F5 201 Study Guide

Front 1

What are somethings a Virtual Server object does

Back 1

1) Distribute client requests across multiple servers to balance server load
2) Apply various behavioral settings to a specific type of traffic
3) Enable persistence for a specific type of traffic4) Direct traffic according to user-written iRules

Front 2

Can a virtual server share an IP address with a vlan node

Back 2

Yes. Create a vlan group that includes the node's vlan, assign a self-ip address to the vlan group, disable the virtual server on the relative vlan.

Front 3

What is a virtual server

Back 3

A traffic-management object represented by IP and service port number. Virtual servers increase the availability of resources for processing client requests.

Front 4

What is a forwarding virtual server

Back 4

Just like other virtual servers but has no pool members to load balance. It just forwards the packets directly to the destination IP.

Front 5

What are some things LTM does with a forwarding virtual server

Back 5

adds, tracks and reaps connections. You can also view statistics.

Front 6

What is a performance (HTTP) virtual server

Back 6

A virtual server with which you associate a fast HTTP profile. Together the vs and profile increase the speed at which the VS processes HTTP requests.

Front 7

What is a performance (L4) VS

Back 7

A VS that has a fast L4 profile. Speeds up processing of L4 requests.

Front 8

What can a VS do with DHCP

Back 8

You can createa VS that relays DHCP between clients and servers in different networks. Known as a DHCP relay agent.

Front 9

What does a DHCP relay agent VS do

Back 9

Listens for DHCP client messages being broadcast on the subnet and relays to the server which then sends them back via the f5.

Front 10

What is the criteria for virtual server precedence

Back 10

1) First precedent of the algorithm chooses the virtual server that has the longest subnet match for the incoming connection

2) If the number of bits in subnet mask match then the virtual server that has a port match.

3) If no port match is found it uses the wildcard server if a wildcard VS is defined

Front 11

What are the results of the algorithm for order of precedence in VS precedence

Back 11

address:port
address:*
network:port
network:*
*:port
*:*

Front 12

What type of proxy in the LTM TMOS

Back 12

Full Proxy for VS configured with a TCP profile.

Front 13

What allows the LTM to maintain compatibility to disparate server OSes

Back 13

TCP Profile

Front 14

In full proxy architecture how with the LTM appear

Back 14

As a TCP peer to both the client and the server by associating 2 independent TCP connections with the end to end session.

Front 15

Standard virtual server requires

Back 15

TCP or UDP profile. HTTP, FTP, SSL profiles are optional.

Front 16

Describe the TCP connection setup for a standard virtual server

Back 16

3 way TCP handshake occurs on the clientside before the LTM initiates the TCP handshake on the server side.

Client Syn -> LTM Syn-ACK -> Client ACK
LTM Syn -> Pool Member Syn/Ack -> LTM ACK

Front 17

What are the VS Status indicators for enabled and able to receive traffic

Back 17

Green Circle

Front 18

What is the VS status indicator for enabled but unavailable, may become available later. For example: Connection limit exceeded.

Back 18

Yellow Triangle

Front 19

What is the VS status indicator for enabled but offline. Must actively enable.

Back 19

Red Diamond

Front 20

What is the VS status indicator for Operational but set to disabled. Must actively enable.

Back 20

Black Circle

Front 21

What is the VS status indicator for Unknown

Back 21

Blue Square

Front 22

Can you create a many to one relationship between Virtual Servers and Virtual Server Addresses

Back 22

Yes. 10.1.1.1:80, 10.1.1.1:443, 10.1.1.1:21 for example

Front 23

How do you create a virtual address

Back 23

Created indirectly when you first create a virtual server. LTM associates the virtual address with a MAC address. LTM responds to ARP requests and sends gratuitous ARP requests

Front 24

Things to check when troubleshooting VS connectivity

Back 24

1) DNS
2) Network connectivity
3) Virtual server configuration (right address/ right listen port)
4) Destination URL the clients are using
5) Right profiles eg HTTP and not HTTPS

Front 25

What are examples of VS resources

Back 25

POols, iRules and persistence profiles

Front 26

Easy way to see if a VS is unavailable due to lack of resources

Back 26

LTM -> Network Map

Front 27

What will a virtual server with an unknown status due with traffic?

Back 27

Take in traffic and send on to the resources even if they are not online.

Front 28

Difference between a disabled pool member and pool member marked down by a monitor

Back 28

Disabled pool member continues to process persistent and active connections

Front 29

What is the pool member status icon for available and processing

Back 29

Green circle

Front 30

What is the pool member status icon for no pool members available but could become available later such as when the concurrent connections to the pool member in question no longer exceeds connection limit

Back 30

Yellow Triangle

Front 31

What is the pool member status icon for all pool members unavailable such as EAV monitor has detcted that the pool member is unavailable

Back 31

Red Diamond

Front 32

What is the pool member status icon for status of at least one pool member = unknown.

Back 32

Blue Square

Front 33

Some reasons why a pool member status might be unknown

Back 33

1) One or more pool members has no associated monitor
2) Monitor results not yet available

3) Pool member's IP address not configured
4) Parent node has been disconnected

Front 34

What monitor types are not available for association with pools

Back 34

Monitors specifically designed to monitor nodes, that is monitors going to an IP address only and not an IPaddress and port.

Front 35

What specific monitors are unavailable for monitoring pools

Back 35

1) ICMP
2) TCP Echo
3) Real Server
4) SNMP DCA
5) SNMP DCA Base
6) WMI

Front 36

What happens when you associate a health monitor with an entire pool instead of individual server

Back 36

LTM automatically associates that monitor with all pool members and pool members you add later

Front 37

You can associate multiple monitors with the same pool. For example

Back 37

HTTP and HTTPS monitors

Front 38

Describe flexibility of monitoring

Back 38

You can monitor multiple processes on the same server and port by associating that server with multiple pools.

You can exclude servers when monitoring an entire pool and associate a different monitor. EG http for some and HTTPs for others.

Front 39

What does a green circle mean for pool member monitors

Back 39

Set to enabled
Parent node is up
Monitor has marked pool member as up

Front 40

What does a yellow triangle mean for pool member monitors

Back 40

Pool member is unavailable but could become availabile later

Front 41

What does a red diamond mean for pool member monitors

Back 41

Unavailable because parent node is down, a monitor has marked it as down or a user has disabled the pool member.

Front 42

What does a black circle mean for pool member monitors

Back 42

Pool member is set to disabled although a monitor has marked it up. The parent node could also be down. Must enable manually.

Front 43

What does a black diamond mean for pool member monitors

Back 43

Set to disabled and is offline because parent node is down or a user disabled or a monitor marked as down.

Front 44

What does a blue square mean for pool member monitors

Back 44

Pool member or node has no monitor associated with it.

Front 45

List the ratio-based load balancing methods

Back 45

Ratio (node, member and sessions)
Dynamic Ratio (Node and member)
Ratio Least Connections (node and member)

Front 46

Difference between connection limit and connection rate limit

Back 46

Connection limit = max concurrent connections
Connection rate limit = max number of new connections per second

Front 47

Point of Persistence

Back 47

Ensure client requests are directed to the same pool member through the life of the session or subsequent sessions as required by an app

Front 48

What can session persistence track

Back 48

Session data such as the specific pool member
User prefs

User /password

Front 49

Define Cookie Persistence

Back 49

Uses an HTTP cookie to allow the client to reconnect to the same server

Front 50

Destination address affinity

Back 50

AKA Sticky Persistence, supports TCP and UDP protocols and directs session to the same server based on dest IP

Front 51

Hash persistence

Back 51

Create a persistence hash based on an existing iRule

Front 52

MSRDP Persistence

Back 52

Maintains persistence specifically for RDP

Front 53

SIP Persistence

Back 53

Type of persistence to receive SIP messages sent through UDP, SCTP or TCP

Front 54

Source Address Affinity Persistence

Back 54

AKA Simple Persistence, supports TCP and UDP directs based on source IP of the packet

Front 55

SSL Persistence

Back 55

Tracks non terminated SSL sessions using SSL session ID. Maintained even when client IP address changes.

