Bug ID 713707: ix600 platforms will now have DoS Enforcement in Software Mode enabled automatically

Last Modified: Jan 29, 2019

Bug Tracker

Affected Product:  See more info
BIG-IP AFM(all modules)

Known Affected Versions:
12.1.0, 12.1.0 HF1, 12.1.0 HF2, 12.1.1, 12.1.1 HF1, 12.1.1 HF2, 12.1.2, 12.1.2 HF1, 12.1.2 HF2, 12.1.3, 12.1.3.1, 12.1.3.2, 12.1.3.3, 12.1.3.4, 12.1.3.5, 12.1.3.6, 12.1.3.7, 12.1.4, 13.0.0, 13.0.0 HF1, 13.0.0 HF2, 13.0.0 HF3, 13.0.1, 13.1.0, 13.1.0.1, 13.1.0.2, 13.1.0.3, 13.1.0.4, 13.1.0.5, 13.1.0.6, 13.1.0.7, 13.1.0.8, 13.1.1, 13.1.1.1, 13.1.1.2, 13.1.1.3, 13.1.1.4

Fixed In:
14.1.0, 14.0.0

Opened: Apr 05, 2018
Severity: 3-Major

Symptoms

The sys db variable dos.forceswdos controls DoS enforcement in software mode. ix600 platforms with TurboFlex licenses restrict DoS enforcement to software mode. The default for dos.forceswdos is 'disable', so DoS enforcement does not work on those platforms until this setting is changed to 'enabled'.

Impact

The dos.forceswdos db variable is set to false by default in the configuration, meaning that DoS works in Hardware mode on capable hardware platforms. However, due to licensing restrictions for ix600 platforms, DoS enforcement can run only in software mode. For ix600, if the dos.forceswdos setting is not changed to true, DoS enforcement does not work at all.

Conditions

-- ix600 platforms, as detailed in the following list: + BIG-IP i2600 + BIG-IP i4600 + BIG-IP i5600 + BIG-IP i7600 + BIG-IP i10600 + BIG-IP i12600 + BIG-IP i15600 + BIG-IP i11600 -- TurboFlex license. -- Using software versions 13.1.x-14.0.0.

Workaround

Manually set the sys db variable dos.forceswdos to true to enable DoS enforcement in software mode. Note: In its default value 'false', DoS enforcement is in hardware mode, which is not supported by ix600. If you upgrade the license from ix600 to ix800, this db variable is still set to 'true', meaning DoS is operating in software mode. To run DoS in hardware mode on ix800 platforms, set the db variable to false.

Fix Information

This change supports licensing behavior on ix600 platforms with Turboflex licenses, and enables DoS enforcement in supported software mode automatically (sets db variable to true). To have DoS enforcement in hardware mode requires ix800 or higher licenses, whenever available, and requires that the sys db variable dos.forceswdos be set to false.

Behavior Change