Last Modified: Aug 25, 2026
Affected Product(s):
BIG-IP F5OS, TMOS, Velos
Known Affected Versions:
15.1.0, 15.1.0.1, 15.1.0.2, 15.1.0.3, 15.1.0.4, 15.1.0.5, 15.1.1, 15.1.2, 15.1.2.1, 15.1.3, 15.1.3.1, 15.1.4, 15.1.4.1, 15.1.5, 15.1.5.1, 15.1.6, 15.1.6.1, 15.1.7, 15.1.8, 15.1.8.1, 15.1.8.2, 15.1.9, 15.1.9.1, 15.1.10, 15.1.10.2, 15.1.10.3, 15.1.10.4, 15.1.10.5, 15.1.10.6, 15.1.10.7, 15.1.10.8, 17.0.0, 17.0.0.1, 17.0.0.2, 17.1.0, 17.1.0.1, 17.1.0.2, 17.1.0.3, 17.1.1, 17.1.1.1, 17.1.1.2, 17.1.1.3, 17.1.1.4, 17.1.2, 17.1.2.1, 17.1.2.2, 17.5.0, 17.5.1, 17.5.1.2, 17.5.1.3, 21.0.0, 21.0.0.1, 21.0.0.2, 21.0.0.3
Fixed In:
17.5.1.4, 17.1.3
Opened: Jul 27, 2023 Severity: 4-Minor
A BIG-IP tenant running on an r2000 or r4000 appliance cannot access addresses in the floating traffic group if MAC masquerade is enabled. For instance, the standby tenant will not be able to ping a floating self IP address, or any virtual servers in the active traffic-group. External devices can communicate with the floating self IP address without issue. Note that this not only affects traffic from the standby unit towards the active unit, but also affects traffic from any other tenants on the same physical r2000/4000 device as the standby member of the target HA pair. If the tenants swap HA roles (the active device becomes standby, and the standby device becomes active), the problem follows the standby device -- the newly-standby system is not able to ping the floating self IP address.
Standby tenant unable to access resources in the floating traffic group when MAC masquerade is configured.
-- F5 r2000 or BIG-IP r4000 system -- Standby and Active tenants located on physically different BIG-IP systems. -- BIG-IP tenant with MAC masquerade configured for floating traffic group
None
A configuration option to disable MAC filter installation has been added. To disable MAC filters: echo -e "drvcfg iavf uc_mac_filter 0\ndrvcfg iavf mc_mac_filter 0" >> /config/xnet_init.tcl bigstart restart tmm