Applies To:
Show Versions
BIG-IQ Centralized Management
- 5.2.0
BIG-IQ CM Release Information
Version: BIG-IQ-5.2.0
Build: 5741.0
Known Issues in BIG-IQ CM v5.2.x
Vulnerability Fixes
| ID Number | CVE | Solution Article(s) | Description |
| 625230 | CVE-2016-5195 | K10558632 | Linux privilege-escalation vulnerability (Dirty COW) CVE-2016-5195 |
| 621413 | CVE-2016-6304 | K54211024 | OpenSSL vulnerability CVE-2016-6304 |
| 565221 | CVE-2015-2925 CVE-2015-5307 CVE-2015-8104 CVE-2015-7613 CVE-2015-7872 | K31026324 K94105604 K90230486 | Multiple Linux Kernel vulnerabilities |
| 540056 | CVE-2015-5364 CVE-2015-5366 | K17309 K17307 | Multiple Linux Kernel vulnerabilities |
| 525368 | CVE-2013-2596 CVE-2014-3690 CVE-2014-5471 CVE-2014-5472 CVE-2014-8159 CVE-2014-8884 CVE-2015-1421 | K17199 | Kernel Vulnerabilities |
| 488801 | CVE-2013-2596 CVE-2013-4483 CVE-2014-0181 CVE-2014-3122 CVE-2014-3601 CVE-2014-4608 CVE-2014-4653 CVE-2014-4654 CVE-2014-4655 CVE-2014-5045 CVE-2014-5077 CVE-2014-6410 | K15852 | Kernel Vulnerabilities |
| 480424 | CVE-2014-0205 CVE-2014-3535 CVE-2014-3917 CVE-2014-4667 | K15680 | Kernel Vulnerabilities |
| 640649 | CVE-2016-1669 | K35655050 | CVE-2016-1669 : NodeJS Vulnerability |
| 623155 | CVE-2016-4470 | K55672042 | Linux kernel vulnerability CVE-2016-4470 |
| 622257 | CVE-2016-5829 | K28056114 | Linux kernel vulnerability CVE-2016-5829 |
| 618497 | CVE-2016-2182 | K01276005 | OpenSSL vulnerability CVE-2016-2182 |
| 610216 | CVE-2016-5696 | K46514822 | Linux TCP Stack vulnerability CVE-2016-5696 |
| 600379 | CVE-2016-2177 | K23873366 | OpenSSL vulnerability CVE-2016-2177 |
| 597979-1 | CVE-2016-5021 | K99998454 | Path sanitization for iControl REST worker |
| 589931 | CVE-2015-5370 CVE-2016-2110 CVE-2016-2111 CVE-2016-2112 CVE-2016-2115 CVE-2016-2118 | K37603172 | Multiple Samba vulnerabilities |
| 582856 | CVE-2016-1950 | K91100352 | Mozilla NSS vulnerability CVE-2016-1950 |
| 572608 | CVE-2015-5312 CVE-2015-7497 CVE-2015-7498 CVE-2015-7499 CVE-2015-7500 CVE-2015-7941 CVE-2015-7942 CVE-2015-8241 CVE-2015-8242 CVE-2015-8317 | K61570943 | Multiple libXML2 vulnerabilities |
| 570137 | CVE-2015-7575 CVE-2015-8126 CVE-2015-8472 CVE-2016-0402 CVE-2016-0448 CVE-2016-0466 CVE-2016-0475 CVE-2016-0483 CVE-2016-0494 | K50118123 | Multiple Java vulnerabilities |
| 561855 | CVE-2015-7181 CVE-2015-7182 CVE-2015-7183 | K31372672 | Multiple NSS Vulnerabilities |
| 556431 | CVE-2015-3245 CVE-2015-3246 | K05770600 | Linux libuser vulnerabilities |
| 554513 | CVE-2015-3238 | K17494 | PAM vulnerability CVE-2015-3238 |
| 548085 | CVE-2015-5157 CVE-2015-8767 | K17326 | Multiple kernel vulnerabilities |
| 542392 | CVE-2011-5321 CVE-2015-3636 CVE-2015-1593 CVE-2015-2830 CVE-2015-2922 | K51518670 | Multiple Linux Kernel vulnerabilities |
| 535886 | CVE-2015-5600 | K17113 | OpenSSH vulnerability CVE-2015-5600 |
| 528771 | CVE-2011-1098, CVE-2011-1154, CVE-2011-1155 | K16869 K16870 K16871 | Multiple Logrotate vulnerabilities |
| 526154 | CVE-2013-1740,CVE-2014-1490,CVE-2014-1491,CVE-2014-1492, CVE-2014-1544, CVE-2014-1545 | K16716 | Multiple Mozilla Network Security Services vulnerabilities |
| 525360 | CVE-2014-7822 CVE-2014-8369 | K17237 | Multiple Linux Kernel vulnerabilities |
| 525279 | CVE-2015-4000 | K16674 | TLS vulnerability CVE-2015-4000 |
| 515231 | CVE-2015-1781 CVE-2013-7423 | K16865 | GNU C Library (glibc) vulnerability CVE-2015-1781 & CVE-2013-7423 |
| 486791-1 | CVE-2014-6421 CVE-2014-6422 CVE-2014-6423 CVE-2014-6424 CVE-2014-6425 CVE-2014-6426 CVE-2014-6427 CVE-2014-6428 CVE-2014-6429 CVE-2014-6430 CVE-2014-6431 CVE-2014-6432 | K16939 | Resolution of multiple wireshark vulnerabilities |
| 486622 | CVE-2004-1060 | K15792 | Path MTU discovery vulnerability CVE-2004-1060 |
| 484319-1 | CVE-2012-1571 CVE-2014-0237 CVE-2014-0238 CVE-2014-1943 CVE-2014-2270 CVE-2014-3479 CVE-2014-3480 | K16954 | File vulnerabilities |
| 480421 | CVE-2013-4238 | K15638 | Python vulnerability CVE-2013-4238 |
| 480240 | CVE-2013-1620 | K15630 | Mozilla NSS vulnerability |
| 474513 | CVE-2013-1667 CVE-2012-5195 CVE-2012-5526 CVE-2012-6329 | K15867 | Multiple Perl Vulnerabilities |
| 456217 | CVE-2013-4113 | K15169 | PHP vulnerability CVE-2013-4113 |
| 613353 | CVE-2016-2180 CVE-2016-6306 CVE-2016-6302 | K90492697 | Multiple OpenSSL Vulnerabilities |
| 594397 | CVE-2013-0169 | K14190 | TLS/DTLS 'Lucky 13' vulnerability CVE-2013-0169 |
| 588359-1 | CVE-2016-0742 CVE-2016-0746 CVE-2016-0747 | K23073482 | Multiple nginx vulnerabilities |
| 587511 | CVE-2013-4397 | K16015326 | libtar vulnerability CVE-2013-4397 |
| 580015 | CVE-2016-1286 | K62012529 | BIND vulnerability CVE-2016-1286 |
| 579744 | CVE-2015-8776 | K23946311 | glibc vulnerability CVE-2015-8776 |
| 572613 | CVE-2013-6629 | K59503294 | libjpeg vulnerability CVE-2013-6629 |
| 571432 | CVE-2015-2730 | K15955144 | Mozilla NSS vulnerability CVE-2015-2730 |
| 568590 | CVE-2015-8704 | K53445000 | BIND vulnerability CVE-2015-8704 |
| 563839 | CVE-2015-7981 CVE-2015-8126 CVE-2015-8472 | K81903701 K76930736 K21057235 | Multiple libpng vulnerabilities |
| 562693 | CVE-2015-8000 | K34250741 | BIND Vulnerability CVE-2015-8000 |
| 547438 | CVE-2014-8155 CVE-2015-0282 CVE-2015-0294 | K17327 | Multiple GNU TLS vulnerabilities |
| 545723 | CVE-2015-6564 CVE-2015-6563 | K17263 | Multiple OpenSSH vulnerabilities |
| 545369 | CVE-2014-3565 | K17315 | SNMP vulnerability CVE-2014-3565 |
| 542976 | CVE-2015-5722 CVE-2015-5986 | K17227 K17181 | Multiple BIND vulnerabilities |
| 541002 | CVE-2015-2638 CVE-2015-4731 CVE-2015-4736 CVE-2015-4733 CVE-2015-4760 CVE-2015-2625 | K17172 | Multiple Java Vulnerabilities |
| 538018 | CVE-2015-3183 | K17251 | Apache vulnerability CVE-2015-3183 |
| 535884 | CVE-2015-5477 | K16909 | BIND Vulnerability |
| 533930 | CVE-2015-3210 | K17235 | PCRE library vulnerability CVE-2015-3210 |
| 533924 | CVE-2015-2325 | K16983 | PCRE library vulnerability CVE-2015-2325 |
| 531740 | CVE-2014-9657 CVE-2014-9658 CVE-2014-9660 CVE-2014-9661 CVE-2014-9663 CVE-2014-9664 CVE-2014-9667 CVE-2014-9669 CVE-2014-9670 CVE-2014-9671 CVE-2014-9673 CVE-2014-9674 CVE-2014-9675 | K16900 | Multiple FreeType vulnerabilities |
| 530268 | CVE-2015-3416 | K16950 | SQLite vulnerability CVE-2015-3416 |
| 529394-1 | CVE-2014-7844 | K16945 | CVE-2014-7844 : mailx Vulnerability |
| 529393-1 | CVE-2004-2771 | K16945 | CVE-2004-2771 : mailx Vulnerability |
| 527639-1 | CVE-2015-1791 | K16914 | CVE-2015-1791 : OpenSSL Vulnerability |
| 527638-1 | CVE-2015-1792 | K16915 | OpenSSL vulnerability CVE-2015-1792 |
| 527637-1 | CVE-2015-1790 | K16898 | PKCS #7 vulnerability CVE-2015-1790 |
| 527633-1 | CVE-2015-1789 | K16913 | OpenSSL vulnerability CVE-2015-1789 |
| 526171 | CVE-2013-1960,CVE-2013-1961,CVE-2013-4231,CVE-2013-4232,CVE-2013-4243,CVE-2013-4244 | K16715 | Multiple LibTIFF vulnerabilities |
| 525391 | CVE-2014-9585 | K17241 | Linux kernel vulnerability CVE-2014-9585 |
| 525389 | CVE-2014-9584 | K17245 | Linux kernel vulnerability CVE-2014-9584 |
| 525386 | CVE-2014-9529 | K17239 | Linux kernel vulnerability CVE-2014-9529 |
| 525365 | CVE-2015-1593 | K17244 | Linux kernel vulnerability CVE-2015-1593 |
| 525349 | CVE-2015-3148 | K16707 | cURL vulnerability CVE-2015-3148 |
| 525347 | CVE-2015-3143 | K16704 | cURL vulnerability CVE-2015-3143 |
| 522207 | CVE-2013-7423 | K16841 | GNU C Library (glibc) vulnerability CVE-2013-7423 |
| 521050 | CVE-2013-5704 | K16863 | Apache vulnerability CVE-2013-5704 |
| 511757 | CVE-2015-1349 | K16356 | BIND Vulnerability |
| 505646 | CVE-2014-6040 CVE-2014-7817 | K16010 K16435 | Multiple Glibc vulnerabilities |
| 503045 | CVE-2015-0204 | K16139 | CVE-2015-0204 : OpenSSL Vulnerability |
| 500788 | CVE-2012-6657 | K16011 | Linux kernel vulnerability CVE-2012-6657 |
| 499075 | CVE-2014-9293 | K15934 | CVE-2014-9293 : NTP Vulnerability |
| 499073 | CVE-2014-9294 | K15935 | NTP vulnerability CVE-2014-9294 |
| 487507 | CVE-2014-2532 CVE-2014-2653 | K15780 | Multiple OpenSSH vulnerabilities |
| 486354 | CVE-2014-2497 CVE-2014-3538 CVE-2014-3597 CVE-2014-4670 CVE-2014-4698 CVE-2014-5120 CVE-2014-0238 | K15761 | Multiple PHP 5.x vulnerabilities |
| 481806-1 | CVE-2013-4002 | K16872 | Java Runtime Environment vulnerability CVE-2013-4002 |
| 480207 | CVE-2014-3940 CVE-2014-4027 | K15685 | Multiple Linux Kernel vulnerabilities |
| 479431-3 | CVE-2014-3596 | K16821 | Apache Axis vulnerability CVE-2014-3596 |
| 476871 | CVE-2014-4341 CVE-2014-4342 | K15552 K15547 | MIT Kerberos 5 vulnerability CVE-2014-4342 |
| 439068-1 | CVE-2013-0221 CVE-2013-0222 CVE-2013-0223 | K16859 | SUSE coreutils vulnerabilities |
| 416372-1 | CVE-2012-2677 | K16946 | Boost memory allocator vulnerability CVE-2012-2677 |
| 622069 | CVE-2014-3613 CVE-2014-3707 CVE-2014-8150 CVE-2015-3143 CVE-2015-3148 | K16704 K16707 | Resolution of multiple curl vulnerabilities |
Functional Change Fixes
| ID Number | Severity | Description |
| 620231 | 3-Major | The Web Application Security marks all devices as modified when restoring configuration from a snapshot |
BIG-IQ Configuration - Network Fixes
| ID Number | Severity | Description |
| 632934 | 2-Critical | BIG-IP name CIDR format is not accepted on BIG-IQ for Self IP: 10.9.91.254_24 |
BIG-IQ Device User Interface Fixes
| ID Number | Severity | Description |
| 654806 | 3-Major | UI does not allow reactivation of regkeys in a regkey pool if the EULA has changed on the license server |
| 654781 | 3-Major | UI unable to reactivate a purchased pool license when the EULA has changed |
| 639522 | 3-Major | Device inventory CSV fails if a device is unreachable |
BIG-IQ Monitoring - Dashboards & Reports Fixes
| ID Number | Severity | Description |
| 648597 | 3-Major | Command needed to restore Access data after upgrading to the latest BIG-IQ system★ |
BIG-IQ System User Interface Fixes
| ID Number | Severity | Description |
| 631015 | 2-Critical | HA Failover initiated from Secondary node may leave the BIG-IQ cluster in "standalone" mode |
| 645743 | 3-Major | IE browser does not work with System -> This Device -> Email Notification Recipients |
| 631874 | 4-Minor | Audit Log Syslog Server Configuration |
BIG-IQ Access Fixes
| ID Number | Severity | Description |
| 650367 | 2-Critical | Object Deletion failure upon Deployment |
| 588171 | 3-Major | Under heavy sustained stress traffic over 500 sessions per second from the BIG-IP system, Logging Node fails to accept logs |
| 581899 | 3-Major | Logs and sessions info are missing in BIG-IQ Access reports |
BIG-IQ Local Traffic & Management Fixes
| ID Number | Severity | Description |
| 618007 | 2-Critical | BIG-IQ does not correctly link VLAN and interface configuration from Viprion when blade id is part of the interface name |
| 614233-1 | 2-Critical | Browser performance degredation with large number of discovered Profiles, Monitors and iRules that have unique fullPaths |
| 580103-1 | 2-Critical | ADC deployment fails because a DNS resolver is being used by the http-explicit profile. |
| 635557 | 3-Major | LTM fails to import certificate names beginning with * |
| 633472-1 | 3-Major | Deployment fails with "Could not determine which real kinds mapped to intermediate kind ADC_MONITOR_TCP_HALF_OPEN" |
| 630438 | 3-Major | User can create a "Standard" Virtual Server with *All Protocols and a 'None' Any IP profile. |
| 628518 | 3-Major | DSC Cluster: Importing LTM configuration for second device fails |
| 624825 | 3-Major | Error: Could not determine which real kinds mapped to intermediate kind ADC_SSL_CERT |
| 621767 | 3-Major | LTM service discovery fails if virtual address has route domain with "any" address |
| 617607 | 3-Major | Changing the state of pool members or virtual servers on manual sync DSC groups moves the group out of sync. |
| 617178-1 | 3-Major | Prefix Length value of None in custom source address persistence profile on BIG-IP gets parent's value on BIG-IQ after importing |
| 610660-1 | 3-Major | Unexpected difference and loss of inheritance for null-mask in Source Addr persistence profile on BIG-IP |
BIG-IQ App Visibility and Reporting (AVR) Fixes
| ID Number | Severity | Description |
| 621986 | 3-Major | Users can't generate AVR reports in WebApplication or Network Security modules against a BIG-IP HA setup |
| 655185 | 4-Minor | "Invalid registered claims" error may occur when creating reports in Monitoring -> REPORTS -> Security |
AppIQ Fixes
| ID Number | Severity | Description |
| 643189 | 3-Major | Statistics show inaccurate data when certain interval collection frequencies are used |
BIG-IQ Configuration - Infrastructure Fixes
| ID Number | Severity | Description |
| 608932-1 | 3-Major | DSC Sync status not correctly determined |
| 617266 | 4-Minor | Sevone PLA schedule end date cannot be extended if schedule is finished |
BIG-IQ Device Management Fixes
| ID Number | Severity | Description |
| 614819 | 3-Major | Devices under high load may show inaccurate status messages |
| 612044-1 | 3-Major | iHealth upload fails after BIG-IP upgrade from 11.5.x |
| 611257 | 3-Major | BIG-IQ signals success when assigning a license to an unmanaged BIG-IP hardware-based device |
| 580726-1 | 3-Major | License state information from REST worker is out of sync with device |
| 573323-3 | 3-Major | Remotely-authenticated user with Admin role changed to Guest by McpUsersEnumeratorWorker. |
| 559599 | 3-Major | BIGIQ 7000: GUI Registration Key box is not populated by default |
| 603960 | 4-Minor | Managed device license status is not updated |
| 575659 | 4-Minor | BIG-IP DSC Sync setting not modified on subsequent BIG-IP trust establishment |
BIG-IQ Fraud Protection Service (FPS) Fixes
| ID Number | Severity | Description |
| 626476 | 2-Critical | FPS Forwarding: Incorrect date value using {date} info tag |
| 639241-1 | 3-Major | Proxy IP - {proxy} field is forwarded only for SOC destination, User should be able to forward the field to all other destination as well |
| 639234-1 | 3-Major | Proxy host name {proxyname} does not get forwarded to any destination - Email, Syslog, Custom and SOC |
| 631211 | 3-Major | Manually reforward alerts matching transform rules |
| 628858-1 | 3-Major | Correct IP address is not shown for the client IP in some FPS alerts |
| 627518-1 | 3-Major | Unable to display Advanced Phishing Alerts |
| 625630 | 3-Major | GUI error when filtering alerts in custom date |
| 620901 | 3-Major | Missing "client IP" field in alert on BIG-IQ FPS dashboard |
| 640928 | 4-Minor | Remote Fraud Protection User Accounts do not appear in related-to search for a selected BIG-IQ user account. |
| 621244 | 4-Minor | vjail score not shown on dashboard for mobilesafe alerts |
| 613245 | 4-Minor | Alert Transform Rule import with CSV files larger than 8MB fails |
BIG-IQ Network Security Fixes
| ID Number | Severity | Description |
| 557774 | 2-Critical | BIG IQ Discovery fails if a DoS profile is configured with custom Bot Signature on the BIG IP |
| 610135 | 3-Major | Firewall or NAT policies may show false differences, in some conditions, when IP protocol 138 through 141 are used. |
| 595822 | 3-Major | Deployment will fail if a FW NAT Policy coexists with existing LTM pools (either SNAT/LSN/Automap or LTM Pool) |
| 590492 | 3-Major | Missing vector support under DoS Single Endpoint for 11.5.3 BIG-IP; also, GUI error doesn't provide info of unsupported vectors |
| 617547 | 4-Minor | Changing timer policy rule from a port-based to non-port-based protocol |
| 595302 | 4-Minor | DoS Profiles do not support correct upper range eveywhere |
REST Framework and TMOS Platform Fixes
| ID Number | Severity | Description |
| 648305 | 2-Critical | RADIUS Access-Requests are not fully RFC compliant. |
| 637084 | 2-Critical | Primary BIG-IQ UCS restore never completes successfully |
| 629835 | 2-Critical | Update to RHEL6 kernel |
| 624679 | 2-Critical | Managed devices was marked unavailable intermittently |
| 647114 | 3-Major | LDAP login may fail with empty bindUser. |
| 643638 | 3-Major | Duplicated routing table entry causes "Error: OID not increasing" from snmpwalk |
| 640326 | 3-Major | No audit log entry logged for the failed login attempt |
| 630660 | 3-Major | The bigiqsnmpd daemon cores |
| 629725-1 | 3-Major | Breaking up an HA pair does not remove the console from the Logging Configuration Cluster. |
| 628365-1 | 3-Major | Minimum Master Eligible Nodes can be set to value higher than the number of nodes in cluster |
| 621321 | 3-Major | Europe/Moscow timezone is incorrect |
| 612566 | 3-Major | FPS alerts or ASM Events or Access Reporting is empty after restoring a Logging Cluster Snapshot |
| 609403 | 3-Major | The BIG-IQ timezone is off-set for the SevOne Performance Logging Appliance monthly-scheduled push time |
| 599845 | 3-Major | Hardware compression test fails on BIG-IQ 7000. |
| 590514-1 | 3-Major | [Fixed] Certificate Expiration emails report stale Expiration Date |
| 588651 | 3-Major | BIG-IQ fails to manage a BIG-IP device when changing the device certificate of the device |
| 585769 | 3-Major | BIG-IQ Logging Snapshots: After scheduling a snapshot, the "Snapshot Schedules" reads "N/A" |
| 581471 | 3-Major | Updating an LDAP Auth Provider fails |
| 584666 | 4-Minor | Grid columns may be render partially or completely off-screen |
| 583975 | 4-Minor | BIG-IQ Logging configuration should not be performed on the Logging Node |
BIG-IQ System Fixes
| ID Number | Severity | Description |
| 644953 | 3-Major | Virtual Machines now require 4 CPUs / 16GB memory or 8 CPUs / 32GB memory |
| 619890 | 3-Major | BIG-IQ cannot be setup when configured with VLANs referencing trunks |
| 631249 | 4-Minor | Creation/Deletion of an Auth Provider may need a browser refresh to be able to see updated Auth Provider list |
| 621627 | 4-Minor | SNMP Client Allowed List has incorrect Mask value in builtin entry |
| 613558 | 4-Minor | Unable to delete System Self IP using Internet Explorer 11 |
BIG-IQ Web Application Security (ASM) Fixes
| ID Number | Severity | Description |
| 634264 | 2-Critical | ASM: conflict related to policy signatures is not shown |
| 635322 | 3-Major | ASM: policies created on BIG-IQ with Automatic Policy Builder enabled are incompatible with BIG-IP v12 devices. |
| 633284 | 3-Major | ASM - import failure when using IP addresses with the same network and different masks |
| 621516 | 3-Major | ASM - import failure when policies originate from a device with users that have special characters in username★ |
| 615180 | 3-Major | Web Application Security deployment from a snapshot fails |
| 606431 | 3-Major | Certain Web Application Security related to searches take a long time to complete |
| 593678 | 3-Major | Critical error shown on deployment for 12.x devices with policies originated from 11.x devices |
| 591982 | 3-Major | Policy specific signature settings (enabled, in staging) may not be deployed correctly when deployment task deploys other relevant changes |
| 590604 | 3-Major | BIG-IQ does not manage the learn flag on BIG-IP policy sub violations - HTTP Protocol Compliance and Evasions |
| 587060 | 3-Major | New policies deployed to BIG-IPs may have wrong settings for user defined signatures if those are created on different BIG-IP devices |
| 501561 | 3-Major | Web Application Security does not allow changing the order of wildcard entities |
| 598590 | 4-Minor | Web Application Security - device modified indicator is not turned on when deploying the configuration from a snapshot. |
| 596787 | 4-Minor | Cannot export Web Application Security event logs in a CSV file using Chrome/Firefox |
| 582626 | 4-Minor | Web Application Security event logs do not show violation ratings |
Cumulative fix details for BIG-IQ CM v5.2.0 that are included in this release
655185 : "Invalid registered claims" error may occur when creating reports in Monitoring -> REPORTS -> Security
Component: BIG-IQ App Visibility and Reporting (AVR)
Symptoms:
An "Invalid registered claims" error may occur when creating reports in Monitoring -> REPORTS -> Security -> Network Security (or Web Application Security) -> Reporting.
