F5 301 Study Guide

Front 1

What is a Standard Virtual Server

Back 1

It directs client traffic to load balancing pool and is most basic type and is general purpose.

Front 2

What is a Forwarding Layer 2 Virtual Server

Back 2

It typically shares the same IP as a node in an associated VLAN. It is used with a VLAN group.

Front 3

What is a Forwarding IP Virtual Server

Back 3

It forwards packets directly to the destination based on the routing table and has no pool members.

Front 4

What is a Performance Layer 4 Virtual Server

Back 4

It has a FastL4 profile and increases speed of processing.

Front 5

How does Persistence Match Across Services work

Back 5

It matches a persistence record as a valid destination based on the IP address of the node of the pool member. Good for persistence from HTTP to HTTPS.

Front 6

How does Persistence Match Across Virtual Servers work

Back 6

It allows persistence record match regardless of the virtual server IP and port to the same pool member node IP.

Front 7

How does Persistence Match across Pools work

Back 7

It will use any pool which has a persistence record which matches the same client source IP.

Front 8

What is a FastL4 Profile

Back 8

It makes load balancing based on socket (IP and port) information only. No OneConnect.

Front 9

What is a FastHTTP Profile

Back 9

Faster than HTTP+TCP and requires SNAT. Includes some OneConnect features. No compression or IPv6.

Front 10

What is a performance HTTP Virtual Server

Back 10

It has a FastHTTP profile and increases speed of HTTP processing compared to a Standard Virtual Server with HTTP+TCP profiles.

Front 11

What is a Stateless Virtual Server

Back 11

It improves UDP performance in some circumstances.

Front 12

What is a Reject Virtual Server

Back 12

It discards all traffic which matches the Virtual Server.

Front 13

What is a DHCP Relay Virtual Server

Back 13

It forwards DHCP requests for an IP to a pool of DHCP servers and returns the response to the requesting client.

Front 14

What is TCP Express

Back 14

This is when a Virtual Server has a TCP WAN profile on the client side and a TCP LAN profile on the server side.

Front 15

What are two ways to have a Virtual Server listen for multiple ports on the same IP

Back 15

1. Have multiple Virtual Servers, one for each port.

2. Have a Virtual Server with a wildcard port and an iRule discarding any traffic coming to undesired ports.

Front 16

What is a Packet Filter

Back 16

It is an ACL ingress rule and you can create global Packet Filters which apply to all Packet Filter rules.

Front 17

What is the general virtual server matching order for new connections

Back 17

1. Virtual Server with the closest subnet match (longest)

2. Matched Virtual Server with same port

3. Wildcard port Virtual Server on IP used if present and no port match

4. Wildcard Virtual Server used if present

Front 18

What are the 6 Virtual Server matching order values

Back 18

1. Address:port

2. Address:*

3. Network:port

4. Network:*

5. *:port

6. *:*

Front 19

What is the difference between static and dynamic load balancing

Back 19

Static load balancing uses a metric calculated by the BIG-IP independent of the load of the pool members. Dynamic load balancing uses the pool member load as a weight, based on queries to the pool member.

Front 20

How does Outbound load balancing work

Back 20

The pool members are the outbound routers and the Virtual Server is either wildcard or matches the external destination. The clients are the internal resources.

Front 21

What is Cache Array Routing Protocol (CARP)

Back 21

It is stateless and is used for load balancing HTTP requests by hashing the URI and distributing evenly between pool members. This is similar to hashing done in LACP for trunk members.

This does not utilize the persistence table in the BIG-IP.

Front 22

How does CMP affect load balancing

Back 22

Load balancing is performed per TMM rather than per BIG-IP so load balancing may appear uneven.

Front 23

What does the OneConnect profile do

Back 23

It increases throughput by efficiently managing server-side connections. Ingress IPs are matched against Mask and then server-side connection is reused if match and available.

Also allows per higher level protocol load balancing rather than per TCP connection.

Front 24

Can Access Controls be applied to the MGMT interface

Back 24

No, only to TMM interfaces

Front 25

What traffic should use the MGMT interface

Back 25

Trusted administrative traffic only

Front 26

What are three ways to perform a Clean Install

Back 26

1. USB DVD Drive

2. USB Thumb Drive

3. Network

Front 27

What are the four ways to change the Management IP address

Back 27

1. Configuration Utility

2. tmsh config

3. tmsh modify

4. LCD Panel

Front 28

What is AOM and how is it accessed

Back 28

It is Always On Management, a management system separate from the main system. It is accessed via console port or SSH on the management IP's subnet if AOM is configured with its own address. It can power on/off the system among other things.

Front 29

Why is the subnet of a Self IP important

Back 29

It determines the scope of what networks are routed out that interface. For VLAN groups it would need to represent the address space covering all the VLANs in that group.

Front 30

Which as a lower metric: Management or TMM routes

Back 30

TMM routes

Front 31

Will TMMs use management routes

Back 31

No, only TMM routes

Front 32

What happens to TMM routes when no TMMs are active

Back 32

They are removed from the routing table

Front 33

When are static management routes recommended

Back 33

When the destination host/network is not in an adjacent management network. This ensures the packets use the desired route and interface.

Front 34

What are three reasons time should be accurate on the BIG-IP

Back 34

1. HA may not work

2. Log timestamps may be inaccurate between network devices

3. SSL Certificate Expiration may not be enforced

Front 35

What happens to all remote administrative users when a user role and/or partition assignment is changed for any remote user account

Back 35

All remote users are logged off

Front 36

What object uses MAC Masquerade

Back 36

A traffic group. This means there can be multiple MAC Masquerades if there are multiple traffic groups configured.

Front 37

How does HA Group determine which BIG-IP should be Active

Back 37

Each BIG-IP has a score based on values from Pools and/or Trunk member state and whichever has the highest score is Active.

Front 38

How are statistics generated against iRules

Back 38

With "timing on" in the iRule before the first clause.

Front 39

When can Global Variables by used in iRules without CMP demotion

Back 39

When they are static Global Variables since they never change. Since they are static the TMMs will never cache differing values and then never have to CMP demote to compensate.

Front 40

How is the Session Table used in iRules

Back 40

It is a common space shared by all TMMs to store and retrieve values. This provides a location for dynamic Global Variables.

Front 41

How does the RAM Cache help Pool Members

Back 41

By caching content frequently requested by clients it reduces the need for the pool member to keep sending that through the BIG-IP as the BIG-IP can provide it directly.

Front 42

What is the system impact of RAM cache

Back 42

This increases memory utilization on the BIG-IP

Front 43

What is the system impact of HTTP Compression

Back 43

This increases CPU utilization on the BIG-IP

Front 44

What is vCMP Configured state

Back 44

The vCMP Guest is not running and no resources are allocated. Similar to an unformatted physical device.

Front 45

What is vCMP Provisioned state

Back 45

The vCMP Guest is not running and it has resources allocated. Similar to a powered-off physical device

Front 46

What is vCMP Deployed state

Back 46

The vCMP Guest is running and has resources allocated. Similar to a powered-on physical device

Front 47

What is does the FastL4 Profile use to accelerate traffic

Back 47

The Packet Velocity Accelerator (PVA) to process traffic. Note that any traffic processed by this (typically post-SYN) is not visible to TCPDump.

Front 48

How do iRules interact with Profiles

Back 48

The iRule can use the profile command to get values from a specific profile when the event is triggered.

Front 49

What does a Standby send out as it becomes Active for a Traffic Group

Back 49

Gratuitous ARPs indicating that the floating Self IPs have new MAC addresses. Traffic Groups with MAC Masquerade on their Self IPs don't have GARPs sent out - that is the whole port of that feature.

Front 50

How does the Streams profile's functionality change with the addition of HTTP profile

Back 50

Without the HTTP profile it can manipulate the entire payload sent to client. With the HTTP profile it only manipulates the HTTP payload.

Front 51

What is the idle timeout on the BIG-IP

Back 51

It is how long a connection is kept in the connection table without data flow before being marked ready for deletion.

Front 52

Does changing setting in a profile take effect immediately

Back 52

The changes only take effect for new connections

Front 53

How does OneConnect work with SNAT

Back 53

SNAT is applied to the connection before it is compared to the OneConnect Mask to see if it matches

Front 54

What is OneConnect Transformations

Back 54

When the BIG-IP transforms HTTP/1.0 headers on server-side to HTTP/1.1 so that the connection can be kept in Keepalive state

Front 55

What profile should be added to a Virtual Server with a OneConnect profile which is processing HTTP traffic

Back 55

A HTTP profile

Front 56

When could OneConnect cause problems

Back 56

With Non-HTTP traffic or TCP traffic without clear start/stop to its flow.

Front 57

By default does the LTM load balance by TCP connection or HTTP request

Back 57

By TCP

Front 58

What happens to load balancing when a Virtual Server has HTTP and OneConnect profiles

Back 58

It can perform Content Switching where it load balances per HTTP request rather than per TCP connection

Front 59

Does OneConnect change load balancing for Virtual Servers with TCP and OneConnect profiles but no HTTP profile

Back 59

Yes, it can still perform Content Switching if there is a clear request/response format to the traffic

Front 60

How does Fallback Host in HTTP profile work

Back 60

If the pool is down, the HTTP profile causes the Virtual Server to return a HTTP 302 along with the fallback host information

Front 61

What is the HTTP Class profile

Back 61

Last used in version 11.3, it allows performing matching and then actions (like rewrite) against different components (classes) of HTTP traffic. Replaced with Local Traffic Policies in 11.4.

Front 62

What is the goal of reducing redundancy in configuration

Back 62

It makes things more efficient and easier to understand

Front 63

How is a vCMP guest's initial software partition created

Back 63

From an image in the vCMP host's /shared/images/ directory

Front 64

What is a SCF

Back 64

Single Configuration File, a list of non-default values which can be loaded to customize a BIG-IP.

Front 65

What is an UCS

Back 65

User Configuration Set, an archive containing all the data to restore a BIG-IP including configuration, license, SSL certificates and optionally SSL private keys.

Front 66

What iRule command prints data to log

Back 66

The log command. It is very useful for troubleshooting.

Front 67

What are HTTP 1xx codes

Back 67

Informational, like request received

Front 68

What are HTTP 2xx codes

Back 68

Success, like OK

Front 69

What are HTTP 3xx codes

Back 69

Redirection, like page has moved

Front 70

What are HTTP 4xx codes

Back 70

Client Error, like Not Authorized

Front 71

What are HTTP 5xx codes

Back 71

Server Error, like Failed to Provide Resource. Best practice is to hide these from clients. A proxy like BIG-IP can do that.

Front 72

What are three important HTTP headers

Back 72

1. Version: HTTP/1.0, HTTP/1.1

2. Accept-Encoding: gzip, deflate

3. Connection: Keep-Alive, Close

Front 73

Where are Cookies kept in a packet

Back 73

In the HTTP header in Cookie headers

Front 74

What decrypts encrypted cookies

Back 74

Client browser or the server

Front 75

What are three common HTTP methods

Back 75

1. Get

2. Post

3. Put

Others are

4. Delete

5. Head

Front 76

What are three differences between HTTP/1.0 and HTTP/1.1

Back 76

1. 1.1 has Options method

2. 1.1 always performs Connection Keepalives

3. 1.1 has better Caching

Front 77

What are the two items needed to decrypt SSL/TLS traffic

Back 77

Either the asymmetric private key or the symmetric pre-master shared key. SSLDump can create the pre-master with the private key and a TCPDump as inputs.

