoints are used.

Issue observed on releases with an existing fix, ID 1040573 at https://cdn.f5.com/product/bugtracker/ID1040573.html, where some changes happened on icrd operations.

Impact:
During telemetry operations ,100% restjavad usage occurs.

Workaround:
None

---

1679869 : [APM][SAML] import IdP metadata with signing/encryption certificate only imports signing cert, not encryption cert

Links to More Info: BT1679869

Component: Access Policy Manager

Symptoms:
BIG-IP supports import of external SAML SP metadata to create SP-Connector objects. When such metadata file contains two certificates (one with 'signing' and one with 'encryption use) then BIG-IP will import certificate that is positioned 'second' in metadata twice.

Conditions:
Imported metadata contains two certificates with different use types: 'signing' and 'encryption'

Impact:
Only the second certificate is imported.

Workaround:
Import certificates manually

---

1679661-3 : Log messages in Session Awareness Data Point Sweep

Links to More Info: BT1679661

Component: Application Security Manager

Symptoms:
Critical error messages for unhandled keywords are included in asmcrond and /var/log/asm logs.

Conditions:
Devices are configured using ‘Manual’ ASM sync for the device group, and the ‘Session Awareness’ feature is enabled.

Impact:
Errors that are not of critical level are found in the high-level logs.

Workaround:
None

---

1679633-3 : Custom SNMP OID script using clsh/ssh fails due to SElinux permissions

Links to More Info: BT1679633

Component: TMOS

Symptoms:
Custom SNMP OID Script does not work, returned output is not correct.

Conditions:
You create a custom OID that uses ssh/clsh to access data from other blade.

Impact:
The OID fails due to SElinux permissions. You can't use SNMP to collect the new bfd stats from each blade from just the primary blade.

Workaround:
None

---

1678105-1 : F5OS tenant, TMM crashing after loading a UCS

Links to More Info: BT1678105

Component: TMOS

Symptoms:
If a UCS is loaded on a F5OS tenant and the name of the tenant from where the UCS was saved does not match the tenant name where it is restored.

Conditions:
- UCS restored on tenant with a different tenant name than were the UCS was created.

Impact:
The tenant will not become operational because TMM fails to start.

Workaround:
Refer to following steps for workaround:

1. Remove the file "tmm_velocity_init.tcl" in /config/.
2. Perform bigstart restart platform_agent.
3. Ensure a new "tmm_velocity_init.tcl" is created and TMM stops failing.

---

1677429-3 : BFD: TMM might not agree on session ownership.

Links to More Info: BT1677429

Component: TMOS

Symptoms:
Bidirectional forwarding detection (BFD): TMM might not agree on session ownership.

Conditions:
- Multi-bladed chassis.
- A blade is added or removed in a cluster.

Impact:
BFD session ownership moves to a new TMM.

Workaround:
None

---

1677409 : Show auth login-failures does not show failures when remote auth falls back to local auth

Links to More Info: BT1677409

Component: TMOS

Symptoms:
If the remote auth server fails and is configured to fallback to local auth, failures of local auth accounts are not tracked when we look at show auth login-failures

Conditions:
Issue occurs when remote auth server fails and is configured to fallback to local auth.

Impact:
Show auth login-failures is not showing the failure users which makes it more difficult to track login failures.

Workaround:
None

---

1677137 : Protocol-Inspection compliance http_non_crlf_line_break is not shown on show running-config

Links to More Info: BT1677137

Component: Protocol Inspection

Symptoms:
protocol-inspection compliance http_non_crlf_line_break" is not shown on "show running-config

Conditions:
Configuring "protocol-inspection compliance http_non_crlf_line_break"

Running the command 'tmsh show running-config | grep http_non_crlf_line_break'

Impact:
The 'tmsh show running-config' command does not show the entire running configuration.

Workaround:
Explicitly show the compliance item:

tmsh show running-config security protocol-inspection compliance http_non_crlf_line_break

---

1671917-3 : The 'received' field is unavailable in SIP VIA header when 'rport' is included in SIP request

Links to More Info: BT1671917

Component: Service Provider

Symptoms:
When a SIP request with the VIA header containing the 'rport' field is received, BIG-IP forwards rport=<source port> to the server without the ‘received’ field. This causes the SIP server to return a 400-type error because of the missing ‘received’ field.

Conditions:
Any SIP request which contains the rport field.

Impact:
The SIP server sends 400 type error

Workaround:
None

---

1671545-1 : BIND no longer follows CNAME to populate A records in the reply

Links to More Info: BT1671545

Component: Global Traffic Manager (DNS)

Symptoms:
When answering authoritative queries, the named process (also known as 'bind') does not return the target (for example, 'A' records) related to a cross-zone CNAME between two locally served zones.

For example, if BIG-IP is configured with a wideip such as www.gslb.example.org, and a DNS query is sent to it for 'A' records for www.example,org, that query falls through to, and is handled by bind, and bind responds with a CNAME to www.gslb.example,org, then the previous behaviour was that bind would also include the related A records that the CNAME pointed to.

When the 'A' record in the reply pass back through BIG-IP DNS, they are rewritten to match the wideip's pool state, so the result passed to the client is the same as if the wideip was the query.

A code fix for security improvements in bind version 9.12 and later alters this behaviour so that the 'A' records are no longer populated into the reply, which means the rewrite logic in BIG-IP does not take place, and the CNAME alone is passed back to the DNS client.

Conditions:
DNS query resolution of CNAME records via BIND.

Impact:
Incomplete DNS resolution.

Workaround:
Instead of using bind to resolve the CNAME, configure BIG-IP to do it.

Option 1: Configure the wideip with an alias that it will also respond to. This will return a response (for example an A record) to the client, as if the client had queried the gslb record.

   tmsh modify gtm wideip a www.gslb.example.org aliases add { www.example.org }


Option 2: Create a wideip for the 'www.example.org' record, which points to a CNAME pool, which contains the www.gslb.example.org record, and disable minimal-responses. This method is more complicated, but also more flexible, for example it could be used as a fallback if other 'A' record pools associated with the wideip are unavailable. This method will cause BIG-IP to return both the CNAME and A record in the DNS reply.

   tmsh create gtm wideip a www.gslb.example.org pools add { gtmpool }
   tmsh create gtm pool cname CNAME_www.example.org members add { www.gslb.example.org }
   tmsh create gtm wideip a www.example.org pools-cname add { CNAME_www.example.org } minimal-response disabled

---

1671149-3 : Timestamp cookies may cause issue for PVA-accelerated connections

Links to More Info: BT1671149

Component: Advanced Firewall Manager

Symptoms:
Timestamp cookies may cause performance issues for PVA-accelerated connections on some older platforms and/or platforms without a performance license.

Conditions:
-- PVA offload configured (any stage).
-- DOS ACK (TS) vector has timestamp cookies option enabled.
-- Platform does not support the following list of devices*:
A112
A114
A121
D116
D120
C116
C118
C119
C123
C124
C125
C126
F5OS-C and rSeries platforms.
-- *Platform must have a performance license, with DOS HW capabilities enabled via turboflex profile.

Impact:
Resets the connection or causes slow performance.

Workaround:
Disable timestamp-cookie feature.

---

1671129-1 : Add support for TLSv1.2 in PHP package

Links to More Info: BT1671129

Component: TMOS

Symptoms:
SMTP server may reject SMTP connection and SMTP server may not send mails.

Conditions:
SMTP server should be configured.

Impact:
SMTP server may not send mails.

Workaround:
None

---

1670625-2 : Incorrect set of TCAM rules

Links to More Info: BT1670625

Component: TMOS

Symptoms:
Incorrect set of TCAM rules.

Conditions:
Multiple hardware acceleration features are activated simultaneously.

Impact:
Hardware offload does not function properly, only software protection is available.

Workaround:
None

---

1670465-3 : TMMs might not agree on session ownership when multiple cluster geometry changes occur.

Links to More Info: BT1670465

Component: TMOS

Symptoms:
TMMs might not agree on session ownership when multiple cluster geometry changes occur in a quick succession.

Conditions:
Cluster geometry changes occur in a quick succession, for example two blades come up one after another during a software upgrade.

Impact:
Session might be dropped few minutes/seconds after cluster geometry change happens

Workaround:
None

---

1670445 : Subsequently attached IPS log profile to a virtual server is not used when IPS is disabled on the firstly attached log profile

Links to More Info: K000140367, BT1670445

Component: Advanced Firewall Manager

Symptoms:
Protocol inspection in the security log profile is not activated/enabled when the first log profile has Protocol Inspection disabled and is already attached to the virtual server.

Conditions:
1. Create the first security log profile (for example, enable a sub-module other than Protocol Inspection) and attach to a virtual server (VS).
2. Create the second security log profile with Protocol Inspection enabled, select a publisher and attach to the VS.
3. Event logs are not sent through the selected publisher which is not expected.

Therefore, the protocol inspection log profile attached later to the virtual server is not effective.

Impact:
Inconsistency in configuration behavior.

Workaround:
Run the below command to detach the profiles from virtual server (VS) and attach the required log profile first.

tmsh modify ltm virtual <VS Name> security-log-profiles none

---

1670225-1 : 'Last Error' field remains empty after initial monitor Down status post-reboot

Links to More Info: BT1670225

Component: Local Traffic Manager

Symptoms:
After rebooting the BIG-IP system, the 'Last Error' field in the /var/log/ltm log for a TCP monitor shows as empty (null) following the first occurrence of the monitor's down status.

mcpd[6893]: 01070638:5: Pool /Common/http_pool member /Common/192.168.10.71:80 monitor status down. [ /Common/my_tcp_monitor: down; last error: ] [ was up for 0hr:0min:41sec ]

And If pool member goes back to 'up' and then 'down' again, 'last error:' string is not empty, but the 'last error" string is not the most recent failure reason following.

mcpd[8820]: 01070638:5: Pool /Common/http_pool member /Common/10.2.116.207:80 monitor status down. [ /Common/myhttpmon: down; last error: /Common/myhttpmon: Response Code: 200 (OK) @2024/12/09 00:14:23. ] [ was up for 0hr:0min:32sec ]

Conditions:
The issue occurs when the monitor status of system is up and rebooted and during the first occurrence of a monitor's down status following the reboot, and pool member goes back to 'up' and then 'down' again.

Impact:
Users may not be able to determine the cause of monitor failures immediately after a system reboot, and pool member goes back to 'up' and then 'down' again. as the 'Last Error' field does not provide the necessary diagnostic information

Workaround:
None

---

1670041 : [SWG] VCMP all secondary slots restart when URL categories are modified/deleted

Component: Access Policy Manager

Symptoms:
VCMP Blades restart after modifying a SWG category.

After the deletion occurs, log entries can be seen in /var/log/ltm:

err mcpd[6095]: 01070734:3: Configuration error: Configuration from primary failed validation: 010717ac:4: Configuration Warning: The is-recategory flag in url-category (/Common/categoryname) is reset to false, because the last url has been removed.... failed validation with error 17242028.

notice clusterd[7358]: 013a0006:5: Failed to send cluster packet; disconnecting

info sod[4418]: 010c0009:6: Lost connection to mcpd - reestablishing.

notice mcpd[4424]: 0107092a:5: Secondary slot 3 disconnected

Conditions:
-- VCMP secondary blades
-- URL categories are modified or deleted

Impact:
Unexpected failover when modifying SWG Categories

Workaround:
None

---

1644497-3 : TMM retains old Certificate Revocation List (CRL) data in memory until the existing connections are closed

Links to More Info: BT1644497

Component: TMOS

Symptoms:
In TMM memory, the old CRL data is available until the existing connections are closed. This may exhaust TMM memory.

Conditions:
- Connections last for a long time.
- Frequent updates on the CRL.

Impact:
TMM memory exhausts.

Workaround:
- Dynamic CRL or CRLDP on the Client-SSL profile can be configured to dynamically verify the SSL certificate revocation status.

or

- Online Certificate Status Protocol (OCSP) can be enabled on the Client-SSL profile to validate SSL certificate revocation status.

---

1642301-3 : Loading single large Pulse GeoIP RPM can cause TMM core

Links to More Info: BT1642301

Component: Global Traffic Manager (DNS)

Symptoms:
Creates a TMM core.

Conditions:
Loading large Pulse GeoIP RPM resources.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
Use GEOIP Edge database.

---

1641421-1 : Folders in the GTM synchronized group does not have same value as the inherited traffic group

Links to More Info: BT1641421

Component: Global Traffic Manager (DNS)

Symptoms:
In some GTM members, the inherited traffic group is set to false.

Conditions:
When folders are synchronized to GTMs that are in an LTM HA synchronized group.

Impact:
In a few conditions, it will cause GTM configuration loss.

Workaround:
None

---

1637797-3 : Memory leak in TMM of TCL memory when a procedure is called with too few arguments

Links to More Info: BT1637797

Component: Local Traffic Manager

Symptoms:
TMM memory growth over time.

There may be an error message in the LTM log similar to:

01220001:3: TCL error: /Common/irule <CLIENT_ACCEPTED> - wrong # args: should be "call my_proc <arg1> <arg2> while executing "call my_proc $variable"

Note that the LTM log message may be throttled and not visible in the current logs.

Conditions:
An iRule calls a procedure with insufficient arguments.

Impact:
- Memory leak in TMM.
- TMM experiences an out-of-memory state and might crash.

Workaround:
Ensure that the called procedure provides enough arguments.

---

1637477-1 : Negotiated Window scaling by HW SYN cookie not accounted by TMM

Links to More Info: BT1637477

Component: Local Traffic Manager

Symptoms:
When hardware SYN cookie mode is activated, the hardware will negotiate window scaling with the client, but TMM still assumes no window scaling is involved.

Conditions:
When the receive window size and send buffer size are both at or below 65535, TMM establishes the TCP connection without using TCP window scaling.

This can happen if a profile such as this one is used:

- ltm profile tcp tcp-legacy
- ltm profile tcp tcp-wan-optimized
- since they have the following settings:
- receive-window-size 65535
- send-buffer-size 65535

Impact:
TMM interprets the client’s advertising in a very small window, which reduces its performance.

Workaround:
Increase to 65536 or higher for either one of the following:
- receive-window-size
- send-buffer-size

---

1636273-1 : In BIND 9.18.28, a new configurable parameter (max-records-per-type) has been introduced with a default limit of 100 to address a security issue.

Component: Global Traffic Manager (DNS)

Symptoms:
No DNS response is received for more than 100 records.

Conditions:
Resolve a domain with more than 100 records of the same type.

Impact:
DNS resolution fails.

Workaround:
Adjust the max-records-per-type value in the BIND configuration as needed.

---

1636077-1 : Adding an operationally DOWN interface to existing LAG causes traffic disruption on r2k/r4k

Links to More Info: BT1636077

Component: Local Traffic Manager

Symptoms:
When an operationally DOWN interface is added to an existing LAG interface, traffic flow to the tenant stops on r2k/r4k based appliances.

Conditions:
-- Interface is marked down
-- Interface is added to an existing LAG interface

Impact:
Traffic flow gets impacted and the system misses the packets routed onto the LACP trunk to where the LAG member was added.

Workaround:
Restart tmm on all tenants that are associated with the trunk.

---

1635829-1 : Sint Maarten (SX) and Curacao (CW) are unavailable in Geolocation enforcement and event log filter

Links to More Info: BT1635829

Component: Application Security Manager

Symptoms:
Sint Maarten (SX) and Curacao (CW) countries are unavailable in Geolocation enforcement and event log filter.

Conditions:
ASM is provisioned.

Impact:
Unable to apply Geolocation enforcement to the country codes SX and CW.

Workaround:
None

---

1635013-4 : The "show sys service" command works only for users with Administrator role

Links to More Info: BT1635013

Component: TMOS

Symptoms:
A guest or non-root user must be able to use the TMSH “show sys service” command, as there is no rule associated with a schema.

Conditions:
The issue occurs when the user is a non-root user.

Impact:
A non-root user will not be able to run the command even though they have permissions.

Workaround:
None

---

1634669-1 : The CATEGORY::lookup iRule command prioritizes default categories over custom categories.

Links to More Info: BT1634669

Component: Access Policy Manager

Symptoms:
While executing the CATEGORY::lookup iRule command, the default categories will be first included in the resulting array before any custom categories. If the URL does not match any default categories, the first result will be UNCATEGORIZED.

Conditions:
Use the CATEGORY::lookup iRule command with request_default_and_custom and custom categories are in use.

Impact:
The iRule prioritizes default categories which may be unexpected, especially if the iRule only looks at the first (primary) category returned.

Workaround:
None

---

1633925-3 : Neurond is crashing intermittently during the creation/deletion of Neuron rules.

Links to More Info: BT1633925

Component: TMOS

Symptoms:
Neurond crashes are observed intermittently and core files are generated in the /shared/core folder.

Conditions:
When a profile-based DOS vector threshold is configured with a very low value, it may result in frequent addition/deletion of Neuron rules.

Impact:
Neurond crashes will be observed and may result in software-only mitigation due to failure in Neuron rule addition. Once Neurond comes up, rules are recreated allowing with the hardware mitigation.

Workaround:
Increase in threshold values for Profile-based DOS vectors if the configured value is very low.

---

1633573-1 : Active/Active Deployment Leads to DCC corruption due to duplicate sync files

Component: Application Security Manager

Symptoms:
If changes are applied to two devices in auto-sync device groups at the same time, database corruption could occur.

Conditions:
Active/active deployment with ASM auto-sync enabled in a full sync group, and automatic policy builder running on both devices with traffic.

Impact:
Possible Policy enforcement corruption errors

Workaround:
Spurious changes and applying the affected policies fix the corruption.

---

1632925-1 : Sod does not update the value for sys DB failover.crcvalues

Links to More Info: BT1632925

Component: TMOS

Symptoms:
- The Traffic Groups GUI on a device in a device group reports the following even if the traffic group is in sync:

“The traffic group configuration on this device does not match with other devices. Sync the Configuration between devices.”

- Traffic group CRC values are consistent among peer devices when dumping the sod registers into /var/log/sodlog using the command /bin/cmd_sod get info.

- Restarting sod does not change the DB var failover.crcvalues from 'disagree' to 'agree'.

Conditions:
The DBVAR failover.crcvalues was previously set to disagree before the sod restart.

Impact:
The GUI displays the incorrect message in contrast to the actual state of the traffic group.

Workaround:
-- Ensure that the traffic groups are in sync and the peers agree on the CRC values.

-- Manually set the db var failover.crcvalues to 'agree' on the affected device. The commands would be:

     tmsh modify sys db failover.crcvalues value agree
tmsh save sys config

---

1632745-1 : Tmctl snapshots fail to work when slow_merge is enabled

Links to More Info: BT1632745

Component: TMOS

Symptoms:
With the slow_merge option enabled as a workaround, tmctl snapshots are no longer created. This issue prevents capturing snapshots required for troubleshooting problems.

Conditions:
This issue occurs under the following conditions:

a. The system has the slow_merge option.
b. Tmctl snapshots are attempted to be created while the slow_merge method is active.

Impact:
Tmctl snapshots are not generated when the slow_merge workaround is enabled.

Workaround:
None

---

1629693-1 : Continuous rise in DHCP pool current connections statistics

Links to More Info: BT1629693

Component: TMOS

Symptoms:
- Displays all properties of the dhcp_pool in its raw format under the LTM pool.
- Displays a rising count of current connections.

Conditions:
When a pool is used for DHCP servers.

Impact:
Wrong statistics showing a growing number of connections.

Workaround:
None

---

1629465-1 : Configuration synchronization fails when there is large number of user partitions (characters in user partition names exceeds sixty five thousand)

Links to More Info: BT1629465

Component: TMOS

Symptoms:
Configuration synchronization fails with the below errors,

err mcpd[6505]: 01070712:3: Caught configuration exception (0), MCP call 'mcpmsg_set_string_item(msg, CID2TAG(m_cid), val.c_str())' failed with error: 16908375, 01020057:3: The string with more than 65535 characters cannot be stored in a message..

err mcpd[6505]: 01071488:3: Remote transaction for device group /Common/[device group] to commit id [commit id #] [config stamp #] /Common/[hostname] 0 failed with error 01070712:3: Caught configuration exception (0), MCP call 'mcpmsg_set_string_item(msg, CID2TAG(m_cid), val.c_str())' failed with error: 16908375, 01020057:3: The string with more than 65535 characters cannot be stored in a message...

Conditions:
Traffic group with multiple devices and a large amount of user partitions (total character in the user partition names exceeds sixty five thousand)

Impact:
Configuration synchronization fails.

Workaround:
Reduce the number of user partitions and the characters in the partition names, or split the configuration into separate vCMP guests.

---

1629221-1 : BWC menu is not available in UI when licensing DHD

Links to More Info: BT1629221

Component: TMOS

Symptoms:
You are unable to view "Acceleration->Bandwidth Controllers" in Advanced Menu and are unable to configure anything from the GUI

Conditions:
-- Install the DHD license

Impact:
Not able to to access the Bandwidth Controllers menu from the GUI

Workaround:
Use tmsh command to configure or access.

tmsh create net bwc policy test max-rate 10000000

---

1624625-1 : L7 policy for bot defense enable without profile name causes issues.

Links to More Info: BT1624625

Component: Application Security Manager

Symptoms:
When configuring L7 policy with bot defense enable command, but not setting the profile name, the command is not honored and tmm core can occur.

Conditions:
Bot Defense profile is attached to VS.
L7 policy is configured for enabling bot defense profile, without profile name (from editing bigip.conf only, GUI does not allow this)

Impact:
The bot defense enable command fails, and tmm may core. Traffic disrupted while tmm restarts.

Workaround:
Set the profile name in the Bot Defense enable command.

---

1624557-1 : HTTP/2 with RAM cache enabled could cause BIG-IP to return HTTP 304 with content

Links to More Info: BT1624557

Component: Local Traffic Manager

Symptoms:
When the server replies to BIG-IP with HTTP 304 (not modified) and the BIG-IP system returns the contents of the RAM cache, it will not change the HTTP code 304 returned by the server when sending the cached content back to the client. The client will reject the HTTP 304 with content since it is expecting 200 OK with content.

Conditions:
-- Content in RAM cache has expired
-- The BIG-IP system requests an update from the origin server
-- The origin server returns 304 Not Modified.

Impact:
The BIG-IP system sends the response to the client as a 304 along with the content, causing the client to reject the content.

Workaround:
Disable RAM cache or alternatively have the server never return HTTP 304 but rather the content with 200 OK, even if unchanged.

---

1623921-2 : IPencap monitor probes from bigd are prone to connection re-use.

Links to More Info: BT1623921

Component: Local Traffic Manager

Symptoms:
When using a DNS monitor with IP encapsulation, TMM handles probe encapsulation. Bigd reuses source ports after closing sockets quickly, but TMM applies a 30-second timeout, leading to connection re-use. This can result in probes being incorrectly encapsulated to the wrong pool member, causing inaccurate health monitoring

Conditions:
1. DNS monitor configured with 'transparent' destination and IP encapsulation enabled.
2. Large number of pool members (e.g., 60).

Impact:
Probes may be encapsulated to the wrong destination, leading to inaccurate health monitoring of pool members.

Workaround:
None

---

1623597-1 : Nat46/64 hardware connection re-offload is not optimal.

Links to More Info: BT1623597

Component: TMOS

Symptoms:
Nat46/64 hardware connection re-offload is not optimal.

Conditions:
Nat46/64 configuration with hardware offload (fastl4).

Impact:
Not optimal resource usage.

Workaround:
None

---

1623325-4 : VLAN groups or VLAN group members may be deleted on F5OS tenant

Links to More Info: BT1623325

Component: F5OS Messaging Agent

Symptoms:
If using VLAN groups on a tenant running on an rSeries appliance or VELOS chassis, the system may delete the VLAN group or VLAN group members unexpectedly.

This will happen when configuration changes to the tenant are made in F5OS or if the interface members of the VLAN change state (i.e. link down)

- If the VLAN groups are in a non-"Common" partition, any members of the VLAN group will be removed, but the VLAN group will remain.

- If the VLAN groups are in the Common partition, but are not referenced by higher-level objects, the VLAN group will be removed.

- If the VLAN groups are in the Common partition and are referenced by higher-level objects, the system will not delete the VLAN group, but will log messages similar to the following:

err mcpd[9181]: 01070623:3: The vlangroup (/Common/otters-vlangroup) is referenced by one or more virtual servers.
err chmand[4691]: 012a0003:3: hal_mcp_process_error: result_code=0x1070623 for result_operation=eom result_type=eom

Conditions:
- BIG-IP tenant running on rSeries appliance or VELOS chassis
- VLAN group configured in tenant, and not using virtual wire

Impact:
Traffic disrupted due to removal of VLAN group objects or VLAN group members.

Workaround:
To avoid this problem, define an unused VLAN group in the Common partition and assign it to the VLAN list for a virtual server.

tmsh create net vlan-group /Common/unused-vg
tmsh create ltm virtual /Common/unused-virtual vlans-enabled vlans add { unused-vg } description "Workaround for ID1623325"
tmsh save sys config

Note the use of "vlans-enabled" and adding the empty VLAN group to the virtual server's VLAN list. This means that the BIG-IP system will never actually process traffic via this virtual server, as it would only accept traffic to the virtual server that arrives over the VLAN group, but the VLAN group will never receive any actual traffic.

As a result of implementing this workaround, when the tenant processes any configuration updates from F5OS, the tenant will log error messages similar to the following:

err mcpd[10720]: 01070623:3: The vlangroup (/Common/unused-vg) is referenced by one or more virtual servers.
err chmand[6781]: 012a0003:3: hal_mcp_process_error: result_code=0x1070623 for result_operation=eom result_type=eom

---

1623277-1 : TCP reset is dropped when AFM is provisioned and a PVA-accelerated flow and the client does not have timestamps enabled.★

Links to More Info: BT1623277

Component: Advanced Firewall Manager

Symptoms:
After upgrading from version 15.x to 17.x, a fastL4 virtual no longer forwards TCP resets to the server side.

Conditions:
- Upgrade from version 15.x to 17.x
- The environment uses a standard fastL4 virtual server configuration.

Impact:
RST does not reach the backend server. Open connections accumulate on the backend server, causing longer response times to client requests.

Workaround:
N/A

---

1622425 : Float the management ip to the next available ip when the connectivity of primary blade is lost

Links to More Info: BT1622425

Component: Local Traffic Manager

Symptoms:
When the connectivity of the primary blade is lost with the management interface, then the UI is also lost.

Conditions:
The primary blade lost connectivity on the management interface.

Impact:
Lost chassis monitoring/alerting and access to the Management GUI.

Workaround:
Manual switchover of the slot will solve the issue.

---

1621949-1 : [PA]Applications break when specific host is in rewrite control list of rewrite profile

Links to More Info: BT1621949

Component: Access Policy Manager

Symptoms:
You may observe applications not working with console error like

ERROR TypeError: Cannot read properties of undefined (reading 'location/window')

Conditions:
Rewrite profile's rewrite control list contains specific host instead of Any/Any.

Impact:
Applications via Portal Access is not working.

Workaround:
Custom irule

=======
when REWRITE_REQUEST_DONE {
  
     if { [HTTP::path] ends_with "main.99af53556af6dbcb.js" } {
        REWRITE::post_process 1
        set rewrite_new 1
    }
}

when REWRITE_RESPONSE_DONE {

    if {[info exists rewrite_new]} {
        unset rewrite_new
    
        set rewrite_str {/*F5_*/ F5_g_window /*_5F#window#*/ .open().location.href=r}
        set rewrite_str_len [string length $rewrite_str]
        set strt [string first $rewrite_str [REWRITE::payload]]
        
        if {$strt > 0} {
            REWRITE::payload replace $strt $rewrite_str_len {F5_g_window.open(r)}
        }
        
    }
}
=======

---

1621481-1 : Tmrouted in a restart loop when large number of route-domains is configured.

Links to More Info: BT1621481

Component: TMOS

Symptoms:
Tmrouted enters a restart loop when large number of route-domains is configured.

Conditions:
Large number of route-domains configured (~ >1000)

Impact:
Tmrouted is unable to start successfully.

Workaround:
None

---

1621405-1 : Inactive policies are synced and removed

Links to More Info: BT1621405

Component: Application Security Manager

Symptoms:
An ASM policy in a sync-only device group is synced and removed from the virtual server.

Conditions:
-- Devices are in a sync-only device group.
-- An ASM policy is synced.

Impact:
Policies are removed from the virtual server.

Workaround:
None

---

1621317-1 : Uncaught (in promise) TypeError: Failed to construct 'MouseEvent': Please use the 'new' operator, this DOM object constructor cannot be called as a function.

Links to More Info: BT1621317

Component: Access Policy Manager

Symptoms:
Below console error in devtools

Uncaught (in promise) TypeError: Failed to construct 'MouseEvent': Please use the 'new' operator, this DOM object constructor cannot be called as a function.

Conditions:
Portal Access with Modern JS

Impact:
Unable to download CSV files

Workaround:
Custom irule:

==========
when REWRITE_REQUEST_DONE {
  if {
      [HTTP::path] ends_with "index.html"
  } {
    set flgx 1
    REWRITE::post_process 1
  }
}
 
when REWRITE_RESPONSE_DONE {
 if {[info exists flgx]} {
 
   unset flgx
   set str {if(typeof(F5_flush)}
 
   set strt [string first $str [REWRITE::payload]]
   if {$strt > 0} {
 
     REWRITE::payload replace $strt 0 {
    
    (function (window) {
        // Polyfills DOM4 MouseEvent
        const MouseEventPolyfill = function (eventType, params) {
            params = params || { bubbles: false, cancelable: false };
            const mouseEvent = document.createEvent('MouseEvent');
            mouseEvent.initMouseEvent(eventType,
            params.bubbles,
            params.cancelable,
            window,
            0,
            params.screenX || 0,
            params.screenY || 0,
            params.clientX || 0,
            params.clientY || 0,
            params.ctrlKey || false,
            params.altKey || false,
            params.shiftKey || false,
            params.metaKey || false,
            params.button || 0,
            params.relatedTarget || null
        );
 
        return mouseEvent;
        }
 
    MouseEventPolyfill.prototype = Event.prototype;
 
    window.MouseEvent = MouseEventPolyfill;
    })(window);
     }
   }
 }
}

==========

---

1621269-2 : TMM restart loop when attaching large number of interfaces.

Links to More Info: BT1621269

Component: TMOS

Symptoms:
TMM is unable to finish initialization when attaching 9 or more Intel 710/E810 SR-IOV interfaces.

Conditions:
-- Using 9 or more Intel 710/E810 SR-IOV VFs

Impact:
BIG-IP is unable to go into the Active state because TMM restart loop is present.

Workaround:
Update Mcpd.KeepAliveCount DB variable to 127 and reboot the BIG-IP.

---

1620725-3 : IPsec traffic-selector modification can leak memory

Links to More Info: BT1620725

Component: TMOS

Symptoms:
Memory leaks can occur after traffic-selector modification.

Conditions:
- Create a valid IPsec tunnel configuration.
- Constantly modifying the traffic-selector.

Impact:
Continuously modifying a traffic-selector will leak memory.

In a typical environment, traffic-selectors are configured once and are not reconfigured. Memory leaks can occur when traffic-selector is modified.

Workaround:
Do not modify the traffic-selector.

To update a traffic-selector, delete the traffic-selector and create it again as required.

---

1617329-3 : GTM LDAP may incorrectly mark a pool member as DOWN when chase-referrals is enabled

Links to More Info: BT1617329

Component: Local Traffic Manager

Symptoms:
LDAP monitoring can fail to detect a member as UP when "chase-referrals" is set to "yes", even if the server response does not contain any referral.

Conditions:
GTM LDAP monitor is setup with chase-referral enabled

Impact:
A pool member may continue to be marked as DOWN, even if available

Workaround:
Set chase-referral to disable

---

1617041-1 : Latest installed update missing on secondary device in HA-Pair

Links to More Info: BT1617041

Component: Application Security Manager

Symptoms:
The live update misses currently installed updates on secondary after installing latest updates on primary BIG-IP in HA pair.

Conditions:
-- BIG-IP configured for high availability (HA)
-- Install latest live update on primary BIG-IP device using Software Management-> live update -> asm attack signature
-- Click on check for updates
-- New files shown as available for updates (e.g. ASM-AttackSignatures_20240711_120647.im) and install update.

Note: The issue may not occur consistently with the steps outlined above, as it is intermittent in nature.

Impact:
User has to verify updates on secondary using curl command or navigating through GUI/CLI to check latest signature status on secondary device.

Workaround:
The live updates can be manually checked and installed on the secondary device via GUI/CLI

---

1617037-1 : [PA]"navigator.userAgent" detects Chrome browser as Safari

Links to More Info: BT1617037

Component: Access Policy Manager

Symptoms:
You may observe an error like below in Developer tools console
Uncaught TypeError: TypeError: Cannot read properties of undefined (reading 'document')

Conditions:
Accessing applications through Portal Access

Impact:
Unable to access applications via Portal Access.

Workaround:
None

---

1616629-1 : Memory leaks in SPVA allow list

Links to More Info: BT1616629

Component: Advanced Firewall Manager

Symptoms:
Adding and removing entries from an address list on a BIG-IP configured for hardware DoS may result in a memory leak.

Conditions:
-- BIG-IP HSB hardware and VELOS.
-- AFM provisioned
-- security dos profile with a whitelist

Impact:
Tmm memory usage may grow over time. Eventually this could cause a crash. Traffic disrupted while tmm restarts.

Workaround:
Avoid using a DoS whitelist, or periodically restart tmm.

---

1615081-1 : Remove SHA and AES Constraint Checks in SNMPv3

Links to More Info: BT1615081

Component: TMOS

Symptoms:
SNMPv3 user cannot be created with a combination of SHA-2 and AES.
The following errors are observed:

> 'SHA-256 + AES' returns "The AES privacy protocol keys cannot be shorter than 192 with SHA-2 auth protocol."
> 'SHA-512 + AES' returns "The AES privacy protocol keys cannot be shorter than 192 with SHA-2 auth protocol."
> 'SHA + AES-256' returns "SHA-2 auth protocol is required with longer AES keys."
> 'SHA + AES-192' returns "SHA-2 auth protocol is required with longer AES keys."

Conditions:
- Creating SNMPv3 user with combination of SHA-2 and AES.

Impact:
Unable to create SNMPv3 user with lower keys.

Workaround:
None

---

1612561-3 : The "Source Address" field on the Virtual Server configuration page does not accept IPv4-mapped IPv6 addresses

Links to More Info: BT1612561

Component: TMOS

Symptoms:
On the GUI Virtual Server configuration page, it's not possible to add an IPv4-mapped IPv6 address to the "Source Address" field ("Host" radio button selected).

When trying to add an IPv4-mapped IPv6 address, for example "0:0:0:0:0:ffff:ac1f:c179/128", the GUI throws this error:

"Error parsing IP address: 0:0:0:0:0:ffff:ac1f:c179/128"

Conditions:
On the GUI Virtual Server configuration page, add an IPv4-mapped IPv6 address with any of these possible syntaxes:

0:0:0:0:0:ffff:ac1f:c179/128
::ffff:192.168.0.128/128
::ffff:ac1f:c179/128

Impact:
The GUI throws an error and it's not possible to add the IPv4-mapped IPv6 address.

Workaround:
Add the IPv4-mapped IPv6 source address via tmsh:

# create ltm virtual test_ipv6_00637978 destination ::0.433 source ::ffff:ac1f:c179/128

---

1612201-1 : Malformed certificates found in local /config/httpd/conf/ssl.crt/server.crt

Links to More Info: BT1612201

Component: Global Traffic Manager (DNS)

Symptoms:
The gtm_add command fails with:

"ERROR: found "END CERT..." without BEGIN at line: 0.
ERROR: Malformed certificates found in local /config/httpd/conf/ssl.crt/server.crt."

Conditions:
A device certificate in PEM format contains a newline as CRLF:

-- Create device certificate where "-----BEGIN CERTIFICATE-----" is terminated with CRLF ('＼r＼n' 0x0D 0x0A) instead of LF ('＼n' 0x0A)
-- Perform the gtm_add.

Impact:
The gtm_add command fails with a malformed certificate error.

Workaround:
To mitigate use openssl x509 to convert CRLF to LF:

# cp /config/httpd/conf/ssl.crt/server.crt /config/httpd/conf/ssl.crt/server.crt-back
# openssl x509 -in /config/httpd/conf/ssl.crt/server.crt-back > /config/httpd/conf/ssl.crt/server.crt

---

1611109-1 : Trunk names exceeding 32 characters results in non-deterministic behavior

Links to More Info: BT1611109

Component: F5OS Messaging Agent

Symptoms:
The trunk in the tenant might be completely down which could affect virtual server, pool member, HA, etc.

Conditions:
Trunk names configured in F5OS exceed 32 characters.

Impact:
Communication disruption of any virtual, pool member, HA peer that relies on the trunk.

Workaround:
None

---

1606813-1 : Zone transfer fails for large zones when using TSIG key

Links to More Info: BT1606813

Component: Global Traffic Manager (DNS)

Symptoms:
-- Zone transfer fails when DNSSEC is enabled. Malformed records exist in traffic captures.
-- Error logs such as err zxfrd[4833]: 01531012:3: Transfer of zone <zone name> failed due to invalid TSIG were seen.

Conditions:
-- Larger zone with large number of records
-- DNSSEC and TSIG is enabled

Impact:
Zone transfer fails with DNSSEC enabled.

Workaround:
Zone transfer works fine if DNSSEC is not used on the Master DNSX server.

---

1604021-2 : Using CLI, the creation of urlcat-id TMSH command with values 28671 and 65536 must fail, but it is getting created.

Links to More Info: BT1604021

Component: Traffic Classification Engine

Symptoms:
The user defined URL category ID must be in a numeric range of 28672 to 32768. The GUI displays an error when the custom URL category ID is outside the range. But, the TMSH command accepts the full `uint16` range.

Conditions:
TMSH must display an error when it is outside the value range.

Impact:
It will overlap with the predefined data type category ID.

Workaround:
Configure the cusotm caterogy ID from the GUI.

---

1603605-1 : DNS response is malformed when the response message size reaches 2017 bytes

Links to More Info: BT1603605

Component: Global Traffic Manager (DNS)

Symptoms:
DNS response is malformed.

Conditions:
When the response message size reaches 2017 bytes.

Impact:
The formatting of the DNS response is incorrect.

Workaround:
None

---

1603541-1 : Platform_agent crashes

Links to More Info: BT1603541

Component: F5OS Messaging Agent

Symptoms:
Platform_agent is crashing continuously, and core files are found.

Conditions:
The Platform_agent crashes while running stability on the hardware.

Impact:
BIG-IP tenant communicates with the F5OS host for l2 configuration and receives packet states via platform_agent.
If services restart continuously, it may not configure l2, and states may be incorrect.

Workaround:
None

---

1603445-3 : Wccpd can have high CPU when transitioning from active to standby

Links to More Info: BT1603445

Component: TMOS

Symptoms:
Wccpd on a device can be seen taking a high amount of CPU.

Conditions:
This can happen on a box running wccpd with a connection to a router and the box is going from active to standby.

Impact:
High cpu usage reducing the box's performance.

Workaround:
Restart the wccpd daemon on the standby (where the high CPU is observed):
bigstart restart wccpd

---

1602641-4 : Configuring verified-accept and SSL mirroring on the same virtual results in stalled connections.

Links to More Info: BT1602641

Component: Local Traffic Manager

Symptoms:
If a virtual server has SSL mirroring and with verified-accept enabled, the set handshake timeout value will be delayed during the SSL handshake client connections. The standby unit will not copy the connection to the virtual server.

Conditions:
- Verified accept enabled
- SSL mirroring enables
- An HA pair

Impact:
- SSL connections delayed inside the SSL handshake
- SSL connections are not mirrored to the peer unit.

Workaround:
Disable mirroring or disable verified-accept.

---

1602629-3 : Tmm_mcpmsg_print can trigger SOD

Links to More Info: BT1602629

Component: Local Traffic Manager

Symptoms:
TMM is killed by SOD.

Conditions:
Conditions are unknown, it was encountered when ID 1047789 was encountered, see https://cdn.f5.com/product/bugtracker/ID1047789.html

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

---

1602345-1 : Resource records are not always created when wideips are created in a bundle

Links to More Info: BT1602345

Component: Global Traffic Manager (DNS)

Symptoms:
Resource records are not created for some of the created WideIPs.

