Applies To:
Show Versions
BIG-IQ Centralized Management
- 4.6.0
Summary:
This release note documents version 4.6.0 of BIG-IQ Centralized Management.
Contents:
- New features
- Screen resolution requirement
- Browser support
- BIG-IP compatibility
- User documentation for this release
- Software installation
- Upgrading BIG-IQ
- Fixes
- Behavior changes
- Known issues
- Removing BIG-IQ system services from a BIG-IP device
- Contacting F5 Networks
- Legal notices
New features
BIG-IQ ADC
There are no new features for BIG-IQ ADC.
BIG-IQ Device
Retention policy for UCS backups
You can now define how long to save locally-stored UCS backups on the BIG-IQ system through a retention policy.Support for RADIUS failover with externally-hosted RADIUS server
BIG-IQ device now supports failover for authentication against remote RADIUS servers. If one RADIUS server is not available, BIG-IQ device attempts to authenticate against the failover servers. You can configure up to three RADIUS servers.Support for multiple LDAP servers
You can now add multiple LDAP servers for authentication.Software upgrade and installation enhancements
This release includes enhancements to the software image deployment work flow.BIG-IQ Security
Support upgrade from version 4.4 to version 4.6 for BIG-IQ Security module
BIG-IQ Security version 4.6 release supports upgrades from BIG-IQ Security version 4.4 and 4.5 to version 4.6.Support for BIG-IP devices running version 12.0
BIG-IQ Security version 4.6 supports BIG-IP version 12.0. Refer to http://support.f5.com/kb/en-us/solutions/public/14000/500/sol14592.html for details.Support for BIG-IP v11.4.1 interoperability using iControl SOAP
BIG-IQ Security version 4.6 continues to interoperate with BIG-IP version 11.4.1 using iControl SOAP.Enhanced scalability for BIG-IQ Network Security
The Network Security module has enhanced scalability to support up to 200 devices and up to 120,000 configuration objects.Enhanced scalability for BIG-IQ Web Application Security
The Web Application Security module has enhanced scalability to support up to 50 devices with up to 250 virtual servers, and a combined total of 5 Web Application Security policies on the BIG-IQ system.Enhanced firewall policy management for BIG-IQ Network Security
The Network Security Policy Editor has enhanced usability and search capabilities.Change verifications feature for Network Security
The Network Security Policy Editor now includes the Change Verifications feature that allows you to verify changes to a firewall before deployment to a BIG-IP device.Multiple item deletion of snapshots and deployments in Network Security
The Network Security Overview panels now include the ability to delete multiple snapshots or deployments at one time.Confirmation of firewall rule deployment in Network Security
The Network Security Deployments panel now includes the ability to confirm that firewall rules were deployed to and compiled on the BIG-IP devices using the Check Rule Compilation option.Support for Headers in Policy Editor in Web Application Security
The Web Application Security Policy Editor now includes support for the Headers property, including Allowed Methods and HTTP Headers.Support for Custom Signature Sets in Policy Editor in Web Application Security
The Web Application Security Policy Editor now includes support for the creating and editing custom signature sets.Support for archiving audit logs in Web Application Security
Web Application Security audit logs can now be archived as they are in Network Security.BIG-IQ System
There are no new features for BIG-IQ System.
Screen resolution requirement
To properly display, the BIG-IQ system requires that your screen resolution is set to 1280x1024 or higher.
Browser support
BIG-IQ supports the following browsers and versions:
- Microsoft Internet Explorer version 9 and later
- Mozilla Firefox version 29.x and later
- Google Chrome version 34.x and later
BIG-IP compatibility
SOL14592: Compatibility between BIG-IQ and BIG-IP releases provides a summary of version compatibility for specific features between the BIG-IQ system and BIG-IP releases.
User documentation for this release
For a comprehensive list of documentation that is relevant to this release, refer to the BIG-IQ 4.6.0 Documentation page.
Software installation
For procedures about specifying network options and performing initial configuration, refer to the BIG-IQ Centralized Management: Licensing and Initial Configuration guide.
Upgrading BIG-IQ
Before you can upgrade the BIG-IQ system, you must perform the following tasks:
- Download the .iso file for the upgrade from F5 Downloads to /shared/images on the BIG-IQ system. If you need to create this directory, use the exact name /shared/images.
- Select a disk volume on which to install the upgrade. You must install the BIG-IQ software on an available volume.
- Locate the user configuration set (UCS) in the /var/local/ucs directory on the source installation location, and copy the UCS file to another system for safe keeping.
If you have configured the BIG-IQ system in a high availability cluster, perform these steps on each BIG-IQ system in the cluster in immediate succession. It is important to get the cluster members on the same software version as quickly as possible to avoid potential user experience issues.
Fixes
ID Number | Functional Area | Description |
---|---|---|
534030 | ADC | Log messages about registering a pool member are now displayed when the logging level is set to FINEST and not when the logging level is set to INFO. This reduces the number of log messages when logging is set to INFO. |
513210 | ADC | It is possible to DMA a BIG-IP system at a moment when one of its pool member's states (user-up, user-down, force-reload, and so on) is in transition from one state to another. In this case, the pool member has a state field that is unset in the BIG-IQ configuration. If a deployment later occurs with that pool member in the BIG-IQ configuration, the deployment operation formerly failed because of the unset field. Now the deployment succeeds. |
522523 | ADC | Remote user of admin role can now deploy ADC objects to managed device now. |
517319 | Device | Fixed an API inconsistency with backupLifeTime and expirationDateTime parameters when using the UI. |
512349 | Device | Formerly, a user could not grant pool licenses to any discovered BIG-IP devices from the BIG-IQ system. Now you can successfully grant pool licenses. |
532946 | Device | Improved configuration template worker credential handling. |
531701 | Device | Improved device discovery task worker credential handling |
531786 | Device | Improved SMTP Destination worker credential handling |
516315 | Device | Previously, some BIG-IQ system restore operations ran indefinitely. Now they end correctly. |
534129 | Device | You can now specify SNMP settings for all devices in an active-active high availability configuration. |
532182 | Device | The selected day of the week correctly displays on the Backups properties screen for a scheduled weekly backup. |
522631 | Device | As of version 4.6.0, a user can now deploy config templates with SMTP Server objects to managed BIG-IP devices. |
522299 | Device | Populate device inventory even when some devices may be unavailable. |
538633 | Device | Using floating management address to upgrade framework |
539249 | Device | Managed device discovery done with framework upgrade through Network Security succeeds. |
528029 | Device | SNMP authentication information no longer replicated in HA setups |
509250 | Device | The BIG-IQ system no longer incorrectly requests the REST framework be updated when discovering a BIG-IP VIPRION. |
516663 | Device | The Backup panel's screen now contains a scroll bar for the Device list to allow you to more easily navigate to additional devices in the list. |
497555 | Device | If you restore BIG-IQ system while you are managing it(self restore), restore status will not be reported correctly. Instead of showing "Backup_Finished" or "Backup_Failed","Make_Backup" state will be displayed forever. |
519639 | Device | BIG-IQ system no longer requires a route to the management IP Address to update framework components during discovery. |
525319 | Device | Added host/network option to SNMP "Client Allow List" |
516654 | Device | The "End Date" property of a Backup job now properly displays when you select the Daily option. |
519393 | Device | Once a restore of a UCS backup failed it could not be restored again. This issue is resolved. |
527089 | Device | Users with the Device Manager role can now properly access the Cluster Management screen. |
530721 | Device | When properly configured, users with the Device Manager role now have permission to view the following device properties: self-IP addresses, VLANs, interfaces, and routes. |
514543 | Device | Now, when a BIG-IQ system in a high availability configuration creates a UCS backup file job, it now gets reliably replicated to the peer even if the peer is unavailable (offline, running a backup job, adding another peer device after the backup is executed, and so forth). |
513959 | Device | Previously, when creating a UCS backup, the BIG-IQ system allowed you to change the passphrase. This made the backup unusable. You can no longer change the passphrase when creating a UCS backup. |
505906 | Device | When granting a device to a license using the "License Device" list, the operation failed if the device in question was not in the default device group ("Managed BIG-IPs") in Devices/Provisioning. Now the operation succeeds in any case. |
537009 | Device | Pool licenses no longer incorrectly display date fields for licenses that never expires. |
483739 | Device | Jobs that perform a factory install or delete a cloud node still require that the target device be in the Managed BIG-IPs group, but other jobs now work regardless of the device's group. |
492114 | Device | This issue has been resolved. Template deployments can now target any discovered device. |
533764 | Network Security (AFM) | Corrected problem in Web Application Security that caused discovery of a BIG-IP device to fail, due to problems declaring management authority on that BIG-IP device. |
513651 | Network Security (AFM) | Documentation on cluster sync when adding devices was corrected. |
518741 | Network Security (AFM) | The BIG-IQ system formerly reported false conflicts in identical DoS Profiles. |
516805 | Network Security (AFM) | When a Network Security policy is opened for viewing, rule lists are no longer automatically expanded to improve performance. |
533686 | Network Security (AFM) | When using the Network Security Policy Editor, the Filter 'related to' option for an object now works correctly for objects that occur in later pages of a long paged list. |
533918 | Network Security (AFM) | When using the Policy Editor in Network Security, you can now edit a shared resource within a policy while editing a policy itself. |
547830 | Network Security (AFM) | You can now create a search query containing multiple search terms with logical AND operators in the Toolbox search and within the Network Security Policy Editor content table search. These queries are available for address lists, port lists, and schedules, but are not available for policies or rule lists. |
515874 | Network Security (AFM) | You could discover a BIG-IP system through a Security DMA and have no conflicts in its logging profile, but then get conflicts in the logging profile in a subsequent Security DMA. The false conflict in the logging profile no longer occurs. |
547626 | Network Security (AFM) | BIG-IQ system Audit log views now support horizontal scrolling. |
496439 | Network Security (AFM) | Can now declare management authority on BIG-IP systems with certain virtual-server configurations. |
467095 | Network Security (AFM) | Cutting and pasting text that contains a control character (such as a tab character) into a BIG-IQ system description field (such as that in an address list or rule list) no longer leads to deployment differences. |
518958 | Network Security (AFM) | When editing an existing DoS profile, users could not add the first whitelist IP. Now you can successfully add whitelist IP addresses. |
527051 | Network Security (AFM) | Rule search bar no longer appears on address list and port list pages. This is correct behavior. |
520431 | Network Security (AFM) | When viewing the differences between two objects, if the object is no longer available, the system shows "This generation is no longer available for viewing". |
524511 | Network Security (AFM) | Proactive Bot tab is now hidden when Proactive Bot Defense is turned off, which is correct behavior. |
542620 | Network Security (AFM) | REST capability for clustered BIG-IPs is determined correctly on reimport after upgrade in 4.6.0 |
533899 | Network Security (AFM) | You can now create a search query containing multiple search terms with logical AND operators in the Network Security Policy Editor Toolbox search. These queries are available for address lists, port lists, and schedules, but are not available for policies or rule lists. |
519070 | Network Security (AFM) | BIG-IQ GUI no longer displays DoS profile options that are not allowed on the device where the profile is being applied |
517539 | Network Security (AFM) | The discovery of a VIPRION 2400 BIG-IP chassis formerly failed with the following error: "working-config subcollection push sender failed: Invalid format field value: slot_number." Now the discovery succeeds. |
505055 | Network Security (AFM) | Code was updated to handle certain missing information that is expected in custom group. |
542641 | Network Security (AFM) | The cluster group is created on reimport if missing to ensure devices stay in sync. |
547509 | Network Security (AFM) | Search response has been optimized when the user searches in Network Security Policy Editor, using the global navigation search field or the firewall context table search field. |
531784 | Platform | Handling of third party authentication information, such as that used with LDAP and RADIUS, has been improved. |
531735 | Platform | Improved device group credential handling. |
533733 | Platform | SMTP notifications that previously stopped working when authentication was required on the server side now perform correctly. |
520818 | Platform | UCS backups triggered an extended period of high CPU usage. This was due to background search-query optimizations combined with the "Highlight Related Items" feature. The "Highlight Related Items" feature is now disabled in the Device module to avoid this issue. |
549041 | Platform | BIG-IQ Device properly updates the Last Availability field on the Device properties screen every 120 seconds. |
