Symptoms

This can occur with an unknown subscriber policy that doesn't have classification filters. Since applying classification may impede performance significantly, there is an optimization rule that if the first policy applied to a flow doesn't have classification filters, classification for that particular flow will be optimized out. When this occurs, flows will remain unclassified for their lifetime. As a result of remaining unclassified, if PEM pushes some classification match policies to this flow, the policies will not get applied.

Impact

In this scenario, classification match policies may not be applied to existing flows.

Conditions

Global/unknown policies doesn't include any classification filter.

Workaround

A simple workaround would be, put a Any/Any classification filter in global or unknown subscriber policy to enabled classification for flow at its early stage.

Fix Information

None

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips