For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Kevin_Davies_40's avatar
Kevin_Davies_40
Icon for Nacreous rankNacreous
Oct 25, 2015

F5 BIGIP VE Traffic exceeds %75

I am seeing some strange behaviour from my virtual edition running under VMware ESXi. This device is not even in production and yet I am getting warning messages like the following. We are just doing...
Kevin_Davies_40's avatar
Kevin_Davies_40
Icon for Nacreous rankNacreous
Nov 13, 2015

We have discovered that Promiscuous mode had been set to Accept on all vSwitches under ESXi. This effectively means they act as hubs and not switches. They copy any traffic they see to all members of the port group. The F5 was receiving traffic not only for it but every single server on any VLAN's to which it was connected. Every other server was seeing the traffic as well. It would have been placing quite a bit of network load on customer machines.

 

  • Kevin_Davies_40's avatar
    Kevin_Davies_40
    Icon for Nacreous rankNacreous
    Nov 13, 2015
    The next change window Promiscuous mode was set to Reject and the F5 problem dissappeared. They re-enabled it some time later concerned it it had caused issues but this turned out not to be the case. It was turned off again. Why is unsolicited traffic arriving at the F5 being treated as licensed traffic? It's through traffic that should be considered by the licensing, not anything arriving at the interface which appeared to be the case. I raised this as an issue with F5. More diagnosis information was provided and it was escalated.