Conditions:
WideIPs are created in a bundle.

Impact:
Resource records are missing.

Workaround:
Wait for more than a minute before creating another wideip;
Or
When resource records are found missing, delete the related wideips and also delete related db zone file for that wideip, then recreate the wideip.

---

1602209 : The bigipTrafficMgmt.conf file is not copied from UCS to /config/snmp★

Links to More Info: BT1602209

Component: TMOS

Symptoms:
After restoring a UCS file, or after an upgrade, the file /config/snmp/bigipTrafficMgmt.conf is not updated.

Conditions:
The /config/snmp/bigipTrafficMgmt.conf has been modified.

Impact:
If the file was modified, the modifications are lost on upgrade or UCS install. The file will need to be modified again and snmpd restarted, and restarted on all blades/slots.

Workaround:
Edit the bigipTrafficMgmt.conf by hand after the upgrade.

After the above config file has been modified and saved, the "snmpd" daemon must be restarted, using one of two command variants:

  (on a BIG-IP appliance or VE system)

  # bigstart restart snmpd

  (on a a multi-slot VIPRION or vCMP guest)

  # clsh bigstart restart snmpd

---

1601581-3 : Virtual-address settings are not restored properly when overlapping NAT policy with proxy-arp is removed.

Links to More Info: BT1601581

Component: Local Traffic Manager

Symptoms:
Consider a case where there exists a nat policy with proxy-arp enabled overlapping with a virtual-address. If a nat policy proxy-arp option is removed some settings on a virtual-address might not take effect (arp disabled/icmp disabled).

Conditions:
Example of affected configuration:

security nat policy policy1 {
    rules {
        rule_001 {
            destination {
                addresses {
                    0.0.0.0/0 { }
                }
proxy-arp enabled
            }

ltm virtual-address 0.0.0.0 {
    address any
    arp disabled
    icmp-echo disabled
    mask any
}

Impact:
Incorrect traffic handling.

Workaround:
After deleting proxy-arp option from nat policy, toggle one of settings of virtual-address.

---

1601517-2 : BD daemon crash on specific scenario

Links to More Info: BT1601517

Component: Application Security Manager

Symptoms:
With the ASM module licensed, provisioned and configured, the bd daemon may crash while processing incoming traffic.

Conditions:
Although a specific trigger has not been identified, this issue may occur when processing very large (several megabytes) JSON payloads.

Impact:
Traffic disrupted while bd restarts.

Workaround:
None

---

1600669-3 : Inconsistency in iRule parsing for iControl REST and tmsh/WebUI

Links to More Info: BT1600669

Component: TMOS

Symptoms:
After sending iRule content with POST via iControl REST - 400 error is returned similar to below:
{"code":400,"message":"can't parse TCL script beginning with＼n＼nproc someproc {}{＼n log local0. ＼"something＼"＼n}＼n } ＼n","errorStack":[],"apiError":26214401}%

Conditions:
iRule contains closing and opening curly brackets next to each other without a space e.g.:
proc someproc {}{

instead of
proc someproc {} {

Impact:
iRule is not added to BIG-IP and 400 error is returned

Workaround:
Add space between closing and opening curly brackets

---

1600617-3 : Few virtio driver configurations may result in excessive memory usage

Links to More Info: BT1600617

Component: TMOS

Symptoms:
Certain virtio driver configurations may result in excessive memory usage, which in some cases, leads to issues with forwarding traffic.

'tmctl page_stats' output can be examined on a newly launched system to verify if any of the TMMs except for TMM0 have their memory exhausted.

Conditions:
Virtio driver memory usage scales up with:
- Number of queues.
- Number of TMMs.
- Number of interfaces.
- Queue size.

Increasing these numbers might cause a problem trigger.

Impact:
Excessive memory usage, in some cases, leads to problems with traffic forwarding.

Workaround:
Scale down on the number of queues and their size. Reduce the number of interfaces.

---

1600333-3 : When using long VLAN names, ECMP routes with multiple nexthop addresses may fail to install

Links to More Info: BT1600333

Component: TMOS

Symptoms:
Route updates are dropped.

When enabling nsm debug, you might see message similar to:
2024/06/20 22:49:11 errors: NSM : addattr: buffer too small(missing: 4 bytes)
2024/06/20 22:49:11 errors: NSM : netlink_route: error at tmos_api.c:806

Conditions:
-- max-path set to a high value (64) in ZebOS
-- Long VLAN names are used

Impact:
Tmrouted never sees the NEWROUTE update.

Workaround:
- If 'max-paths ibgp 16' of higher is desired, then use smaller VLAN names
- If changing VLAN names is not desired, then use a lower value on 'max-paths ibgp X'

---

1600265-2 : Request_status is alerted in remote logging while local logging shows blocked

Links to More Info: BT1600265

Component: Application Security Manager

Symptoms:
"request_status" is "alerted" in remote logs for blocked requests.

Conditions:
Viewing remote logs for blocked requests

Impact:
"blocked" requests are misinterpreted as "alerted" in remote logs

Workaround:
None

---

1600229 : Sometimes, admin is unable to apply policies until failover

Links to More Info: BT1600229

Component: Access Policy Manager

Symptoms:
Applying an access policy appears to not work and appears as "yellow" even after clicking it multiple times.

Conditions:
OAuth client agent has "using-dynamic-server enabled" and configured to some session variable that can be populated from an iRule.

Impact:
-- apmd memory increases
-- apmd will be busy applying the huge configuration.
-- The access policy is not applied and always appears yellow in spite of clicking multiple times.

Workaround:
None

---

1600033 : Help text contains references to deprecated java tunnels

Links to More Info: BT1600033

Component: Access Policy Manager

Symptoms:
In BIG-IP configuration utility, when you navigate to Access -> Connectivity/VPN -> App Tunnels -> plus icon/ Create.

The help tab to the left contains references to create java tunnels, which is not supported in BIG-IP APM anymore.

Conditions:
When referring to online help while creating application tunnels.

Impact:
No impact.

Workaround:
None

---

1599841-2 : Partition access is not synced to Standby device after adding a remote user locally.

Links to More Info: BT1599841

Component: TMOS

Symptoms:
The local user created for the remote user does not have the same partition access for Standby device as it does for the Active device in the HA pair.

Conditions:
1) Log into the Active device as a remote user
2) Create a local user for this remote user (same name for the user)
3) Sync to the BIG-IP HA peer.

Impact:
The local user created has access only to the Active device and cannot login to the Standby one.

Workaround:
None

---

1599597-1 : BD start failure

Component: Local Traffic Manager

Symptoms:
BD repeatedly fails to start

Conditions:
- VE has 32 no htsplit cpu cores
- VE has license that restricts number of tmm to be 4
- ASM provisioned
- ASM policy is attached to virtual server

Impact:
BD fails to start and the system status is Offline

Workaround:
Change number of cpu cores of the VM to 28, 24, 20, 16, 12, 8 or 4.

---

1598405-1 : Intermittent TCP RST error 'HTTP internal error (bad state transition)' occurs for larger files when the Explicit Proxy virtual server uses HTTP_REQUEST_SEND iRule event

Links to More Info: BT1598405

Component: Local Traffic Manager

Symptoms:
BIG-IP sends a TCP RST with the error message ‘bad state transition’ when the HTTP_REQUEST_SEND iRule event is triggered after the completion of the TLS handshake and acknowledgement by BIG-IP from the server.

Conditions:
- BIG-IP1 is a proxy for clients
- BIG-IP2 is provisioned with LTM and APM, connects to the server
- BIG-IP2 has ACCESS::session iRule command in HTTP_REQUEST_SEND event

Impact:
Client-side traffic may get disrupted.

Workaround:
None

---

1598381-2 : Unable to set the key-usage setting while renewing the CSR

Links to More Info: BT1598381

Component: Local Traffic Manager

Symptoms:
While renewing the CSR, key-usage value is set to empty.

Conditions:
While renewing the CSR with key-usage.

Impact:
Unable to configure the key-usage when renewing the CSR.

Workaround:
As a workaround, delete the complete certificate from GUI and create it using the below commands on CLI

> tmsh create sys crypto key test100.com key-size 2048 key-type rsa-private
> tmsh create sys crypto csr test100.com common-name ＼"test100.com＼" key test100.com key-usage digitalSignature

Note: Here 'test100.com' is the certificate name.

---

1596493 : UCS load of VCMP guest fails on invalid Management Route

Links to More Info: BT1596493

Component: TMOS

Symptoms:
UCS archive load fails with an error:

slot1/guest9.local err mcpd[7207]: 01070734:3: Configuration error: invalid Management Route, the dest/netmask pair 0.0.0.0/0.0.0.0 already exists for /Common/default

Conditions:
-- vCMP guest
-- Default gateway is defined on the BIG-IP system prior to loading the UCS archive
-- The UCS archive has a different default management gateway in it
-- Load the UCS archive

Impact:
UCS fails to load, increasing the amount of time to bring up a restored VCMP guest.

Workaround:
Delete and recreate the default management route with the same name, then run 'tmsh load sys config'

---

1596481-2 : Staged signature IDs and name are not logged in remote logger for websocket traffic

Links to More Info: BT1596481

Component: Application Security Manager

Symptoms:
Staged signature IDs are not visible

Conditions:
Remote logger for websocket traffic is configured

Impact:
Lack of visibility of staged signatures, and difficult to monitor websocket traffic

Workaround:
With HTTP, staged signature details can be seen on the remote logger

---

1596313-1 : Deleting and re-adding a LAG on F5OS causes a validation failure in mcpd, therefore the trunk on the tenant has no interfaces

Links to More Info: BT1596313

Component: TMOS

Symptoms:
When creating an HA group with a trunk in an LTM tenant, after the first reboot an error is thrown.

“Invalid attempt to register an n-stage validator, the stage must be greater than the current stage, and within the range 1 to 101 inclusive, current stage : 7 registered: 5 Unexpected”

Conditions:
-- BIG-IP tenant running on F5OS
-- High availability system
-- HA group with a trunk
-- The tenant is rebooted for the first time

Impact:
No impact on tmm VLAN traffic

Workaround:
Run the 'tmsh create sys ha-group' command again.

---

1593341 : [PA]Submit button throwing an error "Illegal invocation" in application.

Links to More Info: BT1593341

Component: Access Policy Manager

Symptoms:
Noticed an error in the Developer Tools console
Uncaught TypeError: Illegal invocation

Conditions:
Configuration of portal access for an application with a popup window.

Impact:
Unable to access the application via portal access

Workaround:
Custom iRule is available to mitigate this issue.

================================================

when REWRITE_REQUEST_DONE {
    if { [HTTP::path] ends_with "//path to home page" } {
        REWRITE::post_process 1
        set rewrite_new 1
    }
}
 
when REWRITE_RESPONSE_DONE {
 
    if {[info exists rewrite_new]} {
        unset rewrite_new
 
        set rewrite_str {opener.dialogWin.win.close()}
 
        set rewrite_str_len [string length $rewrite_str]
 
        set strt [string first $rewrite_str [REWRITE::payload]]
        if {$strt > 0} {
            REWRITE::payload replace $strt 28 {opener.dialogWin.win = window; opener.dialogWin.win.close()}
        }
    }
}
================================================

---

1592485-1 : 'tcp-psh-flood' attack vector is deleted after upgrade to v17.1.3 and failed to load the configuration★

Links to More Info: BT1592485

Component: TMOS

Symptoms:
After an upgrade, the configuration fails to load on the following error:

Syntax Error:(/config/bigip.conf at line: 39107) "tcp-psh-flood" identifier does not match to any of the following: ext-hdr-too-large
or flood or hop-cnt-low or host-unreachable or icmp-frag or icmpv4-flood or icmpv6-flood or ip-frag-flood or ip-low-ttl or
ip-opt-frames or ipv6-ext-hdr-frames or ipv6-frag-flood or non-tcp-connection or opt-present-with-illegal-len or sweep or
tcp-ack-flood or tcp-bad-urg or tcp-flags-uncommon or tcp-half-open or tcp-opt-overruns-tcp-hdr or tcp-rst-flood or tcp-syn-flood or
tcp-syn-oversize or tcp-synack-flood or tcp-window-size or tidcmp or too-many-ext-hdrs or udp-flood or unk-tcp-opt-type

Conditions:
Enable tcp-psh-flood vector on profiles and upgrade to v17.1.1.3

Impact:
On v17.1.1.3 config is not loaded successfully

Workaround:
None

---

1591197-1 : Specific JSON enforcement is not working

Component: Application Security Manager

Symptoms:
An issue was detected with the JSON schema pattern attribute

Conditions:
When something is defined as a pattern in the JSON schema, it's enforcement can be bypassed on a specific scenario

Impact:
A missed JSON schema violation

Workaround:
None

---

1590689-2 : Loss of kernel routes occurs on 1NIC Virtual Edition when the DHCP lease expires.

Links to More Info: BT1590689

Component: TMOS

Symptoms:
In the single NIC, BIG-IP Virtual Edition is assigned an IP address by a DHCP server. When the DHCP lease expires and the BIG-IP is assigned a new IP address, some of the routes are removed from the kernel routing tables.

Conditions:
An issue occurs in the BIG-IP system with the below condition,
- Single NIC BIG-IP Virtual Edition
- IP address is assigned by a DHCP server
- The DHCP lease expires and the Virtual Edition is assigned a new IP address

Impact:
Some routes are removed from the kernel routing tables thus causing a potential loss of connectivity on the management network and on the data plane.

Workaround:
All the kernel routes can be reinstalled when you disable and re-enable the DHCP client using the,

tmsh modify sys global-settings mgmt-dhcp disabled
tmsh modify sys global-settings mgmt-dhcp enabled

---

1590517 : High CPU utilization when enabling IPS + HTTP/2 Profile

Links to More Info: BT1590517

Component: Protocol Inspection

Symptoms:
When running HTTP/2 requests with all IPS signatures and compliance checks enabled, 100% TMM CPU utilization peaks occur.

Conditions:
-- Virtual server with an IPS and HTTP2 profile
-- HTTP2 traffic

Impact:
HTTP/2 traffic slowdown occurs, which impacts performance.

Workaround:
To help optimize CPU utilization, enable only the necessary IPS signatures and compliance checks based on specific requirements, rather than activating all available options. While this targeted approach reduces the system’s processing load and maintains essential protections, it may not completely eliminate CPU usage spikes under high traffic or intensive processing demands.

---

1590085-1 : DoSL7D ICC errors are observed during higher throughput with DoS profile on Active-Active setup

Links to More Info: BT1590085

Component: Application Security Manager

Symptoms:
Occurrence of too many Intelligent Client Cache (ICC) errors during higher throughput on Active-Active setup.

Conditions:
- Active-Active BIG-IP setup
- DoS profile should be attached
- Higher throughput condition

Impact:
Failure of configuration sync between Active-Active BIG-IPs, due to ICC errors.

Workaround:
None

---

1589753-3 : [BGP] IPv6 routes not installed/pushed after graceful restart when IPv6 peer-groups are configured.

Links to More Info: BT1589753

Component: TMOS

Symptoms:
Some IPv6 routes are not installed/pushed after graceful restart when IPv6 peer-groups are configured.

Conditions:
- BGP configured with peer-group activated under IPv6 address-family.
- BGP graceful restart took place.

Impact:
Routes are missing on BIG-IP. Routes are not sent to IPv6 peers.

Workaround:
Do not use peer-groups under IPv6 address-family. Configure peers separately instead.

---

1589629-3 : An ICMPv6 Neighbor Solicitation sent to the last address on an IPv6 subnet is using the wrong Destination MAC address

Links to More Info: BT1589629

Component: Local Traffic Manager

Symptoms:
The destination MAC address of the ICMPv6 Neighbor Solicitation message is incorrect.

Conditions:
An IPv6 SelfIP address is used.

Impact:
No node on the network would respond to ICMPv6 Neighbor Solicitation messages.

Workaround:
None

---

1589421-2 : LTM Monitor not shown in Pool Member "Health Monitors" if Transparent attribute changes

Links to More Info: BT1589421

Component: TMOS

Symptoms:
If an LTM monitor is created with an alias address configured and assigned to a pool or pool member(s), then the monitor's "transparent" attribute is changed (either from enabled to disabled, or from disabled to enabled), the monitor no longer appears in the Local Traffic GUI in the "Health Monitors" list for an affected pool member.

Conditions:
This occurs when all of the following conditions are true:
-- An LTM health monitor is configured with an Alias Address and/or Port (Destination field in TMSH)
-- The monitor is assigned to an LTM pool and/or pool member(s)
-- The monitor's Alias Address and/or Port are different from the address of the assigned pool member
-- After the monitor is assigned to the LTM pool and/or pool member(s), its "transparent" attribute is changed (either from enabled to disabled, or from disabled to enabled)
-- The list of Health Monitors assigned to a given pool member is viewed in the BIG-IP LTM GUI
(Local Traffic --> Pools : Pool List --> select pool --> Members --> select member)

Impact:
The assignment of the monitor to the pool member is not immediately visible in the BIG-IP LTM GUI in the "Health Monitors" list for the affected pool member(s).

When viewing the properties of the pool member in the Local Traffic GUI, if the "Advanced" Configuration view is selected, the Health Monitors assigned to the pool member can be viewed. If the "Inherit from Pool" option is configured, the Health Monitors assigned to the pool can be viewed under the Properties tab for the pool.

Workaround:
When viewing the properties of the pool member in the BIG-IP LTM GUI, if the "Advanced" Configuration view is selected, the Health Monitors assigned to the pool member can be viewed. If the "Inherit from Pool" option is configured, the Health Monitors assigned to the pool can be viewed under the Properties tab for the pool.

---

1589269-2 : The maximum value of sys db provision.extramb was reduced from 8192 to 4096 MB★

Links to More Info: BT1589269

Component: SSL Orchestrator

Symptoms:
From version 16.1.0 the maximum value of sys db provision.extramb is 4096 MB, reduced from 8192 MB. It will be automatically set to 4096 during the upgrade if it has a higher setting.

Conditions:
Any BIG-IP device running software version 16.1.0 or higher.

Impact:
It is extremely rare to need values of provision.extramb above 4096 MB.

No impact on upgrade if value of sys db provision.extramb is 4096 or less. After the upgrade, it is not possible to increase the value above 4096.

If greater than 4096 the value will be reduced to 4096 when upgrading to version 16.1.0 or higher. This may leave device with insufficient 4KB page memory (also known as host memory) which may lead to issues due to memory pressure such as oom killer killing processes, poor scheduling of processes which may cause core dumps, and sluggish management access.

Workaround:
None

---

1589213-2 : Content signatures are triggered for FileUploads even though check attack signature is disabled

Links to More Info: BT1589213

Component: Application Security Manager

Symptoms:
Having FileUpload parameters and disabling the "Check for attack signatures" results in content and paramcontent signatures violations.

Conditions:
- Create parameters with a FileUpload option
- Disable Check attack signature.

Impact:
Requests are blocked

Workaround:
None

---

1586877-1 : Behavior difference in auto-full sync virtual server and manual-incremental config sync

Links to More Info: BT1586877

Component: Application Security Manager

Symptoms:
An ASM policy is assigned to a virtual server with the same name in a Sync-Only device group in Auto-Sync mode.

Conditions:
Devices with same virtual server name in a Sync-Only device group.

Impact:
The ASM policy is synced, which is unexpected behavior.

Workaround:
None

---

1586745-1 : LACP trunk status became DOWN due to bcm56xxd failure

Links to More Info: BT1586745

Component: TMOS

Symptoms:
Lacp, lldp reports trunk(s) down and you may observe the below logs.

err lldpd[7489]: 01570004:3: HAL send PDU failed
err lldpd[7489]: 01290003:3: HalmsgTerminalImpl_::sendMessage() Unable to send to any BCM56XXD address
err lldpd[7489]: 01570004:3: HAL send PDU request failed
info bcm56xxd[10383]: 012c0016:6: TableDmaTimeOut: ING_SERVICE_COUNTER_TABLE_X.ipipe0 interrupt timeout
err lacpd[10571]: 01290003:3: HalmsgTerminalImpl_::sendMessage() Unable to send to any BCM56XXD address
err lacpd[10571]: 01160005:3: HalMsgHandler.cpp:125 - HAL send PDU request failed
info bcm56xxd[10383]: 012c0016:6: TableDmaTimeOut:_soc_xgs3_mem_dma, Abort Failed
info bcm56xxd[10383]: 012c0016:6: TableDmaTimeOut: FP_COUNTER_TABLE_X.ipipe0 interrupt timeout
info bcm56xxd[10383]: 012c0016:6: TableDmaTimeOut:_soc_xgs3_mem_dma, Abort Failed
info bcm56xxd[10383]: 012c0016:6: TableDmaTimeOut: EFP_COUNTER_TABLE_X.epipe0 interrupt timeout
info bcm56xxd[10383]: 012c0016:6: TableDmaTimeOut:_soc_xgs3_mem_dma, Abort Failed

Conditions:
Not known at this time.

Impact:
An outage was observed

Workaround:
Restart bcm56xxd, lldpd, lacpd process.

---

1586717-2 : [F5OS Changes] vlan members fails to populate inside the tenant if vlans attached to interface before deploying the tenant w/ feature from SYSEB-528

Links to More Info: BT1586717

Component: F5OS Messaging Agent

Symptoms:
You can tag the same VLAN to multiple interfaces on r2K/r4K platforms, but when you attach VLANs to interfaces before deploying the tenant, the VLAN members will not be populated in the tenant.

On BIG-IP, running 'tmsh list net vlan' will not show any tagged VLANs from F5OS.

Conditions:
-- rSeries r2K/r4K series platforms
-- Tagged VLAN spanning multiple interfaces
-- VLANs attached to the interfaces before deploying a BIG-IP tenant

Impact:
The BIG-IP tenant will not show the expected VLANs.

Workaround:
In F5OS, remove and re-attach the vlans to the interfaces.

Example:
appliance-1(config)# no interfaces interface 1.0 ethernet switched-vlan config
appliance-1(config)# no interfaces interface 7.0 ethernet switched-vlan config
appliance-1(config)# commit
Commit complete.
appliance-1(config)# interfaces interface 1.0 ethernet switched-vlan config trunk-vlans [ 1001 3006 ]
appliance-1(config-interface-1.0)# interfaces interface 7.0 ethernet switched-vlan config trunk-vlans [ 1001 3006 ]
appliance-1(config-interface-8.0)# commit
Commit complete.
appliance-1(config-interface-8.0)#

---

1586405-2 : "/f5-h-$$/" repeatedly appened to URL's path every refresh of the page

Links to More Info: BT1586405

Component: Access Policy Manager

Symptoms:
Observe multiple "/f5-h-$$/" in URLs when accessing via Protected Access.

Conditions:
"<base href="xxxxx">" tag in the home page.

Impact:
URLs become lengthy upon every refresh and may lead to webapp misfunction.

Workaround:
Customized iRule

======================
when REWRITE_REQUEST_DONE {

    if { [HTTP::path] ends_with "path_to_file1" } {
        REWRITE::post_process 1
        set rewrite_new 1
        
    }
    if { [HTTP::path] ends_with "path_to_file2" } {
        REWRITE::post_process 1
        set rewrite_new1 1
        
    }
    
}

when REWRITE_RESPONSE_DONE {

    if {[info exists rewrite_new]} {
        unset rewrite_new
    
        set rewrite_str {<base href=""f5-h-$$path_in_file1"">}
        set rewrite_str_len [string length $rewrite_str]
        set strt [string first $rewrite_str [REWRITE::payload]]
        
        if {$strt > 0} {
            REWRITE::payload replace $strt $rewrite_str_len {<base href="/f5-w-6578616d706c652e636f6d//path_in_file1">}
        }
    }
    
    if {[info exists rewrite_new1]} {
        unset rewrite_new1
    
        set rewrite_str {<base href="f5-h-$$/path_in_file2">}
        set rewrite_str_len [string length $rewrite_str]
        set strt [string first $rewrite_str [REWRITE::payload]]
        
        if {$strt > 0} {
            REWRITE::payload replace $strt $rewrite_str_len {<base href="/f5-w-6578616d706c652e636f6d//path_in_file2">}
        }
    }
}
======================

---

1585153-2 : SSL handshake failures with error message Profile <name> cannot load key/cert/chain

Links to More Info: BT1585153

Component: Local Traffic Manager

Symptoms:
If the BIG-IP configuration has CA bundle manager with auto-sync enabled, it can lead to error
Profile /Common/CAbundle - /config/filestore/files_d/Common_d/certificate_d/:Common:cert2_46889_1 reading: Unknown error.

Conditions:
-- The CA bundle is being modified/updated.
-- An automatic config sync occurs

Impact:
SSL connection are failing for the given virtual server associated with the ssl profile.

Workaround:
If possible, disable auto-sync to avoid the issue.
Otherwise, when the problem happens:
-- Detach the client/server ssl profile from the virtual server, which has association with this file
-- Attach the client/server ssl profile to virtual server again after the file is available

Another workaround is:
Try to open the virtual server in the GUI and update it again with/without any minor change after file is available

---

1584297 : PEM fastl4 offload with fastl4 leaks memory

Links to More Info: BT1584297

Component: Policy Enforcement Manager

Symptoms:
A tmm memory leak occurs while passing PEM traffic. The tmctl memory_usage_stat command shows pem_hud_cb_data memory is high.

Conditions:
-- A PEM profile with fast-pem enabled
-- The PEM profile is assigned to a Fast L4 virtual server

Impact:
A memory leak occurs. This could cause tmm to crash. Traffic disrupted while tmm restarts.

Workaround:
Either of these workarounds will be effective.
-- Do not use Fast L4 offload for Fast L4 PEM virtual servers
-- Do not use Fast L4 for the PEM virtual if fast-pem is enabled

---

1583701-1 : Access Policy Export does not write OCSP profile correctly to ng_export.conf

Component: Access Policy Manager

Symptoms:
After exporting an Access Policy, further import shows such error:
Import error: 0107134a:3: File object by name (Common/Cert_Name_Example.crt) is missing. Unexpected Error: Loading configuration process failed.)

Conditions:
- OCSP profile configured with "Verify Other"
- OCSP Auth agent configured with such OCSP responder in an Access Policy

Impact:
Unable to export/import Access policy

Workaround:
On the BIG-IP system where the export is made:
- Edit OCSP responder AAA profile
- Under advanced, remove the certificate from "Verify Other" entry and then click Finished
- Apply Access Policy
- Export Access Policy

on the BIG-IP system where the import is made:
- Import the previously exported Access Policy
- Edit OCSP responder which should now be available
- Under advanced, select relevant certificate in "Verify Other" entry and then click Finished

---

1581685-1 : iRule 'members' command counts FQDN pool members.

Links to More Info: BT1581685

Component: Local Traffic Manager

Symptoms:
iRule 'members' command counts and lists FQDN pool members.

Conditions:
- create a pool with at least one FQDN member.
- use the members function in an iRule.

Impact:
iRule with members command will not give the desired result.

Workaround:
When FQDN pool members are present, using the 'members' command in the iRule will not yield the desired result.

---

1581653-1 : Unbounded GENERICMESSAGE queue growth

Links to More Info: BT1581653

Component: Service Provider

Symptoms:
TMM memory grows while passing traffic.

Conditions:
The GENERICMESSAGE::message iRule event is used with the no_response parameter set to 'no'.

If requests messages are sent and a response message does not occur, the request messages are added to the cur_pending_requests. It keeps growing without any control.

Impact:
Cur_pending_requests under profile_genericmsg_stat keeps growing. "filter" memory keeps growing.

Workaround:
None

---

1580369-1 : MCPD thrown exception when syncing from active device to standby device.

Links to More Info: BT1580369

Component: TMOS

Symptoms:
Config sync fails on the secondary blade and MCPD restarts.

In /var/log/ltm:

err mcpd[7906]: 0107134b:3: (rsync: link_stat "/config/filestore/.snapshots_d/custom_urldb_d/:Common:custom_feedlist_348871_3751" (in csync) failed: No such file or directory (2) ) errno(0) errstr().

err mcpd[7906]: 0107134b:3: (rsync error: some files/attrs were not transferred (see previous errors) (code 23) at main.c(1518) [Receiver=3.0.9] ) errno(0) errstr().

err mcpd[7906]: 0107134b:3: (syncer /usr/bin/rsync failed! (5888) () Couldn't rsync files for mcpd. ) errno(0) errstr().

err mcpd[7906]: 0107134b:3: (rsync process failed.) errno(255) errstr().

err mcpd[7906]: 01070712:3: Caught configuration exception (0), Failed to sync files..

Conditions:
- A BIG-IP system with multiple blades and multiple slots configured for high availability
- Active device has to download the custom_urldb file from a server
- A config sync occurs

Impact:
Config sync to the secondary blade fails and MCPD throws an exception and restarts on the secondary. The cluster primary blade has the correct custom_urldb file. This will impact incremental syncing to other peers in the device group.

Workaround:
None

---

1579805-1 : GTM load balancing decision logs contain truncated pool member details.

Links to More Info: BT1579805

Component: Global Traffic Manager (DNS)

Symptoms:
The load balancing decision logs for GTM contains truncated pool member details.

Conditions:
Enable 'load-balancing-decision-log-verbosity { pool-selection pool-traversal pool-member-selection pool-member-traversal }' at the WIDEIP level to view detailed pool member information in the logs, which are currently truncated.

Impact:
Minimal impact; logs lack comprehensive details.

Workaround:
None

---

1579637-3 : Incorrect statistics for LTM. Rewrite profile with rewrite_uri_translation mode

Links to More Info: BT1579637

Component: TMOS

Symptoms:
Statistics for a rewrite profile are zeroes when using it in LTM with rewrite-uri-translation mode

Conditions:
LTM usecase with "Rewrite Profile".
Configure rewrite-uri-translation for "Rewrite Profile".

Impact:
URI translation is working but there are no statistics.
All statistics are set to zero on "tmctl profile_rewrite_stat -w 240"

Workaround:
None

---

1579525 : TMM crash when memcached querying samlcryptodata

Links to More Info: BT1579525

Component: Access Policy Manager

Symptoms:
Observed a TMM crash

Conditions:
Conditions are unknown, this was only seen once.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

---

1578637-1 : TMM may drop MRF messages after a failover.

Links to More Info: BT1578637

Component: Service Provider

Symptoms:
If the Standby unit of an HA pair configured for MRF mirroring drops a message, the TCP state will be out of sync between the two units and possibly cause the Standby to fail to pass traffic when it goes Active.

Conditions:
BIG-IP configured with HA mirroring and MRF

profile_diameterrouter_stat.common.tot_messages_standby_dropped has incremented on the affected profile

A failover occurs

Impact:
After a failover, TMM will ACK incoming MRF messages and not forward them to the peer.

Workaround:
Delete the affected connflow.

Ensure that messages are not dropped on the standby by any or all of the following:

- Increase the mirrored-message-sweeper-interval:

modify ltm message-routing diameter profile router <name> mirrored-message-sweeper-interval 1000 -> 5000

- Ensure that the HA connection does not have excessive latency or packet loss. The "Buffered" stat in the ha-mirror statistics table should be low. See K54622241 for details.

- Ensure that the Maximum Pending Messages setting in the Diameter router profile is high enough to handle the message load.

---

1578597-2 : Religion URL Categories not found on SWG database download

Links to More Info: BT1578597

Component: Access Policy Manager

Symptoms:
Error messages in /var/log/apm

"The requested URL Category (/Common/Lesser-Known_Religions) was not found."
"The requested URL Category (/Common/Widely-Known_Religions) was not found."

Conditions:
APM provisions and SWG database downloads enabled.

Impact:
Religion URLs do not get get categorized properly from the SWG database

Workaround:
None

---

1577161-1 : BIG-IP tries to resume SSL sessions when session ID only matches partially

Links to More Info: BT1577161

Component: Local Traffic Manager

Symptoms:
After receiving the SSL session ID which partially matches a session ID in the cache VIP with the client SSL profile attempts to resume the session. For example - there is an existing Session ID:

session_id[32]=
28 67 9b 30 dc 8a 6e f4 d1 ef 80 f9 04 93 d6 3d
fb 2e ea b5 ac c2 be f1 6b e7 42 ef 54 a3 a6 cd

When a client sends Client Hello with

resume [32]=
12 11 11 12 12 12 12 12 11 11 80 f9 04 93 d6 3d
fb 2e ea b5 ac c2 be f1 6b e7 42 ef 54 a3 a6 cd

BIG-IP resumes the session.

Conditions:
- Create VIP with client SSL profile.
- Create a new TLS session (for example with 'openssl s_client')
- Try to reuse the existing session with some of the bytes of the session ID altered.

Impact:
The BIG-IP sends a ServerHello with a different Session ID from the one in the ClientHello and then attempts to resume a TLS session.

Workaround:
None

---

1576565-3 : Expect header is not forwarded to pool when PingAccess profile is applied to VS

Links to More Info: BT1576565

Component: Access Policy Manager

Symptoms:
When a PingAccess profile is added to a virtual HTTP, expect headers from clients are not forwarded to the HTTP server even though headers exist.

Conditions:
Basic PingAccess setup
Attach the ping pool to the PingAccess profile
PingAccess profile added to a virtual server

Restart the PingAccess plugin (it will cache lookups and the Expect header is only dropped for cache misses)

Bigstart restart ping_access_agent

Send an HTTP request with an Expect header, e.g.

curl --location --request POST https://10.10.10.88/ -H "Expect: 100-continue" -H "Foo: bar" -vk

Impact:
Since no HTTP 100 is received by the client, it causes connection retries and eventually times out not able to send requests further.

---

1574521-1 : Intermittent high packet latency on R4000 and R2000 tenants

Links to More Info: BT1574521

Component: Performance

Symptoms:
When compared to previous platforms, BIG-IP tenants on R4000 and R2000 platforms may demonstrate higher jitter and packet latency / rtt. This affects pings, tcp, udp, and any other protocols processed by the software data plane (tmm).

This is because the r4000 and r2000 appliances have a slightly different hardware architecture than other appliances.

CPUs on this platform are not dedicated to the tenant and these platforms also run a different class of Intel processing, and do not utilize hyperthreading like the higher end platforms do.

See:
https://clouddocs.f5.com/training/community/rseries-training/html/rseries_performance_and_sizing.html#r4000-vcpu-sizing

Conditions:
BIG-IP tenants on R4000 and R2000 platforms

Impact:
Intermittent high latency and jitter.

Workaround:
None

---

1573601-4 : MCP query for fw_rule_stat takes ~23s to complete

Links to More Info: BT1573601

Component: Advanced Firewall Manager

Symptoms:
- On average mcpd takes more time to process large firewall rule stats ~20k, but sometimes it takes even longer.
- MCPD abruptly removes the LACPD connection causing LACPD to restart.
- Multiple MPCD query response exceeding messages and then lead to bcm core.
Ex: 010e0004:4: MCPD query response exceeding 60 seconds

Conditions:
More(~20k) firewall rules configured along with pccd.overlap.check enabled.

Impact:
MCPD response is slow for fw_rule_stat query and some protocols[LACPD] restarts abruptly and lead to bcm core.

Workaround:
Disable db pccd.overlap.check

---

1572577 : Certain user roles cannot modify the Address Lists in Shared Objects in normal flow

Component: TMOS

Symptoms:
Certain user roles cannot modify the address list under Shared Objects -> Address List

Conditions:
Users with a role belonging to any one of the following
Application Security Administrator
Application Security Editor
Application Security Operations Administrator

Impact:
Not following best practices

Workaround:
If the user account belongs to one of the affected roles, use the below URL to modify the address
https://<BIG_IP>/tmui/Control/jspmap/tmui/security/firewall/address_list/list.jsp

---

1572545-3 : Upgrade from version 14.X to version 15.X may encounter problems with L2 forwarding for some of the flows.★

Links to More Info: BT1572545

Component: Local Traffic Manager

Symptoms:
L2 forwarding issues may be encountered for some flows. Due to this, there can be hinderances in the traffic flow towards server.

Conditions:
Flow 1:
Client(L3 Net1)--- (vg2)--> BIG-IP --(vg1)--> Gateway --(vg1)--> BIG-IP (again) --(vg2)--> server(L3 Net2)

1. Client and server are in same vlan but not in same subnet.
2. Gateway is in another vlan, it is the gateway for both client and server.
3. connection.vlankeyed is disabled.
4. After an upgrade from 14.X to 15.X, traffic returning from gateway towards the server is dropped


Flow 2:

Client --(VG1)--> BIG-IP --(nonVgVlan1)--> IPS --(nonVgVlan2)--> BIG-IP (again) --(VG2)--> Server

1. Client traffic over transparent vlan-group towards Server is intercepted by a standard virtual server and sent to IPS on a non-vlan-group vlan.
2. connection.vgl2transparent is enabled
3. When traffic is sent from BIG-IP to IPS, the destination MAC will be the MAC address of a server (ARL non local) and the source MAC is still the original client MAC which is breaking the returning traffic from IPS.
4. The expectation here is traffic leaving from BIG-IP to IPS should have BIG-IP nonVgVlan1 MAC address as source MAC.

Impact:
Traffic drop is observed when packets are sent towards server.

Workaround:
For this workaround, ensure "nw_l2_transparent license enabled".

1. For Flow 1, keep connection.vgl2transparent disabled and add the following config:

    ltm virtual VG_transparent {
        destination <SERVER>
        ip-protocol tcp
        l2-forward
        mask 255.255.255.255
        profiles {
            fastL4 { }
        }
        rules {
            t-nexthop
        }
        source 0.0.0.0/0
        translate-address enabled
        translate-port enabled
        vlans {
            vg2
        }
        vlans-enabled
    }

    ltm rule t-nexthop {
    when CLIENT_ACCEPTED {
    nexthop vg1 transparent
    }
    when SERVER_CONNECTED {
    nexthop vg2 transparent
    }
    }

2. For Flow 2, keep connection.vgl2transparent disabled.

---

1571817-1 : FQDN ephemeral pool member user-down state is not synced to the peer device

Links to More Info: BT1571817

Component: TMOS

Symptoms:
One or more FQDN ephemeral pool members on a device group member is showing an incorrect state for the pool member.

Conditions:
1. Create the FQDN pool with an FQDN template pool member and ensure that the state of any ephemeral pool member associated with the FQDN template pool member is 'up'.
2. On one member of the device group, modify the state of the FQDN template pool member to 'user-down'.
3. Synchronize the configuration to the device group.
4. Check the status of the pool on the same member of the HA pair and verify that the state of any ephemeral pool member associated with the FQDN template pool member is 'user-down'.
5. On the other member of the device group, the state of any ephemeral pool member associated with the FQDN template pool member is 'up'.

Impact:
The state of the ephemeral pool members on one member of the device group is incorrect.

Workaround:
None

---

1567013-1 : Pool member stats are not reported for 2 of 10 pool-members in MRF diameter pool

Links to More Info: BT1567013

Component: Local Traffic Manager

Symptoms:
A problem is noticed when previous connections to the pool member exist and a new pool member is added with the same IP address and port.

Due to this, the pool member (same IP and port) has no connections associated with it. If new connections are made to the new pool member, the stats will be non-zero

Conditions:
Pool members with long-lived connections are deleted after re-creating the pool member. Now the new pool member does not have any connections, so its stats will be zero until a new connection is made

Impact:
But the reason you are seeing empty stats is that the new pool member (same IP and port) has no connections associated with it. When new connections are made to the new pool member, the stats will be non-zero

Workaround:
If you do not want to lose the stats, it is recommended to avoid deleting pool members with outstanding connection(s) and consider disabling them instead.

---

1566893-1 : Configuration fails to load while upgrading from BIG-IP 14.0.x to BIG-IP 15.1.x or later★

Links to More Info: BT1566893

Component: Access Policy Manager

Symptoms:
A few category names and descriptions have been updated from Forcepoint, and incorporating those changes in BIG-IP 15.1.10 triggered this upgrade failure.

Conditions:
Upgrade from the BIG-IP version where the latest category names were not present to the version where they exist with some additional configuration will fail the BIG-IP upgrade.

Impact:
After the upgrade, the configuration fails to load with one or more "In url-filter" errors.

Following is an example:

01070734:3: Configuration error: In url-filter {}...

Workaround:
No workaround. Remove the affected category names before attempting the BIG-IP upgrade.

