Cumulative fix details for BIG-IP v21.1.0.1 that are included in this release

Known Issue details for BIG-IP v21.1.x

995877-3 : Edge Client 'Save Password'' checkbox not visible when 'Allow Password Caching' method is 'memory'

Links to More Info: BT995877

Component: Access Policy Manager

Symptoms:
The 'Save Password' checkbox is not displayed.

Conditions:
-- 'Allow Password Caching' is selected in the connectivity profile.
-- The 'Allow Password Caching' method is 'memory'.
-- From the Edge Client, access the virtual server.

Impact:
The 'Save Password' option does not exist on the logon page.

Workaround:
Use the 'disk' option in 'Allow Password Caching' instead of 'memory'.

941961-9 : Upgrading system using WAM TCP profiles may prevent the configuration from loading

Links to More Info: BT941961

Component: TMOS

Symptoms:
If a BIG-IP is on version 13.1.0 through 15.1.x and has profiles in use that use wam-tcp-wan-optimized and/or wam-tcp-lan-optimized as parent profiles, then when the configuration is upgraded to 16.0.0, the configuration fails to load, with an error similar to:

err mcpd[10087]: 01020036:3: The requested parent profile (/Common/wam-tcp-wan-optimized) was not found.

On devices that are provisioned with not just the LTM module this may lead to an out of memory condition as the config load failure prevents memory provisioning completing leaving too little 4KB page (host) memory and too much huge page memory.

If suffering memory pressure then management access to device will be sluggish or not possible.

Conditions:
-- Upgrading from version 13.1.0 through 15.1.x.
-- Using profiles derived from wam-tcp-wan-optimized and/or wam-tcp-lan-optimized.

Impact:
Configuration does not load.

Workaround:
Remove these profiles and adjust the configuration elements that use them accordingly. If it is difficult to work on the device it may be necessary to rollback to earlier version and make changes there. Usually it would be better then to delete newer software volume and reinstall it at which point the modified config will be copied across and installed on newer volume.

Here are two examples:

-- Copy the definition of 'wam-tcp-wan-optimized' from /defaults/wam_base.conf into /config/bigip.conf, and then reload the configuration.

-- Change the references to wam-tcp-wan-optimized to something else in your config file (e.g., tcp-wan-optimized), and then reload the configuration.

933809-4 : Too many interrupts from console serial port starve TMM for CPU time

Links to More Info: BT933809

Component: TMOS

Symptoms:
Kernel log file will show this message:
"err kernel: serial8250: too much work for irq4"
In some conditions when there are too many of these, TMM may crash.

Conditions:
Occurs due to performing heavy I/O over the serial console.
For example, running tcpdump and dumping the output to the console while the device is under heavy load.

Impact:
Traffic disrupted while tmm restarts.

Workaround:
Avoid using the console for issuing commands that produces a lot of output.

932553-11 : An HTTP request is not served when a remote logging server is down

Links to More Info: BT932553

Component: Local Traffic Manager

Symptoms:
BIG-IP systems provide an option to sanitize HTTP traffic via the http_security profile. When the profile is configured to alarm on a violation, it is possible that a connection to the violating client is reset if a remote logging server is marked down.

Conditions:
-- A BIG-IP system has an HTTP profile and and an http_security profile with the alarm option set.
-- A remote logging server is configured via a BIG-IP pool.
-- The pool has a monitor that marks all the pool members down.
-- A request with an HTTP violation is processed and triggers an alarm configured in the http_security profile.

Impact:
-- A TCP connection to a client is reset by the BIG-IP system.
-- The web page may not render, or may not render as expected.
-- Data are not delivered to a server with a POST request.

Workaround:
None.

914493-9 : Protocol Profile (Client) for virtual server is reset to the default profile for that protocol

Links to More Info: BT914493

Component: TMOS

Symptoms:
The GUI page always incorrectly shows that the default protocol profile is selected in a virtual server, even though it is not the actual configured profile

CLI will show the correct information for the virtual server

Conditions:
A virtual server is configured with a non-default protocol profile

Impact:
- The GUI always displays the default protocol profile (e.g., "tcp") regardless of the actual configured value
- The actual tmsh configuration remains correct
- If an administrator clicks "Update" while viewing the incorrect GUI values, the default profile gets pushed to the configuration, silently overwriting the intended setting, along with any other changes being made

Workaround:
No workarounds in the GUI to view the correctly selected profile

CLI will show the correct profile selected

912293-9 : Persistence might not work properly on virtual servers that utilize address lists★

Component: Local Traffic Manager

Symptoms:
-- Connections to the virtual server might hang.
-- Increased tmm CPU utilization. This can occur after upgrading.

Conditions:
-- A virtual server is configured with a traffic-matching-criteria that utilizes a source-address-list and/or destination-address-list.

-- The virtual server utilizes certain persistence one of the following persistence types:
  + Source Address (but not hash-algorithm carp)
  + Destination Address (but not hash-algorithm carp)
  + Universal
  + Cookie (only cookie hash)
  + Host
  + SSL session
  + SIP
  + Hash (but not hash-algorithm carp)

Impact:
-- High tmm CPU utilization.
-- Stalled connections.

Workaround:
Enable match-across-virtuals in the persistence profile.

Note: Enabling match-across-virtuals might affect the behaviour of other virtual servers in the configuration that utilise persistence.

905477-9 : The sdmd daemon cores during config sync when multiple devices configured for iRules LX

Links to More Info: BT905477

Component: Local Traffic Manager

Symptoms:
The iRules LX workspaces belong on only one device in a Device Service Cluster (DSC) (config sync device-group). If you have the same iRules LX workspace configured on multiple devices and then perform a config sync operation, the sdmd daemon cores.

Conditions:
-- Multiple devices configured with the same iRules LX workspace in a DSC.
-- Change one of the devices such that the configuration requires a config sync.
-- Perform the config sync.

Impact:
The sdmd daemon cores. Although having multiple devices configured with the same iRules LX workspace is an incorrect configuration, sdmd should not core.

Workaround:
When the iRules LX workspace is correctly configured, i.e., on only one device in a DSC, there is no need to config sync, so this issues does not occur.

898389-10 : Traffic is not classified when adding port-list to virtual server from GUI

Links to More Info: BT898389

Component: Local Traffic Manager

Symptoms:
Traffic is not matching to the virtual server.

Conditions:
Using the GUI to configure traffic-matching-criteria by adding port-list to the virtual server.

Impact:
Traffic loss.

Workaround:
Creating traffic-matching-criteria from the command line

root@(localhost)(cfg-sync Standalone)(Active)(/Common)(tmos)# create ltm traffic-matching-criteria tmc_name_here destination-address-inline <IP ADDR>%10 route-domain <Route domain name>

883149-10 : The fix for ID 439539 can cause mcpd to core.

Links to More Info: BT883149

Component: TMOS

Symptoms:
Mcpd cores during config sync.

Conditions:
This occurs on rare occasions when the device transitions from standby to active, and the connection between the BIG-IP peers stalls out.

Impact:
Mcpd cores. Traffic disrupted while mcpd restarts.

Workaround:
None

881937-7 : TMM and the kernel choose different VLANs as source IPs when using IPv6.

Links to More Info: BT881937

Component: Local Traffic Manager

Symptoms:
IPv6 traffic generated from the host, either from a host daemon, monitors, or from the command line, can use a MAC and IPv6 source address from different VLANs.

Conditions:
-- Multiple VLANs configured with IPv6 addresses.
-- Multiple routes to the same destination, either the same or more specific, default routes, etc., that cover the traffic destination.
-- Changes are made to routes that cause the traffic to the destination to shift from one VLAN and gateway to another. This can be typically observed with dynamic routing updates.
- The db key snat.hosttraffic is set to disable.

Impact:
Traffic to the destination may fail because the incorrect source IPv6/MAC address is used, which might cause monitor traffic to fail.

Workaround:
Tmsh list sys db snat.hosttraffic
tmsh modify sys db snat.hosttraffic value enable
tmsh save sys config

870349-7 : Continuous restart of ntlmconnpool after the license reinstallation★

Links to More Info: BT870349

Component: TMOS

Symptoms:
The ntlmconnpool process continuously restarts after reinstalling the license. The system reports a message in the BIG-IP console:

Re-starting ntlmconnpool.

The BIG-IP may show as 'Disconnected', and 'TMM outbound listener not yet created' messages may be present in /var/log/ltm.

Conditions:
This occurs when you upgrade your license such that the new license changes the number of available TMMs.

Impact:
The system requires a reboot and reports a ‘Re-starting ntlmconnpool’ message continuously in the BIG-IP console.

Workaround:
To resolve the issue, it is necessary to reboot. Once the system restarts, it operates as expected.

867985-10 : LTM policy with a 'shutdown' action incorrectly allows iRule execution

Links to More Info: BT867985

Component: Local Traffic Manager

Symptoms:
BIG-IP systems provide manipulation tools over a connection with an LTM policy and/or iRule. LTM policy takes precedence over iRules and has an option to shutdown a connection based on satisfied conditions. When a connection is closing, an iRule should not be executed under the same conditions.

Conditions:
-- The BIG-IP system has a virtual server with an LTM policy and an iRule.
-- The LTM policy has action 'shutdown connection' under certain conditions.
-- The iRule has an event which is triggered under the same conditions.

Impact:
The iRule is executed before the connection is being reset.

Workaround:
None.

857769 : FastL4+HTTP or FastL4+Hash-Persistence virtual servers do not work correctly in DSR mode.

Links to More Info: BT857769

Component: Local Traffic Manager

Symptoms:
Given a long-lived TCP connection that can carry multiple client requests (for example, but not limited to, HTTP requests), the BIG-IP system fails to forward requests after the forty-eighth one.

The client will try re-transmitting the answered request, but the BIG-IP system will persist in dropping it.

Conditions:
This issue occurs when all of the following conditions are met:

1) The virtual server uses the FastL4 profile.
2) The virtual server also uses the HTTP or Hash-Persistence profiles.
3) The virtual server operates in DSR (Direct Server Return) mode (also known as N-Path).

Impact:
The BIG-IP system fails to forward traffic.

Workaround:
Do not use the HTTP or Hash-Persistence profiles with a FastL4 virtual server operating in DSR mode.

Note: It is fine to use an iRule that calls hash persistence commands (for example, "persist carp [...]") as long as the Hash-Persistence profile is not associated to the virtual server. This technique will allow you to persist on a hash based on L4 information that you can extract at CLIENT_ACCEPTED time. For example, the following iRule correctly persists a specific client socket to a pool member in a FastL4 DSR configuration:

when CLIENT_ACCEPTED {
   persist carp [IP::client_addr]:[TCP::client_port]
}

851837-8 : Mcpd fails to start for single NIC VE devices configured in a trust domain

Links to More Info: BT851837

Component: TMOS

Symptoms:
Single NIC BIG-IP Virtual Edition (VE) devices configured in a trust domain (e.g., in high availability (HA)) cannot reload a running configuration when restarted and/or when mcpd fails to load the config, and reports a validation error:

err mcpd[25194]: 0107146f:3: Self-device config sync address cannot reference the non-existent Self IP ([IP ADDR]); Create it in the /Common folder first.

Conditions:
Single NIC VE devices configured in a trust domain (e.g., HA)

Impact:
The mcpd process fails to start, and the configuration does not load.

Workaround:
Manually copy and paste the self IP configuration snippet into the /config/bigip_base.conf file:

1. Connect to the CLI.

2. Edit bigip_base.conf, and add the following:

net self self_1nic {
    address 10.0.0.1/24
    allow-service {
       default
    }
    traffic-group traffic-group-local-only
    vlan internal
}

Note: replace 10.0.0.1 with the IP indicated in the error message

3. Save the changes and exit.

4. Load the configuration using the command:
tmsh load sys config

5. If APM or ASM is provisioned/configured, then also restart services with this command:
bigstart restart

842137 : Keys cannot be created on module protected partitions when strict FIPS mode is set

Links to More Info: BT842137

Component: Local Traffic Manager

Symptoms:
When the Hardware Security Module (HSM) FIPS mode is set to FIPS 140-2 Level 3 protection, new keys cannot be created in the module's protected partition.

Note: Although FIPS grade Internal HSM (PCI card) is validated by the Marvell company at FIPS 140-2 Level 3, the BIG-IP system is not 140-2 Level 3 validated.

