Known issues
This document lists and describes the known issues and possible workarounds in F5 NGINX Instance Manager. We also list the issues resolved in the latest releases.
We recommend you upgrade to the latest version of NGINX Instance Manager to take advantage of new features, improvements, and bug fixes.
June 16, 2025
| Issue ID | Status |
|---|---|
| 46177 | Open |
Fetching latest CVE data from internet might fail if you enable “ssl_verify” in Kubernetes environments.
-
Switch to the offline CVE database. To switch add the property “offline_nginx_cve: true” under the DPM section in the “nms.conf” file.
dpm: offline_nginx_cve: true -
Download the latest security advisories file from the nginx.org repository and save them with “cve.xml” as filename in “/usr/share/nms/cve.xml”
-
Restart the
nmsservice.sudo systemctl restart nms
After the restart you will see the line “loading CVE data from file” in the “nms.log” file.
March 27, 2025
| Issue ID | Status |
|---|---|
| 45991 | Fixed in Instance Manager 2.20.0 |
When the dashboard page and certificates page are loaded, the count displayed for total, valid, expired, expires soon, managed and unmanaged are incorrect.
The changes required have been made and the UI displays the values correctly now. Pagination also works well along with the certificate stats.
February 06, 2025
| Issue ID | Status |
|---|---|
| 45845 | Fixed in Instance Manager 2.19.1 |
In NGINX Instance Manager v2.19.0, publishing an NGINX App Protect WAF policy from the UI fails if the latest NGINX App Protect WAF compiler v5.264.0 (for NGINX App Protect WAF v4.13.0 or v5.5.0) is manually installed without adding the NGINX repository certificate and key.
-
Download the NGINX repository certificate and key:
- Log in to MyF5.
- Go to My Products and Plans > Subscriptions.
- Download the SSL certificate (nginx-repo.crt) and private key (nginx-repo.key) for your NGINX App Protect subscription.
-
Upload the certificate and key using the NGINX Instance Manager web interface:
- Go to Settings > NGINX Repo Connect.
- Select Add Certificate.
- Choose Select PEM files or Manual entry.
- If using manual entry, copy and paste your certificate and key details.
For detailed steps, see Upload NGINX App Protect WAF certificate and key.
-
Restart the
nms-integrationsservice:sudo systemctl restart nms-integrations
November 08, 2024
| Issue ID | Status |
|---|---|
| 45846 | Fixed in Instance Manager 2.19.1 |
On Ubuntu 24.04, NGINX Instance Manager v2.18.0 and v2.19.0 fail to automatically download NGINX App Protect WAF compiler v5.210.0 (for NGINX App Protect WAF v4.12.0) and v5.264.0 (for NGINX App Protect WAF v4.13.0) from the NGINX repository.
Manually install the missing compiler by following the instructions in Install the WAF compiler.
| Issue ID | Status |
|---|---|
| 45573 | Fixed in Instance Manager 2.19.0 |
Saving templates as “staged configs” causes syntax errors due to Augment templates being multiple directories down the tree.
| Issue ID | Status |
|---|---|
| 45570 | Fixed in Instance Manager 2.19.0 |
If there is an NGINX configuration error when pushing a template configuration, the text overlaps outside the error window.
| Issue ID | Status |
|---|---|
| 45301 | Fixed in Instance Manager 2.19.0 |
.tgz files are not accepted in templates while .tar.gz files are.
| Issue ID | Status |
|---|---|
| 45024 | Fixed in Instance Manager 2.19.0 |
There is an issue that causes previous error messages to persist in the web interface, even after fixing the error causing the message.
July 10, 2024
| Issue ID | Status |
|---|---|
| 45131 | Open |
When using NGINX Instance Manager, you configure OIDC by manually editing the /etc/nginx/conf.d/nms-http.conf and /etc/nms/nms.conf files.
During the upgrade to 2.17.0, the user is asked if they would like to keep their own nms-http.conf, or replace it with the new default. As Web Analytics are enabled via the /etc/nginx/conf.d/nms-http.conf file, if a user decides to keep their own config when prompted during upgrade, these will not get enabled.
To keep the existing nms-http.conf file while maintaining the web analytics functionality, add the following to “/etc/nginx/conf.d/nms-http.conf” , inside the /ui location block:
add_header Content-Security-Policy "default-src 'none'; block-all-mixed-content; frame-ancestors 'self'; object-src 'none'; manifest-src 'self'; script-src 'self' https://*.walkme.com 'unsafe-inline' 'unsafe-eval'; style-src 'self' https://*.walkme.com fonts.googleapis.com 'unsafe-inline'; img-src 'self' https://*.walkme.com s3.walkmeusercontent.com d3sbxpiag177w8.cloudfront.net data:; font-src 'self' https://*.walkme.com data: https://fonts.gstatic.com; connect-src 'self' https://*.walkme.com; frame-src 'self' https://*.walkme.com blob:; worker-src 'self' blob: https://*.walkme.com;";| Issue ID | Status |
|---|---|
| 45113 | Open |
If NGINX Agent is configured to monitor NGINX App Protect before App Protect is installed, NGINX Agent will send an empty App Protect metadata structure to NGINX Instance Manager. This causes Instance Manager to fail to register the NGINX instance properly.
Edit the “/etc/nginx-agent/nginx-agent.conf” file and configure “precompiled_publication” as “false”. Then restart the nginx-agent process running sudo systemctl restart nginx-agent.
December 12, 2023
| Issue ID | Status |
|---|---|
| 44698 | Open |
After adding a license, some NGINX Management Suite features might be disabled, even if they are included in the license.
Restart NGINX Management Suite to make all the features available for use. To restart NGINX Management Suite, open a terminal on the host and run the command:
sudo systemctl restart nms| Issue ID | Status |
|---|---|
| 44685 | Open |
With the introduction of Instance Manager 2.15, we are expanding the features available for some licenses, such as those with only NGINX Plus entitlement. If such a license was applied before upgrading to 2.15, the expanded set of features will not be available as intended.
Terminate the license applied previously. Re-apply the license.
October 16, 2023
| Issue ID | Status |
|---|---|
| 44554 | Open |
When using the Scan feature, the CVE column may provide a value of ‘–’ for instances running specific versions of NGINX App Protect, including App Protect 4.4 and potentially others.
| Issue ID | Status |
|---|---|
| 44547 | Open |
Under certain conditions, instances that are not reporting request totals may not show in the Network Utilization panel or drawer when data is sorted by Request count. This typically happens when NGINX is not configured to stream metrics data to NGINX Agent.
Configure NGINX Plus or NGINX Stub Status APIs to send correctly the NGINX metrics using NGINX Agent. See the Metrics documentation to learn more.
| Issue ID | Status |
|---|---|
| 44520 | Open |
Users might not have permission to access the built-in policies (NginxDefaultPolicy and NginxStrictPolicy) while using NGINX Management Suite.
Use RBAC to assign the following permissions to the user:
- (At minimum) READ access to any other custom security policy or
- READ access to the security policy feature:
/api/platform/v1/security/policies
August 28, 2023
| Issue ID | Status |
|---|---|
| 44267 | Open |
In Instance Manager 2.13, a new configuration is published before the compile stage of a WAF policy is complete. This happens only when the policy is first referenced. This leads to a deployment failure, and the configuration rolls back. Typically, by the time you try to submit the configuration again, the policy has finished compiling, and the request goes through.
The initial failure message looks like this:
Config push failed - err: failure from multiple instances. Affected placements: instance/70328a2c-699d-3a90-8548-b8fcec15dabd (instance-group: ig1) - err: failed building config payload: config: aux payload /etc/nms/NginxDefaultPolicy.tgz for instance:70328a2c-699d-3a90-8548-b8fcec15dabd not ready aux payload not ready, instance/2e637e08-64b3-36f9-8f47-b64517805e98 (instance-group: ig1) - err: failed building config payload: config: aux payload /etc/nms/NginxDefaultPolicy.tgz for instance:2e637e08-64b3-36f9-8f47-b64517805e98 not ready aux payload not readyRetry pushing the new configuration. The deployment should work the second time around.
| Issue ID | Status |
|---|---|
| 43950 | Open |
If precompiled_publication is set to true, NGINX Management Suite may incorrectly report the version of Attack Signatures (AS) and Threat Campaigns (TC) that you previously installed on the NAP WAF instance.
June 12, 2023
| Issue ID | Status |
|---|---|
| 42838 | Open |
When updating Attack Signatures or Threat Campaign packages on multiple instances simultaneously, only one instance may be successfully updated. An error similar to the following is logged: security policy bundle object with given ID was not found.
Update the Attack Signatures or Threat Campaigns package one instance at a time.
April 26, 2023
| Issue ID | Status |
|---|---|
| 42217 | Open |
The list of Threat Campaigns will disappear when scrolling down, preventing the selection of the oldest versions.
Threat Campaign versions can be published with the API using the route: api/platform/v1/security/publish
November 17, 2022
| Issue ID | Status |
|---|---|
| 36265 | Open |
References to external files in a policy are not supported.
For example, in the NGINX App Protect WAF JSON declarative policy, these references are not supported:
- User-defined signatures - " not supporting for a while” @dan
- Security controls in external references
- Referenced OpenAPI Spec files
June 30, 2022
| Issue ID | Status |
|---|---|
| 34255 | Open |
NGINX Instance Manager reports metrics at a per-minute interval and includes dimensions for describing the metric data’s characteristics.
An issue has been identified in which metric data is aggregated across all dimensions, not just for existing metrics data. When querying the Metrics API with aggregations like SUM(metric-name), the aggregated data causes the API to over count the metric. This overcounting skews some of the metrics dashboards.
When querying the Metrics API, you can exclude the data for an aggregated dimension by specifying the dimension name in the filterBy query parameter.
filterBy=<dimension-name>!= ''December 21, 2021
| Issue ID | Status |
|---|---|
| 31081 | Open |
In the web interface, when uploading a config file that’s larger than 50 MB (max size), the system incorrectly reports the state as Analyzing (Status code 403), although the upload failed.
Keep config files under 50 MB.