---

1562833-1 : Qkview truncates log files without notification

Links to More Info: BT1562833

Component: TMOS

Symptoms:
When generating a qkview on a BIG-IP system via the GUI or command line:
-- Log files included in the qkview will be truncated if they exceed the maximum log file size.
-- Log file truncation occurs even with the "-s 0" command line option or "Unlimited snaplen" GUI checkbox, if the log file exceeds 100MB in size.
-- No user-visible notification is provided that log file truncation has occurred.

The "Unlimited snaplen" GUI checkbox does not actually remove the maximum log file size limit of 100MB. Selecting the "Unlimited snaplen" GUI checkbox limits the maximum log file size to 100MB. Log files larger than 100MB will still be truncated, even if the "Unlimited snaplen" checkbox is selected when generating a Support Snapshot from the GUI.

Conditions:
Log file truncation occurs if:

-- The log file exceeds 5MB in size and:
  -- The qkview utility is launched from the command line without the "-s" option to specify a larger maximum file size, or a Support Snapshot is request from the GUI without selecting the "Unlimited snaplen" checkbox.

-- The log file exceeds 100MB in size and:
  -- The qkview utility is launched from the command line with the "-s 0" option to specify a 100MB maximum file size, or a Support Snapshot is request from the GUI without selecting the "Unlimited snaplen" checkbox.

-- The log file exceeds the maximum file size specified by the "-s" option when running the qkview utility from the command line.

Impact:
Log files included in qkviews may be truncated unexpectedly without the user being aware.
If additional actions are not taken to create untruncated archives of affected log files, data required to diagnose BIG-IP issues may be permanently lost due to incomplete data in the qkview, and subsequent log rotation on the affected BIG-IP system.

Workaround:
To check whether a qkview file contains truncated log files, use the "tar" utility at a command line to check for files with "_truncated" appended to the file name.

For example:
tar -tf /var/tmp/my-test-qkview.qkview | grep truncated
var/log/DBDaemon-0.log_truncated

If the qkview file contains truncated log files, manually create a log file archive containing untruncated versions of the affected log files.

---

1562669 : [APM]Access Policy Export does not write certificate authority profile correctly to ng_export.conf

Component: Access Policy Manager

Symptoms:
When a machine cert check agent is used in an access policy and references a certificate authority profile, policy export does not create the object properly in the ng_export.conf file. This causes the subsequent import to fail.

1. Export policy from 17.1.1
2. Attempt to import into another APM on 17.1.1
3. In the GUI it refreshes, but never imports.
4. Import command fails with this error:

21:12:06 0 error: 01020036:3: The requested profile_certificateauthority (/Common/my-ca) was not found.

Unexpected Error: Loading configuration process failed.

Conditions:
Importing a policy from one APM system into another APM system.

Impact:
Can not import the access policy into a different APM.

Workaround:
Modify the ng_export.conf file to add @name- in the certificate-authority profile object:

ltm profile certificate-authority /@partition/@name-my-ca {

---

1560853-1 : [GUI] error while updating the rewrite profile uri-rules name have both leading and trailing "/"

Links to More Info: BT1560853

Component: TMOS

Symptoms:
Error when updating rewrite profile.

Conditions:
Uri-rules name has both leading and trailing "/".

Impact:
Uri-rules for rewrite profile is not able to be updated through GUI.

Workaround:
Remove either leading or trailing "/" from uri-rules name.

---

1560449-1 : Rest_logintegrity does not suppress output to stderr

Links to More Info: BT1560449

Component: TMOS

Symptoms:
The find command in rest_logintegrity script fails and returns "No such file or directory" when no matching file is found if there are no newly rotated restnoded, restjavad log files whenever the rest_logintegrity script runs as part of the cron job.

Conditions:
When there are no files which matches the below patterns in the script:
"/var/log/restjavad.[1-9]*.log", "/var/log/restnoded/restnoded[1-9]*.log".

Impact:
Overload of emails with message similar to:

find: '/var/log/restnoded/restnoded[1-9]*.log': No such file or directory

Workaround:
Creating the files as below mitigates the error

touch /var/log/restnoded/restnoded1.log
touch /var/log/restjavad.1.log

---

1558869-1 : Tmsh generated config file which fails to load for VLAN specific non-default route-domain IPv6

Links to More Info: BT1558869

Component: Local Traffic Manager

Symptoms:
The configuration fails to load with an error:

Syntax Error:(/config/bigip_base.conf at line: 138) "fe80::1%vlan333%1/64" invalid address

Conditions:
Tmsh is used to create a non-default route-domain IPv6 for a VLAN, for example:

# tmsh create net self fe80:14d::1%1/64 vlan test

Impact:
The configuration fails to load.

Workaround:
None

---

1558857-2 : Pool command support functionality to be implemented in WS_REQUEST event

Links to More Info: BT1558857

Component: Local Traffic Manager

Symptoms:
We can create the following iRule in BIG-IP with the pool command. However, the iRule does not work as expected.

when WS_REQUEST {
log local0. "using myHttpOss2"
pool myHttpOss2
}

Conditions:
Create an iRule with a WS_REQUEST event and include pool command in it.

Impact:
It limits the user functionality, and they cannot write the irules according to their need.

Workaround:
Whatever is supported in HTTP_REQUEST should be supportable in WS_REQUEST also. Even though we cannot use the pool command in WS_REQUEST, the purpose can be achieved using the HTTP_REQUEST event.

---

1556845-1 : Tmm crash after modifying a virtual server

Links to More Info: BT1556845

Component: Traffic Classification Engine

Symptoms:
Tmm crashes after making changes to a virtual server

Conditions:
An iRule attempting to access classification results combined with GPA (generic protocol analyser) used for classification.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

---

1555437-1 : QUIC virtual server with drop in CLIENT_ACCEPTED crashes TMM

Links to More Info: BT1555437

Component: Local Traffic Manager

Symptoms:
TMM crashes on connection if the drop is executed in an iRule on CLIENT_ACCEPTED event.

Conditions:
If an iRule contains a drop that is executed on CLIENT_ACCEPTED or CLIENT_DATA on a virtual server supporting HTTP3 (QUIC/UDP) then TMM crashes.

Impact:
Traffic is disrupted while restarting TMM.

Workaround:
In iRule use FLOW_INIT as the event instead of CLIENT_ACCEPTED to call drop.

---

1554961 : APM - Websso leeway time of 60 seconds

Links to More Info: BT1554961

Component: Access Policy Manager

Symptoms:
When JWT is cached, then the error "JWT Expired and cannot be used" is observed.

Conditions:
WebSSO is used with bearer option to generate JWT tokens.

Impact:
JWT fails in upper layer

Workaround:
None

---

1553169-1 : Parsing tcp payload using iRules can be inaccurate because of binary to string conversion

Links to More Info: BT1553169

Component: Local Traffic Manager

Symptoms:
When an iRule is used to parse tcp payload, the value returned as string can be inaccurate.

Conditions:
TCP payload is parsed using iRule.

Impact:
The iRule functionality may not work as expected, as the parsed data can be inaccurate.

Workaround:
None

---

1552517-1 : When F5OS tenants are part of a GTM sync group, rebooting one device may cause monitor flapping on the other

Links to More Info: BT1552517

Component: TMOS

Symptoms:
When an F5OS tenant is part of a GTM sync group and it is rebooted, other members of the sync group may experience flapping monitors.

Conditions:
-- F5OS Tenants
-- GTM provisioned
-- Prober pools configured

Impact:
Flapping GTM monitors when one device is rebooted.

Workaround:
Configure gtmd and big3d to wait until tmm is ready before starting

cp /etc/bigstart/scripts/big3d /etc/bigstart/scripts/big3d.1552517
cp /etc/bigstart/scripts/gtmd /etc/bigstart/scripts/gtmd.1552517


sed -i 's/tmm running/tmm ready/' /etc/bigstart/scripts/gtmd /etc/bigstart/scripts/big3d

---

1550933-1 : Gtm virtual server query_all related SNMP query could get wrong result

Links to More Info: BT1550933

Component: TMOS

Symptoms:
Gtm virtual server query_all related SNMP query could get wrong result such as gtmVsNumber with log message such as:
Duplicate oid index found: bigip_gtm_vs.c:184

Conditions:
Similar gtm server and virtual server name combination

Impact:
SNMP query returns wrong results.

Workaround:
Use less similar virtual server names. If the virtual server name is long, ensure the string is different at the beginning of the virtual server name.

---

1549661-1 : Logs sent to syslog-ng on VIPRION devices utilize truncated hostname instead of FQDN

Links to More Info: BT1549661

Component: TMOS

Symptoms:
Log messages sent to syslog-ng process, most commonly within /var/log/messages with a message such as the following:

slot1/bigip1 notice syslog-ng[2357]: Configuration reload request received, reloading configuration;

Conditions:
-- VIPRION device (either multi-bladed or single-slot) being utilized
-- Hostname contains a period and the log truncates it at the first period.

Impact:
The syslog-ng log messages on VIPRION devices contain truncated hostnames instead of using the complete FQDN.

Workaround:
None

---

1549397-1 : Pool member from statically-configured node deleted along with ephemeral pool member using same IP address

Links to More Info: BT1549397

Component: Local Traffic Manager

Symptoms:
If an LTM pool is created containing both FQDN and statically-configured pool members using different port numbers, and the FQDN name resolves to the same IP address as the statically-configured node, if the FQDN name no longer resolves to that IP address, the statically-configured pool member may be deleted along with the ephemeral pool member with the same IP address.

In this configuration, the pool in question may be found to contain:
-- a statically-configured (not ephemeral) pool member referencing the statically-configured node
-- an ephemeral pool member with the same node name and IP address as the statically-configured node

Both pool members have the same node name and IP address, since only one node can exist for a given IP address. This prevents a separate ephemeral node from being created with the same IP address as the statically-configured node, forcing both pool members to reference the same statically-configured node with the given IP address.

Conditions:
-- The LTM pool contains both FQDN pool members and pool members referencing statically-configured nodes.
-- The FQDN and statically-configured pool members use different port numbers.
-- The FQDN name resolves to one or more IP addresses that match the statically-configured node.
-- The DNS server subsequently no longer resolves the FQDN name to that IP address.

Impact:
Pool members may be deleted unexpectedly when DNS records/name resolution changes.

Workaround:
To work around this issue:
-- Use the same port number for both statically-configured pool members and FQDN pool members.
-- Add the statically-configured pool member(s) to the pool before adding any FQDN pool members which resolve to the same IP address(es).

---

1538689-1 : QUIC connections from the Chrome browser does not upgrade to HTTP/3

Links to More Info: BT1538689

Component: Local Traffic Manager

Symptoms:
When virtual server in BIG-IP is configured to support Quick UDP Internet Connections (QUIC) protocol, a connection from client to a server which supports QUIC must be upgraded to HTTP/3. But, connections coming from the Chrome client continue as HTTP/2 instead of HTTP/3.

Conditions:
- Connection must be initiated from the Chrome browser.
- The server must support HTTP/3 or QUIC.
- The TLS 1.3 0-RTT feature is disabled.

Impact:
Unable to establish a QUIC connection with the server.

Workaround:
Enabling the TLS 1.3 0-RTT feature allows the connection to continue in HTTP/3.

---

1519001-1 : After a crash, tmm may experience memory corruption

Links to More Info: BT1519001

Component: Local Traffic Manager

Symptoms:
On an F5OS tenant on affected platforms, if tmm does not stop gracefully - meaning it crashed or was killed, it may experience memory corruption when it starts again, leading to another crash.

Conditions:
-- F5OS tenant on a VELOS system or an r5000, r10000, or r12000-series appliance.
-- Tmm does not shut down gracefully

r4000 and r2000 series appliances are not affected.

Impact:
Tmm may crash again when it starts up. Traffic disrupted while tmm restarts.

Workaround:
Reboot the tenant, or if tmm is able to start, shut down tmm gracefully and restart.

---

1518997 : Under extreme conditions (with full load) traffic fail over and TMM restart may happen due to internal Session DB malfunction

Links to More Info: BT1518997

Component: TMOS

Symptoms:
On a High capacity chassis system that is running at extreme load conditions with HA pair configuration, it is observed that occasionally a failover may happen due to an internal SessionDB malfunctioning. The system is handling about 40k+ connections in this state and is seen seldomly.
This may lead to a TMM restart due to the ABORT situation due to looking up problems with sessionDB

Conditions:
Running at extreme load conditons and handling 40k+ connections

Impact:
Unintended failover happens and may lead to slight Performance degradation and TMM restart

Workaround:
The system will recover by itself after reboot.
But it may cause a disturbance to client traffic for a short duration while failover happens or TMM restart.

---

1518985 : Periodic fetching of DOS stats might result in TMM crash under low memory conditions

Links to More Info: BT1518985

Component: Local Traffic Manager

Symptoms:
TMM crashes while fetching DOS stats under low memory conditions in VELOS platform.

Conditions:
Low memory conditions.

Impact:
TMM crashes and restarts.

Workaround:
None

---

1505753-2 : Maximum Fragment Length extension is not visible in ServerHello even though it is present in ClientHello

Links to More Info: BT1505753

Component: Local Traffic Manager

Symptoms:
When the request from the client contains the Maximum Fragment Length header, BIG-IP is able to process it and honors the functionality, but this parameter is not added to the ServerHello.

Conditions:
Send a request from a client that contains the maximum fragment length extension.

Impact:
The ClientHello succeeds but the TLS Handshake fails when the Server Hello is received.

Workaround:
None

---

1505257-1 : False positive with "illegal base64 value" for Authorization header

Links to More Info: BT1505257

Component: Application Security Manager

Symptoms:
False positive "illegal base64 value" is detected

Conditions:
The given base64 encoded value is legal base64 but the decoded auth-param is unparsable. Such request triggers "HTTP Protocol Compliance" violation when configured to do so and it is indeed triggering, but such request should not trigger "illegal base64 value".

Impact:
A false positive is detected.

Workaround:
None

---

1505081-1 : Each device in the HA pair is showing different log messages when a pool member is forced offline

Links to More Info: BT1505081

Component: Local Traffic Manager

Symptoms:
On an HA pair, if a pool member is forced offline, different log messages related to the pool member's previous monitor status are seen on the active and standby devices.

Conditions:
On an HA pair, force a pool member offline.

Impact:
A potentially confusing log message occurs.

The Active device may display "[ was forced down for 0hr:2mins:28sec ]"
The Standby device may display "[ was up for 0hr:2mins:14sec ]".

No other functional impact.

Workaround:
None.

---

1497633-3 : TMC incorrectly set /32 mask for virtual-address 0.0.0.0/0 when attached to a VS

Links to More Info: BT1497633

Component: Local Traffic Manager

Symptoms:
When a 0.0.0.0/0 virtual-address created by a wildcard virtual server and a Traffic-Matching-Criteria (TMC) is attached to it, the mask for the 0.0.0.0 virtual address will be incorrectly modified.

Conditions:
Create a wildcard Virtual server with virtual address 0.0.0.0/0.

Attach a Traffic-Matching-Criteria with destination and source addresses as 0.0.0.0/0.

Impact:
The virtual server's address is advertised with an incorrect mask of /32, making the redistributed route via ZebOS ineffective.

---

1496269-3 : VCMP guest on version 16.1.4 or above might experience constant TMM crashes.★

Links to More Info: BT1496269

Component: TMOS

Symptoms:
VCMP guest on version 16.1.4 or above might experience constant TMM crashes.

Conditions:
VCMP guest running version from 16.1.x software train, 16.1.4 or above.

vCMP host running any other software version.

Impact:
Post upgrade TMM enters crash/core loop on vCMP guest. Traffic disrupted while tmm restarts.

Workaround:
None

---

1495265-1 : [SAML][IDP] Modifying the Assertion by adding xmlns:xs namespace causes signature failure on SP side

Links to More Info: BT1495265

Component: Access Policy Manager

Symptoms:
Verification of SAML signature fails with errors in /var/log/apm:

err apmd[28312]: 01490000:3: modules/Authentication/Saml/SamlSPAgent.cpp func: "verifyAssertionSignature()" line: 5978 Msg: ERROR: verifying the digest of SAML Response
debug apmd[28312]: 01490266:7: /Common/<striing>: modules/Authentication/Saml/SamlSPAgent.cpp: 'verifyAssertionSignature()': 6030: Verification of SAML signature #1 failed
err apmd[28312]: 01490204:3: /Common/<string>: SAML Agent: /Common/sp_ap_act_saml_auth_ag failed to process signed assertion, error: Digest of SignedInfo mismatch

The xml namespace added as part of ID 1397321 "xmlns:xs="http://www.w3.org/2001/XMLSchema" in the <AttributeValue> is ignored by the BIG-IP IDP canonicalize xml which results the digest calculated on Assertion without the namespace in the <AttributeValue>.

The assertion sent by idp has the newly added namespace but the Signature does not include this namespace during its calculation. As a result, verification of the signature fails on the SP side.

Conditions:
1) Create access profile
Start -> Logon ->AD auth -> Ad query -> Allow

2) Create IDP service and its sp connector and add attribute as thumbnail photo to the idp service config

3) Attach the IDP Service config in the "SSO Configuration" of the access profile.
 
4) Create an iRule object with replace assertion with additional namespace tag "or" have code change for ID1397321.

5) Attach the iRule and Access profile to the IDP VS
 
6) Configure BIG-IP as SP

7) Access the BIG-IP SP virtual server

Impact:
SAML breaks and authentication fails

---

1494773 : DHD (VELOS) - DHD does not load the network Quick Configuration - Virtual wire

Links to More Info: BT1494773

Component: Advanced Firewall Manager

Symptoms:
Loading...
Receiving configuration data from the device, in DDoS Menu's Quick Configuration and not being able to view/edit virtual wire details.

Conditions:
-- rSeries device.
-- Create a VLAN and 2 Virtual Networks to build a Virtual Wire.
-- BIG-IP Virtual Edition tenant assigned to the VLAN and virtual wire.

Impact:
In "DDoS Menu" Quick Configuration page shows Loading...

Workaround:
The virtual wire configuration should not be viewed by tenants on F5OS appliances.

---

1494137-3 : Translucent mode vlan-group uses wrong MAC when sending ICMP to client

Links to More Info: BT1494137

Component: Local Traffic Manager

Symptoms:
Translucent mode vlan-group uses source MAC as the vlan-group's MAC address instead of the server's MAC address while responding to an ICMP unreachable request.

Conditions:
1. Configure Vlangroup in Translucent mode on BIG-IP
2. Send an ICMP unreachable request from client to server.
3. Capture the tcpdump on the BIG-IP, observe the response packet has source MAC as the vlan-group's MAC address instead of the server's MAC address while responding to an ICMP unreachable request.

Impact:
The wrong MAC address is used which can cause traffic disruption.

Workaround:
Disable vlangroup.flow.allocate :

tmsh modify sys db vlangroup.flow.allocate value disable

---

1493869-1 : 'Duplicate OID index found' warning observed while running snmpwalk for F5-BIGIP-SYSTEM-MIB::sysProcPidStatProcName periodically

Links to More Info: BT1493869

Component: TMOS

Symptoms:
Certain processes failed to get monitored during the snmpwalk due to duplicate OID index.

Conditions:
Run snmp walk for F5-BIGIP-SYSTEM-MIB::sysProcPidStatProcName periodically

#snmpwalk -v 2c -c public localhost .1.3.6.1.4.1.3375.2.1.12.1.2.1.2

Impact:
A list of processes cannot be reliably retrieved using F5-BIGIP-SYSTEM-MIB::sysProcPidStatProcName

---

1492769-3 : SPVA stats-related may cause memory leak

Links to More Info: BT1492769

Component: Local Traffic Manager

Symptoms:
On specific platforms using EPVA HSB with SPVA stats involved, memory leaks might be observed.

Conditions:
Specific to this platform when SPVA statistics are involved.

Impact:
Memory is slowly running out

Workaround:
None

---

1491165-2 : TMM crashes when saving DAG setting and there are 7 or more blades

Links to More Info: BT1491165

Component: TMOS

Symptoms:
TMM crashes and generates a core file and continues to crash during startup.

Conditions:
A chassis has 7 or more blades installed.

The settings introduced by ID1282181 have been saved.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
The issue could be avoided by clearing the variables for ID1282181. However, this takes away the feature.

---

1490977-1 : Websense URLDB download fails with IPv6 sys DNS

Links to More Info: BT1490977

Component: Access Policy Manager

Symptoms:
The urldbmgrd fails to download the database and logs the below errors:

THREAD: D128E700; ERROR; Could not resolve m_downloadServer: download.websense.com.
THREAD: D128E700; ERROR; WsHttpClientConnect: Failed to resolve host address.
THREAD: D128E700; ERROR; DDSCommDownloadDatabase: WsHttpClientConnect failed: 4

Conditions:
IPv6 sys DNS is configured

Impact:
Urldb download fails.

Workaround:
If possible, change the DNS resolver to IPv4.

---

1490861-3 : "Virtual Server (/Common/xxx yyy)" was not found" error while deleting a virtual server in GTM

Component: TMOS

Symptoms:
When attempting to delete a virtual server in GTM, mcpd throws an error falsely indicating that the requested virtual server was not found, even though the virtual server has been deleted successfully.

Conditions:
Virtual servers are deleted from both TMUI and TMSH.

Impact:
The virtual server has been deleted but the log message incorrectly indicates there was an error. The log message can be ignored.

Workaround:
None

---

1490125 : When performing failover between two chassis during mixed performance testing, it requires 1-5 minutes for traffic to completely recover.

Component: Application Visibility and Reporting

Symptoms:
On certain blades of chassis, TMMs can spike to 100% CPU usage and around 50% of data traffic can be lost for 4-5 minutes.

Conditions:
-- A failover occurs while under heavy load.
-- AVR is collecting DoS statistics.

Impact:
In HA mode, when a failover event occurs, data traffic loss is possible and it takes 1-5 minutes for data traffic processing to be restored to normal.

Workaround:
Disable "Collect ACL Stats" in the BIG-IP GUI under Security Settings. Navigate to:

Security :: Reporting: Settings: Reporting Settings

---

1489941 : PKCE 'code_challenge_methods_supported" to be included in openid-configuration well-know-uri

Component: Access Policy Manager

Symptoms:
OAuth AS does not include PKCE "code_challenge_methods_supported" in openid-configuration well-know-uri

Conditions:
OAuth AS to support PKCE

Impact:
OAuth Client is unaware of the support for OAuth AS and PKCE parsing from the openid-configuration well-know-uri

Workaround:
None

---

1485557-1 : OAuth token not found for OAuth server with Bearer SSO

Links to More Info: BT1485557

Component: Access Policy Manager

Symptoms:
When the BIG-IP Administrator configures BIG-IP as OAuth RS with OAuth Bearer Single Sign On, WebSSO fails as an empty access token is included as a session variable.

Conditions:
OAuth Scope sets different access_token variables except for the one that is acceptable by WebSSO.

Impact:
BIG-IP Administrator fails to implement a successful OAuth Bearer SSO on OAuth RS.

---

1481969-1 : In-tmm monitor marks all pool members down

Links to More Info: BT1481969

Component: In-tmm monitors

Symptoms:
- Logs similar to the following are observed in /var/log/ltm with no entry stating that bigd was restarted

Monitor Agent TMM 0: channel connection closed
Monitor Agent TMM 0: channel connection opened
Monitor Agent TMM 0: channel authenticated

- Probes to nodes are not sent from tmm

- Pool is marked as down

Conditions:
- in-tmm monitors are enabled
Specific conditions are not known at this time

Impact:
All pool members are marked as down suddenly

Workaround:
None

---

1481889-1 : High CPU utilization or crash when CACHE_REQUEST iRule parks.

Links to More Info: BT1481889

Component: Local Traffic Manager

Symptoms:
When CACHE_REQUEST iRule stops, the Ramcache filter stays in CACHE_INIT state when it restarts. This causes the request to be processed twice, which causes high CPU usage or a crash when an incorrect address is encountered.

Conditions:
- HTTP Virtual server
- CACHE_REQUEST iRule with ms delay
- Multiple attempts to request a compressed doc

Impact:
- High CPU on boxes with 4G of valid memory after the key is hashed - on smaller boxes, will crash when an invalid address is encountered.

Workaround:
- Removal of CACHE_REQUEST iRule if avoidable

---

1474877-1 : Unable to download large files through VIP due RST Compression error.

Links to More Info: BT1474877

Component: Local Traffic Manager

Symptoms:
- Download of files exceeding maximum tmm.deflate.memory.threshold fails at client.
- Client receives RSTs (Compression error)

Conditions:
- Virtual server with HTML profile or REWRITE profile.
- Size of decompressed http response from server exceeds max tmm.deflate.memory.threshold value i.e. 4718592 bytes.

Impact:
- Client may lose connection to the server.

Workaround:
- Based on URI matches in the HTTP request, decide which responses should NOT be rewritten (e.g. big downloads) and disable REWRITE profile for the selected responses.
- For example, URI starting with "/headsupp/api/data/compare/measures" :

when HTTP_REQUEST {
   if { [HTTP::uri] starts_with "/headsupp/api/data/compare/measures" } {
      set no_rewrite 1
   }
}
when HTTP_RESPONSE {
  if { $no_rewrite == 1 } {
     REWRITE::disable
  }
}

---

1474401-1 : [HA failover resulting in connections on new Active not being maintained via mirroring on Standby]

Component: Service Provider

Symptoms:
When failover occurs through software, it leaves the connections on the active device still running. This is causing the current new active to continue to operate and retain previous connections. The previous active is still generating watchdog messages on the previous active connection, thus keeping it alive. This connection is from a different HA generation and is not part of a mirroring relationship. When failing over again via software, these previous connections are causing trouble.

Conditions:
Need a HA pair and connections have to be alive on both Active and standby.

Impact:
The old connections can create unwanted traffic concerning watchdog messages.

---

1474125-3 : iControl LX extension packages wrongly tagged as "IAPP" when synced to the HA peer unit

Links to More Info: BT1474125

Component: Device Management

Symptoms:
The HA unit where the iControl LX extension package is synced to tags it as IAPP.

Conditions:
iControl LX extension package is installed on the active device of a BIG-IP HA pair

Impact:
You are unable to differentiate installed iControl LX extension packages from virtual server iApps LX packages on the standby BIG-IP GUI.

Workaround:
None

---

1470085-2 : MDM has wrong links for Microsoft GCC High and DoD environments

Links to More Info: BT1470085

Component: Access Policy Manager

Symptoms:
When making a POST request to "login.microsoftonline.us," a resource POST parameter contains a URL for "api.manage.microsoft.com" instead of the expected "api.manage.microsoft.us".

Conditions:
MDM with GCC High/DoD Environments.

Impact:
Endpoint inspection fails.

Workaround:
None

---

1469221-2 : SSH access issues due to line wrapping in known_hosts file

Links to More Info: BT1469221

Component: TMOS

Symptoms:
Line wrapping in the known_hosts file introduced the incorrect whitespace in /config/ssh/ssh_known_hosts (generated by /etc/sysconfig/sshd-functions) this makes known_hosts entry non-functional because the contents of the file are space delimited.

Conditions:
-- SSHD configuration is modified to specify MaxAuthTries to a value of 3 or lower (the default value for MaxAuthTries is 6).

Impact:
Unable to SSH from one blade to another in a VIPRION or clustered vCMP guest or VELOS tenant, e.g. "ssh 127.3.0.whatever" or "ssh slot2".

Unable to SSH to localhost, e.g. "ssh localhost".

Workaround:
Do not specify a lower-than-default value for MaxAuthTries in the SSHD configuration.

---

1468473-1 : Statistics for DNS validating resolver not showing properly for Client hits and misses

Links to More Info: BT1468473

Component: Global Traffic Manager (DNS)

Symptoms:
Statistics are not shown properly for Client hits and misses.

Conditions:
DNS validating resolver.

Impact:
Statistics are not shown properly.

Workaround:
None

---

1465621-4 : Destination and Service fields are empty on virtual server Security policies tab

Links to More Info: BT1465621

Component: Advanced Firewall Manager

Symptoms:
Unable to access Virtual Server (Policies).

To access the Policies tab, the db afm.allowtmcvirtuals value must be set to true, the default value is set to false.

After the value change, the Destination and Service values are fetching default values instead of configured one.

No Functional Impact and only GUI issue.

Conditions:
- Create VS
- Create a Port list and add to the VS

Impact:
No Functional Impact and only GUI issue.

Workaround:
None

---

1464201-1 : GTM rule created with wildcard * from GUI results in configuration load error

Links to More Info: BT1464201

Component: Global Traffic Manager (DNS)

Symptoms:
GTM configuration load with error similar to the following:
Syntax Error:(/config/bigip_gtm.conf at line: 4) the "create" command does not accept wildcard configuration identifiers

Conditions:
Create GTM rule with name having wildcard

Impact:
GTM configuration fails to load.

Workaround:
None

---

1462421-3 : PVA connections are not re-accelerated after a failover.

Links to More Info: BT1462421

Component: TMOS

Symptoms:
After a failover, not all PVA-accelerated flows are accelerated on the new peer.

Conditions:
-- PVA acceleration enabled
-- Connection mirroring

Impact:
No PVA acceleration for mirrored flows on the newly active unit.

Workaround:
Delete the affected flows and then cause them to be re-created. Disable HA mirroring.

---

1462337-1 : Intermittent false PSU status (not present) through SNMP

Links to More Info: BT1462337

Component: TMOS

Symptoms:
PSU status displays as (2) Not Present through SNMP.
or
sysChassisFanStatus status displays as (2) Not Present through SNMP.

Conditions:
Conditions are unknown. It occurs intermittently.

Impact:
Intermittent false alarm in SNMP monitoring.

Workaround:
None

---

1461601-1 : SSH to localhost not working with SSH-RSA in Non FIPS mode

Links to More Info: BT1461601

Component: TMOS

Symptoms:
The password prompt is not displayed when trying SSH to localhost in Non FIPS mode

Conditions:
- Create test_user,

# tmsh create auth user test_user password abcde shell bash session-limit -1 partition-access replace-all-with { all-partitions { role admin } }
# tmsh save sys config

- Try login localhost using test_user,

Impact:
SSH to localhost will not work in Non FIPS mode

Workaround:
- SSH-RSA key deprecated in FIPS mode and supported in non-FIPS mode.
- Copying ssh-rsa key to ssh_known_hosts to connect to the local host in non-fips mode.
- FIPS mode uses the ECDSA key present in ssh_known_hosts to connect to the local host

---

1455805-1 : MCPD unstable/inoperative after copying SNMP configuration from another BIG-IP

Links to More Info: BT1455805

Component: TMOS

Symptoms:
If SNMP configuration that contains Secure Vault-protected attributes ("$M$...") is copied from a BIG-IP system to another and the devices do not have the same Secure Vault master key, the target device will appear to accept the configuration, but will be unable to decrypt the attributes.

If the system is subsequently rebooted, MCPD will remain inoperative or restart repeatedly during startup.

The LTM log files will contain error messages similar to the following:

bigip01 notice mcpd[30645]: 01071027:5: Master key OpenSSL error: 4008867572:error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt:evp_enc.c:664:
bigip01 notice mcpd[30645]: 01b00001:5: Processed value is empty: class name (usmuser) field name ()
bigip01 err mcpd[30645]: 01071684:3: Unable to encrypt application variable (/Common/ifoobar_1_1 auth_password usmuser /Common/snmpd).

Or

bigip01 notice mcpd[7011]: 01b00001:5: Processed value is empty: class name (trapsess) field name ()
bigip01 err mcpd[7011]: 01071684:3: Unable to encrypt application variable (/Common/i192_0_2_1 auth_password trapsess /Common/snmpd).

The LTM log file may contain this log message, indicating that MCPD exited and restarted while attempting to load the configuration:

bigip01 emerg load_config_files[25201]: "/usr/bin/tmsh -n -g -a load sys config partitions all " - failed. -- Error: failed to reset strict operations; disconnecting from mcpd. Will reconnect on next command.

Conditions:
- SNMP configuration that contains Secure Vault-encrypted attributes ("$M$..."), present as SNMPv3 auth-password and/or privacy-password attributes
- SNMP configuration is copied from a BIG-IP system to another BIG-IP system, and the two devices do not share the same Secure Vault master key.

Impact:
- SNMP configuration does not function.
- If the device is rebooted or MCPD is restarted, the system will remain INOPERATIVE or MCPD will be in a restart loop.

Workaround:
Do not copy SNMP configuration with encrypted attributes between disparate devices.

If a device is currently in an inoperative state and affected by this issue:

- Create a backup copy of /config/bigip_base.conf
- Manually edit bigip_base.conf and remove the SNMPv3 users and traps
- If the system does not recover automatically, restart MCPD or reboot the device once.

---

1455781-3 : Virtual to virtual SNAT might fail to work after an upgrade.

Links to More Info: BT1455781

Component: Local Traffic Manager

Symptoms:
Virtual to virtual SNAT might fail to work after an upgrade.

Conditions:
- Virtual-to-virtual configuration (chaining) with SNAT applied on the first virtual.
- The SNAT pool members are not reachable via any route entry.

Impact:
SNAT is not applied on the first virtual, which might lead to connection failures.

Workaround:
Add any route towards SNAT pool members, and re-create the SNAT pool.

---

1440409-4 : TMM might crash or leak memory with certain logging configurations

Links to More Info: BT1440409

Component: Local Traffic Manager

Symptoms:
TMM might crash or leak memory with certain logging configurations.

Conditions:
Virtual-to-virtual chaining is used for handling syslog messages.

Impact:
Memory leak or Crash.

Workaround:
None

---

1434789 : Address List containing IP addresses with route domain IDs cannot be assigned as Default Allowedlist in DoS profiles

Component: Local Traffic Manager

Symptoms:
Modifying DoS profile with default allowed list option throws error message on TMSH as well as on GUI.

Conditions:
Create allowlist IP address list like below,

security firewall address-list test-whtlst {
addresses {
8.8.8.8 { }
10.10.10.0/24 { }
192.168.0.1%2/32 { }
}
}
assign this whitelist to dos profile.

Impact:
Unable to assign allowlist IP address to DoS profile.

Workaround:
Use same allowlist as HTTP allowlist option.

Following is an example:
modify security dos profile test-dos-profile http-whitelist test-whtlst

---

1429813-2 : ASM introduce huge delay from time to time

Links to More Info: BT1429813

Component: Application Security Manager

Symptoms:
During high traffic, the response to some requests will be delayed for more than 1 second.

Conditions:
ASM Policy attached to the Virtual Server and during high traffic conditions.

Impact:
Some critical URLs like payment links, will timeout for the user.

Workaround:
None

---

1411365-2 : CMP forwarded flows can be removed by other CMP forwarded flows incorrectly

Links to More Info: BT1411365

Component: Local Traffic Manager

Symptoms:
BIG-IP may fail to forward server-side traffic if flow forwarding occurs due to an overload scenario, specifically due to flow collisions on the server-side connection when using the source-port preserve-strict option with UDP virtual configuration.

Conditions:
BIG-IP configured with UDP virtual configuration with source-port preserve-strict.

- CMP forwarding occurs when traffic on ingress is managed by a different TMM on egress.
- Overload condition occurs on TMM that leads to forwarding the flow by keeping server-side connection.
- Forwarded flow causes existing connection flow to be removed and interrupts current traffic flow.

Impact:
Forwarding flow removes the existing flow and causes traffic to be dropped.

Workaround:
Clear the existing connection from the connection table. For more information, refer to the article K53851362: Displaying and deleting BIG-IP connection table entries from the command line.

---

1411061-3 : API Protection rate limiting can cause cores with high traffic

Links to More Info: BT1411061

Component: Access Policy Manager

Symptoms:
Tmm cores and restarts

Conditions:
-- APM API Protection rate limiting is enabled
-- High traffic volumes

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

---

1410441-1 : Large file transfer over SFTP/SSH proxy failure

Links to More Info: BT1410441

Component: Advanced Firewall Manager

Symptoms:
- Large file transfer (>110MB) fails using the SFTP PUT command through a virtual server configured with AFM SSH Proxy.
- Depending on the boundary byte that gets sent from BIG-IP towards the backend server, the server sends back a SSH2_MSG_UNIMPLEMENTED for a packet type corresponding to the incorrect byte being interpreted as the message type.

Conditions:
- SSH Proxy profile attached to BIG_IP Virtual Server.
- Large file (>110MB) is uploaded using PUT command through the virtual server.

Impact:
File transfer fails.

Workaround:
Workaround options are:

- Limit the file transfer rate through the SFTP client.
  Ex:
  sftp -l 1000 <VS-IP>
  put <filename>

- Use a smaller buffer size (eg. 1400).
  Ex:
  sftp -B 1400 <VS-IP>
  put <filename>

---

1410285-1 : Genesis bot signature file does not install after upgrade

Links to More Info: BT1410285

Component: Application Security Manager

Symptoms:
Genesis bot signature file does not install after upgrade, even after removing signature overrides.

Conditions:
Installing the Genesis BotSignatures_xxxx_yyyy.im fails after upgrade due to a Bot Defense Signature that cannot be deleted because it is in use by a Bot Defense Profile Signature Override.

Deleting the conflicting Signature Override causes subsequent installing of the Genesis BotSignatures_xxxx_yyyy.im to fail silently (install endlessly spinning in UI).

Impact:
Cannot install Genesis BotSignatures_xxxx_yyyy.im after upgrade.

Workaround:
Remove bot signature override from bot defense profile - *before upgrade*.
After upgrade Genesis BotSignatures_XXX_yyy.im installs successfully.

---

1408229-1 : VCMP guest deployment may fail on newly installed blade

Links to More Info: BT1408229

Component: TMOS

Symptoms:
If a VCMP guest is configured to be Provisioned or Deployed to multiple blades in a VIPRION chassis, and one of those blades is replaced or has a new installation of BIG-IP installed, the VCMP guest may fail to be Provisioned or Deployed to the newly installed/reinstalled blade.

A message similar to the following may be logged to the LTM log (/var/log/ltm):

<date> <time> slot# err vcmpd[#####]: 01510004:3: Guest (GUEST_NAME): Install to VDisk /shared/vmdisks/GUEST_IMAGE_NAME.img FAILED: Child exited with non-zero exit code: 255

When this issue occurs, the blade where the VCMP guest image fails to be installed is found not to be running the KVM kernel module:

[root@CHASSIS_NAME:/S1-green-P::Active:Standalone] ~ # clsh 'lsmod | grep kvm'
=== slot 2 addr 127.3.0.2 color green ===
kvm_intel 179624 68
kvm 603109 1 kvm_intel
irqbypass 13503 1 kvm
=== slot 3 addr 127.3.0.3 color green ===
kvm_intel 179624 0
kvm 603109 1 kvm_intel
irqbypass 13503 1 kvm
=== slot 4 addr 127.3.0.4 color green === <<<<<<< no 'kvm' module shown for affected blade
=== slot 5 addr 127.3.0.5 color blue ===
=== slot 6 addr 127.3.0.6 color blue ===
=== slot 7 addr 127.3.0.7 color blue ===
=== slot 8 addr 127.3.0.8 color blue ===
=== slot 1 addr 127.3.0.1 color green ===
kvm_intel 179624 68
kvm 603109 1 kvm_intel
irqbypass 13503 1 kvm

Conditions:
This may occur if:
-- VCMP is provisioned, and one or more VCMP guests are provisioned/deployed in a VIPRION chassis with multiple blades.
-- One of the blades is replaced with a new blade (such as from an RMA replacement).
-- The newly installed/reinstalled blade has a version of BIG-IP installed that does not match the BIG-IP version installed and running on the existing blades in the chassis.
-- The newly installed/reinstalled blade must reboot multiple times to complete the installation of all required BIG-IP versions to match the existing blades in the chassis.
-- One or more VCMP guests are configured to be Provisioned and/or Deployed to the newly installed/reinstalled blade's slot.
-- The newly installed/reinstalled blade does not automatically reboot after successfully provisioning VCMP after the automated installation of the final (matching) BIG-IP version.

Impact:
The VCMP guest fails to be Provisioned or Deployed to the newly installed/reinstalled blade.

Workaround:
To work around this issue when it occurs, reboot the affected blade.
-- From the console of the affected blade:
reboot
-- From the console of another blade in the chassis:
clsh --slot=# reboot
(where # is the slot number of the affected blade)

---

1407949-1 : iRules using regexp or regsub command with large expression can lead to SIGABRT.

Links to More Info: BT1407949

Component: Local Traffic Manager

Symptoms:
When iRule is using badly crafted regexp or regsub command, sometimes large regex compilation may lead to TMM core.