Impact:
The report will not generate, the UI will spin endlessly.
Workaround:
As a workaround, click "Dismiss" and refresh browser.
654806 : UI does not allow reactivation of regkeys in a regkey pool if the EULA has changed on the license server
Component: BIG-IQ Device User Interface
Symptoms:
Attempts to reactivate a license in a regkey pool cannot be completed because the Activate button is disabled.
Conditions:
This issue occurs when reactivating a license in a regkey pool that requires a new EULA to be accepted. The UI does not present the EULA to the user.
Impact:
The license cannot be reactivated via the UI.
Workaround:
The pool license reactivation must be completed via CLI.
1. Determine the regkey pool ID:
restcurl cm/device/licensing/pool/regkey/licenses/'?$select=name,id'
2. Save the EULA to a file
restcurl cm/device/licensing/pool/regkey/licenses/{id from step 1}/offerings/{regkey}/'?$select=eulaText,status' > /var/tmp/eula.txt
4. Edit /var/tmp/eula.txt and, at the end of the file, change the status from "ACTIVATING_AUTOMATIC_NEED_EULA_ACCEPT" to "ACTIVATING_AUTOMATIC_EULA_ACCEPTED"
5. curl -X PATCH --upload-file /var/tmp/eula.txt http://localhost:8100/cm/device/licensing/pool/regkey/licenses/{id from step 1}/offerings/{regkey}
Fix:
The UI now prompts the user to accept the new EULA when needed.
654781 : UI unable to reactivate a purchased pool license when the EULA has changed
Component: BIG-IQ Device User Interface
Symptoms:
Attempts to accept a new EULA when reactivating a purchased pool license generates an error similar to:
"The system returned an unexpected error (400 Bad Request). eulaText cannot be changed"
Conditions:
This issue applies when reactivating a purchased pool license and F5 has updated the EULA since the original activation.
Impact:
The purchased pool license cannot be reactivated via the UI.
Workaround:
The purchased pool license reactivation must be completed via CLI.
1. Determine the purchased pool license ID
a. Prior to BIG-IQ 5.2:
restcurl cm/shared/licensing/pools'?$select=name,selfLink,state'
b. In BIG-IQ 5.2 and later:
restcurl cm/device/licensing/pool/purchased-pool/licenses/'?$select=name,selfLink,state'
2. Note the selfLink for the pool in question; the selfLink path (selfLink minus the 'https://localhost/mgmt/' prefix) will be used in subsequent steps
3. Save the EULA to a file
restcurl {selfLink path}'?$select=eulaText,state' > /var/tmp/eula.txt
4. Edit /var/tmp/eula.txt and, at the end of the file, change the state from "WAITING_FOR_EULA_ACCEPTANCE" to "ACCEPTED_EULA"
5. curl -X PATCH --upload-file /var/tmp/eula.txt http://localhost:8100/{selfLink path}
Fix:
The UI now prompts the user to accept the new EULA when needed.
650367 : Object Deletion failure upon Deployment
Component: BIG-IQ Access
Symptoms:
When deploying a configuration from BIG-IQ to BIG-IP systems, un-referenced objects are deleted from BIG-IQ and thus, on the BIG-IP systems managed by that BIG-IQ. This deletion can fail on 12.1.0, 12.1.1, 12.1.2, and 13.0 BIG-IP devices.
Conditions:
1. 12.1.0, 12.1.1, 12.1.2, and 13.0 BIG-IP systems have the specific defect (see BZ 647108, 649929).
2. The BIG-IP systems have objects that are not referenced.
3. A deployment is attempted.
Impact:
The customer will not be able to deploy the configuration, unless they follow the workaround.
Workaround:
1. Users can delete the unreferenced objects on BIG-IP systems in advance, or
2. Prior to object import, upgrade all managed BIG-IP systems in advance.
648597 : Command needed to restore Access data after upgrading to the latest BIG-IQ system★
Component: BIG-IQ Monitoring - Dashboards & Reports
Symptoms:
After a software upgrade from to the latest BIG-IQ release and restoring the snapshot to retrieve the data, a command is needed to have the data successfully restored.
Conditions:
After a software upgrade from to the latest BIG-IQ release and restoring the snapshot to retrieve the data.
Impact:
User cannot successfully restore data if a command is not entered.
Workaround:
After upgrading from 5.0 or 5.1, the admin sends the POST request to the below rest API. This step is needed to restore session data after upgrading. The admin has to perform this step after Elastic snapshot restore is completed. Sessions that were created before the upgrade are not displayed in the Sessions Report or in the Active Sessions report if this step was not performed after the upgrade.
restcurl -X POST -u admin:admin http://localhost:8100/mgmt/cm/access/reports/access-es-upgrade-task -d ‘{ }’
Fix:
This issue has been fixed and you no longer need to perform additional steps to restore Access data after upgrade.
648305 : RADIUS Access-Requests are not fully RFC compliant.
Component: REST Framework and TMOS Platform
Symptoms:
The RFC states an Access-Request MUST contain either a NAS-IP-Address attribute or a NAS-Identifier attribute (or both).
Conditions:
Setup RADIUS authentication and some servers won't accept the Access-Requests
Impact:
Failing authentication with properly configured RADIUS server and BIG-IQ configuration.
Workaround:
The RADIUS server can be adjusted to be more lenient to the missing attributes.
Fix:
BIG-IQ will now always send a NAS-Identifier attribute with every RADIUS Access-Request. It will also include a NAS-IP-Address when possible.
647114 : LDAP login may fail with empty bindUser.
Component: REST Framework and TMOS Platform
Symptoms:
LDAP Authentication fails. This will most likely occur after an upgrade where it was previously working.
Conditions:
The LDAP auth provider has an empty string or a string with all spaces such as "" or " " for the bindUser field. This is different than null. The LDAP server also doesn't allow anonymous binding.
Impact:
Authentication requests from the auth provider will try to use the bindUser field to bind to the LDAP server. If the bindUser field is a blank string it will fail causing login attempts to fail.
Workaround:
Set the bindUser field to null.
Fix:
Fixed a case where an empty bindUser can cause LDAP authentication to fail.
645743 : IE browser does not work with System -> This Device -> Email Notification Recipients
Component: BIG-IQ System User Interface
Symptoms:
Creating new email recipients fails without providing any feedback to the user when using Internet Explorer.
Conditions:
Issue is applicable when using Internet Explorer.
Impact:
New email recipients cannot be created.
Workaround:
As a workaround, use a browser other than IE.
Fix:
Browser incompatibility issue was addressed.
644953 : Virtual Machines now require 4 CPUs / 16GB memory or 8 CPUs / 32GB memory
Component: BIG-IQ System
Symptoms:
Upon logging into a BIG-IQ virtual machine, if the BIG-IQ's configuration has fewer than 4 CPUs and/or less than 16GB of memory, the user will be presented with a dialog warning that their virtual machine configuration is no longer supported.
Conditions:
You are using a BIG-IQ virtual machine with less than 4 CPUs and/or less than 16GB of memory.
Impact:
Some functions of BIG-IQ may not function, and you may encounter performance issues.
Workaround:
Change the configuration of your BIG-IQ virtual machine to one of the two supported configurations:
- 4 CPUs, 16GB memory
- 8 CPUs, 32GB memory
Then restart the virtual machine.
Fix:
BIG-IQ warns users upon login if the virtual machine is configured with insufficient CPU and memory resources.
643638 : Duplicated routing table entry causes "Error: OID not increasing" from snmpwalk
Component: REST Framework and TMOS Platform
Symptoms:
When running the snmpwalk utility, an error is seen similar to:
Error: OID not increasing: IP-FORWARD-MIB::ipCidrRouteDest...
Conditions:
This issue occurs on typical BIG-IQ installs with the affected versions, because of a duplicate routing table entry.
Impact:
snmpwalk may fail or snmpd may core.
Workaround:
Deleting the duplicate routing table entry will temporarily work around this issue, but the duplicate entry will be restored on the next reboot.
In a bash command shell, run the "ip route" command. Examine the output to identify the two entries with the same destination network. Delete the entry that includes "metric 9" by running "ip route del <entry>", where <entry> is the line of "ip route" output that describes the entry. For example:
# ip route del 172.27.64.0/24 dev eth0 scope link src 172.27.64.29 metric 9
Fix:
BIG-IQ no longer has a duplicate routing table entry by default.
643189 : Statistics show inaccurate data when certain interval collection frequencies are used
Component: AppIQ
Symptoms:
You may observe "choppy" and/or inaccurate statistics in graphs.
Conditions:
This may occur when the statistics collection frequency is set at 2 minutes or greater.
Impact:
Graphs may not show accurate information / data.
Workaround:
Use the 30 seconds or 60 seconds frequency setting for all BIG-IPs desired for statistics collection.
640928 : Remote Fraud Protection User Accounts do not appear in related-to search for a selected BIG-IQ user account.
Component: BIG-IQ Fraud Protection Service (FPS)
Symptoms:
When you do a global search on a non local User Account or group, it finds the User Account together with any FPS Accounts to which it is assigned.
However, if you select the non local User Account in the search results and click Show in Related Items, the assigned FPS Accounts do not appear
on the list.
Conditions:
This can occur when doing a global search for a non local User Account.
Impact:
The issue makes related-to search asymmetric. Local User accounts are searchable from FPS accounts but not vice versa.
Workaround:
No workaround
Fix:
When you do a global search on a non local User Account or group, it finds the User Account together with any FPS Accounts to which it is assigned.
However, if you select the non local User Account in the search results and click Show in Related Items, the assigned FPS Accounts do not appear
on the list.
640649 : CVE-2016-1669 : NodeJS Vulnerability
Vulnerability Solution Article: K35655050
640326 : No audit log entry logged for the failed login attempt
Component: REST Framework and TMOS Platform
Symptoms:
No audit log entry logged for the failed login attempt.
Conditions:
Failed login attempt.
Impact:
Failed login attempts are not viewable from the audit logger.
Workaround:
Failed login attempts are logged to the /var/log/restjavad.*.log files
Fix:
Login activity is now reported in the audit log for both successful and failed attempts.
639522 : Device inventory CSV fails if a device is unreachable
Component: BIG-IQ Device User Interface
Symptoms:
BIG-IQ Configuration Management 5.1.0 device inventory CSV download fails.
Conditions:
If a managed device is not reachable, the UI will silently fail to give a download dialog when a user tries to Export Inventory.
Impact:
User is unable to get a device inventory report.
Workaround:
None.
Fix:
GUI now shows a warning if the device is unreachable when exporting the device inventory.
639241-1 : Proxy IP - {proxy} field is forwarded only for SOC destination, User should be able to forward the field to all other destination as well
Component: BIG-IQ Fraud Protection Service (FPS)
Symptoms:
Proxy IP - {proxy} field is forwarded only for SOC destination. The user should be able to forward the field to all other destinations (Email, syslog and Custom forwarding) as well.
Conditions:
When a forwarding rule has {proxyname} field in email/syslog template or in Custom forwarding: WS alert header/WS Alert Request.
Impact:
Proxy Ip address will not be shown at the destination
Fix:
The {proxy} field can now be forwarded to all forwarding targets.
639234-1 : Proxy host name {proxyname} does not get forwarded to any destination - Email, Syslog, Custom and SOC
Component: BIG-IQ Fraud Protection Service (FPS)
Symptoms:
Proxy host name {proxyname} does not get forwarded to any destination - Email, Syslog, Custom and SOC
Conditions:
- When a forwarding rule has SOC forwarding enabled and selected
"Client Proxy HostName" field to forward
- When a forwarding rule has {proxyname} field in email/syslog template or in Custom forwarding: WS alert header/WS Alert Request
Impact:
Proxy hostname will not be shown at the destination
Fix:
This is fixed in 5.2.
637084 : Primary BIG-IQ UCS restore never completes successfully
Component: REST Framework and TMOS Platform
Symptoms:
If a UCS restore operation is attempted on a BIG-IQ that is the primary member of a primary-secondary pair, the restore operation will not complete successfully.
Conditions:
Always
Impact:
Inability to perform UCS restore on a primary BIG-IQ
Workaround:
The backup can be restored if the HA pair is broken first. After restoring the backup, the HA pair can be re-created.
635557 : LTM fails to import certificate names beginning with *
Component: BIG-IQ Local Traffic & Management
Symptoms:
Importing LTM for a device fails in BIG-IQ because BIG-IQ doesn't support traffic certificates that have names beginning with an asterisk.
Conditions:
This issue occurs when BIG-IP has one or more traffic certificates starting with an asterisk.
Impact:
The LTM service cannot be managed for affected devices.
Fix:
BIG-IQ now supports importing certificates with names that begin with an asterisk. See release notes for ID637937 regarding residual issues related to this scenario.
635322 : ASM: policies created on BIG-IQ with Automatic Policy Builder enabled are incompatible with BIG-IP v12 devices.
Component: BIG-IQ Web Application Security (ASM)
Symptoms:
ASM: policies created on BIG-IQ with Automatic Policy Builder enabled are incompatible with BIG-IP v12 devices.
When deploying such policies critical verification errors are shown.
Conditions:
Policies are created on BIG-IQ and have the policy builder enabled.
Impact:
Critical verification errors are shown.
Fix:
Policies created on BIG-IQ are now compatible with 12.x devices, even after changing policy building configuration and enabling the automatic policy builder.
634264 : ASM: conflict related to policy signatures is not shown
Component: BIG-IQ Web Application Security (ASM)
Symptoms:
ASM: conflict related to policy signatures is not shown.
Conditions:
This happens when there are policy signature changes in two or more policies and another non-signature change in one of the policies.
Impact:
As no conflict is shown, the policy is kept as is regardless of the change that happened on the BIG-IP.
Fix:
A certain case in which a conflict import was not showing up was fixed, and now the user is requested to resolve that kind of conflict.
633472-1 : Deployment fails with "Could not determine which real kinds mapped to intermediate kind ADC_MONITOR_TCP_HALF_OPEN"
Component: BIG-IQ Local Traffic & Management
Symptoms:
When deploying a change to one or more managed devices, deployment fails and restjavad shows an error similar to: AdcClusterDistributeTaskWorker] Error parsing difference summary: java.lang.IllegalArgumentException: Could not determine which real kinds mapped to intermediate kind ADC_MONITOR_TCP_HALF_OPEN
Conditions:
This issue applies when: 1) The deployment contains a change where a TCP monitor is involved (i.e. creating a new pool with such a monitor attached); 2) The deployment target is a BIG-IP cluster; 3) A TCP monitor exists with the same name in two or more managed devices, but it has different properties in at least one of the devices.
Impact:
Deployment fails.
Workaround:
Avoid having TCP monitors with same name but different properties across managed devices.
Fix:
BIG-IQ now allows deployments to succeed in this case.
633284 : ASM - import failure when using IP addresses with the same network and different masks
Component: BIG-IQ Web Application Security (ASM)
Symptoms:
ASM import failure when using IP addresses with the same network and different masks.
Conditions:
The issue happens when a configuration is imported and contains IP Address whitelist records with the same address but different network masks.
Impact:
The issue causes a failure to import the configuration.
Fix:
Policy IP address configuration that had elements with the same addresses and different network masks was handled incorrectly, and importing such configuration was causing a failure. The handling of such IP address configuration items was fixed and no longer generates errors on import.
632934 : BIG-IP name CIDR format is not accepted on BIG-IQ for Self IP: 10.9.91.254_24
Component: BIG-IQ Configuration - Network
Symptoms:
BIG-IP supports a naming format for some objects where you can use an IP address. BIG-IQ seems not to handle this. For instance a self-ip can be names "10.9.91.254", however it does not support adding the CIDR to the end like this:
10.9.91.254_24
That is a valid Self IP name on BIG-IP and works for other objects that require IP and Masks.
Conditions:
BIG-IP supports a naming format for some objects where you can use an IP address. BIG-IQ seems not to handle this. For instance a self-ip can be names "10.9.91.254", however it does not support adding the CIDR to the end like this:
10.9.91.254_24
That is a valid Self IP name on BIG-IP and works for other objects that require IP and Masks.
Impact:
BIG-IQ cannot create these objects using a name with <ip>_<port> format.
Workaround:
Creation can be performed on BIG-IP and re-discovered and re-imported.
Fix:
BIG-IQ now accepts names with IP_CIDR as valid.
631874 : Audit Log Syslog Server Configuration
Component: BIG-IQ System User Interface
Symptoms:
When using the select all checkbox, the Remove button is not enabled.
Impact:
User is unable to remove all syslog servers when selecting them using the select all checkbox.
Workaround:
When attempting to remove all of the audit log syslog servers, remove them one at a time or check them all individually.
Fix:
The Select all checkbox now properly enables the remove button.
631249 : Creation/Deletion of an Auth Provider may need a browser refresh to be able to see updated Auth Provider list
Component: BIG-IQ System
Symptoms:
After creating an Auth Provider, Auth Providers page may not show the new provider. Similarly, when deleting a provider, it may still appear on the page.
Impact:
The Auth Provider page shows stale data.
Workaround:
To update the page with the latest data, perform a browser refresh on the page.
Fix:
BIG-IQ now automatically refreshes the page to show the current Auth Providers.
631211 : Manually reforward alerts matching transform rules
Component: BIG-IQ Fraud Protection Service (FPS)
Symptoms:
Its a RFE to allow user to forward specific alerts after applying transform rules again.
Conditions:
This feature is applicable only when user applies transform rule manually through UI.
Impact:
Without this feature there is no way for user to re-send updated alerts.
Fix:
This feature is now available. It will allow an admin to re-forward alerts when they match a rules. Typically this will be a new rule tat did not exist when the alert was first recieved.
631015 : HA Failover initiated from Secondary node may leave the BIG-IQ cluster in "standalone" mode
Component: BIG-IQ System User Interface
Symptoms:
When Promote-to-Primary has been initiated from the Secondary,
Conditions:
The secondary will become standalone.
Impact:
This can causes confusion for the customer.
Workaround:
In 5.1 the promotion should be initiated from the primary device, not the secondary.
Fix:
The option on the Secondary to promote to primary has been changed to 'Reset to Standalone'. Normally the promotion should be initiated from the primary.
This option in intended for use when the primary is not accessible.
630660 : The bigiqsnmpd daemon cores
Component: REST Framework and TMOS Platform
Symptoms:
The bigiqsnmpd daemon cores.
Conditions:
This happens in some circumstances such as when using the snmpwalk command on BIG-IQ.
Impact:
SNMP functionality is impaired.
Fix:
The snmp daemon no longer cores due to these conditions.
630438 : User can create a "Standard" Virtual Server with *All Protocols and a 'None' Any IP profile.
Component: BIG-IQ Local Traffic & Management
Symptoms:
User can click save when creating VS of type 'Standard', with Protocol '*All Protocols' and Any IP profile 'none'.
