F5-301A study plan
F5-301A · Give each week a clear focus.
8 weeks · About 7 hours per week
Setup and Initial Configuration
Install a BIG-IP VE lab instance and complete the initial setup wizard, setting hostname, management address, and admin credentials.
Provision the LTM module and confirm licensing and provisioning state from both the GUI and tmsh.
Configure DNS resolvers, NTP servers, and a second administrative user with a non-default role, then prove time sync is healthy.
Trace where configuration and log artifacts live on the filesystem so later troubleshooting weeks have a known starting point.
Save a baseline UCS archive and rehearse the restore into a clean instance.
Your checkpoint
A one-page baseline build sheet plus a matching UCS archive that has been restored into a second lab instance, with hostname, NTP, and DNS re-verified by CLI output pasted into the sheet.
Network Configuration (VLANs, Self IPs, Routes)
Create two internal VLANs and one external VLAN, bind them to interfaces, and confirm link and tag state.
Assign self IPs on each VLAN with port lockdown tightened to the services actually needed.
Add a default gateway and a static route, then validate forwarding with ping and traceroute from lab hosts.
Configure a route domain and demonstrate that traffic in it stays isolated from the default domain.
Verify with packet capture which ports are reachable on a self IP after lockdown is applied.
Your checkpoint
A finished topology diagram paired with a tmsh configuration dump of VLANs, self IPs, and routes, plus a connectivity test log showing one VLAN reachable and the isolated route domain unreachable as designed.
Local Traffic Objects: Nodes, Pools, and Monitors
Add address-based and FQDN nodes, then build pools with ratio and priority weighting across members.
Attach health monitors at both node level and pool level and record which one governs member state.
Author a custom HTTP or HTTPS monitor with explicit send and receive strings, interval, and timeout values.
Stop a back-end service and time how long the member takes to flip to down, then restart it and time recovery.
Inspect monitor-related log entries to confirm the state transitions match the configured intervals.
Your checkpoint
A three-member pool where stopping one back-end service produces a down member within the configured interval, evidenced by a timestamped monitor log and a written note on node-versus-pool monitor precedence.
Virtual Servers and Profiles
Build a standard virtual server bound to a multi-member pool and validate it with repeated client requests.
Stack TCP, HTTP, and cookie persistence profiles on the virtual server and tune idle timeouts deliberately.
Configure source address translation on the virtual server and observe the changed source address at the back end.
Test default pool and fallback host behavior when every pool member is marked down.
Compare a Layer 4 forwarding virtual server against the standard one for the same back-end service.
Your checkpoint
A working VIP with cookie persistence proven by two consecutive client requests landing on the same pool member, documented in a test matrix that also records fallback behavior with all members down.
NAT and SNAT
Configure source address translation using automap, a SNAT pool, and a shared SNAT on a self IP, then compare back-end observed addresses.
Build a destination NAT that forwards an external address and port to an internal server without a virtual server.
Change port translation on an existing NAT and confirm the new mapping with a live connection test.
Capture traffic at the back end to prove which source address each translation method presents.
Your checkpoint
A comparison table of four translation methods listing the back-end observed source address for each, backed by packet capture evidence for every row.
SSL/TLS and Certificate Management
Generate a key and CSR, then import a certificate chain and confirm the full chain is recognized by the device.
Create a client SSL profile that restricts TLS versions and cipher suites, and verify the negotiated version with a client probe.
Configure a server SSL profile so the virtual server re-encrypts traffic to the back-end pool members.
Test certificate expiry and hostname mismatch handling, and document the exact client-visible failure for each.
Export and re-import a certificate and key pair to confirm portability between lab devices.
Your checkpoint
A TLS test report showing negotiated protocol and cipher for two client SSL profiles, the client error produced by an expired certificate, and a successful re-encrypting handshake to the back end.
High Availability and Device Service Clustering & Monitoring, Logging, and Troubleshooting
Build a two-device device service cluster with a trust domain, device group, and traffic group, then push a config sync.
Create floating self IPs and virtual addresses, then force failover and confirm traffic follows the active device.
Read HA state and sync status from tmsh and interpret the output for a deliberately out-of-sync device.
Isolate a traffic problem using packet capture, pool member state, and the relevant log files in sequence.
Set up a remote syslog destination and confirm virtual server and monitor events arrive there.
Your checkpoint
A failover runbook with captured tmsh HA status output before, during, and after a forced failover, plus a troubleshooting log showing one deliberately broken pool member diagnosed to root cause and the syslog evidence that pinpoints it.
Setup and Initial Configuration & Network Configuration (VLANs, Self IPs, Routes) & Local Traffic Objects: Nodes, Pools, and Monitors & Virtual Servers and Profiles & NAT and SNAT & SSL/TLS and Certificate Management & High Availability and Device Service Clustering & Monitoring, Logging, and Troubleshooting
Retake two full-length timed practice exams under exam conditions and score every domain separately.
Rebuild from memory the five configurations you failed or hesitated on during practice, without notes.
Re-read the personal error log and convert each recurring mistake into a one-line rule you can apply quickly.
Re-verify the lab environment end to end so every earlier deliverable is reproducible on demand.
Your checkpoint
A domain-by-domain scorecard from two timed practice exams plus a one-page remediation sheet listing each weak objective, the corrective action taken, and the re-test result.
Milestones
Week 2: Management access, DNS, NTP, VLANs, self IPs, and a static route all work in the lab, and a baseline UCS archive is restorable on demand.
Week 4: A full request path works end to end, from client through virtual server and profile stack to a health-monitored pool member, with persistence and fallback behavior both demonstrated.
Week 6: Source address translation methods are documented with capture evidence, and a client can complete a TLS handshake through a restricted client SSL profile with re-encryption to the back end.
Week 8: Two timed practice exams each score at or above your target passing margin with no single domain below 70 percent, and every missed objective has a documented corrective action.