- Multiple clock advances will be logged in tmm logs.

- A message similar to the one below will be logged in tmm logs:
notice sod[9938]: 01140041:5: Killing tmm.0 pid <pid of tmm>.

Conditions:
- iRules using regexp or regsub command with large expression

Impact:
Traffic disrupted while tmm restarts.

Workaround:
Update iRule to avoid using regex or regsub with large expressions.
either by
1. setting an upper-limit on the permitted size for regex expression or
2. rewrite the iRule to avoid the use of 'regsub'.

---

1407929-2 : Virtual-wire HW offload statistics are incorrect

Links to More Info: BT1407929

Component: TMOS

Symptoms:
Flow status received from the hardware cannot be matched to flows, hence offload statistics are not updated and packet/bytes counters remain 0.

Conditions:
- BIG-IP tenant on the F5OS platform;
- Virtual-wire and HW offload enabled;

Impact:
Incorrect offload statistics.

Workaround:
None

---

1404253-1 : [NAT-LOGS] PBA Lease Duration suffers from a 32-bit rollover after 50 days

Links to More Info: BT1404253

Component: Advanced Firewall Manager

Symptoms:
On NAT logs, the sum of PBA start time and duration values do not match with the log-generated time.

Conditions:
NAT policy in action with PBA and block-life-time is 0 which implies infinite time.

Impact:
The duration field in the logs does not show the right value.

Workaround:
None

---

1403869-4 : CONNFLOW_FLAG_DOUBLE_LB flows might route traffic to a stale next hop

Links to More Info: BT1403869

Component: TMOS

Symptoms:
Pool members configured with IP encapsulation or any type of flow using CONNFLOW_FLAG_DOUBLE_LB flag might take some time to refresh its nexthops.

Conditions:
BIG-IP receives an ECMP route towards a server over two different BGP peers and the server is a pool member with IPIP encapsulation enabled. One of the BGP peers goes down and the route gets removed immediately, but BIG-IP is still forwarding traffic to this peer for the next few seconds, even though tmm.inline_route_update is enabled.

Impact:
The connection is using the old, invalid next hop for a few seconds.

Workaround:
None

---

1403825-1 : Lvm2 package upgrade from 2-2.02.166 to 2-2.02.187

Links to More Info: BT1403825

Component: TMOS

Symptoms:
Bootup of BIG-IP tenant will fail due to logical cache/metadata corruption.

Conditions:
On a r10K System with Multi-Tenant BIG-IPs were deployed, sometimes this issue may come up as a timing issue.

Impact:
Traffic handling by the BIG-IP tenant will fail.

Workaround:
None

---

1403797 : Extending the username existence check for remote users

Links to More Info: BT1403797

Component: TMOS

Symptoms:
The below endpoints that helps admin role users to create authentication tokens for the same or other role users, are unable to validate the username (either in the attribute or in the user link of the supplied payload) against the existence check.

/mgmt/cm/system/authn/providers/tmos/token-generator
/mgmt/shared/authz/tokens

Conditions:
When admin role user is trying to create authentication token for same or other role users on behalf of using the following endpoints, with a non-existing username supplied.

/mgmt/cm/system/authn/providers/tmos/token-generator
/mgmt/shared/authz/tokens

Impact:
Admin role user can create authentication token for any non-existing or disabled remote user, which is not expected to happen.

Workaround:
None

---

1401961 : A blade with a non-functional backplane may override the dag context for the whole system

Links to More Info: BT1401961

Component: TMOS

Symptoms:
A blade with a non-functional backplane may override the dag context for the whole system.

Conditions:
- a blade has backplane problems, as evidenced by "shared random" not being ready in `tmctl -d blade tmm/ready_for_world_stat`.

Impact:
The traffic is black-holed into a non-functional blade.

Workaround:
Depending on the nature of the blade fault, a workaround is to either disable or just reboot the non-functional blade.

---

1401569-1 : Engineering Hotfix readme file refers to non-applicable "full_box_reboot" command★

Component: TMOS

Symptoms:
The readme file automatically produced for BIG-IP Engineering Hotfixes contains the following instructions:

This hotfix may not be operational without a FULL
system restart. To accomplish this, use the command:
/usr/bin/full_box_reboot

However, the full_box_reboot command is not part of the documented or recommended workflows for current BIG-IP versions.

Conditions:
These instructions are contained in the .readme file that may accompany a BIG-IP Engineering Hotfix provided by F5 to resolve critical issues, under the terms and conditions of the F5 critical issue hotfix policy as described at:
https://my.f5.com/manage/s/article/K4918

Impact:
The instructions in the Engineering Hotfix readme file may be confusing due to inconsistency with documented workflows for installing BIG-IP Engineering Hotfixes.

Workaround:
After the software installs and boots to the volume with installed software no further reboot is required.

---

1400337 : GTP compliances are deprecated after BIG-IP version upgrade

Links to More Info: BT1400337

Component: Protocol Inspection

Symptoms:
After upgrade from BIG-IP 17.1.0.1 to higher versions (like 17.1.0.2 or 17.1.0.3) below compliances are deprecated with "action" configured other than default value:

gtp_allowed_apns
gtp_disallowed_apns
gtp_disallowed_imsi

This issue is not encountered when directly installing BIG-IP 17.1.0.2.

Conditions:
- BIG-IP 17.1.0.1 is installed
- Create a protocol inspection profile with GTP compliance.
- Change action for gtp_allowed_apns, gtp_disallowed_apns and gtp_disallowed_imsi other than default value and commit these changes.
- Upgrade to BIG-IP 17.1.0.2 or other higher versions.
- Deprecated becomes "yes".

Impact:
These compliances are removed and cannot be used.

Workaround:
If the active version on BIG-IP 17.1.0.2 with an IPS Profile created, then do the following:
1) Change the Action to default "Don't Inspect" for all 3 affected compliances in profile and commit the changes.
2) Install BIG-IP 17.1.0.2.
3) Upgrade to BIG-IP v17.1.0.2.
4) Now change the action value as per the requirement (Accept/Reject/Drop) and commit the changes.

---

1400105-1 : Replace policy function fails even though local and imported (JSON format) policies have the same encoding/applicationLanguage

Links to More Info: BT1400105

Component: Application Security Manager

Symptoms:
Exporting and replacing a policy in JSON format fails with error "InternalError - import_policy failed: fatal: Failed action: Imported and replaced policies have different encodings."

Conditions:
Export a policy in JSON format and replace a policy with the exported policy.

Impact:
Import policy getting failed with Replace option.

Workaround:
Works with exporting policy as XML format.

---

1399369-1 : While upgrading standby device, active device is going to standby mode for few seconds, and traffic loss is observed.★

Links to More Info: BT1399369

Component: Local Traffic Manager

Symptoms:
Traffic loss due to failover.

Conditions:
-- F5OS with BIG-IP tenants.
-- Execute failovers on the active device by running "tmsh run sys failover standby".
-- Proceed to upgrade F5OS on the current standby device.
-- Note that during this process, the device previously in Active mode will transition to standby mode momentarily, typically lasting around 20 seconds.

Impact:
Traffic loss lasting up to 20 seconds approx.

Workaround:
None

---

1399017-3 : PEM iRule commands lead to TMM crash

Links to More Info: BT1399017

Component: Policy Enforcement Manager

Symptoms:
In a few circumstances PEM iRule commands lead to a TMM crash.

Conditions:
PEM iRule commands

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

---

1398961 : External IDP Connector Certificate Settings disappears

Links to More Info: BT1398961

Component: Access Policy Manager

Symptoms:
When BIG-IP administrator creates a certificate with name "SP_ADFS__saml_idp_metadata_cert.crt", the dropdown showing the list of available certificates in the External IDP Connector Settings disappeared.

Conditions:
The issue occurs only when the certificate is named with string "SP_ADFS__saml_idp_metadata_cert.crt"

Impact:
The BIG-IP administrator will not be able to select a certificate for External IDP Connector.

Workaround:
As the issue occurs only for chrome & Edge browsers, the BIG-IP administrator can use Safari or FireFox.

---

1397001-1 : Memory leak in websense when RTU is updated

Links to More Info: BT1397001

Component: Access Policy Manager

Symptoms:
URLDB stops responding and you may observe below logs

crit tmm5[27171]: 01790602:2: [C] <IP:port> -> <IP:port>: (ERR_EXPIRED) URL category lookup failed

Conditions:
Websense database update.

Impact:
SSL Orchestrator traffic cannot be forwarded.

Workaround:
Restart urldb:
bigstart restart urldb

Impact of workaround: restarting urldb causes traffic to be disrupted while urldb is restarting.

---

1395349-2 : The httpd service shows inactive/dead after "bigstart restart httpd"

Links to More Info: BT1395349

Component: TMOS

Symptoms:
The systemd service unit for httpd shows a status of inactive (dead) after you restart httpd using bigstart restart httpd. For example:

# systemctl status httpd
* httpd.service - LSB: start and stop Apache HTTP Server
   Loaded: loaded (/etc/rc.d/init.d/httpd; enabled; vendor preset: enabled)
   Active: inactive (dead) since Mon 2023-11-13 09:55:06 GMT; 5s ago



In versions v15.1.10.5 and above in v15.1.x, v16.1.5 and above in v16.1.x, and v17.1.1.4 and above, if a system is affected by this and then a user or process restarts httpd via systemd, the GUI will stop responding and return 403 Forbidden errors. This happens when attempting to renew or update the device certificate via the GUI.

Conditions:
Executing the command bigstart restart httpd. This will also happen behind-the-scenes when making HTTP configuration changes via tmsh/the GUI/iControl.

Impact:
httpd is running normally, but systemd is not aware of it.

Workaround:
To confirm httpd is running, you can use the following commands:

bigstart status httpd

OR

ps ax | grep '[h]ttpd'

If you would like to clear the stale state, restart httpd via its systemd service unit twice:

systemctl restart httpd && systemctl restart httpd


If the GUI is returning 403 Forbidden errors for everything, restart httpd ("systemctl restart httpd && systemctl restart httpd").

---

1394445-1 : Password-memory is not remembering passwords to prevent them from being used again

Links to More Info: BT1394445

Component: TMOS

Symptoms:
Password-memory is not remembering passwords to prevent users from using the same password again.

Conditions:
-- Policy-enforcement is enabled.
-- password-memory is configured.

Impact:
System should support "password memory" for each user and can't use previous password.

Workaround:
None

---

1391081-1 : TMM crash when running HTTP/3 and persist record

Links to More Info: BT1391081

Component: Local Traffic Manager

Symptoms:
TMM crashes when handling an HTTP/3 request.

Conditions:
HTTP/3 traffic on a BIG-IP system with multiple TMMs and the use of persistence.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

---

1382389 : QDCOUNT LIMIT DoS vector Not working as expected.

Links to More Info: BT1382389

Component: Advanced Firewall Manager

Symptoms:
Two DoS vectors match the same type of traffic:

-- Device: DNS Question Items != 1
-- Protection Profile: DNS QDCOUNT LIMIT

If you have both of these DoS vectors configured, only the "DNS Question Items != 1" DoS vector is matched.

Conditions:
-- Both "DNS QDCOUNT LIMIT" and "DNS Question Items != 1" are configured.
-- The DOS vectors are triggered

Impact:
Only the "DNS Question Items != 1" alert is raised.

Both of these DoS vectors have identical meanings internally, and so only "DNS Question Items != 1" will be triggered.

Workaround:
None

---

1381629 : Config Sync Issues may arise after UCS restore/save and sync.

Links to More Info: BT1381629

Component: TMOS

Symptoms:
Config sync may fail after a UCS save/restore and sync in clustered HA pair.

You may see the following errors in the log:

- rsync: link_stat "/config/.snapshots_d/customization_group_d/1697724524_:Common:kerberos_auth_config_default_end_deny_ag_1" failed: No such file or directory (2)
- rsync error: some files/attrs were not transferred (see previous errors) (code 23)
- Caught configuration exception (0), Failed to sync files..
- Remote transaction for device group /Common/GROUPNAME failed with error Caught configuration exception (0), Failed to sync files...

Conditions:
1. Should be in a clustered HA pair with auto sync on.
2. Take a UCS and save on both devices in the HA pair.
3. Configure the device with a new kerberos auth config and do a config sync of this configuration.
4. Restore the UCS file saved from before.
5. Run a manual config sync.

Impact:
Config sync fails.

Workaround:
Remove the customisation group snapshot files and run “tmsh run cm config-sync force-full-load-push to-group GROUPNAME”. This should be run from the device that does not have default kerberos auth config profiles.

---

1380009-3 : TLS 1.3 server-side resumption resulting in TMM crash due to NULL session

Links to More Info: BT1380009

Component: Local Traffic Manager

Symptoms:
TMM core is observed when TLS 1.3 server-side resumes.

Conditions:
- TLS 1.3 handshake

Impact:
TMM cores, traffic is disrupted.

Workaround:
None

---

1379649-1 : GTM iRule not verifying WideIP type while getting pool from TCL command

Links to More Info: BT1379649

Component: Global Traffic Manager (DNS)

Symptoms:
When the pool name is same for different pool types, the GTM iRule cannot segregate the pool types thus giving a wrong DNS response.

Conditions:
-- Both A/AAAA same name WideIP and pools.
-- GTM iRule with pool command pointing to common pool name in different WideIP types.

Impact:
Traffic impact as a non-existent pool member address in DNS response.

Workaround:
None

---

1378869-2 : tmm core assert on pemdb_session_attr_key_deserialize: Session Rule key len is too short

Links to More Info: BT1378869

Component: Policy Enforcement Manager

Symptoms:
bad PEM session lookup request via MPI

Conditions:
PEM is provisioned.

Impact:
tmm core .

---

1378069-1 : DNS profile RPS spike every time when there is change in configuration of DNS profile

Links to More Info: BT1378069

Component: Global Traffic Manager (DNS)

Symptoms:
High rps value seen in profile_dns_stat which is not as per the traffic sent.

Conditions:
-- Monitor the rps value under profile_dns_stat when there is a change in the configuration of DNS profile.

Impact:
High RPS value seen.

Workaround:
None

---

1377205 : Content-based routing: Matched XML data being truncated to 1024 bytes

Links to More Info: BT1377205

Component: Application Security Manager

Symptoms:
When trying to match the (XML) content, B64 decode it and then use sideband in an iRule to have the content checked. But this only works for content lengths less than 1024 characters in the relevant XML field.

Conditions:
The content of the XML data which is to be matched is more than 1024 bytes.

Impact:
Match requests of string lengths more than 1024 bytes will be truncated to 1024 bytes after validation.

Workaround:
None

---

1366765-1 : Monitor SEND string parsing "＼＼r＼＼n"

Links to More Info: BT1366765

Component: Local Traffic Manager

Symptoms:
Double backslashes in monitor SEND string results in CR/LF being doubled.

Conditions:
Following is an example of SEND string:

Send "GET / HTTP/1.1＼＼r＼＼nHost: nt.gov.au ＼＼r＼＼nConnection: Close ＼＼r＼＼n＼＼r＼＼n"

Impact:
Monitor logging showed that these are correctly converted to ＼x0d＼x0a apart from the trailing "＼＼r＼＼n＼＼r＼＼n" and the monitor sends a sequence of "＼x0d＼x0a＼x0d＼x0a＼x0d＼x0a＼x0d＼x0a" which is not HTTP protocol compliant.

Workaround:
Removed the extra back-slashes
send "GET / HTTP/1.1＼r＼nHost: nt.gov.au ＼r＼nConnection: Close ＼r＼n"
Now, the request is closed correctly ＼r＼n＼r＼n

Execute without ＼r＼n at the end of the SEND string, following is an example:
send "GET / HTTP/1.1＼r＼nHost: nt.gov.au ＼r＼nConnection: Close"
The above string works correctly.

---

1366269-4 : NAT connections might not work properly when subscriber-id is confiured.

Links to More Info: BT1366269

Component: Advanced Firewall Manager

Symptoms:
When subscriber-aware NAT is configured or subscriber-id logging is enabled under NAT log profile some NAT connections might not work properly.

Conditions:
- Subscriber-aware NAT or NAT logging with subscriber-id enabled.

Impact:
Some NAT connections fail to complete.

Workaround:
Disable 'subscriber-id' under NAT logging profile.

---

1361041 : Behavioral L7 DOS cannot learn if 'sys db merged.method' is set to 'slow_merge'

Component: Anomaly Detection Services

Symptoms:
Behavioral L7 DOS cannot learn.

Conditions:
'sys db merged.method' is set to 'slow_merge'

Impact:
Behavioral L7 DOS is not functioning as expected.

Workaround:
Do not set 'sys db merged.method' to 'slow_merge'

---

1361021-1 : The management interface media on a BIG-IP Tenant on F5OS systems does not match the chassis

Links to More Info: BT1361021

Component: TMOS

Symptoms:
The management interface media on a BIG-IP tenant running on F5OS systems does not match the media/speed of the management interface on the system controllers.

Running 'tmsh show net interface' reports the media of the management interfaces (i.e. 'mgmt' or '1/mgmt') as "100TX-FD".

Conditions:
BIG-IP tenant running on F5OS systems (rSeries or VELOS).

Impact:
The media is reported as "100TX-FD".

Workaround:
Ignore the speed reported for the tenant's management interface(s), and instead, look at the speed of the management interfaces as reported in F5OS.

While running confd, run the following command to see the correct media settings:

VELOS: show interfaces interface 1/mgmt0
rSeries: show interfaces interface mgmt

---

1360221-4 : Unable to view hardware DOS drops through SNMP

Links to More Info: BT1360221

Component: Advanced Firewall Manager

Symptoms:
Cannot view hardware DOS drops through SNMP walk due to missing OID for hardware drops.

Conditions:
- AFM licensed and provisioned.
- Hardware DOS enabled.

Impact:
The count of attack packets dropped in hardware cannot be retrieved using SNMP.

Workaround:
View the hardware drops stats using the TMSH command.

The following is an example:

tmsh shows security dos device-config

---

1359817-2 : The setting of DB variable tm.macmasqaddr_per_vlan does not function correctly

Links to More Info: BT1359817

Component: F5OS Messaging Agent

Symptoms:
TMM is not configuring L2 listener entry for a new MASQUEREDE MAC created from a base MAC and VLAN ID when the DB variable tm.macmasqaddr_per_vlan is true.

Conditions:
- F5OS Tenant
- MAC MASQUEREDE is configured
- DB variable tm.macmasqaddr_per_vlan is true

Impact:
Connectivity issues may occur, pinging a self-IP will fail.

Workaround:
None

---

1355309-1 : VLANs and VLAN groups are not automatically saved to bigip_base.conf on first boot or modification of a tenants VLANs or virtual wire

Links to More Info: BT1355309

Component: TMOS

Symptoms:
Standalone/Virtual Wire VLANs are removed when the device is rebooted without saving the configurations.

Conditions:
-- Configuring VLANs, VLAN groups, or virtual wire without saving the configuration
-- The device is rebooted

Impact:
VLAN/VLAN group loss for some or all of them.

Workaround:
Save the configurations on the tenant after removing or adding the virtual wire VLANs.

---

1355109 : [API Protection] TMM core after adding api-protection profile to VS

Links to More Info: BT1355109

Component: Access Policy Manager

Symptoms:
TMM crashes

Conditions:
-- API Protection profile added to Virtual Server

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

---

1354289 : NAT64 virtual IP does not translate ICMPv6 to v4 after failover in mirrored connections

Links to More Info: BT1354289

Component: Local Traffic Manager

Symptoms:
In an HA deployment with mirroring enabled on a virtual IP address, when failover occurs the newly active device does not translate ICMPv6 to IMCPv4 properly.

Conditions:
1) Enable NAT64 on a virtual IP
2) Enable mirroring on virtual IP
3) Configure HA pair.

Impact:
Traffic impact after failover.

Workaround:
None

---

1353809-4 : HTTP/2 erroneously expects the body length to match the Content-Length in response to HEAD request

Links to More Info: BT1353809

Component: Local Traffic Manager

Symptoms:
HTTP/2 is attempting to enforce the Content-Length sent (legally) by the Apache server, because it is a HEAD, there is no body, but HTTP/2 erroneously expects the body length to match the Content-Length sent.

Conditions:
-- HTTP/2 virtual server
-- Response from the server should contain DATA (0 length) frame for HEAD request

Impact:
BIG-IP sends RESET frame.

Workaround:
None

---

1352445-1 : Executing 'tmsh load sys config verify', changes Last Configuration Load Status value to 'config-load-in-progress'

Links to More Info: BT1352445

Component: TMOS

Symptoms:
After mcpd starts and successfully loads the config, executing 'tmsh load sys config verify', and thereafter executing 'tmsh show sys mcp-state' results in an incorrect value shown for Last Configuration Load Status.

# tmsh show sys mcp-state

-------------------------------------------------------
Sys::mcpd State:
-------------------------------------------------------
Running Phase running
Last Configuration Load Status config-load-in-progress
End Platform ID Received true

Conditions:
Executing 'tmsh load sys config verify' and then 'tmsh show sys mcp-state' results in MCPD state indicating "Last Configuration Load Status" is "config-load-in-progress" even though the config has successfully loaded.

Impact:
Inaccurate config load state shown by 'tmsh show sys mcp-state' command.

Workaround:
Run 'tmsh load sys config'.

---

1350909-1 : Statsd error condition is not logged

Links to More Info: BT1350909

Component: Local Traffic Manager

Symptoms:
There is one statistics file per TMM and when large number of TMMs are in use, these statistics files have to be merged to view total memory usage of TMMs. These statistics files merge may fail if the total memory required is greater than 4 GB. There will not be any logs printed to inform the memory exhaustion condition.

Conditions:
When the files in /var/tmstat/blade/ exceed 4 GB, this could be to a large number of TMMs or due to an extremely large configuration.

Impact:
Incorrect TMM memory statistics and failure to log this message in debug logs.

Workaround:
Restart TMM.

---

1350485-1 : When the parameter value contains '@', domain name is not properly extracted

Links to More Info: BT1350485

Component: Application Security Manager

Symptoms:
Request is blocked with Illegal Parameter type violation

Conditions:
-- Parameter value type set to 'Auto Detect'
-- Illegal data type violation is enabled

Impact:
Request blocked if the parameter Url values having '@' followed by other special characters

Workaround:
Change the type to alpha-numeric

---

1350417-2 : "Per IP in-progress sessions limit (xxx) exceeded" message occurs before number of "In-Progress session" reaches the limit

Links to More Info: BT1350417

Component: Access Policy Manager

Symptoms:
You may observe the below in /var/log/apm.

warning tmm2[20687]: 01490547:4: Access Profile <AP Name>: Per IP in-progress sessions limit (2048) exceeded for <IP Address>

Conditions:
-- No specific conditions, it happens when Access Profiles are attached to a virtual server.

Impact:
New sessions may be rejected when this message was logged.

Workaround:
Keep large value for " Per IP In-Progress session" limit.

---

1348061-4 : [Dual Stack MGMT] - Upgrade of BIG-IP in HA with Dual stacked mgmt IP causes deletion of peers failover IPv4 unicast address★

Links to More Info: BT1348061

Component: TMOS

Symptoms:
Before the upgrade, 'tmsh show cm failover' output will show the status as 'OK' in all BIG-IPs for both Ipv4 and Ipv6 management IPs configured as failover unicast addresses.
 
After the upgrade, a few BIG-IPs in the HA cluster stopped sending failover packets to the peer on ipv4 mgmt which caused the output of ''tmsh show cm failover' to show as "Error".

Conditions:
The issue occurs under the following conditions:
-- 3 or more BIG-IPs in the HA cluster.
-- 3 or more Traffic-Group configured.
-- IPv4 and IPv6 management address configured.
-- Upgrade from 14.1.x to the new version or MCPD forceload of BIG-IPs in cluster running 14.1.x or later.

Impact:
BIG-IPs stopped sending failover packets to the peer on ipv4 mgmt. Since only the Ipv4 mgmt address will show as an error but other failover unicast addresses will not be impacted so it should not cause broken failover connectivity.

Workaround:
Delete and re-add the 'management_address' in the failover network in all BIG-IPs and the status will be changed to 'OK'. It is suggested to also add self-ip as a failover unicast address along with management-IP.

---

1347861-1 : Monitor status update logs unclear for FQDN template pool member

Links to More Info: BT1347861

Component: TMOS

Symptoms:
When the state of an FQDN template node is changed (such as being forced offline by user action), one or more messages similar to the following may appear in the LTM log (/var/log/ltm):

notice mcpd[####]: 01070638:5: Pool /Common/poolname member /Common/nodename:## monitor status unchecked. [ ] [ was unknown for #hrs:##mins:##sec ]

Although such log messages indicate the current state of the FQDN template pool member, the prior status is indicated as "unknown" and does not accurately indicate the prior state of the FQDN template pool member.

Conditions:
This may occur when FQDN nodes and pool members are configured, and When the state of an FQDN template node is changed (such as being forced offline or re-enabled from an offline state by user action).

Impact:
Such messages may confuse users who are attempting to monitor changes in the BIG-IP system by not providing clear information.

Workaround:
The state of an FQDN template pool member is generally determined by the state of the referenced FQDN template node. The FQDN template node contains the configuration used to resolve the FQDN name to the corresponding IP addresses. FQDN template pool members are not involved in this process, and generally only reflect the status of the name resolution process centered on the FQDN template node.

Examining log messages related to to the associated FQDN template node can inform the interpretation of the FQDN template pool member state.
For example, if an FQDN template node is forced offline, messages similar to the following will be logged indicating the FQDN template node state change, which is subsequently reflected in FQDN template pool member state changes:

notice mcpd[####]: 01070641:5: Node /Common/nodename address :: session status forced disabled.
notice mcpd[####]: 01070638:5: Pool /Common/poolname member /Common/nodename:## monitor status forced down. [ ] [ was unknown for #hr:##min:##sec ]

notice mcpd[####]: 01070641:5: Node /Common/nodename address :: session status enabled.
notice mcpd[####]: 01070638:5: Pool /Common/poolname member /Common/nodename:## monitor status unchecked. [ ] [ was unknown for #hr:##min:##sec ]

---

1346101-2 : SSL Orchestrator can crash TMM

Links to More Info: BT1346101

Component: Local Traffic Manager

Symptoms:
In rare circumstances, the use of the SSL Orchestrator split session filter crashes TMM.

Conditions:
SSL Orchestrator in use.

Impact:
TMM crashes.

Workaround:
None

---

1345997-3 : Very large number of custom URLs in SWG can impact performance.

Links to More Info: BT1345997

Component: Access Policy Manager

Symptoms:
High TMM CPU usage. Inability to support expected number of connections.

Conditions:
- SWG and APM provisioned.
- Large numbers of glob pattern matches in custom URL categories, e.g. tens of thousands.
- Bulk of the matches are similar to "*://www.hostname.com" or "http://*.domain.com"

Impact:
Degraded TMM performance.

Workaround:
None

---

1344925-3 : TLS1.3 does not fall back to full handshake when Client Hello is missing the pre_shared_key

Links to More Info: BT1344925

Component: Local Traffic Manager

Symptoms:
BIG-IP sends out a TLS Fatal Error (Handshake Failure) when TLS1.3 Client Hello is missing the 'pre_shared_key' extension when TLS session resumption is expected.

Conditions:
-- TLS1.3 Session resumption
-- Client Hello is missing the 'pre_shared_key' extension (but has a valid 'key_share')

Impact:
BIG-IP resets the connection with TLS Fatal Alert (Handshake Failure) instead of falling back to full TLS handshake.

Workaround:
Don't use TLS1.3 and session resumption.

---

1341093-1 : MCPD returns configuration error when attaching a client SSL profile containing TLS 1.3 to a virtual server with HTTP/2 profile

Links to More Info: BT1341093

Component: Local Traffic Manager

Symptoms:
A configuration error is seen on BIG-IP as below:
01070734:3: Configuration error: In Virtual Server (/Common/vsname) an http2 profile with enforce-tls-requirements enabled is incompatible with client ssl profile '/Common/PORTAL-3119-cssl-tls13'; cipher ECDHE-RSA-AES128-GCM-SHA256 must be available

Conditions:
- Virtual Server with cipher rule that uses tlsv1_3 ciphers only
- Cipher group
- Client-SSL profile and HTTP/2 profile with enforce-tls-requirements enabled

Impact:
HTTP/2 and Client-SSL Profiles with TLS 1.3 is not supported.

Workaround:
None

---

1340513-1 : The "max-depth exceeds 6" message in TMM logs

Links to More Info: BT1340513

Component: TMOS

Symptoms:
An error message similar to the following is seen in /var/log/ltm:

err tmmX[XXXXXX]: 01630002:3: (max-depth exceeds 6) ()

Conditions:
These errors may appear in the LTM log once for each TMM that starts up, often after a configuration action such as:
-- Modifying virtual server configuration.
-- Assigning an ASM policy or a bot profile to a virtual server.
-- Running a config merge command.

Impact:
These messages are benign, despite being logged at an "error" level.

---

1332473-1 : Configuring SNAT Origin IPv6 address through GUI in non RD0 incorectly expands subnet mask to '/32' causes error during configuration load

Links to More Info: BT1332473

Component: TMOS

Symptoms:
The SNAT Origin IPv6 address subnet mask incorrectly expands to '/32' causing an error during configuration load.

Conditions:
-- In GUI, create a SNAT list with Origin Set to IPv6 address.
-- Perform the command tmsh load sys config.

Impact:
Error is observed while loading the configuration (tmsh load sys config).

Workaround:
None

---

1331037-4 : The message MCP message handling failed logs in TMM with FQDN nodes/pool members

Links to More Info: BT1331037

Component: TMOS

Symptoms:
When an FQDN node or pool member is created, one or more messages of the following form may appear in the TMM logs (/var/log/tmm*):

notice MCP message handling failed in 0x<hex value>

Conditions:
This may occur when creating an FQDN node or pool member on affected versions of BIG-IP.

Impact:
There is no known impact of this issue, besides the appearance of "notice" level messages in the TMM logs.

Workaround:
None

---

1330273-3 : When MAC masquerade is enabled on r5k/r10k/r12k systems with a live upgrade, an FDB entry is seen on Active and Standby

Component: TMOS

Symptoms:
When a MAC masquerade address is configured on BIG-IP in R5K/R10K/R12K based systems and a live upgrade of F5OS is done, an FDB entry can be seen in both Active F5OS appliance as well as Standby:

f5-appliance-active# show fdb
                                                                                          NDI
MAC ADDRESS VLAN TAG TYPE VLAN TAG TYPE VID ENTRY TYPE OWNER AGE ID SVC VTC SEP DMS DID CMDS MIRRORING INTERFACE
-----------------------------------------------------------------------------------------------------------------------------------------------------
00:94:a1:ab:cd:ef 3920 tag_type_vid 3920 tag_type_vid 3920 L2-LISTENER vm2b - 4095 9 - - - - 1 - -
02:94:a1:ab:cd:ee 3920 tag_type_vid 3920 tag_type_vid 3920 L2-LISTENER vm2b - 4095 9 - - - - 1 - -

f5-appliance-standby# show fdb
                                                                                          NDI
MAC ADDRESS VLAN TAG TYPE VLAN TAG TYPE VID ENTRY TYPE OWNER AGE ID SVC VTC SEP DMS DID CMDS MIRRORING INTERFACE
-----------------------------------------------------------------------------------------------------------------------------------------------------
00:94:a1:ab:ee:ef 3920 tag_type_vid 3920 tag_type_vid 3920 L2-LISTENER vm2a - 4095 9 - - - - 1 - -
02:94:a1:ab:cd:ee 3920 tag_type_vid 3920 tag_type_vid 3920 L2-LISTENER vm2a - 4095 9 - - - - 1 - -

Conditions:
On r5k/r10K/r12K systems where BIG-IP is configured in HA mode and MAC masquerading is addressed and configured, and F5OS is upgraded.

Impact:
Active and Standby act as if they are the owners of Floating MAC and IP.

Workaround:
From Standby system remove fdb entry from confd.
f5-appliance-standby# show fdb
                                                                                          NDI
MAC ADDRESS VLAN TAG TYPE VLAN TAG TYPE VID ENTRY TYPE OWNER AGE ID SVC VTC SEP DMS DID CMDS MIRRORING INTERFACE
-----------------------------------------------------------------------------------------------------------------------------------------------------
00:94:a1:ab:cd:ef 3920 tag_type_vid 3920 tag_type_vid 3920 L2-LISTENER vm2b - 4095 9 - - - - 1 - -
02:94:a1:ab:cd:ee 3920 tag_type_vid 3920 tag_type_vid 3920 L2-LISTENER vm2b - 4095 9 - - - - 1 - -

f5-appliance-standby(config)# no fdb mac-table entries entry 02:94:a1:ab:cd:ee 3920 tag_type_vid
f5-appliance-standby(config)# comm
Commit complete.

f5-appliance-standby# show fdb
                                                                                          NDI
MAC ADDRESS VLAN TAG TYPE VLAN TAG TYPE VID ENTRY TYPE OWNER AGE ID SVC VTC SEP DMS DID CMDS MIRRORING INTERFACE
-----------------------------------------------------------------------------------------------------------------------------------------------------
00:94:a1:ab:ee:ef 3920 tag_type_vid 3920 tag_type_vid 3920 L2-LISTENER vm2a - 4095 9 - - - - 1 - -

---

1330249-4 : Fastl4 can queue up too many packets

Links to More Info: BT1330249

Component: Local Traffic Manager

Symptoms:
-- Excessive xdata memory usage.
-- SOD may kill TMM for being unresponsive.

Conditions:
The issue occurs under the following conditions:
-- fastl4 profile in use.
-- rate-limit is used in virtual.
-- server-side gets stuck trying to connect.
-- lots of incoming clientside packets.

Impact:
Packets can be queued without limit. In the worst case, this can lead to memory exhaustion or SOD killing TMM as it tries to process the packet queue. Traffic is disrupted while TMM restarts.

Workaround:
Do not use rate-limit.

---

1329557-3 : The Attack Types and Violations reported in the incident do not match the incident subtype

Links to More Info: BT1329557

Component: Application Security Manager

Symptoms:
The Attack Types and Violations in the incident are computed incorrectly.

Conditions:
-- Event Correlation is enabled.
-- Incident is generated from the related requests.

Impact:
The incident generated shows incorrect Attack Types and Violations.

Workaround:
None

---

1329509-3 : TCL error 'ERR_VAL (line 1) invoked from within "HTTP::path"'.

Links to More Info: BT1329509

Component: Local Traffic Manager

Symptoms:
Under specific conditions, when the client accesses an HTTP(S) virtual server, an iRule execution error occurs. Client-side HTTP(S) connection is terminated by RST when an iRule execution error occurs.

  err tmm[xxxxx]: 01220001:3: TCL error: /Common/test-rule <HTTP_REQUEST> - ERR_VAL (line 1) invoked from within "HTTP::path"

Conditions:
This issue occurs under the following conditions:

-- HTTP::path command is used on an iRule.
-- The iRule is attached to an HTTP(S) virtual server.
-- Client's HTTP(S) request URI includes square bracket character, "[" (0x5b) or "]" (0x5d).
-- Client's HTTP(S) request URI includes only opening square bracket "[" or only closing square bracket "]", for example, "GET [ HTTP/1.0＼r＼n＼r＼n".

NOTE: When an explicit proxy is configured in the HTTP profile, a client request containing only an opening square bracket "[" will result in the BIG-IP responding with a 400 Bad Request error. In this case, the TCL error may not be visible.

Impact:
The iRule execution fails with a TCL error, as shown in the example below, and the client will receive a TCP RST from the virtual server when the iRule fails to execute.

  err tmm[xxxxx]: 01220001:3: TCL error: /Common/test-rule <HTTP_REQUEST> - ERR_VAL (line 1) invoked from within "HTTP::path"

Workaround:
Add "-normalized" command option to HTTP::path command.

ltm rule /Common/test-rule-normalized {
   when HTTP_REQUEST {
      if { [HTTP::path -normalized] contains "test" } {
         HTTP::respond 200 -content "OK !!!＼n"
      } else {
         HTTP::respond 200 -content "Hit ＼"else＼" statement !!!＼n"
      }
   }
}

Note: Adding the "-normalized" command option can change the URI, therefore it is highly recommended to thoroughly test and verify its behaviour before implementing the workaround in a production environment.

---

1328857-1 : GUI error when accessing hyperlink for associated gtm link object on a virtual server

Links to More Info: BT1328857

Component: Global Traffic Manager (DNS)

Symptoms:
GUI displays "An error has occurred while trying to process your request" while accessing gtm link object on a virtual server.

Conditions:
Trying to access gtm link object under LTM -> Virtual Servers -> virtual server properties.

Impact:
Unable to view gtm link information in GUI.

Workaround:
Modify links through dns -> gslb -> links

---

1327961-2 : EAM plugin crashes

Links to More Info: BT1327961

Component: Access Policy Manager

Symptoms:
EAM process was restarting and kept coring.
Suspecting this as key collision. The key is generated using ftok and isn't guaranteed to avoid collisions on a large box with 18 TMMs, which creates the opportunity for collisions (more shared memory in use).

Conditions:
Errors come across when EAM plugin intialisation
eam: shmget name:/var/run/tmm.mp.eam16, key:0xff14561e, size:7, total:789184 : Invalid argument

Impact:
Impacts functionality.

Workaround:
Fixed the problem by restarting the BIG-IP
The fact that a reboot clears the condition also supports this - the underlying inode being used to generate key is changed due to the a new version of the key file being created.

---

1327933-2 : 'tmsh show sys ip-address' command throws 'Syntax Error: Invalid IP address' error when address space is added

Links to More Info: BT1327933

Component: Access Policy Manager

Symptoms:
You may observe 'Syntax Error: Invalid IP address' error when you run

'tmsh show sys ip-address'

Conditions:
-Address space configured.

Impact:
Unable to run 'tmsh show sys ip-address'.

---

1327649-3 : Invalid certificate order within cert-chain associated to JWK configuration

Links to More Info: BT1327649

Component: TMOS

Symptoms:
An error occurs while validating the certificate and certificate chain in JSON web key configuration:

General error: 01071ca4:3: Invalid certificate order within cert-chain (/Common/mycert.crt) associated to JWK config (/Common/myjwk). in statement [SET TRANSACTION END]

Conditions:
Issue occurs when the certificate chain contains three or more certificates.

The proper order in issuing:
endpointchild
|
 endpoint
 |
  intermediate
   |
    ca

Impact:
You are unable to create a policy with key configuration for OAuth when the certificate chain contains more than two certificates.

Workaround:
Note that there is no impact when the certificate chain order is valid and contains only two certificates in the chain.

---

1327245-1 : Webhook notification for Apply Policy should be sent only from active devices

Component: Application Security Manager

Symptoms:
'Apply Policy' Webhook notification is being triggered from all devices with the webhook configured.

Conditions:
Configure policy and webhook

Impact:
Webhook notofications are being sent from all the devices.

Workaround:
None

---

1326797-4 : The Pool State of an offline pool with one or more user-disabled pool members depends on which pool member was marked down last by its monitor (non-deterministic behaviour)

Links to More Info: BT1326797

Component: Local Traffic Manager

Symptoms:
When you have two or more pool members with one pool member being administratively disabled and the other(s) being enabled, and all pool members are marked down by their monitor, the pool status depends on which pool member was marked down last.

Specifically:
- the disabled pool member is marked down by the monitor last - pool is in "offline/disabled-by-parent" state
- one of the enabled pool members are marked down by monitor last - pool is in "offline/enabled" state

Conditions:
- LTM pool configured with two or more pool members
- One pool member administratively disabled and the other(s) enabled
- All pool members marked down by their monitors

Impact:
When all the pool members are marked down by their monitors, the State of the pool depends on which pool member was last marked down by its monitor.

Workaround:
None

---

1325885-1 : TMM cores on BIG-IP

Links to More Info: BT1325885

Component: Local Traffic Manager

Symptoms:
The TMM is terminated and restarted by sod and a coredump has been generated.
Possible corruption of umem_alloc_1536 cache.
Provisioned Modules are AFM, CGNAT, and LTM.
Core is not created frequently.

Conditions:
There is no specific conditions noticed.

Impact:
TMM cores and restarted by sod interrupting provisioned functionalities. Traffic disruption can occur.

Workaround:
No workaround, but TMM gets restarted by sod after coring.

