Last Modified: Sep 04, 2026
Affected Product(s):
BIG-IP LTM
Known Affected Versions:
17.5.0, 17.5.1, 17.5.1.2, 17.5.1.3, 17.5.1.4, 17.5.1.5, 17.5.1.6, 17.5.1.8, 17.5.1.9
Opened: Jul 24, 2026 Severity: 3-Major
- With a GARP reply, the lasthop address is not changed. This is consistent with https://my.f5.com/manage/s/article/K2211 : "If the MAC address of the device that sends inbound traffic to the BIG-IP system changes (such as when redundant firewalls or routers failover), the BIG-IP system will continue to send return traffic to the old MAC address. " - With a GARP request, the lasthop address is changed
- Established flows can temporarily use a new return-path MAC after failover GARP, instead of staying on the original learned MAC - This can cause a short service interruption during failover for active sessions
- Auto Last Hop is enabled on the traffic path (global and/or object level) - An upstream failover device sends GARP announcing a MAC change. - Established flows remain active during the failover window - Most visible in environments with long-lived sessions and strict failover continuity requirements
- Configure an explicit Last Hop Pool on affected services instead of relying on Auto Last Hop learning - This avoids GARP-driven MAC reselection behavior on established flows and provides deterministic return-path selection during failover
None