Last Modified: Jul 18, 2026
Affected Product(s):
BIG-IP TMOS
Known Affected Versions:
12.0.0, 12.0.0 hf1, 12.0.0 hf2, 12.0.0 hf3, 12.0.0 hf4, 12.1.0, 12.1.0 hf1, 12.1.0 hf2, 12.1.1, 12.1.1 hf1, 12.1.1 hf2, 12.1.2, 12.1.2 hf1, 12.1.2 hf2, 12.1.3, 12.1.3.1, 12.1.3.2, 12.1.3.3, 12.1.3.4, 12.1.3.5, 13.0.0, 13.0.0 hf1, 13.0.0 hf2, 13.0.0 hf3, 13.0.1, 13.1.0, 13.1.0.1, 13.1.0.2, 13.1.0.3, 13.1.0.4, 13.1.0.5, 13.1.0.6, 13.1.0.7, 13.1.0.8, 13.1.1, 13.1.1.2, 13.1.1.3
Fixed In:
14.0.0, 13.1.1.4, 12.1.3.6
Opened: Aug 03, 2017 Severity: 3-Major Related Article:
K25082113
When an IPsec Security Association (SA) does not exist on a remote IPsec peer, the BIG-IP system might be sent an INVALID-SPI notification, but might not delete the SA. The IPsec tunnel might not be renegotiated until the deleted SAs on the BIG-IP system are removed manually or age out.
IPsec tunnel appears to be up but suffers a connectivity loss until the SPIs are manually deleted or age out.
-- The BIG-IP system and remote peer communicate over a lossy network. -- The remote peer prematurely deletes an IPsec SA.
Manually delete the SA.
This release corrects this issue.