For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

hung_105573's avatar
hung_105573
Icon for Nimbostratus rankNimbostratus
Oct 02, 2012

BigIP F5 ( LC , LTM) WAS CRASH

Hi all   I'm new F5 , at the moment, my F5 was crash after running 2 days . I can not access the F5 via interface management and led status is yellow flicker     I didn't know why .   ...
config
design
hoolio's avatar
hoolio
Icon for Cirrostratus rankCirrostratus
Oct 05, 2012
Hi Hung,

 

 

If you suspect that your BIG-IP was compromised, I would do as WLB suggested and prevent any access to HTTPS and SSH from untrusted networks. It's then critical to reinstall the OS on all partitions to ensure the units are no longer suspect. If you have a known good UCS backup from before the attack, you can restore the configuration from there. Else, you could save the current config and load select portions (bigip.conf/bigip_base.conf) after reinstalling the OS and hand checking the config is still valid.

 

 

Make sure that after you reinstall, you either upgrade to a current version or manually protect the units per:

 

 

SOL13600 - SSH vulnerability CVE-2012-1493

 

https://support.f5.com/kb/en-us/solutions/public/13000/600/sol13600.html

 

 

Aaron