Conditions:
User is creating a Virtual Server and selects *All Protocols for Protocol.
Impact:
If this virtual server is deployed, BIG-IP will add a fastl4 profile. It will show up as Performance (Layer 4) type instead of standard.
Fix:
BIG-IQ now prevents the invalid combination of VS attributes.
629835 : Update to RHEL6 kernel
Component: REST Framework and TMOS Platform
Symptoms:
Rare race condition between two (or more) threads operating on the same buffer_head/journal_head may cause a kernel panic
Impact:
Unexpected machine reboot causing loss of service
Workaround:
None.
Fix:
Redhat provided an update to RHEL6.7
F5 backported to RHEL6.4, 6.5:
jbd2: Fix oops in jbd2_journal_remove_journal_head()
jbd: Fix oops in journal_remove_journal_head()
629725-1 : Breaking up an HA pair does not remove the console from the Logging Configuration Cluster.
Component: REST Framework and TMOS Platform
Symptoms:
When you remove the peer Console node from the BIG-IQ HA pair, the Console node remains in the Logging Configuration Cluster. On the GUI of either Console node, the System Management > BIG-IQ LOGGING > Logging Configuration screen shows the same number of "Nodes in Cluster" before and after the peer is removed.
Impact:
This has no effect on FPS services or HA. The Console nodes no longer share configuration information after you break up the pair, and resume sharing if you later rejoin them.
628858-1 : Correct IP address is not shown for the client IP in some FPS alerts
Component: BIG-IQ Fraud Protection Service (FPS)
Symptoms:
If an alert is received from a client that is behind multiple intermediate proxies, the wrong client IP is extracted from the alert.
Conditions:
There has to be one or more intermediate proxies between client and server.
Impact:
Client IP address field populated is actually an intermediate device, which is a wrong value.
Fix:
The list of IP Addresses are now interpreted in the correct order. The client IP and proxy IP addresses are listed correctly in FPS alerts.
628518 : DSC Cluster: Importing LTM configuration for second device fails
Component: BIG-IQ Local Traffic & Management
Symptoms:
Unable to import LTM configuration of second device of a DSC pair. It fails with an error similar to: [ERROR][24 Oct 2016 17:36:47 CEST][/cm/adc-core/tasks/device-sync/77ece313-26c6-47d9-9b88-97fd7ea1732e/worker AdcDeviceSyncTaskWorker] Reject reentrant transition to status FAILED - java.lang.IllegalStateException
Conditions:
At least one LTM object is NOT "In Sync". For example, the same virtual has different properties in different devices (e.g. one has SNAT automap and another SNAT pool).
Impact:
Unable to import LTM configuration.
Workaround:
Identify the out-of-sync LTM objects in BIG-IP. Correct the LTM objects and ensure config sync occurs. Remove both DSC members from BIG-IQ. Re-discover and re-import LTM configuration for the DSC members.
Fix:
BIG-IQ now correctly imports LTM configuration from the second device of a DSC pair.
628365-1 : Minimum Master Eligible Nodes can be set to value higher than the number of nodes in cluster
Component: REST Framework and TMOS Platform
Symptoms:
On BIG-IQ System Management-> BIG-IQ LOGGING-> Logging Configuration page, Minimum Master Eligible Nodes can be given value higher than the "Nodes in Cluster" value shown on the page.
Impact:
The system overrides the incorrect value provided by the system and set it back to expected value based on its internal calculations.
627518-1 : Unable to display Advanced Phishing Alerts
Component: BIG-IQ Fraud Protection Service (FPS)
Symptoms:
Although Advanced Phishing alerts are received and counted, they are not displayed in the table.
Impact:
User is unable to see the alert in detail.
Fix:
Some alerts were showing up in the count for an alert type, but were not listed among the grouped alerts. These alerts did not have the property that the alerts were being grouped on. For example, they were missing the domain, and they were grouped on the domain. This is now fixed. Missing fields that are used for grouping are now grouped under a 'No Domain Available' group name.
626476 : FPS Forwarding: Incorrect date value using {date} info tag
Component: BIG-IQ Fraud Protection Service (FPS)
Symptoms:
When alert is forwarded, date is rendered with the minutes repeated in the month position. The format is dd.mm.yyyy HH:mm, while it should have been dd.MM.yyyy HH:mm.
Conditions:
This issue occurs only in alert forwarding with {date} tag.
Impact:
Unexpected date-format is forwarded as part of the alert.
Fix:
When forwarding alerts with dates, the time is rendered in correct format: dd.MM.yyyy HH:mm
625630 : GUI error when filtering alerts in custom date
Component: BIG-IQ Fraud Protection Service (FPS)
Symptoms:
UI shows error while searching for alerts with custom dates.
Conditions:
The issue only occurs when client is in a timezone with '+' in the string. This causes the query to be misinterpreted and error.
Impact:
User can not search alerts with custom date.
Fix:
When doing an advanced filter for FPS alerts, setting a custom time caused errors when filtering in some time zones. This is now fixed.
625230 : Linux privilege-escalation vulnerability (Dirty COW) CVE-2016-5195
Vulnerability Solution Article: K10558632
624825 : Error: Could not determine which real kinds mapped to intermediate kind ADC_SSL_CERT
Component: BIG-IQ Local Traffic & Management
Symptoms:
An LTM evaluation/deployment fails with the error: Could not determine which real kinds mapped to intermediate kind ADC_SSL_CERT.
Conditions:
This issue may occur when the LTM evaluation/deployment occurs for clustered BIG-IPs.
Impact:
This issue prevents deployments to affected BIG-IPs.
Fix:
BIG-IQ now properly handles deployments in this situation.
624679 : Managed devices was marked unavailable intermittently
Component: REST Framework and TMOS Platform
Symptoms:
Firewall rules intended to restrict access to an ant daemon running on the system might incorrectly interfere with managed device traffic generated by the BIG-IQ system on port 54321.
Conditions:
BIG-IQ connection to managed devices with source port "54321".
Impact:
This may result in managed device being incorrectly marked unavailable.
Workaround:
As a workaround, add these iptables commands to the '/config/startup' script, and reboot the BIG-IQ system (or manually run these commands once). These commands modify the firewall rule to prevent interference with managed device traffic:
/sbin/iptables -D INPUT -p tcp --dport 54321 -j REJECT --reject-with icmp-port-unreachable
/sbin/iptables -D INPUT -p tcp -m tcp --dport 54321 --tcp-flags ACK,SYN SYN -j REJECT --reject-with tcp-reset
/sbin/iptables -A INPUT -p tcp -m tcp --dport 54321 --tcp-flags ACK,SYN SYN -j REJECT --reject-with tcp-reset
Fix:
Firewall rules no longer incorrectly interfere with managed device traffic generated by the BIG-IQ system on port 54321.
623155 : Linux kernel vulnerability CVE-2016-4470
Vulnerability Solution Article: K55672042
622257 : Linux kernel vulnerability CVE-2016-5829
Vulnerability Solution Article: K28056114
622069 : Resolution of multiple curl vulnerabilities
Vulnerability Solution Article: K16704 K16707
621986 : Users can't generate AVR reports in WebApplication or Network Security modules against a BIG-IP HA setup
Component: BIG-IQ App Visibility and Reporting (AVR)
Symptoms:
When trying to generate an AVR report on a single or a group of devices an error "Proxy task failed" is returned.
Conditions:
Attempting to generate AVR reports against a BIG-IP HA cluster environment. This can happen also intermittently.
Impact:
Customer aren't able to generate AVR reports.
Fix:
When trying to generate an AVR report on a single or a group of devices an error "Proxy task failed" was returned. This could also happen intermittently.
The fix makes sure the outgoing AVR request from the BIG-IQ are destined to the queried device only and not replicated to the HA peers.
621767 : LTM service discovery fails if virtual address has route domain with "any" address
Component: BIG-IQ Local Traffic & Management
Symptoms:
Discovery fails with error: "Error while transforming Virtual Server, Details: java.lang.IllegalArgumentException: Invalid route domain (1:0)."
Conditions:
This issue applies to virtual addresses with a route domain and a "any" or "any6" address.
Impact:
LTM service discovery fails.
Workaround:
1) Manually edit bigip.conf and change the name of the virtual address named "any" to "0.0.0.0". Find line: "ltm virtual-address /Common/any%1" and change the "any" to "0.0.0.0". Load config via "tmsh load sys config" and save config via "tmsh save sys config".
Fix:
BIG-IQ now properly handles this case during LTM discovery.
621627 : SNMP Client Allowed List has incorrect Mask value in builtin entry
Component: BIG-IQ System
Symptoms:
On the SNMP Access - Client Allowed List screen, there is a single entry with default Mask set as "127.". This is wrong, only the address should be set as "127.".
Conditions:
The mask is not changed to a valid mask before saving.
Impact:
The default values shown on the screen are incorrect and must be corrected by the user.
Workaround:
Replace the mask with valid value.
Fix:
BIG-IQ has been updated to prevent this.
621516 : ASM - import failure when policies originate from a device with users that have special characters in username★
Component: BIG-IQ Web Application Security (ASM)
Symptoms:
ASM import failure when policies originate from a device with users that have special characters in the username.
Conditions:
One of the BIG-IP users that have a special character such as a '!' makes a change to a security policy before the configuration is discovered and imported.
Impact:
This issue causes an error when importing the configuration.
Fix:
Device configurations with usernames that contain the ! are no longer generating an error when being imported in BIG-IQ. Validation logic has been changed to accept those configurations.
621413 : OpenSSL vulnerability CVE-2016-6304
Vulnerability Solution Article: K54211024
621321 : Europe/Moscow timezone is incorrect
Component: REST Framework and TMOS Platform
Symptoms:
Incorrect time shown for Moscow
Impact:
Incorrect time shown for Moscow
Fix:
Fixed by bringing in latest timezone files.
621244 : vjail score not shown on dashboard for mobilesafe alerts
Component: BIG-IQ Fraud Protection Service (FPS)
Symptoms:
When Mobilesafe alerts are received with vjail score, it is not displayed on UI.
Impact:
The field and value is missing from UI.
Fix:
For some MobileSafe alerts, the vjail score was not shown. This is now fixed.
620901 : Missing "client IP" field in alert on BIG-IQ FPS dashboard
Component: BIG-IQ Fraud Protection Service (FPS)
Symptoms:
If client IP information is received from any source other than alert header, it was not collected.
Conditions:
If client IP information is received from any source other than alert header, it was not collected
Impact:
UI does not show client IP correctly. Alerts can not be searched using client-IP.
Workaround:
No workaround.
Fix:
Some alerts, such as copied pages phishing, did not have the client IP address set correctly if it was not in the header. This is now fixed.
620231 : The Web Application Security marks all devices as modified when restoring configuration from a snapshot
Component: BIG-IQ Web Application Security (ASM)
Symptoms:
The Web Application Security marks all devices as modified when restoring a configuration snapshot, even when the restore operation does not change device configuration in working-config.
Conditions:
A restore operation is done that changes configuration for some of the devices.
Impact:
The issue may confuse users to think that a deploy operation is required.
Workaround:
An evaluation can be attempted to check whether deploy changes are needed. If not, the system will turn off the modified device indicator.
Fix:
The system now better detects which device configuration has changed during the restore operation, and only such devices are now marked with the modified device indicator.
Behavior Change:
When restoring Web Application Security configuration modified device indicator is now only turned on for devices that the restore operation changed their configuration. Before the change all devices would have their indicator turned on.
619890 : BIG-IQ cannot be setup when configured with VLANs referencing trunks
Component: BIG-IQ System
Symptoms:
After attempting to complete BIG-IQ's setup wizard, the following error appears in the restjavad logs repeatedly: [ERROR][27 Sep 2016 11:17:38 AEST][/shared/system/easy-setup EasySetupWorker] Unexpected exception: java.lang.NullPointerException
Conditions:
This issue occurs when BIG-IQ is configured with trunks for interfaces which are referenced via VLANs / Self IPs.
Impact:
BIG-IQ cannot be setup when configured with VLANs referencing trunks.
Workaround:
Use the CLI/tmsh to configure more complicated networking after running BIG-IQ setup.
Fix:
BIG-IQ's setup wizard can now be completed when the internal VLAN is configured with a truck. See release notes for ID635584 for remaining related issues.
618497 : OpenSSL vulnerability CVE-2016-2182
Vulnerability Solution Article: K01276005
618007 : BIG-IQ does not correctly link VLAN and interface configuration from Viprion when blade id is part of the interface name
Component: BIG-IQ Local Traffic & Management
Symptoms:
BIG-IQ does not correctly link VLAN and interface configuration from Viprion when blade id is part of the interface name.
Conditions:
This occurs with interfaces including blade names.
Impact:
When viewing the linkage between the interfaces and VLANSs the interfaces containing the blade id (e.g. "1/1.1") will not appear to be linked to the VLANs.
Fix:
BIG-IQ now properly imports interfaces for VLANs on Viprions.
617607 : Changing the state of pool members or virtual servers on manual sync DSC groups moves the group out of sync.
Component: BIG-IQ Local Traffic & Management
Symptoms:
Instant deployments (i.e., updating the BIG-IP state of a virtual server or pool member outside of the Change Management module) within a manually-synced, clustered BIG-IP environment will result in an error being thrown for one of the two BIG-IPs. Furthermore, the two BIG-IPs will be in Changes Pending state following the deployment.
Conditions:
BIG-IP cluster is setup as a manually-synced cluster (Sync-Failover group is set to Manual Sync).
Impact:
The deployment will fail to one of the two devices, and the BIG-IP devices will be left in Changes Pending state.
Workaround:
Log into one of the BIG-IP devices, and manually sync the changes from the one device that got the change to the other one (Click the "Changes Pending" link in the top-left corner). Or setting the cluster to automatically sync.
Alternatively, the cluster can be sync'd via the BIG-IQ UI using the Device Management -> DSC Groups and syncing in the DSC Group Properties.
Fix:
BIG-IQ now handles instant deployments in this scenario.
617547 : Changing timer policy rule from a port-based to non-port-based protocol
Component: BIG-IQ Network Security
Symptoms:
If a timer policy rule is changed from a port based protocol to non-port-based protocol, deployment will fail with device error when the change is deployed from the BIG-IQ to the BIG-IP.
Conditions:
Seen when a BIG-IP port-based timer policy rule is changed to non-port-based rule in a BIG-IQ deployment task.
Impact:
Timer policy rules cannot be changed from port-based to non-port-based rules using a BIG-IQ deployment task.
Workaround:
On the BIG-IQ, delete the port-based timer policy rule in the timer policy, and create a new non-port-based rule with the same name or a new name.
Fix:
A timer policy rule that is changed from a port based protocol to non-port-based protocol, no longer causes deployment failure.
617266 : Sevone PLA schedule end date cannot be extended if schedule is finished
Component: BIG-IQ Configuration - Infrastructure
Symptoms:
If the last scheduled sevone PLA configuration push has occurred for a particular sevone PLA schedule, the end date for that schedule cannot be extended.
Conditions:
Seen on daily, weekly, and monthly schedules.
Impact:
User must create a new sevone PLA external logging device entry with a new schedule if end date is to be extended.
Workaround:
Create a new sevone PLA external logging device entry with new schedule that contains the desired end date.
Fix:
An existing PLA configuration push schedule can be extended into the future even after it has reached its previously configured end date.
617178-1 : Prefix Length value of None in custom source address persistence profile on BIG-IP gets parent's value on BIG-IQ after importing
Component: BIG-IQ Local Traffic & Management
Symptoms:
BIG-IQ cannot detect that a child source address persistence profile has inherited its parent's value. This is due to a defect on BIG-IP in versions before 11.6.
Conditions:
This issue only applies to BIG-IP versions below 11.6. This occurs when the parent source address persistence profile (source_addr) has a mask or prefix set and a child profile has this setting as "none".
Impact:
On BIG-IQ the prefix value will appear to be customized on the child source address profile even though on BIG-IP it is not.
Workaround:
If managing versions 11.5.x, do not set parent source address profiles' masks. Instead manage the mask on the children directly.
Fix:
BIG-IQ now supports setting the mask on the parent.
615180 : Web Application Security deployment from a snapshot fails
Component: BIG-IQ Web Application Security (ASM)
Symptoms:
Web Application Security deployment from a snapshot fails with error: Exception in verifyConfig: java.lang.NullPointerException.
Conditions:
The issue happens when deploying a configuration from a snapshot and the deployed changes include deletion of policies.
Impact:
The issue causes a deployment/evaluate failure.
Fix:
A deployment crash that involved deletion of policies was fixed.
614819 : Devices under high load may show inaccurate status messages
Component: BIG-IQ Device Management
Symptoms:
On a BIG-IQ under high load, there can be occasional displays of the "You are not licensed yet" banner, even though the device is licensed. Performance problems can also cause managed devices to falsely appear as "unhealthy".
Conditions:
This is an intermittent issue under certain high-load situations.
Impact:
This can be confusing to you. Certain actions may not succeed on devices that are marked "unhealthy".
Workaround:
Wait a few minutes, and the issue should resolve itself.
Fix:
BIG-IQ now shows the "You are not licensed yet" messaging only after confirming that is indeed the case.
614233-1 : Browser performance degredation with large number of discovered Profiles, Monitors and iRules that have unique fullPaths
Component: BIG-IQ Local Traffic & Management
Symptoms:
Browser performance is degraded on Virtual Servers, Pools, Pool Members and Nodes properties pages.
Conditions:
One or more BIG-IPs are discovered with hundreds/thousands of Profiles, Monitors or iRules and user navigates to a Virtual Server, Pool, Pool Member or Node properties page or attempts to create a new object of one of these types.
Impact:
Browser performance is degraded. In some browsers, such as Firefox, you may see a dialog that shows "A script on this page may be busy, or it may have stopped responding."
Workaround:
Use the latest version of Chrome browser for best performance.
Fix:
The performance of this area has been greatly improved.
613558 : Unable to delete System Self IP using Internet Explorer 11
Component: BIG-IQ System
Symptoms:
Nothing happens when trying to delete System Self IP via GUI.
Conditions:
Issue applies when using Internet Explorer 11.
Impact:
User is unable to delete System Self IP.
Workaround:
Use Firefox or Chrome browser. Self IP can also be removed via tmsh using: "tmsh delete net self <self_ip_name>". Or the REST API using: "restcurl -u <user:password> /mgmt/tm/net/self/~Common~<self_IP_name> -X DELETE"
Fix:
System Self IP's can now be deleted using Internet Explorer 11.
613353 : Multiple OpenSSL Vulnerabilities
Vulnerability Solution Article: K90492697
613245 : Alert Transform Rule import with CSV files larger than 8MB fails
Component: BIG-IQ Fraud Protection Service (FPS)
Symptoms:
Import of large CSV file fails.
Conditions:
Only when files are larger than about 8 MB
Impact:
User can not apply signatures, typically exported from SOC.
Workaround:
- Split the CSV file into multiple files less than 8MB.
- Ensure split happens along line boundary, so, complete lines are in files.
- Ensure CSV header (first line from original file) gets copied to each subsequent split file. That way each CSV file has its own header.
- Upload these smaller CSV file individually
Fix:
FPS Alert Transform Rule CSV files up to 32MB in size are now supported.
612566 : FPS alerts or ASM Events or Access Reporting is empty after restoring a Logging Cluster Snapshot
Component: REST Framework and TMOS Platform
Symptoms:
After running restore operation on the Data Collection Devices, FPS alerts or ASM events or Access Reporting do not display restored data.
Conditions:
You find the following in the restjavad logs
java.lang.IllegalArgumentException: status:403, body:{"error":{"root_cause":[{"type":"index_closed_exception","reaso
n":"closed","index":"websafe_2016-08-23t00-00-00-0700"}],"type":"index_closed_exception","reason":"closed","index":"websafe_2016-08-23t00-00-00-0700"},
"status":403}
Impact:
FPS alerts not visible (or ASM events or Access reports)
Workaround:
Query for closed indices
curl 'localhost:9200/_cat/indices?pretty
Then for each closed index run the following command
Worked around by issuing the command as follows:-
curl -X POST 'localhost:9200/<index_name>/_open'
Fix:
You will need to open closed indices so that the queries can work
612044-1 : iHealth upload fails after BIG-IP upgrade from 11.5.x
Component: BIG-IQ Device Management
Symptoms:
iHealth upload may fail with an the error "Request for POST on <IP address> failed: status:400". The failure message will also contain the text "Only requests [[Source: LOCAL], [Source: BIGIQ]] are supported".
Conditions:
This occurs following a BIG-IP upgrade from an 11.5.x version.
Impact:
iHealth upload may fail with an the error "Request for POST on <IP address> failed: status:400". The failure message will also contain the text "Only requests [[Source: LOCAL], [Source: BIGIQ]] are supported".
Workaround:
This issue can be resolved by removing BIG-IP from BIG-IQ management and then adding it back.
Fix:
This issue has been fixed in BIG-IQ 5.2.
611257 : BIG-IQ signals success when assigning a license to an unmanaged BIG-IP hardware-based device
Component: BIG-IQ Device Management
Symptoms:
BIG-IQ signals success when assigning a license to an unmanaged BIG-IP hardware-based device, however, the hardware device rejects the license.
Conditions:
Assigning a license from BIG-IQ to an unmanaged BIG-IP hardware device.
Impact:
The customer is led to believe the licensing operation was successful when it otherwise fails.
Fix:
BIG-IQ now prevents assigning a license to a hardware device.
610660-1 : Unexpected difference and loss of inheritance for null-mask in Source Addr persistence profile on BIG-IP
Component: BIG-IQ Local Traffic & Management
Symptoms:
After successful deployment and subsequent evaluation, BIG-IQ UI shows a difference where there should be none.
Conditions:
This issue occurs when a source address profile with "mask none" is created on BIG-IQ and deployed to a BIG-IP 11.5.x device.
Impact:
The persistence profile loses its inheritance nature. A mask overridden with "none" on BIG-IQ is ignored by BIG-IP. BIG-IP 11.5.x devices treat null as "none" in this context but should not. A false difference is presented to user.
Workaround:
Always explicitly override all properties with the desired value.
Fix:
BIG-IQ now has a workaround for cases where BIG-IP does not differentiate 'none' overrides.
610216 : Linux TCP Stack vulnerability CVE-2016-5696
Vulnerability Solution Article: K46514822
610135 : Firewall or NAT policies may show false differences, in some conditions, when IP protocol 138 through 141 are used.
Component: BIG-IQ Network Security
Symptoms:
When a BIG-IQ 5.0 with Firewall or NAT policies containing rules using IP protocols 138 through 141 is upgraded to 5.0 HF1 or later, there are cases when a false difference is shown for those protocols after deployment.
Impact:
The BIG-IQ will continue to show differences between its configuration and the BIG-IP's for these protocols until the workaround is executed. Functionally the BIG-IP will behave correctly.
Workaround:
To correct these erroneous differences, deploy any other pending changes to the device. Following the deployment, re-import the device choosing "USE BIG-IP" in the conflict resolution screen for the rules showing a protocol difference.
Fix:
When a BIG-IQ 5.0 with Firewall or NAT policies containing rules using IP protocols 138 through 141 is upgraded to 5.0 HF1 or later, false difference are no longer shown for those protocols after deployment.
609403 : The BIG-IQ timezone is off-set for the SevOne Performance Logging Appliance monthly-scheduled push time
Component: REST Framework and TMOS Platform
Symptoms:
If the BIG-IQ time zone is different than the browser time zone for the browser accessing BIG-IQ, then the SevOne external logging device, monthly scheduled next push time, is offset as follows: monthly scheduled push time + (browser time - BIG-IQ time).
Conditions:
This occurs only for monthly push schedules.
Impact:
This time zone difference offset behavior results in an unexpected monthly scheduled push time.
Workaround:
When configuring a monthly push schedule, factor in any time zone difference between the browser time zone and the BIG-IQ time zone.
For example, if browser is being run in ET (eastern time zone), and BIG-IQ is sited in a data center in CT (central time zone), offset desired monthly push time by one hour, as follows: desired push time 12:00, configured push time 11:00. NOTE: There is one hour difference between ET and CT.
Fix:
This issue has been resolved in BIG-IQ version 5.2. Timezone offset for monthly schedules is calculated correctly.
608932-1 : DSC Sync status not correctly determined
Component: BIG-IQ Configuration - Infrastructure
Symptoms:
If cm device-group name on BIG-IP is a subset of a hostname of a BIG-IP in group then config may not be parsed correctly.
Conditions:
cm device-group name is part hostname
example:
BigiIP device-group spain-madrid
BIG-IQ Cluster group name spain-madrid
hostname spain-madrid-bigip1.example.com
Impact:
BIG-IQ fails to manage device correctly.
Workaround:
rename device-group to a unique name.
remove BIG-IPs from BIG-IQ config
On BIG-IP
1) create new empty device group
2) move devices out of old device-group
3) put devices in new device group
4) del old device group
5 perform initial sync
On BIG-IQ discover devices
Fix:
DSC sync status is correctly determined even for groups that are sub string of device names.
606431 : Certain Web Application Security related to searches take a long time to complete
Component: BIG-IQ Web Application Security (ASM)
Symptoms:
Certain Web Application Security related-to searches take a long time to complete. This happens when a large number of devices is discovered and imported into BIG-IQ Web Application Security.
Conditions:
This happens when a large number of devices is discovered and imported into BIG-IQ Web Application Security, and performing a related-to search on signature sets.
Impact:
The search takes may take several minutes to complete.
Fix:
BIG-IQ related-to search performance on large scale configuration was improved so these searches are now faster than they were in previous releases.
603960 : Managed device license status is not updated
Component: BIG-IQ Device Management
Symptoms:
BIG-IQ's managed device license status does not reflect the current managed device's license status for 12 hours.
Conditions:
A BIG-IP with an experienced license has recently been reactivated or a new license granted.
Impact:
Incorrect managed device license status is shown for 12 hours.
Workaround:
PATCH /mgmt/cm/shared/event/alert-config/license_health
{
"eventCreationIntervalInMillis": 60000,
"pollingInterval": "1m",
"eventTimeWindow": "1h"
}
This sets the config to generate an event every minute, check for alerts every minute, and check events over the past hour. An alert should be thrown within a few minutes.
Note that in scale environments this will introduce thousands of new events into the system and may cause Toku slowness.
Fix:
The reactivated/new license status is now updated within a few minutes.
600379 : OpenSSL vulnerability CVE-2016-2177
Vulnerability Solution Article: K23873366
599845 : Hardware compression test fails on BIG-IQ 7000.
Component: REST Framework and TMOS Platform
Symptoms:
Internally executed hardware acceleration tests fail while running a platform-check utility command.
Conditions:
Running hardware acceleration tests with the platform-check utility command on the BIG-IQ 7000 series platforms.
Impact:
Tests fail.
Workaround:
None.
Fix:
Internally executed hardware acceleration tests now complete successfully on the BIG-IQ 7000 series platforms when running a platform-check utility command.
598590 : Web Application Security - device modified indicator is not turned on when deploying the configuration from a snapshot.
Component: BIG-IQ Web Application Security (ASM)
Symptoms:
Web Application Security - device modified indicator is not turned on when deploying the configuration from a snapshot.
Conditions:
Deployment from a previously saved snapshot is performed.
Impact:
Devices are not marked as modified in the BIG-IQ UI.
Workaround:
To check if the device is modified and evaluate changes.
Fix:
BIG-IQ Web Application Security now marks devices as modified (changes pending) when configuration deployment was done from a snapshot, since it is likely that there are changes in working config that are not yet deployed.
597979-1 : Path sanitization for iControl REST worker
Vulnerability Solution Article: K99998454
596787 : Cannot export Web Application Security event logs in a CSV file using Chrome/Firefox
Component: BIG-IQ Web Application Security (ASM)
Symptoms:
Exporting Web Application Security event logs fails silently without any errors in Web Application Security GUI when clicking the Select All option.
Conditions:
Issue happens when Select All option is used, which selects more than 50 event logs per screen, however users are able to download CSV files for smaller number of selected Web Application Security event logs in Chrome/Firefox.
Impact:
Users cannot retrieve event logs in a CSV file on Chrome/Firefox.
Workaround:
Event logs can be exported in a CSV file by using Internet Explorer as the browser, or by selecting fewer records at a time.
Fix:
Improvements were added to the server side code to improve scalability and support exporting of a larger number of events.
595822 : Deployment will fail if a FW NAT Policy coexists with existing LTM pools (either SNAT/LSN/Automap or LTM Pool)
Component: BIG-IQ Network Security
Symptoms:
Deployments will fail if a firewall NAT policy coexists with existing LTM pools (either SNAT/LSN/Automap or LTM Pool).
If a virtual server has a firewall NAT policy attached along with LTM pools (either SNAT/LSN/Automap or LTM Pool) configured, the deployment will fail.
Impact:
No verification warning or critical error is displayed to the user prior to the deployment failing.
Fix:
This erroneous configuration is now caught in the off-line verification phase of the deployment.
595302 : DoS Profiles do not support correct upper range eveywhere
Component: BIG-IQ Network Security
Symptoms:
Some BIG-IQ DoS Profile fields have incorrect upper boundaries for fields that support ranges. Where BIG-IP system supports up to 4294967295 for many fields, in some places BIG-IQ supports only a maximum value of 2147483647.
Conditions:
The following error messages might be displayed if you specify too large of a number for a DoS Profile field, "This value is too large" or
"The system returned an unexpected error (400 Bad Request). Invalid JSON posted - could not deserialize to class com.f5.rest.workers.security.shared.config.dosProfile.state.DosProfileApplicationState."
Impact:
When an incorrect upper range value is specified, the resulting error messages may not be as useful as possible.
Workaround:
When attempting to set the maximum value for a field, use 2147483647. Refer to the BIG-IP DoS Profile documentation to find the correct maximum value for a particular field.
Fix:
The correct maximum value is now indicated in all error messages for DoS Profile fields.
594397 : TLS/DTLS 'Lucky 13' vulnerability CVE-2013-0169
Vulnerability Solution Article: K14190
593678 : Critical error shown on deployment for 12.x devices with policies originated from 11.x devices
Component: BIG-IQ Web Application Security (ASM)
Symptoms:
Critical error shown on deployment for 12.x devices with policies originated from 11.x devices. The error states that policy builder settings and violation settings are inconsistent. Example: "Policy /Common/aaa: can't be used on a BIG-IP version 12.0.0. checkMaximumCookieHeaderLength value (true) on policy builder and the matching violation: VIOL_COOKIE_LENGTH (false) have different values." (slightly different cases exist).
Conditions:
The issue happens when automatic policy builder is enabled on the source policy.
Impact:
The policy can't be deployed.
Fix:
Policies that originated from 11.x with certain policy builder settings will no longer trigger critical errors on deployment to BIG-IP versions 12.x.
591982 : Policy specific signature settings (enabled, in staging) may not be deployed correctly when deployment task deploys other relevant changes
Component: BIG-IQ Web Application Security (ASM)
Symptoms:
Policy specific signature settings (enabled, in staging) might not be deployed correctly when the deployment task deploys other relevant changes.
If the deployment included any change that alters the signatures relevant for a policy, the signatures that are affected by this change are configured with the settings last set by BIG-IP system for those signatures, and not the settings that are saved in BIG-IQ.
Conditions:
This happens when policy signature settings are customized on BIG-IP/BIG-IQ and the change to deploy those customizations also includes changes that make these customized signatures relevant for policies. Such changes could include signature set filter changes, adding a signature set to a policy, or change in user defined signature attributes.
Impact:
Per policy signature settings are deployed incorrectly, and an additional deployment task may be required to set the user intended values.
Workaround:
Evaluate and deploy again when such changes are done
Fix:
When BIG-IQ manages a 13.x device, the interaction with BIG-IP improved so BIG-IP handles all signatures in the policy, not only those that match the signature sets. This eliminates the issue since changing signature sets no longer exposes older hidden configurations.
Behavior for versions before 13 is unchanged.
590604 : BIG-IQ does not manage the learn flag on BIG-IP policy sub violations - HTTP Protocol Compliance and Evasions
Component: BIG-IQ Web Application Security (ASM)
Symptoms:
BIG-IQ does not manage the learn flag on BIG-IP policy sub violations - HTTP Protocol Compliance and Evasions. The configuration is not discovered/imported/deployed.
Conditions:
The issue is only relevant to management of BIG-IP devices of versions 12 and above.
Impact:
Deployment of policy configurations to BIG-IP devices will result in different behavior compared to that on the BIG-IP in which the policies originated from. Note that these are not policy enforcement settings (automatic learning).
Fix:
Support for management of the learn flag was added for the BIG-IP versions that support it.
590514-1 : [Fixed] Certificate Expiration emails report stale Expiration Date
Component: REST Framework and TMOS Platform
Symptoms:
Certificate Expiration emails report stale Expiration Date following certificate renewal.
This has been fixed in 5.2
Conditions:
Certificate expires on a managed system
Impact:
Cosmetic, the alert is still correct it just displays the wrong date
Workaround:
No work around for 5.0
Fix:
Certificate Expiration alert emails now include the correct expiration date when they are sent.
590492 : Missing vector support under DoS Single Endpoint for 11.5.3 BIG-IP; also, GUI error doesn't provide info of unsupported vectors
Component: BIG-IQ Network Security
Symptoms:
BIG-IQ Shared Security Device DoS only supports the following DoS Single Endpoint vectors for an 11.5.3 BIG-IP device: Any ICMP IPv4, Any ICMP IPv6, Any IPv4, and Any IPv6. The following vectors are not supported: Any UDP IPv4, Any UDP IPv6, TCP SYN without ACK IPv4, and TCP SYN without ACK IPv6.
An error like the following is shown when a user tries to configure unsupported Single Endpoint vectors for an 11.5.3 BIG-IP device:
"The system returned an unexpected error (400 Bad Request). dos-device-config is invalid on device bigip3.dmeast.acopianet.com (10.1.1.11), device doesn't support enhanced 11.6.0 features."
Conditions:
Select Device DoS from Shared Security. From Device DoS, under Device Configuration, select Single Endpoint. Both Single Endpoint Flood and Single Endpoint Sweep do not support the previously listed vectors with BIG-IP version 11.5.3.
Impact:
This issue results in the user being unable to use the unsupported vectors with BIG-IP version 11.5.3.
Fix:
All 11.5.3 DoS Single Endpoint vectors now supported.
589931 : Multiple Samba vulnerabilities
Vulnerability Solution Article: K37603172
588651 : BIG-IQ fails to manage a BIG-IP device when changing the device certificate of the device
Component: REST Framework and TMOS Platform
Symptoms:
When the device certificate of a managed BIG-IP device is changed the BIG-IQ device management for the related BIG-IP is compromised. The BIG-IP device would be unavailable for further device management workflows in the BIG-IQ user interface.
Conditions:
Changing the device certificate of a BIG-IP device while the BIG-IP is managed by a BIG-IQ.
Impact:
The BIG-IP device becomes unavailable in the BIG-IQ device management user interface.
Workaround:
Either of the following procedures would restore the availability of the managed BIG-IP device in the BIG-IQ device management user interface:
- re-discover the BIG-IP device using the BIG-IQ device management user interface
- restart the restjavad daemon on the BIG-IQ, using the BIG-IQ CLI and running the following command "bigstart restart restjavad"
Fix:
Either of the following procedures would restore the availability of the managed BIG-IP device in the BIG-IQ device management user interface:
- re-discover the BIG-IP device using the BIG-IQ device management user interface
- restart the restjavad daemon on the BIG-IQ, using the BIG-IQ CLI and running the following command "bigstart restart restjavad"
588359-1 : Multiple nginx vulnerabilities
Vulnerability Solution Article: K23073482
588171 : Under heavy sustained stress traffic over 500 sessions per second from the BIG-IP system, Logging Node fails to accept logs
Component: BIG-IQ Access
Symptoms:
BIG-IQ Logging Node drops logs if traffic on BIG-IP APM generates more than 4,500 logs per second for 10 minutes.
Conditions:
High number of sessions have to be created on the BIG-IP devices for a period of more than 10 minutes.
Impact:
Loss of logs on Logging node.
Workaround:
To try to work around this issue, load-balance the logs from the BIG-IP device to multiple BIG-IQ Logging Nodes, and enabling Access service on them.
Fix:
Design change to add flow-control to the logging node listener is added.
587511 : libtar vulnerability CVE-2013-4397
Vulnerability Solution Article: K16015326
587060 : New policies deployed to BIG-IPs may have wrong settings for user defined signatures if those are created on different BIG-IP devices
Component: BIG-IQ Web Application Security (ASM)
Symptoms:
New policies deployed to BIG-IP devices might have the wrong settings for user-defined signatures if those are created on different BIG-IP devices.
Conditions:
This happens when user-defined signatures are created independently on different BIG-IP devices.
Impact:
Wrong policy settings will be set on the target BIG-IP devices. Subsequent evaluations will show differences.
Workaround:
Evaluate and deploy again to correct the wrong settings.
We also recommend that you add all user-defined signatures through BIG-IQ to avoid the issue.
Fix:
Interaction with the BIG-IP was improved and now on deployment of new policies the correct signatures are set with correct values.
585769 : BIG-IQ Logging Snapshots: After scheduling a snapshot, the "Snapshot Schedules" reads "N/A"
Component: REST Framework and TMOS Platform
Symptoms:
After creating a new Snapshot Schedule in BIG-IQ Logging, if the Snapshot Schedules field displays "N/A", this might indicate that a snapshot schedule won't run.
If you did not encounter an error message while creating the snapshot schedule, BIG-IQ should correctly create a new snapshot at the next scheduled time.
Impact:
When the Snapshot Schedule is listed as "N/A" it may or may not be running a snapshot schedule.
584666 : Grid columns may be render partially or completely off-screen
Component: REST Framework and TMOS Platform
Symptoms:
Some grid columns may not be visible when the grid is too wide to fit into the current browser window.
Conditions:
Some grid columns may not be visible when the grid is too wide to fit into the current browser window.
Impact:
The page may look incorrect and visible columns will appear hidden when a user changes the width of a column.
Workaround:
To work around this issue:
- Increase the width of your browser window until all columns are visible.
or
- Change the visible columns by clicking the gear icon at the upper right corner of the grid, and adding or removing columns until the desired columns are visible.
Fix:
A horizontal scroll bar is now provided when grid columns exceed the visible screen width.
583975 : BIG-IQ Logging configuration should not be performed on the Logging Node
Component: REST Framework and TMOS Platform
Symptoms:
When user logs into a Big-IQ Logging node and goes to System Management-> Logging Configuration
He can then choose to configure the indices or the Snapshot policy.
This will have no effect since it is on the logging node.
Conditions:
When user logs into a Big-IQ Logging node
Impact:
User does not see anything happen
Workaround:
Do the changes from BIG-IQ
Fix:
Logging configuration should not be modified on BIG-IQ Logging Node
582856 : Mozilla NSS vulnerability CVE-2016-1950
Vulnerability Solution Article: K91100352
582626 : Web Application Security event logs do not show violation ratings
Component: BIG-IQ Web Application Security (ASM)
Symptoms:
Web Application Security event logs do not show violation ratings, even when the BIG-IP system that sends the log records supports violation ratings.
Conditions:
Happens when BIG-IQ shows events from BIG-IP versions that support violation ratings.
Impact:
Violation ratings are not displayed.
Fix:
Web Application Security Event Logs now show the violation ratings coming in from the BIG-IP if the BIG-IP version supports it.
581899 : Logs and sessions info are missing in BIG-IQ Access reports
Component: BIG-IQ Access
Symptoms:
BIG-IQ Access reports are missing logs and session data.
Conditions:
This is usually seen under 2 circumstances:
1. Bigstart restart apmd tmm on the managed BIG-IP device.
2. The log-node/restjavad on the Log-node restarts.
Impact:
Loss of logs and session info in BIG-IQ Access Reporting.
Workaround:
To resolve this issue, log in to the command line of the managed BIG-IP and type the following command: bigstart restart tmm
Fix:
The fix is in HSL layer, which stops sending logs when it hits its internal queue full.
The fix is already checked into 13.0 branch and will be integrated into 12.1.0-hf2 branch once it is available.
581471 : Updating an LDAP Auth Provider fails
Component: REST Framework and TMOS Platform
Symptoms:
When attempting to change the "Bind Password" field, or when setting the "Connect Timeout" or "Read Timeout" fields to values greater than 2147483, users are unable to change the "Bind Password" value for LDAP auth providers.
Conditions:
When attempting to change the "Bind Password" field, or when setting the "Connect Timeout" or "Read Timeout" fields to values greater than 2147483.
Impact:
Users are unable to change the "Bind Password" value for LDAP auth providers.
Workaround:
To resolve this, delete and recreate the auth provider with the wanted "Bind Password" value.
580726-1 : License state information from REST worker is out of sync with device
Component: BIG-IQ Device Management
Symptoms:
The license information returned from the REST endpoint /mgmt/tm/shared/licensing/registration does not match the information returned from tmsh show sys license
Conditions:
1. Device has an expired license (for example, an expired Eval period)
2. That license is re-activated, so that inspecting the device manually shows it is no longer expired.
Impact:
The license state information returned from REST workers maybe be out of date with the information on the device.
Workaround:
Restart REST services on the BIG-IP device by typing bigstart restart restjavad
580103-1 : ADC deployment fails because a DNS resolver is being used by the http-explicit profile.
Component: BIG-IQ Local Traffic & Management
Symptoms:
ADC deployment fails because a DNS resolver is being used by the http-explicit profile. BIG-IQ does not know about this relationship, and BIG-IP does not allow the DNS Resolver to be removed when referenced by the HTTP Explicit profile.
Conditions:
User wants to deploy a deletion of a DNS Resolver which is referenced by a HTTP Explicit profile.
Impact:
Deployment will fail with a BIG-IP validation error.
Workaround:
To resolve this issue from BIG-IQ, add the device back the DNS Resolver's list of attached devices. Alternatively, on the BIG-IP device, remove the association of the HTTP Explicit profile to the DNS Resolver.
Fix:
BIG-IQ now manages the HTTP profile and can detect and prevent this situation.
580015 : BIND vulnerability CVE-2016-1286
Vulnerability Solution Article: K62012529
579744 : glibc vulnerability CVE-2015-8776
Vulnerability Solution Article: K23946311
575659 : BIG-IP DSC Sync setting not modified on subsequent BIG-IP trust establishment
Component: BIG-IQ Device Management
Symptoms:
If you add a new BIG-IP device to an existing DSC cluster and the Deployment Settings mode is different than the other devices in the cluster, BIG-IQ ignores the setting for the new device.
Conditions:
This is only an issue if the value for the DSC Sync mode is different from the existing DSC cluster sync mode on a device addition to an existing DSC cluster.
Impact:
This means the DSC Sync mode for the cluster remains set to the value initially configured for the first BIG-IP added to the DSC cluster group.
