Last Modified: Oct 07, 2023
Affected Product(s):
BIG-IP Install/Upgrade
Fixed In:
14.0.0, 13.1.0
Opened: Sep 08, 2017 Severity: 1-Blocking Related Article:
K35448413
There was an LTM Policy with 'requires {ssl-persistence}' that was found and fixed during v13.1.0 project development. Note: Because this issue was fixed in v13.1.0 before release, you will not encounter this issue; this release note is included to track the Behavior Change.
Configuration load fails. Note: This occurs only in internal releases and was never included in an external release.
LTM policy that has 'requires {ssl-persistence}'.
Change the configuration and load it manually. - If policy is active for the ssl-client-hello event, change ssl-persistence to client-ssl. - If policy is active for the ssl-server-handshake event, change ssl-persistence to server-ssl. - If policy is active for both ssl-client-hello and ssl-server-handshake events, change ssl-persistence to client-ssl - server-ssl.
13.1.0 configurations with policies that 'require {ssl-persistence}' are migrated successfully.
Beginning in v13.1.0, LTM Policy supports many more framework events than before, and certain 'requires' aspects had to be replaced. In previous releases, ssl-persistence was used for client-side and server-side events. Now policies that contain client SSL or server SSL will have specific 'requires' aspect for that side. Here are some examples of how the values changed: - If policy is active for the ssl-client-hello event, ssl-persistence should be client-ssl. - If policy is active for the ssl-server-handshake event, ssl-persistence should be server-ssl. - If policy is active for both ssl-client-hello and ssl-server-handshake events, ssl-persistence should be client-ssl - server-ssl. When updating LTM policies that already contain these values, the system changes them as follows: -- The system changes the 'requires' stanza to client-ssl, if policy condition or action references these events: - ssl-client-hello - ssl-client-serverhello-send -- The system changes the 'requires' stanza to server-ssl, if policy condition or action references these events: - ssl-server-hello - ssl-server-handshake -- The system changes the 'requires' stanza to reflect both client-ssl and server-ssl, if the policy condition or action references both a client and a server event: - client-ssl server-ssl