CVE mitigation on F5 XC vs classic F5 WAF
Hi, there is serious CVE out there: https://www.cve.org/CVERecord?id=CVE-2025-55182 And F5 reacted quickly: https://my.f5.com/manage/s/article/K000158058#BIG-IP F5 itself is not affected, but F5 company created signatures addressing this issue. But it seems they are NOT available in F5 XC. That leads me to thinking what is the process, what can we expect? We have deployed signatures on some onsite environments, but how about services behind F5 XC? Thanks, Zdenek
Could not communicate with the system. Try to reload page.
I am trying to check for live updates of attack signatures in F5, but I am getting a message. In passive devices, the signature list does not display — it keeps loading and never shows the updated signatures. Has the destination or location of the signature updates changed in version 17?
Single User Unable to Connect to VPN over F5 APM
Hi Everyone, We have a F5 APM for VPN using Radius servers for authenticating the users. We See that one user is unable to access VPN and when checked logs we see this RADIUS module: authentication with 'Username' failed: Access-Reject packet from host 127.7.0.3:1812 (3) Can someone please clarify if this is being rejected on APM or on Radius Server
AFM Logging Proxy Protocol Header Sent by F5 XC
Hello, We are using F5 distributed cloud XC DDOS service for our published services in proxy mode all traffic coming to F5 BIG-IP AFM sourced from XC IP ranges, at the same time XC is inserting "PROXY Protocol" version 2 header. I need your help to know how to extract "original IP" from header and send it to an external syslog server via irule or any other way. Thanks
Illegal Request in Learning Suggestion for 200 OK response
Dears, I want to know the reason why this suggestion is showing an illegal request status even though response code is 200 OK. Is it because multiple violations triggered? The policy is in transparent mode and I am just verifying the suggestions. Can someone please provide an expert advise?WAF Block Request
Hello Everyone I hope Youre well!!! Recently, I had this event logged by the WAF: a request categorized as “Attack signature detected” with a Violation Rating of 4. However, the WAF did NOT block it and is treating it as “Legal.” However, the linked policy is in blocking mode. Does anyone know what this is due to and how to fix it? Thank you in advance.
