Bug ID 1134441: Inactive policy synced to peer results ASM removed from virtual server only for sync-only DG

Last Modified: Sep 09, 2022

Bug Tracker

Affected Product:  See more info
BIG-IP ASM(all modules)

Known Affected Versions:
15.1.0, 15.1.0.1, 15.1.0.2, 15.1.0.3, 15.1.0.4, 15.1.0.5, 15.1.1, 15.1.2, 15.1.2.1, 15.1.3, 15.1.3.1, 15.1.4, 15.1.4.1, 15.1.5, 15.1.5.1, 15.1.6, 15.1.6.1

Opened: Aug 08, 2022
Severity: 3-Major

Symptoms

An ASM policy is suddenly detached from a virtual server and deactivated.

Impact

Inactive policy is synced to the peer, resulting in ASM being unassigned from the Virtual Server.

Conditions

-- sync-only device group. -- ASM sync enabled. -- A policy is used on device ASM-A (attached to virtual server/device group). -- The same policy is not used on device ASM-B (not attached to virtual server/device group).

Workaround

To prevent Policy Sweeper from deactivating any ASM policy, create a non-functioning device group and attach the unused ASM policies to that device group.

Fix Information

None

Behavior Change