519414 | Platform | Under certain conditions, the BIG-IQ system previously failed to log health events and generate alerts. This issue is now resolved. |
553898 | Platform | The system no longer refuses login when valid credentials are entered. |
514368 | Platform | Fixed CVE-2012-6151. |
499071 | Platform | Fixed CVE-2014-9295 |
511253 | Platform | Applied patches for CVE-2014-9297 and CVE-2014-9298 |
505635 | Platform | glibc has been updated to no longer include code that is vulnerable to CVE-2015-0235 |
516875 | Platform | Fixed CVE-2015-0286 CVE-2015-0287 CVE-2015-0289 CVE-2015-0293 CVE-2015-0209 CVE-2015-0288. |
524616 | Platform | Long Backup names may no longer hide buttons. |
520803 | Platform | Missing stylesheet added to ADC module, which is required for the device health charts. |
525331 | Platform | Source address is no longer marked in yellow, indicating that it is required, for SNMP Access Configuration. This is correct behavior. |
525326 | Platform | OID field in the SNMP Access configuration no longer indicates they are required, which they are not. |
513753 | Platform | In the Device > Configuration > Overview > Backups panel, if you select an existing backup and open its properties screen, you can click Download to download the UCS backup. Previously, if the UCS file was greater than 32MB, this operation failed with the error "Failed - Server problem." Now the download succeeds. |
522317 | Platform | The system now uses 100 GB application volumes for /var/config and /shared/ucs_backups to provide more storage on BIG-IQ 7000 devices. |
531778 | Platform | The circumstances that caused the Null Pointer Exception are now anticipated and these will be logged. The Exception will no longer be propagated back to the UI. |
532195 | Platform | We improved the handling of special characters when you are using LDAP authentication. |
499078 | Platform | The emulated IDE storage driver has been replaced with PV (para-virtualized) SCSI storage driver. PV SCSI driver gracefully handles disk I/O timeouts and recovers from them. |
517987 | Platform | Self IP, VLAN and interfaces information are correctly present in both BIG-IQ nodes. |
521277 | Platform | Responses to searches in the object editor are now 92% faster. |
534028 | Platform | Previously, under rare circumstances, you were sometimes unable to log into the BIG-IQ system. This issue has been resolved. |
527647 | Platform | A BIG-IQ system with LDAP authentication had a security vulnerability in its REST API. This issue has been resolved. |
492377 | Platform | Delete storage snapshot zip file after unzipping it. |
504015 | Platform | Initial setup can now complete. |
526428 | System | BIG-IQ can now connect to configured SMTP servers with no authentication. |
553578 | System | Interfaces now properly display when creating a new VLAN from the VLANs panel. |
516886 | Web App Security (ASM) | After a successful deployment, a second deployment failed with spurious differences in a policy's Response Pages. These false differences no longer occur. |
521085 | Web App Security (ASM) | ASM Deployment failure with error "Failed in child deploy task" on one device when deploying to many devices no longer occurs. |
528199 | Web App Security (ASM) | Conflict resolution window now shows which BIG-IP device has the conflict. |
533818 | Web App Security (ASM) | Corrected problem where changes to ASM signatures on a BIG-IP device could not be deployed by the BIG-IQ. |
516034 | Web App Security (ASM) | Deploy caused false difference in 'learnNewEntities' for Parameters and FileTypes. |
513745 | Web App Security (ASM) | "Deployment failure sometimes occurred with an error similar to this: Virtual server /Common/blueberry5 requires a profile of type websecurity for ltm policy /Common/asm_auto_l7_policy_blueberry5" |
524777 | Web App Security (ASM) | Deployment jobs removed shared namespace with BIG-IP objects that were unknown to BIG-IQ (Web Application Security). Now deployment jobs ignore configuration objects on the BIG-IP device (such as virtual servers) that are unknown to the BIG-IQ system. The graphical difference view in the UI may indicate that unknown objects are deleted, but the objects are preserved on the BIG-IP device. To include the objects in the BIG-IQ configuration, rediscover the BIG-IP device. |
517640 | Web App Security (ASM) | Deployment to a BIG-IP device running version 11.5.2 failed if a policy contained the default for "Dynamic Session ID in URL." Now the BIG-IQ system deploys that default value without any errors. |
514921 | Web App Security (ASM) | Discover/reimport in the Web Application Security Mgr role previously failed with authorization errors when there were conflicts in the shared security area. This no longer occurs. |
517898 | Web App Security (ASM) | Fixed issue when policy had a conflict for applicationLanguage because of different case on reimport. |
530958 | Web App Security (ASM) | If a policy is created on a BIG-IP device, exported, and then imported to a BIG-IQ system, a subsequent discovery of that device no longer shows conflicts on ajax and ajax-login. |
513736 | Web App Security (ASM) | If you deploy from Web Application Security and then run an Evaluate process without changing anything, the Evaluate process should run without finding any differences. Formerly, false differences were appearing in the Evaluate results. Now the Evaluate operation succeeds and no unexpected differences appear. |
515532 | Web App Security (ASM) | If you entered and deployed a disallowed file type in the Web Application Security GUI, then immediately ran another deployment, the second deployment showed false differences. This no longer occurs. |
516334 | Web App Security (ASM) | Immediate deployment of a just-discovered policy (with Parameters configured) no longer shows objects to deploy. |
514437 | Web App Security (ASM) | Improper transformation of a policy's 'inspectHttpUploads' and 'useDynamicSessionIdInUrl' properties during deployment resulted in an unexpected difference. This no longer occurs. |
511705 | Web App Security (ASM) | In the Parameters section of the Web Application Security policy editor, you can click on parameter names to see their details. For parameters with Attack Signatures overrides assigned, in some cases, you were unable to open the details screen. Now you can open the details screen for all such parameters. |
518081 | Web App Security (ASM) | Inconsistencies found in the BIG-IQ system default response page have been corrected. |
514511 | Web App Security (ASM) | No changes showed when attempting to view the Web Application Security differences between two snapshots. This has been corrected. |
513737 | Web App Security (ASM) | On re-import, DMA showed conflicts for an ASM policy after a successful deployment of the same policy. These unexpected conflicts have been resolved. |
514507 | Web App Security (ASM) | Policy builder setting was incorrect for an IP address in the white list after deployment. It now shows correctly. |
515496 | Web App Security (ASM) | Previously, an inactive virtual server was seeing unexpected differences for "description" and "address" fields yet all differences shown in UI were identical. This has been corrected. |
533043 | Web App Security (ASM) | "Previously, if a user added a custom signature to a discovered BIG-IP device, and then ran a BIG-IQ deployment of that BIG-IP device, the deployment failed. The deployment now succeeds." |
510984 | Web App Security (ASM) | Suppose you invoke an Evaluate phase of deployment, and then later invoke the Deploy phase, and then invoke Deploy again (perhaps through the API) before the operation is finished. Formerly, this would leave the operation in the STARTING state indefinitely. Now the BIG-IQ system ignores the second and subsequent commands and the deployment operation proceeds. |
514661 | Web App Security (ASM) | The BIG-IQ Web Application Security module did not allow you to change a policy FileType type from "wildcard" to "explicit". Now you can. |
518647 | Web App Security (ASM) | "The following sequence silently failed to deploy a change to a BIG-IP device: 1. BIG-IQ system: create a new policy and add it to a discovered virtual server from a BIG-IP device. 2. BIG-IQ: deploy. This is successful. 3. BIG-IQ: Remove the policy from the virtual server, and deploy again. The deploy shows no errors in the GUI. 4. BIG-IP: The policy was still incorrectly assigned to the virtual server. Now the policy is correctly deleted from the virtual server in the final step." |
492072 | Web App Security (ASM) | The Policy Signature URI, /mgmt/cm/asm/working-config/policies/<id>/signatures, returned more signatures than expected. Now the URI returns only the signatures that are included in the policy configuration. |
513766 | Web App Security (ASM) | The signature staging setting was not being deployed correctly for a new policy. This behavior has been corrected. |
516515 | Web App Security (ASM) | The Web Application Security software was unable to deploy a subnet-mask change in a Policy Whitelist. Now you can edit the subnet mask in a Policy Whitelist and the software is able to deploy the new mask. |
515814 | Web App Security (ASM) | This issue applied to a Web Application Security DMA where there was a conflict. If the conflicting line was particularly long, the conflict dialog box only showed the left column of the 2-column display. Now, both columns display properly for any length of the conflicting line. |
520152 | Web App Security (ASM) | Unexpected differences in policy after successful deployment of changes in attack signatures configuration no longer occur. |
519446 | Web App Security (ASM) | Using the Show Related search from the Web Application Security policy panel now gives the count of virtual servers and the count of devices correctly. |
523297 | Web App Security (ASM) | We have added Import Policy Blocking setting when you are discovering a policy. |
516021 | Web App Security (ASM) | When deploying a Web Application Security policy without editing the configuration, false differences were encountered for the dataguard description property. This no longer occurs. |
514018 | Web App Security (ASM) | When you added a new FileType to a Web Application Security policy, set all of its values to zero, and saved your changes, the values would appear as "ANY" in the next edit session. This was only an issue in screen presentation. Now the correct value of zero appears on the screen after saving a zero value. |
515542 | Web App Security (ASM) | When you use the GUI to compare different snapshots, a pop-up appears that says "Calculating Differences," and it should be replaced with a window that shows the results of the calculation. This issue was that the second window never appeared. Now a window appears appropriately and shows the differences. |
528251 | Web App Security (ASM) | The BIG-IQ system now enforces the correct limit for a policy's Enforcement Readiness Period as defined by the BIG-IP device. |
517360 | Web App Security (ASM) | A BIG-IQ system can now discover a BIG-IQ logging node using the logging node management IP address. |
516202 | Web App Security (ASM) | A java stack trace appeared in the deployment difference viewer when deploying a change in a Web Application Security policy's Signature List. This no longer occurs for policy signature lists. |
532113 | Web App Security (ASM) | Discovery now succeeds on a BIG-IQ device when Untrusted Time Period Minimum "Accept As Legitimate" rule is not smaller or equal to Untrusted Time Period Minimum in "Stabilize" rule |
532103 | Web App Security (ASM) | On BIG-IP systems, which allow 0 days for Stabilize (Tighten) trusted traffic, discovery of the device now succeeds on BIG-IQ validation. |
519226 | Web App Security (ASM) | A new policy created on the BIG-IQ system was not creating default character sets. The result was that a false difference was being displayed on subsequent deployments. Now the BIG-IQ system correctly creates the default character sets, and no false differences result. |
514019 | Web App Security (ASM) | "Previously, after clicking one of the Web Application Security polices in the deployment task difference viewer, the user waited for all the policy differences to be rendered in the UI. The UI appeared to be busy for several seconds while the system compared every component of the policy. We have changed the method for rendering policy differences and the UI to be more responsive. The policy changes are now displayed as subsections of the parent policy. Users can now click the individual subsections to render and view differences for each subsection individually. Subsections for each policy are displayed directly beneath the policy with a tree node icon to indicate that it is associated with the above listed policy. With this change, the top-level policy object may be displayed in the viewer, but the comparison of that object might show no differences. In this case, all the differences are in the child objects." |
516835 | Web App Security (ASM) | After discovering a BIG-IP device with Web Application Security, taking a snapshot, and editing the configuration, an attempt to restore the snapshot sometimes ended with a single error: "Snapshot failed." This no longer occurs. |
511494 | Web App Security (ASM) | After following the manual to configure an ASM logging node, the BIG-IQ sometimes logged the error message "Logging node is not configured" in the Web Application Security event log. The logging node was not always listening on the correct port. Now the logging node reliably listens on the correct port. |
516261 | Web App Security (ASM) | "After you made changes to the list of custom patterns and exception patterns in a Web Application policy GUI, a subsequent deployment task correctly showed that the policy was changed, but no individual patterns appeared in the graphical display of the Data Guard differences. Other sub collections appeared in this display. This only occurred for policies that were new to the BIG-IP device. Now, for policies that are new to the BIG-IP device, the graphical display of policy differences does not show any sub collection details. This ensures that Data Guard is consistent with the remaining sub collections in this case." |
536778 | Web App Security (ASM) | A new setting has been added to allow manual sync of a device group when updating the signature files. |
528503 | Web App Security (ASM) | Deploying a policy that is configured with non-multibyte encoding now succeeds. |
516240 | Web App Security (ASM) | When changes in a Web Application Security policy Attack Signatures are correctly deployed to BIG-IP devices, the BIG-IP user interface now displays those changes. |
532502 | Web App Security (ASM) | Correct signature file version as saved on the device is now shown on the device properties panel. |
519283 | Web App Security (ASM) | Discovery or rediscovery of a BIG-IP VIPRION completed, but virtual servers were not added and other changes were sometimes missed during discovery or rediscovery. |
516777 | Web App Security (ASM) | Discovery failure no longer causes the GUI to become unresponsive. |
520389 | Web App Security (ASM) | "During the discovery and evaluate process, the BIG-IQ system retrieves ASM signatures from the BIG-IP device to be compared with the BIG-IQ system's signatures. In certain situations this caused the BIG-IP restjavad process to run out of available memory, and this made discovery or evaluate fail on the BIG-IQ system. Now the process to retrieve ASM signatures from the BIG-IP device has been modified to reduce the memory utilization on the BIG-IP." |
524137 | Web App Security (ASM) | Importing a XML Policy file from a BIG-IP device that contains a custom signature now successfully imports. |
528047 | Web App Security (ASM) | If deployment task for a device fails, the change icon is no longer cleared when the deployment task completes. |
542864 | Web App Security (ASM) | Conflicts no longer occur for VIOL_ATTACK_SIGNATURE if a policy from a 12.0.0 device was imported prior to discovery. |
537382 | Web App Security (ASM) | False differences no longer shown. |
536770 | Web App Security (ASM) | Partial text of the readme file for attack signatures is no longer erroneously displayed in the Version field on the Device panel of Web Application Security. |
516268 | Web App Security (ASM) | If you created a new Web Application Security policy on the BIG-IQ system, assigned it to a virtual server, and then deployed, a false conflict referencing "srcType" could occur during the next rediscovery/reimport. The false conflict no longer occurs in this case. |
516760 | Web App Security (ASM) | If the user deleted an ASM policy from the inactive policy holder and then initiated a deployment task, the deployment task failed to remove the deleted policy from the BIG-IP device. The task should have completed with an error. The deployment task now correctly completes with a failure message indicating that the "Task did not finish successfully". |
494811 | Web App Security (ASM) | "If you edited a policy by setting a file-type or parameter's type to ""wildcard,"" saved it, and then attempted to edit that policy section again, the edit operation failed with this error: ""wildcardOrder shouldn't be null"" This failure no longer occurs." |
531892 | Web App Security (ASM) | Deployment: Change icon is now cleared on Standby BIG-IP after a deployment to a pair of BIG-IP systems. |
517514 | Web App Security (ASM) | If you imported an ASM policy with non-default parameters into a BIG-IP device, and then imported the same policy into the BIG-IQ system, the wildcardOrder options were sometimes different on the two systems. A later discovery of the BIG-IP device from the BIG-IQ system's Web Application Security interface would have resulted in conflicts. Now both devices keep the wildcardOrder parameters consistent, and no false-discovery conflicts ensue. |
517534 | Web App Security (ASM) | If you imported the same policy into a BIG-IP device and a BIG-IQ system, the parameters contained a different isBase64 key. The BIG-IP device omitted this key from its JSON, and the BIG-IQ system included the key with a setting of "false." This resulted in false discovery conflicts. The systems now avoid the conflicts by consistently recording this key. |
517517 | Web App Security (ASM) | If you imported the same policy into a BIG-IP device and a BIG-IQ system, the response pages contained a different ajaxEnabled key. The BIG-IQ system omitted this key from its JSON, and the BIG-IP device included the key with a setting of "false." This resulted in false discovery conflicts. The systems now avoid the conflicts by consistently recording this key. |
525320 | Web App Security (ASM) | Incorrect differences for Web Application Security virtual servers are no longer shown. |
528191 | Web App Security (ASM) | In the Devices panel of Web Application Security -> Overview, you can select a device and pull down a menu to Show Related Items. This is intended to highlight all of the objects in the other panels that are on the selected device. The Policies that are on the device are now highlighted correctly by this operation. |
517499 | Web App Security (ASM) | Redeployment after a successful deployment showed false differences, including some differing policies without any difference details. The BIG-IQ system listed all policies as policies with differences, but not all of the policies showed any differences when you clicked on them for details. Now, these false differences do not occur. |
534317 | Web App Security (ASM) | Related to searches from the Web Application Security Devices panel no longer time out. |
518653 | Web App Security (ASM) | It is not possible to determine whether or not a policy is inactive from the Web Application Security interface. You declare an ASM policy active or inactive on the BIG-IP device. If you assigned an inactive policy to an active virtual server and deployed it, the deployment formerly failed. Now the BIG-IQ system changes the policy to active, and the deployment succeeds. |
546648 | Web App Security (ASM) | Differences should only be shown for relevant signatures |
521611 | Web App Security (ASM) | Previously, screens could not fully expand when the browser Window had been shrunk, or when the browser zoom was above 100%. For some screens, this hid some buttons and features. For example, when the Devices screen could not fully expand, the Rediscover button was not always visible. This is no longer a problem. |
530144 | Web App Security (ASM) | Custom signature sets are now removed when ASM policies are removed. |
516624 | Web App Security (ASM) | BIG-IQ should not allow user to edit the 0x0 value for Parameter Name and Parameter Value. On the BIG-IP GUI, these fields are read-only. The BIG-IQ previously allowed the user to edit these settings and then attempt to deploy them. The BIG-IQ GUI now correctly makes these fields read-only. |
515919 | Web App Security (ASM) | Previously after an Import of a Web Application Security policy, the BIG-IQ software mistakenly converted some unset file_type parameters to specific values. This no longer occurs. |
523302 | Web App Security (ASM) | This release supports importing and deploying of custom (user defined) signatures. |
513793 | Web App Security (ASM) | "Previously, the BIG-IQ system might not deploy Web Application Security policies or virtual servers as expected and without signaling an error. Now, those changes are deployed correctly." |
528194 | Web App Security (ASM) | Previously, the Web Application Security Virtual Server panel constantly refreshed while scrolling. This no longer occurs. |
518461 | Web App Security (ASM) | "The following steps resulted in a deployment that failed without any visible error: 1. BIG-IP device: - Create two virtual servers. - Create one ASM policy. - At Local Traffic >> Policies : Policy List, Create a new rule for each virtual server, and assign the same policy to both of them. 2. BIG-IQ system: - discover the BIG-IP device. - remove the Policy from one of the virtual server. - deploy. No errors in the GUI. 3. BIG-IP device: the ASM policy is still referenced by both virtual servers. This is incorrect. Now you can remove a policy from a virtual server and it will successfully deploy to the BIG-IP device." |
518480 | Web App Security (ASM) | "The following steps resulted in false differences: 1. On a BIG-IP device, create a policy with a user-type parameter. 2. From a BIG-IQ system, discover the BIG-IP device. 3. On the BIG-IQ system in the Web Application Security Policy Editor, change one of the user-defined Parameters to a Value type of ""ignored."" 4. From the BIG-IQ system, deploy back to the BIG-IP device. 5. From the BIG-IQ system, immediately deploy again to the same BIG-IP device. The false differences appeared for the second deployment. Now the second and subsequent deployments show no false differences." |
516476 | Web App Security (ASM) | "The following steps resulted in a discovery error with a NullPointerException in restjavad.log: 1. BIG-IP device (running 11.5.2 HF1): create a custom signature. 2. BIG-IP device: in an ASM policy that is assigned to a virtual server, add the ""All Signatures"" signature set. 3. BIG-IQ system: discover the BIG-IP device. This failure no longer occurs." |
516353 | Web App Security (ASM) | The P8 parameter in a Web Application Security policy accepted Value Meta Characters that were rejected in a later deployment, and caused the deploy operation to fail. This occurred in testing when 0xff was set to "disabled," 0xfe was "enabled," and 0xfe was removed. The GUI now only allows characters that can be accepted during deployment. |
516682 | Web App Security (ASM) | The GUI reported an error if the user tried to change the current policy assignment for a virtual server to a policy that is located on the inactive virtual server. The inactive virtual server is a container that displays all policies on the BIG-IP system that are not currently used on any other virtual server. If the user attempted to move the current assigned policy to the inactive virtual server container, and they were selecting a new policy from the virtual server container, a GUI error appeared. Now this policy assignment is fully supported. |
532649 | Web App Security (ASM) | Previously, a BIG-IQ system upgrade from v 4.5.0 GA release to v 4.5.0 HF2 failed. This only occurred with a particular environment. It does not occur on upgrade to v 4.5.0 HF3. |
518496 | Web App Security (ASM) | Error messages have been improved for the case when a Web Application Security policy cannot be assigned to an HTTP virtual server that does not have an HTTP profile assigned to it. |
531671 | Web App Security (ASM) | Determining which Web Application Security policies are inactive has been addressed through improved online help. |
522975 | Web App Security (ASM) | False differences are no longer displayed for Web Application Security policies with newly assigned virtual servers. |
528506 | Web App Security (ASM) | Race condition during upgrade no longer occurs, so upgrade completes successfully. |
532678 | Web App Security (ASM) | BIG-IQ Web Application Security version 4.5.0 HF1 now successfully discovers ASM on a version 11.5.2 BIG-IP device. |
530625 | Web App Security (ASM) | Attack Signature list table now identifies which signatures are user defined. |
518257 | Web App Security (ASM) | When a Policy's Response Page text was different on the BIG-IQ system than it was on the BIG-IP system, the conflict/difference was correctly identified on discovery or deployment, but the text from the BIG-IP device did not appear in the difference view. Now the BIG-IP device text is fully discovered. |
534798 | Web App Security (ASM) | Adding an attack signature set to a Web Application Security policy, now properly display the plus sign (+) to the right of a signature set. |
513827 | Web App Security (ASM) | When an ASM policy has a File Type that is blocked, and a BIG-IP client attempts to access a file of that type, the BIG-IP virtual server is supposed to send the client an HTML response indicating that the file is blocked. If the policy originated from the BIG-IQ system, the client previously received no response. Now the client receives the correct HTML response page. |
519279 | Web App Security (ASM) | When choosing the Character Sets sub collection of a Web Application Security policy, only the left column of the 2-column display appeared. The Policy Editor no longer has this display error. |
516061 | Web App Security (ASM) | "When deploying from a BIG-IQ system to a BIG-IP device with identical Web Application Security policies, the deployment sometimes failed with an error similar to the following: Failed pushing changed objects to device <device-name>: Could not update the Data Guard 'Data Guard'. fileContentDetectionFormats list must not be empty when fileContentDetection is set Now the deployment of unchanged policies does not fail." |
524413 | Web App Security (ASM) | When you created a new policy on a BIG-IQ system and deployed the new policy to a BIG-IP device, the first deployment was not assigning attack signature sets. Now the BIG-IQ system successfully sends attack signature sets on the first deployment. |
499489 | Web App Security (ASM) | When using a French language web browser to access BIG-IQ Security ASM event logging, words in the date that include accent marks are now displayed correctly. |
495725 | Web App Security (ASM) | Deleted tags in the Web Application Security event log are now removed from the web browser window immediately. |
516576 | Web App Security (ASM) | When you defined new parameters in a policy object and then deployed, certain unchanged attributes of those parameters showed false differences. Specifically, false differences appeared on the checkMaxValue and checkMinValue attributes. False differences no longer appear for those attributes. |
517771 | Web App Security (ASM) | When you created a new policy and included information in every editable section of the policy, then ran the evaluation phase of a deployment, the graphical difference view showed every section of the policy except Data Guard, Character Sets, and the Response Pages. Now the graphical difference view lists the new sections without showing the details for any of them. |
516072 | Web App Security (ASM) | "Previously, when you created a new Web Application Security policy on the BIG-IQ system and deployed it, spurious differences occurred on reimport of the policy. The differences were in the Response Pages section of the policy. These false differences no longer occur." |
517099 | Web App Security (ASM) | When you discovered a BIG-IP device with a virtual server and an attached policy, added data-guard custom patterns and exception patterns to the policy through Web Application Security, deployed the new configuration, and then immediately re-deployed the same configuration, false differences appeared in the second deployment. Both custom patterns and exception patterns showed differences in the GUI. The BIG-IQ system no longer shows those false differences. |
517074 | Web App Security (ASM) | When you discovered a BIG-IP device with a virtual server and an attached policy, added data-guard data to the policy through Web Application Security, deployed the new configuration, and then immediately re-deployed the same configuration, false differences appeared in the second deployment. Now the second deployment succeeds without any differences. |