Conditions:
-- FIPS 140-2 Level 3 protection is configured on a NetHSM partition.
-- You attempt to create a FIPS key using that partition.

Impact:
New Keys cannot be create.

Workaround:
Follow these steps to generate a new NetHSM key called 'workaround' and install it into the BIG-IP config:

1. Generate the key:

[root@bigip1::Active:Standalone] config # fipskey.nethsm --genkey -o workaround -c module
WARNING: fipskey.nethsm will soon be deprecated for use with Thales. Please switch to using tmsh commands instead.
tmsh commands...

Generate Key:
tmsh create sys crypto key <key_name> security-type nethsm [gen-certificate|gen-csr] ...
For an exhaustive list of options, please consult F5's tmsh documentation.
Generate CSR for existing key:
tmsh create sys crypto csr <csr_name> key <key name> ...
For an exhaustive list of options, please consult F5's tmsh documentation.
Generate Self-Signed Certificate for existing key:
tmsh create sys crypto cert <cert_name> key <key name> ...
For an exhaustive list of options, please consult F5's tmsh documentation.
Delete Key:
tmsh delete sys crypto key <keyname>


str[cd /shared/tmp && /opt/nfast/bin/generatekey -b pkcs11 certreq=yes selfcert=yes protect=module size=2048 embedsavefile="workaround" plainname="workaround" digest=sha256]
key generation parameters:
 operation Operation to perform generate
 application Application pkcs11
 protect Protected by module
 verify Verify security of key yes
 type Key type RSA
 size Key size 2048
 pubexp Public exponent for RSA key (hex)
 embedsavefile Filename to write key to workaround
 plainname Key name workaround
 x509country Country code
 x509province State or province
 x509locality City or locality
 x509org Organisation
 x509orgunit Organisation unit
 x509dnscommon Domain name
 x509email Email address
 nvram Blob in NVRAM (needs ACS) no
 digest Digest to sign cert req with sha256

Key successfully generated.
Path to key: /opt/nfast/kmdata/local/key_pkcs11_ua882aa9fadee7e440772cb6686358f4b283922622
Starting synchronisation, task ID 5de83486.6e9e32d7f367eaf4
Directory listing failed: No such file or directory


2. Confirm the presence of the key with the label 'workaround':

[root@bigip1::Active:Standalone] config # nfkminfo -l

Keys with module protection:

 key_pkcs11_ua882aa9fadee7e440772cb6686358f4b283922622 `workaround'

Keys protected by cardsets:
...


3. Install the key:

[root@bigip1::Active:Standalone] config # tmsh install sys crypto key workaround from-nethsm


4. Install the public certificate:

[root@bigip1::Active:Standalone] config # tmsh install sys crypto cert workaround from-local-file /config/ssl/ssl.crt/workaround

811425-2 : On a vCMP host VIPRION chassis, mcpd may restart on secondary blades after an abrupt inter-blade disconnection

Links to More Info: BT811425

Component: TMOS

Symptoms:
On a VIPRION chassis provisioned as a vCMP host, mcpd on the secondary blades may restart and log errors similar to the following in /var/log/ltm:
err mcpd[43273]: 01070734:3: Configuration error: DB validation exception, unique constraint violation on table (trunk_virtual_mbr) object ID (<guest_name> <PDE_interface>). A duplicate value was received for a non-primary key unique index field. DB exception text (Cannot update_indexes/checkpoint DB object, class:trunk_virtual_mbr status:13)... failed validation with error 17237812

Conditions:
All of the following conditions must be met:
- The VIPRION system is provisioned as a vCMP host with one or more deployed guests.
- An abrupt loss of inter-blade connectivity occurs without a graceful secondary disconnect.
- A secondary blade subsequently reconnects to the primary.

Impact:
All services on the affected secondary blades restart. vCMP guests running on those blades are disrupted until MCPD recovers

791365-8 : Bad encryption password error on UCS save

Links to More Info: BT791365

Component: TMOS

Symptoms:
When a user with the admin role attempts to save a UCS with a passphrase, the following error is encountered:

[resource-admin@inetgtm1dev:Active:Standalone] ucs # tmsh save sys ucs /var/local/ucs/test-ucs passphrase password
Saving active configuration...
Error: Bad encryption password. <=========
Operation aborted.
/var/tmp/configsync.spec: Error creating package

WARNING:There are error(s) during saving.
        Not everything was saved.
        Be very careful when using this saved file!

Error creating package
Error during config save.
Unexpected Error: UCS saving process failed.

Conditions:
1) Log into the BIG-IP system as a user with admin role that has Advanced Shell access.
2) Attempt to create a UCS with a passphrase.

Impact:
Unable to save UCS with a passphrase.

Workaround:
This affects users logged in with the Admin role; you will be able to create a UCS with a passphrase while logged in firstly as root user and then use 'resource-admin' user to save a ucs with passphrase.

767473-5 : SMTP Error: Could not authenticate

Links to More Info: BT767473

Component: Application Visibility and Reporting

Symptoms:
When using a "sys smtp-server" object (System >> Configuration >> Device >> SMTP) to configure an SMTP mail server, mail may be rejected by the remote SMTP server, and clicking on the "Test Connection" button returns "SMTP Error: Could not authenticate"

Conditions:
The remote SMTP server requires TLS1.2 or higher.

Impact:
Unable to send mail for BIG-IP features that make use of the 'sys smtp-server' object, such as AVR and ASM reports.

Workaround:
Configure the BIG-IP to relay mail through a locally administered SMTP server that allows TLS 1.0 connections (which may mean creating an SMTP relay that only accepts mail from BIG-IP devices and relays it securely to another SMTP server)

760740-6 : Mysql error is displayed when saving UCS configuration on BIG-IP system when MySQL is not running

Links to More Info: BT760740

Component: Protocol Inspection

Symptoms:
When saving the configuration to a UCS file, the process tries save the IPS learning information stored in the MySQL database.

MySQL runs only when particular modules are provisioned. If MySQL was previously running as a result of different provisioning, but is not currently running, saving the configuration to a UCS file succeeds, but the system reports a spurious message during the operation:

Can't connect to local MySQL server through socket '/var/lib/mysql/mysql.sock.

Conditions:
-- Saving the configuration to a UCS file.
-- BIG-IP system provisioning only includes modules that do not require MySQL. These modules may include:
   + LTM
   + FPS
   + GTM (DNS)
   + LC
   + SWG
   + iLX
   + SSLo

-- BIG-IP system was previously provisioned with a module that starts MySQL, which results in the creation of the file /var/db/mysqlpw. These modules may include:
   + APM
   + ASM
   + AVR
   + PEM
   + AFM
   + vCMP

Impact:
The error message is cosmetic and has no impact on the UCS save process.

Workaround:
None.

759258 : Instances shows incorrect pools if the same members are used in other pools

Links to More Info: BT759258

Component: TMOS

Symptoms:
Monitor 'Instances' tab shows incorrect pools if the same members are used in other pools.

Conditions:
Steps to Reproduce:

1. Create custom monitor or use system default.
2. Assign that monitor to a test pool.
3. Navigate to Local Traffic :: Monitors, click the test monitor, then select the Instances tab.

Impact:
The test pool is displayed, as well any other pools that use the same member or members (but with other monitors assigned).

Workaround:
Use tmsh to list monitor instances

For example:

   tmsh show ltm monitor gateway-icmp /Common/gateway_icmp

741621-7 : CLI preference 'suppress-warnings' setting may show incorrectly

Links to More Info: BT741621

Component: TMOS

Symptoms:
At times when the 'suppress-warnings' setting is at its default value ('none'), it may be listed like this instead:

suppress-warnings { }

After loading the configuration, the 'suppress-warnings' setting may return to the default value, in which case it is no longer visible when listing out the CLI preferences (without specifying 'all-properties').

Conditions:
-- Using the default value for 'suppress-warnings' in the CLI preferences.
-- Listing out the CLI preferences.

Impact:
Possibly confusing listing for this value. The 'suppress-warnings' setting auto-populates with an incorrect default of empty { } (instead of 'none') on config load, causing it to be displayed when listing CLI preference in tmsh.

Workaround:
None

725646-11 : The tmsh utility cores when multiple tmsh instances are spawned and terminated quickly

Links to More Info: BT725646

Component: TMOS

Symptoms:
A tmsh core occurs when multiple tmsh instances are spawned and terminated quickly

/var/log/kern.log:
info kernel: tmsh[19017]: segfault ...

system messages in /var/log/messages:
notice logger: Started writing core file: /var/core/-tmsh ...

/var/log/audit:
notice -tmsh[19010]: 01420002:5: AUDIT - pid=19010 ...

Conditions:
This issue occurs intermittently in the following scenario:

1. Open multiple instances of tmsh using the following command pattern:
tmsh
run util bash
tmsh
run util bash
tmsh
run util bash
tmsh
run util bash
...
2. Quickly terminate them using Ctrl-D or by closing terminal.

Impact:
The tmsh utility crashes and produces a core file in the /shared/core directory. The BIG-IP system remains operational.

Workaround:
Restart tmsh if the problem occurs.

To prevent the issue from occurring: Do not quickly terminate tmsh instances using Ctrl-D.

714705-11 : Excessive 'The Service Check Date check was skipped' log messages.

Links to More Info: BT714705

Component: TMOS

Symptoms:
Large numbers of these warnings are logged into the "ltm" file:

  warning httpd[12345]: 0118000a:4: The Service Check Date check was skipped.

The message appears whenever a new "httpd" instance is launched.

Conditions:
The BIG-IP instance has been installed with a "no service check" license. These licenses are sometimes provided with cloud pre-licensed VE software images.

Impact:
Log files are saturated with many useless warnings. This can hide actual problems and impede their diagnosis.

Workaround:
During manual troubleshooting, commands such as the following may be used to filter the excess warnings:

# grep -v 'Service Check Date check was skipped' ltm | less

The syslog-ng 'include' filter mechanism is another possibility, but this should be attempted only with assistance of the F5 Support team.

683706 : Monitor status may show 'checking' after a pool member has been manually forced down

Links to More Info: BT683706

Component: Local Traffic Manager

Symptoms:
Following certain sequences of actions, a pool member that is forced offline (e.g., '{session user-disabled state user-down}'), may have an associated monitor status (status of the associated monitor instance) that is shown as 'checking'.

Conditions:
This result may occur as the result of one of the following sequences of actions:

1. A pool member is created with an associated monitor, and that pool member is simultaneously forced offline.

Example:
tmsh create ltm pool test1 members add { 10.1.108.2:80 { session user-disabled state user-down } } monitor http

2. A pool member is disabled or forced offline, the configuration is saved, and the BIG-IP system is restarted (for example, by 'bigstart restart' or 'reboot' commands).

Example:
tmsh modify ltm pool test1 members modify 10.1.108.2:80 { session user-disabled state user-down } }
tmsh save sys config
bigstart restart

Impact:
The pool member remains offline as directed, but the associated monitor status (monitor instance status) indicates 'checking', which does not appear to match the pool member status.

If the pool member is subsequently re-enabled, the associated monitor status (status of the associated monitor instance) will be updated to show the result of current monitor pings.

Workaround:
The 'checking' status of the monitor instance may be unexpected, in this context, but:

- The monitor status (monitor instance status) does not affect the status of a disabled pool member.

- This monitor status indicates that no monitor pings have been performed to update the initial state of the monitored object from 'checking' to a result determined by a monitor ping. The BIG-IP monitoring subsystem does not ping disabled pool members to update this status.

637613-10 : Cluster blade status immediately returns to enabled/green after it is disabled.

Links to More Info: K24133500, BT637613

Component: Local Traffic Manager

Symptoms:
In some scenarios, disabling a blade will result in the blade immediately returning to online.

Conditions:
This can occur intermittently under these conditions:

- 2 chassis in an HA pair configured with min-up-members (for example, 2 chassis, 2 blades each, and min-up-members=2)
- You disable a primary blade on the active unit, causing the cluster to failover due to insufficient min-up-members.

Impact:
Disabling the primary blade fails and it remains the primary blade with a status of online.

Workaround:
This is an intermittent issue, and re-trying may work. If it does not, you can configure min-up-members to a lower value or disable it completely while you are disabling the primary blade. The issue is triggered when the act of disabling the primary blade would cause the number of members to drop below min-up-members.

