F5CABR (BIG-IP Recert) flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

TMOS full-proxy architecture

TMOS terminates each client connection and creates a separate server-side connection, allowing independent profiles, SSL, persistence, and iRules on each side.

Virtual server definition

A virtual server is a listener object matching destination IP address and port; it receives client traffic and directs it to a pool, an iRule, or another destination.

Pool member state up

A pool member is up when all assigned health monitors pass; only up members receive new connections unless the pool's service-down action permits otherwise.

Round robin default

Round robin is the default load balancing method; it distributes new connections to pool members in sequence, optionally weighted by each member's ratio setting.

Least connections method

Least connections sends each new connection to the pool member with the fewest active connections, adjusted by member ratio, making it suitable for uneven session lengths.

Monitor precedence

A monitor assigned directly to a pool member overrides the monitor inherited from the pool for that member; pool-level monitors apply to all members by default.

SNAT automap

Automap translates the client source address to the self IP of the egress VLAN toward the server; it is configured as a source address translation option on the virtual server.

Profile inheritance

Profiles inherit settings from a default profile and an optional parent profile; a child profile overrides only the values it explicitly changes.

Cookie persistence

Cookie persistence inserts or rewrites an HTTP cookie identifying the selected pool member; encrypted mode hides member details, and the persistence entry expires after the configured timeout.

iRule HTTP_REQUEST event

The HTTP_REQUEST event fires when a complete HTTP request is received; iRules can inspect headers, select a pool with the pool command, or redirect the request.

OneConnect profile

OneConnect reuses server-side TCP connections for multiple client requests, reducing handshake overhead; it is commonly paired with HTTP virtual servers.

SSL termination

The client SSL profile decrypts traffic at the BIG-IP; the server SSL profile can re-encrypt traffic toward pool members, enabling inspection in between.

SNI certificate selection

Server Name Indication lets one virtual server present different certificates per hostname; the client SSL profile needs an SNI entry and a default certificate fallback.

Certificate chain order

The server certificate must be first, followed by intermediate CA certificates; a missing intermediate causes client trust failures even when the leaf certificate is valid.

Client certificate authentication

The client SSL profile can request or require a client certificate and validate it against trusted certificate authorities; the peer certificate is exposed to iRules.

Traffic group

A traffic group is a floating set of self IPs and virtual addresses that moves between devices during failover; the active device owns the group's addresses.

Sync-failover device group

A sync-failover device group synchronizes configuration and supports automatic failover among its members; sync-only groups synchronize without moving traffic groups.

Config sync authority

The device holding config-sync authority pushes configuration to group members; device trust must be established first, and out-of-sync devices do not receive automatic pushes.

Connection mirroring

Connection and persistence mirroring replicate session state to the standby device so established sessions survive failover; it requires a dedicated network path.

VLAN interface tagging

A VLAN is bound to interfaces as tagged or untagged; it must have at least one interface or trunk member before traffic can flow through it.

Self IP purpose

A self IP is an address on a VLAN used for termination of management and monitoring traffic and as a SNAT source; it is not intended as a virtual server destination.

Floating self IP

A floating self IP belongs to a traffic group and moves to the active device during failover; non-floating self IPs remain on their own device.

SNAT pool

A SNAT pool is a set of translation addresses used for server-side source address translation; it is referenced by a virtual server or iRule instead of automap.

APM access policy

An APM access policy evaluates authentication, authorization, and session variables before allowing a connection; it is attached to a virtual server through an access profile.

AFM firewall default deny

AFM firewall rules match address, port, protocol, and VLAN; traffic not explicitly allowed by a rule is dropped by the default deny rule.

ASM enforcement modes

ASM security policies run in transparent, blocking, or disabled mode; blocking mode rejects requests that violate the policy, while transparent mode only logs them.

Health monitor layering

A pool member is up only when all assigned monitors pass; monitor type determines the check, such as ICMP, TCP, HTTP, or HTTPS.

qkview diagnostic bundle

The qkview command collects configuration, logs, and system state into one file for support analysis; it is the standard first step for complex troubleshooting.

Boot location upgrade

Software upgrades install into a new boot volume; the system boots into it and the previous volume remains available for rollback if the upgrade fails.

tcpdump on BIG-IP

tcpdump captures traffic on a VLAN or interface, optionally filtered by host or port, and writes to a file for analysis of connection and handshake problems.

Persistence timeout

When a persistence entry expires, a returning client may be load balanced to a different pool member; the timeout interacts with the virtual server idle timeout.

Wildcard virtual server

A wildcard virtual server matches any destination address on a port, often 0.0.0.0/0, and forwards matching traffic to a pool or a VLAN-based default destination.