Front 56

Universal Persistence

Back 56

An expression you write that defines what to persist on in a packet.

Front 57

What is required for fallback persistence

Back 57

An IP address based persistence type

Front 58

What's an easy way to see if the client is connecting to the same server resources for validating persistence

Back 58

Watermarks on the application pages. If no watermark then
tmsh show sys conn cs-client-addr "client IP"

Front 59

Where to find source address persistence methods for troubleshooting

Back 59

GUI: Statistics -> Module Statistics -> Local Traffic and select Persistence Records from statistics Type.

tmsh show /ltm persistence persist-records

Front 60

How to start EUD

Back 60

Boot off of CD, USB or select EUD option from boot menu

Front 61

How do you exit EUD

Back 61

Use option 21. DO NOT REBOOT

Front 62

Where is EUD report stored

Back 62

eud.log is in /shared/log

Front 63

Describe the LCD screen

Back 63

Info menu: Find info about LCD and its function
Sys Menu: Reboot/netboot/halt set mgmt port and serial port
Screens: Setup info screens for LCD to cycle thru
Options: Set properties of the LCD panel

Front 64

How to configure LED alarms

Back 64

/etc/alertd/alert.conf. lcdwarn function defines which alerts will modify alarm LED indicator

Front 65

LED alarm logs are stored where

Back 65

/var/log/ltm

Front 66

Describe LED buttons

Back 66

X for menu
Arrows to move
Check for ok

Front 67

What are the log message categories for syslog local logging

Back 67

System Messages
Packet Filter Messages
Local Traffic Messages
Global Traffic Messages
Audit/Sys Config messages

Front 68

How do you syslog irules

Back 68

Define the local facility

Front 69

Where are packet filter events stored

Back 69

/var/log/pktfilter

Front 70

What is required for a stateful failover environment

Back 70

Pair configured to mirror current connection table, persistence records and SNAT table.

Front 71

What's one way f5 deals with congestion

Back 71

TCP profile has Nagles algorithm setting which reduces congestion by aggregating smaller TCP packets into larger ones.

Front 72

How to view Performance statistics in conf util

Back 72

Stastics -> Performance

Front 73

Port lockdown: allow default

Back 73

Allows OSPF, iquery (tcp/udp 4353), 443, SNMP (161 UDP/TCP), ssh, tcp/udp dns, RIP and network failover (udp 1026). tmsh list net self-allow for a list

Front 74

Port lockdown: allow none

Back 74

everything except ICMP and if in a redundant pair ports that are listed as exceptions are always allowed. ICMP is always allowed, even in custom

Front 75

Default value for packet filter VLAN setting

Back 75

All Vlans

Front 76

What is the goal of PAM

Back 76

To separate an application, such as BIGIP from its underlying authentication technology

Front 77

How does BIgip normally route remote auth traffic

Back 77

Through TMM (Traffic Management MicroKernel) switch interface, that is the interface associated with a vlan and self-ip rather than through mgmt interface.

Front 78

What happens if TMM service is stopped with regards to authentication

Back 78

Remote authentication is not available

Front 79

How do you configure and manage auth profiles

Back 79

Conf Utility > Main -> Local Traffic -> Authentication

Front 80

What are the Bigip Authentication modules

Back 80

LDAP, Radius, TACACS+, SSL Client cert LDAP, OCSP, CRLDP, Kerberos.

Front 81

When opening a case with f5 support what details are required for the description

Back 81

1) Symptoms
2) Time issue first occured
3) Number of times has recurred
4) Any error output
5) Steps to reproduce
6) Changes made prior to issue
7) Steps made to resolve

Front 82

When opening a case with f5 what is the definition of a 'site down' impact

Back 82

All network traffic has ceased, critical business impact

Front 83

When opening a case with f5 what is the definition of a 'site at risk' impact

Back 83

Primary unit has failed leaving no redundancy. Site is at risk of going down.

