AskF5 Knowledge Base - Recent Additions and Updates

General Solution: Generating new default certificate and key pairs for the Client SSL profile

Tue, 15 May 2012 15:31:54 -0700

(SOL13579) Purpose You should consider using this procedure under the following condition: The default certificate and key must be regenerated for reasons of functionality or security. Prerequisites You must meet the following prerequisites to use this procedure: Command line access Create a UCS archive prior to beginning this process Note: Although a UCS archive is not required to complete this procedure, F5 recommends that you create a UCS archive as a precaution for recovery purposes. Descripti

Best Practice: Making configuration changes on a redundant pair

Tue, 15 May 2012 14:29:17 -0700

(SOL3295) Following are the general guidelines to use when making a change to a redundant pair. For instructions about specific processes, refer to the TMOS Management Guide for BIG-IP Systems. Backing up your configuration Before you make changes to your redundant pair, you must first back up your current configuration. For specific instructions, refer to the following articles: For BIG-IP version 10.x, refer to SOL11318: Backing up and restoring BIG-IP version 10.x configuration files. For BIG-IP versi

General Solution: Renewing self-signed device certificates

Tue, 15 May 2012 13:40:22 -0700

(SOL7754) Note: The SSL certificate in this Solution is the certificate used by the Configuration utility and is not associated with any certificates used by either the Client or the Server SSL profile. By default, BIG-IP devices use self-signed SSL certificates for access to the Configuration utility. The certificates are valid for one year; they will indicate their expiration when you access the Configuration utility with a web browser. If the device certificate expires, you can still access the Configu

General Solution: Creating an SSL device certificate and key pair using OpenSSL

Tue, 15 May 2012 13:42:19 -0700

(SOL9114) The SSL device certificate is used by an F5 system to identify itself to a requesting F5 client system. For example, the device certificate is used for device-to-device communication processes, such as configsync and big3d. The SSL device certificate is located in the /config/httpd/conf/ssl.crt/server.crt file on the BIG-IP system. The SSL device key is located in the /config/httpd/conf/ssl.key/server.key file on the BIG-IP system. Generating a new self-signed device certificate and private key

Known Issue: Terminal display may be garbled when running the End-User Diagnostic (EUD) on a VIPRION blade

Tue, 15 May 2012 11:22:37 -0700

(SOL9667) The terminal display is garbled if the End-User Diagnostics (EUD)is run on a VIPRION blade that was accessed using the bladectl command. F5 Product Development is currently tracking an enhancement request to allow this functionality as ID 247018 (formerly CR107624). Workaround You must run the EUD on the local console ofa VIPRION blade that is being tested. Note: For information about running the EUD, refer to the End-User Diagnostics release note.

General Solution: Overview of monitoring and alerting rates

Tue, 15 May 2012 09:59:49 -0700

(SOL9962) The Enterprise Manager system generates two general categories of alerts: Enterprise Manager alerts include all alerts concerning local conditions on the Enterprise Manager system Device alerts include all alerts concerning conditions on remote BIG-IP systemsthat are monitored by the Enterprise Manager system Each alert is based on a specific alert condition which is monitored by the Enterprise Manager. Some monitoring tasks are automatically scheduled, and some may be scheduled by the system

General Solution: FirePass hotfix matrix

Tue, 15 May 2012 09:58:38 -0700

(SOL10322) The following table lists the latest available hotfix for the correspondingFirePass release. The hotfixes are available for download at the F5Downloads site, or by clicking the Latest Hotfix link in the table. FirePassRelease Latest Hotfix Article 7.0.0 HF-70-6 SOL13568 6.1.0

General Solution: Using OpenSSL to create CA and client certificates

Tue, 15 May 2012 09:08:44 -0700

(SOL4877) Note: This article assumes that you will use a UNIX workstation on which OpenSSL version 0.9.7 or later is installed. This article has not been tested on Windows workstations equipped with OpenSSL. Creating a CA certificate Create a directory to contain your CA certificate by typing the following command syntax: mkdir <directory> Replace <directory> with the name of the directory that you want to create. For example: mkdir /var/AskF5CA/ Create a private directory in yo

General Solution: UDP health monitor operation

Mon, 14 May 2012 18:13:54 -0700

(SOL6143) The BIG-IP UDP health monitor is designed to work with ICMP Destination Unreachable message responses. When the monitored UDP portis unavailable, andthe monitored hostreturns an ICMP port unreachable message in response to the monitor request, the BIG-IP system immediately marks the resource down. If the monitored host goes down, no ICMP port unreachable messages are sent back and the host remains marked up. For this reason, F5 recommends that you use the UDP monitor in conjunction with a second

General Solution: BIG-IP LTM RAM Cache feature and HTTP Vary header functionality

Mon, 14 May 2012 17:55:07 -0700

(SOL5157) The HTTP Vary header, documented in RFC2616, is set by an origin web server (OWS) and contains request-header information. This information is used to determine whether a proxy server is permitted to reply to a subsequent request without re-validating the content from the OWS. The BIG-IP RAM Cache feature uses the information from the Vary header to cache responses from the OWS. The OWS can include information within the Vary header to determine which resource the server returns in its response.

Release Note: BIG-IP APM version 11.1.0

Mon, 14 May 2012 14:04:41 -0700

This release note documents the version 11.1.0 release of BIG-IP Access Policy Manager. You can apply the software upgrade to systems running software versions 10.x. For a list of supported platforms, see SOL9412: The BIG-IP release matrix. For information about which platforms support which module combinations, see SOL10288: BIG-IP software and platform support matrix.

Known Issue: Simultaneously changing the BIG-IP GTM monitor's timeout and interval values results in the host status changing to a down state

Mon, 14 May 2012 13:45:35 -0700

(SOL10337) Simultaneously changingthe BIG-IP GTM monitor's timeout and interval values results in the host status changing to a down state immediately followed by an up state. This issue is known to occur with large BIG-IP GTM configurations. When this issue occurs, status messages that appear similar to the following example are logged to the /var/log/gtm file: gtmd[6785]: 011ae0f2:1: Monitor instance my_tcp 10.0.0.1:80 UP --> DOWN from gtmd (no reply from big3d: timed out) gtmd[6785]: 011a6006:1: SN

Manual: Configuration Guide for BIG-IP Application Security Manager

General Solution: RTSP traffic may be disrupted after upgrading

Mon, 14 May 2012 11:17:32 -0700

(SOL10869) The RTSP profile Check Source option was added in BIG-IP LTM version 10.0.1, and is enabled by default. When the Check Source option is enabled, the BIG-IP system performs the following tasks: Determines the address from the source field in the Transport header Sets up an ephemeral listener for RTP/RTCP traffic using the address determined from the source field Rewrites the Transport header source field with the virtual server address before sending to the destination Whenyou upgrade to BIG-IP

Known Issue: The BIG-IP WebAccelerator logs a benign warning message when it receives a request containing a Proxy-Connection header

Mon, 14 May 2012 11:31:16 -0700

(SOL10351) When a client sends an HTTP request to the BIG-IP WebAcceleratorthat contains a Proxy-Connection header,therequest completes correctly, but the BIG-IP WebAccelerator logs the following warning message in the /var/log/wa/pvac.log file: WA Warning: Request processing parsed as forward proxy mode but host manager did not find the information required Thiswarning messageis benign, and may be safely ignored. F5 Product Development is tracking this issue as ID 327101 (formerly CR119453). Note: Th

General Solution: Backing up and restoring BIG-IP configuration files (11.x)

Mon, 14 May 2012 10:23:13 -0700

(SOL13132) This article applies to BIG-IP version 11.x. For information about other versions, refer to the following articles: SOL11318: Backing up and restoring BIG-IP configuration files (10.x) SOL3499: Backing up and restoring BIG-IP configuration files (9.x) Purpose You should consider using this procedure when you want to perform either of the following actions: Back up your BIG-IP version 11.0.0 configuration data to a UCS configuration archive Restore your BIG-IP version 11.0.0 configuration dat

General Solution: The BIG-IP Edge Client for Android is unable to read the hardware serial number on some devices

Mon, 14 May 2012 10:00:42 -0700

(SOL13495) On some Android devices, the BIG-IP Edge Client may be unable to read the device hardware serial number. When the device operating system does not supply the serial number to the BIG-IP Edge Client, the BIG-IP Edge Client may display the hardware serial number as unknown. The following devices are known to exhibit this behavior: Samsung Galaxy Tab™ Samsung Galaxy S™ II There may be additional products that exhibit this behavior that F5 has not tested. F5 recommends that users who are affected

