Network Configuration: VLANs, Self IPs and Routes
Concepts
Network configuration is split across two planes. The management interface has its own routing table (sys management-ip, sys management-route); data traffic through TMM uses VLANs, self IPs and routes. A route added to one plane never affects the other - a frequent exam trap.
A VLAN is a Layer 2 object bound to one or more interfaces, tagged (802.1Q) or untagged, and identified by a tag. Interfaces are referenced as 1.1, 1.2 and so on. VLAN groups bundle VLANs for failover.
A self IP is a Layer 3 address on a VLAN used for the BIG-IP's own traffic: monitor probes, SNAT automap, iRule side connections and HA. Self IPs can have host scope (one device) or float in a traffic group (moves on failover). Port lockdown controls which services are reachable on the self IP: Allow Default permits a small set including SSH and the HA ports, Allow None permits only what clustering requires.
Routes point to a gateway and can be network, host or default. In practice the data-plane default route is created by naming a gateway default.
Traps
- Two self IPs on the same subnet on one device - the system rejects this.
- A floating self IP missing on the peer, so failover leaves no reachable address.
- Forgetting that SNAT automap needs a self IP on the egress VLAN.
- Expecting a management route to route monitor probes; probes source from self IPs.
- Assuming an untagged interface on a VLAN can also serve another VLAN untagged.
Worked example
tmsh create net vlan internal interfaces add { 1.2 { tagging untagged } }
tmsh create net self 10.0.0.10/24 vlan internal allow-service default
tmsh create net route default network 0.0.0.0/0 gw 10.0.0.1
Rule of thumb: if traffic must flow through the box, think VLAN → self IP → route, and remember the management port sits outside that path entirely.