F5-CA cheat sheet

BIG-IP administrative partitions divide the configuration into separate administrative domains; an object in one partition is not visible to users whose role is scoped to another partition unless they have access to the common partition.

Role-based access: the Administrator role has full access including user and partition management; Resource Administrator manages objects within assigned partitions but cannot manage users; Auditor is read-only; Application Security Administrator and Certificate Manager are narrower roles tied to specific object types.

Configuration sync: a device group defines which devices share configuration; a traffic group defines which device actively hosts a floating virtual address. Sync and failover are separate operations-syncing configuration does not move traffic.

tmsh is the single-configuration-shell CLI; commands follow the pattern tmsh , for example tmsh save sys config writes the running configuration to the stored configuration files.

Configuration states: the running configuration is in memory, the stored configuration is on disk, and a saved UCS archive is a full backup including configuration and licensing; loading a UCS replaces the entire configuration.

Licensing: license files are tied to the platform or to a registration key for virtual editions; an add-on license such as ASM, APM, or LTM must match the registration key and the maximum bandwidth or instance limits.

High availability: active/standby pairs use network failover and/or hard-wired failover; a device is active for a traffic group when it holds the active state for that group, and the standby device monitors health via heartbeats.

Logging and monitoring: remote syslog is configured per destination with a severity filter; SNMP traps and polling are configured separately, and statistics are read from the statistics database, not from the configuration.

Value framing rule: lead with the business outcome (reduced downtime, faster app delivery, lower cost per app) and quantify it with the customer's own numbers before describing product features.

Discovery sequence: current state, business drivers, technical constraints, decision process and timeline, budget owner. A deal without an identified economic buyer and a compelling event stalls in the forecast.

Total cost of ownership comparison must include hardware refresh, licensing, support, operational labor, and downtime cost; a per-app cost metric normalizes comparisons across portfolios.

Deal qualification: distinguish budget, authority, need, and timeline; forecast categories should be evidence-based (validated need and dated next step), not optimism-based.

Competitive displacement: when the incumbent is a load balancer only, the differentiator is consolidation of ADC, application security, and access into one platform, reducing the number of appliances and policy points.

Subscription versus perpetual: subscription bundles hardware, software, and support into a recurring payment; the comparison must account for refresh cycles and cash-flow preference, not just the multi-year total.

Proof of value: define measurable success criteria before a trial (for example, reduced latency, blocked attacks, hours saved per deployment) and agree who signs off on the result.

Renewal risk: track support and subscription expiry dates; an expired support contract removes access to software updates and weakens the renewal conversation.

LTM (Local Traffic Manager) is the core full-proxy ADC: virtual servers, pools, pool members, monitors, persistence profiles, and iRules for programmable traffic logic.

ASM (Application Security Manager) is a web application firewall that enforces a positive security model via learned or manual security policies; it can run in transparent, blocking, or transparent-with-blocking mode.

APM (Access Policy Manager) provides identity-aware access: authentication, authorization, endpoint posture checks, and secure remote access including client-based and clientless VPN.

DNS (formerly GTM) distributes traffic across sites and data centers using wide IPs, global availability, and load-balancing methods such as round robin, ratio, global availability, and topology.

AFM (Advanced Firewall Manager) provides a network firewall, DDoS protection, and IP intelligence on the BIG-IP platform; it operates on flows and addresses, distinct from ASM's application-layer inspection.

SSL Orchestrator centralizes TLS decryption and re-encryption and steers traffic to service chains of inspection devices; it avoids decrypting separately at every security tool.

NGINX and F5 Distributed Cloud extend the portfolio: NGINX for software load balancing and ingress, Distributed Cloud for SaaS-delivered WAF, bot defense, and multi-cloud networking.

iRules use TCL syntax and event-driven commands (for example HTTP_REQUEST, CLIENT_ACCEPTED) to inspect or modify traffic; iRules LX allows Node.js-based extensions.

Cloud architecture rule: in public cloud, prefer autoscaling managed instances or the vendor's cloud-native service over fixed appliance pairs, because elastic scaling and API-driven lifecycle management are the platform's native model.

Security layering: WAF protects against application-layer attacks (injection, cross-site scripting), DDoS protection absorbs volumetric and protocol attacks, and access control governs who reaches the application; each addresses a different threat class.

TLS visibility: encrypted traffic defeats inspection tools; decryption must occur once at a central point and re-encrypt to tools, with policy for exempt categories such as financial or health data.