632553-9 : DHCP: OFFER packets from server are intermittently dropped

Links to More Info: K14947100, BT632553

Component: Local Traffic Manager

Symptoms:
With a DHCP relay virtual server, OFFER packets from DHCP server are intermittently not forwarded to the client and dropped on BIG-IP system.

Conditions:
It is not known exactly what triggers this condition, but it occurs intermittently when the DHCP relay virtual server is in use.

Impact:
Client machines joining the network do not receive DHCP OFFER messages.

Workaround:
Manually delete the serverside to force it to be recreated by the next DHCP request.

For example, if the flow to the DHCP server 10.0.66.222 is broken, issue the following tmsh command:

tmsh delete sys connection ss-server-addr 10.0.66.222 cs-server-port 67

566995-7 : bgpd might crash in rare circumstances.

Links to More Info: BT566995

Component: TMOS

Symptoms:
Under unspecified conditions and in rare cases, bgpd might crash. Although bgpd restarts right away, routing table might be impacted.

Conditions:
The conditions under which this occurs are not known.

Impact:
This might impact routing table and reachability.

Workaround:
None known.

469724-7 : When evaluation/demonstration features expire, features enabled by both evaluation and perpetual licenses also expire

Links to More Info: BT469724

Component: TMOS

Symptoms:
Evaluation features cause perpetual features to expire when the evaluation license expires.

Conditions:
-- Perpetual license with an evaluation/demonstration add-on feature.
-- The add-on license expires or is expired.

Impact:
When an evaluation/demonstration add-on license expires, features included in both the evaluation add-on as well as the regular, perpetual license stop working.

This behavior is covered in F5 article K4679: BIG-IP evaluation and demonstration licenses do expire :: https://support.f5.com/csp/article/K4679.

Workaround:
To work around this issue, activate the license from the command line:

When reactivating an existing license, and deactivating an expired evaluation license key, specify the base registration key and add-on (if any), and use the -i option for the expired evaluation license key in the get_dossier command.

For example, if the expired evaluation license key is ABCDEFG-ZZZZZZZ, use the following command:

get_dossier -b ABCDE-ABCDE-ABCDE-ABCDE-ABCDEFG -a ABCDEFG-ABCDEFG -i ABCDEFG-ZZZZZZZ

You can find these steps detailed in K2595: Activating and installing a license file from the command line :: https://support.f5.com/csp/article/K2595. This part in particular is required to work around this issue

369640-9 : iRules might return incorrect data when multiple partitions and/or folders contain objects with the same name

Links to More Info: K17195

Component: Local Traffic Manager

Symptoms:
iRules might return incorrect data when the BIG-IP configuration has folders or multiple administrative partitions that contain objects with the same name.

As a result of this issue, you may encounter one or more of the following symptoms:

 -- Client connections receive incorrect data.
 -- The BIG-IP system incorrectly load balances client connections.

Conditions:
This issue occurs when all of the following conditions are met:

 -- The configuration includes objects of the same name in different folders or administrative partitions
 -- An iRule references the object without using the fully-qualified path, e.g. "pool example_pool" instead of "pool /Common/folder1/example_pool"

Impact:
Client connections receive incorrect data, or are load balanced incorrectly.

Workaround:
To work around this issue, always specify full paths to objects referenced in iRules, e.g. instead of:
    pool example_pool
use:
    pool /Common/example_pool

2395777-1 : Radius monitor password encryption is incorrect

Component: Local Traffic Manager

Symptoms:
Radius monitors will send an Access-Request with a password that has been incorrectly encrypted. This will cause the pool member to return an Access-Reject packet, resulting in a monitor failure

Conditions:
Radius monitor configured with a password

Impact:
Radius monitors configured with a password will always fail and mark the pool member down

Workaround:
None

2391333-1 : Bigd: Failed to find EAV pinger script file for imported external monitor★

Component: Local Traffic Manager

Symptoms:
When monitoring an LTM pool using an imported external monitor, the pool members may remain in a "checking" state and never get marked UP or DOWN by the external monitor

When this occurs, a message similar to the following is logged in the LTM log file (/var/log/ltm):

alert bigd.#[#####]: Failed to find EAV pinger script file, /config/filestore/files_d/Common_d/external_monitor_d/:<partition_name>:<external_monitor_name>_#####_##

Conditions:
This may occur on affected versions of BIG-IP if:

- You either upgrade to an affected version, with one or more external monitors configured, or you add an external monitor to the BIG-IP configuration while running an affected version

- The external monitor was created from a script imported into the BIG-IP system as a new external monitor file, not from an external monitor included in the BIG-IP system

Impact:
The imported external monitor does not function. Pool members are not marked UP or DOWN by the action of the external monitor

Workaround:
None

2390849-1 : FTP connections reset after protocol security is toggled off/on and ASM is restarted

Component: Application Security Manager

Symptoms:
Connection RST immediately after the client connects to the FTP virtual server where FTP protocol security is enabled.

In pcap or rstcause, plugin abort initiated by PSM.

"Internal error (PSM::FTP requested abort (plugin abort error))."

In bd.log, an error below is emitted.

event_open: ***ERROR: Cannot get data profile info from DB

Conditions:
- Protocol security
- Enable/disable protocol security via GUI screen below

Local Traffic ›› Profiles : Services : FTP ›› FTP_PROFILE_NAME

Impact:
Connection reset

Workaround:
Disable and reenable protocol security via GUI screen below

Local Traffic ›› Virtual Servers : Virtual Server List ›› VIRTUAL_NAME ›› Security

2389277-3 : ASM GUI Learning and Blocking page search result returning extra unnecessary items

Links to More Info: BT2389277

Component: Application Security Manager

Symptoms:
Under Security -> Application Security -> Policy Building -> Learning and Blocking Settings, if searching for "Unescaped", the HTTP Protocol Compliance section will appear despite having no matching entries

Conditions:
- BIG-IP with ASM provisioned

Impact:
This is cosmetic only. There is no functional impact

Workaround:
N/A

2389273-3 : Incorrect GUI HTTP Protocol Sub-Violation counts under Learning and Blocking Settings

Links to More Info: BT2389273

Component: Application Security Manager

Symptoms:
Under Security -> Application Security -> Policy Building -> Learning and Blocking Settings, the Enabled and Total counts for the HTTP Protocol Compliance section are each 1 higher than they should be

Conditions:
- BIG-IP with ASM provisioned

Impact:
This is cosmetic only. There is no functional impact

Workaround:
N/A

2388333-1 : BIG-IP terminates HTTP/2 with GOAWAY/PROTOCOL_ERROR when client sends empty initial SETTINGS frame

Component: Local Traffic Manager

Symptoms:
The HTTP/2 protocol requires that an empty SETTINGS frame be sent as the first frame. When BIG-IP receives this empty initial SETTINGS frame, it incorrectly terminates the connection with a PROTOCOL_ERROR

Conditions:
- BIG-IP has a virtual server with an HTTP/2 profile
- Client initiates an HTTP/2 connection and sends its initial SETTINGS frame with no settings

Impact:
Connection is immediately terminated, preventing the client from serving any requests

Workaround:
None

2386237-4 : Traffic-matching-criteria with no route-domain specified fails to match traffic in non-default route-domain partition

Links to More Info: BT2386237

Component: Local Traffic Manager

Symptoms:
In a partition that uses a non-default route domain, a traffic-matching criteria object created without specifying an explicit route domain (for example, through the GUI or by using the 'load sys config' command) builds its virtual address and listener in route domain 0. As a result, traffic within the partition's route domain will not match the listener. Please note that the TMSH workaround needs to be reapplied on each device after every configuration synchronization or reload

Conditions:
- A partition with a non-default route domain is configured
- A traffic-matching-criteria object is created without an explicit route-domain (including via the GUI or config load)

Impact:
Traffic fails to match the virtual server. The TMSH workaround does not survive config-sync or config reload

Workaround:
When creating the traffic-matching-criteria object via TMSH, specify the route-domain explicitly. See K94024302 for steps

2386137-1 : Remote SNMPv3 fails to connect

Links to More Info: BT2386137

Component: TMOS

Symptoms:
Trying to use SNMPv3 remotely just results in timeouts.
In /var/log/snmpd, the following log message shows that v1-traps or v2-traps are configured.
"The separate port argument for sinks is deprecated"

Conditions:
v1-traps or v2-traps have been configured.

Impact:
Unable to use SNMPv3 remotely when v1-traps or v2-traps are configured.

Workaround:
Make note of the v1-traps and v2-traps configuration, and set them to none by using tmsh:
`tmsh modify sys snmp v2-traps none`

Use either tmsh or the GUI to recreate the v1-traps and v2-traps, but use the generic traps with the correct version
`tmsh modify sys snmp traps add`

2386021-2 : TMM fails to load large number of bot defense signatures

Links to More Info: BT2386021

Component: Application Security Manager

Symptoms:
TMM crashes during config load attempt

Conditions:
- 163 security bot-defense profiles
- 2670 security bot-defense signatures

Impact:
TMM cannot load config

Workaround:
Remove unnecessary bot-defense profiles

2380665-1 : FIPS Key Deletion via tmsh/GUI/iControl Fails When /config/filestore/.trash_bin_d Path is Missing.

Component: TMOS

Symptoms:
FIPS key deletion initiated through tmsh, GUI, or iControl fails. The operation attempts to access /config/filestore/.trash_bin_d for file content manipulation during the deletion workflow, but the process errors out if the path does not exist

Conditions:
FIPS key deletion is performed via tmsh, GUI, or iControl
/config/filestore/.trash_bin_d directory is missing or not created on the system

Impact:
- FIPS key deletion operation fails.
- Users are unable to remove keys, potentially blocking key lifecycle management and related administrative operations.

Workaround:
Manually create the /config/filestore/.trash_bin_d directory prior to performing the key deletion operation

2377817-3 : TMM may ignore certain DOS L7 config objects

Links to More Info: BT2377817

Component: Application Security Manager

Symptoms:
This issue has been observed with bot-defense signatures, resulting in log lines that appear as follows:
Notice MCP message handling failed in 0xacdf00 (16973843): Jun 24 19:34:45 on 1 - MCP Message:
notice create {
notice bot_defense_compiled_signatures {
notice bot_defense_compiled_signatures_parent_profile "/Common/a_profile_name"
notice bot_defense_compiled_signatures_name "/Common/a_signature_name"
...

The 16973843 error number is a fingerprint for this.＼

Conditions:
This typically requires thousands of the same config objects (e.g., bot-defense signatures), but it can rarely happen with many fewer

Impact:
Config settings aren't honored by tmm. In the case of signatures, this can result in traffic that should be blocked but is not

Workaround:
The root cause is that DOS L7 config object names are hashed into a 32-bit number. This can cause collisions, which lead to the bug. So changing names can prevent the collisions, e.g., by appending a random number to the name

But note that this is a probabilistic fix and is not guaranteed to work with the first random number

2368593-1 : DNS RPZ policies are not applied when upstream server returns error responses

Component: Global Traffic Manager (DNS)

Symptoms:
DNS Response Policy Zone (RPZ) policies are not evaluated when the upstream DNS server returns error response codes such as SERVFAIL, NOTAUTH, REFUSED, NOTIMPL, or FORMERR. The error response is passed through to the client without RPZ policy enforcement.

Conditions:
- BIG-IP DNS configured with a validating cache resolver and RPZ enabled
- RPZ action set to "given" or any other configured action
- Upstream DNS server returns an error response code (SERVFAIL, NOTAUTH, REFUSED, NOTIMPL, or FORMERR) for a domain that has an RPZ policy record

Impact:
RPZ policy actions (such as NXDOMAIN, NODATA, walled garden, or local data) are not enforced for queries where the upstream server returns an error response. This creates a gap in DNS firewall coverage, allowing blocked domains to bypass RPZ when the upstream server is returning errors

Workaround:
None

2366693-2 : MM may enter a crash loop when handling large configurations.

Links to More Info: BT2366693

Component: Local Traffic Manager

Symptoms:
TMM panics with 'unable to extend db' error messages.

Conditions:
This issue occurs when the fix for ID2033781 is applied, and very large configurations are present. Without this fix, TMM logs 'mco_db_extend failed' messages and ignores the configuration settings.
It can also occur with moderately sized configurations, where TMM extends the database by the product of two configuration settings. For instance, this could happen with hundreds of bot-defence profiles and thousands of bot-defence signatures.

