F5-CSE cheat sheet

BIG-IP runs TMOS on top of a Linux kernel; TMM is the user-space process that owns the data plane, while icrd, tmmd, and the REST worker handle control-plane duties.

Full-proxy architecture: a client-side TCP connection terminates at the virtual server and a separate server-side connection is opened to the pool member, so the client and server never share a socket.

FastL4 (packet-by-packet) forwards without terminating TCP; Full NAT and standard virtual servers terminate and re-originate. Choose FastL4 only when L7 inspection is unnecessary.

Default traffic path is client → TMM → server; when a VLAN is not assigned to TMM, traffic falls back to the kernel path, causing a performance drop and /var/log/tmm entries.

PVA (Packet Velocity ASIC) and FPGA/DPDK offload acceleration apply only to eligible flows; SSL and iRules force traffic back into TMM software processing.

Troubleshooting order: /var/log/ltm (tmm and config events), /var/log/ltm and /var/log/audit for config changes, tcpdump :n on the relevant VLAN, then tmctl for counters.

tmsh commands: show sys version, show sys hardware, show net interface, show net vlan, show sys tmm-traffic, show sys performance all-stats.

Connection table limits: default SNAT and node connection limits and memory-based connection table sizing determine how many concurrent flows a platform can hold; watch tmctl for table-full events.

A virtual server with no matching VLAN, no listener, or an address in a non-routable subnet will not receive traffic; verify with show ltm virtual and a tcpdump on the client VLAN.

Virtual server = destination address:port plus a listener; pool = ordered set of nodes:port; node = IP address object; pool member = node plus service port.

Load balancing methods: Round Robin, Least Connections (node or member), Observed (member or node), Predictive, Ratio, Least Sessions, Dynamic Ratio, Fastest, and Priority Group Activation.

Least Connections sends to the member with the fewest current connections; Least Connections (member) counts per member, (node) aggregates all members of the same node.

Observed uses a per-member performance score derived from server latency and volume; it decays over time, so a recovered member regains traffic gradually.

Priority Group Activation: members share a priority; the BIG-IP sends traffic only to the highest active priority group that meets the minimum-active-members threshold.

Pool member states: up (green), down (red, monitor failed), checking (blue), disabled (forced offline by admin), and forced offline; only up or checking members receive traffic.

Ratio and Dynamic Ratio weight members; Dynamic Ratio reads SNMP or a monitor-provided metric and is commonly paired with a health monitor that reports load.

OneConnect (connection reuse) keeps server-side connections open for reuse; it changes connection counts seen by Least Connections and can mask per-client behavior.

A virtual server's default pool can be overridden by an iRule with pool ; if no pool is selected and no default pool exists, the connection is reset.

Profiles are inherited and layered: a parent profile supplies defaults, the child overrides selected settings; the default profile for a type is the parent unless another is specified.

Persistence methods: source address, cookie, SSL session ID, destination address, hash, SIP, and universal. Cookie persistence inserts a BIG-IP cookie naming the selected pool member.

Cookie persistence modes: HTTP Cookie Insert (BIG-IP sets the cookie), Rewrite (existing app cookie is rewritten), Passive (BIG-IP reads an existing cookie), and Hash.

Persistence timeout is separate from the TCP idle timeout; when the persistence entry expires, the next connection is load balanced afresh.

Monitors: interval (how often), timeout (how long to wait), and send/recv strings. Three consecutive failures mark a member down by default; the monitor's up/down counts can change this.

Monitor types include ICMP, TCP, TCP Half Open, HTTP, HTTPS, UDP, and scripted external monitors; a member must pass all monitors assigned to it to be marked up.

iRule events: CLIENT_ACCEPTED, HTTP_REQUEST, HTTP_RESPONSE, LB_SELECTED, SERVER_CONNECTED, and RULE_INIT. Use pool, persist, and node commands to steer traffic.

iRules run in TMM and add latency; prefer profiles or local traffic policies for simple steering, and keep iRule logic short and free of blocking calls.

Local traffic policies can match on host, path, header, or source address and execute forward, redirect, or select-pool actions without iRule code.

SSL termination uses a Client SSL profile (certificate plus key) on the virtual server; re-encryption to the pool uses a Server SSL profile on the same virtual server.

Certificate and key must match; import with tmsh install sys crypto cert from-local-file and install sys crypto key from-local-file .

Certificate chain order matters: the leaf certificate first, then intermediates; a missing intermediate causes client trust failures even if the leaf is valid.

SSL profiles control protocol versions (TLS 1.2/1.3), cipher string, session renegotiation, and session cache; the default cipher string is a curated list, not the OpenSSL default.

SNI allows one virtual server to present different certificates per hostname; enable it in the Client SSL profile and attach multiple cert/key pairs.

OCSP stapling lets the BIG-IP fetch and cache the responder's proof and staple it to the handshake; configure the OCSP responder URL in the Client SSL profile.

SSL session persistence uses the SSL session ID; with TLS 1.3 and session tickets, verify behavior against the persistence profile in use.

Certificate expiration is tracked by the system; check with tmsh show sys crypto cert and monitor the certificate expiration alert, which fires before expiry.

Hardware SSL acceleration requires the key to be imported as an HSM or FIPS key; software keys cannot use the crypto offload path.

AFM (Advanced Firewall Manager) enforces firewall policies, DoS protection, and IP intelligence; a default-deny stance requires explicit allow rules per virtual server or self IP.

ASM (Advanced WAF) protects web apps with a security policy, attack signatures, and bot defense; a policy in transparent mode logs violations without blocking.

APM provides access policy enforcement: an access profile with a visual policy editor flow (authentication, SSO, endpoint checks) gates the virtual server.

Network security constructs: packet filters, VLAN-based ACLs, and self IP port lockdown (default allows only 22, 443, and a few management ports).

LTM SYN cookie protection (TCP profile) mitigates SYN floods by deferring the connection state until the handshake completes.

Connection limits per virtual server, pool, and member, plus rate limits (connection and bandwidth), bound abuse from a single source.

iRules and local traffic policies can reject traffic by source, geography (via IP intelligence), or header; they are not a substitute for a full WAF signature set.

Management access hardening: restrict the management interface to a dedicated network, disable unused services, and use remote authentication (LDAP, RADIUS, TACACS+).

Data plane vs control plane separation: management traffic terminates on the management interface, not on TMM, and must be firewalled independently.

Device group types: Sync-Failover (config and connection state sync with failover) and Sync-Only (config sync without failover); trust domain is established with a device group and trust.

Failover triggers: heartbeat loss, monitored object failure (VLAN, self IP, pool member), and forced offline; failover state is active, standby, or offline.

Config sync pushes the configuration from the sync leader to peers; it does not sync certificates' private keys unless the keys are in the device group's sync scope.

Connection mirroring replicates persistence and connection state to the standby so established flows survive failover; it requires a mirroring VLAN and is enabled per virtual server.

Network failover uses a failover multicast or unicast address on a VLAN; it is independent of the config sync channel.

Traffic group MAC masquerade lets a floating traffic group share a MAC, reducing switch MAC-table churn during failover.

Maintenance: archive UCS files with tmsh save sys ucs, back up before upgrades, and use tmsh load sys ucs to restore; check /var/log/ltm after any restore.

Upgrades follow an install-to-inactive-partition model; activate the new volume with tmsh install sys software and switchboot, then verify before committing.

Health and capacity checks: show sys hardware, show sys performance all-stats, show sys tmm-traffic, and monitor disk usage on /var/log and /shared.