Front 84

When opening a case with f5 what is the definition of a 'Performance degrated' impact

Back 84

Partially functioning network traffic causing some applications to be unreachable

Front 85

What is required when opening a case:

Back 85

1) Description of symptoms/issue
2) Description of site impact
3) Hours/contacts
4) Remote access info
5) Collect qkview/logs

Front 86

How much log info does qkview collect

Back 86

5 MB

Front 87

Example of creating a tarball of logs

Back 87

tar -czpf /var/log/*

Front 88

What are some info you can provide when opening a case

Back 88

qkview
logs
packet capture
UCS archive
Core files

Front 89

Severity 1 case

Back 89

1 hour response. Critical business activities down. Device(s) not powering up and/or not passing traffic.

Front 90

Severity 2 case

Back 90

1 hour response. Software or hardware conditions preventing or significantly impairing high-level commerce or business activities.

Front 91

Severity 3 case

Back 91

4 hour business response. Degrade service or functionality in normal busines or commerce activities.

Front 92

Severity 4 case

Back 92

24 hour response. Questions such as how-to, non-critical troubleshooing, requests for enhancements

Front 93

Difference between quantitative and qualitative

Back 93

Quantitative observation = Observations that can be precisely measure, eg 20 extra seconds per connection.

Qualitative observation = Characteristics of what is being observed, eg it is taking longer to connect

Front 94

Network Map shows:

Back 94

Virtual Servers
Pools
Pool Members
Nodes
iRules

Front 95

Network map icons

Back 95

Green circle = enabled and available
Yellow Triangle = Enabled but currently unavailable
Red Diamond = Offline because they were marked unavailable
Blue square = Unknown

Front 96

Difference between a node and a pool member

Back 96

Node has an IP
Pool member has IP and service port

Front 97

What does the analytics module require for monitoring

Back 97

The analytics (AVR) module requires an Analytics profile for each application you want to monitor.

Front 98

How many analytics profiles can a VS have associated?

Back 98

One

Front 99

What can you customize in analytics profiles

Back 99

1) What statistics to collect
2) Where to collect data (local or remote or both)
3) Whether to capture the traffic itself
4) Whether to send notifications

Front 100

Syntax for saving ucs

Back 100

tmsh save /sys ucs

No path it will look in /var/local/ucs

Front 101

Command to verify that the new or replaced SSH keys from UCS are synchronized

Back 101

keyswap.sh sccp

Front 102

Load UCS w/o license

Back 102

load /sys ucs no-license

Front 103

List tasks that can be automated by the Enterprise Manager

Back 103

Configuration
Cert Management
Software Updates
Node Management
Policy Control

Front 104

Default number of rotating UCS archives EM will create

Back 104

10

Front 105

What is a pinned archive?

Back 105

A UCS archive of a device at a certain place in time

Front 106

Example of EM sub-task

Back 106

After installing a new version as a regular task the subtask might be to reboot.

Front 107

Where are custom EM events applied

Back 107

To individual devices or a device group

Front 108

What happens when you setup a daily rotating archive schedule in EM?

Back 108

EM creates a UCS archive on each day that the managed device configuration changes.

Front 109

What can EM do with SSL certificates

Back 109

Monitor expiration status of all the certificates on the managed device. View status of both traffic and system certificates.

Front 110

Difference between EM system and traffic certs

Back 110

System = web certs that allow clients to login to conf util
Traffic = Server certs that a managed device uses in its traffic management tasks

Front 111

EM Certificate status flags

Back 111

Red = Cert expired.
Yellow = Expire in 30 days or less.
Green = Valid and good for 30+ days

Front 112

What does the cpcfg command do

Back 112

Allows you to copy a configuration from a specified source boot location to a specified target boot location.

Front 113

What reasons might cpcfg fail

Back 113

if you run cpcfg and the target boot location is an earlier version that the source or is the active boot location

Front 114

List possible issues with upgrades

Back 114

known issues with release
irule compatibility with new version
failure to migrate old configurations forward

Front 115

"What is the qkview utility?"

Back 115

"An executable program that generates machine–readable (XML_ diagnostic data from the BIG–IP or Enterprise Manager System.

This automatically generates 5 mb of log files and includes them with qkview in a tar output"

Front 116

"What are core files?"

Back 116

"Core files contain the contents of the system memory at the time a crash occurred."

Front 117

"Where are core files located?"

