Bug ID 1190765: VelOS | Zone Base DDOS | Aggregation, BD | Seeing Entries in sPVA Registers are not getting reset once the attack is completed

Last Modified: Mar 30, 2024

Affected Product(s):
BIG-IP AFM(all modules)

Known Affected Versions:
17.1.0, 17.1.0.1, 17.1.0.2, 17.1.0.3

Fixed In:
17.1.1

Opened: Nov 19, 2022

Severity: 3-Major

Symptoms

In VELOS platform, the ideal timeout for HW entries is 5 mins(Hw eviction timeout). However, when you delete the VS/Zone configuration it will initiate the eviction immediately(Software eviction). In this case, the eviction does not happen as expected and causes the entry to continue to stay at sPVA for some time.

Impact

This issue causes the sPVA entries to stay for 5 minutes(Ideal eviction timeout) even after the Corresponding Zone configuration is deleted.

Conditions

This issue happens when we configure Zone based DDOS with Aggregation or BD in VELOS platform.

Workaround

Not available

Fix Information

The issue is with handling software eviction cases in the Zone scenario. The code is updated to handle the software eviction in a similar way as the virtual server scenario.

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips