BIG-IP Next Fixes and Known Issues¶

This list highlights known issues for this BIG-IP Next release.

BIG-IP Next Release Notes BIG-IP Next Release Information

Version: 20.2.0
Build: 20.2.0-2.375.1+0.0.43

Cumulative fixes from BIG-IP Next v20.2.0 that are included in this release
Known Issues in BIG-IP Next v20.2.0

Cumulative fixes from BIG-IP Next v20.2.0 that are included in this release

Vulnerability Fixes

ID Number	CVE	Links to More Info	Description
1487969	CVE-2023-47038	K000138640	CVE-2023-47038 on f5-csm-icb
1486045	CVE-2023-47038	K000138640	CVE-2023-47038 on f5-csm-bird
1486329	CVE-2023-47038	K000138640	CVE-2023-47038: Perl Vulnerability
1483733-2	CVE-2023-47038	K000138640	CVE-2023-47038 in perl-base on f5-access-apmd-egress-sidecar

BIG-IP Next Fixes

ID Number	Severity	Links to More Info	Description
1497709	1-Blocking		GSLB Sync Group does not reconnect at certificate rotation or reboot
1497549	1-Blocking		Manual or automatic failover of an instance results in unhealthy cluster after CM upgrade★
1495485	1-Blocking		CA file reference for OCSP rule is incorrect.
1495481-1	1-Blocking		CRLDP Authentication rule does not work with valid certificates
1495469	1-Blocking		PUT /api/v1/systems/<system-id>/host-dns does not work
1469329	1-Blocking		Using L1-network with VLANs in VE PUT/onboard no longer generates default L2 and L3 networks.
1430281	1-Blocking		QKVIEW output not captured for resource-manager and platform-manager after factory reset
1411249	1-Blocking		During upgrade activity, TMM cores is found on HA DUT
1353565-2	1-Blocking		Certain extreme SSL traffic patterns may impact throughput
1538581	2-Critical		Next setup script may fail to create tmm interfaces if DHCP address assigned
1498497	2-Critical		Traffic disruption in upgraded BIG-IP Next Central Manager application service from 20.0.x to 20.1.0
1497641	2-Critical		When no security policies are created, "create" button is enabled for Auditor role
1496457-4	2-Critical		TMM crash under certain traffic patterns when an HTTP/2 profile is applied.
1494509	2-Critical		Expression field is missing for few endpoints security agents.
1490089	2-Critical		Policy execution is denied with Antivirus check.
1488105-2	2-Critical		CVE-2022-48522 in perl-base on f5-access-renderer
1487777	2-Critical		CVE-2022-48522 Perl Vulnerability
1486365	2-Critical		CVE-2022-48522 Perl Vulnerability
1483777-2	2-Critical		CVE-2022-48522 in perl-base on f5-access-apmd-egress-sidecar
1472745-1	2-Critical		TMM container is restarted by kubernetes
1351325	2-Critical		Cannot delete a tagged VLAN and recreate an untagged VLAN with same name within ~10 minutes
1322973-8	2-Critical		A particular sequence of HTTP packets may cause TMM to crash
1576397	3-Major		BIG-IP Next Central Manager UI shows external storage as disabled even though it was enabled during setup
1574821	3-Major		BIG-IP Next Central Manager VM instances shutdown a in High availability cluster do not restart few of the Pods
1501461-1	3-Major		CVE-2014-10077: Crash in i18n Ruby Gem
1497365-1	3-Major		BIG-IP Monitor not utilised for Generic Hosts
1497361-1	3-Major		Global Resiliency Group creation time increases as number of non provisioned group members increases
1496901-1	3-Major		Name specified for "SPECIFY THE CERTIFICATES DETAILS FOR THIS APPLICATION" cannot contain special characters
1496897-1	3-Major		Inability to disable Global Resiliency in an application once enabled
1495141	3-Major		Unable to modify or add roles to an existing user
1495037-1	3-Major		Global Resiliency Group allows creation without validating empty entries for group name/DNS listener name
1495001-1	3-Major		Cannot edit Global Resiliency Group once created
1494993-1	3-Major		Cannot use the same group name again on same GSLB instance
1490853	3-Major		Setup script produces warnings "Netplan configuration should NOT be accessible by others."
1490525	3-Major		The execution of the Per Session Access policy is halting when the Linux FPC attempts to initiate a VPN connection
1481801	3-Major		Session.policy.result.policy_path variable is incorrect when multiple agents are used inside a macro policy
1474837	3-Major		Failed to load the webtop when advanced resource assign agent is added after endpoint security agents
1474733	3-Major		iRules are out of order after migraiton to BIG-IP Next Central Manager
1474121	3-Major		Deployment errors when Access policy is set to "Global"
1473477	3-Major		Access Webtop resource configuration is missing from migrated application service
1355649-2	3-Major		TMM may crash while processing ILX::call commands
1328709	3-Major		The coredns pod continuously logs warnings
1205029-3	3-Major	BT1205029	WEBSSO with an OAuth Bearer token and the Cache option enabled cached tokens from a diff per-session context are flowed to the backend application
1574997	4-Minor		BIG-IP Next Central Manager HA node installation requires logout to add node★
1571741	4-Minor		Inappropriate Per Request Branch Contexts & Expressions in Access Policy Editor
1495245	4-Minor		Unable to deploy an application service without pool using standard template in BIG-IP Next Central Manager
1494909	4-Minor		Application Manager cannot view WAF information in the Security Workspace
1494905	4-Minor		Home screen button to Security Workspace disabled for user with Application Manager user role
1474781-1	4-Minor		Updated policy with invalid Inspection Services is deployed to Next instance without any error
1474777-1	4-Minor		Security Policies displays "None" on Application Service UI dashboard after deploying the application with Security Policy
1346905-2	4-Minor		Application Location and Source details missing in the application panel from the security policy grid
1567737	5-Cosmetic		Confusing yellow sign occurs on the Access Policy Editor screen

Workaround:
The yellow sign that comes on each rule/flow block disappears if you provide all the mandatory properties.

For those rules that do not require any change, saving the rule again removes the yellow sign.

The banner on top stays irrespective of even if there is no rule/flow with missing mandatory values.

Fix:
The yellow icon should only appear on rules/flows that require some mandatory values to be provided by the user and should disappear when all the mandatory values are provided.

The banner on top of the editor screen should be visible only if there is any rule/flow showing the yellow icon.

1538581 : Next setup script may fail to create tmm interfaces if DHCP address assigned

Component: BIG-IP Next

Symptoms:
If a BIG-IP Next VE instance is deployed and the instance receives a DHCP address at startup, it will immediately configure and form a Kubernetes cluster. If the setup script is run after that and if VLANs are configured by the script, TMM will not have the VLANs assigned to it.

The problem is not immediately obvious, because the API will return the configured state, showing VLANs assigned to interfaces.

Conditions:
- BIG-IP Next VE.
- Versions 20.0 or 20.1.
- DHCP assigns address to mgmt.
- The setup script is run and VLANs are configured by it.

Impact:
The BIG-IP Next instance will be unable to handle data-plane traffic.

Workaround:
Do not assign DHCP addresses to the Next instance.

Or, if an address is already assigned to mgmt, do not configure VLANs when running the setup script.

Fix:
Setup script completes.

1501461-1 : CVE-2014-10077: Crash in i18n Ruby Gem

Component: BIG-IP Next

Symptoms:
Hash#slice in lib/i18n/core_ext/hash.rb in the i18n gem before 0.8.0 for Ruby allows remote attackers to cause a denial of service (application crash) via a call in a situation where :some_key is present in keep_keys but not present in the hash.

Conditions:
N/A

Impact:
N/A

Workaround:
N/A

Fix:
The Ruby gem has been updated to a fixed version.

1498497 : Traffic disruption in upgraded BIG-IP Next Central Manager application service from 20.0.x to 20.1.0

Component: BIG-IP Next

Symptoms:
Upon upgrading BIG-IP Next Central Manager from 20.0.x to 20.1.0 and redeploying the existing application services, users may experience traffic disruption. This is attributed to conflicts with TMM validation for "allVlans: true" and Default L3-Network.

Conditions:
When both the BIG-IP Next Central Manager and BIG-IP Next Instance are upgraded from from 20.0.x to 20.1.0 , and the existing application service is redeployed.

Impact:
Traffic will not work for existing application

Workaround:
If traffic is not working for the existing application after redeployment, users should delete the application and redeploy it with the same configuration to the BIG-IP Next Instance.

1497709 : GSLB Sync Group does not reconnect at certificate rotation or reboot

Component: BIG-IP Next

Symptoms:
GSLB Engine loses connection to another GSLB Engine Peers in a GSLB Sync Group and fails to reconnect.

Conditions:
When a GSLB Engine gets a certificate rotation, reboots, or experiences a temporary network issue that causes disconnection to another GSLB Engine Peers in a GSLB Sync Group, that connection can be not restored.

Impact:
The affected connection appears in a "half-open" state where one peer considers the connection open, another peer considers the connection closed and disconnects it every 10 seconds. As a result, GSLB Engines in a GSLB Sync Group have states of connections completely unsynced which results in the inability to distribute monitoring resources between each other and share statuses of resources.

Workaround:
Once any GSLB Engine in a GSLB Sync Group gets certificate rotation or reboots, all GSLB Engines in the GSLB Sync Group need to have re-created configuration for all non-local GSLB Engine Instances.

Component: BIG-IP Next

Symptoms:
Name field for a certificate block accepts invalid characters causing the application deployment to fail with different reasons.

Possible errors:
* Failed to submit declaration to AS3: declaration is invalid

* : FAST-0002: Internal Server Error: Failed to create application tenantOLLlCnuuQB90XnE6CrGN1cA:test on BIG-IP Next instance: The property /tenantOLLlCnuuQB90XnE6CrGN1cA/test/tlsserver_local_cert_vs_place between_test_rsa name must be valid.

Conditions:
The name specified for "SPECIFY THE CERTIFICATES DETAILS FOR THIS APPLICATION" cannot contain special characters.

Impact:
Application deployment will fail.

Workaround:
Use only the following characters:
* Allowed characters are: "-","_", 0 to 9 and alphabets

1496897-1 : Inability to disable Global Resiliency in an application once enabled

Component: BIG-IP Next

Symptoms:
Global Resiliency, once enabled, cannot be disabled for an application.

Conditions:
Global Resiliency is enabled.

Impact:
Cannot disable the Global Resiliency.

Workaround:
Delete and recreate the application, then redeploy without enabling Global Resiliency.

Fix:
Global Resiliency Group can be enabled/disabled after application creation.

1496457-4 : TMM crash under certain traffic patterns when an HTTP/2 profile is applied.

Component: BIG-IP Next

Symptoms:
A TMM crash.

Conditions:
An LTM virtual server with an HTTP/2 profile attached.

Impact:
A TMM crash.

Workaround:
Set up HA pairs when configuring your BIG-IP device.

Fix:
The issue no longer occurs.

1495485 : CA file reference for OCSP rule is incorrect.

Component: BIG-IP Next

Symptoms:
OCSP Authentication agent if configured using the BIG-IP Next Central Manager does not provide the correct file reference to the trusted CA certificates used to verify the signature on the OCSP response

Conditions:
Create a policy with OCSP within a flow. Test the traffic through the policy.

Impact:
OCSP agent will not be executed if included in the policy. Access Session will not be established.

1495481-1 : CRLDP Authentication rule does not work with valid certificates

Component: BIG-IP Next

Symptoms:
Crash observed with CRLDP Authentication rule in the per session policy, the policy execution gets denied. It is continuously
getting redirected to https://<VS_IP>/my.policy_nonce?nonce=<nonce_token>

Conditions:
Create a policy with CRLDP rule within a flow. Test the traffic through the policy.

Impact:
CRLDP rule will not be executed if included in the policy. Access Session will not be established.

