Last Modified: Jul 28, 2026
Affected Product(s):
BIG-IP APM
Fixed In:
21.1.0.1, 17.5.1.8, 17.1.3.4
Opened: Jul 31, 2025 Severity: 2-Critical
APM logins intermittently fail when the Machine Certificate check POST payload exceeds the MSS during login. The client-side connection acknowledges all POSTed data; however, the server-side gets stuck, and no connection flow is established.
On BIG-IP APM systems configured with a Machine Certificate Authentication agent, POST requests for the machine certificate check may fail to receive an acknowledgment (ACK) or HTTP response from APM. As a result, the client waits for approximately 20 seconds before resetting the connection.
The access policy includes a Machine Certificate Authentication agent.
tmsh modify ltm profile tcp <profile_name> mss 1400
Use the following tmsh command to modify the MSS value of a TCP profile to 1400: "tmsh modify ltm profile tcp <profile_name> mss 1400"