Bug ID 1134441: Inactive policy synced to peer results ASM removed from virtual server only for sync-only DG

Last Modified: Mar 18, 2024

Affected Product(s):
BIG-IP ASM(all modules)

Known Affected Versions:
15.1.4, 15.1.4.1, 15.1.5, 15.1.5.1, 15.1.6, 15.1.6.1, 15.1.7, 15.1.8, 15.1.8.1, 15.1.8.2, 15.1.9, 15.1.9.1, 15.1.10, 15.1.10.2, 15.1.10.3

Opened: Aug 08, 2022

Severity: 3-Major

Symptoms

An ASM policy is suddenly detached from a virtual server and deactivated.

Impact

Inactive policy is synced to the peer, resulting in ASM being unassigned from the Virtual Server.

Conditions

-- sync-only device group. -- ASM sync enabled. -- A policy is used on device ASM-A (attached to virtual server/device group). -- The same policy is not used on device ASM-B (not attached to virtual server/device group).

Workaround

To prevent Policy Sweeper from deactivating any ASM policy, create a non-functioning device group and attach the unused ASM policies to that device group.

Fix Information

None

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips