Forum Discussion

biglouie_9849's avatar
biglouie_9849
Icon for Nimbostratus rankNimbostratus
Oct 11, 2012

F5 LCD displaying "Blocking DOS attack"

Not sure if I'm posting this in the correct forum, apologies if not.

 

 

We have an Active/Standby cluster of 2 F5 Bigip 1600's running 9.4.7.

 

 

Recently we noticed the Standby F5 is displaying the following error on its LCD display:

 

 

"Critical: 9d Blocking Dos Attack"

 

 

[I'm assuming "9d" refers to 9 days because the number increases each day].

 

 

Is there anything I could or should be doing about this? I'm assuming this just means its doing its job and blocking a denial of service attack, however if I log into the web interface of the device there is nothing in the logs to indicate there is anything going on [I cant find any reference to a Dos attack].

 

The Active cluster member isn't displaying any errors [so I guess its targeted at the local IP address of the external interface of the Standby member?]

 

Should we just wait this out or can something be done about it? As far as I can tell its not affecting our network in any way [although we are having a weird problem with the VPN tunnels on our firewall cluster, but I think thats a coincidence].

 

 

Thanks in advance

 

APM
app sec
security

16 Replies

Sort By
  • What_Lies_Bene1's avatar
    What_Lies_Bene1
    Icon for Cirrostratus rankCirrostratus
    Oct 11, 2012
    I found these links on a post Hoolio had responded to back in 2011 that might help. The error is triggered when LTM runs low on memory. I suspect the standby is running low on memory due to a code bug and I'd suggest a reboot might fix this issue;

     

     

    sol4611: Overview of adaptive reaping

     

    http://support.f5.com/kb/en-us/solutions/public/4000/600/sol4611.html

     

     

    sol7301: Protecting the BIG-IP LTM against denial of service attacks

     

    http://support.f5.com/kb/en-us/solutions/public/7000/300/sol7301.html
  • biglouie_9849's avatar
    biglouie_9849
    Icon for Nimbostratus rankNimbostratus
    Oct 17, 2012
    Thanks for the reply, I have rebooted the device and the LCD display error message has indeed been cleared [LCD has returned to normal and is displaying statistics, etc] but the red alarm light is still lit on the front of the box.

     

     

    Still cant see anything in the web interface regarding what the alarm might indicate. Do you have any suggestions for resolving this issue?
  • biglouie_9849's avatar
    biglouie_9849
    Icon for Nimbostratus rankNimbostratus
    Oct 17, 2012
    Thanks for the reply, I have rebooted the device and the LCD display error message has indeed been cleared [LCD has returned to normal and is displaying statistics, etc] but the red alarm light is still lit on the front of the box.

     

     

    Still cant see anything in the web interface regarding what the alarm might indicate. Do you have any suggestions for resolving this issue?
  • biglouie_9849's avatar
    biglouie_9849
    Icon for Nimbostratus rankNimbostratus
    Oct 17, 2012
    Thanks for the reply, I have rebooted the device and the LCD display error message has indeed been cleared [LCD has returned to normal and is displaying statistics, etc] but the red alarm light is still lit on the front of the box.

     

     

    Still cant see anything in the web interface regarding what the alarm might indicate. Do you have any suggestions for resolving this issue?
  • biglouie_9849's avatar
    biglouie_9849
    Icon for Nimbostratus rankNimbostratus
    Oct 17, 2012
    Thanks for the reply, I have rebooted the device and the LCD display error message has indeed been cleared [LCD has returned to normal and is displaying statistics, etc] but the red alarm light is still lit on the front of the box.

     

     

    Still cant see anything in the web interface regarding what the alarm might indicate. Do you have any suggestions for resolving this issue?
  • biglouie_9849's avatar
    biglouie_9849
    Icon for Nimbostratus rankNimbostratus
    Oct 17, 2012
    Thanks for the reply, I have rebooted the device and the LCD display error message has indeed been cleared [LCD has returned to normal and is displaying statistics, etc] but the red alarm light is still lit on the front of the box.

     

     

    Still cant see anything in the web interface regarding what the alarm might indicate. Do you have any suggestions for resolving this issue?
  • biglouie_9849's avatar
    biglouie_9849
    Icon for Nimbostratus rankNimbostratus
    Oct 18, 2012
    In the System>Logs menu, the "System" tab shows "Configuration reload request received, reloading configuration" three times, the "Packet Filter", "Local Traffic" and "Audit" tabs all show "No records to display".