---

1325721-4 : Oauth not allowed for old tokens after upgrade to 15.1.9

Links to More Info: BT1325721

Component: Access Policy Manager

Symptoms:
Users are not able to access the Oauth old tokens after the fix for vulnerability that is, removal of hard coded encryption keys in Oauth.

Conditions:
Oauth feature with Opaque tokens configured and upgrade the version to 15.1.9 from previous versions.

Impact:
Not able to use old tokens

Workaround:
From 15.1.9 the Oauth old tokens that were generated and used in earlier versions will not work.

Due to the vulnerability CWE-798 the hard coded key encryption functionality usage has been removed and now the token generation will be dynamic so the old tokens which were used earlier are displayed as inactive when client runs a introspection.

Suggestive workaround is to use purge now option in UI. (Access > Overview > OAuth Reports > Tokens)
users have to remove the older tokens in oauthDB for every reboot.

---

1324777-2 : The get_file_from_link in F5::Utils::File should support HTTPS links also when proxy.host DB key is configured

Links to More Info: BT1324777

Component: Application Security Manager

Symptoms:
Import declarative policy is failing because of unsuccessful retrieval of the HTTPS external link for the open API file which is in use in the declarative policy, the response code 400 Bad Request is displayed.

Conditions:
The proxy server is in use and the proxy.host DB key is configured and the declarative policy is using an external HTTPS link for the open API file.

Impact:
Import declarative policy is failing.

Workaround:
Use a local file instead of using the external link.
For example, if you have a file “my_swagger_file.yaml”, you should use 'file-transfer' task to upload the Swagger file to the BIG-IP, and in the JSON policy it will be used like that:
"open-api-files": [
              {
              "link": "file://my_swagger_file.yaml"
              }
          ]

---

1322413-1 : After config sync, FQDN node status changes to Unknown/Unchecked on peer device

Links to More Info: BT1322413

Component: TMOS

Symptoms:
If changes are made to the FQDN node configuration, which has a node monitor configured, and the configuration is synced to a device group, ephemeral nodes generated from the FQDN node may show Availability as “unknown” and Monitor Status as “unchecked”.

Conditions:
This may occur on versions of BIG-IP with fixes for ID724824 and ID1006157, under the following conditions:
- BIG-IP systems are configured in a device group
- The device group is configured for Manual Sync (Full or Incremental)
- One or more FQDN nodes are configured with a node monitor (which could be the Default Node Monitor)
- A change is made to the configuration of the FQDN node
- A Full configuration sync is performed (by a Manual sync with the device group configured for a Full sync, as an automatic fallback/recovery action from a failed Incremental sync, or by using the “force-full-load-push” keyword):
   tmsh run cm config-sync to-group example-group force-full-load-push

Impact:
The affected nodes will be displayed with an Availability as “unknown” and Monitor Status as “unchecked”.

Workaround:
To resolve this condition, remove and add the node monitor:
- Remove the node monitor from the FQDN node configuration (or from default-node-monitor):
   tmsh mod ltm node example monitor none
   (tmsh mod ltm default-node-monitor rule none)
- Sync this change to the device group (Incremental sync)
- Add the node monitor again to the FQDN node configuration (or to default-node-monitor):
   tmsh mod ltm node example monitor my_node_monitor
   (tmsh mod ltm default-node-monitor rule my_node_monitor)
- Sync this change to the device group (Incremental sync)

---

1322117-4 : FastL4 TCP PVA accelerated connection might not be cleared until idle timeout.

Links to More Info: BT1322117

Component: Local Traffic Manager

Symptoms:
Connection where client is re-using the source port connecting to a server in TIME_WAIT might not be cleared immediately from BIG-IP connection table after the closure.

Conditions:
-- FastL4 PVA acceleration at Embryonic.
-- Client re-using 4-tuple, hitting server in TIME_WAIT.
-- Platform has ePVA (VE, r2xxx, r4xxx have no ePVA)

Impact:
Connection will remain in the BIG-IP connection table until idle-timeout is reached.

Workaround:
Set 'tcp-pva-whento-offload establish' on a fastl4 profile.

---

1319385-1 : Syncookies may always show as enabled if a listener address is changed while syncookies is on

Links to More Info: BT1319385

Component: TMOS

Symptoms:
Syncookies may always show as enabled if a listener source or destination address is changed while syncookies is on.

The stat epva_hwvipstat.fsu_rx_drops will be non zero when this occurs.

Conditions:
Syncookies on
Modifications to the source or destination address

Impact:
Syncookies will be disabled, but the virtual server status will show syncookies enabled.

---

1318625-1 : The gtm_add sync configuration is in the unintended direction with large GTM configuration

Links to More Info: BT1318625

Component: Global Traffic Manager (DNS)

Symptoms:
A wrong GTM configuration can be pushed to the sync group members after using the script gtm_add.

Conditions:
-- Race condition with large GTM configuration while performing gtm_add.
-- Following can be seen in GTM debug logs:

011a0200:7: MCP Message queued for resend. 1 backlogged messages.
.
.
.
011a0200:7:MCP Message queued for resend. 1125 backlogged messages.

Impact:
GTM devices are given the wrong or unintended configuration.

Workaround:
Before running gtm_add make the following changes on the gtm where you intend to execute the gtm_add command:
  - disable synchronization
  - disable synchronize-zone-files
  - change the synchronization group name to match the remote gtm

---

1318041-1 : Some OIDs using type as counter instead of expected type as gauge

Links to More Info: BT1318041

Component: TMOS

Symptoms:
While checking via SNMP commands there are number of OIDs in the MIBs that are reporting value as counter that should be gauge/integer

Conditions:
Using the following OIDs:

ltmDosAttackDataStatDropsRate
ltmDosAttackDataStatStatsRate
ltmNetworkAttackDataStatDropsRate
ltmNetworkAttackDataStatStatsRate
ltmVirtualServStatCsMeanConnDur

Impact:
Incorrect Type is seen for some OIDs.

Workaround:
None

---

1317929-1 : Updated ccmode script★

Links to More Info: BT1317929

Component: TMOS

Symptoms:
The existing ccmode script does not invoke the required script for system integrity validation.

Conditions:
Trigger the ccmode script

Impact:
Integrity validation does not occur.

Workaround:
None

---

1316821-1 : HTTP::disable not allowed after HTTP::respond

Links to More Info: BT1316821

Component: Local Traffic Manager

Symptoms:
Rule not processed and ltm logs shows this:
TCL error: /Common/connect-irule <HTTP_REQUEST> - Illegal value. HTTP::disable not supported when responding or retrying (line 1) invoked from within "HTTP::disable"

Conditions:
When an iRule has an HTTP::respond followed by an HTTP::disable, the disable is not allowed.

Impact:
iRule not processed.

Workaround:
N/A

---

1316621-1 : Custom headers and cookies are by default configured with base64 decoding enabled

Links to More Info: BT1316621

Component: Application Security Manager

Symptoms:
When custom headers and cookies are created in ASM, the decode_value_as_base64 flag is enabled by default.

Conditions:
A custom header or cookie is created

Impact:
Decode_value_as_base64 flag is enabled by default.

Workaround:
If base64 decoding is not required, then the flag decode_value_as_base64 has to be turned off manually after creating custom header/cookie

---

1316481-1 : Large CRL file update fails with memory allocation failure

Component: TMOS

Symptoms:
When updating a large CRL file in BIG-IP using tmsh, the file may be partially read due to internal memory allocation failure.

Please note that the size of the CRL file causing this issue varies across hardware types, network bandwidth and usage, and system resources.

Conditions:
1. Using tmsh, large CRL file is updated to an existing CRL.
2. This large CRL file is attached to multiple profiles.
3. The tmsh modify command is used multiple time in a short span of time that leads to the memory crunch.

Impact:
When large CRL file is attached to the profile which was partially read due to memory allocation failure, the profile gets successfully updated. Connections to VIP with this profile may have unexpected results. For e.g. client connecting to VIP with a revoked client certificate will succeed as the CRL was only partially read.

Workaround:
1. Dynamic CRL / CRLDP on client-ssl profile can be configured to dynamically verify SSL certificate revocation status.
2. OCSP can be enabled on client-ssl profile to validate SSL certificate revocation status.

---

1316113 : 1nic VE reloads on every reboot

Component: TMOS

Symptoms:
When Virtual Edition (VE) is configured for 1NIC, you will see the following logs on reboot indicating that configuration has been loaded from file:

 notice tmsh[12232]: 01420002:5: AUDIT - pid=12232 user=root folder=/Common module=(tmos)# status=[Command OK] cmd_data=load sys config partitions all base
 notice tmsh[12392]: 01420002:5: AUDIT - pid=12392 user=root folder=/Common module=(tmos)# status=[Command OK] cmd_data=load sys config partitions all

Conditions:
- VE configured in 1NIC mode.
- Unit booted either through reboot or power on.

Impact:
This is unlikely to have any impact if the VE is in standalone mode but could result in an unexpected config if the configuration files differ.

If the VE is part of a device-group, then this will result in a commit id update and the units will show 'Changes pending'.

Workaround:
None.

---

1314769-1 : The error "No Access" is displayed when trying to remove Bundle Manager object from list

Links to More Info: BT1314769

Component: TMOS

Symptoms:
The error "No Access" is displayed when trying to remove a Bundle Manager object from the list using GUI.

Conditions:
When the checkbox next to the Bundle Manager is checked and clicks the Delete button at the bottom of the page, then "No Access" error appears.

Impact:
Unable to delete a Bundle Manager.

Workaround:
The issue has following two workarounds:
- Click on the Bundle Manager and click Delete at the bottom.
or
- Delete the Bundle Manager from TMSH CLI.

---

1314597-3 : Connection on standby may stay until idle timeout when receiving ICMP error

Links to More Info: BT1314597

Component: Local Traffic Manager

Symptoms:
When a pool member server returns an ICMP error, connections will persist on standby while they have been terminated on active.

Conditions:
When an ICMP error such as port unreachable is returned by a pool member, the packet will be dropped by the standby while the active will process it immediately and terminate the connection.

Impact:
The connection will stay on the standby until the idle timeout expires.

Workaround:
Lower idle timeout will reduce the time before it vanishes.

---

1312225-1 : System Integrity Status: Invalid with some Engineering Hotfixes

Links to More Info: BT1312225

Component: TMOS

Symptoms:
After installing an Engineering Hotfix,
when to attempt to verify the TPM system integrity with either the "tpm-status" or "tmsh run sys integrity status-check" command, the following error massage may appear:
System Integrity Status: Invalid

Running the "tpm-status" command with a Verbosity of 1 (or greater) reveals the following detail:

Verifying system integrity...
...
The signature in 17 is valid
Output wrong commandline parameters
cmdline is *ro ima_hash=sha256 mce=ignore_ce *
The pcr value in 17 is invalid.
...
System Integrity Status: Invalid

Conditions:
This may occur if the Engineering Hotfix contains changes which cause the following packages to be included in the Engineering Hotfix ISO:
-- sirr-tmos
-- tboot
But the Engineering Hotfix ISO does not contain the following package:
-- nash-initrd

The contents of the Engineering Hotfix ISO can be checked using the 'isoinfo' utility:

isoinfo -Rf -i <path/to/Hotfix-*.iso> | grep -e sirr -e tboot -e nash

Impact:
The TPM System Integrity Status is shown as Invalid.
This may incorrectly suggest that system integrity has been compromised.

---

1312041-2 : Connection RST with reason "STREAM max match size exceeded" after upgrading to v16.1.x★

Links to More Info: BT1312041

Component: Local Traffic Manager

Symptoms:
After upgrading from version 15.1.8.2 to version 16.1.3.4, connections reset with reason "STREAM max match size exceeded"

Conditions:
1. Configure a virtual server with rewrite profile.
2. Configure an iRule with the stream profile.

Impact:
Connection resets causes traffic disturbance.

Workaround:
None

---

1311977-3 : IPsec interface mode tunnel not sending icmp unreachable fragmentation needed

Links to More Info: K000134901

Component: TMOS

Symptoms:
When the ESP packet is not fragmentable and too large for next hop interface, ICMPv4 unreachable (type 3 code 4) or IPv6 packet too large (type 2) is not generated by IPsec interface tunnel.

Conditions:
- When the ESP packet is not fragmentable.
- When the size of the packet is bigger than MTU.

Impact:
This issue causes data loss.

Workaround:
Https://my.f5.com/manage/s/article/K000134901

---

1311613-1 : UCS obtained from F5OS tenant with FPGA causes continuous TMM restarts when loaded to BIG-IP

Links to More Info: BT1311613

Component: TMOS

Symptoms:
TMM restarts continuously after loading a UCS file that was taken from an F5OS tenant with FPGA hardware.

Conditions:
The UCS is taken from an F5OS tenant with FPGA hardware (VELOS, r5k, r10k), and loaded to a non-F5OS tenant BIG-IP system (VE, vCMP guest, Hardware)

Impact:
Migrations or moving configurations across dissimilar platforms will not be successful.

Workaround:
Delete the file /config/tmm_velocity_init.tcl and reboot the device if necessary.

Use the following example command:

rm -fv /config/tmm_velocity_init.tcl

---

1311053-1 : Invalid response may be sent to a client when a http compression profile and http analytics profile attached to a virtual server

Links to More Info: BT1311053

Component: Local Traffic Manager

Symptoms:
The number 617 and a script is included in the beginning of an HTTP response that is sent to a client.

Conditions:
-- Both the http compression profile and http analytics profile are attached to a virtual server
-- The server replies with a chunked response

Impact:
An invalid HTTP response is sent to the client.

Workaround:
None

---

1309637-1 : Mac masquerade not working after VLAN movement on host interfaces

Links to More Info: BT1309637

Component: Local Traffic Manager

Symptoms:
Connectivity to the floating IP via the masquerade MAC fails when the VLAN is moved across interfaces.

Conditions:
-- BIG-IP is configured with a floating IP on a traffic group
-- MAC masquerade is enabled
-- The VLAN is assigned to a different interface

Impact:
Connectivity to the floating IP address fails following a failover.

Workaround:
After the VLAN movement, delete and reconfigure the MAC masquerade.

---

1308393-3 : Export security policy XML format fail with "too large and cannot be exported" message

Component: Application Security Manager

Symptoms:
Extremely large policies may fail to export in XML format.

Conditions:
This is caused when an extremely large security policy is exported in XML format.

Impact:
The policy cannot be exported in XML format.

Workaround:
The policy may be exported in Binary or JSON format.

---

1307385-3 : When blade replacement happens, signature config is lost in bigip.conf when IM is loading on a new blade

Links to More Info: BT1307385

Component: Protocol Inspection

Symptoms:
The bigip.conf file differs before and after blade replacement

Conditions:
It happens when one of the blades is replaced

Impact:
The bigip.conf does not list all the signatures added in the IM which is active

Workaround:
1) Try the command "tmsh save sys config"
2) If step 1 does not resolve the issue then try reloading the IM (Move to Factory Defaults IM and load the IM again). Then the bigip.conf will be updated with all the signatures supported by that IM)

---

1305609-4 : Missing cluster hearbeart packets in clusterd process and the blades temporarily leave the cluster

Links to More Info: BT1305609

Component: Local Traffic Manager

Symptoms:
If two or more clusterd processes experience a long HAL timeout communicating with chmand, then either of those clusterd process will report a lack of cluster heartbeart packets and one or more blades will leave the cluster.

Here are two example log messages that will occur when this issue is encountered.

   # slot 3 marking itself as failed because of a partition event where the heartbeat timeout only occurred on the mgmt_bp interface.
    err clusterd[21260]: 013a0004:3: Marking slot 3 SS_FAILED due to partition detected on mgmt_bp from peer 4 to local 3

    # slot 2 marking slot 1 as failed due to a lack of cluster packets from slot1 on both mgmt and tmm bp interfaces.
    err clusterd[29069]: 013a0004:3: Local slot 2: not getting clusterd pkts from slot 1; timed out on mgmt_bp and tmm_bp after 10 seconds. Marking peer slot 1 SS_FAILED

These messages are not unique to this bug. There are other bugs and conditions that can cause clusterd to stop sending/receiving heartbeat packets.

Conditions:
1) Multi-blade chassis with a minimum of 5 blades. More blades increases the chances of encountering this bug.

2) A condition that causes long HAL delays between clusterd and chmand. One condition of long HAL delays that is specific to 14.1.x and prior is a full config sync. However that condition was fixed in 15.1.0 and higher with the changes for ID 721020 and ID 746122.

Impact:
A blade will temporarily leave the cluster but then re-join unless ID 1273161 or something similar also occurs.

If the # of blades leaving the cluster causes the number of online blades to be less then the min-up-members, min-up-members-enabled is set to 'yes' and the chassis is Active a failover will occur.

Workaround:
None

---

1305117-1 : SSL profile "no-dtlsv1.2" option is left disabled while upgrading from v14.x or v15.x to 17.1.0★

Links to More Info: BT1305117

Component: TMOS

Symptoms:
Starting from 16.0.0, given DTLSv1.2 support, "no-dtlsv1.2" option is newly available on SSL profile. Default value is "no-dtlsv1.2" option enabled.

While upgrading from older version to 16.0.0 or later, by default "no-dtlsv1.2" option is to be automatically enabled with following notification message.

> bigip1 warning mcpd[XXXX]: 0107185a:4: Warning generated, for version 16.0.0 or greater : /Common/[SSL-profile-name], default option no-dtlsv1.2 set.

However, when user directly upgrades from v14.x/v15.x to v17.1.0, "no-dtlsv1.2" option may not be automatically enabled on SSL profile.

Conditions:
- roll-forward upgrade from v14.x/v15.x to v17.1.0. upgrade from v16.x to v17.1.0 is not affected.

- custom client|server-ssl profile configured on pre-upgrade version v14.x/v15.x

Impact:
After upgrade to 17.1.0, "no-dtlsv1.2" option may not be enabled on SSL profile.

Workaround:
After upgrade to 17.1.0, manually enable "no-dtlsv1.2" option.

---

1304801-1 : Sync Status: Disconnected. ARP replies suspected to be dropped at the innterface

Component: TMOS

Symptoms:
HA Sync Status is "Disconnected" and config sync fails.

Conditions:
ARP replies are not received by TMM in one of the devices in an HA pair.

Impact:
The devices will be in Disconnected state.

Workaround:
Disable and enable interfaces of trunks
or
delete and recreate trunks
or
bigstart restart bcm56xxd

---

1302101-1 : Sflow receiver flows are not established at TMM startup on sDAG platforms due to sDAG delay

Links to More Info: BT1302101

Component: TMOS

Symptoms:
No sflow data is sent.

Conditions:
Either configure a valid sflow receiver and restart the tmm or, configure a valid sflow receiver reachable via dynamic route on non sDAG platforms and restart the tmm.

Impact:
Sflow data is dropped.

Workaround:
Modify the receiver configuration (any field, including description). This allows triggering an update which will get sflow working.

---

1301897-4 : DAG transition does not complete when TMM starts in FORCED_OFFLINE mode

Links to More Info: BT1301897

Component: TMOS

Symptoms:
When TMM restarts with force-offline enabled, it comes up waiting for a dag_transition. It never completes because CDP proxy never comes up due to no active traffic group in FORCE_OFFLINE mode.

Conditions:
Restarting TMM with force-offline enabled.

Impact:
Tenants show high CPU and idle enforcer constantly starting or exiting.

Workaround:
Do not perform upgrade/restart in force-offline mode.

---

1301865-4 : OSPF summary might have incorrect cost when advertised by Standby unit.

Links to More Info: BT1301865

Component: TMOS

Symptoms:
OSPF summary might have incorrect cost when advertised by Standby unit.

Conditions:
- Other protocol redistribution into OSPF causing a summary route injection.

Impact:
Undesired traffic flow towards Standby unit.

Workaround:
Redistribute a summary route from static:

Use:
!
router ospf 1
 redistribute static metric-type 1
 network 10.10.10.0.32 0.0.0.255 area 0
!
ip route 192.168.0.0/16 Null


Instead of:
!
router ospf 1
 redistribute bgp metric-type 1
 network 10.10.10.0.32 0.0.0.255 area 0
 summary-address 192.168.0.0/16

---

1301317-1 : Update Check request using a proxy will fail if the proxy inserts a custom header

Links to More Info: BT1301317

Component: TMOS

Symptoms:
Update check fails.

Conditions:
-- Update check is checking for updates
-- A proxy is configured
-- The proxy inserts a header in its response

Impact:
Update check will fail.

Workaround:
Do not add any header in the proxy response.

---

1301081-1 : Changing partitions top dropdown does not work on chrome/edge on ASM list pages

Links to More Info: BT1301081

Component: Application Security Manager

Symptoms:
When you try to change the partitions in policies or bots lists, you cannot because the dropdown is disabled on Chrome and Edge.

Conditions:
1. Start v17.1.0.1 BIG-IP with ASM
2. Navigate to Security ›› Application Security : Security Policies : Policies List or to Security ›› Protocol Security : Security
Profiles : HTTP

Actual Results: you can't change the partition.
Expected Results: you can change the partition.

Impact:
Unable to change partition top dropdown on chrome/edge browser

Workaround:
Browse on Firefox, or in incognito mode in Chrome.

---

1300665-1 : ASMCSD memory leak if tsconfd.loglevel is set for debug level

Links to More Info: BT1300665

Component: Application Security Manager

Symptoms:
ASMCSD memory size continue to grow and consumes all the available memory and triggers OOM-Killer.

Conditions:
- Debug level set with tsconfd.loglevel

- Changes on policies

Impact:
Memory leak that eventually triggers OOM-Killer.

Workaround:
- Do not set debug with tsconfd.loglevel to avoid the memory leak.

- Restart ASMCSD to clear the memory if the memory leak has been created and the system suffers from memory pressure.

---

1298225-2 : Avrd generates core when dcd becomes unavailable due to some reason

Links to More Info: BT1298225

Component: Application Visibility and Reporting

Symptoms:
Avrd core file generates.

Conditions:
When avrd is writing to the external device and that device is unavailable temporarily.

Impact:
Potential system impact.

Workaround:
None

---

1298133-4 : BFD sessions using floating self IP do not work well on multi-blade chassis and HA environments.

Links to More Info: BT1298133

Component: TMOS

Symptoms:
BFD (Bi-directional Forwarding Detection) sessions using a floating self IP do not work well on multi-blade chassis and HA environments.. In an event of failure on a standby unit sessions might become unstable on an active unit.

Conditions:
- BIG-IP configured in high availability (HA) setup.
- BFD sessions configured from floating self IPs.
- Failover is triggered; OR
- Standby blade experiences any sort of failure. For example, tmm/tmrouted crash; cmp transistion.

Impact:
Standby BIG-IP might start sending BFD packets causing BFD session flaps on an active unit.

Workaround:
Restart tmrouted on a BIG-IP that is incorrectly sending BFD packets.

---

1297521-1 : Full sync failure for traffic-matching-criteria with port list update on existing object in certain conditions

Component: Local Traffic Manager

Symptoms:
Performing a full configuration sync with traffic-matching-criteria (TMC) under specific conditions fails with errors similar to:

err mcpd[5781]: 01070710:3: Database error (13), Cannot update_indexes/checkpoint DB object, class:traffic_matching_criteria_port_update status:13 - EdbCfgObj.cpp, line 127.
err mcpd[5781]: 01071488:3: Remote transaction for device group /Common/HA to commit id 41 failed with error 01070710:3: Database error (13), Cannot update_indexes/checkpoint DB object, class:traffic_matching_criteria_port_update status:13 - EdbCfgObj.cpp, line 127..

Conditions:
This may occur on a full-load config sync (not an incremental sync)
Both Active and Standby on sync already
- a traffic-matching-criteria is attached to a virtual server
- the traffic-matching-criteria is using a port-list
- Update the port list (Add new port in the existing list)
Ex:
tmsh modify net port-list /Common/<> { ports replace-all-with { 80 { } 83 { } 84 { } } port-lists none }

Assume port list already with 80,83 and adding new port 84 in the list.

NOTE: No issue observed when we try to update the list with removing the port from the list.

Impact:
Unable to sync configurations.

Workaround:
None

---

1296925-1 : Unable to create two boot locations using the 'ALL' F5OS tenant image at default storage size

Links to More Info: BT1296925

Component: TMOS

Symptoms:
Configuration fails to load in second boot location created in F5OS tenant deployed with "ALL" image:

01071008:3: Provisioning failed with error 1 - 'Disk limit exceeded. 16188 MB are required to provision these modules, but only 16028 MB are available.'

Conditions:
-- Tenant deployed using the "ALL" image, with default "storage size"
-- Multiple modules provisioned (e.g. AFM+APM+ASM+LTM), or AFM provisioned
-- Create a second boot location

Impact:
This issue causes a configuration load failure in the second boot location.

Workaround:
Set the tenant(s) in question to configured state, increase the "storage size", then deploy the tenant once more.

---

1296409-3 : TMM cored in ping access hudfilter due to ctx pointed to invalid address

Links to More Info: BT1296409

Component: Access Policy Manager

Symptoms:
In the pingaccess, when the HUDCTL_TEARDOWN arrives and is forwarded synchronously down the chain, this causes the flow to be removed and the chain to be torn down. This also causes the CLIENT_CLOSED to be called.

Coincidentally customer has iRule, and happens to need a block matching the size of the just-freed block containing ctx, thus the freed ctx is overwritten with the log message generated due to the debugging TCL variable being "1".

Upon reaching lower filters, the pingaccess attempts to call pmgr_service_update_last_active where the issue occurred.

This issue can be seen in the 1001041 bug.

Conditions:
APM provisioned. Using multiple ping access instances, the
Ping access feature is mainly used for SSO.

Impact:
Unexpected failover occurred which impacted accessing applications.

Workaround:
None

---

1295353-1 : The vCMP guest is not sending HTTP flow samples to sFlow receiver

Links to More Info: BT1295353

Component: TMOS

Symptoms:
The vCMP clusters without configured slot-specific management-IP addresses will report 0.0.0.0 for: sFlow (Agent Address) resulted in missing HTTP flow samples to sFlow receiver.

Conditions:
- vCMP guest deployed on a chassis with only Cluster IP set, and no individual blade IP addresses configured.
- Configured with an available sFlow receiver.

Impact:
No monitoring information as there were no HTTP flow samples.

Workaround:
- Configure cluster blade IP addresses. For example, to set the slot-specific management IP address on a vCMP guest which runs on a single slot, use a command similar to the following:

tmsh modify sys cluster default members { 1 { address 198.51.100.2 } }

- The HTTP flow samples will be available on a vCMP guest.

---

1295217-2 : When provision.1nic is set to forced_enable the mgmt interface does not respond to ICMP

Links to More Info: BT1295217

Component: TMOS

Symptoms:
When provision.1nic is set to forced_enable the mgmt interface does not respond to ping requests or other ICMP messages.

Conditions:
Provision.1nic is set to forced_enable

Impact:
Not able to ping the mgmt interface.

Workaround:
/sbin/iptables -t raw -I vadc_rawsock_in -p icmp -j ACCEPT

---

1295113-1 : LACP Mode is always ACTIVE even though it is configured PASSIVE on the Host on R2x00/R4x00/R5x00/R10x00

Links to More Info: BT1295113

Component: F5OS Messaging Agent

Symptoms:
For an LACP interface configured on the platform LACP mode is always shown as ACTIVE even though it is configured as PASSIVE on the platform.

Conditions:
When the LACP interface is configured on the platform and associated with a VLAN and a tenant is launched with the same VLAN.

Impact:
This is more of a show issue, There is no impact on the datapath or functionality as LACP mode is a configuration used when LACP protocol is running. For a tenant on Rx00 platforms, LACP protocol runs on the platform but not in the tenant.

Workaround:
None

---

1294905-1 : Charts data is not populating in security analytics default view page.

Component: Application Visibility and Reporting

Symptoms:
Charts always show "Please wait, data is loading...".

Conditions:
Deploy and configure BIG-IP with virtual server and ASM policy
Navigate to Security ›› Overview : Analytics

Impact:
The default chart graph is not displaying properly.

Workaround:
Change the duration settings to hourly/daily data

---

1294709 : SSL Orchestrator ICAP service changes do not propagate to the GUI/CLI

Links to More Info: BT1294709

Component: SSL Orchestrator

Symptoms:
After changing settings for an existing ICAP service and deploying through SSL Orchestrator, the new changes are not reflected in the ICAP profiles visible through either the GUI or tmsh.

Conditions:
Trying to change settings for an existing ICAP service using SSL Orchestrator

Impact:
You are unable to change ICAP service settings through SSL Orchestrator.

Workaround:
Before deploying the changes, first click "Preview Merge Config". Then after clicking "Deploy", tick the additional "Overwrite Changes" box, and click "Deploy".

---

1294141-1 : ASM Resources Reporting graph displays over 1000% CPU usage

Links to More Info: BT1294141

Component: Application Visibility and Reporting

Symptoms:
The ASM resources graph which is present under Security > Reporting > ASM Resources > CPU Utilization displays over 1000% CPU usage when ASM is under load. The unit is percentage so it should be below 100.

Conditions:
- ASM should be under load and utilizing most of CPU cycles.

Impact:
Reporting graph displays incorrect percent value.

Workaround:
None

---

1294113-3 : During a DNS attack, summary log shows no attack ID

Links to More Info: BT1294113

Component: Application Visibility and Reporting

Symptoms:
During a DNS attack, the summary log file shows Dos_attack_id="0", instead of the attack ID of the active attack.

Conditions:
An active DNS attack.

Impact:
Summary log files are not correctly identifying an active attack.

Workaround:
No Workaround

---

1292273-2 : SNAT command in iRule fails to convert ICMPv6 requests to ICMPv4

Links to More Info: BT1292273

Component: Carrier-Grade NAT

Symptoms:
When the SNAT command is used in an iRule, ICMPv6 echo requests cannot be translated to an ICMP echo requests when nat64 is enabled on the virtual server. The snat pool in server side contains the IPV4 addresses.

Conditions:
-- Enable nat64 on a virtual server
-- Configure a SNAT pool.
-- Use "snat" command in an iRule.

Impact:
NAT64 translation does not occur which leads to traffic failure.

Workaround:
Do not use "snat" for selecting a pool member in an iRule.

---

1291121-1 : BIG-IP tenants on F5OS r5000, r10000, and r12000 platforms don't pass traffic properly while in forced offline state

Links to More Info: BT1291121

Component: TMOS

Symptoms:
Monitors may flap. Connections generated from the tenant will succeed and others will fail.

The ConfigSync status for a tenant that is forced offline will report disconnected.

Conditions:
BIG-IP tenant running on r5000, r10000, and r12000-series appliances.

Note: F5OS tenants on VELOS chassis will not pass traffic while the tenant is forced offline, but that behavior is not tracked by this ID. For more information, see K15122: Overview of the Force Offline option for devices and traffic groups (https://my.f5.com/manage/s/article/K15122)

Impact:
Traffic to/from the tenant does not work properly when the tenant is forced offline, although the behavior can be intermittent.

Workaround:
None

---

1290937-1 : 'contentWindow' of a dynamically genereated iframe becomes null

Component: Access Policy Manager

Symptoms:
A web application using iframes may not work/render as expected using Portal Access.

Conditions:
A web application attempts to configure 'contentWindow' for an iframe while the Portal Access feature is in use.

Impact:
Web Application through Portal Access may fails to work/render as expected

Workaround:
Workaround: Using a customized irule/ifile to return un-patched 'contentWindow' from cache-fm*.js file. ifile has modern cache-fm file.

when CLIENT_ACCEPTED {
  ACCESS::restrict_irule_events disable
}

when HTTP_REQUEST {
 if {
   [HTTP::path] ends_with "/cache-fm-Modern.js"
 } {
   HTTP::respond 200 content [ifile get cachefmUploadIssueWorkaround]
 }
}

---

1289009-1 : PA based Hosted content does not add implicit allowed ACL

Links to More Info: BT1289009

Component: Access Policy Manager

Symptoms:
Unable to download the hosted content from Portal Access.

Conditions:
ACLs with a default deny or reject rule

Impact:
Hosted content files are denied by ACL

Workaround:
Add 2 L4 ACLs similar to the rules below:
apm acl /Common/allow-hostedcontent {
   acl-order 20
   entries {
       {
           action allow
           dst-end-port 8080
           dst-start-port 8080
           dst-subnet ::1/128
           log packet
           protocol 6
           src-subnet 0.0.0.0/0
       }

       {
           action allow
           dst-end-port 8080
           dst-start-port 8080
           dst-subnet 127.1.1.0/24
           log packet
           protocol 6
           src-subnet 0.0.0.0/0
       }
   }

---

1288009-4 : Vxlan tunnel end point routed through the tunnel will cause a tmm crash

Links to More Info: BT1288009

Component: TMOS

Symptoms:
Tmm generates a core file and restarts

Conditions:
A vxlan tunnel is configured and there is a route for the remote end point via the tunnel itself

Impact:
Traffic disrupted while tmm restarts.

Workaround:
Do not route the tunnel endpoint through the tunnel.

---

1284589-1 : HTTP CONNECT request from client is not successful with the iRule 'HTTP::disable discard' command

Links to More Info: BT1284589

Component: Local Traffic Manager

Symptoms:
When you use the 'HTTP::disable discard' command in an irule to switch to HTTP transparent passthrough mode, the proxy connect / connection to server is not established.

This only occurs when the 'HTTP::disable' command is used with the additional 'discard' option (which discards the existing HTTP headers before switching to passthrough mode)

Refer https://clouddocs.f5.com/api/irules/HTTP__disable.html

Conditions:
-> Basic HTTP VS
-> iRule
when HTTP_REQUEST {
HTTP::disable discard
node <ip port>
}

Impact:
Client requests containing the HTTP CONNECT method hang (data is not proxied to the serverside flow)

Workaround:
Use 'HTTP::disable' command (without the 'discard' option)

---

1284413-3 : After upgrade to 16.1.3.2 from 16.0.1.1, BIG-IP can send CONNECT requests when no proxy select agent is used★

Links to More Info: BT1284413

Component: Local Traffic Manager

Symptoms:
BIG-IP uses a CONNECT to forward requests regardless of the PRP branch in use.

Conditions:
-- Configure BIG-IP as Explicit Forward proxy with SSL Orchestrator or SWG.
-- Configure an access policy and a prp and apply to the forwarding Virtual Server.
-- In the PRP, use multiple branches where one branch contains a proxy select agent, and another branch does not.

Impact:
Requests fail intermittently

Workaround:
None

---

1283749-1 : Systemctl start and restart fail to start the vmtoolsd service

Links to More Info: BT1283749

Component: TMOS

Symptoms:
Because of a non-existent dependency, systemctl start and restart failed to start the vmtoolsd service.

Following is the reported error:

# systemctl restart vmtoolsd.service
Failed to restart vmtoolsd.service: Unit not found.

systetmctl stop is not affected.

Conditions:
BIG-IP VE on VMware.

Impact:
Unable to start/restart the vmtoolsd service.

Workaround:
Systemctl restart --ignore-dependencies vmtoolsd.service

or

systemctl start --ignore-dependencies vmtoolsd.service

---

1283721-1 : Vmtoolsd memory leak

Links to More Info: BT1283721

Component: TMOS

Symptoms:
The Vmtoolsd service leaks memory on VMware BIG-IP VE guests when the Disk Type is IDE or any disk type other than SCSI.

Conditions:
VMware BIG-IP VE guest
Disk type of IDE or another type that is not SCSI.

Impact:
The VE will eventually run out of memory.

Workaround:
1. Create the file /etc/vmware-tools/tools.conf and add the following to the file:

[guestinfo]

# disable scan for disk device info
diskinfo-report-device=false


2. Restart the vmtoolsd service:

systemctl restart --ignore-dependencies vmtoolsd.service

NB "guestinfo" must be in lower case. The workaround will not work if any letter is not lower case including the following "guestInfo" which was the reported workaround in https://github.com/vmware/open-vm-tools/issues/452

---

1282769-1 : Localdb user can change the password of other user

Component: Access Policy Manager

Symptoms:
The user was able to change the password for another user in the logon page, when local DB authentication was used.

Conditions:
-- At least one user in the local DB instance is forced to change the password
-- the virtual server is tied in with the trusted CA certificates (that is, it would not happen if the virtual server for the SSL-VPN is associated with self-signed certificates).

Impact:
User authentication based on local DB will be impacted.

Workaround:
None

---

1282421-2 : IS-IS protocol may discard Multi-Topology Reachable IPv6 Prefixes

Links to More Info: BT1282421

Component: TMOS

Symptoms:
IS-IS protocol on the BIG-IP might discard some Multi-Topology Reachable IPv6 Prefixes.

Conditions:
This happens when the IS-IS device in the BIG-IP system is peering with RFC 7794 support for sub-TLVs.

Impact:
Some prefixes are incorrectly installed in a routing table.

Workaround:
None

---

1281433-1 : Missing GTM probes on GTM server when an external monitor is attached to an additional pool

Links to More Info: BT1281433

Component: Global Traffic Manager (DNS)

Symptoms:
Incorrect probe behavior when an external monitor is attached to an additional pool.

Conditions:
On a GTM sync group, try to attach an external monitor to an additional pool.

Impact:
Incorrect GTM server monitoring.

Workaround:
None

---

1281405-2 : "fipsutil fwcheck -f" command may not correct result

Component: Local Traffic Manager

Symptoms:
The "fipsutil fwcheck -f" command output shows as "Firmware upgrade available." even though now Firmware upgrade is not needed.

Conditions:
All FIPS platforms.

Impact:
Only a display issue with no functional impact. If we try to make a firmware upgrade, it may not work.

Workaround:
Use the command without the "-f" option like "fipsutil fwcheck".

---

1280813-3 : 'Illegal URL' violation may trigger after upgrade

Links to More Info: BT1280813

Component: Application Security Manager

Symptoms:
Illegal URL violation is triggered for Allowed URL(s).

Conditions:
The conditions that trigger this issue post-upgrade are unknown at this time and the occurrence is rare.

Impact:
Requests get blocked with an 'Illegal URL' violation despite the it being defined as an Allowed URL because the URL object's Content-Profile reference does not get inserted and is missing in the MySQL database post-upgrade.

Workaround:
- Delete the problematic URL within the 'Security ›› Application Security : URLs : Allowed URLs : Allowed HTTP URLs' section in Configuration Utility.
- Re-create the URL again.
- Save the changes with the 'Apply Policy' task.

---

1280141-1 : Platform agent to log license info when received from platform

Links to More Info: BT1280141

Component: F5OS Messaging Agent

Symptoms:
Platform agent to add log to print license info on activated/reinstalled for debuggability.

Conditions:
License activated or reinstalled on platform.

Impact:
No impact

Workaround:
None

---

1277641 : DoS | i-series | After mitigation of bad destination at profile level, bd_hit is not incrementing for host unreachable vector.

Component: Advanced Firewall Manager

Symptoms:
This is specific to iseries platform.
bd related DoS stats are incrementing but SPVA stat of bd_hit is not incremented.

Conditions:
Sending an ipv6 host unreachable traffic to iseries.

Impact:
You can see the dos stats but not in spva stats.

Workaround:
You can see the stats in dos table.

---

1277389-2 : HSB transmitter lockup

Links to More Info: BT1277389

Component: TMOS

Symptoms:
Packets aren't received on the software rx side leading to traffic loss

Conditions:
Unknown

Impact:
HSB lockup with SIGFPE TMM core. Traffic disrupted while tmm restarts.

Workaround:
None

---

1274385-1 : BIGIP-DNS GUI delivery summary stats shows incorrect count for "Disabled" GTM listeners

Links to More Info: BT1274385

Component: Global Traffic Manager (DNS)

Symptoms:
Statistics >> Module Stats >> DNS >> Delivery >> Summary - shows the incorrect count for "Disabled" GTM listeners.

Conditions:
One or more virtual servers (which may or may not be GTM (DNS) listeners) exist on the BIG-IP device which are in a disabled state.

These virtual servers incorrectly count towards the count of "Disabled" virtual servers in the GTM Listeners statistics.

Impact:
Unexpected "Disabled" count in the GTM Listeners line in the DNS stats table (in any of the columns)

---

1273161-4 : Secondary blades are unavailable, clusterd is reporting shutdown, and waiting for other blades

Links to More Info: BT1273161

Component: Local Traffic Manager

Symptoms:
On a multi-slot chassis, VCMP guest, or F5OS tenant, clusterd can enter a shutdown state causing some slots to become unavailable.

The event that can cause this is called a partition and occurs when clusterd stops receiving heartbeat packets from a slot over the mgmt_bp interface but is still receiving them over the tmm_bp interface.

Here is the error that is logged when this occurs:

Mar 17 10:38:28 localhost err clusterd[4732]: 013a0004:3: Marking slot 1 SS_FAILED due to partition detected on mgmt_bp from peer 2 to local 1

When this occurs, clusterd enters a shutdown state and at times will never recover.

Here is an example, tmsh show sys cluster command where clusterd is in the shutdown yet waiting state:

-----------------------------------------
Sys::Cluster: default
-----------------------------------------
Address 172.0.0.160/23
Alt-Address ::
Availability available
State enabled
Reason Cluster Enabled
Primary Slot ID 2
Primary Selection Time 03/17/23 10:38:30

  ----------------------------------------------------------------------------------
  | Sys::Cluster Members
  | ID Address Alt-Address Availability State Licensed HA Clusterd Reason
  ----------------------------------------------------------------------------------
  | 1 :: :: unknown enabled false unknown shutdown ShutDown: default/1 waiting for blade 2
  | 2 :: :: available enabled true standby running Run

Conditions:
Multi-slot chassis, VCMP guest, or F5OS tenant.
A blade determines there is a partition where it's receiving cluster packets over the tmm_bp interface but not the mgmt_bp interface.

Impact:
The unavailable slots/blades will not accept traffic.

Workaround:
Running tmsh show sys cluster will report the primary slot and all slot statuses.

For all blades reporting shutdown or (less likely) initializing and "waiting for blade(s)", restart clusterd on that slot with bigstart restart clusterd. Ensure you do not restart clusterd on the primary slot.

---

1273141-1 : GTM pool members are not probed and multiple GTMs are reporting inconsistent status

Links to More Info: BT1273141

Component: Global Traffic Manager (DNS)

Symptoms:
GTM pool members are not probed and multiple GTMs in the same GTM syncgroup report inconsistent status.

Conditions:
1. Create a GTM pool with a pool member disabled.
2. Create another GTM pool with same monitor and pool member as in the previous GTM pool.

Impact:
GTM pool members are marked incorrect status and inconsistent across GTMs.

Workaround:
Use the following command:

# tmsh modify gtm global-settings general monitor-disabled-objects yes

or

Use a unique monitor names for pools that has disabled pool members.

---

1271941-2 : Tomcat CPU utilization increased after upgrading to 15.1.6 and higher versions.★

Links to More Info: BT1271941

Component: TMOS

Symptoms:
Tomcat CPU utilization is high after upgrading to BIG-IP 15.1.6, java garbage collector is running high. Tomcat needs more memory after upgrading OpenJDK.

Conditions:
- Upgrade from BIG-IP 15.1.5 and earlier versions to BIG-IP 15.1.6 and higher versions.

Impact:
Tomcat server runs in an unstable state as CPU utilization is abnormal.

Workaround:
Increase the cores or CPUs of the BIG-IP for the VE / VCMP.
In most cases, it is not necessary to increase the number of CPU cores.

---

1271469-5 : Failed to install ASU file scheduled for install

Links to More Info: BT1271469

Component: Application Security Manager

Symptoms:
Live Update installation scheduled for installation for any specific day at time 12:01 AM to 12:14 AM will fail.

Conditions:
- ASU file installation scheduled at 12:01 AM to 12:14 AM (not automatic or manual installation).

Impact:
BIG-IP will not get latest ASU file updates.

Workaround:
Set the installation time after 12:15 AM.

---

1271341-3 : Unable to use DTLS without TMM crashing

Links to More Info: BT1271341

Component: Local Traffic Manager

Symptoms:
The TMM crashes when DTLS is used.

Conditions:
- Using DTLS.

Impact:
TMM core is observed, traffic is disrupted while TMM restarts.

Workaround:
Disable 'allow-dynamic-record-sizing' in the client-ssl profile.


Following is an example:

ltm profile client-ssl /Common/otters-ssl {
    allow-dynamic-record-sizing disabled

---

1270989-1 : REST MemcachedClient uses fixed TMM address 127.1.1.2 to connect to memcached

Links to More Info: BT1270989

Component: TMOS

Symptoms:
The RESTcurl command "restcurl -u admin:admin /mgmt/tm/access/session/kill-sessions" returns a "no route to host" error.

Conditions:
Run RESTcurl commands from a vCMP guest to try to kill the session.

Impact:
Attempting to kill sessions returns a 400 - "no route to host error" error.

Workaround:
None

---

1269601-1 : Unable to delete monitor while updating DNS virtual server monitor through transaction

Links to More Info: BT1269601

Component: Global Traffic Manager (DNS)

Symptoms:
Unable to delete monitor while updating DNS virtual server monitor through transaction.

Following message displays:

Command added to the current transaction
Command added to the current transaction
transaction failed: 01070083:3: Monitor /Common/tcp_test is in use.

Conditions:
Using transaction of updating the virtual server monitor and deleting the earlier monitor which was untagged currently.

Following is an example:

echo 'create cli transaction; modify /gtm server generc_serv_test virtual-servers modify { test { monitor none }}; delete /gtm monitor tcp tcp_test; submit cli transaction' | tmsh

Impact:
Unable to delete the monitor.

Workaround:
None

---

1268373-6 : MRF flow tear down can fill up the hudq causing leaks

Links to More Info: BT1268373

Component: Service Provider

Symptoms:
TMM Memory leaks are observed when MRF flows were torn down at once and the hud queue was full.

Conditions:
When the message queue becomes full.

Impact:
TMM memory leak

Workaround:
None

---

1267845-5 : ISC's internal_current function asserted because ifa_name was NULL

Links to More Info: BT1267845

Component: Global Traffic Manager (DNS)

Symptoms:
Named restarting.

Conditions:
- MCPD is down, resulting the service restart.
- The slot interfaces are down.
- During restart named unable to find the interface and asserting.

Impact:
No Impact, this issue occurs when the services are restarting.

Workaround:
None

---

1267269-2 : The wr_urldbd crashes and generates a core file

Links to More Info: BT1267269

Component: Policy Enforcement Manager

Symptoms:
The wr_urldbd crashes and generates a core file.

Conditions:
The munmap function does cross mapping boundaries and it does not fail if the requested unmap contains unmapped memory, i.e. the unmapped segment does not have to be fully mapped

Impact:
Service is interrupted for few minutes and classification does not happen.

Workaround:
None

---

1256757-2 : Suspect keymgmtd memory leak while using dynamic CRL.

Links to More Info: BT1256757

Component: TMOS

Symptoms:
keymagmtd's memory size steadily increases. Specifically, in the emdeviced memory size.

Conditions:
CRL validation is enabled

Impact:
keymgmtd might crash due to out of memory conditions.

Workaround:
Need to reboot the machine to reset the memory usage.

---

1253449-4 : After publishing, the draft LTM policy configuration might not be updated (intermittently) into the bigip.conf

Links to More Info: BT1253449

Component: TMOS

Symptoms:
Publishing LTM draft policy and "save config" operations are not atomic, hence there exists a race condition. When the latter happens first, then the issue is observed otherwise the LTM draft policy is successfully updated into the bigip.conf file.

Conditions:
- Execute the command "tmsh load /sys config current-partition" or the existing system configuration is loaded from bigip.conf after publishing the draft LTM policy.

Impact:
Published LTM draft policies are reverted to the draft state.

Workaround:
Perform any of the below-mentioned steps immediately after successfully publishing an LTM draft policy:

- Execute the command "tmsh save /sys config current-partition" on the BIG-IP shell.

or

Execute curl -sku $COLON_SEPARATED_USERNAME_PASSWORD https://$HOST/mgmt/tm/sys/config/ -X POST -H "Content-type: application/json" -d '{"command":"save"}'

or

Execute curl -sku $COLON_SEPARATED_USERNAME_PASSWORD https://$HOST/mgmt/tm/util/bash -X POST -H "Content-type: application/json" -d '{"command":"run", "utilCmdArgs":"-c ＼"tmsh save sys config current-partition＼""}'

---

1251105-1 : DoS Overview (non-HTTP) - A null pointer was passed into a function

Links to More Info: BT1251105

Component: Advanced Firewall Manager

Symptoms:
In BIG-IP version all 15.1 builds, when protected object filter is selected in Security > DoS overview page, it displays following error:

Error : DoS Overview (non-HTTP) - A null pointer was passed into a function

Schema changes updated in BIG-IP version 15.1.8 which added context_name and context_type to the mcp_network_attack_data_stat_t structure used to report DoS attack stats.

The MCP code that fills in these fields in the structure when responding to the stats request was not inculded, thus an attempt to get the stats, result in detection of a NULL pointer.

Conditions:
Configure a protection profile.
Create a protected object by attaching the protection profile.
Select protected object filter in DoS Overview (non-HTTP) page.

Impact:
This issue avoids usage of GUI partially.

Workaround:
None

---

1249929-2 : Diameter MRF sends CER to pool-member even after peer sent DPR and force-offline the pool member

Links to More Info: BT1249929

Component: Service Provider

Symptoms:
If Disconnect Peer Action is configured to force-offline and when server peer sends Disconnect Peer Request (DPR), then MRF force-offline the pool-member as expected. However, MRF continues to send CER towards pool member, which means MRF is trying to connect the forced-offline peer and also it sends DPR towards pool member.

Conditions:
In diameter session profile, Disconnect Peer Action is configured to force-offline.

Impact:
Unnecessary CER and DPR messages towards down pool member.

Workaround:
Set auto-initialization to disabled in diameter peer if it does agree with the requirement.

---

1239297 : TMM URL web scraping limit not synced to secondary slot 2 in VIPRION chassis

Links to More Info: BT1239297

Component: Application Security Manager

Symptoms:
Web scraping requests will pass even when the threshold is reached in High Availability (HA) configuration. Some packets are blocked, while some others are passed.

Conditions:
Configure web scraping micro services in high availability (HA) mode in some F5 hardware. Send web scraping requests and check if they are blocked.

Impact:
Web scraping requests can pass even when the requests threshold is reached.

Workaround:
None

---

1238897-1 : TMM TCL interpreter's non-TMM "compat" memcasechr broken in 64-bit build

Links to More Info: BT1238897

Component: Local Traffic Manager

Symptoms:
The TMM's base TCL interpreter (tmm_tcl) is used both in TMM and in non-TMM environments like APMD. The TMM has it's own implementation of memcasechr which is preferred to the "compat" implementation in the TCL interpreter itself as TMM statically links tmm_tcl while non-TMM usage is dynamically linked.

Conditions:
Following VPE rule does not work (option -nocase):

expr {[string first -nocase "bid" [mcget {session.oauth.scope.last.jwt.scope}]] >= 0}

Impact:
The memcasechr is broken in 64-bit build.

Following VPE rule does not work (option -nocase):

expr {[string first -nocase "bid" [mcget {session.oauth.scope.last.jwt.scope}]] >= 0}

Workaround:
Change the VPE rule to the following:

expr {[string first -nocase "bid" [mcget {session.oauth.scope.last.jwt.scope}]] >= 0}

---

1231889-4 : Mismatched VLAN names (or VLANs in non-Common partitions) do not work properly BIG-IP tenants running on r2000 / r4000-series appliances

Links to More Info: BT1231889

Component: Local Traffic Manager

Symptoms:
When a VLAN configured in the tenant does not have the same name as the VLAN on in F5OS or the VLAN in the tenant is created in a partition other than "Common", VLANs may not pass traffic properly without manual configuration.

If any such VLANs exist, newly-configured VLANs may also exhibit this issue, even if the VLAN is in Common and has a name that matches the name in F5OS.

The system will have log messages similar to the following; these errors will still occur even once the workaround has been applied.

Feb 15 15:39:49 r4000-1.example.com err mcpd[19522]: 01070094:3: Referenced vlan (/Common/external) is hidden, does not exist, or is already on another instance.
Feb 15 15:39:49 r4000-1.example.com err chmand[19520]: 012a0003:3: hal_mcp_process_error: result_code=0x1070094 for result_operation=eom result_type=eom


Tenants running on an r2000 or r4000-series appliance need to know the VLAN<>interface associations, but the system is not able to populate this information when the VLAN is not in the Common partition. VLANs may not have any 'interfaces' referenced, or will have 'interfaces' that are not in-sync with the configuration on the F5OS host. For example:

R2000# show running-config interfaces interface LAG; show running-config vlans vlan 47
interfaces interface LAG
 config type ieee8023adLag
 config description ""
 aggregation config lag-type LACP
 aggregation config distribution-hash src-dst-ipport
 aggregation switched-vlan config trunk-vlans [ 42 47 ]
!
vlans vlan 47
 config vlan-id 47
 config name vlan_47
!

R2000#

[root@tenant:Active:Standalone] config # tmsh list net vlan /ottersPart/vlan_47
net vlan /ottersPart/vlan_47 {
    dag-adjustment none
    if-index 240 # <-- interfaces is not listed
    partition ottersPart
    [...]
    tag 47
}
[root@tenant:Active:Standalone] config #




[root@tenant:Active:Standalone] config # tmsh list net vlan /ottersPart/vlan_47
net vlan /ottersPart/vlan_47 {
    dag-adjustment none
    if-index 240
    partition ottersPart
    interfaces { # <-- configuration with a workaround in place
        LAG {
            tagged
        }
    }
    [...]
    tag 47
}

Conditions:
- BIG-IP tenant running on r2000 and r4000-series platforms
- VLANs moved to partitions other than "Common", or renamed so that the name does not match between hypervisor and tenant.

Impact:
Partitions other than the Common partition cannot have VLANs. VLANs created in other partitions will not be operational in the data path.

If such VLANs exist in the tenant, newly added VLANs will also exhibit this issue.

Workaround:
In the BIG-IP tenant, modify all VLAN objects to have 'interfaces' that align with the configuration on the host.

For example, for the VLAN 47 described above, the VLAN should be listed as being 'tagged' on the 'LAG' trunk:

tmsh modify net vlan /ottersPart/vlan_47 interfaces replace-all-with { LAG { tagged } }
tmsh save sys config

---

1230833-3 : In the signature advanced mode, the Update button is kept disabled even after some changes in the rule

Component: Application Security Manager

Symptoms:
The Update button is kept disabled when you modify the signature rule string in advance mode.

Conditions:
Using advanced mode, update an existing user-defined signature rule.

Impact:
Additional operation is required to make a change. See the workaround section.

Workaround:
1. Modify the rule string.
2. Change any of the select buttons on the screen, such as Accuracy. At this point, the Update button gets enabled.
3. Revert the change on the select button you did in step 2.
4. The Update button is still kept enabled, click it to apply your change.

---

1230109-2 : Mcpd memory and CPU increase while getting route stats

Links to More Info: BT1230109

Component: TMOS

Symptoms:
Mcpd CPU usage is high after several hours of repeated requests to /mgmt/tm/net/route/stats. Mcpd can crash and restart.

Conditions:
There are two known paths to the issue:
(1) Repeated making authenticated calls to the /mgmt/tm/net/route/stats endpoint.
(2) Opening a long term tmsh shell and repeatedly checking the route table (show net route).

Impact:
Mcpd memory and CPU increases; if unchecked, mcpd can crash and restart.

Workaround:
(1) Avoid checking the /mgmt/tm/net/route/stat endpoint excessively.
(2) Close tmsh session periodically.

---

1229325-1 : Unable to configure IP OSPF retransmit-interval as intended

Links to More Info: BT1229325

Component: TMOS

Symptoms:
The CLI configuration of OSPF retransmit-interval results in error when retransmit-interval value is less than 5 seconds.

Conditions:
- Configure IP OSPF retransmit-interval.

Impact:
The CLI error even when IP OSPF retransmit-interval value is within range.

Workaround:
None

---

1225857-3 : Virtual server with FastL4 profile may drop connection when receives invalid RST packet from a client

Links to More Info: BT1225857

Component: Local Traffic Manager

Symptoms:
If virtual server with FastL4 profile receives an RST packet with a sequence number outside of the receive window, it may drop the client side connection leaving server side intact resulting in server attempting to transmit more data.

Conditions:
- Virtual server with FastL4 profile.
- Client sends RST packet with sequence number outside of receive window.

Impact:
Connection on the client side is dropped while server side becomes stale making server trying to transmit more data.

Workaround:
None

---

1225677-4 : Challenge Failure Reason is not functioning in ASM remote logging

Links to More Info: BT1225677

Component: Application Security Manager

Symptoms:
Challenge Failure Reason is not functioning in ASM remote logging.

Conditions:
Using ASM remote logging.

Impact:
Lack of logging information in ASM remote logger.

Workaround:
None

---

1224377-1 : [APM] Policy sync is not compatible with Network Acesss address spaces

Links to More Info: BT1224377

Component: Access Policy Manager

Symptoms:
An error is encountered during policy sync:
01b70105:3: System built-in APM resource address-space (/Common/default-all) cannot be modified.

Conditions:
Network Access resource has "default-all" address-space
OR
Network Access resource is configured with an address space that contains "0.0.0.0"

Impact:
Policy Sync failure

Workaround:
As a temporary measure, you can use the following steps

1)Remove the 'default-all' address space from the network access configuration, sync the policy, then add it back on the source and destination devices.

OR

2)Do not use Network Access address space if Policy sync is used as those two features are not compatible.

---

1223589-5 : Network Map page is unresponsive when a node name has the form "<IPv4>:<port>"

Links to More Info: BT1223589

Component: TMOS

Symptoms:
The Network Map page does not load, the message "Loading..." continuously displayed on the page because the JavaScript throws an exception and does not terminate:

Uncaught (in promise) TypeError: Cannot set properties of undefined (setting 'isNameHighlighted')
    at NetworkMapPresenter.clearHighlight (NetworkMapPresenter.js:1417:17)
    at NetworkMapPresenter.cardFilter (NetworkMapPresenter.js:1322:14)
    at Array.filter (<anonymous>)
    at NetworkMapPresenter.filterCards (NetworkMapPresenter.js:1315:51)
    at NetworkMapPresenter.filterSortAndGroupCards (NetworkMapPresenter.js:1306:10)
    at NetworkMapPresenter._callee18$ (NetworkMapPresenter.js:1162:14)
    at tryCatch (runtime.js:65:40)
    at Generator.invoke [as _invoke] (runtime.js:303:22)
    at prototype.<computed> [as next] (runtime.js:117:21)
    at step (fetch.js:461:47)

Conditions:
- Node name should be of the form <IPv4:port>.
- Node should be associated to a pool and then to a virtual server.

Impact:
The Network Map loads all the virtual servers, pools, and nodes, but it throws an exception in the browser and the JavaScript never terminates, the message "Loading..." continuously displayed on the page and the page is unresponsive.

Workaround:
Avoid naming a node as "<IPv4>:<port>".

---

1217473-1 : All the UDP traffic is sent to a single TMM

Links to More Info: BT1217473

Component: TMOS

Symptoms:
BIG-IP dataplane's VMXNET3 driver implementation is missing the Receive Side Scaling (RSS) support for the User Datagram Protocol (UDP) available as part of the VMXNET3 version 4.

Conditions:
BIG-IP VE instance is running on a VMWare host and handling UDP traffic.

Impact:
The traffic distribution does not happen evenly across all TMMs but rather all of the UDP traffic is sent to a single TMM.

Workaround:
None

---

1217297 : Removal of guestagentd service from the list of services running inside a tenant.

Links to More Info: BT1217297

Component: TMOS

Symptoms:
Guestagentd services will be running inside a tenant deployed on VELOS or rseries platform.

Conditions:
Install a tenant on VELOS or rseries platform.

Impact:
No impact

Workaround:
NA

---

1217077-1 : Race condition processing network failover heartbeats with timeout of 1 second

Links to More Info: BT1217077

Component: TMOS

Symptoms:
Unexpected failover or log messages similar to the following:
sod[1234]: 010c0083:4: No failover status messages received for 1.100 seconds, from device bigip02(192.0.0.1) (unicast: -> 192.0.0.2)

Conditions:
- HA configuration network failover configured
- DB variable 'failover.nettimeoutsec' set to a value of 1 second.

Impact:
A failover event could impact traffic flow.

Workaround:
Following recommended practices of configuring network failover addresses using both the Management IP and Self IP addresses will reduce the chances of initiating a failover. Log messages may still be observed.

Setting the DB variable 'failover.nettimeoutsec' to a value of 2 or greater should avoid the issue.

---

1215401-2 : Under Shared Objects, some country names are not available to select in the Address List

Links to More Info: BT1215401

Component: Advanced Firewall Manager

Symptoms:
Users can create a shared object list to define countries to block traffic from. On searching a name, a list will be shown from which the user can choose and add it to the address list.

There is a limit of only 8 entries in the drop-down menu to choose from.

Some countries are not shown in this list due to the ordering of entries returned from the database.

Conditions:
DOS is enabled

Impact:
As some countries are not available to select, they cannot be included in the Address List to block traffic.

Workaround:
Instead of the country (which is not available to select), all the regions within the country can be added to the block list. This is very cumbersome and error-prone as the list of regions should be known that are configurable in BIG IP.

---

1215165-2 : Support added for Microsoft Azure Managed HSM

Links to More Info: BT1215165

Component: Local Traffic Manager

Symptoms:
Azure Managed HSM integration with BIG-IP is now supported.

Conditions:
Using an Azure Managed HSM as HSM client with BIG-IP.

Impact:
Azure Managed HSM integration with BIG-IP is now supported.

---

1211437-4 : When mobile cookie is too long, Anti-Bot SDK is failing

Links to More Info: BT1211437

Component: Application Security Manager

Symptoms:
When mobile (TS_72) cookie is longer then 511, it get truncated by BIG-IP and cannot be parsed.

Conditions:
- Bot Defense profile is attached to virtual server, with Mobile SDK enabled.
- Application name is long (causing the cookie to be long).

Impact:
Anti-Bot SDK is failing, clients cannot be handled as mobiles.

Workaround:
None

---

1211089-4 : Traffic to IPv6 all nodes address not received by TMM on VE with ixlv driver

Links to More Info: BT1211089

Component: TMOS

Symptoms:
Traffic sent to the IPv6 all nodes multicast address is not seen by TMM.

Conditions:
A virtual environment utilizing TMM's ixlv driver.
Traffic is sent to the IPv6 all nodes multicast address.

Impact:
TMM fails to receive and process traffic to the IPv6 all nodes multicast address.

Workaround:
None

---

1210569-1 : User defined signature rule disappears when using high ASCII in rule

Component: Application Security Manager

Symptoms:
WebUI display is empty.

Conditions:
When the configured rule has high ASCII (greater than 127) value.

Impact:
Unable to see the rule in webUI.

Workaround:
Use the following steps:

1. Navigate to Security > Options > Application Security > Attack Signatures.

2. Create a new signature in Advanced Edit Mode. After setting, confirm the setting value with the developer tool.

3. Add it to the signature set (backed by actual signature detection confirmation).

4. Remove the old signatures from signature set.

---

1210053-3 : The cred_stuffing_fail_open Internal Parameter does not cause Leaked Credential violation in case of expiration or error

Component: Application Security Manager

Symptoms:
In case of Leaked Credential server error, there is an internal parameter to raise Leaked Credentials Violation:
cred_stuffing_fail_open (default value is not to raise violation)
Changing the internal parameter value does not trigger the violation.

Conditions:
- ASM is provisioned.
- WAF Policy is attached to virtual server with Credential Stuffing enabled.
- Internal Parameter cred_stuffing_fail_open is set to 0.
- A server error (or timeout) occurred during leaked credential check.

Impact:
Leaked Credential violation is not raised.

Workaround:
None

---

1210025-2 : Address list discovery task does not trigger apply access policy automatically

Links to More Info: BT1210025

Component: Access Policy Manager

Symptoms:
After discovery task, the Access Policy is not saved automatically.

Conditions:
Dynamic Address Spaces configuration.

Impact:
Unable to use Dynamic Address Spaces.

Workaround:
None

---

1207917-1 : SSL Orchestrator - NTLM authentication may stop working after a TMM restart or upgrade

Links to More Info: BT1207917

Component: Access Policy Manager

Symptoms:
NTLM authentication may stop working after a TMM restart or upgrade.

ECA debug logs similar to the following:

Dec 8 06:25:44 bigip1 debug eca[18424]: 01620012:7: eca_module_ntlm.cpp:795 ntlm_cfg_process_op_find_set_cfg, err = ECA_ERR_NOT_FOUND

Dec 8 06:25:44 bigip1 debug eca[18424]: 01620012:7: eca_module_ntlm.cpp:730 ntlm_cfg_handler, err = ECA_ERR_NOT_FOUND
bigip1 err eca[18424]: 0162000e:3: Invalid argument (/Common/ntlm-f5lab-config)

Dec 8 06:25:44 fbigip1 err eca[18424]: 0162000e:3: Invalid metadata (select_ntlm:/Common/ntlm-f5lab-config)

Conditions:
TMM restart, upgrade

Impact:
NTLM authentication problems, HTTP 503 error page returned to client.

Workaround:
In the GUI, navigate to Access ›› Authentication : NTLM : NTLM Auth Configuration ›› affected-ntlm-config. Edit the FQDN, leave it the same, and save the configuration.

or

Run the following command:
bigstart restart nlad

---

1205577-1 : The platform_mgr core dumps on token renewal intermittently

Links to More Info: BT1205577

Component: Access Policy Manager

Symptoms:
The platform_mgr core dumps on token renewal.

Conditions:
On token renewal, gRPC adds additional characters to the token buffer in the initial metadata of the gRPC channel.

Impact:
The platform_agent core is dumped and configuration related to the tenant will be re-fetched on platform_agent startup.

---

1205045-6 : WMI monitor does not put pool members into an offline/unchecked state when BIG-IP receives HTTP responses other than 200

Links to More Info: BT1205045

Component: Local Traffic Manager

Symptoms:
With no credentials, WMI monitor status still displays "UP".

Conditions:
With no credentials or stale/expired credentials, the WMI monitor stats displays "UP".

Impact:
The user is misinformed about the status of the WMI monitor.

Workaround:
None

---

1196505-1 : BIG-IP might RST HTTP2 connection with [F5RST:mrhttp_proxy bad transition] when ASM is in use.

Links to More Info: BT1196505

Component: Local Traffic Manager

Symptoms:
BIG-IP might RST HTTP2 connection with [F5RST:mrhttp_proxy bad transition] when ASM is in use.

Conditions:
- HTTP2
- ASM provisioned and passing traffic

Impact:
Unexpected connection reset.

Workaround:
None

---

1190753-2 : HTTP/2 Virtual Server ignores customized HTTP known-methods list

Links to More Info: BT1190753

Component: Local Traffic Manager

Symptoms:
An HTTP2 virtual server does not transfer the client request to the backend pool member.

Conditions:
- HTTP profile "Unknown Method : Reject".
- HTTP profile custom "Known Methods" list has non-default values, such as "PATCH".
- HTTP2 profile (and also HTTP profile) is attached to the virtual server.
- Client request is HTTP/2. And HTTP/2 request method is custom one (== method which isn't set as default "known-methods").

Impact:
HTTP2 virtual server traffic is disrupted.

Workaround:
None

---

1189949-4 : The TMSH sys core is not displaying help and tab complete behavior

Links to More Info: BT1189949

Component: TMOS

Symptoms:
The help and tab complete options are not displayed when TMSH sys core commands are executed.

Conditions:
For example, execute following commands:

tmsh sys core modify tmm-manage ?

tmsh sys core modify tmm-manage TABC

Impact:
The help and tab complete options are not displayed.

Workaround:
None

---

1189909-2 : Active SSL Connections Curve is always kept at Zero on Performance Graph

Links to More Info: BT1189909

Component: Local Traffic Manager

Symptoms:
In the BIG-IP GUI, if a user navigates to Statistics :: Performance Reports : Performance Reports, then clicks "View Detailed Graph", next to "Active Connections" is a graph named Active SSL Connections.

Even though many client SSL connections were received by SSL virtual servers, the SSL Client curve in the graph always shows 0.

The same behavior is seen via CLI with the 'tmsh show sys performance all-stats historical detail' output where the output displays all zeroes within Active SSL Connections for SSL Client.

Conditions:
SSL connections exist from a client over a period of time.

Impact:
You are unable to determine how many active SSL/TLS connections are present.

Workaround:
Use the alternate method mentioned in article K76898322 to see the Active client-side SSL connections.

---

1188817-3 : BIG-IP tenant on F5OS not allowed to modify VLAN tag value

Links to More Info: BT1188817

Component: TMOS

Symptoms:
When attempting to change the VLAN tag on a tenant on the F5OS platform, the tenant rejected the change with the error message "Modifying VLAN and attributes within a guest system is not supported on the deployed host system."

Conditions:
Attempting to change the VLAN tag on a tenant on the F5OS platform.

Impact:
Unable to modify VLAN tag value in tenant to match F5OS host.

Workaround:
The only way to modify the VLAN tag value is either to delete and recreate the VLAN or manually edit bigip_base.conf and adjust the VLAN tag value.

To manually edit bigip_base.conf:
 
1. Save the configuration ("tmsh save sys config")
2. Open /config/bigip_base.conf in a text editor (i.e. vim or nano)
3. Find the "net vlan /Common/<vlan>" stanza, and change the tag value there to the desired value.
4. Save the text file
6. Touch /service/mcpd/forceload
7. Reboot the tenant.

---

1182729-4 : Java connection establishes from BIG-IP to BIG-IQ Management

Component: TMOS

Symptoms:
A TCP connection establishes from BIG-IP to BIG-IQ.

Conditions:
When refreshing the stats, BIG-IP also fetches the stats from BIG-IQ, to fetch the stats from BIG-IQ, a Java connection establishes from BIG-IP to BIG-IQ.

Here, the BIG-IQ is discovered in the BIG-IP. If BIG-IP is not discovered in BIG-IQ, there the issue does not exist.

Impact:
An extra Java connection is listed under netstat.

Workaround:
Updating the property "rest.common.device.automatic.refresh.enabled" to "true" from /etc/rest.BIG-IP.properties, the connection does not establish from BIG-IP to BIG-IQ.

Note: We do not have a workaround for SSL Orchestrator. Workaround is not applicable for SSL Orchestrator.

---

1168245-2 : Browser is intermittently unable to contact the BIG-IP device

Links to More Info: BT1168245

Component: TMOS

Symptoms:
When the coloradvisory probes generated by Javascript loaded on the browser do not get responded by the BIG-IP device within 30 seconds, the browser JS generates a pop-up message "Unable to contact BIG-IP device".

Conditions:
- MCPD is busy serving requests.
- Multiple browser connections to the BIG-IP.
- HTTP GET request from browser JS for /xui/update/configuration/alert/statusmenu/coloradvisory does not get responded within 30 seconds (default timeout).

Impact:
Browser frequently sees the BIG-IP as unavailable, causing interruptions to management of the device via the GUI.

Workaround:
1. Increase memory allocated to tomcat and restjavad.

   tmsh modify sys db provision.tomcat.extramb value 512
   tmsh modify sys db provision.restjavad.extramb value 2227

NB these are very large values, not suitable for most systems. It is probably best to increase tomcat heap size by 50MB a time, and restjavad by 200MB a time (value 600, 800, etc).
To have provision.restjavad.extramb values will be capped in effect to 384 + value of provision.extramb.
Both tomcat and restjavad need to be restarted to have changes take effect. restjavad will log startup info in ltm log.

2. Adjust the browser-based Javascript status update interval and timeout.

   2.1. Remount /usr partition as read-write using the command:
       
        mount -o remount,rw /usr

   2.2. Edit the file /usr/local/www/xui/framework/scripts/variables.js, and modify the variables: time_updateXui to 8, and timeout_status to 60.

        Default values are:

          var time_updateXui = 5; // Seconds
          var timeout_status = 30; //Timeout value for XUI status update

        Change these values to:

          var time_updateXui = 8; // Seconds
          var timeout_status = 60; //Timeout value for XUI status update

   2.3. Remount /usr partition back to read-only.

        mount -o remount,ro /usr

3. Restart associated daemons:

   bigstart restart httpd
   bigstart restart tomcat
   bigstart restart restjavad

---

1167969-2 : In DoS Profile level, the Flood attack Vectors with TCP and UDP, Hardware offloading is not working as expected

Links to More Info: BT1167969

Component: Advanced Firewall Manager

Symptoms:
In Multiblade platforms which support high number of TMM threads, bigger per HSB rate limit values are received and it is causing the hardware to not trigger offload, even though the attack traffic matching the configured rate limits.

Conditions:
This occurs only in the platforms which supports high number of TMMs (more than 20).

Impact:
Hardware offload for the Flood attack vectors will not trigger as expected.

Workaround:
None

---

1167609-4 : The messages msg->ref > 0 are seen in TMM logs with websockets/ASM plugin

Links to More Info: BT1167609

Component: Local Traffic Manager

Symptoms:
With web security enabled and ASM policies attached to virtual server, in an unknown scenario, msg->ref > 0 are appearing in TMM logs.

Conditions:
-- ASM is provisioned
-- ASM policy attached to virtual server
-- Web security configured

Impact:
The /var/log/tmm files may be flooded with the messages.

Workaround:
None

---

1167589-1 : MCPD crashed during ASM stability test execution

Component: Application Security Manager

Symptoms:
MPCD crashed during ASM stability

Conditions:
N/A

Impact:
The Backup Daemon goes down along with other Daemons.

Workaround:
N/A

---

1166929-1 : [AdminUI][Rewrite Profile][PA] Add "*://*" to to rewrite list if an RCL has been entered

Links to More Info: BT1166929

Component: Access Policy Manager

Symptoms:
"Rewrite-List" field is empty Rewrite profile configuration

Conditions:
Portal Access configuaration

Impact:
Rewrite may not work as expected

Workaround:
Add "*://*" manually for Rewrite-List

---

1166481-6 : The vip-targeting-vip fastL4 may core

Links to More Info: BT1166481

Component: Local Traffic Manager

Symptoms:
The TMM cores or VIP does not behave as expected.

Conditions:
- fastL4 virtual
- iRule uses virtual command to redirect flows to a second fastL4 virtual
- first virtual configuration is changed before a flow times out

Impact:
Configuration data is freed but continued to be used by the flow, leading to the configuration appearing to be corrupted causing cores or unexpected behavior.

Workaround:
Ensure that there are no active flows for the virtual being changed.

---

1162149-3 : TCP 3WHS being reset due to "No flow found for ACK" while client have received SYN/ACK

Links to More Info: BT1162149

Component: Advanced Firewall Manager

Symptoms:
As a result, some times BIG-IP sending reset ack, resulting into unsuccessful connection.

Conditions:
- It is specific to i7800 series,
- There are no exact reproduction steps.

Impact:
Unable to establish the connection.

Workaround:
None

---

1156045-1 : FastL4's Don't Fragment (DF) flag Clear is not working in all situations

Links to More Info: BT1156045

Component: Local Traffic Manager

Symptoms:
FastL4 allows to configure the option Don't Fragment (DF) flag Clear, which is not working in all situations

Conditions:
FastL4 configured with the option Don't Fragment (DF) flag Clear

Impact:
Packets are not fragmented when the DF flag Clear option is set.

Workaround:
None

---

1148181-1 : SSL TLS1.3 connection terminates with "empty persist key" error when SSL persistence is enabled and session tickets are disabled

Links to More Info: BT1148181

Component: Local Traffic Manager

Symptoms:
SSL TLS1.3 handshake fails.

Conditions:
- clientssl profile has TLS1.3 enabled
- clientssl profile has session ticket disabled
- virtual server has SSL Persistence profile applied

Impact:
TLS1.3 SSL handhshakes will fail.

Workaround:
Either disabling persistence in the virtual server or enabling session-ticket in the clientssl profile

---

1142445-6 : Multicast handling on wildcard virtual servers leads to TMM memory leak

Links to More Info: BT1142445

Component: TMOS

Symptoms:
Multicast handling on wildcard virtual servers leads to TMM memory leak.

Conditions:
- Multicast license
- Multicast is enabled on a route-domain (ip multicast-routing)
- Wildcard virtual server matching multicast address space.

Impact:
TMM memory usage increasing over time.

Workaround:
None

---

1137269-6 : MCPD fails to reply if a request is proxied to another daemon and the connection to that daemon closes

Links to More Info: BT1137269

Component: TMOS

Symptoms:
MCPD does not reply to the request if the publisher's connection closes or fails. In this case, when bcm56xxd
is restarted, the perceivable signs of failure are:
- The snmpwalk failing with a timeout and
- The "MCPD query response exceeding" log messages.

Conditions:
1) Configure SNMP on the BIG-IP to run snmpwalk locally on the BIG-IP.
2) From the first session on the BIG-IP, run a snmpwalk in the while loop.
    
while true;do date; snmpwalk -v2c -c public 127.0.0.1 sysDot1dbaseStat;sleep 2;done
Sample output:
Sat Aug 21 00:57:23 PDT 2021
F5-BIGIP-SYSTEM-MIB::sysDot1dbaseStatResetStats.0 = INTEGER: 0
F5-BIGIP-SYSTEM-MIB::sysDot1dbaseStatMacAddr.0 = STRING: 0:23:e9:e3:8b:41
F5-BIGIP-SYSTEM-MIB::sysDot1dbaseStatNumPorts.0 = INTEGER: 12
F5-BIGIP-SYSTEM-MIB::sysDot1dbaseStatType.0 = INTEGER: transparentonly(2)

3) From a second session on the BIG-IP restart bcm56xxd

bigstart restart bcm56xxd

4) The snmpwalk will continually report the following:

Timeout: No Response from 127.0.0.1

      And snmpd will continually log "MCPD query response exceeding" every 30 seconds in /var/log/ltm.

Impact:
SNMP stopped responding to queries after upgrade.

Workaround:
Restart SNMP.

---

1136905 : Request for Portal Access Hosted Content are RST with "No available SNAT addr"

Links to More Info: BT1136905

Component: Access Policy Manager

Symptoms:
A RST occurs with the following message in /var/log/apm:
- No available SNAT addr

Conditions:
- Portal Access with Hosted-Content.

Impact:
Unable to access hosted-content resources.

Workaround:
Use the following command:
- tmsh modify sys db ipv6.enabled value false

---

1135425-3 : Created ASM policy does not appear in bigip.conf on the standby

Links to More Info: BT1135425

Component: Application Security Manager

Symptoms:
Policy does not appear under bigip.conf on standby.

Conditions:
Issue observed when creating ASM policies on active device in auto-sync condition.

Impact:
Created policy under Active is not updated in bigip.conf on standby machine.

Workaround:
Explicit 'save sys config'.

---

1128429-7 : Rebooting one or more blades at different times may cause traffic imbalance results High CPU

Links to More Info: BT1128429

Component: Carrier-Grade NAT

Symptoms:
One or more TMMs are consuming more CPU cycles than the other TMMs. The increased CPU usage is caused by a significant number of internal TMM traffic redirections.

Conditions:
- LSN pools enabled.
- The sp-dag configured on the client-side and server-side VLANs (cmp-hash src-ip and cmp-hash dst-ip respectively).

Impact:
Increased TMM CPU usage on one or more TMMs.

Workaround:
- Set up an High Availability (HA) pair of VIPRIONs and make an active VIPRION cluster standby before doing any operation that involves the rebooting, insertion, or removal of one or more blades.

Or if the VIPRION is a stand-alone cluster:

- Stop all external traffic to the VIPRION before rebooting, inserting, or removing one or more blades.

- Restart or reboot all the blades at the same time from the primary, using the following "clsh" command:
"clsh reboot volume <NEW_VOLUME>" or "clsh bigstart restart".

---

1128033-1 : Neuron client constantly logs errors when TCAM database is full

Links to More Info: BT1128033

Component: Local Traffic Manager

Symptoms:
A database held in hardware (TCAM), shared between tenants, has a limit that is exceeded by software in tenants that adds and manages entries in the database.

Symptomatic logs on tenant:

in /var/log/ltm, repeating logs are recorded, following is an example:

  err tmm[635]: 01010331:3: Neuron client neuron_client_pva_hwl failed with rule request submit(client connection is busy (has outstanding requests))

in /var/log/tmm, cycles of following group of logs are recorded:

  notice neuron_client_negotiate: Neuron client connection established
  notice [DDOS Neuron]Neuron daemon started
  notice hudproxy_neuron_client_closed_cb: Neuron client connection terminated
  notice [DDOS Neuron]Neuron daemon stopped
  
  For F5OS host, in partition /var/F5/partitionX/log/velos.log repeating logs are recorded, following is an example:
  
  tcam-manager[41]: priority="Err" version=1.0 msgid=0x6b01000000000007 msg="ERROR" MSG="TCAM processing Error(-5) executing:TCAM_INSERT for ruleno:0x20000000937"
  
In the log message, the msgid and ruleno can vary, but the Error(-5) is an indication of this issue.