Impact:
TMM cannot start up

2365469-1 : Mdmsyncmgr truncates SAS signature when following Intune redirect to Azure Blob Storage, leading to NonCompliantDevice retrieval failure

Links to More Info: BT2365469

Component: Access Policy Manager

Symptoms:
- mdmsyncmgr fails to retrieve NonCompliantDevice details from Intune
- APM logs show authentication errors during device detail updates:
“Authentication error for get all non-compliant devices request”
- Azure Blob Storage responds with HTTP 403 AuthenticationFailed and message: “Signature fields not well formed”
- Packet capture shows SAS signature truncated in redirected request
- Issue correlates with the presence of two newly added HTTP headers in Intune redirect response

Conditions:
- BIG-IP APM configured with mdmsyncmgr and Microsoft Intune integration
- Intune returns an HTTP 303 redirect to Azure Blob Storage with an SAS token
- Redirect response includes additional HTTP headers (recent change on Intune side)
- Resulting HTTP request size exceeds internal handling limit (~1515 bytes observed)
- mdmsyncmgr follows the redirect (HTTP scheme) and truncates the request payload (~15 bytes lost).

Impact:
- NonCompliantDevice retrieval fails completely
- Device compliance data cannot be synchronized from Intune
- Affects visibility and enforcement of compliance policies

Workaround:
None

2365353 : Snat-translation object may get orphaned after running "tmsh delete ltm snat all" command.

Component: TMOS

Symptoms:
After running the "tmsh delete ltm snat all" command, the snat-translation object, which was automatically created while creating the snat object, may not be removed and becomes orphaned. With the orphaned snat-translation object, a couple of problems can occur

- Orphaned snat-translation object cannot be deleted. An error message "01070321:3: Snat translation address /Common/x.x.x.x is still referenced by a snat pool." is returned.

# tmsh delete ltm snat-translation 10.1.1.1
01070321:3: Snat translation address /Common/10.1.1.1 is still referenced by a snat pool.
#

- New snat-translation object cannot be created on either CLI or GUI. An error message "01070712:3: Invalid primary key on trans_addr object - path is empty." is returned.

# tmsh create ltm snat-translation 10.2.2.1 { address 10.2.2.1 traffic-group traffic-group-1 }
01070712:3: Invalid primary key on trans_addr object - path is empty.
#

- New snat object cannot be created on either CLI or GUI. An error message "01070734:3: Configuration error: Invalid primary key on trans_addr object () - not a full path 2." is returned.

# tmsh create ltm snat my_snat2 origins add { 10.4.4.1 } translation 10.5.5.1
01070734:3: Configuration error: Invalid primary key on trans_addr object () - not a full path 2.
#

Conditions:
- Executed "tmsh delete ltm snat all" command

Impact:
- Cannot delete orphaned snat-translation object.
- Cannot create new snat object or snat-translation object

Workaround:
Avoid running "delete ltm snat all" TMSH command. Instead, delete snat object on GUI. Or alternatively, avoid using "all" keyword when you delete snat object on CLI (i.e., delete each snat object by "delete ltm snat [snat-object-name]" command)

If you have already had orphaned snat-translation object and have difficulty in creating new snat/snat-translation object, follow K13030 and refresh mcpdb. After reboot, you can manually delete the orphaned snat-translation object without using "all" TMSH command option

# touch /service/mcpd/forceload
# reboot
# tmsh delete ltm snat-translation 10.1.1.1 ; tmsh save sys config

2359049-3 : IP Intelligence feedlist config with address 0.0.0.0 & no specific netmask

Component: Advanced Firewall Manager

Symptoms:
IP Intelligence feedlist config with 0.0.0.0 as IP address & no netmask wrongly blocks all addresses

Conditions:
Configuration with 0.0.0.0 as IP address entry without netmask

Impact:
A wrong configuration with 0.0.0.0 as an IP address entry without a netmask can unexpectedly drop all traffic, even if such an entry was unintended. The consequences of dropping all traffic are not expected

Workaround:
Ensure no invalid 0.0.0.0 IP address entry. If the intention is to block a single IP, explicitly specify the netmask

<ip>,32,bl,
or
<ip>/32,,bl,
or
<valid ip(non 0.0.0.0)>,,bl,

2359001-2 : Portal access fails with the error 'ERROR: Fetching cookie failed' when large cookies are present.

Component: Access Policy Manager

Symptoms:
Portal access intermittently fails when the HTTP Analytics profile is enabled. Access logs display cookie fetch errors in RewritePlugin, such as:

error rewrite - RewritePlugin.cpp:3290 (0x2005bd0): ERROR: Fetching cookie failed.

Conditions:
Observed when large cookies are send by backends.

Impact:
Connections face interruptions in service availability due to the inability to fetch backend cookies.

2358921-2 : Large JWTs causes tmm core while encoding

Links to More Info: BT2358921

Component: Access Policy Manager

Symptoms:
When JWTs with an encoded length greater than 2MB are processed by TMM for OAuth, it causes TMM to crash

Conditions:
JWT configured with large claims or scope - increasing the overall payload size

Impact:
The TMM crashes, causing the BIG-IP to become unavailable

Workaround:
Reduce JWT payload length by modifying the claims or scopes

2355421-1 : BIG-IP VE on Azure: Traffic loss with no self-recovery after Accelerated Networking VF is rescinded by the platform

Links to More Info: BT2355421

Component: TMOS

Symptoms:
When Azure rescinds or re-presents an SR-IOV Virtual Function (VF) on a BIG-IP VE with Accelerated Networking, the data interface associated with that VF will stop forwarding traffic and will not recover automatically without manual intervention. Other interfaces remain unaffected. The TMM does not crash, but the following messages may appear in the kernel logs.:
  pci_hyperv: PCI dom# 0x<N> has collision, using 0x<M>
  mlx5_core <addr>: no netdev found for vf serial <N>

Conditions:
-- BIG-IP VE deployed on Microsoft Azure
-- Accelerated Networking is enabled on the VM
-- The Azure platform may rescind and re-present the SR-IOV VF during host maintenance, platform servicing, or other internal Azure events that might not be visible to the tenant or reflected in scheduled event notifications
-- VF re-presentation results in a PCI domain collision in the guest kernel

Impact:
Traffic on the affected interface stops. Associated pool members and virtual servers become unavailable. Recovery requires restarting TMM or rebooting

Workaround:
Restart TMM to restore traffic forwarding:
  
bigstart restart tmm or reboot the unit.

2355377 : NTP authentication method upgrade

Component: TMOS

Symptoms:
Currently, the authentication method between the BIG-IP and the NTP server is SHA1. That needs to be upgraded to a more secure message digest algorithm

Conditions:
By default, NTP is enabled and follows the SHA1 algorithm for authentication

Impact:
By adopting SHA512 as the default authentication method, we enhance security, making customer data and NTP authentication more resilient to vulnerabilities linked to SHA-1

Workaround:
None

2354633-1 : Location entries missing in ssl.conf preventing execution of <If> exception★

Component: TMOS

Symptoms:
TMOS version v17.5.1.5 and above are missing the Location entries around SSLVerifyClient require, this prevents Apache from executing the <if> statement.

Conditions:
This issue occurs on BIG-IP version greater than v17.5.1.5

Impact:
All commands within an <if> statement are not executed

Workaround:
Perform the following actions as a workaround:
- locate ssl.conf (usually /etc/httpd/conf.d/ssl.conf)
- edit ssl.conf
- add the missing location entries around SSLVerifyClient require, should look like:
<LocationMatch "^[/][^/]+[/]">
SSLVerifyClient require
</LocationMatch>
- save the file
- restart httpd

**Caution every modification to httpd required the check/modification of ssl.conf

2354021-1 : An LTM policy configured to only disable AVR (avr disable) cannot be applied to a virtual server unless an AVR (analytics) profile is attached.

Links to More Info: BT2354021

Component: Application Visibility and Reporting

Symptoms:
When attaching an LTM policy containing an avr disable action to a virtual server without an AVR (analytics) profile, the configuration is rejected, and MCP logs a validation error similar to:

01071809:3: Virtual server /<partition>/<vs_name> requires a profile of type avr for ltm policy /Common/<policy_name>.

The policy applies successfully only if an AVR profile is manually attached to the virtual server.

Conditions:
- An LTM policy contains a rule with an avr action, and that action is set to disable (no avr enable action is present in the policy).
- The policy is attached (or being attached) to a virtual server that does not have an AVR (analytics) profile.
- This commonly arises when an LTM policy is used to disable AVR statistics collection for specific connections on a virtual server that has a DOS (DoSL7) profile but no AVR profile. The DOS profile causes AVR to run implicitly, and avr disable is the action used to stop AVR statistics collection for those connections.

Impact:
The configuration is rejected and cannot be committed. Because the AVR control requirement is keyed on the action target rather than on whether the action enables or disables AVR, MCP requires an AVR profile even when the policy only disables AVR. As a result, you cannot use an avr disable action to suppress AVR statistics collection on a virtual server unless you also attach an AVR profile that you may not otherwise need. There is no configuration-only workaround other than attaching an AVR profile to the virtual server.

Workaround:
Attach an AVR (analytics) profile to the affected virtual server. With an AVR profile present, the avr disable action validates successfully and takes effect.

2351525-4 : Restrictions on files and iFiles that can be created may be overly restrictive.

Component: TMOS

Symptoms:
When creating files on the device, the specified source path may be overly restrictive, even for admin or root roles.

Conditions:
Attempt to create a file object, such as an iFile, on the device using one of the restricted paths.

Impact:
The file creation will fail, and the command will not complete successfully.

Workaround:
None.

2347141-1 : APMD memory leak causes increasing swap usage, aggressive memory sweeps

Component: Access Policy Manager

Symptoms:
The APMD process continuously consumes memory over time, causing a steady growth of heap memory, "other memory," and swap utilization. As memory consumption increases, the system enters aggressive memory sweep mode, which may degrade performance and impact traffic processing.

Conditions:
- iRule is configured with 'ACCESS::policy evaluate'
- NTLM authentication is configured, and the ECA plugin is involved (for example, VDI RDG)
- Kerberos authentication is configured with RBA enabled

Impact:
- Continuous growth of APMD memory usage
- Increasing "other memory" and swap consumption
- System may enter aggressive memory reclamation/sweep mode
- Increased CPU and memory pressure can negatively affect traffic processing and overall system performance
- Operational intervention, such as periodic rebooting of the device, may be required to restore memory availability

Workaround:
None

2346977-1 : Virtual Servers with an SSL Orchestrator Access profile don't send Server Hello to the client

Component: SSL Orchestrator

Symptoms:
SSL connections from a client to the BIG-IP stall due to the BIG-IP not sending a Server Hello to the client

Conditions:
A virtual server that

- Has an SSL Orchestrator Access Profile attached
- Has either
   -- Address Translation disabled OR
   -- Transparent Nexthop set
- Does not have anything to re-enable SSL client-side

Impact:
The SSL handshake fails, and the connection stalls due to the lack of a Server Hello from the BIG-IP

Workaround:
Attach an irule that re-enables SSL client side on CLIENT_ACCEPTED to the affected virtual server

when CLIENT_ACCEPTED {
    SSL::enable clientside
}

2345869 : APM Portal Access Fails to Parse ES13 Class field syntax

Component: Access Policy Manager

Symptoms:
Apps hosted through portal access fail if they contain Class field syntax

Conditions:
Have an App hosted in Portal Access that uses Class field syntax

Impact:
Apps hosted through Portal Access will not work as intended

Workaround:
None

2343845-1 : Virtual Functions Removal On The Hypervisor Can Cause a Kernel Deadlock And Subsequent Reboot of Big-IP VEs in Azure (Hyper-V hypervisor) When Using The SOCK (NIC) Driver

Links to More Info: BT2343845

Component: TMOS

Symptoms:
When using the SOCK driver, the host-side (Azure) removal of the NIC Virtual Functions can cause a kernel deadlock on the pci_lock_rescan_remove() mutex

Conditions:
- Big-IP VE running in Azure (Hyper-V hypervisor)
- SOCK driver in use
- Azure rescinds one or more Virtual Functions on the hypervisor (host maintenance, live migration, etc...)

