Last Modified: Jul 12, 2023
Affected Product(s):
BIG-IP PEM
Known Affected Versions:
14.0.0, 14.0.0.1, 14.0.0.2, 14.0.0.3, 14.0.0.4, 14.0.0.5, 14.0.1, 14.0.1.1
Fixed In:
14.1.0
Opened: Sep 14, 2017 Severity: 3-Major
This can occur with an unknown subscriber policy that doesn't have classification filters. Since applying classification may impede performance significantly, there is an optimization rule that if the first policy applied to a flow doesn't have classification filters, classification for that particular flow will be optimized out. When this occurs, flows will remain unclassified for their lifetime. As a result of remaining unclassified, if PEM pushes some classification match policies to this flow, the policies will not get applied.
In this scenario, classification match policies may not be applied to existing flows.
Global/unknown policies doesn't include any classification filter.
A simple workaround would be, put a Any/Any classification filter in global or unknown subscriber policy to enabled classification for flow at its early stage.
None