Last Modified: Jun 28, 2025
Affected Product(s):
BIG-IP TMOS
Known Affected Versions:
15.1.3.1, 15.1.4, 15.1.4.1, 15.1.5, 15.1.5.1, 15.1.6, 15.1.6.1, 15.1.7, 15.1.8, 15.1.8.1, 15.1.8.2, 15.1.9, 15.1.9.1, 15.1.10, 15.1.10.2, 15.1.10.3, 15.1.10.4, 15.1.10.5, 15.1.10.6, 16.1.3, 16.1.3.1, 16.1.3.2, 16.1.3.3, 16.1.3.4, 16.1.3.5, 16.1.4, 16.1.4.1, 16.1.4.2, 16.1.4.3, 16.1.5, 16.1.5.1, 16.1.5.2, 16.1.6, 17.1.0, 17.1.0.1, 17.1.0.2, 17.1.0.3, 17.1.1, 17.1.1.1, 17.1.1.2, 17.1.1.3, 17.1.1.4, 17.1.2, 17.1.2.1, 17.1.2.2
Opened: May 11, 2023 Severity: 3-Major
When a pool member is detected down, the standby system holds a mirrored connection until the TCP profile idle-timeout expires even when the FIN packet is properly mirrored to the Standby system from the Active system. The Active peer, on the other hand, properly closes the connection after the 4-way closure.
Mirrored connection remains on the Standby system until the idle timeout expires
- Connection mirroring is enabled on a virtual server - Pool member status changes to unavailable on the standby before it becomes active (i.e., pool member monitor down occurs, or pool member is manually disabled) - HTTP(S) virtual server has an iRule which utilizes HTTP::close command, such as below. --------- ltm rule /Common/my_f5_rule { when HTTP_REQUEST { pool f5_pool } when HTTP_REQUEST_RELEASE { set pool "[LB::server pool]" set pool_name [substr $pool 8 ] set address "[LB::server addr]" set port "[LB::server port]" if {[LB::status pool $pool_name member $address $port] ne "up"} { clientside { HTTP::close } } } } ---------
Do not use iRule with HTTP::close if possible Alternatively use a smaller idle timeout and when manually shutting down a pool member, do so on the active first. Another alternative is to have this type of rule: --------- ltm rule /Common/my_f5_rule { when HTTP_REQUEST { pool f5_pool } when HTTP_REQUEST_RELEASE { set pool "[LB::server pool]" set pool_name [substr $pool 8 ] set address "[LB::server addr]" set port "[LB::server port]" if {[LB::status pool $pool_name member $address $port] ne "up"} { clientside { HTTP::close } if { [HA::status standby] } { HTTP::header insert "X-a" "dn" } } } } ---------
None