F5-304 cheat sheet

A full proxy terminates the client-side TCP connection and originates a separate server-side connection, so each side can use independent TCP profiles, TLS settings, and timeouts.

The default load-balancing method is Round Robin; Least Connections selects the pool member with the fewest active connections and is preferred when session durations vary widely.

Priority Group Activation: members in the highest-priority group that has at least one available member receive traffic; lower-priority groups are used only when all higher-priority members are down.

A virtual server's destination is matched by address and port; a wildcard port (0 or * ) matches any port, and the most specific match wins over a wildcard match.

Persistence (e.g., source-address affinity, cookie persistence) overrides load-balancing selection for the duration of the persistence entry's timeout.

OneConnect connection reuse pools idle server-side TCP connections so multiple client requests can share them; it requires HTTP profile processing and is incompatible with NTLM without special handling.

Health monitors mark a member up or down; a member must pass the monitor for the configured interval and retries before it is placed in service, and a single failed check can mark it down.

SSL termination on the virtual server means the BIG-IP decrypts client traffic; SSL bridging re-encrypts to the pool, and SSL pass-through forwards encrypted bytes without inspection.

Configuration objects live in administrative partitions; a virtual server can reference pool members only within its own partition or a partition it has been granted access to.

iRules events fire in order: CLIENT_ACCEPTED, CLIENT_DATA, HTTP_REQUEST, LB_SELECTED, SERVER_CONNECTED, HTTP_RESPONSE, HTTP_RESPONSE_DATA, SERVER_CLOSED, CLIENT_CLOSED.

Within an iRule, 'pool' commands set the target pool; 'node' commands bypass the pool and send traffic directly to a specific address and port.

Profiles are inherited by child profiles; a virtual server applies exactly one profile of each type (TCP, HTTP, SSL, etc.), and the profile's parent chain supplies defaults.

A virtual server of type Standard handles TCP/UDP; type Performance (HTTP) and Performance (Layer 4) use fastL4 or optimized paths and cannot use iRules that require full payload parsing.

SNAT automap uses the virtual server's own self IP as the translation address; a SNAT pool provides a fixed set of translation addresses and is required when routing demands a specific source address.

A pool member's ratio applies only to Ratio-based load-balancing methods (Ratio, Ratio Member); it has no effect on Round Robin or Least Connections.

The default idle timeout for a virtual server is 300 seconds for TCP; a value of 0 means the connection never times out and should be used deliberately.

An Access Policy (APM) is a per-request visual policy flow attached to a virtual server; successful termination issues a session and typically a session cookie, while a deny branch blocks the request.

APM sessions are stored in an access profile with a configured maximum session timeout and idle timeout; the shorter of the two triggers session expiry.

SSL profiles enforce protocol and cipher policy: a client SSL profile with a restricted cipher string rejects handshakes that do not match, before any HTTP processing occurs.

An LTM policy or iRule can drop traffic by source address, geography, or URI; a 'drop' action silently discards packets while 'reject' returns a TCP reset.

Device Service Clustering (DSC) with sync-failover keeps security policies consistent across peers; configuration changes must be synced to the peer or the standby device serves stale policy.

A WAF (ASM) security policy operates in transparent, blocking, or mixed enforcement mode; transparent mode logs violations without blocking, blocking mode rejects matching requests.

Mutual TLS requires the client to present a certificate that validates against a configured trust anchor in the client SSL profile's CA bundle; failure aborts the handshake.

Access policy branches are evaluated top to bottom; the first matching branch terminates evaluation, so ordering of decision boxes determines the outcome.

The primary log for traffic-processing events is /var/log/ltm; /var/log/apm covers access sessions and /var/log/audit records configuration changes.

tcpdump on the BIG-IP should be run against the relevant VLAN interface; use 'tcpdump -i 0.0:nnn -s0 -w /var/tmp/cap.pcap host ' to capture without truncation.

A virtual server showing 'offline' status means no pool members are available or the virtual server is disabled; check monitor status on pool members first.

Configuration sync status is shown in Device Management; 'Changes Pending' indicates local changes not yet pushed to the peer, and 'In Sync' confirms parity.

The qkview utility collects a diagnostic snapshot (logs, config, stats) for support; it does not modify configuration and is safe to run on production devices.

Statistics for virtual servers, pools, and members are available in the dashboard and via 'tmsh show ltm virtual' or the iControl REST statistics endpoints.

A failed configuration load commonly stems from a missing referenced object or partition mismatch; 'tmsh load sys config verify' checks syntax without applying changes.

High CPU on a virtual server is often caused by iRules that perform per-packet operations or by SSL handshake load; check 'tmsh show sys performance' and the iRule event statistics.