Bug ID 773229: Replacing a virtual server's FastL4 profile can cause traffic to fail in specific circumstances

Last Modified: Sep 14, 2023

Affected Product(s):
BIG-IP LTM(all modules)

Known Affected Versions:
14.1.0, 14.1.0.1, 14.1.0.2, 14.1.0.3, 14.1.0.5, 14.1.0.6, 14.1.2, 14.1.2.1, 14.1.2.2, 14.1.2.3, 14.1.2.4, 14.1.2.5, 14.1.2.6, 14.1.2.7, 14.1.2.8, 14.1.3, 14.1.3.1, 14.1.4, 14.1.4.1, 14.1.4.2, 14.1.4.3, 14.1.4.4, 14.1.4.5, 14.1.4.6, 14.1.5, 14.1.5.1, 14.1.5.2, 14.1.5.3, 14.1.5.4, 14.1.5.6, 15.0.0, 15.0.1, 15.0.1.1, 15.0.1.2, 15.0.1.3, 15.0.1.4

Fixed In:
15.1.0

Opened: Apr 16, 2019

Severity: 3-Major

Symptoms

If a virtual server starts with a FastL4 profile with an idle_timeout of zero, and this profile is then replaced with one that has a non-zero idle_timeout, it can cause traffic to fail with a 'No flow found for ACK' error in the RST packet (if DB variable tm.rstcause.pkt is enabled) or logged (if DB variable tm.rstcause.log is enabled).

Impact

Traffic no longer passes through the virtual server properly.

Conditions

-- There is a virtual server configured with a FastL4 profile with an idle-timeout setting of zero ('immediate'). -- The FastL4 profile is replaced with one that has a non-zero idle-timeout setting.

Workaround

To avoid this issue, if you need to change the FastL4 profile in this manner, delete and recreate the entire virtual server rather than replace the profile. Impact of workaround: This results in a traffic disruption for that virtual server. If the issue has already occurred, the only way to recover is to restart TMM Impact of workaround: This also results in a traffic disruption, this time a general one.

Fix Information

Replacing a virtual server's FastL4 profile no longer causes traffic to fail in this scenario.

Behavior Change

Guides & references

K10134038: F5 Bug Tracker Filter Names and Tips