Back 117

"/var/savecore directory (9.0 – 9.2.5)
/var/core (9.3 and later)"

Front 118

"What is the network summary?"

Back 118

"WebUi utility that shows a summary of local traffic objects, as well as a visual map of the virtual servers, pool, and pool members on the BIG–IP system"

Front 119

"If you configure a pool, but no VS references that pool, will it show in the network map?"

Back 119

"No."

Front 120

"What is the network map?"

Back 120

"A webUI map that presents a visaul hierarchy of the names and status of virtual servers, pools, pool members, nodes, and iRules defined on the system.

Tries to show all objects in context, starting with the virtual server at the top."

Front 121

"What is a virtual server?"

Back 121

"A traffic management object on the BIG–IP system that is represented by an IP address and a service."

Front 122

"To summarize, a virtual server can do the following:"

Back 122

"1. Distribute client requests across multiple servers to balance server load
2. Apply various behavioral settings to a specific type of traffic
3. Enable persistence for a specific type of traffic
4. Direct traffic according to user–written iRules"

Front 123

"What is a pool?"

Back 123

"A load balancing pool is a logical set of devices, such as web servers, that you group together to receive and process traffic."

Front 124

"What is a pool members?"

Back 124

"A logical object that represents a physical node (server), on the network."

Front 125

"What is a node?"

Back 125

"A logical object on the BIG–IP LTM system that identifies the IP address of a physical resource on the network."

Front 126

"What is the difference between a node and a pool member?"

Back 126

"A node is designated by the devices IP address only (10.10.10.10), while designation of a pool member includes an IP address and a server (10.10.10.10:80)"

Front 127

"What is the difference between health monitors of a node and of a pool members?"

Back 127

"A health monitor for a pool member reports the status of a service running on the device, whereas a health monitor associated with a node reports the status of the device itself."

Front 128

"What is the main Dashaboard screen and what does it display?"

Back 128

"The main Dashboard screen is of the system overview. This screen displays a graphical representation of CPU and Memory utiliation, Connections and Throughput of the system."

Front 129

"What is Analytics?"

Back 129

"Analytics is a module on the BIG–IP system that lets you analyze performance of web applications."

Front 130

"What is Analytics also refered to as?"

Back 130

"Application Visibility and Reporting"

Front 131

"What are some things that Analytics shows?"

Back 131

"– Transactions per second
– Server and Client Latency
– Request and Response throughput
– Sessions"

Front 132

"What all can you view metrics for with Analytics?"

Back 132

"– Applications
– Virtual Servers
– Pool Members
– URLs
– Specific Countries
– Application Traffic"

Front 133

"What is an Analytics profile?"

Back 133

"A set of definitions that determine the circumstances under which the system gathers, logs, notifies, and graphically displays information regarding traffic to an application"

Front 134

"In the Analytics profile, you customize what? (4)"

Back 134

"1. What statistics to collect
2. Where to collect data (locally, remotely, both)
3. Whether to capture traffic itself
4. Whether to send notifications"

Front 135

"What ways can you restoring configuration data? (4)"

Back 135

"1. Configuration Utility
2. CLI using tmsh
3. On replacement RMA
4. Running later software version"

Front 136

"How to restart the system in the configuration utility?"

Back 136

"System –> Configuration –> Reboot"

Front 137

"When is the UCS archive actually restored when done on the same device it was taken?"

Back 137

"After a reboot of the device"

Front 138

"What is an alternative way to reactivate the BIG–IP system after a UCS restore done on a different device?"

Back 138

"Replace the /config/bigip.license file with the original file.

If you don't you simply re–license the system."

Front 139

"According to the Study Guide, when should to create a UCS?"

Back 139

"Prior to the change and after the change for both active and stand–by systems"

Front 140

"What does the EM compare when it created a rotating archive?"

Back 140

"It compares the most recently stored UCS archive file to the current configuration on the device at the specified interval. If there are any difference, EM stores a copy of the current configuration. If there are not, it does not store an additional copy (Read: extra space)"

Front 141

"By default, the EM stores up to how many rotating archives?"

Back 141

"Up to 10 rotating archives each, for itself and every managed device."

