Bug ID 1968237: Configuration fails to load post upgrade due to invalid DoS signature predicate 'ip flags'

Last Modified: Sep 01, 2025

Affected Product(s):
BIG-IP AFM, Install/Upgrade(all modules)

Known Affected Versions:
17.1.2.2

Opened: Jun 18, 2025

Severity: 3-Major

Symptoms

After upgrading from v16.1.4.1 to v17.1.2.2, both device slots remain in an offline state. Configuration fails to load due to a DoS signature issue (/Common/dos_Sig). The system throws the following error: >01071cc8:3: Dos Signature (/Common/dos-common/Sig_69253_39_1737834503): Arg (Fragmented) for predicate 'IP Flags' is invalid for DNS/NETWORK signature.

Impact

Device will be in offline state Post Upgrade

Conditions

-- DoS signatures are configured using persistence-based predicates such as ‘IP Flags’. -- Configuration executed via tmsh commands as outlined in the documentation: https://clouddocs.f5.com/cli/tmsh-reference/v15/modules/security/security_dos_dos-signature.html -- This can be configured via the GUI as well -- Issue occurs when upgrading from 16.1.4.1 to 17.1.2.2.

Workaround

None

Fix Information

None

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips