Last Modified: Jul 18, 2026
Affected Product(s):
BIG-IP Install/Upgrade, LTM
Known Affected Versions:
14.1.0, 14.1.0.1, 14.1.0.2, 14.1.0.3, 14.1.0.5, 14.1.0.6, 14.1.2, 15.0.0, 15.0.1, 15.1.0, 15.1.0.1, 15.1.0.2, 15.1.0.3, 15.1.0.4, 15.1.0.5, 15.1.1, 15.1.2, 15.1.2.1, 15.1.3, 15.1.3.1, 15.1.4, 15.1.4.1, 15.1.5, 15.1.5.1, 15.1.6, 15.1.6.1, 15.1.7, 15.1.8, 15.1.8.1, 15.1.8.2, 16.0.0, 16.0.0.1, 16.0.1, 16.0.1.1, 16.0.1.2, 16.1.0, 16.1.1, 16.1.2, 16.1.2.1, 16.1.2.2, 16.1.3, 16.1.3.1, 16.1.3.2, 16.1.3.3, 16.1.3.4, 16.1.3.5, 17.0.0, 17.0.0.1, 17.0.0.2, 17.1.0, 17.1.0.1, 17.1.0.2, 17.1.0.3, 17.1.1, 17.1.1.1, 17.1.1.2, 17.1.1.3, 17.1.1.4, 17.5.0, 17.5.1, 17.5.1.2, 17.5.1.3, 17.5.1.4, 17.5.1.5, 17.5.1.6, 21.0.0, 21.0.0.1
Fixed In:
17.1.2, 16.1.4, 15.1.9, 15.0.1.1, 14.1.2.1
Opened: Mar 04, 2019 Severity: 4-Minor
If a firewall is configured on the management port with an ICMP rule, after upgrading to v14.1.x or later, the ICMP rule does not work. This is because the iptables INPUT chain calls f5required, f5acl, and f5default rules in that order, and ICMP is explicitly allowed in the f5required chain, meaning ICMP never reaches the f5acl chain which is where user defined filters for the mgmt interface are placed.
ICMP packets cannot be blocked with a firewall rule to drop on the management port. ICMP packets are allowed from the management port and will not increase the packet 'Count' reported under System >> Platform >> Security, even if explicitly allowed by a rule.
- Firewall rules are configured on the management port (System >> Platform >> Security) - One or more of those rules are configured to block ICMP traffic (of any type)
Run the following commands after upgrading to v14.1.x or later from earlier versions, to any version where this fix for this ID is not present. ' # Create a new file : /config/id760355.sh #----------------------------------------- #!/bin/bash # Moves the ICMP allow rule from f5required to f5default, replicating the fix in ID760355 # logmsg() { echo "$(realpath $0): $1" | logger -p local0.info } logmsg "Running - waiting for pccd to start" if timeout 180 bash -c 'until pgrep -x "pccd" > /dev/null ; do sleep 2; done' ; then logmsg "pccd has started - applying iptables fix for ID760355" sleep 2 /sbin/iptables -D f5required -p icmp -j ACCEPT 2> /dev/null if [ "$?" == 0 ] ; then logmsg "Moved iptables ICMP accept rule from f5required to f5default" /sbin/iptables -I f5default -p icmp -j ACCEPT else logmsg "No existing iptables ICMP allow rule to move - no changes made" fi else logmsg "pccd did not start - fix for ID760355 has not been applied" fi #----------------------------------------------- # Append these lines to the existing file /config/startup (note the need to use :w! to save the file in vim due to it being read-only) echo Executing $0 | logger -p local0.info timeout 600 /config/id760355.sh&
The firewall rule allowing all ICMP traffic has been moved from the f5-required to f5-default, meaning that the f5acl chain (which contains 'security firewall management-ip-rules' entries) will now see, and process ICMP traffic.