Impact:
Kernel deadlock and subsequent reboot of the VE

The kern.log file contains logs similar to these:


info kernel: hv_netvsc 6045bdf2-e3b3-6045-bdf2-e3b36045bdf2 eth1: Data path switched from VF: nic1
info kernel: hv_netvsc 6045bdf2-e3b3-6045-bdf2-e3b36045bdf2 eth1: VF unregistering: nic1
info kernel: hv_netvsc 6045bdf2-e3b3-6045-bdf2-e3b36045bdf2 eth1: VF slot 2 removed
info kernel: hv_netvsc 7c1e525d-cf8d-7c1e-525d-cf8d7c1e525d eth2: Data path switched from VF: nic2
info kernel: hv_netvsc 7c1e525d-cf8d-7c1e-525d-cf8d7c1e525d eth2: VF unregistering: nic2
info kernel: hv_netvsc 7c1e525d-cf8d-7c1e-525d-cf8d7c1e525d eth2: VF slot 3 removed
info kernel: hv_netvsc 7ced8d13-39cf-7ced-8d13-39cf7ced8d13 eth3: Data path switched from VF: nic3
info kernel: hv_netvsc 7ced8d13-39cf-7ced-8d13-39cf7ced8d13 eth3: VF unregistering: nic3
...
info kernel: pci_hyperv: PCI dom# 0x8219 has collision, using 0x1
err kernel: hv_vmbus: probe failed for device 4d265dd7-8219-4002-86c3-5f88aa46fabc (-19)
info kernel: pci_hyperv: PCI dom# 0xee32 has collision, using 0x1
...
err kernel: INFO: task kworker/u64:3:27429 blocked for more than 120 seconds.
err kernel: "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
info kernel: kworker/u64:3 D ffff880abaa5e9a0 0 27429 2 0x00000080
info kernel: Workqueue: hv_pci_2 hv_eject_device_work [pci_hyperv]
warning kernel: Call Trace:
warning kernel: [<ffffffff816ac1c8>] ? klist_iter_exit+0x18/0x30
warning kernel: [<ffffffff81453c21>] ? bus_find_device+0x91/0xd0
warning kernel: [<ffffffff816c46d9>] schedule_preempt_disabled+0x29/0x70
warning kernel: [<ffffffff816c24d7>] __mutex_lock_slowpath+0xc7/0x1d0
warning kernel: [<ffffffff816c18bf>] mutex_lock+0x1f/0x2f
...
err kernel: INFO: task kworker/22:3:28345 blocked for more than 120 seconds.
err kernel: "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
info kernel: kworker/22:3 D ffff882046e9df10 0 28345 2 0x00000080
info kernel: Workqueue: events vmbus_onmessage_work [hv_vmbus]
warning kernel: Call Trace:
warning kernel: [<ffffffff816c46d9>] schedule_preempt_disabled+0x29/0x70
warning kernel: [<ffffffff816c24d7>] __mutex_lock_slowpath+0xc7/0x1d0
warning kernel: [<ffffffff816c18bf>] mutex_lock+0x1f/0x2f
...
err kernel: INFO: task kworker/u64:2:26055 blocked for more than 120 seconds.
err kernel: "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
info kernel: kworker/u64:2 D ffff880d73f71520 0 26055 2 0x00000080
info kernel: Workqueue: mlx5_health0004:00:02.0 health_recover_work [mlx5_core]
warning kernel: Call Trace:
warning kernel: [<ffffffff816c46d9>] schedule_preempt_disabled+0x29/0x70
warning kernel: [<ffffffff816c24d7>] __mutex_lock_slowpath+0xc7/0x1d0
warning kernel: [<ffffffff816c18bf>] mutex_lock+0x1f/0x2f
...

Workaround:
Replace the SOCK driver with the xnet/DPDK driver on all the interfaces in use: https://my.f5.com/manage/s/article/K33245002

2343225-1 : sslofix Does Not Accept Usernames or Passwords With Special Characters

Links to More Info: BT2343225

Component: SSL Orchestrator

Symptoms:
Running sslofix with a username or password with special characters will cause the script to fail

Conditions:
Running sslofix with a username or password with special characters

Impact:
sslofix cannot be run to fix SSL Orchestrator configurations

Workaround:
Single quote entering the username or password with the special character

e.g: enter 'pa$sword'

2340941-4 : SSL Connections Fail On Some TMMs After Concurrent CRL File Updates Across DSC Members

Links to More Info: BT2340941

Component: Local Traffic Manager

Symptoms:
When the bug is triggered, the following symptoms are observed:

- Specific TMMs begin sending FIN+ACK immediately after completing the TCP 3-way handshake, causing SSL connections to fail silently from the client's perspective
- The failure is permanent and per-TMM — only the TMMs that encountered the race condition are affected; other TMMs continue to function normally
- The following log messages appear in /var/log/ltm:

  01260027:2: Profile <name> - cannot load CRL <path>: Unknown error.
  01260000:2: Profile <name>: could not load CRL

- For every connection that fails, a log similar to the following appears in /var/log/ltm for the TMM that handled the connection:

  01260009:4: Connection error: hud_ssl_handler:1316: alert(40) invalid profile unknown

- The condition does not automatically recover — it persists indefinitely until an administrator manually detaches and then re-attaches the affected SSL profile from the virtual server

Conditions:
All of the following must be present to trigger the bug:

- Two or more BIG-IP devices in a DSC (Device Service Cluster) with automatic ConfigSync enabled
- A Client SSL profile with a crl-file attached to a virtual server
- Concurrent CRL file updates on both devices (e.g., both devices updating the same CRL object within the same second), causing filestore version churn

Impact:
SSL connections to the affected virtual server fail. BIG-IP closes the connection with a FIN immediately after a TCP handshake completes on affected TMMs

Workaround:
Avoid performing simultaneous CRL file updates on both DSC members

Since there is no automatic recovery from this condition, the administrator must manually detach (temporarily replace with another SSL profile) and then re-attach the intended Client SSL profile on the affected virtual server to clear the invalid profile state

2339781-3 : [APM] SAML authentication fails when the SAML attribute FriendlyName contains a valid single quote (').

Links to More Info: BT2339781

Component: Access Policy Manager

Symptoms:
After upgrading BIG-IP APM from version 17.5.1.3 to 17.5.1.6, SAML authentication fails when the SAML Identity Provider (IdP) includes a single-quote character (', hex 0x27) in the FriendlyName attribute of a SAML assertion. This causes the session variable write to fail, leading to authentication rejection and session termination.

Conditions:
SAML authentication is configured with BIG-IP as the Service Provider (SP).
The IdP sends SAML assertions where the FriendlyName contains a single quote (e.g., User's Object ID).
The issue is reproducible when a single quote is present in the FriendlyName attribute.

Impact:
SAML authentication is rejected, blocking user access.

Workaround:
Remove the single-quote character from the FriendlyName configuration on the IdP.

2339769-4 : IP Intelligence Feed List Not Updating Without dwbld Restart

Links to More Info: BT2339769

Component: Advanced Firewall Manager

Symptoms:
The IP Intelligence Feed List is not updating, and feed list IP changes are not effective

Conditions:
- Create a *new* IP Intelligence policy and feed-list using an iRule.
- Modify iRule list (add/delete IP)

The curl command works fine, but the dwbl cache file is not updated with the latest.

Impact:
dwbl content retained with the old IP list and not enforced

Workaround:
Restart dwbld:
bigstart restart dwbld

2338881-2 : SecurID authentication failures cause apmd file descriptor leak leading to service disruption

Links to More Info: BT2338881

Component: Access Policy Manager

Symptoms:
After multiple SecurID authentication failures, the apmd process runs out of file descriptors. The logs indicate that "epoll_create() failed [Too many open files]," leading to failures in subsequent authentication attempts or Active Directory (AD) queries, which generate "Too many open files" errors. Additionally, sockets connecting to the aced daemon accumulate in a CLOSE_WAIT state

Conditions:
- SecurID authentication is configured with logon retry enabled (maxLogonAttempt > 1)
- Multiple authentication failures occur (e.g., wrong credentials, brute-force attempts)
- The user does not complete the retry flow (session is abandoned after initial failure)

Impact:
APMD cannot process new access policy requests when file descriptors are exhausted. All APM functionality—including Active Directory queries, authentication, and session management—is affected for all users. A restart of APMD is necessary to recover

Workaround:
Restart the apmd service to recover file descriptors. Reducing the maxLogonAttempt value to 0 limits exposure but does not eliminate the issue. Implementing rate-limiting for login attempts at the network layer can help slow FD exhaustion.

2337369-1 : SSL profile options string malformed after upgrade

Component: Local Traffic Manager

Symptoms:
BIG-IP config fails to load after an upgrade

Looking at the default SSL profiles, the options section is missing a space between two different options

Conditions:
There is a default SSL profile that has been modified with additional options before the upgrade

Impact:
BIG-IP config fails to load after an upgrade

Workaround:
Edit /config/bigip.conf with the default ssl profile that had changes, to introduce the missing space, and reload the config with tmsh load sys config

2332505-2 : Header-Based Content Profile Entries Display Gaps And Incorrect Order After Reorder

Component: Application Security Manager

Symptoms:
After reordering GUI operations, the header-based content profile entries for a URL may be inserted before the last entry instead of last, as expected

Conditions:
Reordering operations are performed on URL header-based content profiles

Impact:
Potentially unexpected enforcement priority of header-based content profiles

Workaround:
Ensure the moved element has the expected priority after edits

2331445-3 : HTTP/2 Connection May Stall When a Single Response (or request) Exceeds The Per-pass Egress Write Limit

Links to More Info: BT2331445

Component: Local Traffic Manager

Symptoms:
HTTP/2 traffic can stop mid-transfer. The connection delivers approximately 16 KB of payload and then goes idle until it is closed by an idle timeout

Conditions:
- A single HTTP/2 message produces more queued DATA frames in one egress pass than the HTTP/2 profile's per-pass write size (default 16 KB)
- No further application-layer writes follow on the affected stream(s) (typical for a completed response or a fully buffered request body)

Impact:
Stalled HTTP/2 streams; the client or server peer eventually times out

Workaround:
A workaround is possible by having the frame-size lower than

ltm profile http2 http2_New {
    app-service none
    defaults-from Profile_http2
    frame-size 8191 # Lower than write-size 8192
    header-table-size 65536
    write-size 8192
}

2330425-3 : AVR Core is Generated

Component: Application Visibility and Reporting

Symptoms:
In the ESXI longevity pipeline on the control plane running with LTM objects creation and deletion, the AVR core is generated

Conditions:
- HA setup with 8 vCPUs
- LTM and ASM are provisioned
- AVR isn't provisioned

Impact:
Functionality may be affected

Workaround:
Fixed

2330361-3 : FastL4 does not respect configured idle-timeout

Component: Protocol Inspection

Symptoms:
When configured with a global firewall policy that utilizes IPS, FastL4 virtual defaults to the standard FastL4 profile upon upgrade, including custom idle timeout settings

Conditions:
fastL4 virtual when configured with a global firewall policy that utilizes IPS and a custom fastL4 idle timeout

Impact:
configured idle-timeout is not applied

Workaround:
None

2329077 : BIG-IP MCPD crashes with SIGSEGV during database key query, causing unexpected daemon restart

Component: TMOS

Symptoms:
MCPD crashes unexpectedly with a segmentation fault (SIGSEGV), generating a core file in /var/core/

The following entry is observed in /var/log/kern.log:
mcpd_worker_1[11387]: segfault at 22 ip 0000000000669eda sp 00007fd8a38984f0 error 4 in mcpd[400000+64c000]

Conditions:
- BIG-IP version 21.x with multi-threaded mcpd enabled (mcpd.workerthreads >= 1)
- Worker thread processing a cid_query_non_default query concurrently with main thread activity (config modification, folder operations, or other ExtremeDB writes)
- [Add any specific conditions observed, e.g.: HA enabled, config-sync active, high object count, concurrent tmsh/REST API sessions]

Impact:
- MCPD process crashes and restarts
- Traffic disrupted during mcpd restart

Workaround:
NA

2326541-4 : [BGP] AS path as-override not applied during extended-asn-cap capability mismatch

Links to More Info: BT2326541

Component: TMOS

Symptoms:
Neighbors configured with the "as-override" option do not alter the AS path when the local BGP speaker and the peer have mismatched BGP extended ASN capabilities

Conditions:
There is a configuration mismatch regarding the extended ASN capabilities across BGP peers

Impact:
The "as-override" feature does not modify the AS path

Workaround:
Make sure peers agree on extended-asn-cap

2326237-2 : Config Fails To Load On Newly Promoted Viprion Blade Due To AFM Policy Referencing An iRule

Links to More Info: BT2326237

Component: Advanced Firewall Manager

Symptoms:
01070830:3: The iRule (Ex: Test_rule) cannot be deleted because it is in use by a fw_rule (rule1) in Policy(Ex:fw_policy)

Conditions:
Cluster setup:
On Primary:
rm -rf /var/db/mcp*
bigstart restart mcpd; sleep 1; tmsh load sys config partitions all base

Impact:
After a failover, the newly elected blade is in an inoperative state

Workaround:
tmsh load sys config partitions all (without base)
or
tmsh load sys config

2313505-2 : guestagentd Fails To Acquire a Token.

