Last Modified: May 29, 2024
Affected Product(s):
BIG-IP LTM
Known Affected Versions:
16.1.1, 16.1.0, 16.0.1.2, 15.1.5, 15.1.4, 15.1.3.1, 15.1.3, 14.1.4.4, 14.1.4.3, 14.1.4.2, 14.1.4.1, 14.1.4, 13.1.4.1, 13.1.4
Fixed In:
17.0.0, 16.1.2, 15.1.4.1, 14.1.4.5, 13.1.5
Opened: Mar 31, 2021 Severity: 3-Major
The configuration load fails with an error: err mcpd[4182]: 0107186b:3: Invalid "enforce-tls-requirements" value for profile /prod/my_profile. In Virtual Server (/common/my_virtual_server) an http2 profile with enforce-tls-requirements enabled is incompatible with client-ssl/server-ssl profile with renegotiation enabled. Value must be disabled.
The configuration will not load if saved.
BIG-IP system allows this configuration and fails later: -- Virtual server with HTTP/2, HTTP, and client SSL profiles (with renegotiation disabled). 1. Enable the 'Enforce TLS Requirements' option in the HTTP/2 profile (by default it is enabled). 2. Add server SSL profile with 'TLS Renegotiation' enabled. 3. Save the configuration. 4. Load the configuration.
If enabling 'Enforce TLS Requirements' in a HTTP/2 profile configured on a virtual server, ensure that 'TLS Renegotiation' is disabled in the Server SSL profiles on that virtual server.
There is now a validation check to prevent this configuration, which is the correct functionality.