Bug ID 1070677: Learning phase does not take traffic into account - dropping all.

Last Modified: May 29, 2024

Affected Product(s):
BIG-IP AFM(all modules)

Fixed In:
17.0.0, 16.1.2.2, 15.1.6.1, 14.1.5

Opened: Dec 29, 2021

Severity: 3-Major

Symptoms

Suggestions are generated every suggestion interval and every suggestion interval suggestions are overriding, so the last suggestion is considered after the staging period is completed.

Impact

IPS learning phase, which lasts the default 7 days, sees a ton of traffic from websites hitting against signatures, but at the end of the 7 days it blocks all signatures and causes an outage.

Conditions

Once the start of staging period, suggestions will override every time until the staging period completes.

Workaround

N/A

Fix Information

We now make the decision based on the overall suggestions that are generated during the staging period instead of the last suggestion.

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips