Bug ID 670804: Hardware syncookies, verified-accept, and OneConnect can result in 'verify_accept' assert in server-side TCP

Last Modified: Sep 13, 2023

Affected Product(s):
BIG-IP LTM(all modules)

Known Affected Versions:
11.5.4, 11.5.5, 11.6.0, 11.6.1, 11.6.2, 11.6.3, 11.6.3.1, 12.0.0, 12.0.0 HF1, 12.1.0 HF1, 12.0.0 HF2, 12.1.0 HF2, 12.0.0 HF3, 12.0.0 HF4, 12.1.1 HF1, 12.1.1 HF2, 12.1.2 HF1, 12.1.2 HF2, 12.1.0, 12.1.1, 12.1.2, 12.1.3, 12.1.3.1, 12.1.3.2, 12.1.3.3, 12.1.3.4, 12.1.3.5, 13.0.0, 13.0.0 HF1, 13.0.0 HF2, 13.0.0 HF3, 13.0.1

Fixed In:
12.1.3.6, 11.6.3.2, 11.5.6

Opened: Jun 23, 2017

Severity: 2-Critical

Related Article: K03163260

Symptoms

The system experiences a 'verify_accept' assert in server-side TCP.

Impact

Traffic disrupted while TMM restarts.

Conditions

-- Verified Accept enabled in TCP profile. -- Hardware syncookies enabled. -- OneConnect profile on virtual servers. -- Syncookie threshold crossed.

Workaround

Disable verified accept when used with OneConnect on a virtual server.

Fix Information

Verified accept, OneConnect, and hardware syncookies now work together correctly.

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips