Technical Forum topics

Recursive DNS resolution (DoT), allowing queries UDP/53 while BIG-IP forwards over TCP/853

Rolandjt — Tue, 07 Jul 2026 16:59:01 GMT

How can I configure BIG-IP to perform recursive DNS resolution over DNS-over-TLS (DoT), allowing standard DNS clients to send queries over UDP/53 while BIG-IP forwards those queries securely over TCP/853?

It is possible without a external resolver ?

Azure application gateway as backend pool of F5 VS

Sanal_Babu — Fri, 10 Jul 2026 09:34:55 GMT

Hi All,

I am facing an issue with the below setup and need some guidance.

Architecture:

Internet Client → F5 VIP → Azure Application Gateway (Internal IP) → Backend Application

The requirement is to publish the application through F5, where the backend pool member is the internal IP address of an Azure Application Gateway.

Issue:

If I configure the F5 pool health monitor as TCP, the pool member becomes UP.

If I configure the health monitor as HTTP or HTTPS, the pool member remains DOWN.

Accessing the Azure Application Gateway directly (using its internal IP and required hostname) works successfully.

The issue only happens when traffic passes through F5.

SSL/TLS Configuration:

SSL certificate is configured on F5 VIP.

The same application certificate is also configured on Azure Application Gateway listener.

Hostname used by the application

We have already tried server SNI configuration on F5 and multiple SSL profile settings, but the issue is not resolved.

Troubleshooting already performed:

Verified Azure Application Gateway backend configuration.

Confirmed Application Gateway listener and certificate are working when accessed directly.

Tested F5 TCP health monitor successfully.

Tested HTTP/HTTPS monitors from F5, but they fail.

Raised a case with F5, and they advised checking from the Azure Application Gateway side.

Appreciate your support.

APM Portal access and ECMAScript compatibility

Alex_Ng — Thu, 09 Jul 2026 03:33:36 GMT

I notice that ECMAScript (ES13) is supported as stated in version 21.1 release note

https://techdocs.f5.com/en-us/bigip-21-1-0/big-ip-release-notes/big-ip-new-features.html#portal-access-ecmascript-es13-support-for-modern-javascript-applications

As I know, latest version in 17.1 can also use the latest cache-fm-Modern.js file. Does it imply that latest version in 17.1, say 17.1.3.2, also support ECMAScript (ES13)?

https://my.f5.com/manage/s/article/K000148786

AWAF Access Profile, missing a configurable JWKS URL - RFE

amolari — Wed, 08 Jul 2026 17:39:07 GMT

The AWAF Access Profile functionality (introduced in 17.5) is potentially a great feature, but IMHO it (still) lacks an essential function in the "Verify Digital Signature" part: an automatic refresh/rotation interval to periodically fetch and update the JWKS from a specified URL. Currently, it only supports the upload of a file containing the key. Not enough for a mature solution, which supports enterprise deployments (OIDC integrations with such as Entra ID, Okta, etc.)

Note: I do know that some experts here builded some automation to work around this lacking feature. Great stuff.

Anyway, as I though the effort for the F5 devs should not be huge (they have already some code doing that in their APM OIDC auto-discovery function), I've opened a support case/RFE and got one back =>

RFE ID2294753: AWAF Access profile Verify Digital Signature to support dynamic JWKS retrieval via a configurable URL endpoint

Don't hesitate to open a support case to get it bound to that RFE, the more we are the higher priority will be assigned to implement it (hopefully). 😀

Alexandre

APM OIDC debug logging is somehow verbose but not where it should - RFE

amolari — Wed, 08 Jul 2026 17:22:49 GMT

While I was configuring and testing an APM Access policy for an OIDC integration with Entra ID, I was seeing some backchannel errors logged (debug level) some HTTP error 400.
The whole logging is quite verbose, but here, not very useful:


[...]
OAuth Client: failed for server '/Common/entraid_test' using 'authorization_code' grant type (client_id=xxxxxxxxxxxxxx), error: HTTP error 400,

Session variable 'session.oauth.client./Common/entra_front_act_oauth_client_ag.errMsg' set to 'HTTP error 400, '

Session variable 'session.oauth.client./Common/entraid_test.errMsg' set to 'HTTP error 400, '

Session variable 'session.oauth.client.last.errMsg' set to 'HTTP error 400, '

So, tcpdump was required to see what exactly the error was in the returned JSON payload from Entra ID.

