F5-302 key terms

A BIG-IP object that owns a destination IP address and port and listens for client traffic, then applies a profile and forwards the connection to a pool or other destination.

A named group of backend servers, called pool members, that receive traffic from a virtual server. Health monitors and load-balancing methods decide which member is selected.

A single IP address and port entry inside a pool. Its state (up, down, forced offline) is usually set by health monitors and determines whether it can receive new connections.

A BIG-IP object representing a backend host by IP address. Nodes are shared across pools, and a node's state can override the state of its associated pool members.

The algorithm a virtual server uses to choose a pool member for each new connection, such as round robin, least connections, or observed. Choice affects fairness and session distribution.

Configuration that keeps a client tied to the same pool member across connections, using methods such as source address, cookie, or SSL session ID. Essential for applications that store session state locally.

A probe that periodically checks a pool member or node and marks it up or down based on the response. Types include ICMP, TCP, HTTP, and HTTPS, each with interval and timeout settings.

A reusable settings object attached to a virtual server that controls protocol behavior, such as TCP, HTTP, client SSL, or server SSL. Profiles are inherited and can be layered.

A Tcl-based script bound to a virtual server that runs on named events like HTTP_REQUEST or CLIENT_ACCEPTED. Used for custom routing, header rewriting, redirects, and logging.

A declarative, GUI-managed set of rules that match on conditions such as host, path, or source address and then take actions like forward, redirect, or select a pool. An alternative to iRules for common cases.

Source network address translation, which changes the source IP of traffic leaving the BIG-IP toward pool members. It can be automatic, using a self IP, or configured with a SNAT pool.

A group of translation addresses used for source NAT when automatic SNAT is not suitable. Allows scaling and control over which source address backend servers see.

A Layer 2 broadcast domain configured on the BIG-IP with tagged or untagged interfaces. Virtual servers can be restricted to specific VLANs to control where traffic is accepted.

An IP address assigned to a VLAN on the BIG-IP itself, used for management traffic, SNAT, and as the source for health monitor probes. Each self IP belongs to exactly one VLAN.

A logical separation of the IP address space on the BIG-IP, allowing overlapping addresses in different domains. Objects in different route domains must use the %id notation to communicate.

The dedicated out-of-band port used for administration, typically accessed over HTTPS, SSH, and iControl REST. Its address and routes are configured separately from traffic-handling interfaces.

A container that separates configuration objects so multiple tenants or teams can share one BIG-IP. Users are granted access per partition, and objects are referenced by partition path.

Profile that defines the certificate, key, and TLS settings the BIG-IP presents to clients. Enables SSL offload, re-encryption, and control over protocol versions and ciphers.

Profile that controls how the BIG-IP acts as a TLS client toward pool members, including which certificate authorities it trusts and which protocols it offers. Used for re-encryption.

A security policy enforced on the BIG-IP that inspects HTTP traffic for attacks such as SQL injection and cross-site scripting. Policies can run in blocking or transparent mode and use learned entities.

The container that holds WAF enforcement settings, signatures, and violations for one or more virtual servers. It defines whether traffic is blocked, alarmed, or allowed per violation type.

A pattern that matches known malicious request content, such as SQL injection strings. Signatures are organized in sets and can be enabled, disabled, or tuned per policy.

A WAF mode where the system observes traffic and builds suggested entities, such as URLs and parameters, without blocking. Suggestions can later be accepted into the policy to reduce false positives.

A visual flow in APM that defines how users authenticate and are authorized before reaching a resource. It is made of action items such as logon, decision, and resource assignment.

The APM object that binds an access policy to a virtual server and controls session settings, such as cookie name, timeout, and landing URI.

An APM policy evaluated on every HTTP request rather than only at session start. Used for scenarios such as application-level authorization and step-up authentication.

An APM feature that lets a user authenticate once and be automatically signed in to backend applications, using methods such as form-based, Kerberos, or SAML credential mapping.

A GTM object representing a fully qualified domain name that clients resolve. It holds pools of virtual servers or addresses and a load-balancing method for DNS answers.

A group of virtual servers or IP addresses that a wide IP can return in DNS responses. Members are monitored for availability and can be weighted or prioritized.

A GTM feature that answers DNS queries from a zone transferred from an authoritative server, providing fast responses without full recursive resolution. Reduces load on backend DNS infrastructure.

The process of copying a DNS zone from a primary server to another server, typically using AXFR or IXFR. DNS Express relies on it to keep its zone data current.

Configuration that enables collection of traffic statistics on a virtual server, such as HTTP response codes, latency, and throughput. Data is viewed in the analytics dashboards.

A profile that records selected request and response details to a remote syslog or local log. Useful for auditing and for troubleshooting application behavior without packet capture.

The packet capture utility available from the BIG-IP command line. Captures can be written to a file and analyzed to confirm whether traffic reaches and leaves the device.

The REST API for configuring and monitoring the BIG-IP over HTTPS. Supports GET, POST, PATCH, and DELETE on configuration objects and is used for automation.

A persistence method that inserts or reads a cookie to identify which pool member served a client, so later requests return to the same member. Common for HTTP applications with local session state.

A profile that enables HTTP parsing on a virtual server, allowing header insertion, compression, and URI-based routing. Required for most Layer 7 features and for cookie persistence.