Links to More Info: BT2313505

Component: TMOS

Symptoms:
These errors are seen every 5 minutes:

info guestagentd[6007]: 01810007:6: Rest request failed: {"code":400,"referer":"Unknown","restOperationId":17678971,"kind":":resterrorresponse"}
[WARNING][673][03 Jun 2026 16:22:29 PDT][com.f5.rest.common.RestWorker] dispatch to worker http://localhost:8100/shared/authz/tokens caught following exception: java.lang.NullPointerException
[I][674][03 Jun 2026 16:22:29 PDT][ForwarderPassThroughWorker] {"user":"local/admin","method":"POST","uri":"http://localhost:8100/mgmt/shared/authz/tokens","status":400,"from":"Unknown"}

Conditions:
The guest is running a TMOS version that includes the fix for ID2229021

Impact:
The Guest Status page in the GUI appears empty

Workaround:
None.

2313477-2 : TMC Fallback Wildcard Synthesis Incorrectly Sets prefix_len(0), Causing Config Load Failure When Coexisting Wildcard Forwarding virtual server Already Owns The 0.0.0.0 Virtual Address

Links to More Info: BT2313477

Component: Local Traffic Manager

Symptoms:
After upgrading to an affected version, a configuration containing both a wildcard IP-forwarding virtual server and a second virtual server using a Traffic Matching Criteria (TMC) with a source address list may fail to load with the following error:
0107176c:3: Invalid Virtual Address, the IP address 0.0.0.0 already exists.
Unexpected Error: Validating configuration process failed.

Conditions:
All of the following must be true:
- A wildcard IP-forwarding virtual server exists with destination 0.0.0.0:0 and mask any
- A second virtual server in any partition references a TMC configured with:
  - destination-address-inline 0.0.0.0 (any destination)
  - destination-port-inline <port>
  - source-address-list <list-name>
  - No destination-address-list
- The configuration is loaded from disk (upgrade, reinstall, or MCP force-reload)

Impact:
The BIG-IP system fails to load its configuration after upgrade, interrupting traffic processing

2313453 : RSA Key related statistics not incremented

Component: Local Traffic Manager

Symptoms:
The RSA statistics, like Handshakes using RSA and handshakes offloaded for RSA for different key sizes, are not incremented and will always be set to 0

Conditions:
No specific conditions, but during RSA key exchange, these stats need to be udpated but not getting udpated

Impact:
There will be RSA key size statistics in the Profile stats which are useless and always be zero

Workaround:
None

2313441-3 : TMM stops processing traffic when an accelerated networking interface is removed on Azure

Links to More Info: BT2313441

Component: TMOS

Symptoms:
TMM stops processing traffic and consumes high CPU on BIG-IP VE running on Microsoft Azure when an accelerated networking virtual function (VF) is removed at runtime.

Conditions:
- BIG-IP VE deployed on Microsoft Azure with Accelerated Networking enabled.
- Azure platform performs host maintenance, live migration, or other operations that remove the virtual function (VF) at runtime.

Impact:
Traffic disruption. TMM stops processing traffic and must be restarted.

Workaround:
Restart TMM or reboot the BIG-IP system to restore traffic processing

2313429-1 : keymgmtd Memory Growth With Debug Logging And Dynamic CRL Validation

Links to More Info: BT2313429

Component: TMOS

Symptoms:
When debug logging is enabled for the key management daemon, memory usage for the keymgmtd process grows continuously while client certificate authentication with dynamic CRL validation is active. Memory does not recover while the system is running

Conditions:
device config only, no code:
- A Client SSL profile is configured with a client certificate
  authentication (peer-cert-mode require) and a dynamic CRL
  cert-validator with strict-revocation-check enabled, assigned to a virtual server
- The log level for keymgmtd is set to debug:
  tmsh modify sys db log.keymgmtd.level value debug
- Client certificate traffic is active through the virtual server

Impact:
The key management process memory grows proportionally to the connection rate while debug logging is active. Under sustained traffic, this can degrade system performance

Workaround:
- Set the keymgmtd log level back to the default:
  tmsh modify sys db log.keymgmtd.level value info
- This stops memory growth without requiring a restart

2311013-1 : RST packet is not generated when service-down-action is configured as "reset"

Component: Local Traffic Manager

Symptoms:
No service-down-action RST packet (rstcause text "Flow expired (sweeper: pool member down)") is sent out from BIG-IP to either client or pool member when service-down-action is configured as "reset," and pool member monitor down occurs

Conditions:
- On a pool object, service-down-action is configured as "reset" (default "none")
- A pool member monitor down occurs, and the configured service-down-action is triggered

Impact:
When monitor down occurs, client or pool member may not receive RST packet from BIG-IP and connection may remain longer

Workaround:
None

2310981-3 : Config Sync May Fail After Modifying a Shared Object Port List Referenced By Traffic Matching Criteria

Links to More Info: BT2310981

Component: Advanced Firewall Manager

Symptoms:
After modifying a Shared Object Port List and performing config sync in an HA pair, the sync may fail on the receiving device

You may see an error similar to:

Sync Failed

A validation error occurred while syncing to a remote device

01070710:3: Database error (13), Cannot update_indexes/checkpoint DB object,
class:traffic_matching_criteria_port_update

Conditions:
This issue may occur when all of the following are true:

- The system is part of an HA pair or device group using config sync
- A Shared Object Port List is modified
- The Port List is referenced by a Traffic Matching Criteria, directly or through related configuration
- A full config load or merge is performed on the peer during sync processing

Impact:
Configuration synchronization between HA peers may fail after Port List updates. As a result, configuration changes made on the active device may not propagate successfully to the peer until corrective action or a workaround is taken

Workaround:
None

2310641-3 : Using non-default SIP::Persist Routing May Cause TMM To Core Dump.

Links to More Info: BT2310641

Component: Service Provider

Symptoms:
TMM encounters a segmentation fault

Conditions:
- An iRule explicitly sets the message direction to either forward or reverse, for example:
SIP::persist direction reverse

- SIP::persist bidirectional is not set to true (or is not set at the right location)

Impact:
Traffic is interrupted as TMM restarts

Workaround:
Add `SIP::persist bidirectional true` after setting the persist key and before setting direction reverse. For example:

if { $persist_key ne "" } {
    SIP::persist $persist_key
    SIP::persist bidirectional true # <== add this here
    SIP::persist direction reverse
}

Restart tmm after making the above change

2310621-1 : RPZ policy is not applied to SERVFAIL responses from upstream

Component: Global Traffic Manager (DNS)

Symptoms:
A client’s DNS query that travels through a BIG-IP DNS cache to an upstream authoritative server will not be evaluated against RPZ policies if the server returns a SERVFAIL response

Conditions:
A DNS cache configuration, whether through a resolver or a transparent setup, can utilize RPZ (Response Policy Zone) policies to block or modify DNS responses. However, if a client's DNS query matches an RPZ policy based on the client's IP address or the QNAME trigger, and the DNS server responds with a SERVFAIL message, the RPZ policy will be ignored. As a result, the client will receive a SERVFAIL response, even if the RPZ policy specifies that queries from this client IP or for this QNAME should lead to a specific RPZ-generated response

Impact:
It might be difficult to create RPZ policy configurations that effectively process negative DNS responses from upstream

Workaround:
If the specific QNAMEs yielding the SERVFAILs from upstream are limited and known beforehand, the cache can be configured with local zone records for them, obviating the need to send out the query to the upstream server, and then RPZ will be applied normally based on the response obtained from the local zone. This is, however, not practical for large and unpredictable domain sets

2306957-1 : Changes To The sys http auth-pam-validate-ip Setting May Not Take Effect When PAM Cache Files Are Present

Links to More Info: BT2306957

Component: TMOS

Symptoms:
Changing auth-pam-validate-ip from 'on' to 'off' does not work if /run/pamcache contains token files

Login attempts fail unexpectedly, sometimes logging "Cookie impersonation detected" in /var/log/httpd/httpd_errors.
Transition from 'off' to 'on' works as expected

Conditions:
Occurs when older token files are still present in the /run/pamcache directory after changing the auth-pam-validate-ip setting from 'on' to 'off'

Impact:
- Login disruptions for users
- Security configuration changes fail to take effect

Workaround:
- set auth-pam-validate-ip to "off"

- make sure that no active client sessions are sending or receiving data to/from httpd

- delete all tokens from /run/pamcache

2304825-1 : Remotely authenticated users don't have any serial console fallback if the remote server fails

Links to More Info: BT2304825

Component: TMOS

Symptoms:
When using a remote authentication server like Radius, Tacacs, or LDAP, the users can log in to the console/virtual console using authentication from that server. If the server, or communication with this server, fails, the users have no fallback to local authentication
This fallback only works with sshd or httpd

Conditions:
- Remote authentication server configured and in use
- Remote authentication server not reachable
- Console access needed

Impact:
Remotely authenticated users accessing the device via the console don't have any fallback mechanism if the remote authentication server is not reachable

Workaround:
None

2304433-2 : SAML SP assertion canonicalization fails if the AttributeValue contains arrow characters.

Links to More Info: BT2304433

Component: Access Policy Manager

Symptoms:
SAML authentication fails when the <AttributeValue> contains Arrows

Conditions:
Occurs when AzureAD user group names includes Arrow characters in SAML assertions processed by BIG-IP APM as SAML SP.

Impact:
Users affected by this issue are unable to authenticate via SAML and are denied access. Notably, the problem does not occur with other non-ASCII characters, such as Japanese.

Workaround:
None

2304105-1 : Remote users with usernames containing backslash or at sign cannot access some GUI pages

Links to More Info: BT2304105

Component: TMOS

Symptoms:
After logging in to the BIG-IP Configuration Utility, some pages display the error
"Error getting auth token from login provider." Affected pages include Device
Management, Shared Objects, and iApps Application Services

Conditions:
- BIG-IP is configured to use a remote authentication provider (such as Active
  Directory, LDAP, or RADIUS)
- The remote user's username contains a backslash or an at sign character
  (for example, DOMAIN＼username or user@domain)

Impact:
- Remote users with usernames containing backslash or at sign cannot access some
- Configuration Utility pages. Other pages and CLI access are unaffected

Workaround:
None

2298633-2 : TMM May Fail To Start, Rendering The Device Inoperative

Links to More Info: BT2298633

Component: Local Traffic Manager

Symptoms:
In very rare circumstances, tmm may fail to start after a reboot and log a message similar to the following:

/var/log/tmm:
notice vmxnet3(1.3)[1b:00.0]: Waiting for tmm1 to reach state 1...

/var/log/tmm1:
notice Failed to connect to TMROUTED: ERR_INPROGRESS. Try again in 10 seconds.

notice MCP connection expired early in startup; retrying

While the issue is occurring, there may be some ARP entries for tmm.

# arp -an | grep 127.1.1.? (127.1.1.8) at 00:01:23:45:67:07 [ether] on tmm
? (127.1.1.5) at 00:01:23:45:67:04 [ether] on tmm
? (127.1.1.2) at <incomplete> on tmm
? (127.1.1.4) at 00:01:23:45:67:03 [ether] on tmm
? (127.1.1.7) at 00:01:23:45:67:06 [ether] on tmm
? (127.1.1.6) at <incomplete> on tmm
? (127.1.1.1) at 00:01:23:45:67:00 [ether] on tmm
? (127.1.1.3) at 00:01:23:45:67:02 [ether] on tmm

Conditions:
- First start after a reboot or upgrade
- An F5OS tenant running on r2000 or r4000 series hardware

Impact:
TMM is unable to start

Workaround:
Restart tmm manually with

bigstart restart tmm

Or enable tmm.mcp.disconnect.core, which will restart tmm automatically during this situation.

