Last Modified: Oct 16, 2023
Affected Product(s):
BIG-IP vCMP
Known Affected Versions:
11.5.1 HF1, 11.5.1 HF2, 11.5.1 HF3, 11.5.1 HF4, 11.5.1 HF5, 11.5.1 HF6, 11.5.1 HF7, 11.5.1 HF8, 11.5.1 HF9, 11.5.1 HF10, 11.5.1 HF11, 11.5.2 HF1, 11.5.3 HF1, 11.5.3 HF2, 11.5.4 HF1, 11.5.4 HF2, 11.5.4 HF3, 11.5.4 HF4, 11.5.0, 11.5.1, 11.5.2, 11.5.3, 11.6.0, 11.6.1, 11.6.2, 11.6.3, 11.6.3.1, 11.6.3.2, 11.6.3.3, 11.6.3.4, 11.6.4, 11.6.5, 11.6.5.1, 11.6.5.2, 11.6.5.3
Fixed In:
12.1.0, 11.6.0 HF6, 11.5.4
Opened: Mar 26, 2015 Severity: 3-Major Related Article:
K05364212
A BIG-IP system may not clear a crypto-failsafe condition after recovering from a cryptographic hardware lockup. As a result of this issue, you may encounter one or more of the following symptoms: The output of the tmsh show sys ha-status command appears similar to the following example: ------------------------------------------------------------------------------- Sys::HA Status Slot Feature Key Action Fail ------------------------------------------------------------------------------- 1 crypto-failsafe cn-crypto-11 failover yes In the /var/log/ltm file, you observe messages similar to the following examples: -- crit tmm[9184]: 01010025:2: Device error: crypto codec cn-crypto-0 queue is stuck. -- notice sod[8874]: 01140029:5: HA crypto_failsafe_t cn-crypto-0 fails action is failover.
If the crypto-failsafe action is to fail over, you will be unable to activate the BIG-IP system even after the cryptographic hardware recovers.
This issue occurs when all of the following conditions are met: -- Your BIG-IP platform uses internal cryptographic hardware (such as, for vCMP, a Nitrox Lite SSL hardware accelerator card) or external cryptographic hardware (such as SafeNet/Thales hardware security module (HSM)). -- The cryptographic hardware fails and subsequently recovers.
To restore the crypto-failsafe high availability (HA) fail status, restart tmm by issuing the following command: bigstart restart tmm. Note: On VIPRION platforms, this command must be run on the appropriate blade.
The system now allows the crypto device to be restored and not keep the crypto-failsafe HA status in the fail state.