A10 ACOS key terms

A10's Advanced Core Operating System: the software platform that runs on A10 Thunder and AX appliances and provides traffic management, load balancing, security, and networking services through a single configuration model.

A dedicated Ethernet port, usually eth0, used for administrative access to the ACOS device rather than for client traffic. Administrators assign it an IP address, mask, and default gateway.

A logical, isolated container within one ACOS device that holds its own objects, policies, and administrators. Partitions let multiple teams or tenants share hardware without seeing each other's configuration.

A direct serial or USB connection to the ACOS device used when network access is unavailable or misconfigured. It provides local CLI login and is often the recovery path after an IP change.

The text-based command interface for configuring and monitoring ACOS. Commands are organized in modes, such as enable and configure, and changes are applied immediately or after explicit save.

A10's subscription licensing model that pools capacity across multiple devices rather than tying a fixed throughput entitlement to each serial number. It simplifies scaling and reallocating capacity between appliances.

A Layer 2 broadcast domain configured on ACOS interfaces. VLANs separate management and data traffic and carry the IP addresses and virtual ports that the device serves.

An ACOS object representing the client-facing IP address and port that receives traffic. It selects a service group, applies templates and policies, and forwards connections to backend servers.

The TCP or UDP port number, and optional port range, configured on a virtual server. A wildcard port of zero lets the virtual server accept traffic on any port.

A named collection of backend real servers plus the load-balancing method and health monitors applied to them. Virtual servers send client connections to a service group rather than to individual servers.

A backend host, identified by IP address and port, that actually processes client requests. Real servers are members of service groups and receive connections chosen by the load-balancing method.

A load-balancing method that sends each new connection to the next server in the group in sequence. It is simple and predictable but ignores how busy each server actually is.

A load-balancing method that gives each new connection to the server currently handling the fewest active sessions. It adapts better than round robin when request durations vary widely.

A round-robin variant where each server receives new connections in proportion to an assigned weight. Higher-weight servers take more traffic, which suits hardware with different capacity.

A persistence method that maps all connections from one client IP address to the same real server for a configured timeout. It helps applications that store session state locally on a server.

An HTTP persistence method where the load balancer inserts or reads a cookie to remember which real server served a client. Subsequent requests with that cookie go to the same server.

A TCL-based scripting feature in ACOS for customizing traffic handling on virtual servers. Scripts can inspect or modify requests, choose servers, and implement logic beyond built-in policies.

A configuration that rewrites the client's source address to an address owned by the ACOS device before forwarding traffic to backend servers. It ensures return traffic comes back through the load balancer.

A reusable ACOS object that defines how the device probes a real server, such as with ICMP, TCP, or HTTP checks. Its results mark servers up or down and control traffic distribution.

Two monitor timers: the interval is how often a probe is sent, and the timeout is how long the device waits for a reply before counting a failure.

The number of consecutive failed or successful probes required before ACOS changes a server's state. Up and down retry values are often set separately to avoid flapping.

A feature that gradually increases traffic to a real server after it recovers or is re-enabled. Ramping connections prevents a cold server from being overwhelmed immediately.

A graceful removal process where a server stops accepting new connections but keeps existing sessions until they finish or a timer expires. It avoids dropping live user transactions during maintenance.

An administrative state that removes a real server from load-balancing decisions while keeping its configuration. Administrators use it to patch or reboot a backend without deleting it.

Processing TLS encryption and decryption on the ACOS device instead of on backend servers. The load balancer terminates client TLS, then forwards plain HTTP or re-encrypts toward servers.

A digital document, signed by a certificate authority, that binds a public key to a hostname and lets clients verify the server's identity during a TLS handshake.

The secret cryptographic key paired with the public key in an SSL certificate. The ACOS device uses it to decrypt TLS traffic, so it must be protected and matched to the certificate.

The ordered list of intermediate CA certificates that links a server certificate to a trusted root. Clients need the chain to build a trusted path during validation.

A certificate signing request: a block of encoded data containing a public key and identity details that is submitted to a certificate authority to obtain a signed certificate.

An ACOS template that holds the certificate, key, chain, and cipher settings used when the load balancer terminates TLS from clients. Virtual servers reference it to enable HTTPS.

An ACOS template holding the certificate and cipher settings used when ACOS acts as a TLS client toward backend servers. It supports re-encryption of traffic after offload.

Server Name Indication: a TLS extension where the client sends the requested hostname during the handshake. It lets one IP address and port serve multiple certificates.

A10's enhanced Virtual Router Redundancy Protocol implementation. It elects an active device, shares virtual IP addresses, and moves traffic to a peer when the active unit fails.

An HA deployment where one device handles all traffic and the other stays ready to take over. The standby unit monitors the active device and assumes its addresses during failover.

An HA deployment where two or more devices simultaneously serve traffic, often through VRRP-A and separate virtual servers. It uses more capacity but requires careful session and configuration design.

The process of moving traffic and virtual IP addresses from a failed or demoted device to its HA peer. It is triggered by heartbeat loss, tracked objects, or an administrator's manual switchover.

A numeric value that determines which VRRP-A device becomes active. The higher priority wins elections, and preemption settings decide whether a recovered device takes control back.

A10 Virtual Chassis System: a clustering feature that presents multiple ACOS devices as one logical chassis. It simplifies management and enables scalable HA across several appliances.

Automatic or manual replication of configuration objects from one HA peer to another. It keeps both devices consistent so a failover does not lose virtual servers, service groups, or certificates.

Role-based access control: assigning permissions to admin roles rather than to individual users. ACOS uses it with partitions so operators can manage only their assigned objects.