Last Modified: Aug 19, 2026
Affected Product(s):
BIG-IP AFM
Known Affected Versions:
11.5.1, 11.5.1 hf1, 11.5.1 hf2, 11.5.1 hf3, 11.5.1 hf4, 11.5.1 hf5, 11.5.1 hf6, 11.5.1 hf7, 11.5.1 hf8, 11.5.1 hf9, 11.5.1 hf10, 11.5.1 hf11, 11.5.2, 11.5.2 hf1, 11.5.3, 11.5.3 hf1, 11.5.3 hf2, 11.5.4, 11.5.4 hf1, 11.5.4 hf2, 11.5.4 hf3, 11.5.4 hf4, 11.5.5, 11.5.6, 11.5.7, 11.5.8, 11.5.9, 11.5.10
Fixed In:
11.6.0
Opened: Dec 16, 2013 Severity: 3-Major Related Article:
K03037436
Sweeper incorrectly reaps a flow that matches a rule in either global or corresponding route-domain classifier with action = Accept Decisive in the scenario when this particular classifier did not change (and there are no matching rules in the corresponding VIP/SelfIP classifier and VIP/SelfIP default action is set to Drop or Reject).
This incorrect behavior would result in legitimate existing connections being dropped after a firewall policy configuration change (that are supposed to be accepted in firewall configuration).
AFM is enabled and configured in Default Deny mode. A flow matches a global (or route domain) rule with action set to Accept Decisively at time of flow creation. However, this flow also does not match any VIP/SelfIP rule Later, a firewall policy change triggers Kill-on-the-Fly sweeper to re-evaluate all the existing connections against new firewall configuration that results in this undesired behavior.
AFM Kill-on-the-fly feature (in sweeper) can be disabled using the db variable - tm.sweeper.flow.acl
Sweeper would no longer reap a flow that would have matched a rule in either global or corresponding route-domain classifier with action = Accept Decisive in the scenario when this particular classifier did not change (and there are no matching rules in the corresponding VIP/SelfIP classifier and VIP/SelfIP default action is set to Drop or Reject).