I've got a new RFE from F5 support =>
(Bug alias 2229965) [RFE] Add extra verbosity for the debug-level logging for OIDC backchannel connection

Don't hesitate to open a support case to get it bound to that RFE, the more we are the higher priority will be assigned to implement it (hopefully). 😀

Alexandre

PQC: a blindspot (logging) on BIG-IP - RFE

amolari — Wed, 08 Jul 2026 16:31:54 GMT

On BIG-IP it's currently not possible to log information such as proposed and negotiated Key Exchange Algorithm. No available iRule commands for that.

On the other hand, NGINX do offer the possible to log it ($ssl_curve/$ssl_curves variables).

I've got a RFE created for the following:

Provide new iRule commands in events CLIENTSSL_CLIENTHELLO and CLIENTSSL_HANDSHAKE that outputs the Key Exchange Algorithm:
- list of proposed (by the SSL client) Key Exchange Algorithms in CLIENTSSL_CLIENTHELLO
- negotiated Key Exchange Algorithms in CLIENTSSL_HANDSHAKE

RFE ID2347153 — "iRule command equivalent to NGINX's $ssl_curve for logging the negotiated KEM/DH group"

Don't hesitate to open a support case to bind it to that RFE, the more we are the higher priority will be assigned to implement it (hopefully). 😀

Alexandre

SSL & persistence configurations from qkview or UCS files

mtfeliciano — Wed, 08 Jul 2026 00:19:40 GMT

Is there any quick way to extract (into, for example, an Excel file) the following configuration details from qkview or UCS files?

1. list of SSL certificates, including:

- SSL certificate expiration status / dates

- which virtual servers or SSL profiles are using each SSL certificate

2. list of persistence configurations

How to safely purge logs on BIG-IP (disk usage high)

KriengsakL — Tue, 07 Jul 2026 15:58:29 GMT

Hi All,

I would like to ask for the best practice to purge/clean log files on BIG-IP system.

Current situation:

- Disk usage is getting high due to log files

- Logs located in /var/log (e.g. ltm, asm, audit, etc.)

Questions:

What is the recommended way to purge or rotate logs safely?
Can we manually delete logs under /var/log ?
Is there any tmsh command or utility tool to manage this?
How to configure log rotation properly?

Thanks in advance!

F5 rules for AWS WAF compatibility with the new WAF console

AKX — Tue, 07 Jul 2026 15:10:07 GMT

Once subscribed to the F5 rules for AWS WAF, I was redirected to the old/classic WAF console that we are not using, and I can't seem to find F5 rules in the new AWS WAF console. Is it not supported? Is there a plan / timeline to make it usable in the new console?

Local-Only in your browser BIG-IP Report Generator

bitwisecook — Mon, 06 Jul 2026 07:28:02 GMT

Leveraging my f5query engine and the Python interface to it, along with my Tcl-LSP Tcl/iRule compiler and analyser, I built a report generator. You can run it locally yourself, it's a single HTML file that embeds all the WASM to do the work, makes no requests to the outside world.

I don't have good lab devices to use for demo content anymore so I had to use some SCF files I found on GitHub for the demo.

Example Report

Report Generator - nothing is ever uploaded, there's no telemetry, the only external URL in it is in the footer pointing to my GitHub.

It should have somewhat decent print output.

If you have feature requests, bug reports, please open issues on GitHub

This work only exists in the rust branch and 2.x pre-releases if you're interested in the code.

APM) NA error "Configuration download failed"

RaNiAKeA — Fri, 03 Jul 2026 00:42:27 GMT

Hello everyone

My client is currently using APM version 7253; prior to the OS upgrade, they were using version 7247.

The setup involves an inline configuration with an SSL VA positioned upstream of the APM.

Communication between the client and the SSL VA uses TLS 1.3, while communication between the SSL VA and the APM uses TLS 1.2.

VPN connections worked normally when using version 7247, but an "NA error" appears after upgrading to version 7253.

Has there been any change in TLS-related behavior between version 7247 and 7253?

Alternatively, has anyone else encountered a similar issue?

F5 CIS applying iRule from one VirtualServer definition to another

reginaldobo — Thu, 02 Jul 2026 14:42:47 GMT

Hi everyone,

I am experiencing a strange behavior with F5 Container Ingress Services (CIS) where an iRule defined in one VirtualServer resource is being applied to a different VirtualServer on BIG-IP.

The setup:

I have two VirtualServer manifests sharing the same IP address and partition, but serving different ports — one for HTTPS (443) and one for HTTP (80).

The HTTP VirtualServer (cis-dev-80) has the iRule /Common/https-301-redirect explicitly defined, which is expected — it redirects HTTP traffic to HTTPS. I'm not using the parameter httpTraffic because I need the http status code 301 instead of 302.

The HTTPS VirtualServer (cis-dev-443) has no iRules defined in its manifest.

