Bug ID 676897: IPsec keeps failing to reconnect

Last Modified: Oct 16, 2023

Affected Product(s):
BIG-IP TMOS(all modules)

Known Affected Versions:
12.0.0, 12.0.0 HF1, 12.1.0 HF1, 12.0.0 HF2, 12.1.0 HF2, 12.0.0 HF3, 12.0.0 HF4, 12.1.1 HF1, 12.1.1 HF2, 12.1.2 HF1, 12.1.2 HF2, 12.1.0, 12.1.1, 12.1.2, 12.1.3,,,,,, 13.0.0, 13.0.0 HF1, 13.0.0 HF2, 13.0.0 HF3, 13.0.1, 13.1.0,,,,,,,,, 13.1.1,,

Fixed In:

Opened: Aug 03, 2017

Severity: 3-Major

Related Article: K25082113


When an IPsec Security Association (SA) does not exist on a remote IPsec peer, the BIG-IP system might be sent an INVALID-SPI notification, but might not delete the SA. The IPsec tunnel might not be renegotiated until the deleted SAs on the BIG-IP system are removed manually or age out.


IPsec tunnel appears to be up but suffers a connectivity loss until the SPIs are manually deleted or age out.


-- The BIG-IP system and remote peer communicate over a lossy network. -- The remote peer prematurely deletes an IPsec SA.


Manually delete the SA.

Fix Information

This release corrects this issue.

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips