Bug ID 1065757: Virtual servers may not receive TCP SYN packets when another virtual server is in SYN Cookie mode

Last Modified: Sep 29, 2022

Bug Tracker

Affected Product:  See more info
BIG-IP LTM(all modules)

Known Affected Versions:
14.1.0, 14.1.0.1, 14.1.0.2, 14.1.0.3, 14.1.0.5, 14.1.0.6, 14.1.2, 14.1.2.1, 14.1.2.2, 14.1.2.3, 14.1.2.4, 14.1.2.5, 14.1.2.6, 14.1.2.7, 14.1.2.8, 14.1.3, 14.1.3.1, 14.1.4, 14.1.4.1, 14.1.4.2, 14.1.4.3, 14.1.4.4, 14.1.4.5, 14.1.4.6, 14.1.5, 14.1.5.1, 14.1.5.2

Opened: Dec 03, 2021
Severity: 3-Major

Symptoms

When a wildcard or subnet virtual server that listens on a specific VLAN or list of VLANs enter HW SYN Cookie mode its Neuron rule jumps to the top of the priority list and therefore catches the SYN packets of other virtual servers that have an overlapping destination address and are configured to listen on all VLANs.

Impact

Virtual servers that are not in SYN Cookie mode, perhaps even have SYN Cookie disabled, do not receive the TCP SYN packets. The limited number of possible MSS values may cause a slight performance degradation.

Conditions

- On platforms with Neuron support (BIG-IP iSeries). - Wildcard or subnet virtual server that listens on a list of VLANs and other overlapping virtual servers that listen on all VLANs.

Workaround

Disable HW SYN Cookie on the wildcard virtual server.

Fix Information

None

Behavior Change