Workaround:
None

1495469 : PUT /api/v1/systems/<system-id>/host-dns does not work

Component: BIG-IP Next

Symptoms:
Setting host DNS servers using PUT /api/v1/systems/<system-id>/host-dns does not change the host DNS servers

Conditions:
Send a PUT request to /api/v1/systems/<system-id>/host-dns

Impact:
The host DNS servers do not change

Workaround:
In VE, send a PUT request to /onboard instead

Fix:
In VE, send a PUT request to /onboard instead

1495245 : Unable to deploy an application service without pool using standard template in BIG-IP Next Central Manager

Component: BIG-IP Next

Symptoms:
When you create an application service without a pool the 'Review & Deploy' button is disabled.

Conditions:
1. Create an application service using a standard template.

2. Do not add a pool to the application service.

Impact:
The application service cannot be deployed when a pool is not attached.

Workaround:
When creating the application service, go to the Pools tab. Navigating to the Pools tab enables the'Review & deploy' button. You do not need to add pools.

Component: BIG-IP Next

Symptoms:
The Application Manager user role has view-only permissions to all modules within the security workspace. When an Access Manager logs in, they might not be able to view WAF information in the Security Workspace.

Conditions:
1. Log in to BIG-IP Next Central Manager as a user with an Application Manager role.

2. Go to the Security Workspace.

Impact:
No WAF visibility for Application Manager users.

Workaround:
Admin should add the user the role of 'Auditor' as well to have full view permission of the security workspace.

1494905 : Home screen button to Security Workspace disabled for user with Application Manager user role

Component: BIG-IP Next

Symptoms:
The 'Go to Security Workspace' shortcut button in BIG-IP Next Central Manager's home screen is disabled for users with an Application Manager role.

Conditions:
1. Log in to BIG-IP Next Central Manager with an Application Manager user role.

2. Go to the home screen and try to use the quick link to the Security Workspace.

Impact:
The 'Go to Security Workspace' button is disabled.

Component: BIG-IP Next

Symptoms:
If there is an antivirus check in the access policy, the policy always gets denied and the agent result is set to 0.

Conditions:
Antivirus check is included in the policy.

Impact:
The policy gets denied and does not proceed for further execution.

1488105-2 : CVE-2022-48522 in perl-base on f5-access-renderer

Symptoms:
The sock driver experiences tx_errors sending out packets on the veth interface(tmctl -d blade -w 250 tmm/xnet/sock/stats), as shown below:

ifname q_id mmap_ring_drops rx_buf_err rx_io_err tx_err
------ ---- --------------- ---------- --------- --------
xeth0 0 0 0 0 70828320

Conditions:
- The TMM container's veth mtu uses a value less than 1500.

Impact:
- TMM stops processing traffic.

Fix:
- TMM no longer crashes.

1469329 : Using L1-network with VLANs in VE PUT/onboard no longer generates default L2 and L3 networks.

Component: BIG-IP Next

Symptoms:
On VE PUT /onboard with L1-network with VLANs no longer creates default L2 and L3 networks.

Conditions:
On VE send a PUT request to /onboard with L1-network with VLANs.

Impact:
Default L2 and L3 networks are no longer created.

Workaround:
You can manually create the L2 and L3 networks as needed.

Fix:
On VE PUT /onboard with L1-network with vlans no longer creates Default L2 and L3 networks.

Component: BIG-IP Next

Symptoms:
If you delete an existing tagged VLAN and attempt to create a new untagged VLAN with the same name within 10 minutes, the creation fails.

Conditions:
Delete an existing tagged VLAN then try to create a new untagged VLAN with the same name.

Impact:
Unable to create the new VLAN.

Workaround:
Try again in another 10 minutes.

1346905-2 : Application Location and Source details missing in the application panel from the security policy grid

Component: BIG-IP Next

Symptoms:
When clicking on the application counter in the WAF Policies list, a panel is opened with a list of the applications referencing the selected policy. The columns Source and Location are blank.

Conditions:
1. Create a WAF policy and attach to one or more application services.

2. Deploy application services with attached WAF policies.

3. Click the application counter from the WAF Policies list.

Impact:
The application service's location (BIG-IP Next instance) and source (name of template used) is not visible.

Workaround:
You can view the information about application service directly from the Applications workspace.

Go to the Applications workspace, and select the application service from My Application Services list. From the Application Service Topology, select the eye icon next to the application service tile to view the source and location details.

1328709 : The coredns pod continuously logs warnings

Component: BIG-IP Next

Symptoms:
The coredns pod in the kube-system namespace of the kubernetes cluster continuously logs the following warnings:

[WARNING] No files matching import glob pattern: /etc/coredns/custom/*.override
[WARNING] No files matching import glob pattern: /etc/coredns/custom/*.server

Conditions:
BIG-IP Next Central Manager VM has been created and assigned an IP address.

Impact:
There is no operational impact.

Fix:
The warnings are no longer logged.

1322973-8 : A particular sequence of HTTP packets may cause TMM to crash

Component: BIG-IP Next

Symptoms:
Tmm crashes and restarts

Conditions:
A basic http virtual server with rfc-compliance enabled in http profile and client sending the request with headers more than the max-header-count, results in crash under rare conditions

Impact:
Traffic disrupted while tmm restarts.

Workaround:
N/A

Fix:
Tmm does not crash anymore.

1205029-3 : WEBSSO with an OAuth Bearer token and the Cache option enabled cached tokens from a diff per-session context are flowed to the backend application

Links to More Info: BT1205029

Component: BIG-IP Next

Symptoms:
In some cases of WEBSSO same token is sent to different sessions in the backend.

Conditions:
WEBSSO with an OAuth Bearer token and the Cache option enabled cached tokens from a diff per-session context are flowed to the backend application

Impact:
Situations where JWTs (via WEBSSO / OAuth Bearer profile) are being sent downstream for requests which belong to a different user. The problem seems to be related to when these requests share the same client IP address. This is a big problem when clients are using NAT themselves to mask different users/sessions behind the same IP address.

Fix:
When sessions are different we are clearing the cache tokens so that new tokens are generated for different sessions.