Workaround:
To correct this issue: (1) Click the name of the newly-added BIG-IP device on the BIG-IP Device inventory screen (2) From the Properties screen, click the Edit button for the Cluster Members setting. (4) Edit the Deployment Setting to match the other cluster members.
Fix:
This issue has been fixed in BIG-IQ 5.2.
573323-3 : Remotely-authenticated user with Admin role changed to Guest by McpUsersEnumeratorWorker.
Component: BIG-IQ Device Management
Symptoms:
Remotely-authenticated user with Admin role changed to Guest by McpUsersEnumeratorWorker.
This breaks incremental config sync. There will be errors in /var/log/ltm similar to this:
Oct 19 06:43:37 bigip10 err mcpd[20373]: 01071488:3: Remote transaction for device group /Common/jsyncfail to commit id 3 6343171031926035192 /Common/bigip11.jay.local 0 failed with error 01020036:3: The requested user role partition (admin9) was not found..
Oct 19 06:43:37 bigip10 err mcpd[20373]: 01020036:3: The requested user role partition (admin9) was not found.
Additionally, logged in users will receive this message and be logged out:
Your user account role has been changed, you must re-authenticate.
Current session has been terminated.
Enter any key to end your session.
Conditions:
This occurs when a customer has remote authentication configured (such as TACACS or RADIUS), has logged in at least once, and has their BIGIP managed by BIGIQ
Impact:
Logged in users are logged out. Incremental config sync no longer works.
Workaround:
Perform a full sync
Fix:
This issue has been fixed in BIG-IQ 5.2
572613 : libjpeg vulnerability CVE-2013-6629
Vulnerability Solution Article: K59503294
572608 : Multiple libXML2 vulnerabilities
Vulnerability Solution Article: K61570943
571432 : Mozilla NSS vulnerability CVE-2015-2730
Vulnerability Solution Article: K15955144
570137 : Multiple Java vulnerabilities
Vulnerability Solution Article: K50118123
568590 : BIND vulnerability CVE-2015-8704
Vulnerability Solution Article: K53445000
565221 : Multiple Linux Kernel vulnerabilities
Vulnerability Solution Article: K31026324 K94105604 K90230486
563839 : Multiple libpng vulnerabilities
Vulnerability Solution Article: K81903701 K76930736 K21057235
562693 : BIND Vulnerability CVE-2015-8000
Vulnerability Solution Article: K34250741
561855 : Multiple NSS Vulnerabilities
Vulnerability Solution Article: K31372672
559599 : BIGIQ 7000: GUI Registration Key box is not populated by default
Component: BIG-IQ Device Management
Symptoms:
During initial setup for the BIG-IQ 7000 platform, the license registration key is not populated.
Impact:
BIG-IQ cannot be licensed without a known registration key.
Workaround:
To work around this issue, paste the key into the field. For new hardware platforms, you can find the key in the /config directory.
Fix:
This issue has been fixed. The key is now populated automatically.
557774 : BIG IQ Discovery fails if a DoS profile is configured with custom Bot Signature on the BIG IP
Component: BIG-IQ Network Security
Symptoms:
If you enable and modify the default values for the Bot Signatures or Bot Signature Categories settings
on a version 12.0 BIG-IP device, and then attempt to discover that BIG-IP device using a BIG-IQ system, the discovery will fail because the BIG-IQ DoS Profile only supports the default values for these parameters.
Additionally, if you configure a new Bot Signature category and use the category to create a bot signature list, the Action must be set to a value of None. If the Action is set to a value of Block or Report, discovery of the BIG-IP device will fail even if Bot Signatures are disabled on the BIG-IP device in the DoS profile.
Impact:
Discovery failure makes BigIQ unable to manage Big-IPs with certain configuration.
Workaround:
Do not enable and modify the default values for the Bot Signatures or Bot Signature Categories settings on a version 12 BIG-IP device and then attempt to discover that device using a BIG-IQ system.
Fix:
Discovery of a version 12.0 BIG-IP device no longer fails after you modify the default values for Bot Signatures or Bot Signature Categories settings in Shared Security.
556431 : Linux libuser vulnerabilities
Vulnerability Solution Article: K05770600
554513 : PAM vulnerability CVE-2015-3238
Vulnerability Solution Article: K17494
548085 : Multiple kernel vulnerabilities
Vulnerability Solution Article: K17326
547438 : Multiple GNU TLS vulnerabilities
Vulnerability Solution Article: K17327
545723 : Multiple OpenSSH vulnerabilities
Vulnerability Solution Article: K17263
545369 : SNMP vulnerability CVE-2014-3565
Vulnerability Solution Article: K17315
542976 : Multiple BIND vulnerabilities
Vulnerability Solution Article: K17227 K17181
542392 : Multiple Linux Kernel vulnerabilities
Vulnerability Solution Article: K51518670
541002 : Multiple Java Vulnerabilities
Vulnerability Solution Article: K17172
540056 : Multiple Linux Kernel vulnerabilities
Vulnerability Solution Article: K17309 K17307
538018 : Apache vulnerability CVE-2015-3183
Vulnerability Solution Article: K17251
535886 : OpenSSH vulnerability CVE-2015-5600
Vulnerability Solution Article: K17113
535884 : BIND Vulnerability
Vulnerability Solution Article: K16909
533930 : PCRE library vulnerability CVE-2015-3210
Vulnerability Solution Article: K17235
533924 : PCRE library vulnerability CVE-2015-2325
Vulnerability Solution Article: K16983
531740 : Multiple FreeType vulnerabilities
Vulnerability Solution Article: K16900
530268 : SQLite vulnerability CVE-2015-3416
Vulnerability Solution Article: K16950
529394-1 : CVE-2014-7844 : mailx Vulnerability
Vulnerability Solution Article: K16945
529393-1 : CVE-2004-2771 : mailx Vulnerability
Vulnerability Solution Article: K16945
528771 : Multiple Logrotate vulnerabilities
Vulnerability Solution Article: K16869 K16870 K16871
527639-1 : CVE-2015-1791 : OpenSSL Vulnerability
Vulnerability Solution Article: K16914
527638-1 : OpenSSL vulnerability CVE-2015-1792
Vulnerability Solution Article: K16915
527637-1 : PKCS #7 vulnerability CVE-2015-1790
Vulnerability Solution Article: K16898
527633-1 : OpenSSL vulnerability CVE-2015-1789
Vulnerability Solution Article: K16913
526171 : Multiple LibTIFF vulnerabilities
Vulnerability Solution Article: K16715
526154 : Multiple Mozilla Network Security Services vulnerabilities
Vulnerability Solution Article: K16716
525391 : Linux kernel vulnerability CVE-2014-9585
Vulnerability Solution Article: K17241
525389 : Linux kernel vulnerability CVE-2014-9584
Vulnerability Solution Article: K17245
525386 : Linux kernel vulnerability CVE-2014-9529
Vulnerability Solution Article: K17239
525368 : Kernel Vulnerabilities
Vulnerability Solution Article: K17199
525365 : Linux kernel vulnerability CVE-2015-1593
Vulnerability Solution Article: K17244
525360 : Multiple Linux Kernel vulnerabilities
Vulnerability Solution Article: K17237
525349 : cURL vulnerability CVE-2015-3148
Vulnerability Solution Article: K16707
525347 : cURL vulnerability CVE-2015-3143
Vulnerability Solution Article: K16704
525279 : TLS vulnerability CVE-2015-4000
Vulnerability Solution Article: K16674
522207 : GNU C Library (glibc) vulnerability CVE-2013-7423
Vulnerability Solution Article: K16841
521050 : Apache vulnerability CVE-2013-5704
Vulnerability Solution Article: K16863
515231 : GNU C Library (glibc) vulnerability CVE-2015-1781 & CVE-2013-7423
Vulnerability Solution Article: K16865
511757 : BIND Vulnerability
Vulnerability Solution Article: K16356
505646 : Multiple Glibc vulnerabilities
Vulnerability Solution Article: K16010 K16435
503045 : CVE-2015-0204 : OpenSSL Vulnerability
Vulnerability Solution Article: K16139
501561 : Web Application Security does not allow changing the order of wildcard entities
Component: BIG-IQ Web Application Security (ASM)
Symptoms:
Web Application Security does not allow changing the order of wildcard entities.
Conditions:
None
Impact:
Users cannot change the order of wildcard entity evaluations
Fix:
BIG-IQ now supports changing the order of wildcard evaluations for different policy elements.
500788 : Linux kernel vulnerability CVE-2012-6657
Vulnerability Solution Article: K16011
499075 : CVE-2014-9293 : NTP Vulnerability
Vulnerability Solution Article: K15934
499073 : NTP vulnerability CVE-2014-9294
Vulnerability Solution Article: K15935
488801 : Kernel Vulnerabilities
Vulnerability Solution Article: K15852
487507 : Multiple OpenSSH vulnerabilities
Vulnerability Solution Article: K15780
486791-1 : Resolution of multiple wireshark vulnerabilities
Vulnerability Solution Article: K16939
486622 : Path MTU discovery vulnerability CVE-2004-1060
Vulnerability Solution Article: K15792
486354 : Multiple PHP 5.x vulnerabilities
Vulnerability Solution Article: K15761
484319-1 : File vulnerabilities
Vulnerability Solution Article: K16954
481806-1 : Java Runtime Environment vulnerability CVE-2013-4002
Vulnerability Solution Article: K16872
480424 : Kernel Vulnerabilities
Vulnerability Solution Article: K15680
480421 : Python vulnerability CVE-2013-4238
Vulnerability Solution Article: K15638
480240 : Mozilla NSS vulnerability
Vulnerability Solution Article: K15630
480207 : Multiple Linux Kernel vulnerabilities
Vulnerability Solution Article: K15685
479431-3 : Apache Axis vulnerability CVE-2014-3596
Vulnerability Solution Article: K16821
476871 : MIT Kerberos 5 vulnerability CVE-2014-4342
Vulnerability Solution Article: K15552 K15547
474513 : Multiple Perl Vulnerabilities
Vulnerability Solution Article: K15867
456217 : PHP vulnerability CVE-2013-4113
Vulnerability Solution Article: K15169
439068-1 : SUSE coreutils vulnerabilities
Vulnerability Solution Article: K16859
416372-1 : Boost memory allocator vulnerability CVE-2012-2677
Vulnerability Solution Article: K16946
Known Issues in BIG-IQ CM v5.2.x
These known issues apply specifically to this release. Unless listed in this note as Fixed, known issues that appear in versions 5.0.0 and 5.1.0 may also apply to this release. See the appropriate release note for known issues from previous releases.
BIG-IQ Configuration - Access Issues
| ID Number | Severity | Description |
| 645725 | 2-Critical | Cannot re-import from a SWG-provisioned device after upgrading.★ |
| 659958-1 | 3-Major | Active Directory Groups update does not show any groups |
| 658892-1 | 3-Major | Deployment fails with error : Failed submitting iControl REST transaction ....: status:400,..... unknown property","errorStack":[],"apiError":2} |
| 647189-1 | 3-Major | Deployment to version 12.1.1 device fails with error ""Encountered unsupported operation 16 at /apm/policy/access-policy/..../subroutine-properties" |
BIG-IQ Configuration - Local Traffic Issues
| ID Number | Severity | Description |
| 650218 | 3-Major | Client SSL - BIG-IP 11.5.1 HF7 - overridden yet unchanged Cert Key Chain in Client SSL profile causes discovery failure |
| 641451 | 3-Major | Deployment error when overriding the certificate-key chain on a Client SSL profile. |
| 653529 | 4-Minor | Deployment fails when attempting to deploy more than 4000 certs in a single deployment across multiple BIG-IPs |
| 653528 | 4-Minor | Deployment fails when attempting to deploy more than 1100 certificates and key pairs (2200 files) to a single BIG-IP |
| 637937 | 4-Minor | Similarly named keys/certs on BIG-IPs of different versions appear as distinct objects in BIG-IQ if the name includes special characters |
| 637728 | 4-Minor | SSL keys/certificates on BIG-IP with + or ~ in the name cause a discovery failure in BIG-IQ |
| 636086 | 4-Minor | Certificates and keys that are copied between BIG-IP are not match on the BIG-IQ |
BIG-IQ Configuration - Network Issues
| ID Number | Severity | Description |
| 660022 | 3-Major | BIG-IQ does not support creating route with default address |
BIG-IQ Configuration - Security - Network Security Issues
| ID Number | Severity | Description |
| 658780-1 | 3-Major | A port misuse policy rule marked for deletion will have the deletion state cleared when a new rule is added. |
BIG-IQ Deployment - Evaluate & Deploy Issues
| ID Number | Severity | Description |
| 648546 | 3-Major | Cannot deploy a certificate with server-ssl |
BIG-IQ Device User Interface Issues
| ID Number | Severity | Description |
| 658039-1 | 4-Minor | Failure to reactivate some licenses when EULA has changed |
BIG-IQ Monitoring - Alerts & Notifications Issues
| ID Number | Severity | Description |
| 647177-1 | 3-Major | BIG-IQ system performance can degrade with high numbers of accumulated snapshots |
BIG-IQ Monitoring - Dashboards & Reports Issues
| ID Number | Severity | Description |
| 653760-1 | 3-Major | Token Table is not updated in real time on the drill down screen |
| 652975-1 | 3-Major | OAuth Client timeline doesn't show right data if timeframe is changed |
| 639896-1 | 3-Major | Cannot view SWG Reports and download CSV Reports on Standby BIG-IQ |
| 647068 | 4-Minor | Sharepoint and OWA Application data missing in the Access Application Dashboard |
| 627105-1 | 4-Minor | Incorrect Error when clicking on Tokens under Monitoring --> Access --> Federation --> OAuth --> Authorization Server --> Tokens |
BIG-IQ Search Issues
| ID Number | Severity | Description |
| 641427-1 | 3-Major | Portal Access Rewrite not be searchable by Global Search |
BIG-IQ System User Interface Issues
| ID Number | Severity | Description |
| 655987-1 | 3-Major | When upgrading devices with large configurations to 5.2, user may encounter errors when setting the Master Key in the setup wizard★ |
BIG-IQ Access Issues
| ID Number | Severity | Description |
| 660828 | 3-Major | Deployment Failure: "transaction failed: ... : file (/config/filestore/files_d/Common_d/customization_group_d/:Common:...) expected to exist" |
| 659829-1 | 3-Major | Evaluation error for Local Traffic and Network. Failed to inflate referenced items for unspecific referrer. |
| 655123-1 | 3-Major | Unable to open Network Access, LDAP, AD, CRLDP, TACACS, or Radius server object UI for edit. |
| 652758 | 3-Major | Fail to restore from snapshot |
| 642976-1 | 3-Major | Deployment diff shows unused objects to be deleted during deployment |
| 636188-1 | 3-Major | Access Events in iRule requires an Access Profile associated with Virtual |
| 629213-1 | 3-Major | Set filespace quota for file objects |
| 629041 | 3-Major | Access deployment failure with error "DNS resolver /Common/<dns resolver name>: Referencing a non existing route domain /Common/<route_domain_name>." |
| 618101 | 3-Major | Access Reporting UI take 30 seconds or more to load. |
| 612292-1 | 3-Major | Customization file changes are not deployed when customization template and customization group objects are created in deployment |
| 659424-1 | 4-Minor | Deployment failure due to SAML object deletion |
| 505455-1 | 4-Minor | Adding a device to Access Group fails: Unable to calculate working config ID |
BIG-IQ Local Traffic & Management Issues
| ID Number | Severity | Description |
| 659729-1 | 3-Major | Filtering by the text 'http' in LTM Profiles grid takes a long time to complete |
| 651892 | 3-Major | Some Rewrite profiles created on BIG-IP cannot be updated or deleted by BIG-IQ |
| 651186-1 | 3-Major | SSL certificate in non-PEM format can not be imported and managed |
| 650405 | 3-Major | Error while transforming Profile Client SSL when BIG-IP in DSC (Failed to transform secure field value) |
| 643825 | 3-Major | Inability to remove Certificate and/or Key used by serverssl profile in specific cases for v11.6.0 and v11.6.1 |
| 641237 | 3-Major | Inability to delete SNAT pool with SNAT transaction from some versions of BIG-IP. |
| 614199-1 | 3-Major | Profile - Client SSL - Cannot deploy Certificate Key Chain changes to root clientssl profile |
| 646929 | 4-Minor | BIG-IQ cannot remove overrides for LWS Separator field on HTTP explicit profiles. |
| 624368 | 4-Minor | BIG-IQ fails to discover Rewrite profiles that have a corrupt passphrase on BIG-IP |
AppIQ Issues
| ID Number | Severity | Description |
| 653467-1 | 2-Critical | Retaining more than 10 hours of raw statistical data may cause chart timeouts when querying for Last Day or Last 12-hours of data |
| 647127-1 | 2-Critical | Removal of Data Collection Device may result in a Elastic Search cluster health status of "red" |
| 656112-1 | 3-Major | Scroll bars are not present on device health, device, traffic, DNS, and local traffic statistics UI |
| 651998-1 | 3-Major | When /var partition reaches configured limit, collection of statistics from BIG-IP will stop, and older data may be automatically removed by BIG-IQ |
| 644884-1 | 3-Major | Sort-Selected rows of data in dimension panes may show N/A for data |
| 642862-1 | 3-Major | BIG-IQ will show statistics for system iRules, which may not be listed in the BIG-IP's UI |
| 644860-1 | 4-Minor | BIG-IQ may take a while to resume statistics collection after a time skew issue has been corrected |
BIG-IQ Device Management Issues
| ID Number | Severity | Description |
| 590791-1 | 3-Major | Rediscovery fails due to required REST framework upgrade although the error message does not indicate this |
| 627255 | 4-Minor | When discovering a cloned BIG-IP, error message does not provide sufficient information |
BIG-IQ Fraud Protection Service (FPS) Issues
| ID Number | Severity | Description |
| 656788 | 3-Major | FPS Alert sorting results not always as expected |
| 635584-1 | 3-Major | BIG-IQ setup wizard fails with "Cannot delete IP X.X.X.X because it would leave a route unreachable" |
| 656861 | 4-Minor | Re-using a filter with a country and region fails to provide region in the filter |
| 649067-1 | 4-Minor | Specifying certain characters in the wrong field can result in failed queries and no matching results |
| 642550 | 4-Minor | If you use Go To to reach an alert near the end of the list, you cannot scroll until you refresh. |
BIG-IQ Network Security Issues
| ID Number | Severity | Description |
| 648876-1 | 3-Major | Discovery of a BIG-IP Advanced Firewall service may fail if the service is newly provisioned on the BIG-IP |
| 632900 | 3-Major | Bot Signatures/Bot Signature Categories User Defined Flag Behavior |
| 632813-1 | 3-Major | Removing the global-fqdn policy may fail. The deployment may need to be done in 2 steps. |
| 638131 | 4-Minor | Deploying a DoS profile imported from a BIG-IP 11.6.x to a 12.x or higher would fail when Proactive Bot Defense is enabled |
| 582701-1 | 4-Minor | At Scale, HTML Report fails to render in IE and Edge. |
REST Framework and TMOS Platform Issues
| ID Number | Severity | Description |
| 656828 | 2-Critical | Setting the master key after upgrading a system with a large configuration from 5.x to 5.2 could result in an unsuccessful encryption of objects. |
| 658358-1 | 3-Major | Minimum master eligible node setting set by user is overwritten by default calculated value when zone of the log node is changed |
| 650404 | 3-Major | A list screen may not always show all items |
| 645768 | 3-Major | TMSH command 'tmsh show sys hardware' is incomplete for VE systems |
| 645721-1 | 3-Major | If you use HTTPS over a proxy for a custom-alert receiver, you need to re-install the receiver's certs after upgrade |
| 632201 | 3-Major | Users who are members of more than 40 user groups may fail to login. |
| 630648-1 | 3-Major | BIG-IQ HA: Zone of the secondary console node is set to default when two BIG-IQ console nodes are paired |
| 620791 | 3-Major | BIG-IQ 5.2.0 images imported into previous versions of BIG-IQ may not be available after restart★ |
| 599844 | 3-Major | Ltm log has GET_MEDIA and chmand error and failure messages on shutdown |
| 590022-1 | 3-Major | Added a Logging Node, it appears to be added (In the Logging Configuration -> logging node Count increases) but does not show up in the list on Logging Nodes page |
| 658163-1 | 4-Minor | AVR statistics are not available on the Secondary BIG-IQ |
| 652954-1 | 4-Minor | BIG-IQ 5.x does not allow clustered BIG-IP devices to be added to custom device groups created in BIG-IQ 4.x |
| 622676 | 4-Minor | Dual management routes in the main routing table |
| 599838 | 4-Minor | notice HA: ha_enabled_put(daemon_heartbeat, tmm, FALSE/TRUE) |
| 596082-1 | 4-Minor | Incorrect information displayed by HA Inventory page in HA Error state |
| 660424-1 | 5-Cosmetic | httpd service fails to start on boot |
BIG-IQ Web Application Security (ASM) Issues
| ID Number | Severity | Description |
| 658702-1 | 3-Major | After upgrading BIG-IQ to 5.2.0, already discovered 11.5.4 devices may fail on Web App Security rediscovery. |
| 657640 | 3-Major | Issue deploying new ASM policy to BIG-IP with disallowed WebSocket URLs configured in policy |
| 649425 | 3-Major | Discovery failure occurs due to BIG-IP ASM software unexpected service restart |
| 645199 | 3-Major | ASM - Inheritance comments deployment issue |
| 642196 | 3-Major | ASM deployment failure with a deadlock error message on Signature Set configuration changes |
| 639967 | 3-Major | ASM deployment failure with deadlock on Data Guard configuration changes |
| 630437 | 3-Major | Parent policy items not shown when searching for items related to the child policy |
| 628451 | 3-Major | Child policy items not shown when searching for items related to the parent policy |
| 624756 | 3-Major | Discovery failure occurs due to BIG-IP ASM software unexpected service restart - auto detect language |
| 615822 | 3-Major | Deployment failure reported when attempting to deploy a change to TMOS v11.5.4 that would change a manual-type signature set to a filter-based signature set |
| 606953 | 3-Major | Deployment of a new asm policy may result in failure. |
| 579422 | 3-Major | Evaluation shows unexpected differences after deployment for policy building settings (enabled) |
| 585505-1 | 4-Minor | Discovery and import allows a change in a policy's application language, but a deployment fails when application language is to be changed |
Known Issue details for BIG-IQ CM v5.2.x
660828 : Deployment Failure: "transaction failed: ... : file (/config/filestore/files_d/Common_d/customization_group_d/:Common:...) expected to exist"
Component: BIG-IQ Access
Symptoms:
Deployment failure with error similar to the one below:
Deployment Failure: "transaction failed: ... : file (/config/filestore/files_d/Common_d/customization_group_d/:Common:...) expected to exist"
Conditions:
Deployment fails when advanced customization is involved.
