F5-302 flashcards
F5-302 · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Standard virtual server
- An L4 virtual server that forwards TCP or UDP traffic to a pool; it performs full proxy and supports iRules and L7 profiles, unlike Performance L4 which forwards packets without proxy processing.
- Priority Group Activation
- A pool setting that balances traffic only among members of the highest-priority group that has at least the configured minimum number of available members; lower groups activate only when that threshold is not met.
- Persistence profile
- A profile that maps a returning client to the same pool member using source IP, cookie, SSL session ID, or hash; it is evaluated before the load-balancing method and lasts for the configured timeout.
- SNAT automap
- A virtual server setting that translates the client source address to the virtual server's self IP; an explicit SNAT pool is used instead when a specific translation address is required.
- OneConnect profile
- A profile that pools and reuses server-side TCP connections across many client connections; it requires an HTTP profile and can break protocols that depend on per-connection state, such as NTLM.
- Pool member versus node
- A node is a server address; a pool member is a node plus a service port plus optional ratio and priority; monitors and load balancing apply to the pool member, not the node directly.
- iRule event order
- Events fire in a fixed sequence: RULE_INIT, CLIENT_ACCEPTED, HTTP_REQUEST, LB_SELECTED, SERVER_CONNECTED, HTTP_RESPONSE, CLIENT_CLOSED; commands like pool and persist take effect at the event where they run.
- Health monitor timing
- A monitor's interval is the seconds between checks, timeout is the maximum wait for a response, and the up/down counts set how many consecutive results are needed to change member state.
- Default pool
- The pool a virtual server uses when no iRule selects one; if it has no available members, the connection fails unless a fallback host or all-services-down action is configured.
- Virtual server states
- Enabled or Disabled controls whether the virtual server accepts new connections; Available or Offline controls whether it is listening; both must be enabled and available to serve traffic.
- ASM enforcement modes
- Transparent logs violations without blocking, Blocking blocks them, and Learn builds policy suggestions from observed traffic; the mode is set per policy and can be overridden per attack type.
- Positive versus negative security
- Positive security is a whitelist of allowed URLs, parameters, and cookies; negative security uses attack signatures and attack types; a policy can combine both approaches.
- Learning suggestions
- Suggestions generated from traffic while a policy is in Learn mode; they do not change the policy until accepted, and an accepted suggestion can later be reverted.
- IP reputation
- A feature that uses a subscribed intelligence feed of known-bad addresses; when enabled in a policy, requests from listed addresses are blocked or alarmed according to the policy setting.
- Attack types
- Categories such as SQL injection, cross-site scripting, command injection, and buffer overflow; each can be set to Alarm, Block, or Alarm and Block independently of the signature sets.
- Access policy flow
- A visual sequence of items starting at Start and ending at Allow, Deny, or Redirect; items include authentication, authorization, assignment, logging, and branching on session variables.
- Session variables
- Named values such as session.user or session.group that persist for the access session and are read by branch items to decide the path through the access policy.
- Access profile SSO
- A setting that defines how APM signs the user on to the backend application; methods include form-based, NTLM, Kerberos, and SAML, and it is separate from the client-side authentication method.
- Per-request access policy
- A policy evaluated on each HTTP request rather than only at login; it is attached separately from the main access profile and is used for portal or per-URL authorization.
- Network access resource
- An APM resource that grants VPN connectivity; it requires a connectivity profile and an IP address pool, and the access policy assigns the ACL to the session.
- Wide IP
- A GTM object that maps a fully qualified domain name to a pool of virtual servers or addresses; GTM answers DNS queries for the wide IP using the configured load-balancing method.
- GTM load-balancing methods
- Methods that choose which pool member is returned in a DNS answer, including Round Robin, Global Availability, Ratio, Topology, Least Connections, Virtual Server Score, and Return to DNS.
- Topology load balancing
- A GTM method that maps the client's source address to a preferred pool member using a topology database of region, ISP, and network records; the highest-scoring match wins.
- DNS Express
- A feature that serves authoritative DNS answers directly from the BIG-IP using loaded zone data, without a backend DNS server, to offload or replace an existing DNS server.
- GTM health check
- A monitor attached to a GTM pool member; a member is marked down after the configured consecutive failures and is excluded from DNS answers until it recovers.
- Connection statistics
- Per-object counters including current connections, total connections, bits in and out, and requests; they are viewed per virtual server, pool, pool member, or node and reset on an interval or manually.
- Log types
- The LTM log records iRule log output and system events, the audit log records configuration changes, and the ASM log records security violations; each has its own destination and verbosity.
- SNMP traps
- Notifications sent by the BIG-IP on state changes such as a pool member going down; the community string and trap destination are configured in system settings.
- Analytics (AVR)
- A feature providing per-application traffic statistics, latency, and response codes; it requires an analytics profile attached to the virtual server and a data collection setting.
- Monitor mismatch
- The most common cause of a member marked down while the application is healthy: the monitor's send string, recv string, or port does not match what the application actually returns.
- NTLM and OneConnect
- NTLM needs per-connection authentication state; reusing server connections with OneConnect breaks it unless NTLM handling is enabled, so disable OneConnect or enable NTLM handling.
- SSL chain error
- A client trust failure usually means the ClientSSL profile certificate is missing an intermediate certificate or the key does not match; the SNI setting must also match the requested hostname.