Cirrus
MVPDid it happen again or was it a one time occurrence?
Can you involve F5 support? They can actually look at your configuration and perhaps logs which makes things way easier.
What was your enforcement mode set to?
CirrusHi boneyard
I switched the Policy building learning mode to manual, and this issue no longer occurs. I have always set the mode to blocking from the beginning. I want to investigate the cause of the problem, which is why I brought up this topic. This issue occurs on many of my F5 servers, from devtest to prod.
MVPCertainly if it can be reproduced I would involve F5 support.
I gave it quick try myself, not sure how I would trigger the hostname removal now. You don't do anything just keep getting traffic to it?
CirrusI have tried to create a TAC case for F5, but there are some issues occurring. For the environments, we have a SIEM system, so we can know exactly when traffic blocking happens