Conditions:
The BIG-IP system with a rSeries r5xxx, r10xxx, r12xxx or has VELOS blades such as BX110.
The rSeries 2xxx, 4xxx and iSeries platforms are not affected.

Large configurations, on the order of high hundreds of virtual servers, are more likely to encounter issue.

Impact:
The neuron client software will restart and log repeatedly.
Inefficient use of TCAM database.

Workaround:
None

---

1127725-2 : Performance drop with the AES_CCM 128 cipher★

Links to More Info: BT1127725

Component: Local Traffic Manager

Symptoms:
On all BIG-IP platforms with Coleto Creek - Intel Crypto and Coleto Creek DH8925CL chip present for Hardware cryptos like i10800, i11800, i5800, i7000, i15800, i4x00 platforms and VIPRION, when AES_CCM 128 ciphers such as TLS_RSA_WITH_AES_128_CCM are used, there will be a performance drop when compared to previous releases.

Conditions:
The AES_CCM 128 algorithm is configured.

Impact:
A performance drop of up to 30% and an increase in CPU utilization occurs.

Workaround:
None

---

1127481-1 : FIPS HSM password length issue

Component: Local Traffic Manager

Symptoms:
Unable to initialize the FIPS HSM if the SO password is set to more than 14 characters.

Conditions:
This is specific to FIPS HSM platforms only. It is observed during FIPS card initialization.

Impact:
Cannot initialize the FIPS HSM and use the FIPS card.

Workaround:
Set the SO password with 14 characters or below.

---

1126561-3 : Connections over IPsec fail when hardware acceleration in fastl4 is enabled

Links to More Info: BT1126561

Component: TMOS

Symptoms:
Connection setup fails through IPsec tunnel.

Conditions:
- rSeries and VELOS platform.
- PVA acceleration is enabled in the fastL4 profile of the IPsec virtual on the responder BIG-IP.

Impact:
Connections through the IPsec tunnel do not work.

Workaround:
Disable PVA acceleration in the relevant fastL4 profile. PVA acceleration cannot be performed on flows going into or coming out of IPsec. This workaround returns the functionality as it was designed.

F5 recommends creating Virtual Servers to specifically catch flows that go over IPsec tunnels. If a generic Virtual Server uses a fastL4 profile with acceleration disabled, then non-IPsec flows that could be accelerated will not be.

---

1126505-2 : HSB and switch pause frames impact data traffic

Links to More Info: BT1126505

Component: TMOS

Symptoms:
There are cases where the HSB and switch report pause frames on the HSB <-> switch interfaces. This can be seen in the switch interface stats:

name counters.rx_pause
---- -----------------
9.1 11522051
10.1 11392101

Conditions:
The iSeries platforms with an HSB and switch.

Impact:
There can be an impact on networking traffic.

Workaround:
There is no workaround for this issue. When this condition happens, the unit needs to be rebooted to clear the issue.

---

1125381-3 : Extraneous warnings recorded in when using only intermediate certificates

Links to More Info: BT1125381

Component: Local Traffic Manager

Symptoms:
When client authentication is enabled on the client SSL profile but the trusted-ca file includes only an intermediate certificate and no CA root cert to build the whole cert chain, although the TLS connection is made, as expected, there is an error message reported.

Conditions:
Trusted-ca includes only inter-cert and no root CA-cert
is configured.

Impact:
Although the TLS handshake succeeds without any issue and the connection is processed, as expected, a confusing warning is reported.

Workaround:
Because the connection is made, you can safely ignore this message.

Note: This issue does not occur if the root CA cert is also configured in the CA-cert bundle.

---

1124733-3 : Unnecessary internal traffic is observed on the internal tmm_bp vlan

Component: TMOS

Symptoms:
Unnecessary internal traffic can be observed on the internal tmm_bp vlan. It is a UDP broadcast on 62965 port.

Conditions:
Always

Impact:
Unnecessary traffic that does not disrupt normal operation.

Workaround:
None

---

1123157-1 : Single-page application AJAX does not work properly with page's navigation

Component: Application Security Manager

Symptoms:
When a single-page application is enabled and the page's own navigation is triggered during the display of CAPTCHA, the CAPTCHA frame disappears.

Conditions:
-- Single-page application is enabled in ASM.
-- The single-page application's code performs its own navigation on top of the displayed CAPTCHA.

Impact:
ASM end users may not be able to pass the CAPTCHA challenge and therefore will not be able to access the application.

Workaround:
None

---

1121209-3 : MTU value update on VLAN in tenant launched on r2k and r4k systems needs tmm restart

Links to More Info: BT1121209

Component: Local Traffic Manager

Symptoms:
Updating the MTU on a VLAN in a BIG-IP tenant requires a tmm restart.

Conditions:
Tenants launched on R2x00 or R4x00 appliances and configured to use Jumbo Frames.

Impact:
Jumbo frames feature support impacted.

Workaround:
- Update the MTU value on the VLAN via the tenant's CLI (tmsh) or UI.
- Restart tmm.

---

1121169-5 : Unable to resize the /appdata: /dev/mapper/vg--db--sda-dat.appdata when in use

Links to More Info: BT1121169

Component: TMOS

Symptoms:
On systems where ID1004833 has been fixed, the resizing instructions for /appdata from K74200262 no longer work.

Conditions:
When the jitterentropy-rngd is started by systemd which is the default state of the BIG-IP.

Impact:
A filesystem resize operation may fail with the following error:

# lvreduce --resizefs --size -40G /dev/mapper/vg--db--sda-dat.appdata
Do you want to unmount "/appdata"? [Y|n] y
fsck from util-linux 2.23.2
/dev/mapper/vg--db--sda-dat.appdata is in use.
e2fsck: Cannot continue, aborting.

resize2fs 1.42.9 (28-Dec-2013)
resize2fs: Device or resource busy while trying to open /dev/mapper/vg--db--sda-dat.appdata
Couldn't find valid filesystem superblock.
fsadm: Resize ext3 failed
  fsadm failed: 1
  Filesystem resize failed.

Workaround:
Unmount /appdata and restart the jitterentropy-rngd, using the following commands:

umount /appdata
systemctl restart jitterentropy-rngd

Then retry the resize operation.

---

1115601-1 : VE on VMware with VMXNET3 fails to work with Large Receive Offload (LRO)

Links to More Info: BT1115601

Component: Performance

Symptoms:
BIG-IP VE running on VMware may either not utilize Large Receive Offload (LRO), or may exhibit poor TCP performance for standard virtual servers using TCP profiles with Delayed ACKs enabled.

Conditions:
BIG-IP VE deployed in a VMWare environment, using VMXNET3 NICs

Impact:
- TCP performance is not as expected when going through a standard virtual server when TMM receives LROed TCP segments.

- Virtual servers are not using LRO, even when it is enabled.

Workaround:
Disable LRO globally:
tmsh modify sys db tm.tcplargereceiveoffload value disable && tmsh save sys config

---

1114253-5 : Weighted static routes do not recover from BFD link failures

Links to More Info: BT1114253

Component: TMOS

Symptoms:
If a BFD link fails and recovers, the weighted static route that should be preferred does not populate back into the routing table.

Conditions:
Weighted static routes with BFD configured, this is an example of the affected configuration:

ip route 0.0.0.0/0 10.8.8.4 100
ip route 0.0.0.0/0 10.8.8.34 200
ip static 0.0.0.0/0 10.8.8.4 fall-over bfd
ip static 0.0.0.0/0 10.8.8.34 fall-over bfd

After BFD session to 10.8.8.4 fails and recovers the default route will still be pointing to 10.8.8.34.

Impact:
Incorrect route nexthop.

Workaround:
Re-add route config statements.

---

1114089-1 : Frequent SIGSEGV TMM crash/core in AFM FQDN | fw_iptbl_fqdn_ctx_check

Links to More Info: BT1114089

Component: Advanced Firewall Manager

Symptoms:
TMM crash or core

Conditions:
Two FQDNs associated to BIG-IP firewall rules point to same IP in the DNS server at any instance of time.

Impact:
1. One of the FW rules may not work.
2. TMM crash or core.

Workaround:
Use IP addresses on such places of firewall rules.

---

1110485-5 : SSL handshake failures with invalid profile error

Links to More Info: BT1110485

Component: Local Traffic Manager

Symptoms:
1. TMM reports SSL handshake failures with reason "hud_ssl_handler:1208: alert(40) invalid profile unknown on VIP"

2. There will be Certificate read errors in the ltm log "reading: Unknown error."

Conditions:
-- The certificates associated with the SSL profile are corrupted by modifying/adding/deleting them manually/Venafi

-- There are frequent unintentional Certificate updates

Impact:
-- The BIG-IP system will not be able process the traffic
-- All traffic to particular virtual servers fails

Workaround:
1. Correct the certificates which are corrupted and make them valid.

2. Deattach/Remove the corresponding SSL profile from all virtual servers to which it is applied.

3. In the GUI open the virtual server and click on update and make sure there are no errors shown on the screen.

4. Now re-apply the SSL profile to the virtual server

---

1110373-1 : Nitrox device error logs in /var/log/ltm

Links to More Info: BT1110373

Component: Application Visibility and Reporting

Symptoms:
The BIG-IP may log errors similar to the following:

Apr 20 06:22:30 bigip1 crit tmm3[6615]: 01010025:2: Device error: n3-compress0 Zip engine ctx eviction (comp_code=4): ctx dropped.

Feb 1 08:53:00 bigip1 crit tmm1[25889]: 01010025:2: Device error: n3-compress1 Zip engine ctx eviction (comp_code=6): ctx dropped.

Conditions:
When AVR is in use, a Nitrox accelerator card is installed in the BIG-IP.

Impact:
If these logs are not occurring frequently and are being caused by AVR they can be safely ignored.

It is difficult to determine whether these messages are related to AVR or part of a hardware problem with the Nitrox. With AVR debugging enabled the following log message can be observed:

<13> 2022-04-22T15:21:30.836+02:00 bigip1 notice AVR: AVR decompression failed (most likely out-of-memory or bad format, err=32)

Workaround:
Disable AVR or hardware compression:

tmsh modify sys db compression.strategy value softwareonly

---

1103953-3 : Unable to connect to "localhost" port 25. err sSMTP[9797]

Links to More Info: K60914243, BT1103953

Component: TMOS

Symptoms:
An error is logged every 20 minutes to /var/log/maillog

err sSMTP[9797]: Unable to connect to "localhost" port 25.
err sSMTP[9797]: Cannot open localhost:25

The symptoms are similar to what you see in https://support.f5.com/csp/article/K60914243 but the solution in that article will not help. K60914243 talks about 15.x while current issue is on 16.x.

Conditions:
This occurs in one of the following happens

1. You have manually deleted restjavad or restnoded log files with following commands
   rm /var/log/restjavad*
   rm /var/log/restnonded*

2. One of the restjavad/restnoded log files is small and unable to rotate (rotation fails). This happens when file size does not exceed default "max-file-size"

Impact:
Log rotation for restjavad/restnoded will be stuck. You may see system emails about sSMTP errors every 20 minutes.

Workaround:
This issue subsides if you manually create a file for the stuck log file.

1. Open a command terminal
2. Run # ls -l /var/log/restnoded*
3. If you find that restnonded1.log is missing then manually create it
    # touch /var/log/restnoded/restnoded1.log
4. Run # ls -l /var/log/restjavad*.log
5. If you find that restjavad.1.log is missing then manually create it
    # touch /var/log/restjavad.1.log

---

1100249-7 : SNAT with FLOW_INIT firewall rule may core TMM due to wrong type of underlying flow structure

Links to More Info: BT1100249

Component: Local Traffic Manager

Symptoms:
Tmm crashes with SIGSEGV while passing firewall traffic.

Conditions:
-- SNAT + firewall rule
-- FLOW_INIT used in an iRule

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

---

1099621-2 : DAG context synchronization debug instrumentation

Links to More Info: BT1099621

Component: TMOS

Symptoms:
The BIG-IP system lacks instrumentation for the exchange of tmm DAG state over the statemirror channels between high availability (HA) peers running on VELOS.

Conditions:
-- High availability (HA) pair running on VELOS

Impact:
When average application response latency increases and health checks flap and the DAG is suspected, instrumentation is unavailable.

Workaround:
None

---

1093717-5 : BGP4 SNMP traps are not working.

Links to More Info: BT1093717

Component: TMOS

Symptoms:
BGP4 SNMP traps are not working.

Conditions:
--Perform any BGP related event and check for snmp traps.

Impact:
No BGP SNMP traps.

Workaround:
None

---

1091785-6 : DBDaemon restarts unexpectedly and/or fails to restart under heavy load

Links to More Info: BT1091785

Component: Local Traffic Manager

Symptoms:
While under heavy load, the Database monitor daemon (DBDaemon) may:
- Restart for no apparent reason
- Restart repeatedly in rapid succession
- Log the following error while attempting to restart:
   java.net.BindException: Address already in use (Bind failed)
- Fail to start (remain down) after several attempts, leaving database monitors disabled and marking monitored resources Down.

Conditions:
- One or more active GTM and/or LTM database monitors are configured with short probe-timeout, interval and timeout values (for example, 2, 5, or 16 respectively).
- A large number (for example, 2,000) of GTM and/or LTM database monitor instances (combinations of above monitor and pool member) are configured.
- Active GTM and/or LTM database monitors are configured with debug yes and/or count 0.

Impact:
The DBDaemon restarts for no apparent reason.
The DBDaemon fails to start (remain down) after several attempts, leaving database monitors disabled and marking monitored resources Down.

Workaround:
The conditions that are suspected to cause these symptoms include effects of ID1025089. This issue has not been confirmed to occur on BIG-IP versions which include a fix for ID1025089. On other versions, measures to prevent or reduce occurrences of ID1025089 (by reducing database monitor workload) are expected to also prevent or reduce occurrences of these symptoms.

If the DBDaemon fails to restart, the following steps may allow DBDaemon to restart successfully upon the next database monitor probe:

-- Check for a running instance of DBDaemon with the following command:

ps ax | grep -v grep | grep DBDaemon

-- If DBDaemon is running, this command will return a set of parameters including the numerical process ID (PID) at the beginning of the line and a command line that begins with "/usr/lib/jvm/jre/bin/java" and includes the parameter "com.f5.eav.DBDaemon", such as:

24943 ? Ssl 46:49 /usr/lib/jvm/jre/bin/java -cp /usr/lib/jvm/jre/lib/rt.jar:/usr/lib/jvm/jre/lib/charsets.jar:/usr/share/monitors/postgresql-jdbc.jar:/usr/share/monitors/DB_monitor.jar:/usr/share/monitors/log4j.jar:/usr/share/monitors/mssql-jdbc.jar:/usr/share/monitors/mysql-connector-java.jar:/usr/share/monitors/ojdbc6.jar -Xmx512m -Xms64m -XX:-UseLargePages -DLogFilePath=/var/log/DBDaemon-0.log com.f5.eav.DBDaemon 1521 24943 0

-- If a running DBDaemon process is identified, use the "kill" command to terminate the running DBDaemon process:

kill #
(where # is the DBDaemon PID from the above "ps" command)

-- Repeat the above "ps" command to confirm that the DBDaemon process has been terminated. If a new DBDaemon process has not been started (with a different PID), proceed to the next steps.

-- Check the /var/run directory for the presence of any files with names beginning with "DBDaemon", such as:

/var/run/DBDaemon-0.lock
/var/run/DBDaemon-0.pid
/var/run/DBDaemon-0.start.lock

Note: The numeric value in the above example filenames corresponds to the Route Domain of pool members monitored by database monitors. If the database monitors are only applied to pool members in the default route domain (RD 0), that value will be "0" as seen above. If database monitors are applied to pool members in a non-default route domain (RD 7, for example), the numeric value will correspond to that route domain, such as:
/var/run/DBDaemon-7.lock
/var/run/DBDaemon-7.pid
/var/run/DBDaemon-7.start.lock

-- If no DBDaemon process is running, delete any /var/run/DBDaemon* files. It is especially important to delete:
/var/run/DBDaemon-#.start.lock (indicates DBDaemon restart is in progress and that no further restart actions should be attempted)
/var/run/DBDaemon-#.pid (indicates current DBDaemon PID)

-- If the above actions do not result in DBDaemon restarting upon the next database monitor ping, then a complete BIG-IP restart will likely be required to recover from unknown conditions within the Java subsystem that may prevent successful DBDaemon operation:

bigstart restart

or:

reboot

---

1091021-6 : The BIG-IP system may not take a fail-safe action when the bigd daemon becomes unresponsive.

Links to More Info: BT1091021

Component: Local Traffic Manager

Symptoms:
You may observe LTM monitors malfunctioning on your system. For instance, you may notice some probes are not sent out on the network, and some monitored objects are showing the wrong status.

Conditions:
-- The bigd daemon consists of multiple processes (which you can determine by running "ps aux | grep bigd").

-- One or more of the processes (but not all of them) become disrupted for some reason and stop serving heartbeats to the sod daemon.

Under these conditions, sod will not take any fail-safe action and the affected bigd processes will continue running impaired, potentially indefinitely.

Impact:
LTM monitoring is impacted.

Workaround:
If you suspect this issue is occurring in your system, you can resolve it by killing all bigd processes using the following command:

pgrep -f 'bigd＼.[0-9]+' | xargs kill -9

However, this does not prevent the issue from manifesting again in the future if the cause for bigd's disruption occurs again.

Monitoring may become further disrupted as bigd restarts, and a failover may occur depending on your specific configuration.

Another work around is to set only one bigd if that is possible.
modify sys db bigd.numprocs value 1
If only a single bigd is available, sod will detect when it is down.

---

1090313-5 : Virtual server may remain in hardware SYN cookie mode longer than expected

Links to More Info: BT1090313

Component: TMOS

Symptoms:
A virtual server may remain in hardware SYN cookie mode longer than expected after the SYN flood attack has stopped. The TMSH 'show ltm virtual' command shows that the virtual has already exited SYN Cookie mode, but the SYN packets are still responded from hardware for a few minutes longer.

Conditions:
The problem is a result of a race condition in TMM, so the issue might show up intermittently.

Impact:
Discrepancy between the actual SYN Cookie mode and the reported SYN Cookie mode for a short period of time after a SYN flood attack.

Workaround:
Disable hardware SYN Cookie mode.

---

1089625-1 : Java core dump with SIGABRT while high cpu load in BIG-IP

Links to More Info: BT1089625

Component: TMOS

Symptoms:
Observe the logs in /var/log/daemon.log

Nov 8 01:13:27 localhost.localdomain emerg logger[6270]: Re-starting restjavad

Java core generated in folder /var/core.

Conditions:
1. Provision ASM
2. Huge number of requests to restjavad
3. cpu is hitting 100%

Impact:
Restjavad will be restarted.

Workaround:
More heap memory can reduce cpu consuming operations, fewer GC cycles, less frequent minor GCs, overall less overhead for memory management can add for less cpu usage.

Please increase the value of provision.extramb and provision.restjavad.extramb by 200MB at a time ( 400, 600, 800 ...) till the issue resolves. Since changing the value of provision.extramb is service affecting you may want to start with a higher value so there is more room to experiment to find a good value for restjavad heap size. Note 500MB is equivalent to large management provisioning and 200MB is the same as medium management provisioning.

NB provision.extramb value doesn't sync between peers (by design) and must be changed on each peer, one at a time, and is service affecting when changed on active. On ASM provisioned system it can take approximately 15 minutes for system to reprovision.

tmsh modify sys db provision.extramb value 200 ( 400, 600, 800 ...)
tmsh modify sys db provision.restjavad.extramb value 600 (800, 1000, 1200 ...

bigstart restart restjavad

Increase timeout
# tmsh modify sys db icrd.timeout value 300
# tmsh modify sys db restjavad.timeout value 300
# tmsh modify sys db restnoded.timeout value 300

bigstart restart restjavad restnoded

---

1087981-1 : Tmm crash on "new serverside" assert

Links to More Info: BT1087981

Component: Local Traffic Manager

Symptoms:
TMM cores with "new serverside" assert.

Conditions:
This can occur while passing UDP traffic while tmm is under memory pressure.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

---

1087569-6 : Changing max header table size according HTTP2 profile value may cause stream/connection to terminate

Links to More Info: BT1087569

Component: Local Traffic Manager

Symptoms:
BIG-IP initializes HEADER_TABLE_SIZE to the profile value and thus when it exceeds 4K (RFC default), the receiver's header table size is still at the default value. Therefore, upon receiving header indexes which has been removed from its table, receiver sends GOAWAY (COMPRESSION_ERROR)

Conditions:
-- HTTP2 profile used in a virtual server
-- In the HTTP2 profile, 'Header Table Size' is set to a value greater than 4096

Impact:
Stream/connection is terminated with GOAWAY (COMPRESSION_ERROR)

Workaround:
Issue can be avoided by restoring the header-table-size value to the default of 4096

---

1086473-6 : BIG-IP resumes a TLS session on the client-side but then proceeds to do a full handshake

Links to More Info: BT1086473

Component: Local Traffic Manager

Symptoms:
When a client attempts to resume the TLS session using the Session-ID in its Client Hello from a previous session, the BIG-IP agrees by using the same Session-ID in its Server Hello, but then proceeds to perform a full handshake (Server Hello, Certificate, Server Key Exchange, Certificate Request, Server Hello Done) instead of an abbreviated handshake (Server Hello, Change Cipher Spec, Server Hello Done).

This is a violation of the TLS RFC.

Conditions:
- High availability (HA) pair of two BIG-IP units.
- LTM virtual server with a client-ssl profile.
- Mirroring enabled on the virtual server

Impact:
Client-side TLS session resumption not working.

Workaround:
Disable mirroring on the virtual server

---

1083405-6 : "Error connecting to named socket" from zrd

Links to More Info: BT1083405

Component: Global Traffic Manager (DNS)

Symptoms:
After an mcpd restart, zrd may not be able to re-establish a connection to named. This shows up in the /var/log/gtm file or in the GUI with a message similar to the following:

err zrd[27809]: 01150306:3: Error connecting to named socket 'Connection refused'.
(or)
err zrd[16198]: 01150306:3: Error connecting to named socket 'Connection timed out'.

Conditions:
After an mcpd restart

Impact:
Looking up or modifying zone records may fail.

Workaround:
Restart zrd and named

tmsh restart sys service zrd named

---

1082197-5 : RNAME and MNAME field order reversed for Synthetic SOAs sent for negative response

Links to More Info: BT1082197

Component: Global Traffic Manager (DNS)

Symptoms:
Synthetic SOA returned by BIG-IP has the MNAME and RNAME fields reversed, resulting in the wrong values being noted as the primary name server and mailbox of administrator, respectively.

Conditions:
-- Set the failure-rcode-response enabled and failure-rcode-ttl on a down WIP.
-- Perform a DNS query.
-- Observe the SOA.

Impact:
Per RFC (rfc1035) the order of the fields is significant and MNAME must come before RNAME. When reversed, consumers of the synthetic SOA will associate the wrong values with the wrong fields.

---

1082133-4 : iSeries LCD displays "Host inaccessible or in diagnostic mode"

Links to More Info: BT1082133

Component: TMOS

Symptoms:
The LCD displays "Host inaccessible or in diagnostic mode" for an extended period of time when platform_check is running.

Conditions:
This will occur when platform_check is running after booting up an iSeries BIG-IP system.

Impact:
LCD is unusable until the system is rebooted.

Workaround:
Wait 5 minutes.
If the LCD is still displaying "Host inaccessible or in diagnostic mode" after this time period, reboot the BIG-IP system.

---

1080093-1 : The Acct-Session-id attribute for audit, forwarding the RADIUS packets is always the same for all sessions

Links to More Info: BT1080093

Component: TMOS

Symptoms:
The Acct-Session-id attribute displays the F5-BIGIP-AUDIT-FORWARDER message for all sessions. As per RFC2866 it should be unique for each session.

Conditions:
Configure radius remote audit logging.
In the Radius “Accounting-Request” which BIG-IP sent is configured in the audit server, but “Acct-Session-Id” always has the same “F5-BIGIP-AUDIT-FORWARDER” value.

Impact:
The user expects that the F5-BIGIP-AUDIT-FORWARDER value must be unique for each session. Also, the RADIUS platform cannot start or stop records, making it difficult to differentiate between sessions.

Workaround:
None

---

1077789-6 : System might become unresponsive after upgrading.★

Links to More Info: BT1077789

Component: TMOS

Symptoms:
After upgrading, the system encounters numerous issues:

-- Memory exhaustion (very low MemAvailable) with no particular process consuming excessive memory.
-- High CPU usage usually due to high kswapd or iowait activity
-- System is unresponsive, difficult to log in, slow to accept commands.
-- Provisioning is incomplete; there is a small amount of memory amount assigned to 'host' category.

Conditions:
The device is provisioned for more than LTM, typically with ASM or APM as well or instead, and needs more host memory than a pure LTM system.

-- The configuration loads in the previous release, but does not load successfully on the first boot into the release you are upgrading to.
-- Device is upgraded and the configuration is rolled forward.
-- There may be other conditions preventing the configuration from loading successfully after an upgrade.

Exact conditions that trigger this issue could be varied.
Failure to reactivate license, if needed, before upgrade could cause it, or an actual config issue. The config load error will be shown in the ltm log - search on 'emerg load'; the actual failure should be shown a few lines before the general warning about config load failure.

Impact:
-- System down, too little host (4KB page) memory to be stable.
-- Difficulty logging in over SSH might require serial console access.

Workaround:
Reboot to an unaffected, pre-upgrade volume.

-- If the system is responsive enough, use 'tmsh reboot volume <N>' or switchboot to select an unaffected volume.

-- If the system is completely unresponsive, physically powercycle a physical appliance or reboot a BIG-IP Virtual Edition (VE) from an applicable management panel, and then select an unaffected volume from the GRUB menu manually.

Note: This requires that you have console access, or even physical access to the BIG-IP device if you are unable to SSH in to the unit. On a physical device, a non-responsive system might require that you flip the power switch.

For more information, see:
-- K9296: Changing the default boot image location on VIPRION platforms :: https://support.f5.com/csp/article/K9296
-- K5658: Overview of the switchboot utility :: https://support.f5.com/csp/article/K5658
-- K10452: Overview of the GRUB 0.97 configuration file :: https://support.f5.com/csp/article/K10452.

---

1074513-4 : Traffic class validation does not detect/prevent attempts to add duplicate traffic classes to virtual

Links to More Info: BT1074513

Component: TMOS

Symptoms:
Tmm crashes after adding a traffic class.

Conditions:
-- Virtual server with two traffic classes
-- A third traffic class is added via tmsh

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

---

1074285-3 : Apmd crashes while handling JWT tokens.

Links to More Info: BT1074285

Component: Access Policy Manager

Symptoms:
An apmd crash might occur while handling JWT tokens.

Conditions:
The payload has invalid JSON during authentication.

Impact:
BIG-IP authorization disrupted while apmd restarts.

Workaround:
None

---

1073897-6 : TMM core due to memory corruption

Links to More Info: BT1073897

Component: Local Traffic Manager

Symptoms:
Tmm restarts

Conditions:
Unknown

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

---

1072401-1 : Modification of certificate associated with a parent ssl profile will fail if the a child profile is part of an iApp with strict updates enabled

Links to More Info: BT1072401

Component: TMOS

Symptoms:
Modification of a certificate that is associated with a parent SSL profile will fail if a child SSL profile is part of an iApp that has strict updates enabled.

It fails with the following error message in /var/log/ltm:

010715bc:3: The application service (/Common/app_name/<app service name> has strict updates enabled, the object (ClientSSL Profile /Common/app_name/<child ssl profile> must be updated using an application management interface.

Conditions:
An SSL profile with a certificate, where this profile is not associated with an iApp and where it's the parent SSL profile for other profiles.

iApp with strict updates enabled and a SSL profile that is a child profile of the parent SSL profile.

Impact:
Modification of the certificate associated with the parent SSL profile fails.

Workaround:
None

---

1071385-4 : SSL session resumption is incorrectly logging handshake failure messages

Links to More Info: BT1071385

Component: Local Traffic Manager

Symptoms:
Handshake failure messages are logged when the handshake was successful.

Conditions:
-- Client establishes connection with session resumption option

Impact:
Inaccurate information in log.

Workaround:
None

---

1071021-3 : Some URLs such as *cdn.onenote.net configured in the Office 365 dynamic address space are not processed by APM

Links to More Info: BT1071021

Component: Access Policy Manager

Symptoms:
Dynamic address space parser not accepting few patterns(*cdn.example.net) which are added at the DNS address space field.

Conditions:
When the user configures Office 365 Dynamic Address Space with URLs formats like:

 *-admin.sharepoint.com
 *cdn.onenote.net
 *-files.sharepoint.com
 *-myfiles.sharepoint.com

Impact:
Due to the above pattern DNS relay proxy is not compatible with them.

Workaround:
None

---

1070957-5 : Database monitor log file backups cannot be rotated normally.

Links to More Info: BT1070957

Component: Local Traffic Manager

Symptoms:
Debug log files used by the BIG-IP database monitor daemon (DBDaemon) do not exhibit the log-rotation behavior of other BIG-IP log files.
- The active DBDaemon log file is /var/log/DBDaemon-0.log
- DBDaemon log file size is limited to approximately 5MB. DBDaemon log files are backed up/rotated upon reaching this size.
- Exactly 9 (nine) DBDaemon log file backups are retained (/var/log/DBDaemon-0.log.[1-9])
- DBDaemon log file backups are not compressed.
- DBDaemon log file backup/rotation behavior is not user-configurable.

Conditions:
This issue applies when using BIG-IP database monitors:
-- mssql
-- mysql
-- oracle
-- postrgresql

Impact:
-- DBDaemon log file backups may consume more space under /var/log than desired.
-- When troubleshooting database monitor issues, DBDaemon log file rotation may occur so rapidly that older DBDaemon events may be lost, limiting the ability to capture meaningful diagnostic data.

Workaround:
It may be possible to work around this issue by periodically archiving DBDaemon log files, such as in a script with the following core functionality:
pushd /var/log;tar -czf DBDaemon_$(date +%Y%m%d%H%M).tgz DBDaemon-0.log*;popd

---

1070393-2 : The f5_api_com.crt certificate file may be removed by the load sys config command

Links to More Info: BT1070393

Component: TMOS

Symptoms:
The BIG-IP downloads an f5_api_com.crt certificate file when a production BIG-IP license is installed, but a subsequent "load sys config" reverts to the pre-certificate config, and deletes (tidies up) the file.

Conditions:
-- Activate a BIG-IP license in either the GUI or tmsh (this causes the f5 API certificate to be downloaded and installed into the config)
-- Run 'tmsh load sys config'
-- Observe that the f5_api_com.crt object is no longer present in the BIG-IP config.

Impact:
F5_api_com.crt certificate file is not present on the BIG-IP system.

Workaround:
- Ensure that "tmsh save sys config" is run after installing a new BIG-IP license.

- If the certificate has been removed from the BIG-IP configuration, but is still present in the filesystem, you can import it with the expected name (f5_api_com.crt): "tmsh create sys file ssl-cert f5_api_com.crt source-path file:///config/ssl/ssl.crt/f5_api_com.crt"

- If the certificate has been lost, you can re-activate the license, to cause a new API certificate to be pulled down from the F5 license server.

---

1070181-4 : MCPD crash on the standby device

Links to More Info: BT1070181

Component: Local Traffic Manager

Symptoms:
MCPD crashes with an error:

Configuration error: In Virtual Server (/Common/vip-test) an http2 profile with enforce-tls-requirements enabled is incompatible with client ssl profile '/Common/test-ssl-2'; renegotiation must be disabled

Conditions:
Virtual server with
-> http2 profile - 'enfore-tls-requirements' enabled
-> client-ssl profile 1 - 'renegotiation' disabled
-> client-ssl profile 2 - 'renegotiation' enabled

Impact:
MCPD crashes on the standby device or the non-primary blade.

Workaround:
Disable 'enforce-tls-requirements' of http2 profile

---

1069977-2 : Repeated TMM SIGABRT during ips_flow_process_data

Links to More Info: BT1069977

Component: Protocol Inspection

Symptoms:
IPS consumes excessive CPU time processing GTP related context entries and this causes the tmm clock not to be updated, because of which SOD tries to restart the TMM.

Conditions:
-- Heavy GTP traffic, and request creation messages are sent without sending the response messages.

Impact:
Traffic disrupted while tmm restarts.

---

1069137-7 : Missing AWAF sync diagnostics

Links to More Info: BT1069137

Component: Application Security Manager

Symptoms:
Complex issues related to Policy Synchronization over Device Sync Groups are difficult to diagnose.
More detailed logging is needed if errors occur.

Conditions:
Device Group Sync is enabled.

Impact:
Root cause analysis is lengthy and difficult.

Workaround:
Enable debug logs in the environment:
> tmsh modify sys db log.asm.asmconfig.level value debug
> tmsh modify sys db log.asm.asmconfigevent.level value debug
> tmsh modify sys db log.asm.asmconfigverbose.level value debug

---

1067857-8 : HSB completion time out causes unexpected reboot

Links to More Info: BT1067857

Component: TMOS

Symptoms:
A bad_tlp_status message closely follows a completion_time_out_status message in the /var/log/sel file, Following is an example:
CPU 0 PCI/DMI Error B:D.F 0:3.2: corerrsts: bad_tlp_status
CPU 0 PCI/DMI Error B:D.F 0:3.2: rperrsts: error_fatal_nonfatal_received
CPU 0 PCI/DMI Error B:D.F 0:3.2: rperrsts: non_fatal_error_messages_received
CPU 0 PCI/DMI Error B:D.F 0:3.2: uncerrsts: completion_time_out_status

Conditions:
This issue is known to occur on the following platforms:

- i2600
- i2800
- i4600
- i4800

Impact:
The device unexpectedly reboots.

Workaround:
None

---

1064753-6 : OSPF LSAs are dropped/rate limited incorrectly.

Links to More Info: BT1064753

Component: TMOS

Symptoms:
Some LSAs are dropped on BIG-IP with a log similar to:
"LSA is received recently".

Conditions:
Tuning OSPF min LSA arrival has no effect on some LSA handling.

Impact:
OSPF LSAs are dropped/rate limited incorrectly.

Workaround:
N/A

---

1064725-5 : CHMAN request for tag:19 as failed.

Links to More Info: BT1064725

Component: Local Traffic Manager

Symptoms:
The following log is seen in /var/log/ltm when a qkview is generated:

warning chmand[6307]: 012a0004:4: CHMAN request (from qkview) for tag:19 failed.

or when a tcpdump capture is started:

warning chmand[792]: 012a0004:4: CHMAN request (from bigpcapq33E5-24) for tag:19 failed

or when get a dossier from GUI/CLI:

warning chmand[4319]: 012a0004:4: CHMAN request (from get_dossier) for tag:19 failed

or when reboot:

warning chmand[8263]: 012a0004:4: CHMAN request (from mcpd) for tag:19 failed
warning chmand[8263]: 012a0004:4: CHMAN request (from DossierValidator) for tag:19 failed
warning chmand[8263]: 012a0004:4: CHMAN request (from LACPD_USER) for tag:19 failed
warning chmand[8263]: 012a0004:4: CHMAN request (from get_dossier) for tag:19 failed

Conditions:
Any one of the following:

-- Generate a qkview file from the GUI/CLI
-- Start a tcpdump command from the CLI
-- Get a dossier from GUI/CLI
-- Reboot

Impact:
No functional impact.

Workaround:
None

---

1063237-7 : Stats are incorrect when the management interface is not eth0

Links to More Info: BT1063237

Component: TMOS

Symptoms:
The provision.managementeth db variable can be used to change which interface the management interface is bridged to:

https://clouddocs.f5.com/cloud/public/v1/shared/change_mgmt_nic_google.html

If this is changed to something other than eth0, the management interface stats will continue to be read from eth0 and thus be incorrect.

Conditions:
When provision.managementeth is changed to something other than eth0.

Impact:
Management interface stats are incorrect.

Workaround:
Reconfigure the management interface to use eth0

---

1062901-5 : The 'trap-source' and 'network' SNMP properties are ineffective, and SNMP traps may be sent from an unintended interface.

Links to More Info: BT1062901

Component: TMOS

Symptoms:
The BIG-IP system sends SNMP traps from an unintended interface (likely a TMM VLAN instead of the management port).

Conditions:
This issue occurs when the configuration:

- Includes a 'trap-source' property which matches the BIG-IP system's management IP address.

- Includes a SNMP trap destination which specifies 'mgmt' as the 'network' property.

- Includes routes to the aforementioned SNMP trap destination via both tmm and the management port (and the routes are such that the tmm one wins).

Impact:
Outgoing snmp traps fail to bind to the management IP address and to leave from the management port. Instead, they will bind to a self-ip matching TMM's route to the destination and leave from a TMM VLAN.

This can cause issues (or not work at all) depending on the configuration of the host system meant to receive the traps and/or of the surrounding network devices.

Workaround:
N/A

---

1060769-5 : The /mgmt/tm/sys/performance/all-stats and /mgmt/tm/sys/performance/throughput iControl REST endpoints cannot be successfully parsed by common JSON libraries.

Links to More Info: BT1060769

Component: TMOS

Symptoms:
Because of identically-named key/value pairs in the "entries" object returned by the /mgmt/tm/sys/performance/all-stats and /mgmt/tm/sys/performance/throughput iControl REST endpoints, the output of these endpoints cannot be successfully parsed by common JSON-parsing libraries.

Only the key/value pair appearing last for a given name is returned by common JSON-parsing libraries.

As a result, the In/Out/Service sections of the output, which should show both Throughput(bit) and Throughput(packets) only shows Throughput(packets).

Conditions:
Querying the /mgmt/tm/sys/performance/all-stats or /mgmt/tm/sys/performance/throughput iControl REST endpoints.

Impact:
Common JSON-parsing libraries are unable to extract all of the information contained in the JSON blob (only a subset of the information is returned).

Workaround:
If possible, use the TMSH utility from the CLI of the BIG-IP system to display the complete information.

---

1057557-6 : Exported policy has greater-than sign '>' not escaped to '&gt;' with response_html_code tag.

Links to More Info: BT1057557

Component: Application Security Manager

Symptoms:
The greater-than sign '>' is not escaped/converted to '&gt;' with response_html_code tag.

Having an un-escaped greater-than sign can cause issues when re-importing the policy, if the greater-than sign appears in a specific sequence, ']]>'. In other words, if the greater-than sign does not appear in the specific sequence, you can successfully re-import the policy without problem.

The specific sequence can be possible with a custom response page configuration. If you modify the custom response page in the way it has a sequence of characters ']]>', as the greater-than sign is not converted due this issue, the exported policy has the sequence of characters ']]>'. The expected characters are ']]&gt;'

The characters ']]>' in XML is CDATA End delimiter and not allowed. The exported policy causes parser error and can not be re-imported.

Conditions:
This issue occurs if you modify the default custom response page where this specific character sequence is observed ']]>'.

Impact:
The exported policy cannot be re-imported.

Workaround:
This workaround forces the greater-than sign to be escaped to '&gt;' so that that policy can be re-imported without problem.

- make /usr writable
# mount -o remount,rw /usr

- backup
# cp /usr/local/share/perl5/F5/ExportPolicy/XML.pm /usr/local/share/perl5/F5/ExportPolicy/XML.pm.orig

- see this line exists
# grep "gt;" /usr/local/share/perl5/F5/ExportPolicy/XML.pm
            $xml =~ s/&gt;/>/g;

- delete the line and verify
# sed -i '/$xml =~ s＼/&gt;.*/d' /usr/local/share/perl5/F5/ExportPolicy/XML.pm

- should not see the line
# grep "gt;" /usr/local/share/perl5/F5/ExportPolicy/XML.pm

- move /usr read-only
mount -o remount,ro /usr

- make the change in effect
# pkill -f asm_config_server

---

1051153-5 : DHCP fails intermittently when the connection is through BIG-IP.

Links to More Info: BT1051153

Component: Local Traffic Manager

Symptoms:
DHCP DISCOVER packets are received, load balanced to the back end DHCP server, a DHCP OFFER reply is received from the server to BIG-IP, but this packet is dropped.

