F5-301A cheat sheet

Hardware defaults: management interface 192.168.1.245/24, user admin, password admin; the console config utility or the browser setup wizard changes them.

Configuration files: /config/bigip.conf holds the full running config, /config/bigip_base.conf holds base network and system objects, /config/bigip_gtm.conf holds GTM objects.

Persist changes with tmsh save sys config; tmsh load sys config default restores factory defaults and restarts the system.

License activation: tmsh install sys license registration-key ; add-on keys with tmsh install sys license add-on-key .

Provisioning: tmsh modify sys provision ltm level nominal; any provisioning change restarts services and briefly interrupts traffic.

NTP and DNS: tmsh modify sys ntp servers add { 10.0.0.1 } and tmsh modify sys dns name-servers add { 10.0.0.2 }.

Time zone: tmsh modify sys ntp timezone America/New_York; correct time is required for certificate validation and HA config sync.

Admin shell: tmsh is the default on 11.x and later; bash requires tmsh modify auth user admin shell bash (advanced shell).

VLAN creation: tmsh create net vlan internal interfaces add { 1.1 { tagged } 1.2 { untagged } }; the interface number is slot.port.

Self IP creation: tmsh create net self 10.0.0.10/24 vlan internal traffic-group traffic-group-1; traffic-group-local-only makes it non-floating.

Self IP port lockdown defaults to Allow None; Allow Default permits a limited set (SSH 22, SNMP 161, HTTPS 443, iQuery 4353).

Floating self IPs must be in the same subnet on all peers and must be assigned to the same non-local traffic group.

Default route: tmsh create net route default network default gw 10.0.0.1; specific route: tmsh create net route r1 network 192.168.0.0/16 gw 10.0.0.1.

Management traffic uses a separate table: tmsh create sys management-route mgmt network 10.10.0.0/16 gateway 192.168.1.1.

MTU is per VLAN: tmsh modify net vlan internal mtu 9000; every device and switch port on the path must match or large packets drop.

Route domains isolate overlapping address space: tmsh create net route-domain rd1 id 1, then reference objects as 10.0.0.1%1.

Node: tmsh create ltm node web1 address 10.1.1.10; a node is only an address, state, and an optional node-level monitor.

Pool: tmsh create ltm pool web_pool monitor tcp members add { web1:80 { address 10.1.1.10 } }.

Monitor precedence per member: member monitor, then node monitor, then pool monitor.

HTTP monitor: tmsh create ltm monitor http hm_send send "GET /health\r\n" recv "200 OK"; the recv string supports regular expressions.

Monitor timing: interval is probe frequency and timeout is reply wait; F5 recommends timeout = 3 x interval + 1, and up-interval controls retries of down members.

Member states: up, down, checking, unchecked; view them with tmsh show ltm pool members.

Methods: round-robin is the default; least-connections-member, least-connections-node, observed-member, ratio-member, fastest-node, and dynamic-ratio are alternatives.

Priority group activation keeps min-active-members from the highest priority group before falling back to lower priority members.

Member admin states: enabled, disabled (existing connections finish), forced offline (connections are reset).

Create: tmsh create ltm virtual vs_https destination 10.0.0.100:443 profiles add { tcp http clientssl } pool web_pool.

Profile dependencies are resolved automatically: http requires tcp, clientssl requires tcp, and serverssl requires tcp.

Wildcard virtual server uses destination 0.0.0.0:0; a network virtual server uses a subnet destination without a port for forwarding.

Types: standard (full proxy), performance-l4 (fastL4), forwarding-ip, reject, and stateless; standard is required for HTTP, SSL termination, and iRules.

Source address translation: source-address-translation { type automap }, { type snat pool }, or { type none }.

Persistence: tmsh modify ltm virtual vs1 persist add { cookie }; a persistence profile overrides the load balancing method for matching clients.

VLAN binding: default is all VLANs; tmsh modify ltm virtual vs1 vlans add { internal } restricts the listener to the listed VLANs.

