Last Modified: Apr 28, 2025
Affected Product(s):
BIG-IP All
Known Affected Versions:
17.1.0, 17.1.0.1, 17.1.0.2, 17.1.0.3, 17.1.1, 17.1.1.1, 17.1.1.2, 17.1.1.3, 17.1.1.4, 17.1.2, 17.1.2.1
Opened: Sep 07, 2022 Severity: 3-Major
AP cookie might not be added from the client browser for the initial request towards virtual server when ASM policy is being used.
Very first client request towards AP endpoint might get blocked due to missing AP cookie.
1. ASM policy is configured. 2. AP and AI profile is created with a Protected Endpoint that has Enforcement Mode configured to Mitigate. 3. The Mitigate Missing Cookie field is enabled on the protected endpoint. 4. AP and AI profile is attached to virtual server.
Disable 'Mitigate Missing Cookie' for the particular endpoint.
None