Known Issues in BIG-IP Next v20.2.0

BIG-IP Next Issues

ID Number	Severity	Links to More Info	Description
1353589	1-Blocking		Provisioning of BIG-IP Next Access modules is not supported on VELOS, but containers continue to run
1352969	1-Blocking		Upgrades with TLS configuration can cause TMM crash loop
1350285-1	1-Blocking		Traffic is not passing after the tenant is licensed and network is configured
1329853-1	1-Blocking		Application traffic is intermittent when more than one virtual server is configured
1324545-1	1-Blocking		L3 validation fails after a BIG-IP Next HA instance fails over
1321417-1	1-Blocking	BT1321417	Cannot use WAF modules on VELOS on deploying tenant with 10 CPUs
1280713	1-Blocking		VELOS high availability (HA) cluster goes into active/active after upgrade★
1189933-1	1-Blocking		BIG-IP Next Central displays a BIG-IP Next Instance as 'IsHealthy': true even if traffic isn't passing
1162213-1	1-Blocking		Incorrect state when upgrading a BIG-IP Next HA instance★
1104625	1-Blocking		The BIG-IP Next VE tmstat table does include stats for the management interface
1576277	2-Critical		Instance backup file creation fails after upgrade to v20.2.0
1561053-1	2-Critical		Application status migration status incorrectly labeled as green when certain properties are removed
1560493-1	2-Critical		Inaccurate Reflection of Selfip Prefix Length in TMM Statistics and "ip addr" Output
1492705	2-Critical		During upgrading to BIG-IP Next 20.1.0, the BIG-IP Next 20.1.0 Central Manager failed to connect with BIG-IP Next 20.0.2 instance
1466305	2-Critical		Anomaly in factory reset behavior for DNS enabled BIG-IP Next deployment
1365005	2-Critical		Analytics data is not restored after upgrading to BIG-IP Next version 20.0.1
1354265	2-Critical		The icb pod may restart during install phase
1294565	2-Critical		After upgrading, login api may return 401 with correct credentials
1283629-1	2-Critical		Deploying an application with the same name as another deployed application fails
1271477	2-Critical		BIG-IP Next instance on VELOS reports unhealthy status if upgrade fails★
1268361	2-Critical		API GET /upgrade/systems/{system_id}/stats/{type} is VE specific only★
1232993-1	2-Critical		Forced reboot during BIG-IP Next upgrade can cause instability★
1162253	2-Critical		Monitors in an application cannot be removed from stacks and traffic stops running
1123381	2-Critical		Standby node in a BIG-IP Next HA instance loses it's license when HA is disassembled
1090205	2-Critical		Floating IP address for a BIG-IP Next HA instance is unavailable during an active node reboot
1087937	2-Critical		API endpoints do not support page query
1083205	2-Critical		Default network is the only supported network
1078013-1	2-Critical		BIG-IP Next HA instance fails when VLANs exist or invalid VLANs are submitted
1574685	3-Major		Generated WAF report can be loaded without text
1574681	3-Major		Dynamic Parameter Extract from allowed URLs doesn't show in the parameter in the WAF policy
1574573	3-Major		Global Resiliency Group status not reflecting correctly on update
1574565	3-Major		Inability to Edit Generic Host While Re-Enabling Global Resiliency
1572681-1	3-Major		Data Group Changes not getting reflected on BIG-IP after deployment when removing key-value pairs
1569969-1	3-Major		WAF policy with default DoS profile cannot be migrated
1569589-1	3-Major		Default values of Access policy are not migrated
1567129	3-Major		Unable to deploy Apps on BIG-IP Next v20.2.0 created using Instantiation from v20.1.x★
1566745-1	3-Major		L3VirtualAddress set to ALWAYS advertise will not advertise if there is no associated Stack behind it
1560561	3-Major		Instance Manager and Security Manager roles are required to deploy Inspection Service with VLAN changes
1495017	3-Major		BIG-IP Next Hostname, Group Name and FQDN name should adhere to RFC 1123 specification
1495005	3-Major		Cannot create Global Resiliency Group with multiple instances if the DNS instances have same hostname
1494997	3-Major		Deleting a GSLB instance results in record creation of GR group in BIG-IP Next Central Manager
1491197	3-Major		Server Name (TLS ClientHello) Condition in policy shouldn't be allowed when "Enable UDP" option is selected in application under Protocols & Profiles
1491121	3-Major		Patching a new application service's parameters overwrites entire application service parameters
1489945	3-Major		HTTPS applications with self-signed certificates traffic is not working after upgrading BIG-IP Next instances to new version of BIG-IP Next Central Manager
1474801	3-Major		BIG-IP Next Central Manager creates a default VRF for all VLANS of the onboarded Next device
1472669	3-Major		idle timer in BIG-IP Next Central Manager can log out user during file uploads★
1403861	3-Major		Data metrics and logs will not be migrated when upgrading BIG-IP Next Central Manager from 20.0.2 to a later release
1394945	3-Major		No Bot defense due to DNS resolving issue
1393389	3-Major		QKView creation for BIG-IP Next Central Manager might not complete
1366321-1	3-Major		BIG-IP Next Central Manager behind a forward-proxy
1365433	3-Major		Creating a BIG-IP Next instance on vSphere fails with "login failed with code 501" error message★
1360121-1	3-Major		Unexpected virtual server behavior due to removal of objects unsupported by BIG-IP Next
1360097-1	3-Major		Migration highlights and marks "net address-list" as unsupported, but addresses are converted to AS3 format
1360093-1	3-Major		Abbreviated IPv6 destination address attached to a virtual server is not converted to AS3 format
1359209-1	3-Major		The health of application service shown as "Good" when deployment fails as a result of invalid iRule syntax
1358985-1	3-Major		Failed deployment of migrated application services to a BIG-IP Next instance
1355605	3-Major		"NO DATA" is displayed when setting names for appliction services, virtual servers and pools, that exceed max characters
1326385	3-Major		Floating self-IP address for a BIG-IP Next HA instance
1325297	3-Major		Metrics are missing for application services with names longer than 24 characters
1306317-1	3-Major		Telemetry services with invalid hostnames are not rejected by the API
1306229	3-Major		Updating a self-IP address on a BIG-IP Next instance that was created from BIG-IP Next Central Manager does not work
1296721	3-Major		App template default values can override configured properties for existing applications upon redeploy
1294081-1	3-Major		AS3 applications configured with HTTP2 and TLS do not function
1293901	3-Major		If pool member/endpoint name is omitted, app creation/edit screen might crash
1293137	3-Major		At least one toggle field on every page needs to be visited before the application can deploy successfully
1291621	3-Major		Cannot delete certificate after removing BIG-IP Next instance from BIG-IP Next Central Manager
1286181-1	3-Major		Add a service with Transport Layer Security (TLS), but one or more of the certs is missing or invalid
1286173-1	3-Major		Telemetry services that do not exist appear to have been deleted using an API call
1267981	3-Major		BIG-IP Next pool monitors use management network as fallback
1251181	3-Major		VLAN names longer than 15 characters can cause issues with troubleshooting
