F5 Insight 2.0.0 release notes

Release notes for F5 Insight 2.0.0, the on-premises observability and operational strategy solution for F5 Application Delivery and Security Platform.

Version 2.0.0 | October 2026

Product F5 Insight
Version 2.0.0
Release date October 2026
Deployment model On-premises / self-hosted
Document revision 2.0.0

About this release

F5 Insight 2.0.0 is a feature release.

System requirements

Host platform

Component Requirement
Operating system F5-supported image
Architecture x86_64 (AMD64)
CPU Minimum 12 vCPUs
Memory Minimum 16 GB RAM
Storage 650 GB overall single volume storage. 100 GB for OS; 50 GB for backup and restore; 500 GB minimum for default telemetry retention policy
Hypervisor images QCOW and OVA

Managed BIG-IP devices

Component Requirement
BIG-IP version 17.1.x, 17.5.x and 21.1.x
Modules Local Traffic Manager (LTM) required; DNS, Advanced Web Application Firewall (AWAF), Advanced Firewall Manager (AFM), Access Policy Manager (APM), Carrier-Grade NAT (CGNAT), and SSL Orchestrator (SSLO) supported
Management access iControl REST API enabled; HTTPS reachable from F5 Insight host
Telemetry iRule High-speed logging (HSL) enabled; syslog reachable from collector listener

Highlighted features

  1. Post-quantum cryptography (PQC) dashboard

    Review BIG-IP software support, Client SSL profile configuration, and observed client use of post-quantum cryptography (PQC). The read-only assessment helps you identify readiness gaps across devices and virtual servers without changing BIG-IP configuration. See Post-Quantum Readiness.

  2. AI Chat telemetry queries (early access)

    Ask AI Chat questions about BIG-IP metrics in VictoriaMetrics and logs in the supported ClickHouse tables, irule_logs and sslo_logs. Telemetry Query Model Context Protocol (MCP) Tools discover available telemetry and query the relevant source to answer your question. Answers depend on collected telemetry, and results may be partial when query limits are reached. The tools don’t provide access to administrative settings, passwords, or licenses.

    This early access feature is on by default in new installations. Administrators can change AI Chat Telemetry Query Tools under Settings > About > Manage features.

  3. Telemetry export destinations

    Export telemetry to Splunk HTTP Event Collector (HEC) or Datadog, or send selected log types to an external ClickHouse database. Configure destinations and test their connections from System Management > F5 Exporter.

  4. Metrics opt-out

    Stop or resume scheduled BIG-IP metrics collection for all devices in your F5 Insight deployment. Collection is on by default, and the setting persists across collector restarts. Turning collection off doesn’t remove devices or turn off AI Data Fabric (AIDF) integration. Historical metrics remain available according to retention policies. Resuming collection doesn’t backfill the period when collection was off.

    Changes take effect after the collector restarts, which can briefly interrupt other telemetry pipelines. A successful save doesn’t confirm that the restart completed. Verify collection behavior after the restart.

  5. Improved LDAP flow for Active Directory

    Configure LDAP authentication with Microsoft Active Directory (AD) and map directory groups to F5 Insight roles. F5 Insight resolves groups from the user’s memberOf attribute, so AD groups don’t need to be under ou=groups. Role mappings use the exact, case-sensitive group common name (CN), such as Domain Admins. For configuration details, see External authentication and role-based access control.

  6. Local user accounts

    Create and manage local user accounts for people who sign in to the F5 Insight UI, and assign users Admin, Operator, or Viewer roles. Local user accounts are for UI access; use machine users for API-only access. See Local authentication and role-based access control.

  7. Machine users for API access

    Create service identities for API and automation access without an interactive user login. Machine users authenticate with a client_id and client_secret using the OAuth 2.0 client_credentials grant. See Machine users.

