Last Modified: Jun 13, 2024
Affected Product(s):
BIG-IP AFM
Fixed In:
17.1.0, 15.1.9
Opened: May 06, 2022 Severity: 3-Major
Hardware drops are not seen for the vectors ICMP flood or ICMP/IP/IPv6 fragment when configured on zone.
Hardware mitigation is not happening when ICMP flood and ICMP/IP/IPv6 fragment vectors configured on a zone.
A zone is configured with ICMP flood or ICMP/IP/IPv6 fragment vectors.
None
This was due to know limitation in one of the hardware module. Added the required changes to use SPVA for these vectors to fix the issue. In order to mitigate these vectors on Zone, you can update the dos.allvlans sys DB variable to 'false'. root@(localhost)(cfg-sync Standalone)# modify sys db dos.allvlans { value false } root@(localhost)(cfg-sync Standalone)# list sys db dos.allvlans sys db dos.allvlans { value "false" }"