Multi-cloud consistency: a common policy and configuration model across on-premises and cloud reduces operational variance; per-environment drift is the main cause of security gaps.

Zero trust framing: authenticate and authorize every request based on identity and device posture rather than network location; access policy is enforced at the application edge.

Deployment models: hardware appliance, virtual edition, cloud marketplace image, and SaaS service. Selection depends on throughput, latency, compliance, and operational ownership.

High availability in cloud: use DNS-based failover or cloud load balancers across availability zones; traditional floating IP failover is often unavailable or impractical in public cloud networks.

Bot defense: distinguish good bots (search engines, monitoring) from bad bots (scraping, credential stuffing) using behavioral signals, and apply mitigation progressively to avoid blocking legitimate automation.

Health monitors determine member availability; a monitor marks a member down after a configured number of failures and up after successes. Monitor type must match the service (HTTP vs TCP vs ICMP).

Persistence rule: source-address persistence pins a client to a member; cookie persistence inserts or inspects an HTTP cookie. Persistence overrides load-balancing method for the duration of the persistence entry.

Virtual server types: standard (full proxy), performance HTTP, forwarding (IP), and network. A forwarding virtual server does not terminate connections and cannot apply L7 profiles.

Connection limits: a virtual server or pool member can enforce maximum concurrent connections and rate limits; exceeding them results in resets or queuing depending on configuration.

Troubleshooting order: verify virtual server state and availability, then pool member health, then monitor status, then persistence and profiles, then iRules and logs.

Packet capture and tcpdump on the BIG-IP, plus the request logging profile, are the primary tools for confirming whether traffic reaches and leaves the device.

Upgrade planning: read release notes for deprecated features, confirm add-on license compatibility, and verify configuration compatibility before loading a new software image; a UCS backup precedes any upgrade.

Renewal motion: begin the renewal conversation at least one quarter before expiry, confirm the installed base and serial numbers, and identify any add-on licenses that are no longer used.

Expansion signal: high CPU or connection utilization on existing devices, or repeated manual change requests, indicates capacity or automation gaps worth a refresh conversation.

Discount governance: discounts above the approved threshold require deal registration or management approval; the business case should document competitive pressure and strategic value.

Multi-year subscription: a three-year term typically lowers the annual cost versus annual renewal and improves forecast predictability; the customer trades flexibility for price.

Partner involvement: resellers and distributors affect margin and deal registration; confirm who owns the customer relationship before quoting to avoid channel conflict.

Proof metrics for the business case: cost per application, incidents avoided, deployment lead time, and percentage of traffic inspected. Use customer-supplied baselines rather than vendor averages.

BIG-IQ provides centralized management across many BIG-IP devices: device discovery, configuration backup, license management, and application-centric deployment templates.

Declarative onboarding and AS3 (Application Services 3 extension) let administrators describe desired application configuration as a JSON declaration; the platform reconciles actual state to the declaration.

DO (Declarative Onboarding) handles device-level configuration such as networking, licensing, and clustering; AS3 handles application services such as virtual servers and pools.

Telemetry Streaming (TS) exports statistics and events to analytics endpoints; it is configuration-driven and separate from the logging profiles used for request logs.

iControl REST exposes the configuration and statistics over HTTPS; automation should target supported endpoints and be version-checked, because schema details vary by release.

Certificate management: SSL certificates and keys are stored in the device's certificate store; Certificate Manager role and centralized management reduce the risk of expired certificates causing outages.

Anomaly detection in ASM learns normal traffic patterns and flags deviations, reducing the tuning burden compared with purely manual policy adjustments.

Cloud-native service selection: choose a managed WAF/CDN service when the customer wants no infrastructure ownership; choose virtual editions when policy must run inside the customer's VPC or on-premises.

Ingress and API gateway: Kubernetes ingress controllers and API gateways handle north-south traffic and API routing; service mesh handles east-west service-to-service traffic with mutual TLS.

Resilience design: spread across availability zones, use health-checked DNS or global server load balancing for region failover, and define recovery time and recovery point objectives explicitly.

Observability: collect metrics, logs, and traces from the edge and from applications; without a baseline, anomaly detection and capacity planning are guesswork.

Compliance mapping: data residency, encryption in transit and at rest, and audit logging requirements drive whether traffic must be inspected locally or can be handed to a SaaS service.

Migration pattern: lift-and-shift of appliance pairs into cloud often produces idle capacity; refactor to autoscaling groups or managed services to match elastic demand.