  8. BIG-IP and F5OS license management

    Manage registration key pools for BIG-IP Virtual Edition (VE) instances, including license assignment, reassignment, revocation, and reactivation. Reactivate BIG-IP and F5OS licenses from individual instances, dedicated automation jobs, or software installation jobs. License management requires Administrator access. License reactivation interrupts instance traffic and also affects guests and tenants on F5OS hosts or vCMP hosts.

  9. Switch an F5 Insight license

    Use Edit License > Switch License to replace an active or expired trial or paid license with a paid license on the same instance. You don’t need to deactivate the current license or wait for an active trial to expire. Switching preserves connected or disconnected mode. In disconnected mode, complete the report exchange and verify the signed acknowledgement returned by F5 licensing services. Switching to a trial license isn’t supported.

  10. Forward proxy support for licensing and AI Chat

    Configure an outbound forward proxy for F5 Insight licensing, BIG-IP license activation, and AI Chat services. You can select which supported services use the proxy. See Configure an outbound forward proxy.

  11. BIG-IP and F5OS instance backup

    Backup BIG-IP TMOS (UCS) and F5OS-A (rSeries) configurations across your fleet from a single console. Create on-demand or scheduled backup jobs, configure encryption and retention policies, and store backup files locally on F5 Insight or on a remote NFS or SMB share. Backup jobs also integrate with software installation jobs, so you can capture a pre-upgrade backups automatically.

  12. BIG-IP and F5OS instance restore

    Restore a BIG-IP or F5OS-A device configuration from any available backup file stored in F5 Insight. Select a backup file, choose the target device, configure restore behavior options (such as retaining the master key for encrypted objects or preserving the management IP address), and run pre-flight readiness checks before executing.

  13. Software installation rollback

    Rollback BIG-IP TMOS and F5OS-A (rSeries) instances to their previous software version directly from F5 Insight after a software installation job. Rollback targets devices that reached the reboot phase during installation, reverting BIG-IP devices to their previous boot volume and F5OS-A devices using the platform’s built-in rollback mechanism. Rollback inherits the HA sequencing and failover behavior of the original installation run.

  14. Software distribution — Remove unused images

    Automatically clean up software images on target instances during a distribution job. When Remove unused images is enabled, F5 Insight deletes images that are neither currently running on the instance nor included in the current distribution job, freeing disk space for future distributions. Both the base ISO and any associated EHFs are taken into account. The pre-flight readiness check includes a Cleanup Preview that lists which images will be removed before the job runs.

    Note: This feature does not apply to vCMP Guests.

  15. Boot BIG-IP into another volume

    Reboot a BIG-IP device into any of its available inactive boot volumes directly from F5 Insight, without requiring console or SSH access to the device. This supports rollback to a previous software version or activation of a volume prepared but not yet booted. Optionally carry forward the active volume’s configuration onto the target volume before rebooting.

  16. BIG-IP and F5OS license management

    Manage registration key pools for BIG-IP Virtual Edition (VE) instances, including license assignment, reassignment, revocation, and reactivation. Reactivate BIG-IP and F5OS licenses from individual instances, dedicated automation jobs, or software installation jobs. F5 Insight acts as the intermediary for all communication with the F5 licensing server. License re-activation is handled in software installation jobs, which is critical for minor version upgrades, where the License Check Date and Service Check date must be in good standing for the upgrade to succeed.

  17. Minor version software upgrades

    Install software updates across minor BIG-IP TMOS versions (for example, 17.1.x to 17.5.x) using the same software installation job workflow. Minor version upgrades may require license reactivation — F5 Insight handles all communication with the F5 licensing server automatically as part of the installation job, provided that it has egress access to the internet. The License Re-activation setting in the software installation job controls when reactivation occurs: reactivate all instances, reactivate only when the license is expired or the service check date has passed, or skip reactivation entirely.

  18. Example Amazon Web Services deployment guide

    An example deployment guide for Amazon Web Services (AWS) is available. See the AWS deployment guide for details.