1235089	3-Major		Selected signatures for cookies are not added to overriden signature section
1234093	3-Major		BIG-IP Next Central Manager iRules do not support double quote characters
1233681	3-Major		Redeploying an application fails after you renew the certificates for an HTTPS application
1231089	3-Major		Multiple applications can be configured with duplicate values for virtualAddresses and virtualPort
1230993	3-Major		'Mandatory request body is missing' violation in staging but request is unexpectedly blocked
1220077	3-Major		Failover for a BIG-IP Next HA instance between upgrades can time out★
1216889	3-Major		Incorrect application count is displayed on BIG-IP Next Central Manager iRules page after a BIG-IP Next instance is removed
1195281-1	3-Major		Endpoint is down when sendString contains double escaped characters
1172933	3-Major		Stack name must be unique in an application regardless of types
1134225	3-Major	K000138849	AS3 declarations with a SNAT configuration do not get removed from the underlying configuration as expected
1122689-3	3-Major		Cannot modify DNS configuration for a BIG-IP Next VE instance through API
1120457-1	3-Major		Data interfaces for BIG-IP Next VE are not visible on the host after the interface configuration is sent to TMM
1120417	3-Major		Machine ID on the BIG-IP Next properties pages shows an error
1117817	3-Major		Interface assignments are unpredictable when more than 4 interfaces are configured
1117805	3-Major		Unable to determine the TMM interface for MAC addresses on BIG-IP Next VE from the API
1117765	3-Major		BIG-IP Next Central Manager displays empty network interface metrics for a BIG-IP Next instance
1112285	3-Major		Cannot update management IP address on BIG-IP Next HA instances
1110805	3-Major		Setup needs to be finished on the host OS before BIG-IP Next can function properly.
1109933-1	3-Major		Unexpected behavior when multiple routes with identical route configuration and different names are created
1107757-1	3-Major		Large numbers of AS3/API requests can trigger job timeout errors.
1107533-1	3-Major		Upgrading a BIG-IP Next instance endpoint does not accept file names★
1106573	3-Major		If an application deployment fails due to BIG-IP Next instability, the policies referenced in the application cannot be deleted from BIG-IP Next Central Manager
1089201	3-Major		BIG-IP Next HA instance in an HA configuration fails when control plane IP address is configured incorrectly
1087881	3-Major		Network API endpoints reject Content-Type application/hal+json
1086221-1	3-Major		Content-Type response header does not match documented in BIG-IP Next OpenAPI spec
1085753	3-Major		Overwritten application deployments display in applications list
1079873	3-Major		Text in first column of a BIG-IP Next Central Manager grid might overlap with text in subsequent columns
1078533-1	3-Major		Cannot delete a BIG-IP Next instance from BIG-IP Next Central Manager
1060829	3-Major		Unable to delete template from BIG-IP Next Central Manager if it was used for the application deployment
1058837	3-Major		Incorrect item count following application deletion and subsequent deletions fail
1057493	3-Major		'HTTP::header insert' command does not work under ASM iRule events
1053009-1	3-Major		Transaction in progress message and dropped connections using Files API to upload a cert/key
1576273	4-Minor		No L1-Networks in an instance causes BIG-IP Next Central Manager upgrade to v20.2.0 to fail★
1575549	4-Minor		BIG-IP Next Central Manager discovery requires an instance to have both Default L2-Network and Default L3-Network if either one already exists
1564157	4-Minor		BIG-IP Next Central Manager requires VELOS/rSeries systems to use an SSL certificate containing the host IP address in the CN or SANs list.
1560605	4-Minor		Global Resiliency functionality fails to meet expectations on Safari browsers
1498421	4-Minor		Restoring Central Manager (VE) with KVM HA Next instance fails on a new BIG-IP Next Central Manager
1498121	4-Minor		BIG-IP Next Central Manager upgrade alerts not visible in global bell icon
1490381-1	4-Minor		Pagination for iRules page not supported with a large number of iRules
1394625-1	4-Minor		Application service failes to deploy even if marked as green (ready to deploy)
1365445	4-Minor		Creating a BIG-IP Next instance on vSphere fails with "login failed with code 401" error message★
1365417	4-Minor		Creating a BIG-IP Next VE instance in vSphere fails when a backslash character is in the provider username★
1360709	4-Minor		Application page can show an error alert that includes "FAST delete task failed for application"
1360621	4-Minor		Adding a Control Plane VLAN must be done only during BIG-IP Next HA instance creation
1354645	4-Minor		Error displays when clicking "Edit" on the Instance Properties panel
1350365	4-Minor		Performing licensing changes directly on a BIG-IP Next instance
1325769	4-Minor		VLANs with a blank tag cannot be used to create a BIG-IP Next instance
1325713-1	4-Minor		Monthly backup cannot be scheduled for the days 29, 30, or 31
1325369	4-Minor		Saved JSON Web Token licenses do not appear after upgrade
1306997	4-Minor		Deselecting the Tagged Interface when creating a BIG-IP Next HA instance on VELOS causes an error
1305761	4-Minor		While configuring a BIG-IP Next HA instance, the "Next" button is enabled while the instance is still checking node state
1305757	4-Minor		Configuring a BIG-IP Next HA instance from BIG-IP Next Central Manager returns an error
1294393	4-Minor		Sorting and filtering create instance tasks on the My Instances page
1294137	4-Minor		BIG-IP Next HA instance creation fails
1291473	4-Minor		Creating a BIG-IP Next HA instance with instances that have deployed applications
1284665-1	4-Minor		When adding a new BIG-IP Next instance, the error message from an unsuccessful addition attempt is not cleared
1235105	4-Minor		Endpoint grid is shown only for applications that use the HTTPS-Load-Balancing-Service template
1209649-1	4-Minor		Load More' button reloads data already on the page for FAST Apps on BIG-IP Next Central Manager
1137869	4-Minor		Attempting to create an application from BIG-IP Next Central Manager sometimes fails
1114841-2	4-Minor		Creating a BIG-IP Next HA instance from BIG-IP Next Central Manager fails
1113593	4-Minor		BIG-IP Next Central Manager cannot deploy an application to an unhealthy BIG-IP Next instance
1109633	4-Minor		Creating a BIG-IP Next HA instance on VE from BIG-IP Next Central Manager
1106477	4-Minor		Cannot control the order of the fields generated from a BIG-IP Next Central Manager application template
1104397	4-Minor		When creating a new application from BIG-IP Next Central Manager, the form might show the deployment status of an application created previously in the same session
1104393	4-Minor		Testing an application deployment from BIG-IP Next Central Manager and copying to clipboard
1090405	4-Minor		Error messages in logs: pem block and tls failed to find PEM data
1082417	4-Minor		Application status displays as deployed before it has been created
1227605	5-Cosmetic		Item count on the BIG-IP Next Central Manager My Apps and Instances pages shows -1 items
1113045	5-Cosmetic		BIG-IP Next Central Manager displays No Data for mgmt network interface metrics

