Symptoms

While closing the tunnel, it starts closing the SVPN process, and before closing, it needs to restore the route table similar to the route entries before VPN establishment. If number of route entries is greater than normal, it takes longer than the set timeout. If a timeout is triggered, then the cleanup process stops the SVPN process, which is the process of restoring the route entries. Hence, all the route entries are not restored properly.

Impact

As route entries are not restored properly in the routing table, some of traffic cannot reach to the destination.

Conditions

There were more route entries than normally expected.

Workaround

Configure a smaller number of route entries

Fix Information

During cleanup, before closing the SVPN process forcefully, EdgeClient polls the status of the SVPN closure, sometimes with an interval of 500 miliseconds. If it still exists, then it needs a cleanup. But in this case SVPN will closed automatically once all route entries are restored.

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips