28-Jun-2022 15:24
Does anyone have experience identifying K36155089 and / or know the impacts of this bug? We're supposedly affected and I'd like to see if anyone has experience with it and also if they know they performance impacts that the workaround causes?
Solved! Go to Solution.
29-Jun-2022 00:36
Hello ChristianH.
If your fastL4 is configured as:
Then you should be affected by the mentioned bug. That means that all the embryonic sessions (TCP-Half Open) will be removed from the connections table using the "Idle Timeout" counter instead of the "TCP Handshake Timeout" (which is more restrictive than the "Idle Timeout" counter).
Then, those connections (TCP Half-Open) will be remaining in the connection table for more time than expected.
The workaround KB states to change the Offload State from SYN to EST. That means using PVA after the connection is established.
|-----------> SYN >-----------| >> HW Offloading using SYN
|---------< SYN-ACK <---------|
|-----------> ACK >-----------|
|---> REST OF THE TRAFFIC >---| >> HW Offloading using EST
That means that the TCP Handshake will be done using CPU instead of HW (a bit of CPU higher than using HW).
You could think about this set could be vulnerable to DoS attacks. But thanks to the SYN Cookie protection (by default), your system should be protected.
REF - https://support.f5.com/csp/article/K74451051
29-Jun-2022 00:36
Hello ChristianH.
If your fastL4 is configured as:
Then you should be affected by the mentioned bug. That means that all the embryonic sessions (TCP-Half Open) will be removed from the connections table using the "Idle Timeout" counter instead of the "TCP Handshake Timeout" (which is more restrictive than the "Idle Timeout" counter).
Then, those connections (TCP Half-Open) will be remaining in the connection table for more time than expected.
The workaround KB states to change the Offload State from SYN to EST. That means using PVA after the connection is established.
|-----------> SYN >-----------| >> HW Offloading using SYN
|---------< SYN-ACK <---------|
|-----------> ACK >-----------|
|---> REST OF THE TRAFFIC >---| >> HW Offloading using EST
That means that the TCP Handshake will be done using CPU instead of HW (a bit of CPU higher than using HW).
You could think about this set could be vulnerable to DoS attacks. But thanks to the SYN Cookie protection (by default), your system should be protected.
REF - https://support.f5.com/csp/article/K74451051
29-Jun-2022 06:32
Beautifully explained, thank you!
29-Jun-2022 05:44
Hello Smith845,
There is no solution beyond the workaround.