    F5 documents and tests deployment patterns for the kernel-based virtual machine (KVM) and VMware ESXi. F5 supports AWS deployments that meet documented F5 Insight requirements. F5 has not formally qualified the AWS deployment pattern.

    The same approach applies to KVM-based platforms such as Nutanix. F5 expects these platforms to meet the documented KVM requirements. F5 may not independently validate platform-specific configurations.

    When relevant to troubleshooting, F5 may ask whether you can verify an issue on a documented Proxmox or OpenStack KVM deployment. If an issue appears specific to the underlying cloud platform or hypervisor, F5 may require you to work with the platform vendor. F5 may also ask you to validate the issue on a documented KVM or VMware ESXi deployment.

    Platform-specific qualification, compatibility assurances, and feature guarantees apply only where explicitly documented.

Fixed issues

This section details the bugs and issues resolved in this release.

  1. Upgrade or rollback can fail if the appliance reboots during the Helm install phase

    Previously, if an unexpected reboot occurred while an upgrade was applying the new software (the Helm install/upgrade phase), the automatic rollback could itself fail. This left the appliance in a partially upgraded, inconsistent state that required manual intervention or a VM snapshot restore to recover.

    Now, the upgrade and rollback process is more resilient to unexpected reboots during the Helm install phase. If this situation occurs, the appliance automatically recovers the application deployment to a known-good state. Upgrade recovery after an interruption is also faster and more reliable.

  2. F5 Insight support bundle collection of /var/log might be interrupted by journal file change

    Previously, support bundle collection on an active production system might collect only a partial /var/log directory. The collection script treated tar exit code 1 as a fatal error, even though this code is commonly returned as a non-fatal warning when log files change while being archived. As a result, the script fell back to partial collection and could omit important logs, including rotated journald (.journal) files.

    Now, the collection script correctly handles tar exit code 1 as a non-fatal warning. Support bundles generated on active production systems include the complete /var/log directory, including actively written logs and rotated journald files.

  3. Preview checks report false disk space errors on BIG-IP i15k DF devices with MD-type volumes

    Previously, preview checks incorrectly reported insufficient disk space errors on BIG-IP i15k DF devices that use MD-type volumes, even though sufficient space was available. The installation completed successfully when performed manually.

    Now, preview checks correctly calculate available disk space on BIG-IP i15k DF devices with MD-type volumes.

    This issue occurs with both target volume options:

    • Sequential new volume: The preview check returns an error similar to: insufficient VG free space for new volume "MD1.3". 0.00 GB available 15 GB required - delete an unused volume slot to reclaim space before creating a new one.
    • Existing volume: The preview check returns an error similar to: VG free space 0.00 GB is below the 2 GB recommended buffer for in-place upgrade of "MD1.1" - the upgrade may fail if VM needs to expand existing logical volume.

  4. Software upgrade status might report as complete before the second reboot on iSeries DF devices

    Previously, when you performed a software installation on an iSeries DF device, F5 Insight intermittently marked the upgrade as complete after the first reboot, while the upgrade was still in progress. iSeries DF devices reboot twice during an upgrade.

    Now, F5 Insight correctly waits for the second reboot to complete before marking the upgrade as finished.

  5. External authentication with Active Directory can only assign a user to a Viewer role

    Previously, F5 Insight’s LDAP group search required groups to exist under ou=groups,<baseDN>. Directories that didn’t use this layout, including Active Directory, resolved no groups, and affected users defaulted to the Viewer role.

    Now, F5 Insight resolves Active Directory groups from the user’s memberOf attribute so that users receive their mapped roles. Directories without memberOf groups continue to use the OpenLDAP-style group search. If neither lookup resolves groups and the group search base does not exist, a warning identifies the missing search base and the unsuccessful memberOf lookup.

  6. Active Directory connection validation can stall on LDAP referrals

    Previously, Test Connection could stall when searches under the AD domain root returned LDAP referrals.

    Now, connection validation and runtime LDAP group lookup suppress referral continuations. LDAP operations also have a 30-second timeout so that a stalled operation returns an error instead of waiting indefinitely.

  7. External users receive Viewer access when no role is found

    Previously, external authentication automatically assigned the Viewer role when no role was found.

    Now, access is blocked instead, and the UI displays an error. This change applies to LDAP, AD, and SAML authentication. To grant read-only access, explicitly map a group to Viewer. See External authentication and role-based access control.

  8. Disk space check might report inaccurate results for F5OS appliances upgraded from version 1.5.2 or earlier

    Previously, the disk space check in F5 Insight might report inaccurate results for F5OS appliances upgraded from version 1.5.2 or earlier, which could cause upgrade failures.

    Now, the disk space check correctly reports available space on these appliances.

  9. Large-scale concurrent distribution and installation jobs fail on BIG-IP version 21.1.0

    Previously, running large-scale concurrent distribution and installation jobs on BIG-IP version 21.1.0 could cause timeout and resource contention issues, resulting in intermittent distribution and installation failures.

    Now, these jobs complete without the timeout and resource contention issues.

  10. HA software installation execution drawer doesn’t reflect paused state during subsequent HITL pause

    Previously, during an HA software installation job with multiple Human-in-the-Loop (HITL) pause gates, the execution details drawer might continue to show “Executing” after a subsequent pause gate was reached. The drawer didn’t display the paused banner or the Resume button until you refreshed the view.

    Now, the execution details drawer correctly updates to show the paused state and Resume button when a subsequent pause gate is reached.

  11. Provisioning and system-manager retain stale Vault client certificate after rotation

    Previously, provisioning and other operations that required securely stored credentials could fail after an internal authentication certificate expired, even when a replacement certificate had been generated. Affected services continued using the previous certificate until restarted.

    Now, affected services use the replacement certificate after rotation, preventing failures caused by a stale Vault client certificate.

  12. Incorrect overall status on Anomaly Detection detail pages

    Fixed an issue where Anomaly Detection detail pages could incorrectly display Good while the corresponding System Report Card indicated Critical. The overall status calculation now correctly uses the total number of monitored devices, virtual servers, or pools. This correction applies to Connection Count Deviation, CPU Deviation, Memory Deviation, and Pool Availability Deviation.

  13. BIG-IP devices with perpetual licenses incorrectly displayed as inactive

    Fixed an issue where F5 Insight incorrectly displayed the license status of BIG-IP devices or tenants with perpetual (non-expiring) licenses as Inactive on the Home page. License collection now correctly recognizes licenses that have a registration key but no expiration date and reports their status as Active.

  14. Disconnected licensing fails when the telemetry report is too large

    Fixed an issue where disconnected licensing could fail with the error “Request body exceeds the maximum allowed” when submitting a large license telemetry report to the F5 licensing service. Telemetry report generation now limits the amount of storage-usage data included in each report and carries remaining data forward to subsequent reports.

  15. Software upgrade readiness check may incorrectly report sufficient disk space on BIG-IP devices with multiple provisioned modules

    The software upgrade readiness check now dynamically calculates the required disk space based on the target BIG-IP device’s actual configuration. The calculation accounts for per-boot-location application volumes (example, MySQL for ASM/AFM/APM), provisioned module disk allocations, actual /config and /var directory sizes, and a configurable safety buffer. This replaces the previous static 15 GB threshold.

  16. Password-protected private key support

    Fixed an issue where importing a password-protected private key could make the F5 Insight web UI inaccessible. Certificate import now decrypts the key using the supplied passphrase before storing it for TLS use.

    `bash sudo f5insight-device-cert import-cert \ --cert-file /path/to/certificate-chain.crt \ --cert-key /path/to/encrypted-private.key \ --key-passphrase '<private-key-passphrase>' `

    Note: The imported key is stored without passphrase encryption. For safer passphrase entry, omit –key-passphrase to use the interactive prompt.

  17. Policy dropdown scoped to the selected BIG-IP:

    Fixed an issue where the policy dropdown displayed policies from all BIG-IP devices. It now displays only policies associated with the selected device.

    Known Limitation:

    Deleted policies may remain in the dropdown until the next day: The policy dropdown uses metrics collected during the current day. Policies deleted from a BIG-IP device may therefore remain listed for the rest of that day and are automatically removed when the day rolls over. This affects dropdown visibility only; the device’s actual policy configuration and related security data elsewhere in the dashboard remain accurate.

Known issues

  1. SAML single logout (SLO)

    SAML Single Logout (SLO) is a known limitation in this release. Logging out of F5 Insight might terminate your F5 Insight session, while the Identity Provider (IdP) session can stay active, allowing re-login without re-authentication.

    Workaround: To make sure you fully log out, do one of the following:

    • Use a private or incognito browser window for SAML sessions.
    • Explicitly log out from the IdP after logging out of F5 Insight.

  2. IdP group sync

    When user group or profile attributes are changed in an external IdP (SAML/OIDC, for example, Okta or Ping), those updates might not be synchronized to the existing user record in F5 Insight on subsequent logins. As a result, previously assigned groups in F5 Insight can persist (for example, admin group remains after change to operator group in IdP).

    Workaround: Re-create the SAML IdP provider configuration in F5 Insight after IdP group changes are made.

  3. LDAP + StartTLS isn’t functional with a custom CA certificate

    Runtime LDAP login fails when the identity provider is configured for LDAP with StartTLS and a custom CA certificate. Backend certificate validation accepts the custom CA, but the current identity management component doesn’t apply it during a StartTLS login attempt.

    Workaround: Use LDAPS instead of LDAP + StartTLS for custom CA deployments. If your environment requires StartTLS, apply the workaround script described in Workaround: apply a custom CA for StartTLS.

  4. License reactivation job displays stale “No License” status for newly licensed devices

    When you create a license reactivation job in Automation > Jobs > Re-activate License, a BIG-IP device that was previously unlicensed continues to show a license type of “No License” in the instance selection table, even after a license has been activated on the device. The job creation wizard does not include a refresh option at the instance selection level, so the stale status causes readiness checks to fail with the following error:

    Failed Readiness Check: One or more selected instances have blocking readiness issues.

    Condition: This issue occurs when all of the following are true:

    • A BIG-IP device is onboarded to F5 Insight in an unlicensed state.
    • A valid license is subsequently activated on the device (through F5 Insight or directly on the BIG-IP).
    • You navigate to Automation > Jobs > Add Job > Re-activate License and select the device.

    Impact: You can’t save or execute the license reactivation job for newly licensed devices through the user interface (UI) because the stale license status blocks the readiness check.

    Workaround: Call the device refresh API to update the cached license status:

    curl -X POST /api/v1/fleet/licensing/reactivate/devices/{deviceId}/refresh \
  -H "Authorization: Bearer <TOKEN>" \
  -H "Content-Type: application/json"

    After the request completes, reopen the license reactivation job wizard. The device displays its updated license status and passes the readiness check.

  5. Add-on keys that are already activated are silently ignored during base key activation

    When you activate a base registration key with add-on keys, any add-on key that is already activated is ignored without an error or notification. The F5 license server does not return a message indicating that the add-on key was skipped.

    Impact: You receive no feedback that an add-on key was already activated and was not applied during the activation request.

    Workaround: None. Verify that your add-on keys are not already activated before including them in an activation request.

  6. Reactivating a deleted registration key offering requires a 10-minute wait

    After you delete a license offering from a Registration Key Pool and attempt to reactivate the same key, the activation does not complete immediately. The F5 license server requires approximately 10 minutes to process the deletion before the key can be reactivated. This is expected behavior from the license server.