519636 | Web App Security (ASM) | The correct signature file version is now being queried by the GUI to display correct information. |
524406 | Web App Security (ASM) | A Policy with multiple, simultaneous changes to a list of custom signatures can now be deployed without error. Previously it might have resulted in an the following error: DBD::mysql::db do failed: Deadlock found when trying to get lock |
528088 | Web App Security (ASM) | The Import Policy File feature no longer fails with an erroneous error about character sets. |
Behavior changes
ID Number | Functional Area | Description |
---|---|---|
534473 | ADC | On the ADC device properties screen, Sync Configuration was changed to Reimport and Refresh was changed to Refresh Diff. |
525521 | Device | If you navigate away from the Images properties screen when you are performing a software image upload, the BIG-IQ system continues uploading the software. If you want to cancel the software upload, click the Stop Upload button before exiting the screen. |
532815 | Device | There are new labels on Deployment properties screen for a software upgrade. Name is now referred to as Deployment Name and Install Location is as Target Volume. |
532820 | Device | The Upgrade button now appears in the upgrade legacy properties screen. |
533973 | Device | Instances of the Upgrade Software label and heading now read Install Software. |
534096 | Device | The Options row in the deployment job properties screen is now located at the bottom of the screen. |
534918 | Device | SNMP configuration was moved from the HA Peer Group properties to the localhost properties |
536479 | Device | The option to create a redundant local archive of the backup was removed. This option will likely be re-added when BIG-IQ supports NFS mounts. |
537486 | Device | BIG-IP v11.3.0 is dropped from the list supported by BIG-IQ system. |
554121 | Device | The Create Virtual Device option was removed from the Device panel menu. |
565562 | Device | Starting in version 4.6.0, BIG-IQ supports only active/standby high availability (HA) configurations. To upgrade a previous version of BIG-IQ with a HA configuration, you must first separate the BIG-IQ systems in the HA configuration, delete the peer, upgrade each BIG-IQ system, and set up the active/standby high availability configuration. For more information, refer to the About downloading software, licensing, and upgrading the BIG-IQ system chapter of the BIG-IQ Centralized Management Licensing and Initial Configuration guide. |
551265 | Network Security (AFM) | Cluster name is removed from the device content table due to performance issue. |
520908 | Platform | The disk capacity for the BIG-IQ system was previously 55 GB. Starting in this release, the disk capacity is increased to 95 GB. |
534636 | System | When you perform an upgrade on the BIG-IQ local device, you must select the software image and install volume before you click the Apply button. |
523300 | Web App Security (ASM) | This feature now discovers and displays custom signature sets used in a policy. From the policy editor page, you can assign signature sets to a policy. They should be discovered and deployed to other devices if the policy is applied to a different device. |
523297 | Web App Security (ASM) | This feature adds 1. New pages into the Web App Sec Policy Editor 2. It updates discovery and new items are added to both current config and working config 3. Requires you rediscover devices so the new data is imported. 4. Snapshots and differences use the new data and show differences when they exist. 5. Any changes to the learn/alarm/block are deployed to devices. |
523302 | Web App Security (ASM) | This release supports importing and deploying of custom (user defined) signatures. |
Known issues
Issue | Functional Area | Description | Workaround (if available) |
---|---|---|---|
522520 | ADC | ADC UI is very slow The issue prevents normal operation and administration through the GUI. Multiple stale DMA tasks | |
530234 | ADC | BIG-IQ can no longer communicate with the device. The device is marked unhealthy and unavailable for management. The device will be marked unhealthy and BIG-IQ cannot interact with it. "- The device is added in multiple groups - The device is removed from the first group it was added into" | "The device can either be: - ""Rediscovered"" using the username and password - Deleted and discovered again using username and password" |
497380 | ADC | Some LTM objects are not available on BIG-IQ device after discovering multiple BIG-IP systems in ADC. Expected LTM objects are not available. This might occur when adding or removing multiple devices in quick succession. To ensure data integrity, the system prevents a discovery task if there is one already running, so if the add or remove operations occur too quickly, the discovery operation might not produce the expected results. | Delete all BIG-IP systems and rediscover one by one, waiting in between discoveries until all expected LTM objects show up. |
496706 | ADC | When a node or pool member has been forced offline, if you enable or disable the object from the BIG-IQ device, the monitoring capability for that object is disabled. Loss of monitoring for the node or pool member. Node or pool member has been forced offline and then enabled or disabled from the BIG-IQ device. | There are two options for dealing with this issue. If the forced offline object has already been enabled/disabled using the BIG-IQ device, then you must use the BIG-IP system to force the object offline and then reset the object's enabled/disabled state. This restores monitoring of the object. If the forced offline object is not yet enabled/disabled, you can use an REST API call from the BIG-IQ system. To enable the pool member that has been forced offline via a BIG-IQ device, |
557892 | ADC | When modifying the Virtual Server properties in BIG-IQ ADC Internet Explorer (IE) 11 does not properly display the iRules. The top iRule is not correctly rendered and may not show on the list of active iRules. Customer may have trouble view the iRule associated with the Virtual Server. Using IE 11. | Use a different supported browser or version of IE. |
475579 | Device | After you revoke a BIG-IP device's pool or utility license, the BIG-IP device might be unable to load its configuration. The BIG-IP is inoperative This occurs only with a BIG-IP device configured with licensing-dependent features using. | To work around this issue, restore the BIG-IP device's saved UCS file. |
456211 | Device | BIG-IQ Device does not allow you to use a license pool after reactivation. User will need to open a support case to work with PD to get the license pool active again. If you attempt to re-activate a license pool and re-activation fails for any reason (network connectivity, system error, so forth), you can no longer use that license pool to grant licenses to managed BIG-IP devices. | To resolve this issue, contact F5 support to re-activate the license. |
497002 | Device | BIG-IQ device might report a duplicate item error. This can happen when you discover a BIG-IP device from BIG-IQ Security and then later attempt to discover that same BIG-IP device from BIG-IQ Device, | To work around this issue, discover the BIG-IP device again from BIG-IQ Security and then again from BIG-IQ Device. |
469543 | Device | BIG-IQ Device returns an error when you attempt to activate a Utility License. Utility License cannot be used until F5 Support is contacted and allows the Utility License to be activated. This occurs when you with incorrectly use a Pool License registration key to activate a Utility License. | You cannot use the Pool License and Utility License interfaces interchangeably. To resolve this issue, contact F5 Support to activate the Utility License. |
516659 | Device | BIG-IQ does not run a backup job on the configured end date. For example if the schedule is 'Daily' and the 'End Date' is 4/19/2015, the last run of the job will be on 4/18/2015. Backup schedule does not execute a backup job. This occurs when there is an End Date specified for a backup job. | Specify an End Date one day past the day when you want to run the last backup. For example, For a Daily backup schedule, specify an 'End Date' of 4/20/2015 to have the last run of the job on 4/19/2015. |
490976 | Device | Deploying a configuration template to a BIG-IP device occasionally fails and the BIG-IQ system returns a JSON configuration error. Template deployment will fail partway through the process. Earlier items will be applied, while the failing item and later items will not be. This problem can occur when the target BIG-IP device is an older version (in this case, 11.5) that does not support a particular object attribute in the configuration template. | "If the error occurred because the configuration template includes a BIG-IP object attribute that does not exist in the targeted BIG-IP version, you may be able to work around the issue by editing the template through the REST API and removing the incompatible field. You cannot perform this change from the user interface. Note that the template API is not a supported API and is subject to change or removal without notice. Templates are stored in a collection at the path /mgmt/cm/autodeploy/simple-templates. To make this change, perform a GET to retrieve the current state, edit that state, then perform a PUT or PATCH to apply the updated state. You need to edit only the content field." |
516795 | Device | If you create a backup, set its time, and on the next day, reset its time again, the job might not run if the Enable check box is not selected. | To fix this issue, select the Enable check box before you save the backup. |
450658 | Device | "If you deploy a job to perform a ""Factory Install"" to a physical BIG-IP device, and specify configuration files to deploy as part of that job, the job might fail unexpectedly and display the following message in the log file: /var/log/restjavad.0.log on the target machine: com.f5.rest.workers.autodeploy.ConfigInstallTaskWorker$ProcessTaskException: Failed to run command: [tmsh, -a, load, sys, config] Followed by several lines that appear similar to: 01070605:3: Cannot delete IP 10.10.0.1 because it would leave a pool member (pool /Common/Pool34-b) unreachable." The deployment job fails. This happens if the BIG-IQ device used a self-IP address when it discovered the BIG-IP device and the configuration you are installing on the BIG-IP includes the same self-IP address as the discovery self-IP without the IPv4 address (e.g. "10.20.0.5"). | "To avoid this, the name field of the self-IP must equate to the address field (excluding the netmask). For example, if the address field is ""1.2.3.4/15"", the name field must be ""1.2.3.4"". If the job failed due to this issue, you can complete the job by running the command ""tmsh load sys config"" on the target BIG-IP device." |
558102 | Device | BIG-IQ Device Images and Config Templates panels do not display online help | |
497555 | Device | Performing self restore on BIG-IQ does not report restore status correctly. Instead of showing the end result states, either backup finished or backup failed, Make backup state is reported. Customer can't restore BIG-IQ to the same backup more than once. Perform a local restore on BIG-IQ does not report restore status correctly. | None |
514164 | Device | The BIG-IQ system does not check storage availability before it downloads a UCS backup file. This could cause the BIG-IQ system to use all the storage when creating a backup. All storage space is consumed. | To avoid this issue, configure an alert condition for the /shared/ucs_backups file so you are notified when storage is reaching a specific threshold. The alert conditions are set from the BIG-IQ Systems group > Properties > Alert Conditions screen. If this issue occurs, delete any unneeded backups, and re-create the backup. |
501508 | Device | The BIG-IQ system file upload operations (such as importing devices or uploading software images) do not work. This happens if you use Internet Explorer 9 to upload files because Internet Explorer versions prior to 10 do not contain the HTML5 file API requires to upload files to a BIG-IQ system. | To work around this issue, use Microsoft Internet Explorer version 10 or later. Alternatively, use Mozilla Firefox version 29.x and later, or Google Chrome version 34.x and later. |
547371 | Device | The BIG-IQ system identifies itself as "localhost.localdomain" when connecting to SMTP Server instead of its FQDN or IP address. This violates the SMTP standard. | By default, Java uses the first hostname it find in the /etc/hosts file. To work around this issue, change the order of hostnames in /etc/hosts file. You must do this any time you reboot the BIG-IQ system. |
557194 | Device | The Certificate panel does not display if you are logged in as the Device Manager role. 'Certificate' blade is missing. User logged in 'Device Manager' role. | |
509028 | Device | The F5 HNV Gateway Provider Plugin cannot apply updates to the remaining devices in the cluster. This occurs when a BIG-IP Device Cluster is used with the F5 HNV Gateway Provider Plugin, and one device is unavailable. | |
524798 | Device | Unable to automatically reactivate the license for a replacement BIG-IQ system (RMA) after you restore the UCS file. Must manually activate the license. Automatic license reactivation for a replacement BIG-IQ system. | To work around this issue, manually activate the license by logging into the replacement BIG-IQ system, getting the base-registration key for the license, calling F5 support and asking them to set allow_move variable on the license. Then re-activate the license, and set the hostname, and restore the UCS backup. |
508303 | Device | vCMP guests can become unresponsive when the BIG-IQ system is creating simultaneous backups of all the vCMP guests. Guests might failover, if the device targeted for failover is on the same host the problem will become worse because the net load on the host has increased due to failover. If vCMP guests are already working at high capacity and BIG-IQ starts creating simultaneous backups on guests that share a host, it causes the overall load on the host to rise and the guests to become unresponsive. | To avoid this issue, make sure that guests within the same host are not on the same backup schedule. |