Impact:
The BIG-IQ APM deployment fails.
Workaround:
On the failed device, remove the object that uses the customization group, which in-turn will remove the customization-group, then deploy to the device again.
660424-1 : httpd service fails to start on boot
Component: REST Framework and TMOS Platform
Symptoms:
When booting a BIG-IQ device you may see a message indicating the httpd service fails to start: "Starting httpd: [FAILED]".
Conditions:
When booting the BIG-IQ.
Impact:
No impact to BIG-IQ functionality. httpd is not required for BIG-IQ to function correctly and this message can be ignored.
660022 : BIG-IQ does not support creating route with default address
Component: BIG-IQ Configuration - Network
Symptoms:
After BIG-IQ deploys a new route with the default address cannot discover and reimport a device where that route has been deployed.
Conditions:
Deploying a route with "0.0.0.0/0" address. Deploying it to a BIG-IP device and reimport that same device
Impact:
Unable to import device once deploying with a failure message:
"Invalid route Default: Change destination network from '0.0.0.0/0' to 'default' is not allowed"
Workaround:
Create the default route directly on the BIG-IP device.
659958-1 : Active Directory Groups update does not show any groups
Component: BIG-IQ Configuration - Access
Symptoms:
Active Directory, LDAP groups are not displayed even after the administrator clicks "Update" from the Active Directory > LDAP Groups screen.
Conditions:
This issue happens when the administrator does not have advanced shell access on the BIG-IP system.
Impact:
Admin has to type in the active directory group details manually or copy it from the BIG-IP system.
Workaround:
Give advanced shell access for the administrator on the BIG-IP system.
To give the administrator access to the Advanced Shell, use the following command syntax:
modify /auth user <UserID> shell bash
659829-1 : Evaluation error for Local Traffic and Network. Failed to inflate referenced items for unspecific referrer.
Component: BIG-IQ Access
Symptoms:
Access Deployment fails with error
"Evaluation error for Local Traffic and Network. Failed to inflate referenced items for unspecific referrer."
Conditions:
Access Deployment fails when "Include LTM Objects" is selected and a access policy that has RouteDomainSelectionAgent is configured in Access Group.
Impact:
Access Deployment Failure.
Workaround:
Step 1) Deploy LTM for the device
Step 2) Deploy Access for the device. Do not select "Include LTM Objects" for Access Deployment.
659729-1 : Filtering by the text 'http' in LTM Profiles grid takes a long time to complete
Component: BIG-IQ Local Traffic & Management
Symptoms:
The LTM profiles grid will show a spinner for 30 or more seconds until results are returned. Note that queries for other text is not affected.
Conditions:
User enters 'http' in to the filter bar in the LTM profiles grid and hits the Enter key.
Impact:
The user may have to wait for longer than expected to see the results of this query.
Workaround:
User can use a different or more specific query. For example if the user is searching for the http-explicit profiles, they can filter with 'explicit'.
659424-1 : Deployment failure due to SAML object deletion
Component: BIG-IQ Access
Symptoms:
This symptom observed on BIG-IQ is caused by a defect on BIG-IP systems.
This defect happens when BIG-IQ attempts to delete unreferenced SAML objects on deployment.
When this happens, the deployment will fail, and the following message will be displayed:
Failed submitting iControl REST transaction 1487875767493967: status:400, body:{"code":400,"message":"transaction failed:01070734:3: Configuration error: a
pm aaa saml-idp-connector: Cannot delete saml-idp-connector /Common/ipd.cooper.local
because it is being used by
aaa-saml-server (/Common/saml_sp)","errorStack":[],"apiError":1}
Conditions:
When unreferenced SAML objects are deleted by BIG-IQ at time of deployment.
Impact:
Failure to perform a BIG-IQ deployment.
Workaround:
Customers can administer BIG-IP, and remove the unused SAML objects, or reference them by a dummy Access Policy. Alternatively, BIG-IP systems call be upgraded once appropriate hotfixes are available.
658892-1 : Deployment fails with error : Failed submitting iControl REST transaction ....: status:400,..... unknown property","errorStack":[],"apiError":2}
Component: BIG-IQ Configuration - Access
Symptoms:
Deployment fails after editing Advance Resource Assign Agent in policy or Resource Assign Agent in macro.
Conditions:
Deployment fails after editing Advance Resource Assign Agent in policy or Resource Assign Agent in macro.
Impact:
Access Configuration could not be deployed
Workaround:
Open Advance Resource Assign Agent(s) in policy and Resource Assign Agent(s) in macro (if any) to apply below fix:
1) Go to Advance mode for expressions
2) Put backslash \ in front of any double-quotes " i.e. " => \"
3) Save
658780-1 : A port misuse policy rule marked for deletion will have the deletion state cleared when a new rule is added.
Component: BIG-IQ Configuration - Security - Network Security
Symptoms:
A port misuse policy rule marked for deletion will not be deleted if a new rule is added in the same edit session after the rule has been marked for deletion.
Conditions:
The user marks a port misuse policy rule for deletion and subsequently adds a new rule to the policy in the same edit session.
Impact:
A rule marked for deletion will not be deleted under these conditions.
Workaround:
When a rule will be deleted and a new rule added to a port misuse policy, perform the delete and save actions first for rules that are to be deleted, followed by the addition of the new rules.
658702-1 : After upgrading BIG-IQ to 5.2.0, already discovered 11.5.4 devices may fail on Web App Security rediscovery.
Component: BIG-IQ Web Application Security (ASM)
Symptoms:
After upgrading to 5.2.0, rediscovery of an 11.5.4 device may fail with "Duplicate item. Key already exists: name : brute-force-attack-prevention".
Conditions:
11.5.4 managed device present when upgrading to BIG-IQ version 5.2.0.
Impact:
Unable to rediscover (in Web App Security) the device after upgrade
Workaround:
Following an upgrade, if the above error occurs on Web App Security rediscovery, perform the following:
- remove the device
- discover/import the device (LTM,ASM)
- rediscover/reimport the device (LTM,ASM)
658358-1 : Minimum master eligible node setting set by user is overwritten by default calculated value when zone of the log node is changed
Component: REST Framework and TMOS Platform
Symptoms:
If the BIG-IQ Data Collection Devices --> Settings --> Minimum Master Eligible Devices setting is set by the user and if the BIG-IQ Data Collection Devices --> Zone setting is changed by the user, the Minimum Master Eligible Devices setting will be set to a new code calculated value.
Conditions:
1. Override the Minimum Master Eligible Devices setting from the UI
2. Modify the Zone setting of a BIG-IQ Data Collection device
Impact:
The Minimum Master Eligible Devices setting may or may not be different from what the user had previously set. It could impact how the customer expects the BIG-IQ elasticsearch cluster expects to behave during a disaster. But under normal operations of the BIG-IQ this setting has no impact on the product functionality.
Workaround:
Whenever the BIG-IQ Data Collection Devices --> Zone setting is changed, the Minimum Master Eligible Devices setting can be reset in the UI by the customer based on their environment and requirements.
658163-1 : AVR statistics are not available on the Secondary BIG-IQ
Component: REST Framework and TMOS Platform
Symptoms:
If a user logs into a Secondary BIG-IQ, they will get an error if they try to view AFM or ASM Application Visibility and Reporting (AVR) statistics:
* Monitoring --> REPORTS --> Security --> Network Security --> Reporting
* Monitoring --> REPORTS --> Security --> Web Application Security --> Reporting.
Conditions:
Logging onto the secondary system of a BIG-IQ HA pair
Impact:
The user will see a dialog with a Dismiss button and an error such as the following:
Error on server request
shared/analytics/event-analysis-tasks/5a165c86-7c03-4bc7-9577-484d7c13db93
Selecting the Dismiss button will result in additional dialog buttons appearing.
Workaround:
Refresh the Secondary BIG-IQ page.
658039-1 : Failure to reactivate some licenses when EULA has changed
Component: BIG-IQ Device User Interface
Symptoms:
Attempts to reactivate a license when the EULA has changed generates a message similar to: "The system returned an unexpected error (400 Bad Request). Validation of PATCH failed."
Conditions:
This can occur for utility, volume and FPS licenses when the user navigates away from the license properties page before accepting the new EULA and then returning later.
Impact:
License fails to complete the reactivation.
Workaround:
When the user returns to the license properties page, clicking "Finish Reactivation" opens a new page with a "Reactivate" button which generates the error. Instead of clicking "Finish Reactivation" on the license properties page, the user can click the "Accept" button at the bottom right of the page to accept the new EULA and complete the reactivation.
657640 : Issue deploying new ASM policy to BIG-IP with disallowed WebSocket URLs configured in policy
Component: BIG-IQ Web Application Security (ASM)
Symptoms:
After deploying a new policy to a 13.0 BIG-IP device and doing another evaluation, differences involving the addition of a Plain Text Profile named "Default" might appear. Deploying the second evaluation will fail with an error that the Plain Text Profile cannot be deleted.
Conditions:
The issue happens when deploying to a 13.0 BIG-IP device and the policy has Disallowed WebSocket URLs. The issue happens if the BIG-IP device does not have a fix to bug 658062.
Impact:
Difference shown after deployment and failure of second deployment.
Workaround:
In order to fully deploy the configuration if the unexpected difference appears, it is needed to remove all disallowed WebSocket URLs on the BIG-IP directly before doing another evaluation.
656861 : Re-using a filter with a country and region fails to provide region in the filter
Component: BIG-IQ Fraud Protection Service (FPS)
Symptoms:
Alert filters that are re-used do not have the region code set in the UI filter.
Conditions:
If a filter with a country and region is saved, or a filter that has been run is edited, the region is not correctly shown in the UI. Also, the regions for the selected country are missing.
Impact:
Re-running the same filter will not filter on the region as expected.
Workaround:
Re-select the original country name. Clear any dangling 'region name' text in the 'Additional Query Parameters' field. Then select the region. Re-run the query. Each consecution run of the saved filter with correct country and region information will complete successfully.
656828 : Setting the master key after upgrading a system with a large configuration from 5.x to 5.2 could result in an unsuccessful encryption of objects.
Component: REST Framework and TMOS Platform
Symptoms:
After upgrading the BIG-IQ system from 5.x to 5.2, when the user logs into the BIG-IQ UI, the user will be required to go through the setup wizard. When the master key passphrase is entered and the Next button clicked, the master key is created and the encryption upgrade starts.
The following two symptoms can occur:
Symptom 1:
If the encryption upgrade does not finish within five minutes, the user will see a 504 gateway timeout exception in the UI. This is a possible indication that the encryption upgrade will not succeed, so the user should click the Dismiss button, log out from the UI, and check to see if symptom 2 occurs after waiting another five minutes.
Symptom 2:
If the encryption upgrade does not complete in ten minutes, in the /var/log/restjavad.0.log file the following error message is observed:
[ERROR][12 Apr 2017 11:07:00 EDT][/cm/shared/secure-storage/masterkey SecureStorageMasterkeyGenerator] The BIG-IQ ran into error 'Encryption upgrade has failed to run to completion due to Timed out during execution of command. This may result in some attributes that are encrypted with the old encryption scheme that need to be manually upgraded.' when upgrading encrypted values. This may cause some encrypted values to be unusable.
If Symptoms 1 and 2 are both seen, the customer should proceed with the workaround.
Conditions:
The pre-upgraded 5.x system has large number of objects requiring encryption.
example:
The BIG-IQ system managed several hundred BIG-IP's, had several hundred rules, etc (a very large system) then such a system upon upgrade to 5.2 could have an issue setting the encryption master key upon first logging in to the BIG-IQ 5.2 UI.
Impact:
If the encryption upgrade fails, the upgraded BIG-IQ system will be unstable to use. There will be several errors in the product and in the log files.
Workaround:
If both symptoms 1 and 2 are seen, the customer can work around the issue as follows:
1. Log in to the BIG-IQ shell (not the UI)
2. cd /var/config/rest/tokuupgrade/encryption
3. sh run_encryption_upgrade.sh
4. Wait for the execution of this command to complete. When the execution completes, the following message will be displayed: "The Encryption upgrade script is complete"
5. Log back in to the UI and finish executing the setup wizard.
656788 : FPS Alert sorting results not always as expected
Component: BIG-IQ Fraud Protection Service (FPS)
Symptoms:
There are 2 sorting scenarios that can result in alerts not being sorted as expected. In one case alerts may appear to no longer be included in the results. In the other case, sorting by alert type may not be correct when
Conditions:
(1) Sorting alerts by type, when the type has been changed by a transformed rule to the name of the transform rule.
(2) Sorting alerts when there are a large number of rules matching the query.
Impact:
Sorting rules may make it difficult to locate anticipated alerts.
Workaround:
Be sure that query results are small enough (matching < 9500 alerts) so that alerts can be properly sorted. If sorting by alert type, remember alerts that match transformed rules will have their name changed, but they can be located inthe sorted list based on their alert type.
656112-1 : Scroll bars are not present on device health, device, traffic, DNS, and local traffic statistics UI
Component: AppIQ
Symptoms:
When viewing graphs of statistical data for device health, device traffic, DNS, or local traffic graph pages, there are no scroll bars allowing you to scroll up and down to view content unable to fit in the browser window.
Conditions:
This occurs when view graph data as described by the title.
Impact:
You may not notice additional graphs hidden from view.
Workaround:
To scroll down to view graphs unable to fit in your browser window, you can do one of the following:
1. If your mouse has a wheel used for scrolling, position the mouse in the graphing panel, then you can scroll up and down using the wheel.
2. Click in the graph panel, then you can use the up-arrow, down-arrow, page-up, and page-down windows to scroll.
3. Resize your browser windows such that all charts fit into the window.
655987-1 : When upgrading devices with large configurations to 5.2, user may encounter errors when setting the Master Key in the setup wizard★
Component: BIG-IQ System User Interface
Symptoms:
When setting the Master Key, the request may run for a long time and may time out. If the request times out, it was likely still successful but is taking some extra time to complete due to the existing configuration on the system.
Conditions:
The BIG-IQ is running a large configuration, and is upgraded to BIG-IQ version 5.2.
Impact:
You may need to wait until the Master Key is established on the device. After the request times out, wait for a few minutes and refresh the page. If the page tells you that the Master Key has already been set, you can safely complete the setup wizard.
655123-1 : Unable to open Network Access, LDAP, AD, CRLDP, TACACS, or Radius server object UI for edit.
Component: BIG-IQ Access
Symptoms:
When a user clicks an instance of the following objects, UI does not open the object for edits. There is no response for the user mouse click.
Object Types: LDAP, AD, CRLDP, TACACS, or Radius server
Conditions:
This happens after import/reimport of Access.
This is due to the fact that pool used by the object instance of kinds LDAP, AD, CRLDP, TACACS, or Radius server does not exist in "LTM".
This is due to the fact that route-domain used by Network Access object does not exist in "LTM".
Impact:
Object instances of kind Network Access, LDAP, AD, CRLDP, TACACS, or Radius server could not be edited.
Workaround:
Users must rediscover and reimport LTM for the corresponding device to which the object (LDAP, AD, CRLDP, TACACS, or Radius server) belongs.
653760-1 : Token Table is not updated in real time on the drill down screen
Component: BIG-IQ Monitoring - Dashboards & Reports
Symptoms:
Drilling down on the Access Token Count screen doesn't show the right number of tokens in the table the first time.
Conditions:
Happens during the drill down action.
Impact:
Minimal.
Workaround:
Refresh the page, all tokens will show up.
653529 : Deployment fails when attempting to deploy more than 4000 certs in a single deployment across multiple BIG-IPs
Component: BIG-IQ Configuration - Local Traffic
Symptoms:
Attempting to deploy more than 4000 certificates and key objects will result in deployment failure
Conditions:
Trying to deploy more than 4000 across multiple BIG-IPs
Impact:
Deployment fails and the 'restjavad' daemon must be restarted using the TMSH command 'bigstart restart restjavad' on BIG-IQ to get the device fully operational again, as BIG-IPs may be marked as unavailable.
Workaround:
Split the deployment by either reducing the number of devices or number of certificates and keys per deployment
653528 : Deployment fails when attempting to deploy more than 1100 certificates and key pairs (2200 files) to a single BIG-IP
Component: BIG-IQ Configuration - Local Traffic
Symptoms:
Deployment failure with an error of 'Failed submitting iControl REST transaction.'
Conditions:
Attempting to deploy more than ~1100 certificates and key pairs (2200 files) to a single BIG-IP
Impact:
Deployment failure with an error of 'Failed submitting iControl REST transaction'
Workaround:
Split the deployment to contain below 2200 file objects
653467-1 : Retaining more than 10 hours of raw statistical data may cause chart timeouts when querying for Last Day or Last 12-hours of data
Component: AppIQ
Symptoms:
When viewing data for Last 12 hours or Last Day for Virtual Servers or Pool and Pool Members, you may see timeouts when BIG-IQ attempts to display the data.
Conditions:
This occurs from a confluence of several potential items:
1. The default retention for the raw data time layer is set at greater than 10 hours.
2. Your environment does not have sufficient Data Collection devices to support the scale of your environment.
3. The storage for your Data Collection devices is too slow.
Impact:
Charts for virtual server and pool & pool member inspector pages may show timeouts when querying for last 12 hours and last day of data.
Workaround:
The BIG-IQ uses the raw time layer for the 12-hour and Last Day queries if the retention policy for the raw time layer is greater than 12 hours and 24 hours respectively. This causes a significant I/O burden to fulfill the query request. In some cases, this may be due to poor storage I/O performance for your Data Collection device(s) and/or not enough Data Collection devices to serve the needs of your environment. The BIG-IQ supports up to 5 Data Collection devices for collection of statistical data. When configuring virtual instances of Data Collection devices, ensure the underlying physical storage is spread out across physical disks, rather than shared on the same physical disk. If the issue cannot be resolved with infrastructure changes, you can change the raw time layer default back to 10 hours. F5 plans to address this issue in a future release.
652975-1 : OAuth Client timeline doesn't show right data if timeframe is changed
Component: BIG-IQ Monitoring - Dashboards & Reports
Symptoms:
If you change the timeframe on a report you will notice the timeline not showing the correct data.
Conditions:
This is intermittent, and it's unclear when it can occur.
Impact:
Timeline on a report is not updated if timeframe is changed and may not represent the timeline desired.
Workaround:
Refresh the browser and the data will be displayed properly
652954-1 : BIG-IQ 5.x does not allow clustered BIG-IP devices to be added to custom device groups created in BIG-IQ 4.x
Component: REST Framework and TMOS Platform
Symptoms:
BIG-IQ 5.x fails to properly add a device to a custom device group. The error message in the UI is "Unable to establish trust with this device. Delete the device and re-add it."
Conditions:
This issue is applicable when the BIG-IP is a clustered device and the device group is a custom device group that was created in BIG-IQ 4.x.
Impact:
The BIG-IP device cannot be properly managed via the device group.
Workaround:
Remove the device from the device group, which should clear any "Unable to establish trust" error on the BIG-IP devices inventory. Take a UCS backup of the BIG-IQ. Remove the device-group-key-pair for the device group using: "restcurl -X DELETE shared/device-group-key-pairs/{group name here}". Then add the device to the device group again.
652758 : Fail to restore from snapshot
Component: BIG-IQ Access
Symptoms:
Failure to restore a snapshot taken from a previous BIG-IQ version to the current 5.2 version.
Impact:
The snapshot could not be restored.
Workaround:
Access Snapshots taken from a previous release is not supported in version 5.2.
651998-1 : When /var partition reaches configured limit, collection of statistics from BIG-IP will stop, and older data may be automatically removed by BIG-IQ
Component: AppIQ
Symptoms:
You may observe two behaviors:
1. Current statistics from BIG-IPs are not shown on graphs
2. Older statistics from BIG-IPs may no longer be available
Conditions:
This occurs when the data store for statistics reaches the configured limit
Impact:
Loss of current and potentially older statistical data, resulting in graphs showing no data and/or flat areas of no data.
Workaround:
There are several actions you can take:
1. Increase the /var partition on your Data Collection Devices.
2. Increase the maximum percent of storage BIG-IQ may consume for statistical data.
3. Reduce the frequency of data collection from each BIG-IP.
4. A combination of one or more actions listed above.
Please consult product documentation.
651892 : Some Rewrite profiles created on BIG-IP cannot be updated or deleted by BIG-IQ
Component: BIG-IQ Local Traffic & Management
Symptoms:
Using BIG-IQ to update or delete a URI translation rewrite profile that was created via the BIG-IP UI may fail with a message like "transaction failed:01020036:3: The requested rewrite rules URI (/Common/rewrite-custom uri_c931dcd3-acbe-34cf-81c9-a27b64738bb0) was not found."
Conditions:
This issue applies to URI translation rewrite profiles created via the BIG-IP UI that have a parent profile that includes one URI rule.
Impact:
This issue can cause BIG-IQ deployments to fail.
Workaround:
This issue can be resolved by using BIG-IP (tmsh or UI) to remove the inherited URI rule from the affected profile and then recreating it. Afterwards, discover/import the LTM service for the relevant device to update the profile in BIG-IQ.
651186-1 : SSL certificate in non-PEM format can not be imported and managed
Component: BIG-IQ Local Traffic & Management
Symptoms:
BIG-IQ fails to import DER encoded certificates/keys.
Conditions:
This applies when manually importing DER encoded certificates/keys from an external source or when trying to convert an unmanaged certificate/key from BIG-IP into a managed certificate/key.
Impact:
DER encoded certificates/keys cannot be managed by BIG-IQ.
Workaround:
DER encoded certificates/keys can be converted to PEM format to allow them to be managed by BIG-IQ.
650405 : Error while transforming Profile Client SSL when BIG-IP in DSC (Failed to transform secure field value)
Component: BIG-IQ Local Traffic & Management
Symptoms:
Due to a BIG-IP defect, discovery may fail due to an invalid passphrase. Logs messages will include the error: "Failed to transform secure field value".
Conditions:
This may occur when BIG-IPs are configured in a DSC pair and there is one or more profiles configured with a passphrase.
Impact:
As a result, the LTM service cannot be managed for the affected BIG-IP.
Workaround:
Restart restjavad/icrd on the BIG-IP that fails discovery and re-discover.
650404 : A list screen may not always show all items
Component: REST Framework and TMOS Platform
Symptoms:
Not all rows of a list screen may appear when viewing a page that contains multiple objects.
Conditions:
This can happen when returning to a listing page after drilling down into one of the objects from the listing page and either pressing the back button, the Save & Close button, or the Cancel button.
Impact:
The page may look incorrect until refreshed or the user scrolls within the list.
Workaround:
There are two known workarounds for this issue: 1) scroll the items list with the mouse or scrollbar, or 2) refresh the page.
650218 : Client SSL - BIG-IP 11.5.1 HF7 - overridden yet unchanged Cert Key Chain in Client SSL profile causes discovery failure
Component: BIG-IQ Configuration - Local Traffic
Symptoms:
Discovery of the LTM service for a BIG-IP fails with the error: "Unable to parse tmsh output: java.lang.IllegalArgumentException: malformed or empty array: "" { }"
Conditions:
This can occur for older BIG-IPs that allow a Client SSL profile to be saved without a certificate/key.
Impact:
This prevents the LTM service for the BIG-IP device from being managed in BIG-IQ.
Workaround:
The issue can be resolved by correcting the configuration for the relevant Client SSL profile(s) by adding a certificate/key.
649425 : Discovery failure occurs due to BIG-IP ASM software unexpected service restart
Component: BIG-IQ Web Application Security (ASM)
Symptoms:
BIG-IP has an issue that may cause a restart of services (tracked by BIG-IP bug 644725).
Since the restart on BIG-IP might cause connectivity issues from BIG-IQ, discovery/deployment issues might occur.
Conditions:
This issue might happen when the managed BIG-IP device is affected by bug 644725.
Impact:
Discovery/deployment failures.
Workaround:
Patch the BIG-IP device with a fix to bug 644725.
649067-1 : Specifying certain characters in the wrong field can result in failed queries and no matching results
Component: BIG-IQ Fraud Protection Service (FPS)
Symptoms:
Filters for some data with special characters result in failed queries.
Conditions:
If a user enters data in some fields with special (\+: etc) characters that are not usually found in the field, the query may fail and result in an error message from the database.
Impact:
Another way must be found to do the query. See the online help for details.
Workaround:
Enter the data in the correct field. See the online help for details on valid characters.
648876-1 : Discovery of a BIG-IP Advanced Firewall service may fail if the service is newly provisioned on the BIG-IP
Component: BIG-IQ Network Security
Symptoms:
Discovery of the Advanced Firewall service may fail with an error message similar to: check if iControl REST service is running on the BIG-IP
Conditions:
A BIG-IP Local Traffic service is already imported on the BIG-IQ and then the Advanced Firewall service is provisioned on the BIG-IP and that service is then discovered by the BIG-IQ.
Impact:
The Advanced Firewall service cannot be discovered on the BIG-IQ due to a BIG-IP REST service issue.
Workaround:
If the discovery fails with the indicated symptoms, the restjavad service must be restarted on the BIG-IP. The user should log onto the BIG-IP shell and execute the following command: bigstart restart restjavad
648546 : Cannot deploy a certificate with server-ssl
Component: BIG-IQ Deployment - Evaluate & Deploy
Symptoms:
Failure to deploy a certificate referenced by a new server-ssl profile. If a server-ssl profile inherits from the 'serverssl' system profile, it will be deploy successfully, but if the server-ssl profile inherits from any other profile, a deployment will fail.
An error is generated:
"transaction failed:0107134a:3: File object by name (/Common/some-ca-bundle.crt) is
missing."
Conditions:
This issue occurs when attempting to deploy at least 3 objects together: 1) a new traffic certificate, 2) a parent server-ssl profile, and 3) a child server-ssl profile referencing the traffic certificate from 1) and inheriting from the server-ssl profile from 2).
Impact:
Deployment will fail.
Workaround:
Deploy the traffic certificate or the parent server-ssl profile in a separate deployment task.
647189-1 : Deployment to version 12.1.1 device fails with error ""Encountered unsupported operation 16 at /apm/policy/access-policy/..../subroutine-properties"
Component: BIG-IQ Configuration - Access
Symptoms:
Deployment to version 12.1.1 device fails with error ""Encountered unsupported operation 16 at /apm/policy/access-policy/..../subroutine-properties"
Conditions:
The deployed BIG-IP system is version 12.1.0.
Impact:
Cannot deploy the new configuration to the BIG-IP system.
Workaround:
Upgrade to 12.1.3 or 13.0, which addresses this issue.
647177-1 : BIG-IQ system performance can degrade with high numbers of accumulated snapshots
Component: BIG-IQ Monitoring - Alerts & Notifications
Symptoms:
When managing large configurations with BIG-IQ, accumulated configuration snapshots can consume database resources to the point of slowing down general system performance. This slowdown is typically encountered when viewing large collections of objects in the UI. It may also be encountered when performing deployment evaluation and/or new device discovery.
Conditions:
Managing large configurations.
Impact:
System performance may be affected.
Workaround:
If general system performance issues are encountered, navigate to the Deployment->Snapshots menu, check the snapshot count for each service and delete old snapshots. On that page you can multi-delete by selecting more than one snapshot in the list and clicking the delete button. Once the selected snapshots have been deleted, verify that system performance has returned to normal.
647127-1 : Removal of Data Collection Device may result in a Elastic Search cluster health status of "red"
Component: AppIQ
Symptoms:
Removing a Data Collection Device (DCD) from a cluster that contains statistics data may cause the cluster to contain one or more unassigned data shards.
Conditions:
You desire to remove a DCD when statistics collection is enabled for one or more BIG-IPs.
Impact:
When the DCD elastic search cluster transitions to "red" status, the cluster may become unusable.
Workaround:
The following workaround can be performed:
1. Log into BIG-IQ as an administrator
2. Click on the "System" tab
3. Open up the "BIG-IQ Data Collection" on the left navigation menu.
4. Click on "BIG-IQ Data Collection Devices"
5. Click Add, and enter the DCD's information.
Once successfully added to the BIG-IQ cluster, you will need to enable statistics data replication:
1. From the BIG-IQ Data Collection Devices user interface,
click "Settings".
2. Then, click Statistics Collection
3. Click Configure
4. Click Advanced Settings
5. Check the box next to "Enable Replicas"
6. Click Save & Close
Next, wait for the elastic search cluster to show a status of Green, then the DCD can removal can be re-tried.
647068 : Sharepoint and OWA Application data missing in the Access Application Dashboard
Component: BIG-IQ Monitoring - Dashboards & Reports
Symptoms:
You cannot view the Sharepoint and OWA Application names in the Application Dashboard.
Conditions:
After applying the classification profile to the Sharepoint and OWA Application virtuals in the BIG-IP system, Sharepoint and OWA Application data are not displayed in the BIG-IQ Access Application Dashboard.
Impact:
Sharepoint and OWA Application data is missing in the BIG-IQ Access Application Dashboard
Workaround:
Update classification signatures on the BIG-IP device to fix the issue. You can download signature updates from F5 Networks, and schedule the system to automatically update the signatures. You can also manually install the classification signatures and updates from BIG-IP system under Traffic Intelligence > Classification > Signature Update.You can refer to BIG-IP-> PEM BIG-IP Policy Enforcement Manager-> Implementations Updating Signatures for Application Recognition for detailed steps to update classification signatures.
646929 : BIG-IQ cannot remove overrides for LWS Separator field on HTTP explicit profiles.
Component: BIG-IQ Local Traffic & Management
Symptoms:
BIG-IQ cannot unset overrides on the LWS Separator field for HTTP profiles. This is due to a defect on the BIG-IP. This override can be removed on BIG-IP and the device rediscovered/reimported.
Conditions:
User tries to remove the LWS Separator override on the HTTP explicit profile.
Impact:
The value will always remain overridden in the child profile.
Workaround:
Manually unset the override on the BIG-IP and then rediscovery and reimport the BIG-IP.
645768 : TMSH command 'tmsh show sys hardware' is incomplete for VE systems
Component: REST Framework and TMOS Platform
Symptoms:
Much of the expected machine information is not reported about the BIG-IQ VE device when using the TMSH command 'show sys hardware'. Disk information is missing entirely. The information that is included is minimal.
Conditions:
Device is an AWS VE
Impact:
Incomplete information reported from tmsh show sys software
Workaround:
All the information can be obtained from running the command 'halid -aq halid'
645725 : Cannot re-import from a SWG-provisioned device after upgrading.★
Component: BIG-IQ Configuration - Access
Symptoms:
Reimporting after upgrading from BIG-IQ version 5.0 or 5.1 fails with error "Access Group is not SWG provisioned, but the device is SWG provisioned.".
Conditions:
Reimport fails after upgrade from BIG-IQ 5.0 or 5.1 when the device has SWG provisioned.
Impact:
Access Group is not usable.
Workaround:
Delete the Access Group and re-create it in version 5.2.
645721-1 : If you use HTTPS over a proxy for a custom-alert receiver, you need to re-install the receiver's certs after upgrade
Component: REST Framework and TMOS Platform
Symptoms:
If you have a custom-alert receiver that receives alerts over HTTPS, you need to install the SSL certs from that receiver to forward alerts over a proxy. After an upgrade to a later release of BIG-IQ software, you need to install the same certs again to continue forwarding alerts to that receiver.
Conditions:
You use an FPS Custom-Forward Alert Rule to forward alerts over HTTPS, and over a proxy, to your own custom-alert machine. You downloaded certs from your custom-alert machine previously so that you could forward through the proxy, over HTTPS.
Impact:
Extra installation of the certs after an upgrade.
Workaround:
Re-install the certs from the same custom-alert receiver after the BIG-IQ upgrade.
645199 : ASM - Inheritance comments deployment issue
Component: BIG-IQ Web Application Security (ASM)
Symptoms:
Inheritance comments may not be deployed to BIG-IP if the deployment is adding the policy to the BIG-IP.
Conditions:
The issue is due to BIG-IP bug tracked by ID 645506 which impacts inheritance comments on new policies being imported by the BIG-IP.
Impact:
The comments are not deployed, and additional evaluation will show a difference.
Workaround:
Install a BIG-IP fix for bug ID 645506, or re-evaluate and deploy to get the comments deployed.
644884-1 : Sort-Selected rows of data in dimension panes may show N/A for data
Component: AppIQ
Symptoms:
When sorting data in dimension tables, pinned / sort-selected items may show up as "N/A".
Conditions:
In the table of data for a specific dimension (such as Virtual Servers), BIG-IQ only shows the top-100 items meeting the sort criteria as determine by the column chosen and sort order (descending, ascending). If a specific row has been pinned using the "Sort Selected" action and the sort criteria is changes such that the rows pinned no longer are in the top-100, the data for the pinned rows will show as "N/A".
Impact:
None
Workaround:
You can choose a different column and sorting order resulting in the sort-selected rows showing data if row meets the top-100 criteria.
644860-1 : BIG-IQ may take a while to resume statistics collection after a time skew issue has been corrected
Component: AppIQ
Symptoms:
If the time difference between BIG-IQ and BIG-IP drifts more than 5 minutes, statistics collection stops. After correcting the time skew issues, BIG-IQ may not receive new statistics from the device for a period of time, eventually resuming statistics collection.
Workaround:
If the collection of statistics does not resume, remove the BIG-IP exhibiting the issue from BIG-IQ, correct any remaining time issues, then add the BIG-IP back to the BIG-IQ inventory. To avoid time skew issues, F5 recommends configuring NTP on all BIG-IP and BIG-IQ devices.
643825 : Inability to remove Certificate and/or Key used by serverssl profile in specific cases for v11.6.0 and v11.6.1
Component: BIG-IQ Local Traffic & Management
Symptoms:
When an ltm profile server-ssl using Certificate and/or key, key and certificate property override is unset.
BIG-IQ cannot remove that certificate and key in the same deployment.
Conditions:
1. Discover an ltm profile server-ssl using Certificate and/or key.
2. Unset the certificate override and/or key override.
3. Delete the certificate and key.
4. Deploy to BIG-IP.
Impact:
Deployment will fail with the message
"File object by name (/Common/cert.key) is in use."
Workaround:
Set the server-ssl to the desired value and do not unset the override certificate and key override.
642976-1 : Deployment diff shows unused objects to be deleted during deployment
Component: BIG-IQ Access
Symptoms:
Unused objects are deleted when you deploy a configuration change. The deployment diff shows objects to be deleted.
Conditions:
These objects are not used in the policy that gets deployed to device from BIG-IQ.
Impact:
Objects that are not used in policy in BIG-IP will get deleted.
Workaround:
A dummy policy that is not assigned to any virtual server can be created in BIG-IP or in BIG-IQ and those objects can be added in corresponding agents in the policy. Assigning those objects to the dummy policy will not delete it during deployment.
If the dummy policy is created in BIG-IP, user may have to reimport the shared configuration from the device.
642862-1 : BIG-IQ will show statistics for system iRules, which may not be listed in the BIG-IP's UI
Component: AppIQ
Symptoms:
When viewing statistics for iRules, BIG-IQ will show statistics for system iRules, which do not display in the BIG-IP UI.
Impact:
None.
Workaround:
There is no workaround to suppress the system iRules.
642550 : If you use Go To to reach an alert near the end of the list, you cannot scroll until you refresh.
Component: BIG-IQ Fraud Protection Service (FPS)
Symptoms:
If you use the Go to Alert Number field to reach the end of a long list of alerts, such that the screen does not fill with a full page of alerts, the scroll bar does not appear.
Conditions:
You go to an alert that is very close to (within 20-25 of) the last alert.
Impact:
Scrolling is impossible.
Workaround:
Click Refresh, or refresh the entire browser.
642196 : ASM deployment failure with a deadlock error message on Signature Set configuration changes
Component: BIG-IQ Web Application Security (ASM)
Symptoms:
A deployment task may fail when changes involve Signature Sets, due to a deadlock on the BIG-IP.
Conditions:
The issue happens when a Signature File Update operation is performed while the deployment task is also running.
Note - BIG-IQ itself will not perform a Signature File Update task during deployment operations to the BIG-IP.
Impact:
Deployment failures.
Workaround:
Wait for the Signature File Update operation to complete and re-deploy, or avoid deployment when Signature File Update operations are running. Note that the BIG-IP supports scheduling of Signature File Update operations.
641451 : Deployment error when overriding the certificate-key chain on a Client SSL profile.
Component: BIG-IQ Configuration - Local Traffic
Symptoms:
Deployment error when overriding the certificate-key chain on a Client SSL profile.
Conditions:
On removal of the "Override" setting on the non-root ClientSSL certificate-key chain attribute.
Impact:
This change cannot be deployed to the BIG-IP and deployments will fail.
Workaround:
Specify an override value on the profile. These can be the same as the parent profile.
641427-1 : Portal Access Rewrite not be searchable by Global Search
Component: BIG-IQ Search
Symptoms:
Searching for an Portal Access Rewrite object via global search does not return any results and may return an error.
Conditions:
Using the global search for a Portal Access Rewrite object.
Impact:
You will not be able to search any Portal Access Rewrite object via global search
Workaround:
Customer will have to navigate to Portal Access Rewrite object list screen and do a search using the filter bar.
641237 : Inability to delete SNAT pool with SNAT transaction from some versions of BIG-IP.
Component: BIG-IQ Local Traffic & Management
Symptoms:
On BIG-IQ there is inability to delete a SNAT pool with SNAT translation and deploy to BIG-IP.
An error occurs similar to:
"transaction failed:01070321:3: Snat translation address /Common/1.2.3.4 is still referenced by a snat pool."
Conditions:
Configure a SNAT pool with SNAT translation.
Deleting the SNAT pool and deploying to BIG-IP.
Impact:
Deployment will fail.
Workaround:
Delete the SNAT pool and SNAT translation directly on the BIG-IP device
639967 : ASM deployment failure with deadlock on Data Guard configuration changes
Component: BIG-IQ Web Application Security (ASM)
Symptoms:
Rarely, a Web Application Security deployment task may fail due to a deadlock on the BIG-IP. A second deploy would usually be successful.
Conditions:
The issue may happen when Data Guard changes are deployed, and the BIG-IP does not have a fix for ID 639905.
Impact:
Deployment task failure.
Workaround:
Install the BIG-IP fix for ID 639905 or attempt another deployment task.
639896-1 : Cannot view SWG Reports and download CSV Reports on Standby BIG-IQ
Component: BIG-IQ Monitoring - Dashboards & Reports
Symptoms:
Request failed error message pops up when admin attempts to view SWG Reports or certain access reports like Browser OS, Geo-location,Access Profile Usage from the Stand-by BIG-IQ device. Admin cannot perform CSV download from Stand-by BIG-IQ device.
Impact:
Admin cannot view SWG Reports and few Access Reports , cannot download CSV reports from the stand-by BIG-IQ device.
Workaround:
Admin can view the reports and perform CSV downloads from the Active BIG-IQ device.
638131 : Deploying a DoS profile imported from a BIG-IP 11.6.x to a 12.x or higher would fail when Proactive Bot Defense is enabled
Component: BIG-IQ Network Security
Symptoms:
When a BIG-IQ Centralized Management user discovers a BIG-IP device that is 11.6.x, the Bot Signature Check is disabled and is read-only in a DoS profile.
Deploying a DoS profile imported from a BIG-IP 11.6.x to a 12.x or higher would fail, when Proactive Bot Defense is enabled.
Conditions:
Deploying a DoS profile imported from a BIG-IP 11.6.x to a 12.x or higher, when Proactive Bot Defense is enabled.
Impact:
User cannot deploy a DoS profile imported from a BIG-IP 11.6.x to a 12.x or higher, when Proactive Bot Defense is enabled.
Workaround:
First, in the Dos Profile, select the Application Security Proactive Bot Defense tab, and record the current setting of the Operation mode setting. Then set Operation mode to off. You can set it back to its previous value.
As a result, the Bot Signature Check in Bot Signature screen is set to Enabled automatically.
At this point the Bot Signatures and Bot Signature Categories should be visible and editable.
Save the configuration.
637937 : Similarly named keys/certs on BIG-IPs of different versions appear as distinct objects in BIG-IQ if the name includes special characters
Component: BIG-IQ Configuration - Local Traffic
Symptoms:
BIG-IP v11.x APIs improperly escape special characters in key/certificate names. This was fixed at BIG-IP v12.0.0.
Conditions:
These issues occur when a mixture of BIG-IPs running both v11.x and v12+ are used in conjunction with BIG-IQ to manage SSL keys/certs.
Impact:
Users may see a keys/certs named with special characters (e.g. *.domain.com) represented multiple times on BIG-IQ (once with escaping and once without). Also, such keys/certs created on BIG-IQ or imported from BIG-IP v12+ cannot be deployed from BIG-IQ to BIG-IP v11.x devices.
Workaround:
These issues can be avoided by renaming keys/certs so they do not include special characters.
637728 : SSL keys/certificates on BIG-IP with + or ~ in the name cause a discovery failure in BIG-IQ
Component: BIG-IQ Configuration - Local Traffic
Symptoms:
When a BIG-IP has an SSL key or certificate with + or ~ in the name, discovering the LTM service for the BIG-IP fails.
An error is generated:
"Error querying SSL Cert Bundle Certificate from..."
Conditions:
BIG-IP has an SSL key or certificate with + or ~ in the name.
Impact:
Services on BIG-IP cannot be managed by BIG-IQ.
Workaround:
There is no workaround aside from changing the name of affected keys/certs on BIG-IP.
636188-1 : Access Events in iRule requires an Access Profile associated with Virtual
Component: BIG-IQ Access
Symptoms:
Error during deployment:
"Failed submitting iControl REST transaction ...: status:400, body:{"code":400,"message":"transaction failed:01071912:3: ACCESS_... event in rule (/.../...) requires an associated ACCESS profile on the virtual-server (/.../...).","errorStack":[],"apiError":1}"
Conditions:
This issue happens when deploying LTM or Access Deployment that includes LTM objects. A virtual server in the device has iRule that uses some Access Event assigned.
