Last Modified: Jun 25, 2026
Affected Product(s):
BIG-IP PEM
Known Affected Versions:
17.5.1.6
Opened: Jun 17, 2026 Severity: 3-Major
When the setting `tmm.pem.rancon.towerid.enabled` is activated, only the very first subscriber associated with a specific tower ID is successfully added to the PEM session table. Any subsequent subscriber that attempts to connect to the same tower ID—including the same subscriber after a RADIUS stop/start cycle—will fail to create a session, resulting in the log message "RANCON: towerid add failed." Additionally, the session will be deleted immediately after its creation
Only the first PEM session per towerid succeeds. All subsequent sessions associated with the same towerid are incorrectly torn down, causing subscriber traffic to go unmanaged by PEM policies. In deployments where multiple subscribers share a cell tower (the common case), this effectively breaks PEM session management for all but one subscriber per tower
- The sys db key tmm.pem.rancon.towerid.enabled is set to enabled - A RADIUS-initiated PEM session is created for a towerid that already has an existing entry in the towerid database (i.e., another subscriber is or was previously connected to the same tower) - Reproducible with a single subscriber performing RADIUS start ? RADIUS stop ? RADIUS start (same towerid reused on second session)
- Disable the towerid feature by setting tmm.pem.rancon.towerid.enabled to disabled: - tmsh modify sys db tmm.pem.rancon.towerid.enabled value disable - This prevents the towerid lookup/add path from executing during session creation, allowing all PEM sessions to succeed normally (at the cost of losing RAN congestion towerid tracking).
None