    Condition: You delete a license offering from a Registration Key Pool and immediately attempt to reactivate the same registration key.

    Impact: The reactivation request fails if submitted within 10 minutes of the deletion.

    Workaround: Wait at least 10 minutes after deleting a license offering before reactivating the same registration key.

  7. F5OS-A restore allows selection of unsupported target devices

    When you restore an F5OS-A device from a backup, the device selection step does not enforce that the target device must match the original device (by IP address). You can select an unsupported device, which may cause the restore to fail.

    Condition: This issue occurs during device selection in an F5OS-A restore workflow.

    Impact: You can select a device that is not compatible with the backup, which may cause the restore to fail or produce unexpected results.

    Workaround: Manually verify that you select the correct F5OS-A device (matching the original device’s IP address) before starting the restore. Target device validation is planned for F5 Insight 2.1.0.

  8. Saved AI Data Fabric (AIDF) endpoint change does not take effect until AIDF is toggled

    When you save a new AI Data Fabric (AIDF) endpoint in F5 Insight, the UI confirms the change and updates the configuration, but F5 Connector continues exporting data to the previous endpoint. This occurs because the F5 Insight backend reloads the F5 Connector configuration before the updated configuration file is mounted by the container runtime (which can take 35 to 65 seconds).

    Impact: AIDF data continues to flow to the previous endpoint until F5 Connector is reloaded with the updated configuration.

    Workaround: After saving the new AIDF endpoint, disable AIDF and then re-enable it with the new endpoint. This forces F5 Connector to reload with the updated configuration.

  9. License offering operations require a two-minute wait between revoke or reassign and the next operation

    After you revoke or reassign a license offering, you must wait approximately two minutes before performing another license operation on the same BIG-IP device. If you proceed immediately, F5 Insight returns the following error:

    Failed to assign registration key. Device is unavailable: the device may be restarting or overloaded.

    This occurs because BIG-IP restarts its licensing services after a revoke or reassign operation, and the device is temporarily unavailable.

    Condition: You perform a license revoke or reassign operation and then immediately attempt another license operation (such as assignment) on the same BIG-IP device.

    Impact: The subsequent license operation fails with a “device is unavailable” error.

    Workaround: Wait at least two minutes after a revoke or reassign operation before performing another license operation on the same device. This allows the BIG-IP licensing services to fully restart.

  10. License revoke fails when a device becomes unreachable after assignment

    When a BIG-IP device that has an active license assignment is deleted from the infrastructure (for example, removed from OpenStack) or becomes unreachable, F5 Insight can’t complete a standard license revocation. The Registration Key Pool retains the device as a member and shows the registration key as active and assigned.

    Condition: A BIG-IP device with an active license assignment becomes unreachable or is removed from the infrastructure after the license was assigned.

    Impact: You can’t revoke the license through the UI or reassign it to another device. The registration key remains in an assigned state.

    Workaround: Use the force revoke API to release the license assignment:

    curl -X DELETE "https://<F5_INSIGHT_HOST>/api/v1/fleet/licensing/tmos/pool/licenses/assignments/<ASSIGNMENT_ID>/revoke?force=true" \
  -H "Authorization: Bearer <TOKEN>" \
  -H "Content-Type: application/json"

    Replace the following values:

    • <F5_INSIGHT_HOST> — the IP address or hostname of your F5 Insight appliance
    • <ASSIGNMENT_ID> — the ID of the license assignment to revoke
    • <TOKEN> — a valid API authentication token

    After the force revoke completes, the registration key returns to an unassigned state and can be assigned to another device.

  11. F5OS backup returns an incorrect error code when unsupported options are included

    When you create a backup as part of a software installation job for an F5OS device and include the includePrivateKeys or retainMasterKey options in the backup configuration, F5 Insight returns a 500 Internal Server Error instead of a 400 Bad Request. F5OS devices do not support these options.