Conditions:
A BIG-IP system is between the DHCP client and DHCP server.

Impact:
DHCP OFFER is never passed on to the client, and as such, the client keeps sending DHCP DISCOVER packets, which are all dropped the same way.

---

1047789-2 : [APM] MCP err msg seen when editing/applying resource assign in VPE

Links to More Info: BT1047789

Component: TMOS

Symptoms:
An error message is found in /var/log/apm

MCP message handling failed in 0xb0ad80 (16973840): Sep 3 09:56:22 on 2 - MCP Message:

Conditions:
When VPE (or via CLI) "Advanced Resource Assign" agent is re-configured

Impact:
No functional impact.

Workaround:
None

---

1045277-6 : The /var partition may become 100% full requiring manual intervention to clear space

Links to More Info: BT1045277

Component: TMOS

Symptoms:
The /var partition might become completely full on the disk due to files being written to /var/config/rest. This condition may be accompanied by console error messages similar to the following:
011d0004:3: Disk partition /var (slot #) has only 0% free on secondary blade.

Additionally, there may be periodic restjavad and bigd daemons restarts related to disk space exhaustion.

Conditions:
Process traffic while DoS Dashboard is open

Impact:
The partition housing /var/config/rest may become 100% full, impacting future disk IO to the partition.

Workaround:
Important: This workaround is temporary, and may need to be periodically performed either manually or from a script.

Impact of Workaround: While these steps are performed, the BIG-IP REST API will be temporarily inaccessible, and higher disk IO may be seen.

Run the following commands, in sequence:

bigstart stop restjavad
rm -rf /var/config/rest/storage*.zip
rm -rf /var/config/rest/*.tmp
bigstart start restjavad

Manual application of these workaround steps clears the 100% utilized space condition and allows the partition to resume normal operation.

---

1044873-5 : Deleted GTM link is not removed from virtual server object and causes load failure.

Links to More Info: BT1044873

Component: Global Traffic Manager (DNS)

Symptoms:
The configuration fails to load with an error:

01070712:3: Values (/Common/Link_to_delete) specified for Virtual Server (/Common/vs1 /Common/HTTPP): foreign key index (explicit_link_FK) do not point at an item that exists in the database.
Unexpected Error: Loading configuration process failed.

Conditions:
-- Create GTM link
-- Assign specific link to any virtual server object
-- Delete link object
-- Run tmsh load sys config gtm-only (or create a sync group and the sync will fail)

Impact:
GTM config fails to load or config sync.

Workaround:
Remove any assigned virtual servers from the link prior to deleting it.

---

1043249-1 : Misconfigured CA bundle causes a misleading HTTP error message.

Links to More Info: BT1043249

Component: Access Policy Manager

Symptoms:
You see an error in /var/log/ltm:
Error in getting Address Space Provider Metadata from the URI <URI name> for the provider <Address space name> and error message is Content length header is missing.

Conditions:
Intentionally or mistakenly configuring a wrong "Trusted Certificate Authorities" bundle on a network access address space.

Impact:
The error message is confusing. It really means that the CA bundle is misconfigured.

Workaround:
No workaround

---

1043141-3 : Misleading error 'Symmetric Unit Key decrypt failure - decrypt failure' when loading UCS from another BIG-IP

Links to More Info: K36822000, BT1043141

Component: TMOS

Symptoms:
Loading a UCS file from another BIG-IP results in an error message similar to:

"/usr/bin/tmsh -n -g -a load sys config partitions all platform-migrate" - failed. -- 010713d0:3: Symmetric Unit Key decrypt failure - decrypt failure

The error message is misleading as the issue is unrelated to master key decryption.

Conditions:
-- Loading a UCS archive from a different BIG-IP.
-- The UCS archive does not contain a ".unitkey" file.
-- The target system does have the correct master key value configured.
-- There is some other MCPD validation issue in the configuration.

Impact:
Platform migration fails with a misleading error message.

Workaround:
Once the issue has happened, you can either:

- Examine the LTM log file for other error messages from MCPD and then correct the configuration issue(s).

OR:

- Re-start MCPD.

For more information, refer K36822000.

---

1040477-2 : Drop-Down menu shows white blank items in Reporting : DoS : URL Latencies

Links to More Info: BT1040477

Component: Application Visibility and Reporting

Symptoms:
Drop-Down menu shows white blank items in Reporting : DoS : URL Latencies

Conditions:
- 15.1.2.1 or subsequent v15 releases
- Using Chrome on Windows

Impact:
The drop-down menu is not usable.

Workaround:
None.

---

1040277-7 : Syslog-ng issue may cause logging to stop and possible reboot of a system

Links to More Info: BT1040277

Component: TMOS

Symptoms:
A syslog-ng issue with remote logging to an invalid remote syslog server may lead to logging via syslog-ng to stop, even locally. CPU use of syslog-ng may increase.

For software version 13.1 only it may lead to BIG-IP unexpectedly rebooting due to host watchdog timeout, typically within hours to a day or two after syslog-ng gets hung up.

The cessation of logging happens at the time of the last 'Syslog connection broken' in /var/log/messages before reboot.
That message will appear without a preceding 'Syslog connection established' just before it with same timestamp.

At this time syslog-ng typically spins, using near 100% CPU.

Conditions:
Invalid syslog-ng server configuration or broken connection from BIG-IP toward configured syslog-ng remote server.

A server is configured as a remote syslog destination on the BIG-IP, but it or an intervening system responds to stream of log messages by breaking connection eg by sending ICMP port unreachable to BIG-IP.

Syslog-ng will note the connection attempt and that it has broken usually in the same second, and do so every 60s when it retries.
There may be many of these log pairs, repeating every minute in /var/log/messages, such as:

  Nov 25 03:14:01 localhost.localdomain notice syslog-ng[12452]: Syslog connection established; fd='14', server='AF_INET(192.168.1.1:514)', local='AF_INET(0.0.0.0:0)'
  Nov 25 03:14:01 localhost.localdomain notice syslog-ng[12452]: Syslog connection broken; fd='14', server='AF_INET(192.168.1.1:514)', time_reopen='60'

The final log reports 'connection broken', usually one minute after the last established/broken pair in the very rare event that syslog-ng hangs.

  Nov 25 03:15:01 localhost.localdomain notice syslog-ng[12452]: Syslog connection broken; fd='14', server='AF_INET(192.168.1.1:514)', time_reopen='60'

Impact:
Very rarely syslog-ng hangs in a non-functional state. Sometimes, this may lead to an unexpected reboot of BIG-IP. Loss of logs before restart and traffic disrupted while BIG-IP restarts.

Even if it does not reboot the loss of logging functionality can cause some daemons to block while logging and thus interrupt service.

Workaround:
Ensure syslog-ng server configuration is valid, and that the server is reachable. If a remote server is not reachable remove it from the BIG-IP syslog configuration.

If the system has encountered this issue it's important that syslog-ng is restarted if that (or equivalent such as reboot) hasn't already occurred, to resume its normal service and reduce risk of further issues.

  bigstart restart syslog-ng

---

1039609-4 : Unable to poll Dynamic routing protocols SNMP OID's on non-default route domain

Links to More Info: BT1039609

Component: TMOS

Symptoms:
You are either:
  - unable to extract the dynamic routing protocols configuration information via an SNMP walk or
  - dynamic routing protocols configuration information retrieved by SNMP walk belongs instead to the default route-domain

Conditions:
Example taken below is for BGP:

-- Create BGP config in non-default route-domain, establish peer with some router.
-- Create snmp community in non-default route domain
-- Run snmp walk for BGP4 mib (1.3.6.1.2.1.15).

Certain key MIB OIDs from the BGP configuration like bgpPeerRemoteAddr,bgp4PathAttrIpAddrPrefixLen are missing.

Impact:
Dynamic routing protocols SNMP OID polling not working when they are in a non-default route-domain.

---

1036969-7 : Chrome sometimes ignores cross-site bot-defense cookies

Links to More Info: BT1036969

Component: Application Security Manager

Symptoms:
Chrome ignores cross-site bot-defense cookies when bot-defense is sending 307 redirect.

Conditions:
A site is using another site/domain resources that are also protected by bot-defense

Impact:
The other site/domain resource will not display correctly on Chrome

Workaround:
iRule work-around based on:https://devcentral.f5.com/s/articles/iRule-to-set-SameSite-for-compatible-clients-and-remove-it-for-incompatible-clients-LTM-ASM-APM.

Or, disabling simple redicret via TMSH:
tmsh modify sys db dosl7.proactive_defense_simple_redirect { value "disable" }
tmsh modify sys db dosl7.proactive_defense_simple_redirect_on_grace { value "disable" }

---

1036289-2 : Signature ID not displayed in Attack Signature details

Links to More Info: BT1036289

Component: Application Security Manager

Symptoms:
Only signature name is displayed in the "Attack signature detected" violation details. The ID is not displayed in the details nor in the event log.

Conditions:
Reviewing attack signature details

Impact:
The attack signature ID is not displayed, which makes it more difficult to correlate which attack signature was encountered.

Workaround:
Click on Attack Signature Documentation to know the signature ID.

---

1036221-1 : "Illegal parameter value length" is reported with parsing product length.

Links to More Info: BT1036221

Component: Application Security Manager

Symptoms:
"Illegal parameter value length" violation is reported with wrong parameter length.

Conditions:
A JSON parameter is encoded.

Impact:
The decoded value length of the parameter in the JSON payload will be reported instead of its original length.

Workaround:
None

---

1036217-1 : Secondary blade restarts as a result of csyncd failing to sync files for a device group

Links to More Info: BT1036217

Component: TMOS

Symptoms:
Config sync fails on the secondary blade and mcpd restarts.

In /var/log/ltm:

remote transaction for device group /Common/<group> to commit id 45018 6946340995971480381 /Common/<dest> 0 failed with error 01070712:3: Caught configuration exception (0), Failed to sync files...

Configuration error: Configuration from primary failed validation: 01070712:3: Caught configuration exception (0), Failed to sync files..... failed validation with error 17237778.

Conditions:
-- A BIG-IP system with multiple blades configured for high availability
-- A device group with AFM objects in it
-- A config sync occurs

Other conditions necessary to trigger this issue are unknown.

Impact:
Config sync to the secondary blade fails and mcpd restarts on the secondary. The cluster primary blade has the correct configuration. This will impact incremental syncing to other peers in the device group.

Workaround:
None

---

1034865-6 : CACHE::enable failed on private/no-store content

Links to More Info: BT1034865

Component: Local Traffic Manager

Symptoms:
BIG-IP provides a possibility to cache HTTP responses with RAMCACHE feature. When a response has either "Cache-Control: private" or "Cache-Control: no-store", the CACHE::enable setting allows the content to be cached. This option was removed when a fix to ID 360047 was introduced.

Conditions:
-- A virtual server has a web-acceleration profile without a policy.
-- An iRule has CACHE::enable command, overwriting Cache-Control header's values "no-store" and/or "private".

Impact:
BIG-IP always requests for a response from the origin web server even when a response is cacheable, putting extra load on the origin web server.

---

1033937-2 : HTTP message router stats do not increment for virtual servers and pools

Links to More Info: BT1033937

Component: Local Traffic Manager

Symptoms:
The HTTP MR stats for virtual servers and pools do not increment

Conditions:
- BIG-IP system with HTTP using httprouter and passing traffic.
- View the MRF stats

Impact:
Virtual server and pool stats do not increment.

---

1030093 : An http2 to http2 virtual connection with translate-address disabled might only use one stream on the server side.

Links to More Info: BT1030093

Component: Local Traffic Manager

Symptoms:
When there is no pool object available, this issue results in only stream ID 1 succeeding to the server-side. All subsequent streams fail.

Conditions:
With the following configuration:
-- client side HTTP2
-- server side HTTP2
-- HTTP2 MRF enabled
-- translate-address disabled

Impact:
Connection only works for stream 1. All other streams fail.

Workaround:
If you set "translate-address enabled" on the virtual server, then all streams work fine.

---

1029173-5 : MCPD fails to reply and does not log a valid message if there are problems replicating a transaction to PostgreSQL

Links to More Info: BT1029173

Component: TMOS

Symptoms:
In rare circumstances MCPD fails to reply to a request from TMSH, GUI, or any daemon, for example, SNMPD.

Following is an example error message:

Mar 29 00:03:12 bigip1 err mcpd[15865]: 01070734:3: Configuration error: MCPProcessor::processRequestNow: std::exception

If snmpd is the daemon that is impacted you might see this warning message:

warning snmpd[15561]: 010e0004:4: MCPD query response exceeding 270 seconds

Conditions:
- AFM is provisioned.
- MCPD fails to connect PostgreSQL.

Impact:
TMSH command save sys config might be hung.
SNMPD stops replying to SNMP GET requests.

Workaround:
If there are any hung TMSH commands, then quit.

If SNMPD stops responding to SNMP requests, then use the command bigstart restart snmpd to restart SNMPD.

---

1026965-1 : Cannot change logging format from CSV to any other if facility is not LOG_LOCAL0

Links to More Info: BT1026965

Component: Advanced Firewall Manager

Symptoms:
"cannot select remote log facility while remote storage type is not remote." error while changing the logging format

Conditions:
- facility other than LOG_LOCAL0 is configured.
- trying to change logging format from CSV to another.

Impact:
Unable to update the logging profile

Workaround:
Before changing the logging format, change the facility to LOG_LOCAL0.

---

1026781-5 : Standard HTTP monitor send strings have double CRLF appended

Links to More Info: BT1026781

Component: Local Traffic Manager

Symptoms:
Standard (bigd-based, not In-TMM) HTTP monitors have a double CRLF appended (＼r＼n＼r＼n) to the send string. This does not comply with RFC1945 section 5.1 which states requests must terminate with a single CRLF (＼r＼n). This non-compliant behavior can lead to unexpected results when probing servers.

Conditions:
Standard bigd (not In-TMM) HTTP monitors

Impact:
Servers probed by these non-RFC-compliant HTTP monitors may respond in an unexpected manner, resulting in false negative or false positive monitor results.

Workaround:
There are several workarounds:

1. If running 13.1.0 or later, switch monitoring from bigd-based to In-TMM. In-TMM monitors properly follow RFC1945 and will send only a single CRLF (＼r＼n)

2. Remain with bigd-based monitoring and configure probed servers to respond to double CRLF (＼r＼n＼r＼n) in a desired fashion

Depending on server configuration, a customized send string, even with the double CRLF, may still yield expected responses.

---

1026273-5 : HA failover connectivity using the cluster management address does not work on VIPRION platforms★

Links to More Info: BT1026273

Component: TMOS

Symptoms:
Upon upgrade to an affected version, failover communication via the management port does not work. You may still see packets passing back and forth, but the listener on the receiving end is not configured, and therefore the channel is not up.

Here are a few symptoms you may see:
-- Running 'tmsh show cm failover-status' shows a status of 'Error' on the management network.

-- Running 'tmctl' commands reports the disconnected state:
Example:
$ tmctl -l sod_tg_conn_stat -s entry_key,last_msg,status
entry_key last_msg status
----------------------------- ---------- ------
10.76.7.8->10.76.7.9:1026 0 0 <--- Notice there is no 'last message' and 'status' is 0, which means disconnected.
10.76.7.8->17.1.90.2:1026 1623681404 1

-- Looking at 'netstat -pan | grep 1026 command output, you do not see the management port listening on port 1026:
Example (notice that the management IP from the above example of 10.76.7.9 is not listed):
# netstat -pan | grep 1026
udp 0 0 10.10.10.10:1026 0.0.0.0:* 6035/sod

-- Listing /var/run/ contents shows that the chmand.pid file is missing:
 # ls /var/run/chmand.pid
ls: cannot access /var/run/chmand.pid: No such file or directory

Conditions:
-- Running on VIPRION platforms
-- Only cluster management IP address is configured: No cluster member IP addresses are configured
-- Install a software version where ID810821 is fixed (see https://cdn.f5.com/product/bugtracker/ID810821.html)
-- Management IP is configured in the failover configuration

Impact:
If only the management is configured for failover or there are communication issues over the self IP (such as misconfigured port lockdown settings), then the devices may appear to have unusual behavior such as both going active.

Workaround:
-- Configure a cluster member IP address on each individual blade in addition to the Cluster management IP address.

---

1024269-4 : Forcing a file system check on the next system reboot does not check all filesystems.

Links to More Info: BT1024269

Component: TMOS

Symptoms:
Forcing a file system check on the next system reboot, as described in K73827442, does not check all filesystems. This should not be the case and is a regression compared to previous BIG-IP versions.

After the reboot, you can inspect which filesystems were checked by running the following command:

journalctl --all --no-pager | grep -i fsck

Conditions:
A BIG-IP Administrator follows the procedure to force a file system check on the next system reboot.

Impact:
Some filesystems will not be fixed, and will continue to be corrupted. This can have a number of negative consequences. For instance, enlarging a filesystem (via the 'tmsh modify sys disk directory' command) can fail when a filesystem is dirty.

Workaround:
You can boot the system from the Maintenance Operating System (MOS), and perform all needed file system check operations from there. To boot the system into MOS, simply type 'mosreboot'. Note that once the system reboots into MOS, you will need video console access (for VE systems) or serial console access (for hardware systems) to be able to run fsck and the reboot the system into a regular BIG-IP boot location.

For more information on MOS, please refer to K14245.

---

1023529-5 : FastL4 connections with infinite timeout may become immune to manual deletion and remain in memory.

Links to More Info: BT1023529

Component: Local Traffic Manager

Symptoms:
Command "tmsh show sys tmm-traffic" reports non-zero number of current connections but "tmsh show sys connection" shows nothing.

Conditions:
-- A virtual server with fastL4 profile with infinite timeout enabled and an iRule containing "after" command. Having "-periodic" argument makes the problem more prominent.
-- Aggressive sweeper activated due to low memory conditions.

Impact:
Connections that were supposed to be removed by aggressive sweeper but were waiting for completion of an iRule may end up in a state where they are not reported by "tmsh show sys connection." Because of this issue, these connections cannot be deleted manually using 'tmsh del sys connection", but remain in memory. Their presence can be confirmed by non-zero number of current connections shown by "tmsh show sys tmm-traffic". Because of the infinite timeout setting, they will not timeout by themselves either.

Workaround:
N/A

---

1022997-5 : TCP segments with an incorrect checksum are transmitted when the sock driver is used in AWS deployments (e.g., 1NIC)

Links to More Info: BT1022997

Component: TMOS

Symptoms:
Deployments on AWS that use the sock driver (1NIC, for example) transmit packets with bad checksums when TSO/GSO is required. This causes significant delays as TMM re-segments the packets with correct checksums for retransmission, and may cause some operations to time out (such as configsyncs of large configurations).

Conditions:
-- BIG-IP Virtual Edition (VE) using the sock driver on AWS (all 1NIC deployments use this)
-- TSO/GSO required due to MTU limitations on one or more VLANs

Impact:
-- Delayed packets.
-- Possible timeouts for some operations (configsyncs, for example).

Workaround:
Modify (or create, if not present) the file /config/tmm_init.tcl on the affected BIG-IP systems, and add the following line to it:

ndal force_sw_tcs off 1d0f:ec20

Then restart TMM:

bigstart restart tmm

Note: Restarting TMM will cause a failover (or an outage if there is no high availability (HA) peer available).

---

1021925-5 : During bootup AWS BIG-IP endpoint was not licensed when custom gateway configured over management interface

Links to More Info: BT1021925

Component: TMOS

Symptoms:
AWS-based BIG-IP instance with a static IP assigned to the mgmt interface and a custom gateway configured, the box fails to load its license during startup.

Conditions:
BIG-IP configured with static IP address and customize gateway for default route.

Impact:
BIG-IP fails to load license.

Workaround:
Once BIG-IP boots up, execute reloadlic command which installs the license.

---

1019829-8 : Configsync.copyonswitch variable is not functioning on reboot

Links to More Info: BT1019829

Component: TMOS

Symptoms:
Configsync.copyonswitch variable is not functioning properly during reboot to another partition

Conditions:
-- db variable configsync.copyonswitch modified
-- hostname is changed in global-settings
-- reboot to another partition

Impact:
The hostname will be changed back to the default hostname after reboot

---

1019641-4 : SCTP INIT_ACK not forwarded

Links to More Info: BT1019641

Component: Local Traffic Manager

Symptoms:
After SCTP link down/up (not physical IF link down up), SCTP session can't be established.

Conditions:
-- CMP forwarding enabled (source-port preserve-strict)
-- The BIG-IP system is encountering heavy traffic load
-- A connection is deleted from the connection table

Impact:
Flow state can become out of sync between TMMs

Workaround:
Once the problem occurs, execute "tmsh delete sys connection", and the SCTP session will be re-established.

---

1019261-5 : In-TMM HTTPS monitor with SSL Profile set to None does not use serverssl profile.

Links to More Info: BT1019261

Component: In-tmm monitors

Symptoms:
HTTPS monitors with SSL profile set to None (default) will not use the default ServerSSL profile of "serverssl" when In-TMM monitoring is enabled. Instead, another internal ServerSSL profile is used which has different values from "serverssl".

Conditions:
-- In-TMM monitoring is enabled
-- HTTPS monitor(s) with SSL profile field is set to the default of "None"

Impact:
The TLS settings for the HTTPS monitor monitor probes will not match those of the ServerSSL "serverssl" profile and may cause unexpected behavior such as utilizing TLS 1.3 (disabled by default in the "serverssl" profile) or random session IDs.

Workaround:
Specify a ServerSSL profile in every HTTPS monitor when using In-TMM monitoring.

Attaching the profile "serverssl" will result in the same behavior that SSL Profile "none" should provide, given that the "serverssl" profile should be the default.

---

1017261-8 : Configuraton update triggers from MCP to ASM are ignored

Links to More Info: BT1017261

Component: Application Security Manager

Symptoms:
If a stale/incorrect but running PID is present in /var/ts/var/install/ucs_install.pid, then ASMConfig will think it is in the middle of a UCS or Sync load event and ignore updates from MCP.

Conditions:
A UCS load event such as an upgrade or a config sync is interrupted and ASM is not restarted until another process reuses the process id from the upgrade.

Impact:
Updates from MCP are ignored which can cause:
* Missed sync events
* Missed updates for logging or pool configuration
* Missing security policies

Workaround:
Delete /var/ts/var/install/ucs_install.pid

---

1017029-7 : SASP monitor does not identify specific cause of failed SASP Registration attempt

Links to More Info: BT1017029

Component: Local Traffic Manager

Symptoms:
On affected BIG-IP versions, upon startup, the SASP monitor sends a single Registration Request to the SASP GWM (Group Workload Manager) to initiate monitoring of configured LTM pool members. This Registration Request contains all configured LTM pools (SASP Groups) and members (SASP Group Members).

If an error is encountered by the SASP GWM with one of the SASP Groups in the request, the registration of all groups fails.
However, the GWM does not provide any indication of *which* Group or member does not match the GWM configuration, hindering troubleshooting efforts.

The current BIG-IP behavior does not allow identification of the specific pool/member or monitor that is misconfigured and thus responsible for the failed SASP Registration attempt.

Conditions:
This behavior occurs on affected BIG-IP versions when the LTM SASP monitor is configured to monitor members of multiple LTM pools, and when BIG-IP start/restarts/reboots or the configuration is loaded.

Impact:
If a single Registration Request fails, the GWM terminates the connection with the Load Balancer (BIG-IP SASP monitor). This behavior is defined by the SASP protocol and SASP GWM implementation.

As a result, the SASP monitor will mark all pool members DOWN that are monitored by the SASP monitor, halting traffic from flowing to all pools monitored by the SASP monitor.

When an error occurs during registration of the LTM pools (SASP Groups), the GWM does not provide any indication of *which* Group or member does not match the GWM configuration.
Since a single error message is returned by the SASP GWM for the entire Registration Request (for all SASP Groups), the SASP monitor cannot indicate which Group (pool/member) or monitor caused the error.

This hinders efforts to troubleshoot the cause of the failure, while all traffic has stopped flowing to the SASP-monitored pools.

Workaround:
To diagnose this issue, first enable saspd debug logging:
tmsh mod sys db saspd.loglevel value debug_msg
(Optional alternative values include deep_debug and debug, but provide less detail.)

With saspd debug logging enabled, a message like the following in /var/log/monitors/saspd.log confirms that an error occurred during the Registration step:
SASPProcessor::processRegistrationReply: received error registering workloads with GWM ##.##.##.###:3860: 69 'InvalidGroup'

If the above message is found to confirm this issue, the primary path to resolution should be for the BIG-IP administrator to very carefully compare the BIG-IP pool/member and sasp monitor configuration with the SASP GWM configuration, to identify any mismatches or inconsistencies between the configurations.

On the BIG-IP system, to help isolate the misconfigured LTM pool(s)/member(s) causing the SASP Registration failure:
1. Remove the sasp monitor from configured LTM pools/members one at a time, and observe whether any pool members still monitored by the sasp monitor are marked UP.
2. Add the sasp monitor back to configured LTM pools/members one at a time, in the same order as removed, except for the last LTM pool/member from which it was removed.
3. Save and reload the configuration, and check whether the LTM pools/members monitored by the sasp monitor are still marked UP.
4. Repeat as necessary if there appear to be multiple LTM pools/members causing a SASP Registration failure.


Alternately, it may be possible to choose a different monitor (using a more fault-tolerant protocol) to monitor the status of affected pool members.

---

1016433-3 : URI rewriting is incorrect for "data:" and "javascript:"

Links to More Info: BT1016433

Component: TMOS

Symptoms:
In case of LTM rewrite, HTML content having attribute values like "javascript:", "mailto:", "data:" etc are incorrectly rewritten as URI. This can cause web applications to fail.

Conditions:
-- LTM rewrite profile in URI translation mode.
-- HTML contents of web application contains attribute values like "javascript:abc", "data:" etc.

Impact:
Incorrect URI rewriting may cause web application to fail.

---

1016045-5 : OOPS logging may appear while active ftp if the port command forces a cmp_redirection and a quit follows.

Links to More Info: BT1016045

Component: Carrier-Grade NAT

Symptoms:
OOPS logging may appear in /var/log/ltm and /var/log/tmm

Conditions:
1. Active ftp connection.
2. Sending the port command immediately followed by a quit.

Impact:
Log pollution and potential for performance degradation.

Workaround:
N/A

---

1014761-5 : [DNS][GUI] Not able to enable/disable pool member from pool member property page

Links to More Info: BT1014761

Component: Global Traffic Manager (DNS)

Symptoms:
You are unable to enable/disable DNS pool members from the pool member property page.

Conditions:
Making changes via the DNS pool member property page.

Impact:
You can submit the changes but the changes do not persist.

Workaround:
1. tmsh
or
2. enable/disable pool member from list of pool members instead of 'general properties' page

---

1014633-5 : Transparent / gateway monitors may fail if there is no route to a node

Links to More Info: BT1014633

Component: Local Traffic Manager

Symptoms:
Transparent or gateway UDP monitors may fail.

Conditions:
-- Transparent or gateway monitor configured.
-- Route does not exist to destination.

Impact:
The UDP monitor fails and the node / pool member is marked unavailable.

Workaround:
Add a route to the destination.

---

1014361-3 : Config sync fails after provisioning APM or changing BIG-IP license

Links to More Info: BT1014361

Component: TMOS

Symptoms:
Clustered high availability (HA) devices cannot establish ConfigSync connection, and the prompt status reports disconnected.

MCPD is logging a message similar to this repeatedly, even though all TMMs are up and running:

err mcpd[4247]: 0107142f:3: Can't connect to CMI peer 192.0.2.1, TMM outbound listener not yet created

Conditions:
This can occur in either of the following conditions:

-- Some provisioning operations (i.e. provisioning APM), when TMM restarts during the provisioning. This has primarily been seen with BIG-IP instances running in Google Cloud.

-- Changing the license of a BIG-IP VE when the new license changes the number of TMM instances that will run on the BIG-IP (i.e. upgrading from a 1Gbps to 3Gbps VE license)

Impact:
BIG-IP devices are not able to perform ConfigSync operations.

Workaround:
Restart MCPD on the affected system.

Note: This will disrupt traffic while system services restart.

---

1013209-6 : BIG-IP components relying on ca-bundle.crt may stop working after upgrade★

Links to More Info: BT1013209

Component: TMOS

Symptoms:
After upgrading, the BIG-IP system components may stop working due to missing CA certificates in ca-bundle.crt.

Conditions:
CA cert which is expired/will expire in 6 months (or 182 days) after upgrade is removed from ca-bundle.crt.

Impact:
The BIG-IP components such as TMM, APM etc. may stop working due to missing CA certificates in ca-bundle.crt.

Workaround:
Download the blended-bundle.crt from the F5 download site. It is located at
https://downloads.f5.com/esd/product.jsp?sw=Certificate-Authority-Bundle&pro=Certificate-Authority-Bundle

---

1012009-4 : MQTT Message Routing virtual may result in TMM crash

Links to More Info: BT1012009

Component: Local Traffic Manager

Symptoms:
The BIG-IP system provides an option to use Message Routing virtual servers for MQTT traffic. It uses a different approach to associate a client side and a server side than a standard virtual server. In some instances, a server side is incorrectly handled.

Conditions:
-- A Message Routing virtual with MQTT protocol.
-- A client attempts to reconnect.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
None

---

1011889-7 : The BIG-IP system does not handle DHCPv6 fragmented traffic properly

Component: Local Traffic Manager

Symptoms:
In the following two scenarios, packets may get dropped by the BIG-IP device.

- [client MTU 1500]<--->(vlan1)<--->[MTU 1500BIG-IP MTU 9000]<--->(vlan2)<--->[MTU 1500server]
If the response from the server is large enough to be fragmented, the BIG-IP system is not able to process the packets.

- [client MTU 1500]<--->(vlan1)<--->[MTU 1500BIG-IP MTU 9000]<--->(vlan2)<--->[MTU 9000server]
Large response coming in a single packet is not fragmented properly on the client-side, then packets may be dropped.

Conditions:
DHCPv6 MTU size is greater than or equal to 1500.

Impact:
Packets are dropped, traffic is disrupted.

Workaround:
None

---

1010341-5 : Slower REST calls after update for CVE-2021-22986

Links to More Info: BT1010341

Component: TMOS

Symptoms:
As a result of changes were introduced to increase security around the REST API, REST calls that use HTTP basic authentication may take longer to execute that they did previously.

Conditions:
- REST API calls
- HTTP basic authentication used for the REST calls

Impact:
- Degraded performance of the REST API

Workaround:
Update automation scripting to use token based authentication, which is both faster and more secure than HTTP basic authentication

---

1010301-1 : Long-Running iCall script commands can result in iCall script failures or ceasing to run

Links to More Info: BT1010301

Component: TMOS

Symptoms:
When an iCall script runs for at least 5 minutes (or the value of "tmsh list sys scriptd max-script-run-time", default 300), the Scriptd service attempts to terminate the script.

However, iCall commands that result in external commands such as "tmsh::save sys ucs" (as used in the f5.automated_backup template) can block the termination signal until the command exits, and then block the parent Scriptd service. If this condition remains for 65 more seconds (for a total single iCall script time of at least 365 seconds), the BIG-IP system restarts the Scriptd service.

If the already-running iCall script is running after Scriptd finishes restarting, there is an additional risk that the Scriptd service may be un-marked for high availability monitoring in the BIG-IP system. See the results of "tmsh list sys daemon-ha scriptd heartbeat" to understand the case. As a result, the next time a long-running iCall command blocks the Scriptd service may cause Scriptd to hang again, potentially preventing all further iCall script runs without manual intervention.

Conditions:
- An iCall script that takes at least 6 minutes 5 seconds to run, with individual command(s) that take at least 65 seconds to run.
- For example, the f5.automated_backup template, when a UCS backups takes at least 6 minutes 5 seconds to finish on your BIG-IP system.

Impact:
The iCall scripts repeatedly fail to finish or cease to run altogether.

Workaround:
Re-enable Scriptd HA daemon heartbeat check with the following command:

tmsh modify sys daemon-ha scriptd heartbeat enabled

If you believe your iCall scripts need more time to run normally, you can increase the maximum run time (with an example of 10 minutes) with the following command:

tmsh modify sys scriptd max-script-run-time 600

---

1009337-6 : LACP trunk down due to bcm56xxd send failure

Links to More Info: BT1009337

Component: TMOS

Symptoms:
Lacp reports trunk(s) down. lacpd reports having trouble writing to bcm56xxd over the unix domain socket /var/run/uds_bcm56xxd.

Conditions:
Not known at this time.

Impact:
An outage was observed.

Workaround:
Restart bcm56xxd, lacpd, and lldpd daemons.

---

1009161-3 : SSL mirroring protect for null sessions

Links to More Info: BT1009161

Component: Local Traffic Manager

Symptoms:
Possible tmm crash during ssl handshake with connection mirroring enabled.

Conditions:
14.1 after changes applied for ID760406 and ssl handshake dropped during ssl handshake session state.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
Disable connection mirroring

---

1006857-4 : Adding a source address list to a virtual server in a partition with a non-default route domain fails.

Links to More Info: BT1006857

Component: TMOS

Symptoms:
Adding a source address list to a virtual server in a partition with a non-default route domain fails with an error similar to:

0107176c:3: Invalid Virtual Address, the IP address 10.10.10.20%2 already exists.

Conditions:
-- A partition with a non-default route domain.
-- A virtual server and address list in said partition.
-- Modifying the virtual server to use the address list as its source address.

Impact:
Unable to use a source address list in a partition with a non-default route domain.

Workaround:
Manually create a traffic-matching-criteria object in TMSH with the desired configuration, and then create the virtual server using that traffic-matching-criteria.

Steps to help with this process can be found in F5 solution article K41752699.

---

1006449-4 : High CPU utilization and slow SNMP response after upgrade★

Links to More Info: BT1006449

Component: TMOS

Symptoms:
After upgrading from a 13.1.x release to a later release (such as 15.1.x), BIG-IP CPU utilization increases and SNMP is slow to respond.

Conditions:
-- SNMP client repeatedly polls BIG-IP for OIDs in multiple tables over a short period of time.
-- Following an upgrade

Impact:
SNMP queries take an unusually long time to return data, and BIG-IP CPU utilization is higher.

Workaround:
To the file /config/snmp/bigipTrafficMgmt.conf, add one line with the following content:

  cacheObj 16

This could be accomplished by executing the following command line from bash:

  # echo "cacheObj 16" >> /config/snmp/bigipTrafficMgmt.conf

After the above config file has been modified and saved, the "snmpd" daemon must be restarted, using one of two command variants:

  (on a BIG-IP appliance or VE system)

  # bigstart restart snmpd

  (on a a multi-slot VIPRION or vCMP guest)

  # clsh bigstart restart snmpd

(However, this adjustment will be lost when the BIG-IP software is next upgraded.)

---

1004953-6 : HTTP does not fall back to HTTP/1.1★

Links to More Info: BT1004953

Component: Local Traffic Manager

Symptoms:
After upgrading, the BIG-IP system's HTTP profile no longer falls back to HTTP/1.1 if a client sends a corrupted URI.

Conditions:
-- Client sends a corrupted URI (for example a URI containing a space).

Impact:
The BIG-IP system treats the URI as an HTTP/0.9 request (as per RFC) and forwards only the first request line. In previous releases, the BIG-IP system treated the URI as a HTTP/1.1 request.

Workaround:
None.

---

1004445-6 : Warning not generated when maximum prefix limit is exceeded.

Links to More Info: BT1004445

Component: Local Traffic Manager

Symptoms:
No warnings are given when the maximum prefix limit is exceeded.

Conditions:
BGP neighbor has a maximum-prefix warning configured

Impact:
If the limit is exceeded, no warnings are given. This can cause unexpected behavior.

Workaround:
None

---

1003225-1 : 'snmpget F5-BIGIP-LOCAL-MIB::ltmWebAccelerationProfileStat* returns zeroes

Links to More Info: BT1003225

Component: TMOS

Symptoms:
The values returned during an SNMP get are incorrect for the ltmWebAccelerationProfileStat.

The values should match what is displayed by running the tmsh command.

Conditions:
Performing an SNMP get:

snmpget -v 2c -c public localhost F5-BIGIP-LOCAL-MIB::ltmWebAccelerationProfileStatCacheSize.＼"/Common/test＼"

Impact:
The system reports inaccurate information for ltmWebAccelerationProfileStat stats.

Workaround:
None

---

1002969-6 : Csyncd can consume excessive CPU time★

Links to More Info: BT1002969

Component: Local Traffic Manager

Symptoms:
Following a configuration change or software upgrade, the "csyncd" process becomes always busy, consuming excessive CPU.

Conditions:
-- occurs on a multi-blade VIPRION chassis or VELOS tenant
-- may occur with or without vCMP
-- may occur after configuring F5 Telemetry Streaming, but may also occur in other circumstances
-- large numbers of files are contained in one or more of the directories being sync'ed between blades

Impact:
The overuse of CPU resources by "csyncd" may starve other control-plane processes. Handling of payload network traffic by the data plane is not directly affected.

Workaround:
To mitigate the processing load, identify which directory or directories contain excessive numbers of files being replicated between blades by "csyncd". If this replication is not absolutely needed (see below), such a directory can be removed from the set of directories being sync'ed.

For example: if there are too many files being generated in the "/run/pamcache" directory (same as "/var/run/pamcache"), remove this directory from the set being acted upon by "csyncd" by running the following commands to comment-out the associated lines in the configuration file.
[Note it is better to follow the more complete workaround from ID 1103369, https://cdn.f5.com/product/bugtracker/ID1103369.html ]

# clsh "cp /etc/csyncd.conf /etc/csyncd.conf.$(date +%Y%m%d_%H%M%S)"

# clsh "sed -i '/run＼/pamcache/,+2s/^/#/' /etc/csyncd.conf"

# clsh "bigstart restart csyncd"



If the problem was observed soon after the installation of F5 Telemetry Streaming, the configuration can be adjusted to make csyncd ignore the related files in a subdirectory of "/var/config/rest/iapps". Run the following commands:

# clsh "cp /etc/csyncd.conf /etc/csyncd.conf.$(date +%Y%m%d_%H%M%S)"

# clsh "sed -i '/＼/var＼/config＼/rest＼/iapps/a ＼ ＼ ＼ ＼ ＼ ＼ ＼ ＼ ignore f5-telemetry' /etc/csyncd.conf"

# clsh "bigstart restart csyncd"


----

The impact of disabling replication for the pamcache folder is that in the event of a primary blade failover, the new primary blade would not be aware of the existing valid auth tokens, so the user (eg, a GUI user, or a REST script already in progress at the time of the failover) would need to authenticate again.

The impact of disabling replication for a folder under the /var/config/rest/iapps is that in the event of a primary blade failover, the new primary blade would not be aware of the iApps LX package, so the user would need to install the iApps LX package on the new primary blade.

---

1002417-3 : Switch L2 forwarding entries learnt on multi-blade trunk in one blade needs to be synchronized to other blades of that trunk

Links to More Info: BT1002417

Component: TMOS

Symptoms:
In a chassis, when the switch needs to forward a packet where the destination MAC address does not exist in the L2 forwarding table (DLF, destination lookup failure), the packet is forwarded to blade one and flooded there. This can lead to interfaces on blade one being more heavily used.

Conditions:
Altering of trunk vlan memberships after failovers will lead to traffic imbalance on egress ports.

Impact:
It may lead to an out of bandwidth condition on interfaces.

---

1002345-5 : Transparent monitor does not work after upgrade★

Links to More Info: BT1002345

Component: In-tmm monitors

Symptoms:
Pool state changes from up to down following an upgrade.

Conditions:
A transparent monitor is configured to use the loopback address.
You are using BIG-IP Virtual Edition with a TAP interface handling linux host traffic.

Impact:
The pool is marked down.

Workaround:
None

---

1001101-6 : Cannot update/display GTM/DNS listener route advertisement correctly

Links to More Info: BT1001101

Component: Global Traffic Manager (DNS)

Symptoms:
Not able to update/display GTM/DNS listener route advertisement correctly.

Conditions:
Operating from the GUI GTM/DNS listener page.

Impact:
Not able to manage route advertisement from GUI GTM listener page.

Workaround:
Instead of GTM/DNS GUI, use LTM virtual address operations to manage GTM/DNS listener route advertisement.

---

★ This issue may cause the configuration to fail to load or may significantly impact system performance after upgrade