F5 101(2)

Front 1

LTM

Back 1

Local Traffic Manager

Full proxy between users and application servers. Creates a layer of abstraction to secure, optimize, and load balance application traffic.

Front 2

GTM

Back 2

Global Traffic Manager

Automatically routes connections to the closest or best performing data center in the event of an outage, overload, or other disruption.

Front 3

APM

Back 3

Access Policy Manager

Provides secure, context-aware , and policy-based access control. It centralizes and simplifies AAA management directly on the BIG-IP system

Front 4

ASM

Back 4

Advanced web application firewall that protects critical applications and their data by defending against application specific attacks that bypass conventional firewalls

Front 5

Edge Gateway

Back 5

Provides SSL VPN remote access security with applications acceleration and optimization services at the edge of the network.

Front 6

Link Controller

Back 6

Prevents costly downtime due to ISP problems or other link failures by autmatically switching traffic to alternate ISP connections and ensuring use of the fastest available connection

Front 7

WOM

Back 7

WAN optimization Manager

Overcomes network and application issues on the WAN to ensure that application performance, data replication, and disaster recovery requirements are met.

Front 8

WebAccelerator

Back 8

Give your users an instant improvement in web application performance ad helps reduce costs. By offloading your network and servers, BIG-IP WEBaccelerator decreases your spending on additional bandwidth and new hardware

Front 9

ARX Series

Back 9

Evnable you to dramatically simplify data management and reduce storage costs.
File virtualization results in dramatic improvement in cost,agility and business efficiency

Front 10

FirePass

Back 10

Allows users secure access from anywhere they have an Internet connection, while Firepass ensures that connected computers are fully patched and protefcted

Front 11

4 LTM inital set up steps

Back 11

1. Setup MGMT port IP address via config utility

2. License the system through web interface

3. Run the setup utility

Front 12

Default ltm MGMT port IP address?

Back 12

192.168.1.245

Front 13

To gain a license, you need to use your registration key to generage what?

Back 13

a Dossier and them present the dossier to the license server

Front 14

Base registration key is how many characters?

Back 14

27

Front 15

Systems are shipped with your registration key where?

Back 15

/config/RegKey.license

Front 16

After generating the dossier, what is it names and where is it located?

Back 16

/config/bigip.license

Front 17

Dedicated

Back 17

designed for situations wher eonyl one module is functional on the system, such as GTM

Front 18

Moninal

Back 18

Gives the module its minimun functional resources and distributes additional resources to the module if they are available.

Front 19

Minimum

Back 19

Give the module minimum functional resources and distributes additional resources to other modules.

Front 20

None

Back 20

Designed for situation where another module need dedicated access to resources

Front 21

Lite

Back 21

Available for selected modules granting limited feartures for trials

Front 22

Setup Utility includes the following:

Back 22

Self-IP Addresses and Netmasks for VLANS
Assign interfaces to VLANs

IP address of the default route

root password for cli

admin password for gui

ip address allowed for ssh

Front 23

Administrative IP access Files:

Back 23

/etc/hsots.allow

Front 24

Interface and configuration files:

Back 24

/config/bigip.conf

/config/bigip_base.conf

/config/BigDB.dat

Front 25

Default terminal settings for console access..

Back 25

8-N-1 19,200 bps

Front 26

File extension for backups

Back 26

*.ucs

Front 27

pool members are?

Back 27

each of the actual servers used for client traffic.

includes and IP address and port

Front 28

The devices represented by the IP addreses of pool membera are called what?

Back 28

Nodes -- they may represent multiple pool members

Front 29

A pool is what?

Back 29

A group of pool members.

Front 30

system logs

Back 30

/var/log/messages

Front 31

packet filter logs

Back 31

/var/log/pktfilter

Front 32

local traffic logs

Back 32

/var/log/ltm

Front 33

audit logs

Back 33

Displays system configuration chagnes by user ad time.

Front 34

A Full proxy maintains how many session tables?

Back 34

2

Front 35

bugger-and-stitch- methodology

Back 35

Proxy buffers a connection, often through the TCP handshake process and potentially into the first few packets of application data, but then stitches a connection to a given server on the back-end using either layer 4 or layer 7 data.

Front 36

DSR

Back 36

Direct Server Return

Requests are proxied by the deice, but the responses do not return through the device. Known as a half proxy because only half the connection is proxied.

Front 37

what is a proxy-based design

Back 37

A fill proxy completely understand the protocols, and is itself an endpoint and an originator for the protocols. The connections between a client and the full proxy is fully independent of the connection between the full proxy and the server.

Front 38

iRules

Back 38

scripts created using TCL with custom F5 extensions that enables users to create unique functions triggered from TMOS events.