Front 142

"What is a pinning archive?"

Back 142

"EM created an archive of a specific UCS for a device. Pinned archives are stored until you delete them"

Front 143

"Path to create a scheduled archive on the EM?"

Back 143

"Enterprise Management –> Tasks –> Schedules –> Archive Collection –> Create"

Front 144

"Where will you a see a task failure on the EM?"

Back 144

"In the 'Task List'"

Front 145

"What happens when you set a node or pool to Disabled?"

Back 145

"The node or pool member continues to process persistent and active connections. It can accept new connections only if the connections belong to an existing persistence session."

Front 146

"What happens when you set a node or pool to Forced Offline?"

Back 146

"The node or pool members allows existing connections to time out, but no new connections are allowed."

Front 147

"What is an example case for disabling a member?"

Back 147

"If the administrator needs to make changes, such as configuration maintenance to a server, that is the resource of a pool, but wants to gracefully allow users to finish what they are doing."

Front 148

"What is an example case for forcing down a member?"

Back 148

"If the administrator needs to take a resource out of a pool immediately due to a critical misconfiguration or system error that is impacting business."

Front 149

"If a virtual server is using persistence and the administrator sets the pool to 'Disabled,' what will happen?"

Back 149

"The persistence record will be honored until it expires. Thus the administrator could disable a pool member and that member can still receive new connection from the existing persisted clients."

Front 150

"If a virtual server is using persistence and the administrator sets the pool to 'Forced Offline,' what will happen?"

Back 150

"The virtual service will not allow any new connections to the pool member even if persistence is configured on the virtual server."

Front 151

"What can an administrator do if he needs to stop all connections immediately from a pool resource without any completion of the current connection?"

Back 151

"Remove the pool member from the pool will kill all connections immediately. This is not recommended for day–to–day maintenance but is an option for emergencies."

Front 152

"What is Port–Lockdown?"

Back 152

"A BIG–IP security feature that allows you to specify particular protocols and services from which the self–IP address defined on the BIG–IP system can accept traffic."

Front 153

"What are the Port–Lockdown settings?"

Back 153

"– Allow Default
– Allow All
– Allow Custom
– Allow None
–Allow Customer (Include Default)"

Front 154

"Port–Lockdown Allow Default port are?"

Back 154

"– OSPF
– TCP 4353 iQuery
– UDP 4353 iQuer
– 443 HTTPS
– TCP 161 SNMP
– UDP 161 SNMP
– 22 SSH
– TCP 53 DNS
– UDP 53 DNS
– 520 RIP
– 1026 Network Failover"

Front 155

"What is the default Port–Lockdown setting?"

Back 155

"Version 10.x – Allow default
Version 11.x – None"

Front 156

"Command to modify Port–Lockdown settings from tmsh?"

Back 156

"modify /net self allow–server"

Front 157

"What are Packet Filters?"

Back 157

"Packet filters enforce an access policy on incoming traffic. They apply to incoming traffic only. The primary purpose of a packet filter rule is to define the criteria that you want the BIG–IP system to use when filtering packets."

Front 158

"Example criteria that you can specify in a packet filter are?"

Back 158

"– Source IP
– Destination IP
– Destination port"

Front 159

"What are the possible values for the order of packet filters?"

Back 159

"– First
– Last
– After"

Front 160

"What are the possible Packet Filter Actions?"

Back 160

"– Accept
–Discard
– Reject (sends rejection packet)
– Continue (acknowledge packet for logging or statistical purposed)"

Front 161

"What is PAM technology?"

Back 161

"PAM (Pluggable Authentication Module) allows you to choose from a number of different authentication and authorization schemes to use to authenticate or authorize network traffic."

Front 162

"What are the BIG–IP Authentication Modules?"

Back 162

"– LDAP
– RADIUS
– TACACS+
– SSL client Certificate LDAP
– Online Certificate Status Protocol
– Certificate Revocation List Distribution Point
– Kerberos Delegation"

Front 163

"Steps to configure DNS in Configuration Utility"

Back 163

"System –> Configuration _> Device –> DNS –> DNS Lookup Server List"