Networking Topology, Interfaces, VLANs, and Routing
This domain tests how the ADC is placed in the network and how it forwards traffic: interfaces and channels, VLAN binding, IP address roles, static and dynamic routing, and reverse NAT. The exam favors concrete configuration consequences, such as what happens when a VLAN is not bound to an IP or when return traffic bypasses the ADC.
Interface and VLAN rules
- Interfaces are named slot/port; a link aggregation channel bundles links, and LACP settings must match the switch (active/passive or active/active).
- VLAN 1 exists by default and contains all interfaces and IP addresses unless you change it. For a custom VLAN, bind interfaces as tagged or untagged and bind the ADC IP addresses that belong to it.
- Tagged interfaces carry multiple VLANs; untagged interfaces carry one. Mismatched tagging is a common outage.
- IP roles: NSIP for management, SNIP for server-side traffic, VIP for client-facing services, and MIP in some NAT or GSLB designs.
Routing rules
Static routes handle simple next-hop forwarding; OSPF and BGP are available for dynamic routing; policy-based routing (PBR) can override the routing table for selected traffic. Reverse NAT (RNAT) changes the source address for outbound connections. In a two-arm deployment, servers should use the SNIP as their default gateway so return traffic traverses the ADC. If they use a core router instead, asymmetric routing can bypass connection state and break persistence or inspection.
Worked example
A client VLAN 10 is on interface 1/1 untagged, and a server VLAN 20 is on interface 1/2 tagged. The VIP is 10.10.0.50/24 and the SNIP is 10.20.0.10/24. Bind VLAN 10 to 1/1 and to the VIP; bind VLAN 20 to 1/2 with tagging and to the SNIP. Configure servers with gateway 10.20.0.10. If the servers instead point to core router 10.20.0.1, replies to clients leave directly and the ADC sees only half the flow. The fix is to change the server gateway or add PBR to steer return traffic back through the ADC. The reasoning is that VLAN membership controls Layer 2 delivery, while the gateway controls Layer 3 return paths.
Traps that cost marks
Forgetting to bind an IP address to its VLAN, using duplicate VLAN IDs on a trunk, mismatching LACP modes, and ignoring MTU on channels all cause silent failures. Also check that RNAT is applied to the correct traffic and that PBR does not create a routing loop.