Last Modified: Apr 28, 2025
Affected Product(s):
BIG-IP LTM
Known Affected Versions:
11.3.0, 11.4.0, 11.4.1, 11.5.0, 11.5.1, 11.5.1 HF1, 11.5.1 HF2, 11.5.1 HF3, 11.5.1 HF4, 11.5.1 HF5, 11.5.1 HF6, 11.5.1 HF7, 11.5.1 HF8, 11.5.1 HF9, 11.5.1 HF10, 11.5.1 HF11, 11.5.2, 11.5.2 HF1, 11.5.3, 11.5.3 HF1, 11.5.3 HF2, 11.5.4, 11.5.4 HF1, 11.5.4 HF2, 11.5.4 HF3, 11.5.4 HF4, 11.5.5, 11.5.6, 11.5.7, 11.5.8, 11.5.9, 11.5.10, 11.6.0, 11.6.0 HF1, 11.6.0 HF2, 11.6.0 HF3, 11.6.0 HF4, 11.6.0 HF5, 11.6.0 HF6, 11.6.0 HF7, 11.6.0 HF8, 11.6.1, 11.6.1 HF1, 11.6.1 HF2, 11.6.2, 11.6.2 HF1, 11.6.3, 11.6.3.1, 11.6.3.2, 11.6.3.3, 11.6.3.4, 11.6.4, 11.6.5, 11.6.5.1, 11.6.5.2, 11.6.5.3, 12.0.0, 12.0.0 HF1, 12.0.0 HF2
Fixed In:
12.1.0, 12.0.0 HF3, 11.4.1 HF9, 11.3.0 HF9
Opened: Jan 03, 2014 Severity: 3-Major Related Article:
K15210
When using an iRule on a UDP virtual server, it is possible for a connection flow to get stuck and remain allocated until it times out. The connection flow will appear via the tmsh (using "tmsh sys conn show") but will no longer pass packets. As new packets arrive, the flow timeout will be extended causing an outage.
Incoming packets matching the stuck connection are dropped.
The connection flow must be aborted (e.g. ICMP/Reachable received from serverside) while the iRule is parked due to an asynchronous command.
The error can only be cleared if the connection is allowed to timeout or the tmm is restarted.
Aborted UDP connections with parked iRules will be cleaned up normally and no longer match incoming packets.