F5-301A flashcards
F5-301A · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- tmsh
- The Traffic Management Shell is the default command-line interface on BIG-IP 11.x and later; it configures, monitors, and saves the running configuration.
- save sys config
- tmsh command that writes the running configuration to /config/bigip.conf and related files so changes survive a reboot.
- Management default address
- On hardware platforms the management interface defaults to 192.168.1.245/24 with admin/admin credentials; the console setup utility can change it during initial configuration.
- Provisioning level change
- tmsh modify sys provision ltm level nominal allocates resources to Local Traffic Manager; changing a provisioning level restarts system services and briefly interrupts traffic.
- Self IP port lockdown
- Self IP setting controlling which ports accept traffic addressed to the self IP; Allow None is the default, Allow Default permits a limited service set, Allow Custom lists specific ports.
- Floating self IP
- A self IP in a non-local traffic group so it moves to the active device on failover; both peers must define it in the same subnet.
- VLAN tagging
- An 802.1Q tag on a VLAN interface; a tagged interface carries multiple VLANs, while an untagged interface carries a single VLAN.
- Default route creation
- tmsh create net route default network default gw 10.0.0.1 defines the gateway of last resort used by the data plane for unknown destinations.
- Node versus pool member
- A node is a server address object; a pool member is a node plus a service port that receives load-balanced traffic and has its own monitor, ratio, and state.
- Monitor precedence
- Monitor precedence is member, then node, then pool: a pool member's monitor overrides its node's monitor, which overrides the pool's monitor.
- Round robin
- Default load balancing method that sends each new connection to the next available pool member in order, skipping members that are down or disabled.
- Monitor interval and timeout
- The interval is how often a monitor probes a member; the timeout is how long it waits for a reply, and F5 recommends timeout equal to three times interval plus one.
- Priority group activation
- Pool setting that keeps at least a minimum number of members from the highest priority group active before adding members from lower priority groups.
- Standard virtual server
- Fully proxying virtual server type that terminates the client connection and opens a separate server-side connection, enabling HTTP parsing, SSL termination, and iRules.
- Wildcard virtual server
- A virtual server whose destination is 0.0.0.0:0 or a network address, matching traffic that no more specific virtual server matches.
- Automap source translation
- Source address translation setting that SNATs client traffic to the self IP of the egress VLAN, chosen automatically without a configured SNAT pool.
- Default pool
- Pool attached to a virtual server that receives traffic when no iRule selects another pool; if it has no active members the virtual server cannot serve requests.
- Persistence profile
- Profile attached to a virtual server that keeps a client's connections on the same pool member using source address, cookie, SSL session ID, or other methods.
- SNAT
- Secure NAT rewrites a client's source address to a translation address so servers see the BIG-IP and return traffic through it.
- SNAT pool
- Named set of translation addresses used by a virtual server or SNAT object; the BIG-IP selects one address per connection.
- NAT
- One-to-one destination translation mapping a public origin address on the BIG-IP to an internal translation address for inbound connections.
- SNAT versus NAT
- SNAT changes the client source address for outbound flows; NAT changes the destination address so inbound connections reach an internal server.
- Client SSL profile
- Profile defining the certificate, key, cipher string, and TLS versions used on the client-facing side of a virtual server to terminate SSL.
- Importing certificate and key
- tmsh install sys crypto cert and install sys crypto key load PEM files; the certificate file should contain the leaf certificate and any intermediates.
- SNI
- Server Name Indication lets one virtual server present different certificates based on the hostname in the TLS handshake; it is enabled by default in client SSL profiles.
- Certificate chain order
- The certificate bundle must list the server certificate first, followed by intermediate certificates; the root is usually omitted because clients already trust it.
- Device group
- A collection of BIG-IP devices that synchronize configuration; sync-failover groups also coordinate which device is active for each traffic group.
- Config sync command
- tmsh run cm config-sync to-group <group> pushes the local running configuration to the other members of the device group.
- Traffic group
- Container for floating self IPs and virtual servers that determines which device in the device group is active for those objects.
- ltm log file
- /var/log/ltm records Local Traffic Manager events, monitor state changes, and iRule errors; follow it with tail -f during troubleshooting.
- qkview
- Diagnostic snapshot created with tmsh generate qkview that bundles logs, configuration, and system data for support analysis or upload to iHealth.
- tcpdump on BIG-IP
- tmsh start sys tcpdump -i 0.0:nnn captures packets on a VLAN interface, where nnn is the VLAN ID, and -w writes a pcap file.