Front 39

Single Device HA

Back 39

-Core services being up and running on that device

-VLANs being able to send and receive traffic

Front 40

Redundant system configuration HA

Back 40

Core system services being up and running on one of the two BIP-IP systems

Connection being available between the BIP-IP system and a pool of routers, and VLANS on the system being able to send and receive traffic.

Front 41

Hard-wired failover

Back 41

you enable failover by using a failover cable to physically connect the two dedundant units

default setting

Front 42

Network Failover

Back 42

Enable failover by configuring redundant system to use the network to determine the statuc of the active unit.

Front 43

what is ConfigSync

Back 43

a process where you replicate one units main config file on the peer unit.

Front 44

What does SNAT do?

Back 44

Secure Network Address Translation

maps the source client IP in a request to a translation address defined on the BIG-IP device

Front 45

what is Intelligent SNAT

Back 45

the mapping of one or more original client IP address to a translation address. However, you impliment this type of SNAT mapping within an iRule

Can be based on any piece of packet data you specifiy

Front 46

how to monitor the number of concurrent connections going through the SNAT?

Back 46

tmsh show /ltm snat

Front 47

Auto Last Hop

Back 47

Is a global setting that is used to track the source MAC address of incoming connections.

Allows the BIG-IP system to send return traffic from pools to the MAC address that transmitted the request, even though the routing table points to a different network or interface.

Front 48

what is a node?

Back 48

the physical server itself that will receive traffic from the load balancer

Front 49

How is a member different than a node?

Back 49

a member includes the TCP port of the actual application that will be receiving the traffic

Front 50

What is a basic load balancing transaction...

Back 50

1. Client attempts to connect with the service on the load balancer

2. LB accepts the connection, and changes the destination IP to match the service of the selected host

3. Host accepts the connection and responds back to the original source, the client, via its default route

4. The LB intercepts the return packet from the host and now changes the source IP to match the virtual server IP and port, and forwards packet

5. Clients receives the return packet, believing that it came from the virtual server.

Front 51

Random Algorithm

Back 51

randomly distributes load across the servers availables.

Front 52

Round Robin Algorithm

Back 52

passes each new connection request to the next server in line, eventually distributing connection evenly across the array of machines being load balanced.

Front 53

Weighted Route Robin Algorithm(Ratio) Algorithm

Back 53

the number of connections that each machine receives over time is proportionate to a ratio weight you define for each machine

Front 54

Dynamic Round Robin (dynamic ratio) Algorithm

Back 54

Weights are based on continuous monitoring of the servers and are therefore continually changing. Distributed based on real-time server performance analysis.

Front 55

Fastest Algorithm

Back 55

Passes a new connection based on the fastest response time of all server.

Front 56

Least Connections Algorithm

Back 56

The system passes a new connection to the server that has the least number of current connections. Works best with equipment all has similar capabilities.

Front 57

Observed Algorithm

Back 57

Uses a combination of the logic used in the Least Connections and Fastest Algorithms to load balance connections to servers. Servers are ranked based on current connections and response time.

Front 58

Predictive Algorithm

Back 58

The system analyzes the trend of the ranking over time, determining whether a servers performance is currently improving or declining.

Front 59

What is the primary reason for tracking and storing session data?

Back 59

To ensure that client requests are directed to the same pool member throughout the life of a session, or during subsequent sessions.

Front 60

what is a Persistence Profile?

Back 60

a pre-configured obect that automatically enables persistence when you assign the profile to a VS

Front 61

Cookie persistence

Back 61

Cookie persistence uses an HTTP cookie stored on a clients computer to allow the client to reconnect to the same server previously visited at a web site.

Front 62

Destination address affinity persistence

Back 62

Also known as sticky persistence, destination address affinity persistence supports TCP and UDP protocols, and directs session requests to the same server based solely on the destination IP address of a packet.

Front 63

hash persistence

Back 63

Hash persistence allows you to create a persistence hash based on an existing iRule

Front 64

Microsoft® Remote Desktop Protocol persistence

Back 64

Microsoft® Remote Desktop Protocol (MSRDP) persistence tracks sessions between clients and servers running the Microsoft® Remote Desktop Protocol (RDP) service.

Front 65

SIP Persistence

Back 65

SIP persistence is a type of persistence used for servers that receive Session Initiation Protocol (SIP) messages sent through UDP, SCTP, or TCP.

Front 66

Source address affinity persistence

Back 66

Also known as simple persistence, source address affinity persistence supports TCP and UDP protocols, and directs session requests to the same server based solely on the source IP address of a packet.

Front 67

SSL Persistence

Back 67

SSL persistence is a type of persistence that tracks non-terminated SSL sessions, using the SSL session ID.

Front 68

Univresal persistence

Back 68

Universal persistence allows you to write an expression that defines what to persist on in a packet. The expression, written using the same expression syntax that you use in iRulesTM, defines some sequence of bytes to use as a session identifier.

Front 69

What is the Positive Security Model

Back 69

One that defines what is allowed, and rejects everything else.

Front 70

What is the Negative Security Model

Back 70

Defines what is disallowed, while implicitly allowing everything else.

Front 71

Benefit of the Positive Security Model

Back 71

Is that new attacks, not anticipated by the admin/deveoper, will be prevented.

Front 72

Reset on Timeout

Back 72

The system sends a reset (RST) and deletes the TCP connection when the connection exceeds the idle timeout value. If disabled, the system will delete the TCP connection when it exceeds the idle timeout value, but will not send an RST to the client.

Front 73

SIP

Back 73

Session Initiated Protocol

Application layer protocol that can establish, modify, and terminate multimedia sessions such as Internet telephony calls.

Front 74

HTTP Header Methods?

Back 74

GET

POST

PUT

DELETE

HEAD

Front 75

With the get method, all query parameters are mart of what?

Back 75

URI

Front 76

200 OK

Back 76

This indicates a success

Front 77

304 Not Modified

Back 77

This shows that the resource in question has not changed and the browser should load it from its cache instead. This is used only when the browser performs a conditional GET request

Front 78

404 Not Found

Back 78

This suggests that the resource requested cannot be found on the server

Front 79

401 Authorization Required

Back 79

This indcates that the resource is protected and requires valid credentials before the server can grant access

Front 80

500 Internal Error

Back 80

This signifies that the server had a problem processing the request

Front 81

most important browser headers?

Back 81

HTTP Version

Accept-Encoding: gzip, deflate

Connection: Keep-Alive

If-* headers

Cache-Control or Pragma no cache

Front 82

Most important web server headers?

Back 82

HTTP Version

connection: Keep-Alive/Close

Encoding: gzip, deflate

Cach-strong headers (max-age)

Content-Type:

Date:

Accept-Ranges: bytes

Front 83

no-cache meta tag

Back 83

instructs the browser to not cache the object that contain the meta tag

Forces the browser to always get a full download of that object

Front 84

refresh meta tag

Back 84

often used to mimic an HTTP 302 redirect response.

Tells the browser to override the browser's cache settings and revalidate every object referenced by the refresh tag.

Front 85

IPSEC

Back 85

IP layer protocol that enables the sending and receiving of cryptographically protected pachets of any times (TCP, UDP, ICMP) without any modification

Front 86

What two cryptographic services does IPSec provide?

Back 86

1. confidentiality and authenticity (Encapsulated Security Payload)

2. Or authenticity only. (Authentication Header)

Front 87

Main Mode exchanges

Back 87

-> HDR, SA

<- HDR, SA

<- HDr, KE, Ni

-> HDR, KE, Nr

<- HDY*, ID_I, [CERT], SIG_I

-> HDR*, ID_R[CERT], SIG_R

HDR ISAKMP header

SA Security Association
KE Diffie-Hellman exchanged public value
Ni Nr the nonce
ID I ID R the Initiator Responder
CERT the certicate
SIG I SIG R􀀀the signature for the Initiator Re􀀀
sponder respectively

Front 88

Aggressive Mode Exchanges

Back 88

-> HDR, SA, KE, Ni, ID_I

<- HDR, SA, KE, Nr, ID_R, [CERT], SIG_R

-> HDR, [CERT], SIG_R

HDR ISAKMP header

SA Security Association
KE Diffie-Hellman exchanged public value
Ni Nr the nonce
ID I ID R the Initiator Responder
CERT the certicate
SIG I SIG R􀀀the signature for the Initiator Re􀀀
sponder respectively

Front 89

What does Phase 2 do?

Back 89

Negotiates the cipher and authentication algorithm required to protect further transactions.

Front 90

What does Phase 1 do?

Back 90

Performs mutual authentication and produces the encryption key required to protect Phase 2.

Front 91

What is SSL?

Back 91

an application layer protocol. Mostly utilized to protect HTTP transactions, and has been used for other purposed like IMAP and POP3

Only compatible with applications running over TCP

Front 92

SSL is composed of what 4 protocols?

Back 92

Handshake protocol

Change Cipher Spec protocol

Alert protocol

Application Data protocol

Front 93

What is the handshake protocol used for?

Back 93

To perform authentication and key exchanges

Front 94

What is the Change Cipher Spec Protocol used for?

Back 94

To indicate that the chosen keys will now be used

Front 95

What is the Alert protocol used for?

Back 95

Signaling errors and session closure

Front 96

What is the application data protocol used for?

Back 96

to transmist and receive encrypted data

Front 97

Hash algoritms used in SSL "Client Authentication"?

Back 97

ND5 and SHA-1

Front 98

IPSec supports the use of Digital Signature ad the use of a Secret KEy Alforithm, where SSL supports only the use of what?

Back 98

Digital Signature

Front 99

MAC

Back 99

Message Authentication Code

Used for authentication the exchanged messages after the connection is established.

Front 100

What two connection modes what IPSec have?

Back 100

Tunnel Mode

Transport Mode

Front 101

What is Tunnel mode?

Back 101

Established between gateway-to-gateway, gateway-to-host, and host-to-host. It established a tunnel between the endpoint and it requires adding a new IP header to the original packet

Front 102

What is Transport mode?

Back 102

Host-to-host connection. The data between the two entities are encrypted.

Front 103

PFS

Back 103

Perfect Forward Secrecy

Exchanges new DH values each time a session is resumed

Front 104

100 Continue

Back 104

This means that the server has received the request headers, and that the client should proceed to send the request body

Front 105

101 Switching Protocols

Back 105

This means the requester has asked the server to switch protocols and the server is acknowledging that it will do so.

Front 106

200 OK

Back 106

Standard response for successful HTTP requests.

Front 107

201 Created

Back 107

The request has been fulfilled and resulted in a new resource being created.

Front 108

202 Accepted

Back 108

The request has been accepted for processing, but the processing has not been completed. The request might or might not eventually be acted upon, as it might be disallowed when processing actually takes place.

Front 109

203 Non-Authoritative Information (since HTTP/1.1)

Back 109

The server successfully processed the request, but is returning information that may be from another source.

Front 110

204 No Content

Back 110

The server successfully processed the request, but is not returning any content. Usually used as a response to a successful delete request.

Front 111

205 Reset Content

Back 111

The server successfully processed the request, but is not returning any content. Unlike a 204 response, this response requires that the requester reset the document view.

Front 112

206 Partial Content

Back 112

The server is delivering only part of the resource due to a range header sent by the client. The range header is used by tools like wget to enable resuming of interrupted downloads, or split a download into multiple simultaneous streams.

Front 113

207 Multi-Status

Back 113

The message body that follows is an XML message and can contain a number of separate response codes, depending on how many sub-requests were made.

Front 114

208 Already Reported

Back 114

The members of a DAV binding have already been enumerated in a previous reply to this request, and are not being included again.

Front 115

226 IM Used (RFC 3229)

Back 115

The server has fulfilled a GET request for the resource, and the response is a representation of the result of one or more instance-manipulations applied to the current instance.

Front 116

SNAT

Back 116

Security Network Address Translation

Maps the source client IP address in a request to a translation address defined on the BIG-IP device

Front 117

300 Multiple Choices

Back 117

Indicates multiple options for the resource that the client may follow. It, for instance, could be used to present different format options for video, list files with different extensions, or word sense disambiguation.

Front 118

301 Moved Permanently

Back 118

This and all future requests should be directed to the given URI.

Front 119

302 Found

Back 119

This is an example of industry practice contradicting the standard. The HTTP/1.0 specification (RFC 1945) required the client to perform a temporary redirect (the original describing phrase was "Moved Temporarily"),[5] but popular browsers implemented 302 with the functionality of a 303 See Other. Therefore, HTTP/1.1 added status codes 303 and 307 to distinguish between the two behaviours.[6] However, some Web applications and frameworks use the 302 status code as if it were the 303.[7]

Front 120

303 See Other

Back 120

The response to the request can be found under another URI using a GET method. When received in response to a POST (or PUT/DELETE), it should be assumed that the server has received the data and the redirect should be issued with a separate GET message.

Front 121

304 Not Modified

Back 121

Indicates that the resource has not been modified since the version specified by the request headers If-Modified-Since or If-Match. This means that there is no need to retransmit the resource, since the client still has a previously-downloaded copy.

Front 122

305 Use Proxy

Back 122

The requested resource is only available through a proxy, whose address is provided in the response. Many HTTP clients (such as Mozilla[8] and Internet Explorer) do not correctly handle responses with this status code, primarily for security reasons

Front 123

306 Switch Proxy

Back 123

No longer used. Originally meant "Subsequent requests should use the specified proxy

Front 124

307 Temporary Redirect

Back 124

the request should be repeated with another URI; however, future requests should still use the original URI. In contrast to how 302 was historically implemented, the request method is not allowed to be changed when reissuing the original request. For instance, a POST request should be repeated using another POST request

Front 125

308 Permanent Redirect

Back 125

The request, and all future requests should be repeated using another URI. 307 and 308 (as proposed) parallel the behaviours of 302 and 301, but do not allow the HTTP method to change. So, for example, submitting a form to a permanently redirected resource may continue smoothly.