Bug ID 1019357: Active fails to resend ipsec ikev2_message_id_sync if no response received

Last Modified: May 29, 2024

Affected Product(s):
BIG-IP TMOS(all modules)

Fixed In:
17.0.0, 16.1.2.2, 15.1.6.1

Opened: May 18, 2021

Severity: 3-Major

Symptoms

In high availability (HA) setup, after failover, the newly active BIG-IP device, will send ikev2_message_id_sync messages to the other device. If the BIG-IP device did not receive a response, it has to retransmit the packet. Some of the IKE tunnels are trying to retransmitting the packet, but its not going out of BIG-IP due to wrong state of relation between IKE tunnel and connection flow. After 5 retries, it marks the peer as down, and the IKE tunnel is deleted.

Impact

Traffic loss.

Conditions

-- High availability (HA) environment -- IKE tunnels configured -- A failover occurs

Workaround

None

Fix Information

Fetch latest connection flow during retransmission of IKE/IPSEC packet.

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips