Symptoms

Suggestions are generated every suggestion interval and every suggestion interval suggestions are overriding, so the last suggestion is considered after the staging period is completed.

Impact

IPS learning phase, which lasts the default 7 days, sees a ton of traffic from websites hitting against signatures, but at the end of the 7 days it blocks all signatures and causes an outage.

Conditions

Once the start of staging period, suggestions will override every time until the staging period completes.

Workaround

N/A

Fix Information

We now make the decision based on the overall suggestions that are generated during the staging period instead of the last suggestion.

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips