Last Modified: Sep 13, 2023
Affected Product(s):
BIG-IP Install/Upgrade
Known Affected Versions:
11.5.0, 11.5.1, 11.5.2, 11.5.3, 11.5.4, 11.5.5, 11.5.6, 11.5.7, 11.5.8, 11.5.9, 11.5.10, 11.6.0, 11.6.1, 11.6.2, 11.6.3, 11.6.3.1, 11.6.3.2, 11.6.3.3, 11.6.3.4, 11.6.4, 11.6.5, 11.6.5.1, 11.6.5.2, 11.6.5.3, 12.0.0, 12.0.0 HF1, 12.1.0 HF1, 12.0.0 HF2, 12.1.0 HF2, 12.0.0 HF3, 12.0.0 HF4, 12.1.1 HF1, 12.1.1 HF2, 12.1.2 HF1, 12.1.2 HF2, 12.1.0, 12.1.1, 12.1.2, 12.1.3, 12.1.3.1, 12.1.3.2, 12.1.3.3, 12.1.3.4, 12.1.3.5, 12.1.3.6, 12.1.3.7, 12.1.4, 12.1.4.1, 12.1.5, 12.1.5.1, 12.1.5.2, 12.1.5.3, 12.1.6, 13.0.0, 13.0.0 HF1, 13.0.0 HF2, 13.0.0 HF3, 13.0.1
Fixed In:
13.1.0
Opened: Jul 03, 2017 Severity: 3-Major Related Article:
K22031410
If an IPsec traffic-selector object references the default-ipsec-policy object, an upgrade to a newer version of BIG-IP software might fail during the config load stage with error logs similar to the following: err mcpd[#]: 01070734:3: Configuration error: IPsec policy /Common/default-ipsec-policy does not exist. emerg load_config_files: "/usr/bin/tmsh -n -g load sys config partitions all base " - failed. -- 01070734:3: Configuration error: IPsec policy /Common/default-ipsec-policy does not exist. Unexpected Error: Loading configuration process failed.
Unable to load configuration.
-- IPsec traffic-selector object references the default-ipsec-policy object. -- configuration is loaded from config files, such as: + Performing an upgrade to a later version of BIG-IP software. + Loading configuration from a file (tmsh load sys config file). + Forcing a configuration load from files, as described in K13030: Forcing the mcpd process to reload the BIG-IP configuration (https://support.f5.com/csp/article/K13030).
To work around this problem, use one of the following preventative actions: -- Before upgrading, create a custom ipsec-policy (with default values) instead of default-ipsec-policy, and reference that IPsec policy in the traffic-selector. -- Before upgrading, delete the traffic-selector attached to any default objects. To recover from a failed upgrade or config load, use one of the following recovery actions, then restart BIG-IP (bigstart restart): -- Edit the /config/BIG-IP_base.conf file, add a custom ipsec-policy with default values, and update the traffic-selector configuration to use this ipsec-policy: net ipsec ipsec-policy /Common/my-ipsec-policy { } net ipsec traffic-selector /Common/iFail { ... ipsec-policy /Common/my-ipsec-policy ... -- Edit the /config/BIG-IP_base.conf file, and delete the traffic-selector configuration that references the default-ipsec-policy.
Now, the IPsec traffic-selector can reference default-ipsec-policy without configuration load errors after upgrade.