# cis-dev-443 — no iRules defined

spec:

virtualServer

HTTPSPort: 443

tlsProfileName:dev-tls-profile

...

# cis-dev-80 — iRule intentionally defined here only

spec:

virtualServerHTTPPort: 80

iRules: - /Common/https-301-redirect

...

The problem:

After CIS reconciles, BIG-IP shows the iRule /Common/https-301-redirect attached to both virtual servers — including cis-dev-443, which should not have it. This causes HTTPS traffic to be redirected back to HTTPS in a loop.

Questions:

Has anyone else encountered this behavior?

Does this needs a different configuration?

Any help or pointers to related issues or F5 support articles would be appreciated.

Environment:

CIS version: 2.20.3

AS3 version: 3.55.0

Kubernetes version: v1.22

Thanks in advance

Migration doubt

SuppEsp_AX — Thu, 02 Jul 2026 11:10:40 GMT

Scenario is: 4 serie i2600 forming sync-group GTM. Being two diferent cluster HA active/standby LTM. First ill change one pair and another day the another.

My idea for migrating an LTM/GTM pair from the iSeries platform to the rSeries platform is as follows:

We used same cables from i series and same names and IPs to do it easier to customer

First, I disconnect all the cables from the standby iSeries unit. The active iSeries unit will remain active in standalone mode.

Next, I connect the interfaces used for the synchronization and failover network from both iSeries appliances to the new rSeries appliances. The HA pair has already been configured on the new rSeries units, so one will be active and the other will be in standby.

Once the standby rSeries node is in place, I connect all the service cables to it. After all the service cables have been connected and I have verified that everything looks correct (ARP entries, pools, etc.), I proceed to run the bigip_add and gtm_add commands against the active iSeries node.

It is important to note that the iSeries and rSeries appliances will never form an HA cluster with each other.

After running both commands, I verify that everything is operating correctly before forcing the active iSeries node offline and allowing the rSeries node to become active.

If I face any issues while running the bigip_add or gtm_add commands, since the new rSeries nodes use the same hostnames and IP addresses as the previous iSeries appliances, I may need to remove the trusted certificates associated with the old appliances from the other BIG-IP devices before attempting the commands again.

Anything to keep in mind? or any potencial issie doing like that?? Would it be necessary or recommended to temporarily take the GTM cluster being migrated out of service, or is there no significant risk in keeping it operational?

Its my first GTM migration in a bit lost.

APM Policy Migration Between Standalone TMOS 17.1.3 Systems

paki — Tue, 30 Jun 2026 19:54:42 GMT

Hi everyone,

We're migrating a single production APM policy from an i4600 to an r4600 appliance. Both systems are running TMOS 17.1.3, and the new appliance will not be part of the existing DSC cluster.

We tried exporting/importing only the APM policy, but the import fails because referenced objects are missing on the target system. A full UCS restore would also migrate many unused objects that we don't want.

Is there a supported way to:

Analyze an APM policy and list all required dependencies before import?

Export/import only the APM Customization GUI (HTML/CSS/JavaScript templates)?

Migrate a single APM policy without restoring the entire APM configuration?

Any recommended best practices for this scenario would be appreciated.

Thanks in advanced!

OSPF Route Advertisement for Floating Self IP in Active/Standby HA

LBJ — Mon, 29 Jun 2026 14:35:43 GMT

Hi all
In an Active/Standby HA deployment using OSPF network statements to advertise connected VLAN prefixes, both BIG-IPs advertise the same connected subnet. When the floating self IP is used as the server default gateway and also selected by SNAT Automap, how is traffic redirected to the new Active after failover if the old Active continues advertising the connected prefix with a lower OSPF cost? Is there any recommended design or best practice from F5?

Doubt adding F5 in sync-group

SuppEsp_AX — Mon, 29 Jun 2026 14:08:45 GMT

I need to replace an LTM-GTM cluster. I will replace the standby node first. The sync-group are 4 devices. My question is about adding it to the GTM sync group. Should I run only the gtm_add command, or do I also need to run the bigip_add command? I'm not sure whether joining a sync group requires both commands or just one of them. I'd also like to know where each command should be executed. I understand that gtm_add is run on the new node being added, but is bigip_add also run on the new node? how can i delete the old nodes for the sync-group when its donde the change?

How to identify what is causing "Changes Pending" before ConfigSync?

Khun_Sophavatta — Mon, 29 Jun 2026 03:51:28 GMT

When a BIG-IP device shows "Changes Pending", is there a way to identify exactly what configuration has changed before performing a ConfigSync?

I checked the Audit Log, but it mostly contains commands such as list cm device recursive and other GUI-generated read-only commands, and doesn't clearly show which object was modified.

Also, if I realize the changes were made by mistake, is there a supported way to discard or revert the pending changes without synchronizing them to the peer?

Any recommended commands or best practices would be appreciated.

Thanks!

Clone/export/import API Protection Profile

Eljay — Fri, 26 Jun 2026 13:15:49 GMT

Hi, I need to make a change in an API Protection Profile.
Is possible to clone, export or import such profile? I don't want to change the existing profile.

UCS file migration on differing OS versions

mtfeliciano — Thu, 25 Jun 2026 02:58:13 GMT

We are currently upgrading the F5 load balancers of our customer, from iSeries, to rSeries.

old F5 load balancers:

model: BIG-IP i5600 (C119)
OS: 12.1.x (either 12.1.2 Hotfix HF2 2.0.276 or 12.1.4 Final 0.0.8)
GTM / DNS configurations: enabled

new F5 load balancers:

model: rSeries (2600 and 4800)
OS: 17.5.1.6
GTM / DNS configurations: no longer needed, as per our customer

questions:

1. Noting the OS versions of the old and new F5 load balancers...

Is this the ideal OS upgrade sequence? (based on F5 K13845)

BIG-IP 12.x > BIG-IP 14.x > BIG-IP 15.x or BIG-IP 16.x > BIG-IP 17.x

2. BIG-IP 14.x is no longer available in F5's Downloads website.

Are there any other methods for obtaining a copy of BIG-IP 14.x?

3. About UCS file migration, from old to new F5 load balancers:

Would there be any risks, configuration-wise, if we do the following steps?

- we take the UCS file from the old F5 load balancer, which is running on BIG-IP 12.x

- we import and load that UCS file onto the new lab F5 load balancer, which is running on BIG-IP 17.x

4. Since our customer advised that they will no longer need any GTM / DNS configurations on their new F5 load balancer:

Should we delete the bigip_gtm.conf file from the contents of the UCS file of the old F5 load balancer, before migrating to the new F5 load balancer?

ASM attack signatures not syncing between active and standby F5

P_K — Tue, 23 Jun 2026 20:10:33 GMT

Hello F5ers,

I have a pair of f5s in active/standby setup running ASM (WAF) module. I have ASM synchronization setup with sync-failover device group on both f5s. Everything else works fine but I noticed ASM signatures under system > software management > live update page no longer shows any signatures downloaded or installed my standby f5 anymore. when i try to select an option for "Installation of automatically downloaded updates" such as Real time or scheduled then click Save, I get a "failed to save configuration" error.

This db variable value is same on both f5s

tmsh list /sys db liveupdate.allowautoinstallonsecondary value
sys db liveupdate.allowautoinstallonsecondary {
value "false"
}

Standby f5:

cat /var/log/tomcat/liveupdate.log | egrep 'isMaster|isAsmMaster|isDatasyncMaster'
2026-06-17 16:20:51 INFO SyncHandler:343 - Set isAsmMaster = true
2026-06-17 16:20:51 INFO SyncHandler:351 - Set isMaster = true
2026-06-17 16:20:51 INFO SyncHandler:347 - Set isDatasyncMaster = false
2026-06-17 17:18:46 INFO SyncHandler:351 - Set isMaster = true
2026-06-17 17:18:46 INFO SyncHandler:343 - Set isAsmMaster = true
2026-06-17 17:18:46 INFO SyncHandler:347 - Set isDatasyncMaster = false
2026-06-23 15:10:23 INFO SyncHandler:343 - Set isAsmMaster = true
2026-06-23 15:10:23 INFO SyncHandler:351 - Set isMaster = true
2026-06-23 15:26:03 INFO SyncHandler:351 - Set isMaster = true
2026-06-23 15:26:03 INFO SyncHandler:343 - Set isAsmMaster = true
2026-06-23 15:26:03 INFO SyncHandler:347 - Set isDatasyncMaster = false
2026-06-23 15:41:11 INFO SyncHandler:351 - Set isMaster = false
2026-06-23 15:41:11 INFO SyncHandler:343 - Set isAsmMaster = false
2026-06-23 15:41:11 INFO SyncHandler:347 - Set isDatasyncMaster = false

Active F5:

cat /var/log/tomcat/liveupdate.log | egrep 'isMaster|isAsmMaster|isDatasyncMaster'

2026-06-17 16:39:29 INFO SyncHandler:347 - Set isDatasyncMaster = true

2026-06-23 15:36:50 INFO SyncHandler:343 - Set isAsmMaster = true

2026-06-23 15:36:50 INFO SyncHandler:351 - Set isMaster = true

Did anyone came across this issue in their environment?

version: 17.1.3

platform: VM

Appreciate any help! thanks