472377 | Device | "When manually activating a pool registration key with two or more offering licenses, BIG-IQ does not verify the license matches the offering SKU. For example, if you mean to activate offering SKU for ""X"" and paste the license into BIG-IQ where offering SKU ""Y"" is expected, BIG-IQ does not detect the discrepancy. If this occurs, and you deploy that license to a BIG-IP device, BIG-IQ Device applies the incorrect license and the BIG-IP device might not have the expected features enabled." If you paste the incorrect license text into BIG-IQ Device for an offering SKU License, on license grant, BIG-IP will get the incorrect license, and may not have the features expected enabled as desired. This issue applies to CLP registration keys and Virtual Edition Volume License registration keys. | "If this occurs in your environment, re-active the pool registration key, taking care to paste the correct license text for each offering SKU license." |
428383 | Device | When you use the search field to filter for a number or phrase associated with a particular BIG-IP device, you may get some unexpected results. This occurs because BIG-IQ Device filters on all fields, not just those displayed in the Devices panel. | |
474742 | Device | While running a Deployment Job to perform a Factory Install, the job might fail to re-discover the target device, causing the job to time out with the following message: "Attempting preliminary device configuration", "Attempting to re-discover device", and "Rediscovering device failed, retrying". The message "Rediscovery failed in job <job ID>, will retry" may periodically be logged in /var/log/restjavad.0.log on the BIG-IQ. It's also possible in some cases for the job's message field to simply report "Attempting to re-discover device" until the job times out. Deployment jobs for a factory install on older BIG-IP software version will not complete. This leaves the target device unconfigured and potentially unreachable over its management interface when its DHCP lease expires, because the deployment job is unable to disable DHCP on the management interface. This occurs because the discovery process requires updating the version of the REST framework on the target device. Currently Deployment If the BIG-IQ system cannot update the framework, discovery fails. When discovery fails, the BIG-IQ system retries discovery until the job times out. | To work around this issue, select the Update Framework check box for this device and re-run the deployment job. |
556610 | Device | You cannot select an end date for a scheduled backup using an Internet Explorer (IE) browser versions 9, 10, or 11. Cannot schedule a backup with end date. Select an End Date to schedule a backup on IE browser versions 9, 10, or 11. | Use a different browser, such as Chrome or Firefox, or another version of the IE browser. Or if using IE browser versions 9, 10, or 11, do not specify an end date. |
449472 | Network Security (AFM) | BIG-IQ UI offers users an option (check box) during discovery to auto-update framework on newly discovered device. Due to missing credentials, this feature does not work with BIG-IP versions 11.3.0/11.4.x. | Manually upgrade the framework using the update_bigip.sh script. |
414301 | Network Security (AFM) | Configuration collision errors, requiring manual intervention, can occur. It is also possible to revert collision resolution actions taken during a previous discovery task. | "Options for manual rollback and for restoring earlier configurations to the BIG-IQ environment include the following: - Remove a discovered device, which removes the firewalls and any objects referenced by that device. - If the conflict was resolved by KEEP BOTH, there may be nothing more to do other than to rediscover the device. - If the conflict was resolved by USE BIG-IQ VERSION, discover the device again and make any new conflict resolutions at that time. - If the conflict was resolved by USE BIG-IP VERSION, click the Evaluate button on the Deploy Changes panel to see if there were any changes to existing devices in the BIG-IQ configuration. If so, reimport those devices that show changes and select USE BIG-IP VERSION to resolve conflicts. After each new discovery, use the Evaluate process to verify changes. - Remove and rediscover any devices that showed changes." |
474135 | Network Security (AFM) | Deployment occasionally fails during distribution with the error: There is no transaction created for this user. Deployment might fail and post an error message. This failure is rare and is related to timeouts experienced for large configuration changes and devices under heavy load. | Once deployment to a specific device fails, retry the deployment operation on the same device. |
542905 | Network Security (AFM) | Deployment of the changes to route domains fails because the system cannot find the virtual server to be removed. | Reimport of BIG-IP devices in BIG-IQ Web Application Security (ASM) updates only ASM and shared security with latest BIG-IP configuration. It does not update the BIG-IQ Network Security (AFM) module. Therefore, if you are using both AFM and ASM, you must reimport both modules. |
416665 | Network Security (AFM) | Device discovery fails if an address-list includes an ipv6 any (::) address with a mask. Such as ::/104 or ::/25 This will block all address-lists from being discovered. | "Upgrade the BIG-IP device being discovered to 11.3.0 HF6, an engineering hot fix, or version 11.4 or higher. Alternatively, you can remove the address list that is causing the problem." |
558717 | Network Security (AFM) | Discovery of a version 12.0 BIG-IP device fails when that device contains a virtual server that has an iRule. DMA fails. iRules is assigned to the vip. | Remove the iRule from the virtual server on the version 12.0 BIG-IP device and then discover the BIG-IP device again. |
424326 | Network Security (AFM) | Discovery of shared objects contained in folders is not supported in BIG-IQ Security. | |
450117 | Network Security (AFM) | "During initial HA setup, configuration settings for the audit logger archive are copied from the Active system to the Standby system. After HA setup, any changes made on the Active system are not synced to the Standby system." | Log in to the Standby system and update the Audit Logger configuration manually. |
556247 | Network Security (AFM) | During network fault conditions and for a transient period of time, the BIG-IQ may fail to return status for a BIG-IP in a rule compilation check. Current status of the BIG-IP may not be clear to the customer. | If no status is returned for a BIG-IP in a rule compilation check, immediately check the network connectivity to the BIG-IP, and check the state of the BIG-IP. Once the network fault condition settles, a subsequent rule compilation check should return a status. |
459888 | Network Security (AFM) | "For example, assume you have a non-default partition with a default route domain setting of something other than zero and /partitionA has a default route domain of 5. If, from the BIG-IQ system, you assign an IP address to any firewall in /partitionA without specifying the route domain (such as 192.168.25.4), and then deploy the firewall to the BIG-IP system, the BIG-IP system assigns the default route domain (5) to the IP address. The firewall on the BIG-IQ system is still shown as 192.168.25.4, while on the BIG-IP system it is 192.168.25.4%5. The address is clear on the BIG-IP system (192.168.25.4%5), but it is less clear on the BIG-IQ system where the route domain is omitted." | You can ignore the IP-address settings in the BIG-IQ system. They are benign. |
484161 | Network Security (AFM) | "If you create a virtual server on a BIG-IQ Security system that uses the UDP protocol, and has UDP selected in the client profile and server profile, that virtual server will signal an error and fail to deploy. BIG-IQ Security does not support the assignment of SSL profiles needed to support the UDP protocol." | |
557774 | Network Security (AFM) | "If you enable and modify the default values for the Bot Signatures or Bot Signature Categories settings on a version 12.0 BIG-IP device, and then attempt to discover that BIG-IP device using a BIG-IQ system, the discovery will fail because the BIG-IQ DoS Profile only supports the default values for these parameters. Additionally, if you configure a new Bot Signature category and use the category to create a bot signature list, the Action must be set to a value of None. If the Action is set to a value of Block or Report, discovery of the BIG-IP device will fail even if Bot Signatures are disabled on the BIG-IP device in the DoS profile." | Do not enable and modify the default values for the Bot Signatures or Bot Signature Categories settings on a version 12 BIG-IP device and then attempt to discover that device using a BIG-IQ system. |
473463 | Network Security (AFM) | If you remove the standby BIG-IQ Security configured in a high availability cluster, BIG-IQ Security displays 404 errors. | You can reset BIG-IQ Security to the factory settings by logging in to the BIG-IQ Security command line and typing the following commands: 1) bigstart stop restjavad 2) rm -rf /var/config/rest/storage; rm -rf /var/config/rest/index; 3) bigstart start restjavad |
446796 | Network Security (AFM) | In a BIG-IQ HA environment, the primary node is responsible for running tasks. If a task is running on the primary node and that node fails, the secondary node takes over. However, the pending tasks remain (in a pending state) and are not removed until the primary node recovers. | |
541254 | Network Security (AFM) | "It is a known issue that changing the 'Days to keep entries' or the 'Check expiration at this time' values (under Settings) while an Audit Log archive and deletion operation is currently underway will result in that operation stopping. The next operation will start at the specified time. This can occur if you change the Audit Log Settings for the AFM or ASM Audit Logs." The impact is that Audit Log entries will stop being removed from storage and the archive to the /var/config/rest/auditArchive directory will stop. You will see an Audit Log archive/delete operation stop if you change the Audit Log Settings mid-operation. | "You can wait for the next archive/delete operation to occur. Or you can specify a new time 1 day from the current time, if you want the archive to happen as soon as possible. You cannot force the archive/delete operation to happen within the next 24 hours. It will occur, at the earliest, exactly 24 hours from the current time. To set the new time so that the Audit Log archive/delete will occur 1 day from the current time, select the Audit Log Settings button and enter 1 for 'Days to keep entries'. Then set the 'Check expiration at this time' to the current hour and current minute. Finally, add one additional minute before selecting the Save button." |
478963 | Network Security (AFM) | "Only route-domain 0 can have VLANs from other partitions. All other route-domains should have their assigned VLAN from the same partition." | |
474651 | Network Security (AFM) | The BIG-IQ system user interface continually shows the Identifying device dialog box and never transitions to downloading firewall configuration data. Looking at the REST framework versions on the BIG-IP device, they appear to have been deployed successfully. Issuing a curl command or browsing to https://<BIG-IP>/mgmt/shared/echo shows that the REST service is responding as expected. | Cancel the currently running discovery task and discover the device again. On the second discovery attempt, the Update Framework check box should remain unselected. |
426774 | Network Security (AFM) | "The error message ""HA Firewalls in device 10.1.1.1 do not match those in peer device 10.1.1.2"" is issued when there is a mismatch between firewalls. This error message is not very specific about the types and names of the firewalls. Providing this information would aid the user in correcting the error." | |
473034 | Network Security (AFM) | The hostname of a BIG-IP system is not valid in the search field for Network Security Deployments. | Search for a device by its IP address, and then show its related items. |
476209 | Network Security (AFM) | The Network Security's Overview page contains three blades: Devices, Deployment, and Snapshots. In the Properties for each object in each blade, you can use the "Show Only Related Objects" feature. Any interactions with the Devices blade are not accurate. This feature only produces accurate results when determining which snapshots are related to which deployment, and the reverse. | |
522260 | Network Security (AFM) | "The websecurity profile from the virtual server is not removed if http profile is removed, the user will get an error as ""01070734:3: Configuration error: /Common/vs-ghoomar-1: Web Security profile requires an HTTP profile to be associated with the virtual server"" on BIG-IP if he tries to remove http profile from virtual server with websecurity profile still configured. On BIG-IQ, the websecurity profile is not removed even though http profile is allowed to be removed with websecurity profile still configured on virtual server. There is no error/warning displayed to user." Cannot redeploy after the above changes. "The BIG-IP has the following settings: Virtual server has HTTP profile, and has ASM policy. BIG-IQ discovered this virtual server. From BIG-IQ, edited the virtual server in shared security to change its profile from http Profile to DNS Profile. Deployment was attempted from network security module." | "In BIG-IQ 4.5.0 HF2: The virtual server that has been once used for web application security may not be used for other purposes as the profiles enabled on the virtual server currently cannot be modified on BIG-IP or on BIG-IQ by the user explicitly. The only way to make it usable for other purposes is to remove ASM policy and deploy it back to BIG-IP. The http profile can be removed thereafter." |
423694 | Network Security (AFM) | This address list is accepted on BIG-IP devices (running 11.4.1) but not in BIG-IQ systems. | |
436432 | Network Security (AFM) | "This issue is limited to the BIG-IP device being discovered via a link local ipv6 address (any address that starts with fe80). Link locals have special behavior and are not supported on many utilities so this may not be a good use case. To recognize link local ipv6 addresses, enter an ""ifconfig"" command on the BIG-IP system and note the ""Scope:Link"" following the fe80* address). To avoid link local ipv6 addresses, configure the item being discovered, either a self-ip or a mgmt-ip, on the BIG-IP as Scope:Global.</p><p>Using link local addresses correctly can be problematic. For correct link local address setup, consult the following solution: http://support.f5.com/kb/en-us/solutions/public/9000/000/sol9067.html" The impact of using a link local address may prevent discovery of the BIG-IP device. | To work around this issue, create a "Scope:Global" self-IP address or mgmt-ip, whichever is to be discovered. You can create the self-IP address on the BIG-IP GUI. You can configure the mgmt-IP address by running the "config" command on the BIG-IP device |