1566745-1 : L3VirtualAddress set to ALWAYS advertise will not advertise if there is no associated Stack behind it

Component: BIG-IP Next

Symptoms:
L3VirtualAddress set to RHI Mode ALWAYS advertise will not advertise if there is no associated Application Stack behind it.

Conditions:
Configuration of RHI Mode to ALWAYS advertise on an L3VirtualAddress without an associated Application Stack.

Impact:
L3VirtualAddress will not be advertised as expected.

1564157 : BIG-IP Next Central Manager requires VELOS/rSeries systems to use an SSL certificate containing the host IP address in the CN or SANs list.

Component: BIG-IP Next

Symptoms:
BIG-IP Next Central Manager requires that virtualization providers use a valid SSL certificate. A self-signed certificate can also be explicitly accepted by BIG-IP Next Central Manager users, if the certificate otherwise passes SSL validation successfully.
When F5OS generates self-signed SSL certificates for its HTTPS services, it does not include the actual hostname or IP address in the Common Name or Subject Alternative Names (SANs) fields. As a result, this self-signed certificate will not pass SSL validation for strict TLS clients, because the HTTPS server name does not match any Subject names in the certificate.

Conditions:
A BIG-IP Next Central Manager user attempts to add a VELOS or rSeries system as a virtualization provider, when the VELOS or rSeries system is using the default self-signed certificate generated by the system.

Impact:
BIG-IP Next Central Manager cannot successfully add VELOS or rSeries systems as virtualization providers, and therefore cannot dynamically create new BIG-IP Next instances on VELOS or rSeries systems.

Workaround:
1. Create a self-signed SSL certificate that includes the F5OS system's actual IP address in the Subject Alternative Names (SANs) field. For example, the following steps can be used:
    A. Save the following data into a file named “ip-san.cnf":

[req]
default_bits = 2048
distinguished_name = req_distinguished_name
req_extensions = req_ext
x509_extensions = v3_req
prompt = no

[req_distinguished_name]
countryName = XX
stateOrProvinceName = N/A
localityName = N/A
organizationName = Self-signed certificate
commonName = F5OS Self-signed certificate

[req_ext]
subjectAltName = @alt_names

[v3_req]
subjectAltName = @alt_names

[alt_names]
IP.1 = 127.0.0.1
DNS.1 = f5platform.host

    B. Edit the file -- change the IP address at the end to be the IP address of the F5OS system. Optionally, other certificate fields may also be updated if the new cert should have specific values for them (e.g., commonName, organizationName, localityName, etc.).
    C. Run the following command, to create the two certificate files "ip-san-cert.pem" and "ip-san-key.pem”:

       openssl req -x509 -nodes -days 730 -newkey rsa:2048 -keyout ip-san-key.pem -out ip-san-cert.pem -config ip-san.cnf

2. In the VELOS Partition or rSerie s Hardware UI:
   A. Navigate to the AUTHENTICATION & ACCESS -> TLS Configuration page.
   B. Locate and update the "TLS Certificate" and "TLS Key" text boxes to the new Cert file & Key file, respectively.
   C. The F5OS system will then use this new certificate with its HTTPS services.

Component: BIG-IP Next

Symptoms:
User of BIG-IP Next Central Manager not able to see the alerts sent by upgrade of BIG-IP Next Central Manager.

Conditions:
During upgrade of Central Manager from version 20.0.x to 20.1.x, it may encounter errors.

Impact:
Alerts does not reflect in the 'Global Bell Icon' if there are errors during BIG-IP Next Central Manager upgrade.

1495017 : BIG-IP Next Hostname, Group Name and FQDN name should adhere to RFC 1123 specification

Component: BIG-IP Next

Symptoms:
Hostname, Group Name and FQDN Name used in Global Resiliency feature should be lowercase.

Conditions:
Providing names for above mentioned fields with capital letters causes failure.

Impact:
Group creation or FQDN creation fails when capital letters are used in them.

Workaround:
Always create names with small letters and should adhere to RFC 1123 specification.

1495005 : Cannot create Global Resiliency Group with multiple instances if the DNS instances have same hostname

Component: BIG-IP Next

Symptoms:
The hostname is defaulted and cannot be modified when the hostname is not specified for the BIG-IP Next instances on BIG-IP Next Central Manager

Conditions:
Create a Global Resiliency Group with more than one BIG-IP Next instance with same name.

Impact:
Global Resiliency Group creation fails.

Workaround:
Make sure the hostname is set and unique for the BIG-IP Next instances going to be used in Global Resiliency Group creation.

