Traffic Management
Traffic Management
The Traffic Management domain tests how BIG-IP decides where a connection goes and how it is shaped from client to pool member. Expect questions on virtual-server matching, profiles, load-balancing methods, persistence, source address translation, and health monitors.
Core rules
- A virtual server has a destination (address:port), a listener (VLAN or network), and a default pool. The most specific destination match wins; a host-and-port virtual server beats a host-only or network virtual server.
- Profiles are layered and validated for compatibility: an HTTP profile requires a TCP profile, and a client SSL profile requires a TCP profile. Client-side profiles decrypt and parse traffic before pool selection.
- Pool selection uses the configured method: round robin, least connections, observed, predictive, ratio, or priority group. Persistence overrides the method for subsequent connections.
- Source address translation can be automap, a SNAT pool, or a named SNAT. Without it, pool members see the client address and may route replies incorrectly.
- A monitor marks a member up or down; a down member receives no new connections unless the pool has no up members and a fallback is configured.
Worked example
A client opens HTTPS to 203.0.113.10:443. The virtual server destination is 203.0.113.10:443, with a client SSL profile, an HTTP profile, a cookie persistence profile, and a pool of two members using least connections. The client TCP handshake terminates on BIG-IP; SSL is decrypted; HTTP is parsed; the pool is chosen; least connections picks member B; BIG-IP opens a server-side TCP connection, optionally SNATs the source, and inserts a persistence cookie. Later requests from the same client carry the cookie and go to member B even if member A now has fewer connections.
Traps
- Confusing the virtual address with the destination: a wildcard destination can capture traffic meant for a more specific virtual server.
- Forgetting that persistence wins over load balancing after the first connection.
- Assuming a monitor failure always means the application is down; the monitor may test the wrong port or URI.
- Overlooking that a VLAN listener restricts which VLANs can reach the virtual server.