Alternatively, set up a static ARP mapping on the Linux host:

arp -s 127.1.1.2 00:01:23:45:67:01
arp -s 127.1.1.3 00:01:23:45:67:02
arp -s 127.1.1.4 00:01:23:45:67:03
arp -s 127.1.1.5 00:01:23:45:67:04
arp -s 127.1.1.6 00:01:23:45:67:05
arp -s 127.1.1.7 00:01:23:45:67:06
arp -s 127.1.1.8 00:01:23:45:67:07

If there are more than 8 tmms, the following script can be used:

for y in $(seq $(/usr/bin/getdb Provision.tmmCountActual)); do arp -s 127.1.1.$(($y+1)) 00:01:23:45:67:$(printf "%02g" $y); done

2298469-2 : Header-Based Content Profile Entries Display Gaps And Incorrect Order After Delete/Add

Component: Application Security Manager

Symptoms:
After subsequent add/delete GUI operations, the header-based content profile entries for a URL may have a gap or be inserted before the last entry instead of last as expected

Conditions:
Delete and Add operations are performed on URL header-based content profiles

Impact:
Potentially unexpected enforcement priority of header-based content profiles

Workaround:
Ensure the new element has been inserted in the expected priority after edits

2297821-3 : DoS profile tcp-window-size threshold-mode changes to manual after upgrade from 17.5.1.4 to 17.5.1.5

Component: Advanced Firewall Manager

Symptoms:
After the upgrade, the DoS profile vector tcp-window-size threshold-mode changes from fully-automatic to manual

Conditions:
Occurs when upgrading BIG-IP from 17.5.1.4 to 17.5.1.5 with a DoS protection profile containing tcp-window-size set to fully-automatic

Impact:
Automatic thresholding is lost, potentially reducing DoS protection effectiveness

Workaround:
Manually reset threshold-mode to fully-automatic after upgrade

2297681 : pem_sessiondump --li reports "Error geting sessions!" when PEM subscriber sessions are active

Links to More Info: BT2297681

Component: Policy Enforcement Manager

Symptoms:
Running pem_sessiondump --li to list all active PEM subscriber sessions prints the following output and exits immediately with no session data

List all session (use with care)
PEM session dump all[pemdb_session_bin] ....

Error getting sessions!

Conditions:
BIG-IP with the Policy Enforcement Manager (PEM) module requires at least one active PEM subscriber session, which can be created via a RADIUS Accounting-Request START using a Gx Diameter interface. The operator then executes pem_sessiondump --li from the system shell

Impact:
- The pem_sessiondump --li and pem_sessiondump --summary command-line diagnostic tools are non-functional for listing active subscriber sessions. Operators cannot use this tool to enumerate or inspect session state for troubleshooting

- There is no impact to the data path: subscriber sessions are created, provisioned, and terminated correctly. PEM policy enforcement, Gx/Radius integration, and all session statistics visible via tmsh show pem sessiondb all and tmsh show pem continue to operate normally

Workaround:
Use tmsh show pem sessiondb all to view active subscriber session details, and tmsh show pem for aggregate statistics

2296989-1 : DNS Express Does Not Fall Back to AXFR When Upstream Returns NOTIMPL to IXFR, Causing Stale Zone Data

Links to More Info: BT2296989

Component: Global Traffic Manager (DNS)

Symptoms:
- DNS Express logs indicate that it will attempt an AXFR after receiving a NOTIMPL response to an IXFR request, but it does not actually initiate the AXFR.
- DNS Express repeatedly retries IXFR requests instead of falling back to AXFR.
- The affected DNS zone remains stale and is not updated from the primary server.
- Administrators may be misled by log messages stating AXFR will be attempted.

Conditions:
- BIG-IP DNS Express is configured as a secondary server for a DNS zone.
- The upstream (primary) DNS server supports only AXFR and returns NOTIMPL (RCODE 4) in response to IXFR requests (e.g., NSD 4.3.8).
- A zone update occurs on the primary server, causing the secondary to initiate an IXFR.

Impact:
- DNS Express fails to update its zone data, serving stale DNS records to clients.
- Manual intervention is required to update the zone data.

Workaround:
Manually disable and re-enable the affected DNS zone on BIG-IP DNS Express to force a full AXFR and update the zone data:
   tmsh modify ltm dns zone <zone-name> enabled false
   tmsh modify ltm dns zone <zone-name> enabled true

2296549-1 : tmsh 'show gtm ldns' and 'show gtm path' commands limited to 1,000 records with no option to increase output limit

Links to More Info: BT2296549

Component: Global Traffic Manager (DNS)

Symptoms:
-The tmsh commands show gtm ldns and show gtm path display a maximum of 1,000 records, even if more entries exist in the system.
-There is no tmsh option or keyword (such as max-entries) to increase the number of records displayed.
-Users are unable to view or verify LDNS or path records beyond the first 1,000 entries via tmsh.

Conditions:
-BIG-IP DNS systems with more than 1,000 LDNS or path records.
-User attempts to display all records using tmsh show gtm ldns or tmsh show gtm path.

Impact:
-Administrators cannot view or confirm the existence of LDNS or path records beyond the 1,000-record limit using tmsh.
-Troubleshooting and validation of DNS load-balancing decisions are hindered in large environments.
-Workarounds such as core dumps or engineering hotfixes may be required to access the full set of records, increasing operational complexity and risk.

Workaround:
NA.

2295693-1 : Live update synchronization in an active/standby setup fails to update the standby device.

Component: Application Security Manager

Symptoms:
In a BIG-IP active/standby setup with auto-sync mode enabled, the synchronization of a new ASU file installed on the active device fails to update the standby device after upgrading to the new version.

Conditions:
- active/standby setup
- device group is in "auto-sync" mode
- at least one prior successful ASU sync
- Upgrade to the new version on both devices

Impact:
The standby device will not be updated with the latest signatures

Workaround:
1. Stop 'nsyncd'.
2. Delete the 'nsyncd' manifest on both units.
3. Switch the group to manual full sync mode.
4. Start 'nsyncd' on both units.
5. Restart Tomcat on both units.
6. Perform a forced full sync.
7. Restore the group to its original sync status.

2294317-1 : HA connection is disconnected after a mcpd crash followed by a license install or a config-sync ip address change

Links to More Info: BT2294317

Component: TMOS

Symptoms:
HA ConfigSync enters a permanently disconnected state.

Error present in the logs:
May 7 14:36:35 err mcpd[7116]: 0107142f:3: Can't connect to CMI peer 10.64.245.129, TMM outbound listener not yet created

Conditions:
Any of the following:
- A config sync address is changed to some other address
- Self-IP used previously by config-sync is modified
- A MCPD crash followed by a license install

Impact:
Config changes on the active unit are not synced to the standby

Workaround:
A `bigstart restart tmm` on the Active unit fixes the issue.

Note - restarting tmm will impact all traffic processing on the unit

2291393-1 : Splitsession Traffic Fails

Links to More Info: BT2291393

Component: Local Traffic Manager

Symptoms:
Traffic does not flow through the split-session BigIPs, with the split-session server profile resetting the connection.
If the sys db variable tm.rstcause.log is enabled, the BigIP with the splitsession server profile will have "Failed to find sync data" as the cause logged in /var/log/ltm

Conditions:
Two BigIPs are configured where one has a virtual using a splitsession client profile and the other has a virtual that uses the peer splitsession server profile.

Impact:
Connections fail for the virtual until the proxy flow between the two BigIPs dies and is reestablished.

Workaround:
It is possible to workaround this by disabling SSL for the split-session proxy.

For the BigIP with the splitsession client profile, disabling Mode on the splitsession-default-serverssl profile, and for the BigIP with the splitsession server profiledisabling Mode on the splitsession-default-clientssl profile.

Note, this would mean the flow metadata would no longer be encrypted between the BigIPs.

2291313-1 : Azure/Hyper-V BIG-IP VE uses less memory for TMM process after upgrade to v17.5.x

Links to More Info: BT2291313

Component: TMOS

Symptoms:
On Azure and Hyper-V deployments, BIG-IP VE allocates memory, but TMM only uses a smaller portion of it than before upgrade to version 17.5.x. In larger instances, a significant amount of memory remains unused.

Conditions:
BIG-IP VE is deployed on Microsoft Azure or Hyper-V with multiple data interfaces.

Impact:
Reduced memory available for traffic processing. Larger instance sizes do not provide a proportional memory benefit to TMM.

Workaround:
None

2291277-1 : Limited support for long strings in Login/Logout expected or unexpected string configurations.

Links to More Info: BT2291277

Component: Application Security Manager

Symptoms:
Login/Logout expected and unexpected strings are supposed to support up to 1024 characters, but they fail to handle strings of this length.

Conditions:
Configuring 1024 characters with Login/Logout expected/unexpected string.

Impact:
After ASM is restarted, the bd process enters a restart loop.

Workaround:
Use shorter strings for those fields.

2291257-4 : Adding a Subscriber IP addresses with route-domain notation in the Subscriber Management 'Log Session Activity' box fails with ;Invalid IP Address'

Links to More Info: BT2291257

Component: Policy Enforcement Manager

Symptoms:
Adding an IP with route-domain notation (like 10.0.0.2%2) via the GUI (under 'Subscriber Management ›› Subscribers: Activity Log: Configuration -> Log Session Activity') results in an error: "Invalid IP Address".

Conditions:
-- PEM licensed and provisioned
-- Adding an IP with route-domain notation (like 10.0.0.2%2) via the GUI (under 'Subscriber Management ›› Subscribers: Activity Log: Configuration -> Log Session Activity')

Impact:
An error is returned by the GUI: "Invalid IP Address".

Workaround:
Use tmsh to add the subscriber IP with route domain notation to the subscriber-activity-log settings:

# tmsh modify pem global-settings subscriber-activity-log subscriber-ip-addresses add { 10.0.0.2%2 }

2290681-4 : Use-after-free on ABORT/TEARDOWN

Links to More Info: BT2290681

Component: Application Security Manager

Symptoms:
The tmm crash

Conditions:
Bot defense profile attached to a virtual

Impact:
BIG-IP failover

2290241-3 : Improve the timeout and failure handling logic for multiple TACACS authentication servers.

Links to More Info: BT2290241

Component: TMOS

Symptoms:
The timeout logic does not function properly when a TACACS server is reachable but fails to return an authentication response, resulting in a hang instead of moving to the next available server for authentication.

Conditions:
Set up two TACACS servers and configure them on the BIG-IP system.

Impact:
When the TACACS server is reachable but does not return an authentication response, the load balancer fails to move to the next TACACS server and remains stuck while attempting to authenticate the user.

Workaround:
N/A

2290021-3 : HTTP/3 Requests are counted in HTTP profile statistics instead of HTTP/3 profile statistics

Links to More Info: BT2290021

Component: Local Traffic Manager

Symptoms:
HTTP/3 requests are incorrectly counted as 'Version 1.1' in HTTP profile statistics, instead of 'Version 3.0,' when HTTP/3 traffic is received on an HTTP/3 virtual server.

Conditions:
A virtual server is configured with HTTP/3 and QUIC, and HTTP/3 traffic is transmitted.

Impact:
Request statistics for the HTTP/3 profile are not incremented for HTTP/3 requests, misleadingly suggesting that HTTP/3 is not being used.

Workaround:
N/A.

2289937-1 : ldns.gz file remains empty despite Active Path and Persistence Records

Links to More Info: BT2289937

Component: Global Traffic Manager (DNS)

Symptoms:
The file /config/gtm/ldns.gz remains at 20 bytes (gzip header only) and contains no path or persistence records, even though GTM path and persistence entries are visible in memory via tmsh commands (show gtm path, show gtm persist).

Conditions:
The issue occurs when BIG-IP DNS is configured with GTM path and persistence record collection, and DNS queries are actively processed. Despite path and persistence records being visible in memory through tmsh commands, the scheduled dump process does not save these records to the /config/gtm/ldns.gz file.

Impact:
When the gtmd process is restarted, it is not to restore the previously known path and persistence records from ldns.gz and must relearn them through new DNS requests sent to members of the DNS sync group.

Workaround:
None

2289885-1 : Malformed protobuf file synced from secondary blades cause asmlogs coredump

Links to More Info: BT2289885

Component: Application Security Manager

Symptoms:
asmlogd spontaneously coredump on the tenant (SIGSEGV)

asmlogd log shows "Secondary file /var/asmdata1/cluster/request_log/transfer/request_log__20260331_230212__slot_2 does not match integrity check", right before the crash.