Impact:
Failed to deploy LTM or APM that includes LTM objects.
Workaround:
1) Remove the iRule Assignment from Virtual Server.
2) Deploy Apm that includes LTM Objects
or
Full LTM deployment and APM deployment.
3) ReAssign the iRule to the Virtual Server in LTM
and do a full LTM deployment again.
636086 : Certificates and keys that are copied between BIG-IP are not match on the BIG-IQ
Component: BIG-IQ Configuration - Local Traffic
Symptoms:
Discovering devices with the same keys and/or certificates that were copied from one BIG-IP to another by using the paste text feature will result in conflict during BIG-IQ discovery/import of the second device.
Conditions:
Issue applies when multiple devices with the same certificates and/or keys that were copied using the paste text feature in BIG-IP.
Impact:
Conflict page will be displayed on the identical keys and/or certificates. During deployment, those identical items will be displayed as different.
Workaround:
When copying a key and/or certificate from on BIG-IP to another without using BIG-IQ, use the "Upload File" option versus the "Paste Text" to import the key and/or certificate to the other device.
635584-1 : BIG-IQ setup wizard fails with "Cannot delete IP X.X.X.X because it would leave a route unreachable"
Component: BIG-IQ Fraud Protection Service (FPS)
Symptoms:
BIG-IQ setup wizard fails to configure management address with error "Cannot delete IP X.X.X.X because it would leave a route unreachable".
Conditions:
This issue is applicable when trunking used for VLANs not named internal. The BIG-IQ UI does not support configuring trunks, but such configuration can be created via other means (e.g. tmsh).
Impact:
As a result, system setup cannot be completed.
Workaround:
BIG-IQ system setup should be completed prior to creating trunks on new installations. For upgrade scenarios, the network configuration has to be removed so that system setup can be completed, after which the network configuration can be restored.
632900 : Bot Signatures/Bot Signature Categories User Defined Flag Behavior
Component: BIG-IQ Network Security
Symptoms:
In some cases, user created Bot Signatures and Bot Signature Categories imported from BIG-IP are classified as "system defined" on the BIG-IQ after import. This behavior is true even if a bot signature or bot signature category is designated as "user defined" on BIG-IP.
Conditions:
Seen when discovering user defined bot signatures from "pre 13.0.0" version BIG-IP devices.
Impact:
Bot Signatures and Bot Signature Categories created by a user on the BIG-IP get re-classified as "system defined" upon import into the BIG-IQ. Bot signatures so classified are not editable in BIG-IQ.
Workaround:
To make the bot signature editable in BIG-IQ simply reset the bot signature or bot signature category to "user defined" to match the "user defined" setting in BIG-IP.
632813-1 : Removing the global-fqdn policy may fail. The deployment may need to be done in 2 steps.
Component: BIG-IQ Network Security
Symptoms:
When doing a deployment in which the DNS resolver is removed from the Global FQDN Policy (effectively turning fqdn off on the BIG-IPs), this may fail with the following device error:
"Configuration error: dns-resolver can't be removed (atleast 1 AFM rule with source or destination fqdn attribute set.)"
This is due to an issue in the BIG-IP transaction processing.
Conditions:
This happens when a DNS resolver is configured on the BIG-IP and there are any address-lists or rules that use FQDN in the firewall.
Impact:
The deployment will fail. There is a workaround to do this in 2 phases.
Workaround:
In order to get around this issue, the deployment will need to be done in 2 phases. First, all address lists and rules that use FQDNs will need to be removed from the BIG-IP (deployment 1). Second, the global-fqdn can then remove the DNS Resolver to turn off firewall fqdn (deployment 2).
632201 : Users who are members of more than 40 user groups may fail to login.
Component: REST Framework and TMOS Platform
Symptoms:
If a user who is a member of more than 40 BIG-IQ user groups attempts to log into the UI, they may fail to login and get the error: 413 Request Entity Too Large responses.
Conditions:
User is a member of more than 40 user groups and attempts to log into the UI.
Impact:
Login will fail for these users.
Workaround:
Remove the user from user groups until the user is able to login again.
Go to System > User Management > Users and click a user name to manage the user group memberships.
630648-1 : BIG-IQ HA: Zone of the secondary console node is set to default when two BIG-IQ console nodes are paired
Component: REST Framework and TMOS Platform
Symptoms:
Zone of the secondary console node is set to default when two BIG-IQ console nodes are paired.
There is no impact if the Zone of the secondary console node is set to "default" or incorrectly set or gets overwritten when the BIG-IQ console devices are paired.
Conditions:
When the BIG-IQ HA pair is initiated, the data in the database on the secondary device gets overwritten. Therefore if the Zone on the BIG-IQ console is set to a value prior to BIG-IQ HA pairing is done and is chosen to be the BIG-IQ secondary device, then after the HA pairing is complete the Zone information on the BIG-IQ secondary is overwritten with the Zone named "default".
Impact:
None that affects the functionality of the product. It appears in the UI under System --> BIG-IQ HA that the Zone on the secondary device is set to "default".
Workaround:
After the BIG-IQ HA is setup, navigate to the System --> BIG-IQ HA page. Select the machine with Type "Secondary". Choose an existing Zone or create a new Zone as appropriate and click on Update.
630437 : Parent policy items not shown when searching for items related to the child policy
Component: BIG-IQ Web Application Security (ASM)
Symptoms:
When performing related-to queries on Web Application Security objects, if a policy is set with a parent policy, the parent objects are not shown in the related-to query results.
Conditions:
This happens when policy inheritance (Layered Policies) is configured.
Impact:
Users might not see results they are expecting to see on related-to queries when layered policy relationships are involved.
629213-1 : Set filespace quota for file objects
Component: BIG-IQ Access
Symptoms:
Unable to download new file objects due to "exceeds storage quota" error.
Conditions:
Default storage quota is 500MB, if use wants to store more than that amount the quota must be changed.
Impact:
Inability to add new file objects
Workaround:
To extend the storage quota, use the restcurl command to set a new value. Current value is obtained by:
# restcurl cm/system/file-object-configuration/storageDir
{
"directoryPath": "/var/config/rest/fileobject",
"generation": 4,
"kind": "cm:system:file-object-configuration:fileobjectconfigurationstate",
"lastUpdateMicros": 1491948519420631,
"maxFilespaceBytes": 524288000,
"name": "storageDir",
"selfLink": "https://localhost/mgmt/cm/system/file-object-configuration/storageDir"
}
Use restcurl with PATCH verb to update maxFilespaceBytes:
restcurl -X PATCH cm/system/file-object-configuration/storageDir -d '{"maxFilespaceBytes":1000000000}'
{
"name": "storageDir",
"directoryPath": "/var/config/rest/fileobject",
"maxFilespaceBytes": 1000000000,
"generation": 5,
"lastUpdateMicros": 1491948923168173,
"kind": "cm:system:file-object-configuration:fileobjectconfigurationstate",
"selfLink": "https://localhost/mgmt/cm/system/file-object-configuration/storageDir"
}
629041 : Access deployment failure with error "DNS resolver /Common/<dns resolver name>: Referencing a non existing route domain /Common/<route_domain_name>."
Component: BIG-IQ Access
Symptoms:
Access deployment failure with error "DNS resolver /Common/<dns resolver name>: Referencing a non existing route domain /Common/<route_domain_name>."
Conditions:
An error occurs during deployment when trying to deploy Access that includes a Local Traffic deployment as well.
Impact:
Access deployment fails.
Workaround:
The DNSResolver refers to the RouteDomain and it is not created and deployed on the BIG-IP system. As a workaround, create a RouteDomain for the device in BIG-IQ Local Traffic, and do a full Local Traffic deployment. After deploying Local Traffic, deploy Access again.
628451 : Child policy items not shown when searching for items related to the parent policy
Component: BIG-IQ Web Application Security (ASM)
Symptoms:
When performing related-to queries on Web Application Security objects, and the results contain parent policies that are related-to the searched object, only objects that are directly related-to the parent policy will be returned and not objects that are related-to the child policies that are using this parent policy.
Conditions:
This happens when policy inheritance (Layered Policies) is configured.
Impact:
Users might not see results they are expecting to see on related-to queries when layered policy relationships are involved.
627255 : When discovering a cloned BIG-IP, error message does not provide sufficient information
Component: BIG-IQ Device Management
Symptoms:
When discovery fails due to attempting to discover a "cloned" BIG-IP, the error message does not provide enough information to guide the customer to how to resolve the issue.
Conditions:
Discover both a BIG-IP and a cloned BIG-IP from one BIG-IQ, the discovery returns error, but not specify that the second BIG-IP is a cloned BIG-IP.
Impact:
Customer may not identify the root cause the issue.
Workaround:
Fix the configuration of the cloned BIG-IP by updating the machine-id.
627105-1 : Incorrect Error when clicking on Tokens under Monitoring --> Access --> Federation --> OAuth --> Authorization Server --> Tokens
Component: BIG-IQ Monitoring - Dashboards & Reports
Symptoms:
An error message appears when clicking on Tokens under Monitoring --> Access --> Federation --> OAuth --> Authorization Server --> Tokens
Conditions:
This error is seen only when No token record is yet created on BIG-IQ and a user navigates to the Token page.
Only seen if No tokens are present in BIG-IQ Access OAuth Federation elasticsearch index.
Impact:
No functional impact. It is an incorrect error message.
Workaround:
This error will not be seen if some logs are received from the managed BIG-IP which are in turn responsible for the OAuth token records seen under Reports.
624756 : Discovery failure occurs due to BIG-IP ASM software unexpected service restart - auto detect language
Component: BIG-IQ Web Application Security (ASM)
Symptoms:
BIG-IP has an issue that may cause a restart of services (tracked by BIG-IP bug 644725).
Since the restart on BIG-IP might cause connectivity issues from BIG-IQ, discovery/deployment issues might occur.
Conditions:
The BIG-IP must be affected by bug 644725, and one of the policies language must be set to 'auto-detect'.
Impact:
Discovery/deploy issues.
Workaround:
Either patch the BIG-IP with a fix to the issue or manually set the policy language on the BIG-IP.
624368 : BIG-IQ fails to discover Rewrite profiles that have a corrupt passphrase on BIG-IP
Component: BIG-IQ Local Traffic & Management
Symptoms:
BIG-IQ fails to discover Rewrite profiles that have a corrupt passphrase on BIG-IP
Conditions:
BIG-IP has a custom rewrite profile from the GUI.
Impact:
BIG-IQ cannot discover the BIG-IP.
Workaround:
Use tmsh on the BIG-IP to create the custom profile instead of the GUI.
622676 : Dual management routes in the main routing table
Component: REST Framework and TMOS Platform
Symptoms:
Dual management routes might exist in the default routing table, main. On version 11.6.0, the the system also produces an error message when querying SNMP ipCidrRouteTable.
Impact:
On affected versions earlier than 11.6.0, there are dual management routes in the main routing table. On version 11.6.0, you might also receive an error upon querying SNMP ipCidrRouteTable and/or snmpd core.
Workaround:
To recover from this issue, delete the duplicate route.
Duplicate route may return after a reboot.
620791 : BIG-IQ 5.2.0 images imported into previous versions of BIG-IQ may not be available after restart★
Component: REST Framework and TMOS Platform
Symptoms:
When a BIG-IQ 5.2.0 image is imported into any previous BIG-IQ version (5.1.0 and earlier), it will be available in System management. However, if BIG-IQ services are restarted, the software image may no longer be available.
Conditions:
Restarting servcies (specifically, csyncd) on a BIG-IQ 5.1.0 or earlier that has a BIG-IQ 5.2.0 image imported.
Impact:
The BIG-IQ 5.2.0 image is not available for upgrades.
Workaround:
Re-import the 5.2.0 ISO for it to be available for upgrading the BIG-IQ device.
618101 : Access Reporting UI take 30 seconds or more to load.
Component: BIG-IQ Access
Symptoms:
This happens when one or more BIG-IP devices discovered in the BIG-IQ system is not reachable from BIG-IQ.
Impact:
Access Reporting UI takes 30 seconds or more to load.
Workaround:
1) Navigate to Devices tab.
2) Identify the devices whose status is "Red"
3) Check if the devices are reachable (ping) from BIG-IQ.
4) Either remove or resolve the device connectivity issue of the device.
615822 : Deployment failure reported when attempting to deploy a change to TMOS v11.5.4 that would change a manual-type signature set to a filter-based signature set
Component: BIG-IQ Web Application Security (ASM)
Symptoms:
If you attempt to deploy a change to an v11.5.4 BIG-IP where the change includes the migration of a manual-type signature set to a filter-based signature set, the deployment task will fail with the following error:
error code:500 Can't use an undefined value as a HASH reference
Conditions:
TMOS v11.5.4 experiences an issue when attempting to change the type signature set from manual to filter-based. This issue is tracked by BIG-IP issue ID 615930.
Impact:
Deployment tasks will continue to fail while this type of change is listed in the change set being deployed to the v11.5.4 BIG-IP
Workaround:
Deployment tasks to this device will continue to fail until the change of signature set type is reverted or the signature set is replaced.
614199-1 : Profile - Client SSL - Cannot deploy Certificate Key Chain changes to root clientssl profile
Component: BIG-IQ Local Traffic & Management
Symptoms:
Due to an issue on BIG-IP BIG-IQ cannot update the Cert Key Chain values for root profiles more than once. This operation is blocked on BIG-IQ to prevent modification from BIG-IQ which could lead to permanently blocking deployments from BIG-IQ.
An error occurs:
"transaction failed:010717e1:3: Client SSL profile cannot contain more than one set of same certificate/key type."
Conditions:
User needs to modify the Cert/Key chain values for the root Client SSL Profile.
Impact:
Cannot deploy Certificate Key Chain changes to root clientssl profile
Workaround:
Manage these setting on BIG-IP and re-discover and import.
612292-1 : Customization file changes are not deployed when customization template and customization group objects are created in deployment
Component: BIG-IQ Access
Symptoms:
Customization file changes are not deployed when customization template and customization group objects are created in deployment.
Deployment is successful. On a subsequent evaluation, it indicates that BIG-IQ customization group is different from the one on BIG-IP.
Conditions:
When customization template and corresponding customization group is deployed first time to a non-source device, deployment is successful.
Impact:
Customization group files are not deployed in such cases.
Workaround:
Perform one more deployment and it deploys the customization group correctly.
606953 : Deployment of a new asm policy may result in failure.
Component: BIG-IQ Web Application Security (ASM)
Symptoms:
The deployment of a new Web Application Security policy to a BIG-IP device is failing, and an "ASM subsystem error" appears in the BIG-IP's asm log.
Conditions:
This was related to an intermittent BIG-IP bug 606285, where a previous attempt to delete a policy by the same name failed during the removal process.
Impact:
Deployment failure.
Workaround:
If the deployment of a new Web Application Security policy to a BIG-IP device is failing, check the asm log on the BIG-IP. If an "ASM subsystem error" is shown, perform these two commands on the BIG-IP:
tmsh list asm policy one-line | wc -l
tmsh list asm policy one-line all-properties | wc -l
if the numbers from the two queries do not match, we have a mismatch on the BIG-IP that needs to be corrected. To correct, remove the policy from bigip.conf:
# tmsh save sys config
# vim /config/bigip.conf
remove this section
-------
asm policy /Common/<policy_name> {
encoding utf-8
}
-------
save and quit
# tmsh load sys config
and re-try your deployment from the BIG-IQ.
599844 : Ltm log has GET_MEDIA and chmand error and failure messages on shutdown
Component: REST Framework and TMOS Platform
Symptoms:
Upon a reboot or power cycle from BIGIP, shutdown messages may contain "err chmand[8242]: 012a0003:3: GET_MEDIA failure (status=0xc) page=0x14 reg=0x0 : File mgmtif/BourneMgmtIfSvc.cpp Line 385" messages.
Conditions:
Host is up and running. A reboot or power cycle is issued
Impact:
None.
599838 : notice HA: ha_enabled_put(daemon_heartbeat, tmm, FALSE/TRUE)
Component: REST Framework and TMOS Platform
Symptoms:
On VIPRION B2250 and B4300/B4340N blades, you might encounter log entries of this type: notice HA: ha_enabled_put(daemon_heartbeat, tmm, FALSE): error 01140012 or notice HA: ha_enabled_put(daemon_heartbeat, tmm, TRUE): error 01140012.
Conditions:
This occurs only on VIPRION B2250, B4300, B4340N blades.
Impact:
The system posts the error messages. These messages are benign and can be safely ignored.
596082-1 : Incorrect information displayed by HA Inventory page in HA Error state
Component: REST Framework and TMOS Platform
Symptoms:
1) The "Promote to Primary" button is functional for the secondary BIG-IQ peer when it is selected from the list, even though the cluster is in an unhealthy HA error state.
2) The "Last Successful Sync" field incorrectly displays a successful Sync completion for the first 10 minutes after the initial, unsuccessful BIG-IQ Cluster synchronization attempt.
Conditions:
Something happened that prevented the initial HA Synchronization from completing or otherwise led HA cluster to become unhealthy.
Impact:
The secondary peer in the BIG-IQ HA cluster is falsely presented as up-to-date and available for failover when actually the data from the primary peer has not been synchronized, and an HA failover is impossible.
Workaround:
1. Use the Status bar at the top of the screen to determine the definitive health status of the BIG-IQ HA cluster and its peers.
2. If the Status bar shows "HA Error", do NOT use the "Promote to Primary" functionality of the secondary peer.
3. As soon as possible, break up the unhealthy cluster by removing the secondary device on the primary device's BIG-IQ HA screen.
4. Re-add the secondary device to form a new BIG-IQ HA cluster.
5. Allow the synchronization to complete, ensure that the status indicators at the top display green/healthy status on both peers.
590791-1 : Rediscovery fails due to required REST framework upgrade although the error message does not indicate this
Component: BIG-IQ Device Management
Symptoms:
The BIG-IP service re-discovery might fail with a generic error message if the BIG-IP system needs a REST framework upgrade.
Conditions:
The BIG-IP device is upgraded offline and a BIG-IP REST framework upgrade is required but hasn't been done.
Impact:
Service rediscovery may be failed with non specific error message.
Workaround:
View the BIG-IP Device inventory list to see if the device needs a REST framework upgrade. Make the required upgrades to the REST framework.
590022-1 : Added a Logging Node, it appears to be added (In the Logging Configuration -> logging node Count increases) but does not show up in the list on Logging Nodes page
Component: REST Framework and TMOS Platform
Symptoms:
When you add a logging node, it may take a long time and you could receive an error message. However, if you then go to the Logging Configuration page, you can see that the log node count increased.
This means that adding the Logging node took longer than expected. It is added partially to the BIG-IQ system.
Conditions:
This could happen if there was a network issue intermittently on a VM. When the user adds a logging node, it might appear after a couple of minutes in the elastic search cluster (indicated by the incremented logging node count)
Impact:
Logging node not added to the BIG-IQ.
Workaround:
Go through the UI to add the logging node again.
585505-1 : Discovery and import allows a change in a policy's application language, but a deployment fails when application language is to be changed
Component: BIG-IQ Web Application Security (ASM)
Symptoms:
When 2 devices share the same policy but with a different application language the policy cannot be passed from one BIG-IP device to another through the BIG-IQ
The cause of this issue is that BIG-IP doesn't allow a change in the application language field.
Workaround:
1. Clone the policy and attach the cloned policy to the virtual server instead of the original and deploy
2. Attach the original policy to the virtual server instead of the cloned policy and deploy
3. Remove the cloned policy from the BIG-IQ
582701-1 : At Scale, HTML Report fails to render in IE and Edge.
Component: BIG-IQ Network Security
Symptoms:
In IE & Edge browsers, the HTML report fails to generate when the report has too much data to display, which can be caused by the user selecting a large number of devices to generate the report and/or the data per device is too large.
Impact:
Reports are not available while using certain browser.
Workaround:
There are two possible workarounds:
1) Use Firefox/Chrome.
2) Try reducing the number of devices selected for the report.
579422 : Evaluation shows unexpected differences after deployment for policy building settings (enabled)
Component: BIG-IQ Web Application Security (ASM)
Symptoms:
Evaluation shows unexpected differences after deployment for policy building settings (enabled). This is due to BIG-IP device behavior that alters the configuration when the configuration is synchronized.
Conditions:
This happens when deploying to BIG-IP device groups (clusters).
Impact:
Policy building mode on the BIG-IP device is not configured as set in the BIG-IQ configuration.
505455-1 : Adding a device to Access Group fails: Unable to calculate working config ID
Component: BIG-IQ Access
Symptoms:
Adding a device to an Access group fails when a device-specific object on the non-source device refers to an object that does not exist on the source device.
Conditions:
Adding a device to Access Group fails when there exists a shared object that is referred from a "Device-specific" object in the device being added.
Impact:
Failed to add the device to the Access Group.
Workaround:
To identify and resolve the issue, look into logs for errors such as "Failed to re-work references" and "Unable to calculate working config id". The logs will have information on the type of object that needs to be fixed on the BIG-IP system.
★ This issue may cause the configuration to fail to load or may significantly impact system performance after upgrade
For additional support resources and technical documentation, see:
- The F5 Networks Technical Support web site: http://www.f5.com/support/
- The AskF5 web site: https://support.f5.com/csp/#/home
- The F5 DevCentral web site: http://devcentral.f5.com/