553921 | Network Security (AFM) | Under certain conditions when the BIG-IQ system discovers a BIG-IP device, that discovery can fail and leave that BIG-IP device in an incompletely discovered state. | "If needed, identify the incompletely discovered BIG-IP device -- such as by reviewing the audit log -- and then remove it manually from the BIG-IQ system. Reimport the BIG-IP device to ensure that it is completely and successfully discovered." |
556264 | Network Security (AFM) | Users have experienced significant delay when accessing address lists and port lists. | |
552765 | Network Security (AFM) | Users have observed high CPU usage after a recent upgrade of a managed BIG-IP device. Slowness during discovery followed by temporary high CPU usage. This problem is triggered when an older REST framework gets installed as part of the BIG-IP upgrade. | "If the identified BIG-IP has been recently upgraded, make sure that correct |
489436 | Network Security (AFM) | "When a self IP that contains a tunnel is deployed, and that tunnel was defined on the BIG-IP device with an encapsulation type of tcp-forward or ppp, that deployment fails because those types are not supported by BIG-IQ Security. The error appears similar to the following: Failed submitting iControl REST transaction 1415382609058546: transaction failed:0107032e:3: PPP tunnel (/Common/socks-tunnel) cannot be assigned a Self IP." Deployment fails. BIG-IP tunnels have a property called "Encapsulation type". Some encapsulations (e.g. PPP) are not compatible with SelfIP. When tunnels with such encapsulations assigned to Self-IP on BIG-IQ UI, no error is generated. However, deployment fails. | Do not deploy BIG-IQ Security self IPs that contain tunnels with an encapsulation type of tcp-forward or ppp, since those types are not supported. |
555304 | Network Security (AFM) | When a user selects items for an operation in the Network Security Policy Editor, such as a deletion, those selections will be cleared if the user or the system refreshes that page. User will have re-select items for operation after page refresh. Issue seen anytime user refreshes page with selected items, or when system refreshes page. For example, system will refresh page if another user is on the same page, and deletes an item on that page. Any other user logged into that same page will see a system refresh to keep page current. | Avoid manually refreshing a page with selections on it or having multiple users updating the same page at the same time. |
476752 | Network Security (AFM) | When expanding the context section of the object editor, a locked context will not show a lock, even though it is locked. To determine if a context is locked, select the context, and the lock will appear if it is locked. Alternatively, right click on a lock icon on some other object and select 'view all locks'. Requires the administrator to take extra steps to determine a locked context. | |
556516 | Network Security (AFM) | When performing a search using the Exact keyword in the Network Security Policy Editor, the search is not case sensitive. | |
555149 | Network Security (AFM) | When using "Filter 'related to'" for a device, you must initiate the search from the "Devices" menu or the "Firewall Group" menu. Other device groups do not show correct results. | Initiate the search from the "Devices" menu or the "Firewall Group" menu. |
474178 | Network Security (AFM) | When using Internet Explorer 9 and accessing Network Security Overview, Drag and Drop between panels and forms will not work. User should click on the link to invoke the picker. | |
556152 | Network Security (AFM) | When using the Network Security Policy Editor, expanding all rule lists when there are a large number of rules lists can cause the Web browser to become unresponsive. | "If the Web browser hangs, close the browser and then restart it. Do not expand all rule lists when working with a very large number (900+) of address-lists in a policy." |
540492 | Network Security (AFM) | When viewed from some laptops, the screen resolution does not allow the config and refresh buttons to be seen or pressed. Buttons can't be pressed. This is when viewed from a laptop with a screen resolution of 1440 x 900. | Use the Web browser to zoom in to view and use the buttons. |
553761 | Network Security (AFM) | "With large configurations and large numbers of BIG-IP devices under management, performance issues have become visible when performing searches in the global navigation filter. Although a solution has been developed, there is a restriction for searching in contexts. Search does not search through rules in contexts, only in policies in contexts. Therefore, search does find items in any BIG-IP device running a version that supports inline rules in all contexts. Search also does not find items in management firewall contexts that contain only inline rules for all BIG-IP versions." | |
551729 | Platform | 'Users' blade constantly spinning with no users getting populated. 'Users' blade constantly spinning with no users getting populated. LDAP/Radius auth provider + missing username | "1. Identify the provider: |
556553 | Platform | After adding a VLAN and Self-IP to a previously discovered BIG-IP on VIPRION, the new VLAN/Self-IP are not read by BIG-IQ, even after rediscovery. The change in VIPRION networking configure does not update BIG-IQ automatically | Click the Refresh button on the device properties flyout (next to the Network Config option) will sync networking configuration. |
553670 | Platform | After promoting the peer device to primary in a BIG-IQ HA setup, the UI of the new primary system may come back and be accessible before all entries in the blades are populated. A finite amount of time may be needed to populate the yet to be filled in data. | A browser refresh may expedite recovery. |
449063 | Platform | After upgrading or restarting a BIG-IQ system, the log in screen displays a message that your user credentials are invalid and the system does not allow you to log in. User cannot log in to the BIG-IQ system. During the startup sequence, the BIG-IQ web application is responding to requests before it can appropriately validate user credentials. | Clear the browser cache and refresh. (You may have to refresh several times.) When the log in screen properly displays the host name of the BIG-IQ system, you can successfully log in. |
481360 | Platform | An erroneous warning icon with a 'Device is not available' error might appear in either the BIG-IQ Device or BIG-IQ Security areas for managed BIG-IP devices even though the BIG-IQ system can reach those devices. The system posts the erroneous error message that the device is not available. However, you can still reach the system via HTTPs and SSH. There is no functional issue with the BIG-IP system. The actual issue is that the BIG-IQ fails to provide the correct status. The specific conditions under which this occurs are not easily reproducible. | None. |
417327 | Platform | BIG-IQ can no longer manage a device. The original BIG-IQ will lose connectivity with the device and no longer be able to perform any operations on it. If a user adds a device to a BIG-IQ Security configuration and then later, adds this same device to a different BIG-IQ configuration, the original BIG-IQ system loses connectivity with the device and cannot perform any operations on it. | Don't try to add a device to multiple BIG-IQ systems. Instead, delete the device on all BIG-IQ systems and rediscover the device only on the BIG-IQ system where you want the device managed. |
486335 | Platform | Device discovery fails with a "Failed to establish trust" error message. Device discovery is not possible until the REST framework is downgraded on the BIG-IP. This happens when the REST Framework on the BIG-IP device is newer than the REST Framework on the BIG-IQ system. | "To avoid this issue, take one of the following actions: ()From the BIG-IP system: Remove the framework RPMs and retry discovery from the BIG-IQ system, specifying to upgrade the framework on discovery. Warning: Do not perform the following procedure on BIG-IP devices running version 12.0.0. ()From the BIG-IQ system: Force the REST framework downgrade using the /lib/dco/packages/upd-adc/update_bigip.sh script with the -f argument to force the install of the framework." |
520171 | Platform | Discovery can fail with the below "Connection Refused" error from SSH. Discovery where Framework Upgrade is done via Root/SSH method from the BIG-IQ GUI. | Sync the date and time of the source and target machines, and retry the operation. |
524616 | Platform | For very long backup names, the Restore, Save, Delete, and Cancel buttons may be hidden on the Backup properties screen. Unable to Restore, Save, or Delete backups. | Expand the size of the Backups screen by clicking and dragging the edges of the screen. |
557847 | Platform | If secondary BIG-IQ systems crashed during the initial Active-Standby HA setup, the secondary may end up in HA Error state on restart. You must close the HA cluster by removing the peer BIG-IQ system, and then recreate the Active-Standby HA again. Active/Standby HA fails to setup. Secondary crashed after the initial Active/Standby HA setup. | After setting up Active-Standby HA, an admin should verify that the secondary is in a good state (no HA Error) on restart. |
513613 | Platform | If someone makes a modification to the certificate information on a managed device (for example, changing the certificate's canonical name), that device becomes unavailable to the BIG-IQ system managing it. Functional, performance degradation. Any attempt to communicate with the BIG-IP device fails until restjavad is restarted on the BIG-IQ device. However, even after the restjavad restart, although BIG-IQ-to-BIG-IP device communication is restored, subsequent changes to the certificate will again disrupt communication. BIG-IQ 4.5 managing BIG-IP devices whose device certificates change. | "There are two workarounds for this situation. The first (A) is the recommended |
557915 | Platform | If the secondary BIG-IQ is in HA Error state, an admin can promote the secondary to be the new primary. User does not know which BIG-IQ has the correct data once both primary and secondary end up in HA Error state. An admin promotes a secondary while secondary is in HA Error state. | In an Active-Standby HA, ensure that both BIG-IQ systems are in a good state before promoting the secondary to be the new primary. |
468310 | Platform | If you configure a user with multiple attributes on the RADIUS server (such as Class <value>), the BIG-IQ system returns an error when that user attempts to log in. "The login will be denied: ""multiple attributes of requested type 25""" | To resolve this issue, edit the configuration file on the RADIUS server so the user has only a single instance of each specific attribute name. |
516649 | Platform | It has been seen that after an upgrade to one of the interim hotfix builds, one of the BIG-IP devices failed deployment with an auth token failure. The device needed to be removed from the ASM module and then rediscovered. This issue is being investigated. It is recommended that after the upgrade to this hotfix build that the devices be removed and then re-added to clear the previous false differences that were reported. | |
521513 | Platform | On a BIG-IQ HA setup with two devices, when you go to create a backup from the backup blade and look at the Devices box, it only shows one device in the HA-Peer group. The other device is there but cannot be seen and there are no scroll bars. This gives the impression that there are no more devices. | You can click in this box and use your arrow keys to scroll down |
521867 | Platform | Software upgrade fails with "create_ucs failed; No such file or directory" error. The BIG-IQ configuration is not loaded on the upgraded boot location and the software upgrade is marked as failed. The /shared partition has a limited amount of free disk space. The amount of free space required will vary based on the configuration on the BIG-IQ, but the amount required should be approximately double the size of the /var/config/rest directory. | To avoid this issue, /shared needs to have additional free space. This can be accomplished by deleting files from the /shared disk partition or extending the disk partition to be larger (procedure described in SOL14952) |
485346 | Platform | The BIG-IQ system user interface might freeze and not allow you to view the log in screen. This issue can prevent the user from accessing BIG-IQ entirely using Firefox. This issue is intermittent and can happen when using Mozilla Firefox 33. | In Mozilla Firefox, open a new tab and in to the browser bar, type "about:support", then click the "Reset Firefox..." button. Alternatively, use Google Chrome version 34.x or later to access the BIG-IQ system. |
555694 | Platform | The view that shows the differences between "On BIG-IP" and "On BIG-IQ" in conflict resolution does not provide horizontal scroll bars. | However, you can scroll by selecting the text and sliding the mouse left or right. |
545130 | Platform | This issue is because the ssl certificates from the system when the UCS backup was executed are different (out of date) from the ssl certificates in use with the software on which the UCS restore is executed. The new certificates get overwritten with the backed-up certificates, cause the HA cluster to break. HA cluster down | Re-establish HA cluster. |
550394 | Platform | When a HA sync is performed, the storage from the primary will overwrite the storage on the secondary. This causes any active sessions to terminate on the secondary because the auth tokens are overwritten. Minimal. Users should not be using the secondary because any changes made on the secondary will be overwritten on the next sync. | Log back into secondary. |
499273 | Platform | When managing a large number (dozens to hundreds) of devices, you might notice the memory utilization for the BIG-IQ system is high and reports OutOfMemory exceptions in /var/log/restjavad.*.log or /var/tmp/restjavad.out file. If restjavad is indeed leaking socket connections then it will eventually run out of file descriptors and/or report OutOfMemory exceptions in /var/log/restjavad.*.log or /var/tmp/restjavad.out. "BIG-IQ restjavad is expiring outbound REST operations that haven't completed after 60 seconds. This can occur when a managed BIG-IP is unresponsive or there are network communication problems. Shell command shows sockets that are not being closed over time: lsof -p <restjavad PID>" | "If you cannot communicate with the managed BIG-IP devices, attempt to fix any network communication problems by pinging or routing the BIG-IP device from the BIG-IQ system, and then restart the restjavad process on the BIG-IQ system by typing the following command: # bigstart restart restjavad" |