Front 78

What are three things AVR can track to assist with troubleshooting

Back 78

1. Latency

2. Throughput

3. Reduced transactions per second

Front 79

How do you locate a SSL private key file

Back 79

1. Look at Virtual Server to determine SSL profile

2. Look at SSL profile to determine key logical name

3. Look at bigip.conf to determine file path to actual file from the logical name

Front 80

How is HTTP Post data decoded by the BIG-IP

Back 80

Via iRule

Front 81

What is HTTP Chunking

Back 81

The process of sending a response to a client in chunks rather than waiting until the payload files up before sending to client.

Front 82

What is the default chunking behavior of the HTTP profile

Back 82

Selective. This means the BIG-IP only rechunks if it has modified the payload.

Front 83

What is Cookie persistence

Back 83

An HTTP cookie is provided to the client and when provided to the BIG-IP is used to associate to a persistence record

Front 84

What is Destination Address Affinity persistence

Back 84

Also called Sticky Persistence, it is based off the destination IP address in the client's packet

Front 85

What is Hash persistence

Back 85

Persistence records are created based on hash which is determined via an iRule.

Front 86

What is MSRDP persistence

Back 86

Microsoft Remote Desktop Protocol. Persistence designed for RDP.

Front 87

What is SIP persistence

Back 87

For SIP calls regardless of which transport protocol is used.

Front 88

What is Source Address Affinity persistence

Back 88

Also called Simple Persistence, based on the source IP address of the client's packet

Front 89

What is SSL persistence

Back 89

Based on the SSL session ID

Front 90

What is Universal Persistence

Back 90

Using syntax similar to iRules, something is user-designated to persist against in the packets

Front 91

How is persistence enabled for only some, not all traffic on a Virtual Server

Back 91

By using iRules to elect which traffic is persisted and which is not

Front 92

How does the OneConnect profile help persistence

Back 92

In the rare circumstance where persistence may not fire, OneConnects parsing ability helps ensure it does. This would usually only happen with session data.

Front 93

What is the TCPDump "-e" flag

Back 93

-e prints Ethernet layer (MAC addresses) information to stdout

Front 94

How does PVA affect TCPDump

Back 94

Any packets handled by the PVA cannot be captured by a TCPDump on the BIG-IP

Front 95

What is the TCPDump limitation when capturing on an interface instead of VLAN or 0.0

Back 95

200 packets per second

Front 96

How does an Extended Application Monitor indicate success

Back 96

An EAV monitor which returns anything to stdout indicates success. Only lack of any response indicates failure.

Front 97

What is an Address Check type monitor

Back 97

A monitor which only checks the IP address, for example the IP of a MySQL server. It does not check if the service is running.

Front 98

What is a Service Check type monitor

Back 98

One which checks a service, like logging into MySQL. It does not check if the service has good data however.

Front 99

What is a Content Check type monitor

Back 99

It checks the data of a service to ensure it is good. For example, logging into MySQL, running a command and verifying the output is expected.

Front 100

What is a Performance type monitor

Back 100

Like BIG-IP or SNMP, it gathers performance data of the device rather than state of a specific service.

Front 101

What is an Application Check type monitor

Back 101

It checks to see if a service is running. For example, checking the port used by MySQL when that service is running. It does not determine if the service is healthy, just if it is running.

Front 102

What is CMP demotion

Back 102

This occurs when an iRule has TMMs create individual copies of a shared variable. To avoid this situation only TMM0 will process the traffic. To prevent this from happening, global variables should be static or be kept in the Session Table.

Front 103

What is a Path Check type monitor

Back 103

This checks the path to the node with ICMP echo or similar.

Front 104

How does VLAN Failsafe check for a failure

Back 104

When the BIG-IP stops receiving any traffic on the VLAN it sends out ARPs to entries in the VLAN's table, IPv6 Ping and Multicast Probe

Front 105

What is the difference between Device Trust and Device Groups

Back 105

Device Trust is trust between devices using SSL/TLS certificates. Device Groups are logical grouping made of devices which trust each other through Device Trust.

Front 106

How does the HTTP profile manipulate traffic from HTTP to HTTPS

Back 106

With Rewrite Redirections it can rewrite the redirections to change from HTTP to HTTPS. What exactly triggers the rewrite and the scope are customizable in the Profile.