I85PREP
⌘ K
F5-303 study materials
F5-303 study resources

F5-303: Application Delivery and Security Platform fundamentals

F5-303 · Work through your exam, one topic at a time.

All guide sections

Application Delivery and Security Platform fundamentals

Domain 1 tests the platform knowledge the exam assumes before you configure anything: how BIG-IP forwards and inspects traffic, which module owns which behaviour, and how licensing and form factor constrain design. Scenario questions usually frame a requirement and expect you to name the subsystem responsible.

Control plane versus data plane

  • TMOS is the operating system; TMM (Traffic Management Microkernel) is the data-plane process that owns virtual servers, pools, persistence and iRules and moves the packets.
  • Control-plane daemons (mcpd, sod, restjavad, icrd) push configuration into TMM and answer the GUI and REST. A slow GUI or a hung tmsh session does not mean forwarding has stopped.
  • Full proxy terminates client TCP and opens a separate server-side connection, which is what makes HTTP parsing, SSL offload and content switching possible. fastL4 forwards packets with minimal inspection.

Modules and form factors

  • LTM does local traffic management; ASM (Advanced WAF) enforces L7 security policy; APM handles access and SSO; DNS provides GSLB and authoritative zones; AFM provides network firewall and DDoS protection; AVR supplies analytics.
  • Hardware, virtual edition (VE) and cloud images share the configuration model, but VE throughput and SSL TPS are licence-bound, so identical configurations can behave differently at a lower tier.
  • The virtual server is the front door: destination address and port, a profile set, and a pool reached through a load-balancing method plus optional persistence.

Worked example

A client requests https://app.example.com. Reasoning in order: TMM accepts the SYN on the client VLAN and matches the virtual server by destination IP and port; the client-ssl profile terminates TLS, which lets the HTTP profile parse and route the request; persistence is evaluated, then the load-balancing method selects an available pool member; SNAT (automap or a SNAT pool) sets the source address toward the server; an optional server-ssl profile re-encrypts. If asked where the certificate belongs, the answer is the client-ssl profile on the virtual server, never the pool.

Traps that cost marks

  • Assuming iRules run on the control plane; they execute inside TMM per connection.
  • Treating a GUI or REST slowdown as a traffic outage.
  • Assuming a VE has unlimited throughput or unlimited SSL handshakes.