497373 | Platform | When the BIG-IQ system discovers or re-discovers a multi-slot VIPRION device, it prompts the device to upgrade its framework, regardless of its current version. Framework upgrade is triggered. This happens with any framework revision present on the VIPRION device. All multi-active-slot devices are affected. | Always allow discovery to upgrade the framework, even in cases where it seems unnecessary. You can only discover devices with multiple active slots through the command line. The BIG-IQ system cannot validate the existing framework revision with this technique. |
435629 | Platform | "When two BIG-IQ 7000 Platform devices are configured in a high availability pair, communication might work in only one direction between the two devices. When this occurs, Device A is marked as standby, and reports its peer as active. Device B is marked as active, and reports its peer as down. When this happens, Device B always assumes Device A is down, and always remains active." High availability will not function correctly. Device B will always assume Device A is down, so it will always remain Active. | "To work around this issue, re-initialize the certificates. Alternatively, if resetting the configuration to factory settings is an option, type the following commands on each BIG-IQ system: bigstart stop restjavad; rm -rf /shared/em/ssl.crt/*.*; rm -rf /shared/em/ssl.key/*.*; rm -rf /var/config/rest/storage; rm -rf /var/config/rest/index/; bigstart start restjavad . If resetting the configuration is not an option, perform the following steps on each device: 1) On the High Availability panel, delete the HA peer and any associated devices. |
494567 | Platform | When you upgrade a BIG-IQ system, the analytic indexes from /var/config/rest/analytics are not copied to a new volume. Only affects upgrades | "Perform the following steps each time you apply an upgrade to a new volume: 1) On a volume running the previous version of BIG-IQ, verify the backup script is executable from |
431398 | Platform | While booting, the BIG-IQ system might display the following warning in the console or logs: "SKIPPING unix_config_httpd: /defaults/config/templates/xui.tmpl doesn't exist!!!" None. On boot. | This message has no impact on the BIG-IQ system's functionality. You can ignore this benign message. |
475095 | Platform | While discovering a BIG-IP device running version 11.3.x or 11.4.x with a BIG-IQ system running version 4.2 or later, the process might fail with the error message "You must update the device's framework before you can manage it". Discovery of said BIG-IP will fail with error message "You must update the device's framework before you can manage it". This can happen if the BIG-IP device has new REST framework, because it is running version 11.5.0+ or the BIG-IQ system re-images the BIG-IP device to version 11.3.x or 11.4.x. | To work around this issue, delete the file /config/f5-rest-device-id from the BIG-IP device, discover the device again, select the "Auto Update Framework" check box, and provide the admin and root credentials. |
528253 | Platform | Without the Roles panel, the non-admin user cannot determine their administrative-role assignments. | |
474096 | Platform | You cannot access the BIG-IQ system user interface using Mozilla Firefox version 31 or later. BIG-IQ GUI becomes inaccessible with Firefox 31 or greater | "This issue is caused because of security changes in Firefox. You can view more specific information here: https://blog.mozilla.org/security/2014/04/24/exciting-updates-to-certificate-verification-in-gecko/ This workaround has security implications. 1) Type about:config in the navigation bar of the Firefox browser. 2) Double-click the ""security.use mozillapix verification"" to set it to false. Alternatively, use Chrome or Internet Explorer to access the BIG-IQ system." |
434930 | Platform | You cannot use a hostname to add a device. Cannot use hostnames for adding devices. | When you discover a new device, you must use its IP address. |
496091 | Platform | You might not be able to click-to-provision a BIG-IP VE machine on an ESXi host if there is a time stamp issue on the ESXi host. The BIG-IP VE will not be fully provisioned. | "To determine if this is a time issue, view the BIG-IQ system /var/log/restjavad.0.log file and look for something similar to the following line: Illegal state, startTime is before oldStartTime: startTime=Wed Dec 10 22:10:27 GMT 2014; oldStartTime=Wed Dec 10 22:25:41 GMT 2014. To resolve this issue, refer to the VMWare ESXi documentation to set the NTP server or fix the NTP issue and then restart the click-to-provision VE process." |
526684 | Platform | "[I][0][04 Jun 2015 06:32:21 UTC][com.f5.rest.common.WellKnownPorts][setMachineId] machineId set to 10f97dc6-b31c-4e31-8687-66288f92a1a1 |
"Manually remove lucene jars using the below process, |
575296 | Platform | After adding a new network interface, it doesn't appear in the BIG-IQ. This occurs on VE platforms. Cannot use BIG-IQ to manage the new network interface. | Make an API call to refresh the configuration in BIG-IQ. 1. Identify the BIG-IQ device reference. |
514694 | System | Forms containing usernames and passwords in a Mozilla Firefox browser might not function as expected. The values for username and password display, but you cannot click the button to submit. The user may not understand why the form cannot be submitted. This would occur only in the Firefox browser, and only if the "remember passwords for sites" feature is enabled. It may also occur if the user has installed a 3rd party password management utility as an addon to Firefox. | "Use one of the following solutions to work around this issue: () From the Preference setting of the Security section disable the ""remember passwords for sites"" feature. () Instead of using a Firefox browser, use Chrome or Internet Explorer to access the BIG-IQ system. () Retype the username and password values for all forms." |
558115 | System | If BIG-IP devices have been discovered and the user attempts to save changes to the Use Management Address for HA peer communication check box on the System page, the UI closes the dialog box, but does not save changes to this check box value. Changes to this value are not saved because devices must first be removed from the modules before this change can be allowed. | Remove any discovered devices from the individual modules, and then attempt the value change to the check box again. |
552745 | System | If the user opens the HA Peer Group Properties flyout in a small browser window or after shrinking the flyout, the horizontal scroll bar is not immediately visible. | Scroll to the bottom of the flyout and the horizontal scroll bar will appear. |
474767 | System | The BIG-IQ system might display objects (such as interfaces, self IPs, and VLANs) associated with a device for up to 5 minutes after you delete it. The UI contains data for a device that has been deleted, purely a cosmetic issue. This can happen after you discover a BIG-IP device and then later remove it. | |
532781 | System | The UI reports the memory that is allocated to the BIG-IQ VE as 4096 MB, even if more memory has been allocated to the VE. To view memory allocated to a VE, user must use the CLI or hypervisor reporting. Greater than 4 GB of memory allocated to a BIG-IQ Virtual Edition | Use free command from the CLI to see how much memory is allocated to the VE. |
552834 | System | When a new user with administrator privileges is created, the new user will land on the BIG-IQ initial configuration page upon login. Loading of initial configuration page content by new admin users upon login, when initial configuration is already complete. Seen for all newly created users with administrator privileges. Not seen for users that do not land on the systems page, such as users with Network_Security_Manager privileges, or Web_App_Security_Manager privileges. | At the top of the initial configuration page, the module selection menu is available. Navigate to any module to clear the initial configuration page. Any subsequent logins by user will go to the last page navigated to by the user. |
516585 | Web App Security (ASM) | 4.5.0 HF2 fixes issues where the BIG-IQ was incorrectly identifying differences between the BIG-IP ASM configuration and the BIG-IQ device's view of the ASM configuration. The fixes are implemented as part of the discovery mechanism. | After upgrading to this release, users must remove and rediscover their BIG-IP devices to clear any remaining differences. |
547996 | Web App Security (ASM) | A policy exported from BIG-IQ in version 12.0.0 compatibility mode cannot be imported to BIG-IP version 12.0.0. Policy cannot be imported to BIG-IP version 12.0.0. This occurs when using pre-version 12.0.0 BIG-IP software-created BIG-IQ policies. Because of how the BIG-IP system communicates with the BIG-IQ system, the resulting policy cannot be imported to 12.0.0 BIG-IP. | None. |
515541 | Web App Security (ASM) | After connecting a BIG-IQ system to a BIG-IQ Logging Node, the Logging Node sends events to the BIG-IQ system correctly. However, WARNING and SEVERE log messages appear in the restjavad.log file, showing failures while communicating with the Logging Node. | |
524603 | Web App Security (ASM) | After several seconds, the incorrect message is replaced by a view of the snapshot differences. | |
521595 | Web App Security (ASM) | After the evaluate phase of a BIG-IQ Web Application Security deployment, if an active BIG-IP cluster device goes down before the deployment completes, the BIG-IQ system signals that the deployment has failed, but the deployment does occur on what was the standby BIG-IP device. On BIG-IQ the deployment reports a failure, but the deployment completes successfully on the remaining BIG-IP device which is now the active device. | |
488748 | Web App Security (ASM) | Although a local user with the Web Application Security Manager role can discover devices, remote users with that role, authenticated using a third-party such as RADIUS, cannot discover devices. This is because the BIG-IQ Web Application Security module does not support third-party authentication. ASM does not support RADIUS in its task workers currently, planning to fix in G | |
488830 | Web App Security (ASM) | ASM Security policies can only be deployed from the latest working configuration and not from ASM snapshots. | |
539176 | Web App Security (ASM) | Behavior change in 4.6.0 - when a policy is removed from a virtual server, it is no longer automatically assigned to the special inactive vip placeholder like in previous versions. See symptoms N/A | |
516866 | Web App Security (ASM) | BIG-IP release 11.5.3 has an issue that causes the false character set differences on the BIG-IQ system. | |
556185 | Web App Security (ASM) | "BIG-IQ allows a non-common partition ASM policy to be attached to a virtual server that exists in the common partition. Neither BIG-IQ nor BIG-IP blocks the deployment. The BIG-IP UI prevents a user from attaching an ASM policy in a non-Common partition to a virtual server in the Common partition. However, a BIG-IQ deployment circumvents this protection." Deployment of such a configuration to BIG-IP results in a configuration which should not be used. BIG-IQ has a non-common partition ASM policy attached to a virtual server that exists in the common partition. | Do not assign an ASM policy, existing in a non-Common partition, to a virtual server in the Common partition. |
505799 | Web App Security (ASM) | BIG-IQ Security Web Application Security policy in blocking mode might block legitimate traffic. Legitimate traffic that should pass the block configured for this policy might be erroneously blocked. This occurs when using pre-version 12.0.0 BIG-IP software-created BIG-IQ Security policies. Because of how the BIG-IP system communicates with the BIG-IQ system, the resulting Web Application Security policy contains no allowed URLs for the BIG-IP system. | Use BIG-IP version 12.0.0 to work around this issue. |
525968 | Web App Security (ASM) | Configuration snapshots taken before Release 4.5.0 HF2 do not contain enough information to support the BIG-IQ Web Application Security features in 4.5.0 HF2 and beyond. The BIG-IQ system cannot successfully restore them. | As a best mitigation, take configuration snapshots immediately after installing Hot Fix 2 for release 4.5.0 or any later release. |
516566 | Web App Security (ASM) | Discovery fails when attempting to discover a BIG-IP running 11.5.2 HF1 into a BIG-IQ running 4.5.0 HF2 Discovery fails. BIG-IP running 11.5.2 HF1 into a BIG-IQ running 4.5.0 HF2. | "This only occurs if the BIG-IP device has its rest_api_extensions field set to 0 (zero). On the BIG-IP device, go to this screen and set rest_api_extensions to 1: Security :: Options :: Application Security :: Advanced Configuration > System Variables." |
526964 | Web App Security (ASM) | "Discovery fails with the error message: Error received during device discovery due to missing/empty parameter name." See symptoms This only happens when the BIG-IP license expires | Make sure the BIG-IP is licensed and operational |
517069 | Web App Security (ASM) | Event logs from a BIG-IP device can be configured to go through a BIG-IQ logging node to a remote BIG-IQ system, where they are aggregated from multiple BIG-IP devices onto a single BIG-IQ interface. It is possible to create a situation where some Web Application Security logs do not go through the logging node all the way to the BIG-IQ system. | Clear log storage on the BIG-IQ and the BIG-IQ logging node, remove and replace the logging profile on the BIG-IP's virtual server, and remove and replace the logging node from the BIG-IQ system's logging group. |
526869 | Web App Security (ASM) | If a device discovery failed and was not completed successfully prior to upgrading, a device discovery error message dialog may appear in the UI after the BIG-IP device has been upgraded. Prior to 4.5.0 HF2, the failed discovery task was not being removed from the system. After an upgrade, the system recognizes that the obsolete task has failed and should be removed. The user is prompted the remove the task. | Click the OK button on the discovery error dialog. The system then removes the task and the dialog does not reappear. |
548840 | Web App Security (ASM) | If an ASM policy is associated with a virtual server that has connection mirroring enabled, BIG-IQ ASM fails to deploy this policy. BIG-IQ ASM fails to deploy this policy. The system posts the error message: 01070692:3: ASM is not supported on connection-mirrored virtual servers. This is expected behavior. The configuration is not supported on the BIG-IQ ASM system. For more information, see SOL8637: BIG-IP ASM-enabled virtual servers do not support connection mirroring, available here: http://support.f5.com/kb/en-us/solutions/public/8000/600/sol8637.html. Virtual server that has connection mirroring enabled. | None. |
533938 | Web App Security (ASM) | "If the user creates a custom header on the BIG-IP with a name that contains capital letters, BIG-IQ cannot remove that custom HTTP header during a deployment, and the deployment will fail with an error like the following: AsmDistributeTaskWorker][failed] DELETE to iControl REST failed: ""code"":404,""message"":""Could not get the Header, No matching record was found.""" "The deployment task fails and reports an error like the following: AsmDistributeTaskWorker][failed] DELETE to iControl REST failed: ""code"":404,""message"":""Could not get the Header, No matching record was found.""" | On the BIG-IP device, manually remove any custom headers containing capital letters, or change the names of the custom headers to contain only lowercase letters. |
518575 | Web App Security (ASM) | "If you attempt to discover a BIG-IP device running 11.5.2 EHF1-19, the discovery fails with this message: Error querying iControl Rest for ASM Policy - Response Pages in ..." | "Delete one of the installation volumes on the BIG-IP system and re-install the BIG-IP hotfix. For example, these are the tmsh commands to remove the volume and install the hotfix: # tmsh delete sys software volume HDx.y # tmsh install sys software hotfix Hotfix-BIGIP-whatever-hotfix.iso volume HDx.y create-volume reboot where 'HDx.y' is a (any) desired target software volume. After the boot, please remember to run the following commands: ----------------------------------------------------- # /usr/share/ts/bin/add_del_internal add rest_api_extensions 1 # tmsh restart sys service asm ----------------------------------------------------- and wait for the BIG-IP device to become 'Active' again. Then restart the discovery process from the BIG-IQ system." |
555184 | Web App Security (ASM) | It is not possible to obtain AVR Reports for Network and Application Firewall on a BIG-IQ from BIG-IP systems running versions 12.0.0 or 12.0.0 HF1. This occurs when using BIG-IQ to generate reports in Reporting page under Network or Web Application Security from BIG-IP systems running software versions 12.0.0 or 12.0.0 HF1. AVR Reports do not work. | None. |
555187 | Web App Security (ASM) | BIG-IQ ASM Device: Indicator that the device has been modified is not cleared. In certain cases, users can modify the device configuration, causing the change flag to be set (which indicates that the device has | "Create a deployment task which evaluates the differences between the BIG-IQ configuration and the BIG-IP configuration. In this scenario, there are no changes to deploy so no differences appear. As determined by the deployment task, there are no changes to deploy. The dirty bit will be cleared." |
516545 | Web App Security (ASM) | "In the ASM policy object, the user can define custom parameters. If the user is editing an existing user defined parameter and the Data Type for the parameter is set to decimal, the deployment may fail if the Minimum or Maximum values are changed so that the number of decimal places are extended or one of the value is changed so that it appears as an integer. This is an issue with BIG-IP 11.5.2 HF1 only, and does not occur with other BIG-IP releases." The UI accepts the change, but the deployment task will fail | |
516270 | Web App Security (ASM) | "On changing a virtual server's Web Application Security policy setting from one policy to another, and then deploying the change, the BIG-IQ system reported that the deployment failed. However, the policy assignment successfully changed at the BIG-IP device. This issue is dependent on fixes for 2 BIG-IP 11.5.2 HF1 issues: 464735 and 464750. This does not occur for BIG-IP devices running other software releases." | |
544039 | Web App Security (ASM) | Opening the exported event logs csv file in Microsoft Excel and possibly other programs shows wrong support_id. Opening the exported event logs csv file in Microsoft Excel and possibly other programs shows wrong support_id. Opening the exported event logs csv file in Microsoft Excel. | "1. Open a new empty sheet in Excel. 2. Go to the 'data' tab and select 'from text'. 3. Select your CSV file. 4. Choose: Delimited (you can also specify character encoding). 5. Check 'command' and uncheck 'tab'. 6. Find the field (support_id), select it, and choose 'text'." |
525277 | Web App Security (ASM) | "Snapshots prior to 4.5.0 HF2 cannot be used in 4.5.0 HF2 Custom signature set support and blocking mask support has been added to the ASM module. To extend support for these new objects, references paths in the ASM policy object were changed. After an upgrade, older snapshots will have obsolete references. Differencing against older snapshots and attempting to restore from these snapshots will fail and report the error in the UI. Upgrading of snapshots will not be supported in 4.5.0HF2" | |
554408 | Web App Security (ASM) | The Audit Log contains a section for the status of the updateAndPushSignatures task in the 'Signature file' section when you select Details. The BIG-IP device IP address does not appear in this section of the log. There is an issue that occurs if a newer version of the signature file has not been pushed to the device. | None needed. This is a cosmetic issue and does not impact functionality. |
518734 | Web App Security (ASM) | The client UI appears to be functional for users who were already logged in, even though restjavad is no longer running and the underlying server is not available. It appears that the UI is hung, but the actual problem is that the server is no longer running. "User logged in prior to restjavad stopping/crashing. restjavad stops/crashes. User attempts to do something in the UI with restjavad down." | "Check to see if restjavad is running on the BIG-IQ, using the command: ""bigstart status restjavad."" Restart the restjavad process, using the command ""bigstart restart restjavad."" Refresh the client UI." |
531985 | Web App Security (ASM) | "This only occurs if you use the Policy Creation wizard on the 11.6 BIG-IP device to create the custom signature set. When discovered by the BIG-IQ system and deployed and re-deployed to an 11.5.3 BIG-IP cluster, it creates a duplicate signature set. The custom signature set collides with its originally-deployed copy, and is renamed with an ""_1"" suffix. For example, if the signature set is named ""Systems: Apache"", the final policy on the 11.5.3 device has a set named ""Systems: Apache_1."" Both copies of the signature set, ""Systems: Apache"" and ""Systems: Apache_1,"" appear on the device. This is due to a BIG-IP issue, 532030. User-defined signature sets, created manually on the BIG-IP device, do not exhibit this behavior." | |
516116 | Web App Security (ASM) | This was seen in one testing environment. It has not been seen in any of three other testing environments. It was in an environment with more than 50 ASM policies. When the number of policies was reduced to 10, the device rediscovery completed successfully. | Reduce the number of ASM policies per device to under 20. |
538947 | Web App Security (ASM) | Unexpected user defined signature set is created on the BIG-IP after deploying a custom signature sets from BIG-IQ. Unexpected user defined signature set is created. BIG-IP after deploying a custom signature sets from BIG-IQ. | None. |
539703 | Web App Security (ASM) | Update of the signature file using BIG-IQ fails. Update of the signature file using BIG-IQ fails. The failure can happen if the signature file being used is older than the signature file that is currently in use on the BIG-IP device. A second condition is the software installed on the BIG-IP. | None. |
516107 | Web App Security (ASM) | When deploying a policy from Web Application Security, a log message in restjavad.log may indicate nonexistent differences in the character-sets section. The GUI displays the correct differences, if there are any. | You can safely ignore this log message. |
552573 | Web App Security (ASM) | When deploying configuration to a BIG-IP group, the group is marked as not synced in the BIG-IP system even though run manual sync was chosen. The group is marked as not synced on the BIG-IP system. This occurs in a group that is not configured for 'full sync'. | When configuring the HA group, select 'full sync'. |
522986 | Web App Security (ASM) | When deploying the same deployment again to a BIG-IP version 11.6.0 HF4 cluster with manual sync enabled, differences will be displayed that actually do not exist. | These false differences are not displayed with other versions of BIG-IP devices. |
542812 | Web App Security (ASM) | When discovering devices from different versions (11.6,12.0) there is a conflict even if the policies on the BIG-IP system are imported using the same policy file. There is a conflict. Discovering devices from different versions. | None. |
549116 | Web App Security (ASM) | When evaluating a Web Application Security deployment that contains a large number of BIG-IP devices, the evaluation may take a long time to complete. Web Application Security - Evaluating a deploy may take a long time The deploy task needs to be done with a large set of devices. | |
471353 | Web App Security (ASM) | "When the BIG-IP sends log items to the LOG-IQ node, it does not send the encoding. Therefore, some of the content displays as question mark characters instead of the real content. For example, the request http://23.23.23.23/aXXXa (where ""X"" is a character with an unrecognized encoding). The only attribute that the request displays correctly is the violation_details where all the buffers are base64 encoded." | |
519714 | Web App Security (ASM) | When using Data Guard in Web Application Security, disabling either Custom Patterns or Exception Patterns will cause the patterns to disappear. | |
515924 | Web App Security (ASM) | When using the out-of-band XML policy importing mechanism for importing a policy, the following issue was discovered. If you export a Web Application policy to a BIG-IP system and import the same policy later, the imported policy does not contain any character sets. | |
515552 | Web App Security (ASM) | "When using the Web Application Security Event Log some filters are not producing the expected result set. These filters are only available on the Web Application Security Event Log GUI screens and are related to searches for events that contain a specified string." | |
527759 | Web App Security (ASM) | "When you push a new ASM signatures file to a BIG-IP device that already has that version of the signatures file, the BIG-IP device correctly rejects the update. The BIG-IQ log message in /var/log/restjavad.n.log, however, is misleading about the cause of the push failure: The uploaded Attack signature update file does not match the current version of BIG-IP. The problem is that the update would not change the current file, not a version mismatch." | You can ignore this error. It is benign. |
526160 | Web App Security (ASM) | You can delete a virtual server configuration from the BIG-IQ Shared Security interface, but the virtual server is not deleted from the BIG-IP configuration on the next deployment from the Web Application Security interface. | If the device has been imported through the Network Security interface, you may deploy and delete the virtual server through the Network Security Module. If the device is only discovered through the Web Application Security module, you must delete the virtual server directly at the BIG-IP device and then rediscover the device. |
525539 | Web Client Security (FPS) | "The following error appears in restjavad.log after installing 4.5.0 HF2: [SEVERE][281][...][8100/cm/websafe/event-logs/aggregator WebsafeEventLogsAggregationWorker][failed] couldn't create group shared/resolver/device-groups/cm-websafe-logging-nodes-trust-group . maybe group already exists... This message indicates that it failed creating a group which already exists. In addition, this message concerns a product that is not released in 4.5.0 HF2. You can safely ignore it." |
Removing BIG-IQ system services from a BIG-IP device
Contacting F5 Networks
Phone: | (206) 272-6888 |
Fax: | (206) 272-6802 |
Web: | http://support.f5.com |
Email: | support@f5.com |
For additional information, please visit http://www.f5.com.
Additional resources
You can find additional support resources and technical documentation through a variety of sources.
- The F5 Networks Technical Support web site: http://www.f5.com/support/
- The AskF5 web site: http://support.f5.com/kb/en-us.html
- The F5 DevCentral web site: http://devcentral.f5.com/
- AskF5 TechNews
F5 Networks Technical Support
Free self-service tools give you 24x7 access to a wealth of knowledge and technical support. Whether it is providing quick answers to questions, training your staff, or handling entire implementations from design to deployment, F5 services teams are ready to ensure that you get the most from your F5 technology.
AskF5
AskF5 is your storehouse for thousands of solutions to help you manage your F5 products more effectively. Whether you want to search the knowledge base periodically to research a solution, or you need the most recent news about your F5 products, AskF5 is your source.
F5 DevCentral
The F5 DevCentral community helps you get more from F5 products and technologies. You can connect with user groups, learn about the latest F5 tools, and discuss F5 products and technology.
AskF5 TechNews
- Weekly HTML TechNews
- The weekly TechNews HTML email includes timely information about known issues, product releases, hotfix releases, updated and new solutions, and new feature notices. To subscribe, click TechNews Subscription, complete the required fields, and click the Subscribe button. You will receive a confirmation. Unsubscribe at any time by clicking the Unsubscribe link at the bottom of the TechNews email.
- Periodic plain text TechNews
- F5 Networks sends a timely TechNews email any time a product or hotfix is released. (This information is always included in the next weekly HTML TechNews email.) To subscribe, send a blank email to technews-subscribe@lists.f5.com from the email address you are using to subscribe. Unsubscribe by sending a blank email to technews-unsubscribe@lists.f5.com.