1494997 : Deleting a GSLB instance results in record creation of GR group in BIG-IP Next Central Manager

Component: BIG-IP Next

Symptoms:
Deleting the BIG-IP instance from the "Infrastructure -> My Instances" will disrupt the Global Resiliency Configuration using those instances.

Conditions:
The issue occurs when an instance is deleted directly while it is being used in a Global Resiliency Configuration.

Impact:
Deleting the instance under these conditions will break the Global Resiliency feature, leading to DNS resolution failure for the GR Group.

Workaround:
Refrain from deleting the instances when they are currently being used in a Global Resiliency Group.

1492705 : During upgrading to BIG-IP Next 20.1.0, the BIG-IP Next 20.1.0 Central Manager failed to connect with BIG-IP Next 20.0.2 instance

Component: BIG-IP Next

Symptoms:
BIG IP Next 20.1.0 Central Manager is managing BIG-IP Next 20.0.2 instances.
When upgrading Next instance from BIG-IP 20.0.2 to BIG-IP 20.1.0, Central Manager failed to connect with the instance.

Conditions:
BIG IP Next 20.1.0 Central Manager managing BIG-IP Next 20.0.2 instances.

Impact:
Connection to BIG-IP Next instances fails.

Workaround:
Following is the workaround:

1. Start with BIG-IP Next Central Manager of 20.0.2 managing BIG-IP Next 20.0.2 instances
2. Upgrade Next instances of 20.0.2 version to 20.1.0 version
3. Upgrade Central Manager from 20.0.2 version to 20.1.0 version.

Component: BIG-IP Next

Symptoms:
Deployment fails for a migrated application service that is marked green (ready for deployment.

Conditions:
During application migration, upload a UCS with a virtual server that has clientssl profile attached that points to a cert/key pair with RSA 512 OR 1024 key (unsupported).

Complete the migration and pre-deployment process, and deploy the application service.

Impact:
The application service will not have a deployment location option and can only be saved as a draft.

Component: BIG-IP Next

Symptoms:
After upgrading from BIG-IP Next version 20.0 to 20.0.1, analytic data is not restored.

Conditions:
After upgrading from BIG-IP Next version 20.0 to 20.0.1.

Impact:
Analytics data is not automatically restored after upgrading and cannot be restored manually.

Component: BIG-IP Next

Symptoms:
BIG-IP Next Central Manager will become out of sync with a managed BIG-IP Next instance if you perform licensing actions directly to the BIG-IP Next instance.

Conditions:
Add a BIG-IP Next instance to BIG-IP Next Central Manager. Perform licensing actions directly on the BIG-IP Next instance.

Impact:
BIG-IP Next Central Manager is no longer synchronized with its managed instance.

1350285-1 : Traffic is not passing after the tenant is licensed and network is configured

Component: BIG-IP Next

Symptoms:
After configuring and licensing the BIG-IP Next tenant, such as after an upgrade, traffic is not passing.

Conditions:
A BIG-IP Next tenant is configured without vlans, and a /PUT to create the L1 networking interface is performed; and then vlans are later allocated to the tenant. In this scenario, the (later-) allocated vlans will not take effect for the previously configured L1 network interface.

Impact:
Data traffic associated with the later-added vlans will not be processed.

Workaround:
Workaround is to allocate vlans to the BIG-IP Next tenant before the /PUT call to create the L1 network interface; at which point the L1 network interface will be associated with a vlan allocated to that BIG-IP Next instance.

1329853-1 : Application traffic is intermittent when more than one virtual server is configured

Component: BIG-IP Next

Symptoms:
After deploying an application containing multiple virtual servers, only one of the virtual servers responds to clients.

In the Central Manager GUI, one virtual server is marked as red and the other is marked as green, even though you can ping all of the pool members for each of the virtual servers.

Conditions:
-- The application contains multiple virtual servers
-- The virtual addresses for each of the virtual servers is identical and the port is identical

Alternatively, you could encounter this by deploying two different applications where the virtual address and port are identical.

Impact:
The application will deploy without error even if an IP address/port conflict occurs, and traffic will be disrupted to one or both of the virtual addresses.

Workaround:
Assign different virtual addresses and/or virtual ports for different application services. If any two existing applications has same listeners defined, you can change the data by adding unique listeners and re-deploy.

1326385 : Floating self-IP address for a BIG-IP Next HA instance

Component: BIG-IP Next

Symptoms:
Traffic does not pass to a newly-created BIG-IP Next HA instance.

Conditions:
When you do not use the existing floating self IP address when creating a BIG-IP Next HA instance and instead specifying the existing floating self-IP in the "Active Node IP Address" or "Standby Node IP Address" fields.

Impact:
Creation of the BIG-IP Next HA instance appears successful, but traffic does not flow.

Workaround:
Always assign the existing floating self IP as the "Floating IP Address".

1325769 : VLANs with a blank tag cannot be used to create a BIG-IP Next instance

Component: BIG-IP Next

Symptoms:
Creation of a BIG-IP Next HA instance fails.

Conditions:
1. From BIG-IP Next Central Manager, navigate to Infrastructure > My Instances > Start adding instances > Create a new instance
2. When you reach the Networking page add VLANs but leave the tags blank.
5. Continue creating the instance then Deploy.

Impact:
Creation fails with an error saying the tag must be an integer.

Workaround:
Instead of leaving the tag blank, use the number 0 to represent an untagged VLAN.

Component: BIG-IP Next

Symptoms:
After a BIG-IP Next HA instance fails over to the standby node, L3 network validation fails with the following error:

Validating L3 networks failed due to VLAN duplication.

Conditions:
BIG-IP Next HA instance fails over to the standby node.

Impact:
You cannot send a new config due to a configuration error.

1321417-1 : Cannot use WAF modules on VELOS on deploying tenant with 10 CPUs

Links to More Info: BT1321417

Component: BIG-IP Next

Symptoms:
Cannot use WAF functionality on a BIG-IP Next tenant installed on VELOS when the number of CPUs assigned to tenant is not one of these values: 4, 8, 12, 18, 22.

Conditions:
Install a BIGIP-Next tenant on VELOS with an unsupported CPU core count. Supported CPU values are [4, 8, 12, 18, 22].

Impact:
Cannot configure WAF policies for a BIG-IP Next tenant.

