Bug ID 691224: Fragmented SSL Client Hello message do not get properly reassembled when SSL Persistence is enabled

Last Modified: Oct 06, 2020

Bug Tracker

Affected Product:  See more info
BIG-IP LTM, TMOS(all modules)

Known Affected Versions:
12.1.0, 12.1.0 HF1, 12.1.0 HF2, 12.1.1, 12.1.1 HF1, 12.1.1 HF2, 12.1.2, 12.1.2 HF1, 12.1.2 HF2, 12.1.3,,,,,,, 13.0.0, 13.0.0 HF1, 13.0.0 HF2, 13.0.0 HF3, 13.0.1, 13.1.0,,,,,,,,, 13.1.1

Fixed In:

Opened: Oct 27, 2017
Severity: 3-Major
Related AskF5 Article:


Node Server rejects received-and-incomplete ClientHello message and connection terminates.


With Session Persistence enabled -- The parser fails to reassemble fragmented ClientHello messages prior to passing it on to the backend server. -- As a result, the backend server responds as if it has received an incomplete ClientHello message, rejects the handshake, and terminates the connection.


This occurs when the following conditions are met: -- SSL Persistence is enabled. -- There is no ClientSSL and ServerSSL profile. -- The BIG-IP device receives fragments of a ClientHello message (typically, 11 bytes each) from an SSL front-end client.


The issue disappears when SSL Persistence is disabled.

Fix Information


Behavior Change