Connection limits: tmsh modify ltm virtual vs1 connection-limit 10000 and rate-limit 500 cap simultaneous and new connections.

SNAT object: tmsh create ltm snat snat_out origin 10.0.0.0/24 translation 192.0.2.10.

SNAT pool: tmsh create ltm snatpool sp1 members add { 192.0.2.10 192.0.2.11 }, attached with source-address-translation { type snat pool sp1 }.

Automap translates to the self IP of the egress VLAN and is used when source address translation is enabled without a pool.

NAT: tmsh create ltm nat nat_web origin 203.0.113.10 translation 10.1.1.10 translates inbound destination addresses.

Translation addresses must be routed to the BIG-IP; add a static entry with tmsh create net arp if the address is not a self IP.

SNAT and NAT are connection-based: return traffic is automatically reverse-translated using the connection table.

An iRule snat or pool command overrides the virtual server's configured translation and pool for that connection.

Verify with tmsh show ltm snat, tmsh show sys connection, and the counters in tmsh show ltm virtual .

Import certificate: tmsh install sys crypto cert mycert from-bundle /var/tmp/mycert.crt; import key: tmsh install sys crypto key mykey from-bundle /var/tmp/mykey.key.

Bundle order: leaf certificate first, then intermediates; the root is usually omitted.

Create profile: tmsh create ltm profile client-ssl clientssl cert mycert key mykey; attach it to the virtual server in the profiles list.

Server-side encryption uses a server-ssl profile; without one, traffic between the BIG-IP and pool members is clear text.

TLS versions: tmsh modify ltm profile client-ssl clientssl tls1.0 disabled tls1.1 disabled; ciphers selects TLS 1.2 and below, cipher-group selects TLS 1.3.

SNI is enabled by default in client-ssl profiles, allowing multiple certificates per virtual server based on the handshake hostname.

OCSP stapling: tmsh modify ltm profile client-ssl clientssl ocsp-stapling enabled.

Check expiry with openssl x509 -in cert.crt -noout -dates or inspect the object with tmsh list sys crypto cert .

Trust: run tmsh modify cm trust-domain add-device { device-name bigip2 device-ip 10.0.0.2 } from the existing device.

Device group: tmsh create cm device-group dg1 type sync-failover devices add { bigip1 bigip2 }.

Config sync: tmsh run cm config-sync to-group dg1; check status with tmsh show cm sync-status.

Traffic group: tmsh create cm traffic-group tg1; assign floating self IPs and virtual servers to it with traffic-group tg1.

Failover: tmsh run sys failover standby, tmsh run sys failover active, and tmsh run sys failover offline for hard offline.

Network failover uses a failover VLAN or unicast addresses: tmsh modify cm device bigip1 unicast-address { { ip 10.0.0.1 port 1026 } }.

An HA group references a monitored pool and threshold, adjusting failover score so the device with healthy gateways is preferred.

Config sync requires matching software versions, synchronized time, and unique hostnames; sync pushes the config from the device where it is run.

Check state with tmsh show cm failover-status and tmsh show cm device.

Key logs: /var/log/ltm (LTM events, monitor transitions, iRule errors), /var/log/audit (admin actions), /var/log/messages (system events), /var/log/gtm.

Monitor diagnosis: tmsh show ltm pool members shows state and last error; tmsh show ltm monitor shows the monitor definition.

Capture traffic: tmsh start sys tcpdump -i 0.0:nnn -s0 -w /var/tmp/cap.pcap; stop with tmsh stop sys tcpdump.

qkview: tmsh generate qkview writes /var/tmp/.qkview containing logs and configuration for support or iHealth analysis.

Performance: tmsh show sys performance, tmsh show sys tmm-traffic, and tmsh show sys memory.

Connections: tmsh show sys connection lists entries in the connection table and is used to verify SNAT and persistence behavior.

SNMP: tmsh modify sys snmp communities add { public { source default } }; restrict source hosts with allowed-addresses.

Syslog destinations are set with tmsh modify sys syslog or by editing files under /etc/syslog-ng/; remote logging needs a destination plus a log filter.