Last Modified: Aug 19, 2026
Affected Product(s):
BIG-IP AFM
Known Affected Versions:
11.5.1, 11.5.1 hf1, 11.5.1 hf2, 11.5.1 hf3, 11.5.1 hf4, 11.5.1 hf5, 11.5.1 hf6, 11.5.1 hf7, 11.5.1 hf8, 11.5.1 hf9, 11.5.1 hf10, 11.5.1 hf11, 11.5.2, 11.5.2 hf1, 11.5.3, 11.5.3 hf1, 11.5.3 hf2, 11.5.4, 11.5.4 hf1, 11.5.4 hf2, 11.5.4 hf3, 11.5.4 hf4, 11.5.5, 11.5.6, 11.5.7, 11.5.8, 11.5.9, 11.5.10
Fixed In:
11.6.0
Opened: May 09, 2014 Severity: 3-Major
AFM performs ACL and IP Intelligence match even if first TCP packet of a new flow is (for example) FIN (or RST) which will eventually be dropped by LTM. This causes confusion if the packet matches an AFM rule with action = Accept (and logging enabled) giving the impression that the packet was allowed by the BIG-IP system.
If AFM performs ACL/IP Intelligence checks on traffic as described and matches a rule with action set to Allow (or Allow final) and logging is enabled, it may give an incorrect impression that AFM is allowing these packets through the BIG-IP system.
AFM is enabled and configured with firewall rules and/or IP Intelligence policy. In case of TCP, AFM always performs ACL and/or IP Intelligence checks even if the first packet is not SYN (or an ACK when syncookie is enabled) e.g., FIN or RST. These packets are always dropped in LTM (if tcp_loose_initiation is disabled).
None.
AFM previously matched firewall and IP Intelligence rules against the first TCP packet of a new flow, even if that packet would later be dropped by LTM, for example a FIN or RST packet. AFM no longer matches these packets, and LTM continues to drop them.