F5-CSE flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

TMM process role

TMM is the user-space data-plane process in TMOS that terminates and forwards connections, runs iRules, and applies profiles; control-plane daemons configure it via shared memory.

Full-proxy architecture

The BIG-IP terminates the client TCP connection and opens a separate server-side connection, so it can inspect and modify L7 payloads and apply independent profiles per side.

FastL4 virtual server

A packet-by-packet forwarding mode that does not terminate TCP or inspect L7; it is used for high-throughput flows where no iRules or content inspection are needed.

Kernel traffic path

When a VLAN is not assigned to TMM, traffic falls back to the Linux kernel path, reducing throughput and adding latency; verify VLAN assignment when performance drops.

PVA and DPDK offload

Hardware or polling-based acceleration for eligible flows; SSL termination and iRule processing force traffic back into software TMM, so offload does not apply to those flows.

tcpdump on BIG-IP

Capture with tcpdump -ni <vlan> port <port> to see traffic on a specific VLAN; the interface name is the VLAN name, not eth0, in most TMOS versions.

tmctl counters

tmctl exposes live TMM statistics and tables; use it to check connection table fullness, monitor results, and per-virtual counters that do not appear in tmsh show.

Virtual server listener

A virtual server binds an address and port; without a matching listener or VLAN assignment, packets are not delivered to the virtual server and connections fail.

Pool member state colors

Green is up, red is down from monitor failure, blue is checking, and black or gray is disabled or forced offline; only up and checking members receive new connections.

Least Connections method

Sends each new connection to the pool member with the fewest active connections; the member variant counts per member, the node variant aggregates all members of a node.

Observed load balancing

Assigns each member a performance score based on latency and volume, then distributes traffic proportionally; scores decay so recovered members regain traffic gradually.

Priority Group Activation

Members are grouped by priority; traffic goes only to the highest-priority group that has at least the configured minimum number of active members.

Dynamic Ratio method

Weights members by a metric reported through SNMP or a monitor, so a busier or slower server receives proportionally less traffic than healthier peers.

OneConnect profile

Reuses server-side TCP connections for multiple client requests, reducing handshake overhead but changing the connection counts used by Least Connections.

Profile inheritance

A child profile inherits all settings from its parent and overrides only the fields you change; the default profile of a type is the usual parent.

Cookie persistence insert

The BIG-IP inserts its own cookie naming the selected pool member; subsequent requests carrying that cookie are sent to the same member until the persistence entry expires.

Monitor interval and timeout

Interval is how often the health check runs; timeout is how long to wait for a reply. Three consecutive failures typically mark a member down.

HTTP monitor send string

The request the monitor sends, such as GET /health HTTP/1.1 with a Host header; the recv string must appear in the response for the check to pass.

iRule LB_SELECTED event

Fires after the load balancing decision but before the server connection; it can inspect the chosen pool member and override the selection with node or pool commands.

Local traffic policy

A declarative ruleset that matches on host, path, header, or source and performs actions such as forward, redirect, or select pool, without writing iRule code.

Client SSL profile

Holds the certificate and key the virtual server presents to clients, plus protocol versions, cipher string, and SNI settings for the client-side handshake.

Server SSL profile

Controls re-encryption from the BIG-IP to pool members, including the trusted CA bundle used to verify server certificates; without it, traffic to servers is plaintext.

Certificate chain order

The leaf certificate must be listed first, followed by intermediates; a missing intermediate causes client trust errors even when the leaf itself is valid.

SNI on BIG-IP

Server Name Indication lets one virtual server present different certificates per hostname; enable it in the Client SSL profile and attach the matching cert and key pairs.

OCSP stapling

The BIG-IP queries the OCSP responder, caches the signed proof of revocation status, and staples it to the TLS handshake, reducing client-side lookup latency.

AFM default deny

Advanced Firewall Manager enforces firewall policies and DoS protection; a default-deny stance requires explicit allow rules for each virtual server or self IP.

ASM transparent mode

A web application security policy in transparent mode logs violations and raises events without blocking requests, which is used during tuning before enforcement.

APM access profile

An access policy built in the visual policy editor that performs authentication, SSO, and endpoint checks before the user reaches the protected virtual server.

Self IP port lockdown

Restricts which ports a self IP accepts; the default allows only management and a few services, so open additional ports deliberately rather than setting Allow All.

SYN cookie protection

A TCP profile setting that defers connection state until the three-way handshake completes, mitigating SYN flood exhaustion of the connection table.

Sync-Failover device group

A device group whose members synchronize configuration and, when configured, connection and persistence state, and which participates in automatic failover.

Connection mirroring

Replicates connection and persistence state to the standby device so established flows survive failover; it requires a mirroring VLAN and is enabled per virtual server.

UCS archive

A full configuration backup created with tmsh save sys ucs; it captures configuration and certificates but should be stored off-box before upgrades or changes.