Workaround:
Install a BIG-IP Next tenant with CPUs of the following values: [4, 8, 12, 18, 22 ]

1306997 : Deselecting the Tagged Interface when creating a BIG-IP Next HA instance on VELOS causes an error

Component: BIG-IP Next

Symptoms:
If you deselect the Tagged Interface for the Data Plan VLAN when creating a BIG-IP Next HA instance on VELOS, you get an error.

Conditions:
Configure a BIG-IP Next HA instance on VELOS and deselect the Tagged Interface for the Data Plane VLAN.

Impact:
Submitting this invalid task will result in an error.

Workaround:
Always select the Tagged Interface when creating a BIG-IP Next HA instance on VELOS.

Component: BIG-IP Next

Symptoms:
Unable to filter or sort create instance tasks on the My Instances page.

Conditions:
Navigate to Infrastructure > Instances screen. Create instance tasks that were performed in the last 15 minutes display.

Impact:
Running/failed create instance tasks from the last 15 minutes always appear at the bottom of the My Instances page.

1294137 : BIG-IP Next HA instance creation fails

Component: BIG-IP Next

Symptoms:
BIG-IP Next HA instance creation fails if you select more than one floating IP address for a Traffic VLAN.

Conditions:
Selecting more than one floating IP address for a Traffic VLAN when creating a BIG-IP Next HA instance.

Impact:
BIG-IP Next HA creation fails.

Workaround:
Select only one floating IP address for a Traffic VLAN when creating a BIG-IP Next HA instance.

Component: BIG-IP Next

Symptoms:
After removing a BIG-IP Next instance from BIG-IP Next Central manager, certificates found on applications associated with the deleted instance cannot be removed successfully from BIG-IP Next Central Manager.

Conditions:
1.Install the certificate on BIG-IP Next Central Manager.
2.Create application with template that supports certificates.
3.Deploy the application to a BIG-IP Next instance.
4.Remove the BIG-IP Next instance from BIG-IP Next Central Manager (associated applications are removed from the My Apps page on the BIG-IP Next Central Manager, but still exist on the BIG-IP Next instance).
5.Try to remove the deleted certificate directly from the BIG-IP Next Central Manager.

Impact:
Trying to delete a certificate used by an application hosted on a BIG-IP Next instance and then deleted from the BIG-IP Next Central Manager will not be successful.

1291473 : Creating a BIG-IP Next HA instance with instances that have deployed applications

Component: BIG-IP Next

Symptoms:
If you create a BIG-IP Next HA instance from existing BIG-IP Next instances with deployed applications, BIG-IP Next Central Manager removes the applications from the standby BIG-IP Next instance with or without a warning message. In addition, BIG-IP Next Central Manager might not display previously configured VLANs for selection.

Conditions:
Create a BIG-IP Next HA instance with existing instances that have deployed applications.

Impact:
BIG-IP Next Central Manager deletes the applications to the standby BIG-IP Next instance in the BIG-IP Next HA configuration and does not display previously configured VLANs for selection.

Workaround:
To work around this, click "Previous" during the workflow to create a BIG-IP Next HA instance to return to the previous step, then press "Next" again. The VLANs display properly, allowing you to select them.

1286181-1 : Add a service with Transport Layer Security (TLS), but one or more of the certs is missing or invalid

Component: BIG-IP Next

Symptoms:
Successfully add a new service to the BIG-IP Next configuration, but no logs are created.

Conditions:
Add a service that includes TLS, but the certificate, private key, or root certificate authority is missing or invalid.

Impact:
Users might be confused with the newly added service, because it appears to have been added to the BIG-IP Next configuration. But the service is not added to the otel config and no otel telemetry service is created. Therefore no logs are exported.

Component: BIG-IP Next

Symptoms:
When you open the application properties screen and select the Endpoints (Pool Members) tab, the Endpoints grid does not appear.
Note that the grid appears correctly when you open the application properties screen for an application that uses the HTTPS-Load-Balancing-Service template.

Conditions:
Create an application on BIG-IP Next Central Manager using any template other than HTTPS-Load-Balancing-Service.

Impact:
The endpoints grid is not shown under "Endpoints (Pool Members)" section for the application's details.

1235089 : Selected signatures for cookies are not added to overriden signature section

Component: BIG-IP Next

Symptoms:
When creating a cookie with overridden signatures from BIG-IP Next Central Manager, the signatures are not included in the overridden signatures list when the cookie is created.

Conditions:
Create a WAF policy cookie with an override signature list from BIG-IP Next Central Manager.

Impact:
The overridden signature list for the cookie are not included.

Workaround:
1) From BIG-IP Next Central Manager, create a cookie without the signature override. After the cookie is created, edit the cookie to add signatures.

2) Manually create a cookie with signature overrides.

Component: BIG-IP Next

Symptoms:
Multiple stacks can be included in an application. The name should only need to be unique for a specific type in that application. However, if the name is not unique in that application (regardless of the type), it triggers application errors.

Conditions:
Send PUT request to the /applications endpoint to create an application with two stacks of same name but different types:

{
        "name": "App_1",
        "description": "web server for f5-2",
        "domainName": "www.f5-2.com",
        "stacks":[
            {
                "stackType": "HttpRevProxy",
                "name": "st1"
            },
            {
                "stackType": "HttpSimpleProxy",
                "name": "st1"
            }
        ]
}

Impact:
The request is rejected.

Links to More Info: K000138849

Component: BIG-IP Next

Symptoms:
When upgrading BIG-IP Next software, you must use the UUID of the file that is returned by file upload API (step 1 of the upgrade process), instead of the actual name of file uploaded.

Conditions:
Upgrading a BIG-IP Next instance using the PUT PUT /upgrade endpoint.

Impact:
Do not use the actual file name. Use the name returned by the upload file's API.

Workaround:
In the PUT /upgrade API, for the field 'fileName' use the name returned by upload file's API.

For additional support resources and technical documentation, see:

The F5 Networks Technical Support website: http://www.f5.com/support/
The MyF5 website: https://my.f5.com/manage/s/
The F5 DevCentral website: http://devcentral.f5.com/

******************************************************

Previous Next