BIG-IP LTM configuration and virtual servers
Domain 1 tests whether you can build a listener that actually passes traffic: the virtual server, its address and port, the profiles and pool attached to it, and the address translation that decides what the backend server sees. Most questions ask what a setting does at traffic time, not where the control lives in the UI.
Anatomy of a listener
- The virtual address is its own object; several virtual servers can share one address on different ports.
- Standard is the default type. Performance (Layer 4) skips most TCP processing, Performance (HTTP) is an optimized L7 path with a reduced feature set, Reject resets connections, Stateless forwards without per-connection state.
- A wildcard virtual server (0.0.0.0, port 0) catches everything and needs a default pool; network virtual servers match a subnet by mask.
- The pool can come from the default pool setting or from an iRule; with neither, traffic cannot be balanced.
- Auto Last Hop (enabled by default) answers to the last hop's MAC rather than consulting the routing table.
Translation and access control
- Source Address Translation: None keeps the client address, Auto Map uses the self IP of the egress VLAN, a SNAT pool uses a chosen set of translation addresses.
- With None, servers must route replies back through the BIG-IP or the connection stalls after the handshake.
- Enabled VLANs restricts which VLANs may reach the listener; unlisted VLANs never match.
- Connection and rate limits, Action on Service Down (None, Reject, Drop, Reselect) and per-virtual-server acceleration complete the object.
Worked example
A pool behind 10.10.10.50:443 uses Source Address Translation None. Clients complete the TCP handshake, then time out; the application log shows the true client IP. Reasoning: the SYN reaches the server, but the server's default gateway is its rack router, which has no route to the client subnet, so the SYN-ACK never returns through the BIG-IP. Fixes: switch to Auto Map (the server then sees the egress self IP), add a route on the server pointing client subnets at a BIG-IP self IP, or use a SNAT pool plus X-Forwarded-For if the application must log client addresses.
Traps
- Treating Availability and Status as the same thing: a virtual server can be Enabled but Offline (all members down) or Disabled but Available.
- Forgetting the default pool on a wildcard virtual server.
- Expecting Auto Map to preserve the client address - it never does.
- Confusing Reject (sends a reset) with Drop (silent discard).