    Condition: You enable backup in a software installation job for an F5OS device and include includePrivateKeys or retainMasterKey in the backup configuration payload.

    Impact: The backup fails with an unexpected 500 Internal Server Error instead of a clear 400 Bad Request validation error. The error message does not indicate that the options are unsupported for F5OS devices.

    Workaround: Do not include includePrivateKeys or retainMasterKey in the backup configuration when the target device is an F5OS device. These options are supported for BIG-IP devices only.

  12. BIG-IP UCS backup fails with permission denied error

    When F5 Insight initiates a UCS backup on a managed BIG-IP device, the backup fails with a Permission denied error from the configsync pre-save and post-save scripts. This is a BIG-IP TMOS issue, not an F5 Insight issue.

    Condition: The managed BIG-IP device is running TMOS v21.1.1.

    Impact: The backup fails and F5 Insight doesn’t create a UCS archive.

    Workaround: Create the backup directly on the BIG-IP device rather than through F5 Insight. A fix is planned for a future TMOS release.

  13. The admin username always receives the Admin role

    F5 Insight always assigns the Admin role to the username admin, including accounts from an external identity provider. Remote role mappings don’t override this behavior.

    Impact: You can’t assign Operator or Viewer to an external account named admin.

    Workaround: If there’s any risk of username collisions, don’t use local and external users together. Keep external usernames distinct from all local usernames, including admin. For Active Directory, the full user principal name (UPN) is a workaround to avoid collisions with local usernames. Verify that the UPN doesn’t match a local username. See LDAP authentication.

  14. Reset Password appears for external users

    Reset Password appears for all users, including users who authenticate through an external identity provider.

    Impact: The option appears for external users, but password resets apply only to local users.

    Workaround: Manage external passwords through your identity provider, not through Reset Password in F5 Insight.

  15. Username collisions prevent local user management

    When a local and an external username collide, you can no longer manage the local user. For example, after an external admin login, the local admin account disappears from the user list.

    Impact: You can’t manage the affected local user or reset the local user’s password.

    Workaround: If there’s any risk of username collisions, don’t use local and external users together. For Active Directory, a full UPN that differs from every local username is a workaround. See Known authentication issues.

  16. BIG-IP license reactivation fails with ``Not a valid F5 License`` error

    When F5 Insight reactivates a BIG-IP license through the BIG-IP Licensing Registration API (/mgmt/tm/shared/licensing/registration), the request fails with a 400 Bad Request error and the message Not a valid F5 License. The same license text can be applied successfully through tmsh or by updating the bigip.license file and reloading the license directly on the device.

    Condition: The BIG-IP device’s restjavad service is in an inconsistent state that causes the licensing API to reject valid license text.

    Impact: Automated license reactivation workflows through F5 Insight fail. Manual intervention on the affected BIG-IP device is required.

    Workaround: Connect to the affected BIG-IP device using SSH and run the following command:

    bigstart restart restjavad

    After the service restarts, retry the license reactivation from F5 Insight.

  17. BIG-IP devices may boot into the previous volume during scale upgrades

    During large-scale upgrades initiated from F5 Insight, some BIG-IP devices may reboot into the previously active volume instead of the newly upgraded volume. The software installation completes successfully, but the device boots into the wrong volume, causing F5 Insight to report the upgrade as failed. This issue is intermittent.

    Condition: Observed during large-scale upgrade operations when multiple BIG-IP devices are upgraded and rebooted through F5 Insight.

    Impact: Some devices boot into the previous software version instead of the newly upgraded version. F5 Insight reports the upgrade as failed even though the software was installed successfully.

    Workaround: After the upgrade reboot, verify the active software version on the affected device. If the device booted into the previous volume, retry the upgrade from F5 Insight. Because the issue is intermittent, the upgrade typically succeeds on a subsequent attempt.