General Solution: APM BIG-IP Edge Client SDK

Fri, 11 May 2012 16:13:50 -0700

(SOL13552) This article applies to the BIG-IP APM system. For information about other versions, refer to the following articles: SOL7615: FirePass BIG-IP Edge Client SDK Summary The BIG-IP Edge Client provides an Application Programming Interface (API) for use by third party applications. This API allows you to create customized SSL VPN clients or to provide seamless SSL VPN support to your existing in-house applications. Description Using the BIG-IP Edge Client API, you can create applications that ca

Known Issue: The 'nsck migrate-metadata' command fails when moving metadata to a share on a Windows cluster

Fri, 11 May 2012 15:36:05 -0700

(SOL12720) The nsck migrate-metadata command fails when moving metadata to a share on a Windows cluster. The nsck migrate-metadata command uses the discovered service principal name (SPN) of the Windows cluster instead of the configured SPN of the clustered filer. As a result, the command fails and displays an error message that appears similar to the following example: % ERROR: CIFS_CONNECT_BADNAME8 (41353223): Unable to connect to CIFS share acopiaP_metadata$ on filer at 10.1.20.198; reasons include an

General Solution: Restricting access to the Configuration utility by source IP address (9.x - 10.x)

Fri, 11 May 2012 15:04:58 -0700

(SOL7448) This article applies to BIG-IP version 9.x through 10.x. For information about other versions, refer to the following article: SOL13309: Restricting access to the Configuration utility by source IP address (11.x) You can restrict access to the Configuration utility by the source IP address. To do so,perform one of the following two procedures for theversion of the BIG-IP system that you are running: BIG-IP versions 9.4.2 and later Important: In some versions, the bigpipe httpd allow command do

Known Issue: BIG-IP WebAccelerator may fail to load a configuration after an upgrade to 11.x

Fri, 11 May 2012 13:25:58 -0700

(SOL13577) Description The BIG-IP WebAccelerator system may fail to load a configuration after an upgrade to 11.x. This issue occurs when either of the following conditions is met: You attempt to upgrade BIG-IP WebAccelerator with a configuration that contains a published policy with no nodes You attempt to install a 10.x UCS that contains a configuration with a published policy with no nodes While it is possible to configureapolicy that has no nodes, the policy will not accelerate content and may incur

Known Issue: Multicast failover cannot be configured from the Configuration utility

Fri, 11 May 2012 10:16:33 -0700

(SOL13464) Description You cannot configure a multicast failover address from the Configuration utility. Impact You cannot configure a multicast failover address from the Configuration utility. Symptoms As a result of this issue, you may encounter the following symptom: After you enter a multicast failover address into the Multicast Address field and click update, the system displays error messages in the Configuration utility that appear similar to the following example: Invalid Multicast Address

Known Issue: The symmetric deployment feature is not functional in WebAccelerator version 11.x

Fri, 11 May 2012 09:55:23 -0700

(SOL13561) Description The symmetric deployment feature is not functional in BIG-IP WebAccelerator version 11.x. A symmetric configuration consists of central and remote WebAccelerator systems that have synchronized configurations. With this configuration, users can transparently use the functionality of a WebAccelerator system on another network, across the globe, from both sides of the transaction. Impact Symmetric deployments will no longer function. Symptoms As a result of this issue, you may encounter

Release Note: BIG-IP APM version 10.2.4

Fri, 11 May 2012 09:21:22 -0700

This release note documents the version 10.2.4 release of the Access Policy Manager. To review the features introduced by this release, see New features and fixes in this release. For existing customers, you can apply the software upgrade to systems running versions 10.1.0 or later. For information about installing the software, refer to Installing the software. Note: F5 offers general availability releases and general sustaining releases. For detailed information on our policies, refer to SO

General Solution: Overview of BIG-IP version 10.2.2 cumulative hotfixes

Fri, 11 May 2012 07:19:09 -0700

(SOL13109) F5 has released cumulative hotfixes for BIG-IP version 10.2.2. These hotfixes correct several issues that affect customers running version 10.2.2. The following table lists the rollup hotfixes available for BIG-IP version 10.2.2. The table lists the ID number of the related bug, a link to the corresponding article (if an article exists), and a brief description of the issues that the hotfix resolved: Note: These rollup hotfixes are cumulative; each hotfix contains all fixes included in the previ