Conditions:
ASM provisioned

multi-blade platform with at least 2 blades

Impact:
asmlogd spontaneously crashed on the primary blade and then restarted automatically in about 30seconds

Workaround:
none

2288617-1 : The SNAT pool is not applied to the virtual server when source address translation is not configured as SNAT.

Links to More Info: BT2288617

Component: TMOS

Symptoms:
When creating an LTM virtual server with source-address-translation and attempting to assign a pool to this property, the pool will not be applied unless the type is explicitly set to snat. Although it may appear successful, reviewing the LTM logs will reveal the correct log message indicating the issue.

Conditions:
Attempting to create an LTM virtual object with the source-address-translation pool property without configuring the type property.

Impact:
The LTM virtual object will be created, but the source-address-translation will not include a pool.

Workaround:
To work around this issue, users should configure source-address-translation and pool properties as usual, but ensure the type property is set to snat."

2288173-4 : Some TMMs not ready and failed to bring up full cluster due to failed cmp dag transition

Links to More Info: BT2288173

Component: TMOS

Symptoms:
On VELOS tenants, when you reboot or restart the tenant, the cluster fails to come up fully with some TMMs indicating tmm-not-ready state, and performance is degraded as it fails to bring up the full cluster

Conditions:
VELOS tenants, with scenarios leading to reboot or restart of the tenant, possibly triggered by
- some software upgrade
- some power reset or
- configuration change causes occasional problems in tmm cluster bring-up and reduces the capacity handled by the tenant

When the problem happens, it is observed that
- tmctl tmm/cmp shows queue_drops
- tmctl tmm/mpi_mem shows tx-full
Due to a lot of internal background traffic in the cluster

and tmctl tmm/ready_for_world_stat indicates "not read" state for "dag_transition"

Impact:
Performance degraded due to reduced cluster size

Workaround:
No Workaround
As it is an intermittent problem, reboot/restart the problematic tenant may help to recover

2287865-1 : Dynamic CRL always fails connections that use self-signed certificates

Links to More Info: BT2287865

Component: Local Traffic Manager

Symptoms:
Connections fail with alert(46) unknown certificate error

The following is logged in /var/log/ltm

"unable to build certificate trust chain for profile"

Conditions:
Serverssl profile that uses Dynamic CRL, and the backend servers are configured with self-signed certificates.

Impact:
Dynamic CRLs cannot be used if backend servers are configured with self-signed certificates.

Workaround:
Add any self-signed certificates to the trusted CA of the ssl profile.

2285529-3 : IPS Attack Traffic Bypasses Inspection When A Signature Update Is Loaded While Signature Compilation Is In Progress

Component: Protocol Inspection

Symptoms:
When a second IPS signature update is loaded while the IPS daemon is still compiling signatures from a previous update, traffic that matches signature-based inspection rules passes through without being inspected

Conditions:
A virtual server has an IPS profile that includes signature-based inspection rules attached to it

A signature update is loaded. While the profile status shows "Signature compilation...", a second signature update is loaded before the first compilation completes

Impact:
Traffic that would typically be blocked or rejected by signature-based IPS rules goes uninspected

Workaround:
Before loading a new signature update, verify that all IPS profiles have reached Ready status

2285101 : APM policy export (ng_export) resulting in import failure for default oauth-request objects

Component: Access Policy Manager

Symptoms:
Importing an APM Access policy with OAuth Client agents that reference default built-in oauth-request objects fails with error:

err mcpd[4995]: 01020036:3: The requested oauth_request (Common/MSIdentityPlatform2.0AuthRedirectRequest) was not found.

Conditions:
Policy contains OAuth Client agent referencing the default built-in apm aaa oauth-request objects
Policy exported using ng_export and imported using ng_import

Impact:
Policy import fails, preventing migration or restoration of APM access policies containing default oauth-request references.

Workaround:
Manually extract ng-export.conf from the exported .tar.gz file, add the leading slash ('/') to the affected oauth-request references, repackage the archive, and re-import the policy. This allows ng_import to complete successfully.

2285073-2 : AbandonedTaskSweep Removes Tasks Prematurely

Links to More Info: BT2285073

Component: Application Security Manager

Symptoms:
When an asynchronous worker reaches a lifecycle limit for memory or calls handled, it hands its remaining task queue off to another worker.
Some timing conditions exist where the AbandonedTaskSweep periodic job will remove an unfinished task (such as a BulkTask) before the new worker updates the status to finished.

Conditions:
Normal operations.

Impact:
When the update to the task fails, the impact is cosmetic, as the task was already successfully completed.
The result of the task will not be retrievable.

Workaround:
None

2279193 : TMM may crash while configuring selfip

Component: Local Traffic Manager

Symptoms:
Configuring an IPv4 encoded IPv6 address with a prefix length greater than 32 as selfip causes TMM to crash

Conditions:
Configure an IPv4 encoded IPv6 address with a prefix length greater than 32 as selfip

Impact:
TMM crashes and causes disruptions to traffic handling

2277969-2 : [APM] ng_profile -copy does not rename internal objects (AAA server, ACL, portal access, webtop, webtop-link) causing object name growth on repeated deployments

Component: Access Policy Manager

Symptoms:
1.Internal object names (AAA, ACL, portal access, webtop, webtop link) accumulate extra suffixes or UUIDs after each ng_profile copy operation.
2.Object names become increasingly long and complex.
3.Orphaned objects may remain after delete operations.
4.Configuration errors or failures may occur if object names exceed allowed limits.

Conditions:
This issue occurs when all of the following conditions are met:

1.BIG-IP APM is used with an automation tool such as AS3 that follows the workflow: ng_import → ng_profile -copy → ng_profile -deleteall

2.The access profile references internal shared objects such as AAA servers (Active Directory, LDAP, RADIUS, etc.), ACLs, portal access resources, webtop and webtop-link resources.

3.The import step stamps a UUID or random string into the temporary profile name, for example tstSimple_UUID_appsrvs.

4.ng_profile -copy is run to rename the temporary profile to the final permanent name.

The issue does NOT occur when the profile contains only top-level objects with no shared AAA, ACL, or webtop references.

Impact:
1.Configuration management becomes difficult due to long and complex object names.
2.Risk of hitting BIG-IP character limits, leading to deployment failures.
3.Orphaned objects may cause clutter and potential errors in future operations.
4.May affect automated workflows and environments relying on clean object naming.

Workaround:
None

2277837-3 : TMM Crashes On Standby Device Due To Ram Cache Issue

Links to More Info: BT2277837

Component: Local Traffic Manager

Symptoms:
High throughput with large and small documents in RAM cache is involved; TMM crashes in rare cases

Conditions:
Under congestion, events might not be in order on the standby, leading to a crash

Impact:
TMM is out of service while rebooting

Workaround:
None

2269969-4 : Using TCP congestion BBR might lead to TMM core

Links to More Info: BT2269969

Component: Local Traffic Manager

Symptoms:
Using TCP congestion BBR might lead to TMM core

Conditions:
TCP congestion BBR is in use.

Impact:
TMM crash/core.

Workaround:
N/A

2263577-2 : APM Portal Access Modern rewrite: Citrix StoreFront resources return HTTP 404 due to un-normalized URLs from deflate_uri()

Component: Access Policy Manager

Symptoms:
-- Citrix icons and image resources fail to load when accessed through BIG-IP APM Portal Access.
-- Browser console displays repeated 404 errors for requests.
-- Application performance is degraded, and user experience is impacted.
-- Direct access to Citrix works correctly; the issue only occurs via Portal Access.

Conditions:
-- Citrix StoreFront is accessed through BIG-IP APM Portal Access (PA) with a Modern rewrite profile.
-- BIG-IP APM version 17.1.3 is in use.
-- Outbound CSS is rewritten so that ../ becomes f5-w-doubledot/.
-- JavaScript reads getComputedStyle(el).backgroundImage, triggering APM's interceptor and deflate_uri() function, which returns un-normalized absolute URLs.

Impact:
Citrix web interface is partially broken for end users.
Icons and other image resources do not display, resulting in repeated 404 errors.

Application usability and visual integrity are compromised. It may affect productivity and user satisfaction for organizations relying on Citrix through BIG-IP APM Portal Access.

2262641-4 : [BGP] Peering deadlock when modifying supported capabilities

Links to More Info: BT2262641

Component: TMOS

Symptoms:
When modifying capabilities BGP peering might enter a deadlock with local peer ignoring incoming and not creating outbound connections.

Conditions:
Modifying BGP capabilities when local peer tries to connect.

Impact:
BGP peering enters a deadlock.

Workaround:
Remove peer (neighbor) configuration and reapply it.

2261529 : HTTP2 RST_STREAM flood detection should be more sensitive

Links to More Info: BT2261529

Component: Local Traffic Manager

Symptoms:
If an HTTP2 RST flood comes at an interval of 5 msec or more, TMM will not flag this as an attack.

Conditions:
These floods are not detected.

Impact:
Although not as impactful as an attack with less than 1 msec between RST_STREAMs, it could impact performance.

Workaround:
None

2261337 : TMUI displays Local Traffic menu on rSeries Best Bundle tenant without LTM provisioned

Links to More Info: BT2261337

Component: TMOS

Symptoms:
In rSeries BIG-IP tenants with a Best Bundle license, TMUI shows the Local Traffic menu even when LTM is not provisioned (GTM dedicated, LTM none), which does not occur on DNS-only tenants with the same provisioning.

Conditions:
This issue occurs when,

- Platform is rSeries (eg: R5900, R10900)
- Deployment is a BIG-IP tenant
- License is Best Bundle
- GTM is set to dedicated and LTM is set to none

Impact:
This reveals LTM configuration options (virtual servers, pools, nodes, etc.) on a DNS‑dedicated tenant, increasing the risk of accidental object creation.

Workaround:
None

2261137-5 : TMM may crash if DNS cache resolver concurrency settings are changed during live traffic

Links to More Info: BT2261137

Component: Global Traffic Manager (DNS)

Symptoms:
TMM crashes with a SIGSEGV and then restarts.

Conditions:
- The DNS cache resolver is configured and processing queries.
- A DNS cache-resolver object is changed, specifically a setting that alters max-concurrent-queries or max-concurrent-tcp.
- Live DNS traffic is in progress when the change is applied.

Impact:
Traffic is disrupted during a TMM restart, and the redundant unit fails over.

2260905-3 : Full config-sync adds remotely authenticated user to sdm group in /etc/group on sync receiver

Links to More Info: BT2260905

Component: Local Traffic Manager

Symptoms:
During a full config-sync on BIG-IP LTM (e.g., 17.5.1.x), remotely authenticated administrative users may be added to the sdm group in /etc/group on the sync receiver.

Conditions:
- BIG-IP is configured with remote authentication (e.g., LDAP, Active Directory, TACACS+).
- A remotely authenticated administrative user is used to access the system.
- A full config-sync operation is performed between BIG-IP devices.

Impact:
An inconsistency has been observed in the /etc/group file content between the sync initiator and the receiver.

Workaround:
NA

2259777-1 : Spurious 'Config error: Error updating categories' messages are logged by each TMM during boot.

Component: Access Policy Manager

Symptoms:
On every TMM start, /var/log/ltm contains:

  err tmm[<pid>]: 01010007:3: Config error: Error updating categories in urlcat
  err tmm[<pid>]: 01010007:3: Config error: Error updating categories in urlcat items
  err tmm[<pid>]: 01010007:3: Config error: Error updating categories in classification

The triplet repeats twice per TMM and is logged by every TMM instance.

Conditions:
- Install BIG-IP 17.1.3.1.
- Occurs with any provisioning or licensing combination (reproducible with LTM-only).
- The issue arises during every TMM start, including boot, upgrade, or upon running bigstart restart tmm.

Impact:
This issue results in cosmetic log noise only and may trigger monitoring systems that parse /var/log/ltm for error-severity or 'Config error' strings. It does not affect URL categorization, filtering, classification, or traffic processing.

2259397-3 : [BGP] In route map the change in as-path does not automatically trigger soft outbound update

Links to More Info: BT2259397

Component: TMOS

Symptoms:
When updating route-map as-path a new path is not advertised automatically and manual update is needed.

Conditions:
Updating route-map as-path for the route-map attached to a BGP peer.

Impact:
Manual soft update is needed.