Bug ID 680838: IKEv2 able to fail assert for GETSPI_DONE when phase-one SA appears not to be initiator

Last Modified: Oct 16, 2023

Affected Product(s):
BIG-IP TMOS(all modules)

Known Affected Versions:
11.6.1, 11.6.2, 11.6.3,,,,, 11.6.4, 11.6.5,,,, 12.1.2, 12.1.3,,,,,, 13.0.0, 13.0.0 HF1, 13.0.0 HF2, 13.0.0 HF3, 13.0.1, 13.1.0,,,,,,,,, 13.1.1,,

Fixed In:

Opened: Aug 29, 2017

Severity: 3-Major


A tmm restart and corefile can occur in rare cases while negotiating an IKEv2 IPsec tunnel. A child_sa managed to process GETSPI_DONE once in the IDLING state, where the ike_sa was expected to be the initiator, but it appeared not to be -- failing an assert.


Traffic disrupted while tmm restarts.


The BIG-IP is negotiating an IPsec tunnel as the Initiator, but an unexpected state change associated with being the Responder occurs.



Fix Information

TMM will no longer restart due to assertion failure.

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips