F5CAB2 BIG-IP Administration Data Plane Concepts (F5CAB2) exam Question and Answers

On BIG-IP, a disabled pool member is deliberately treated differently from a member that is unavailable because of a failed health monitor or one that has been forced offline . Disabling a pool member removes it from normal load-balancing selection for new, unrelated sessions, but BIG-IP can continue sending traffic associated with existing active connections and existing persistence sessions to that member.

F5 documentation states specifically that when a pool member is disabled, it continues to process active connections and connections belonging to the current persistence session. F5 also describes the disabled state as allowing “persistent or active connections” while preventing ordinary new load-balanced connections.

The relevant persistence configuration is attached to the virtual server , making A correct. When a client has an existing persistence record—for example, source-address affinity—the persistence decision can continue directing that client ' s connections to its previously selected pool member even though that member has subsequently been disabled.

Slow Ramp Time serves a different purpose: it gradually increases connection allocation to a newly available pool member so that it is not immediately overwhelmed. It does not explain continued access to disabled members. A persistence profile is not configured on the pool itself, eliminating D.

Study Guide References/Topics: Pool Member States; Disabled versus Forced Offline; Persistence Profiles; Virtual Server Persistence; Connection Processing; Slow Ramp Time.

On BIG-IP systems, physical interface bandwidth is fixed by the link speed (for example, 1GbE or 10GbE). When traffic demand exceeds the capacity of a single interface, BIG-IP provides link aggregation through trunks .

Key concepts involved:

Interfaces A single physical interface (such as 1.1) is limited to its negotiated link speed. You cannot exceed this capacity through software tuning alone.

Trunks (Link Aggregation) A trunk combines multiple physical interfaces into a single logical interface.

BIG-IP supports LACP and static trunks.

Traffic is distributed across member interfaces, increasing aggregate bandwidth and providing redundancy .

VLANs are then assigned to the trunk , not directly to individual interfaces.

Why option B is correct:

Creating a trunk with two interfaces allows BIG-IP to use both physical links simultaneously.

This increases total available bandwidth (for example, two 10Gb interfaces → up to 20Gb aggregate capacity).

This is the documented and supported method for scaling bandwidth on BIG-IP.

Why the other options are incorrect:

A. Increase the MTU MTU changes affect packet size and efficiency, not total bandwidth capacity .

C. Assign two interfaces to the VLAN BIG-IP does not support assigning a VLAN to multiple interfaces directly. VLANs must be associated with one interface or one trunk .

D. Set the media speed manually Media speed can only be set up to the physical capability of the interface and connected switch port. It cannot exceed the hardware limit.

Conclusion:

To increase total available bandwidth on BIG-IP when a single interface is insufficient, the administrator must create a trunk object with multiple interfaces and move the VLAN onto the trunk. This aligns directly with BIG-IP data plane design and best practices.

12

In the BIG-IP system, pool selection must occur on the client-side of the connection, before the system attempts to connect to a pool 3 member. The events listed 4 are the primary entry points for making these decisions:

CLIENT_ACCEPTED (E): This is a Layer 4 event triggered when the BIG-IP accepts a TCP connection. It is the earliest point where a pool can be assigned based on the client ' s source IP address or the destination port.

CLIENT_DATA (A): This event is triggered when the system receives a " chunk " of data on the client-side. It is often used for non-HTTP protocols (like custom TCP protocols) to inspect the payload and select a pool based on its contents.

HTTP_REQUEST (C): This is a Layer 7 event. It occurs once the BIG-IP has fully parsed the HTTP headers. This is the most common event for pool selection, allowing the administrator to route traffic based on the URI, Host header, or cookies.

Events like SERVER_SELECTED or SERVER_CONNECTED occur after the load balancing decision has already been made, and HTTP_RESPONSE or SERVER_DATA occur after the server has already started communicating back, making them too late for initial pool selection.

Although remote authentication (LDAP, RADIUS, TACACS+) is a control-plane / management-plane feature, it directly affects availability and resiliency of administrative access , which is a critical operational HA consideration.

How BIG-IP Remote Authentication Works:

BIG-IP can authenticate administrators against:

LDAP

RADIUS

TACACS+

When remote authentication is enabled, BIG-IP by default relies on the remote server for user authentication

If the remote authentication server becomes unreachable, administrators may be locked out unless fallback is configured

Why “Fallback to Local” Is Required:

The Fallback to Local option allows BIG-IP to:

Attempt authentication against the remote authentication server first

If the remote server is unreachable or unavailable , fall back to:

Local BIG-IP user accounts (admin, or other locally defined users)

This ensures:

Continuous administrative access

Safe recovery during:

Network outages

Authentication server failures

Maintenance windows

This behavior is explicitly recommended as a best practice in BIG-IP administration to avoid loss of management access.

Why the Other Options Are Incorrect:

A. Configure a second remote user directory

Provides redundancy only if both directories are reachable

Does not help if remote authentication as a whole is unavailable

B. Configure a remote role group

Maps remote users to BIG-IP roles

Does not affect authentication availability

D. Set partition access to “All”

Controls authorization scope after login

Has no impact on authentication success

Key Availability Concept Reinforced:

To maintain administrative access resiliency , BIG-IP administrators should always enable Fallback to Local when using remote authentication. This prevents lockouts and ensures access even during authentication infrastructure failures.

===========

4647

Virtual Servers have a setting called VLAN and Tunnel Traffic which defines where the BIG-IP " listens " for new connections. 4849

Ingress Logic: A virtual server is an entry point. It must be enab 50 led on the VLAN where the Client resides. If a client is on the " 51 Internal " VLAN, the Virtual Server must be enabled there to receive the traffic.

Egress Logic: The BIG-IP system uses the TMM Routing Table and Self-IPs to reach pool members. It does not need the Virtual Server to be " enabled " on the destination VLAN (External) to send traffic there.

Default Behavior: By default, Virtual Servers are enabled on " All VLANs. " However, if restricted for security, the administrator must ensure the Virtual Server is active on the client-facing (ingress) VLAN.

A Self IP is an IP address on the BIG-IP system that you associate with a specific VLAN .

VLAN Association: A Self IP cannot exist independently; it must be bound to a VLAN to define which network segment the BIG-IP can communicate with.

Layer 2 to Layer 3 Mapping: While a VLAN is associated with physical interfaces or trunks (Layer 2), the Self IP provides the Layer 3 identity for the BIG-IP on that VLAN.

Traffic Processing: Self IPs are used by the BIG-IP for health checking backend servers, acting as a default gateway for servers, and for HA heartbeat communication.

In BIG-IP LTM, a Wildcard virtual server is defined by using a destination IP address of 0.0.0.0. These virtual servers are designed to handle traffic that does not match any more specific Virtual Server destination address.

0.0.0.0 Destination: This address acts as a " catch-all " for IP traffic.

VLAN Specificity: While the destination address is generic, a Wildcard virtual server is typically restricted to a specific VLAN (such as the Internal VLAN) to process outbound traffic from backend servers.

Service Ports: A wildcard virtual server can be configured for a specific port (e.g., 0.0.0.0:80) or for all ports (0.0.0.0:0).

Data Plane Usage: It is commonly used for transparently intercepting outbound traffic for the purpose of Source NAT (SNAT), bandwidth shaping, or directing traffic to a gateway pool.

When managing a large environment with hundreds of Virtual Servers, the most efficient way to identify the relationship between an iRule and the objects it manages is to view the properties of the iRule itself.

iRule Properties: Within the BIG-IP Configuration Utility, navigating to Local Traffic > iRules and selecting a specific iRule provides a " Statistics " or " Usage " tab (depending on the version). This view explicitly lists all Virtual Servers currently associated with that specific iRule.

Centralized Management: Instead of manually checking 235 individual Virtual Servers under the " Virtual Servers " menu, the iRules menu acts as a central point of reference for that specific logic.

Data Plane Impact: Because iRules can modify traffic flow, headers, and load balancing decisions, seeing the full list of affected Virtual Servers is critical before making adjustments to avoid unintended side effects across the application portfolio.

In the BIG-IP system object hierarchy, health monitors can be applied at three levels: Node , Pool , and Pool Member .

Pool Level (Properties): Applying a monitor at the Pool > Properties level is the most common and efficient administrative practice. When applied here, the monitor is inherited by all members of that pool. If the monitor fails for a specific member, that member is marked " down " specifically for that pool.

Node Level: If a monitor is applied at the Node level ( Local Traffic > Nodes ), it checks the health of the physical IP address itself. If it fails, that node (and all pool members associated with it) is marked down globally across the entire system.

Member Level: Applying a monitor at the Pool > Members level allows for specific " per-member " monitoring, which is usually only done if different members in the same pool require different health checks.

The Specific Case: For a standard database pool like DB_Pool, the administrator should navigate to Local Traffic > Pools > DB_Pool > Properties and select the appropriate monitor (e.g., a custom TCP or Oracle monitor) from the " Health Monitors " configuration section.

In BIG-IP high availability (HA) deployments, one of the primary causes of traffic disruption during failover is Layer 2 and Layer 3 relearning by upstream network devices (switches and routers). When traffic groups move from the Active device to the Standby device, the network must quickly associate the IP addresses with the new device.

Why MAC Masquerading Minimizes Failover Impact:

MAC masquerading allows a traffic group to use a floating, shared MAC address for its Self IPs. This MAC address moves with the traffic group during failover.

Key benefits:

The MAC address does not change when failover occurs

Upstream switches do not need to relearn ARP entries

Traffic resumes almost immediately after failover

Dramatically reduces packet loss and connection interruption

From BIG-IP Administration Data Plane Concepts:

MAC masquerade is specifically designed to provide fast failover

It is a best practice for HA pairs, especially in environments sensitive to latency and connection loss

Why the Other Options Are Incorrect:

A. External monitors

Used to check the availability of external resources

Do not reduce network convergence or failover disruption

B. Clone pool

Used for traffic mirroring or security analysis

Has no impact on failover behavior

C. OneConnect profile

Optimizes server-side TCP connections

Does not address ARP or MAC relearning during failover

Key HA Concept Reinforced:

To minimize failover impact on live traffic, BIG-IP administrators should ensure Layer 2 continuity . MAC masquerading is the primary mechanism that enables near-instant failover by preventing ARP and MAC table reconvergence delays.

===========

SNAT Automap is a feature that automatically selects a self-IP address to use as the source address for translated packets. The selection logic follows a strict hierarchy to ensure that traffic is routable back to the BIG-IP:

Egress VLAN Priority: The BIG-IP first looks at the VLAN through which the traffic is exiting toward the pool member (the egress VLAN).

Floating Self-IP Preference: If the egress VLAN has a floating self-IP address , the BIG-IP will always prefer it for SNAT Automap. This is critical for High Availability (HA) because, during a failover, the floating IP moves to the new active device, allowing existing connections to be maintained or correctly timed out.

Non-Floating Fallback: If no floating self-IP is available on the egress VLAN, the system will use a floating self-IP from a different VLAN. If no floating IPs exist at all, it will then fall back to the non-floating self-IP.

Key Data Plane Concept:

The management IP is never used for data plane traffic. In this scenario, since the administrator has configured a floating self-IP, that specific address becomes the source for all SNAT Automap traffic leaving that VLAN to ensure symmetric routing during HA events.

In the Traffic Management Shell (TMSH), there is a distinct difference between list and show commands.

List Command : Used to view the configuration of an object (what is stored in the config file). list net route would show you the static routes you have manually configured.

Show Command : Used to view the status, statistics, and real-time state of an object.

TMM Routes : Because the routing table (RIB/FIB) is a dynamic entity that includes both static routes and learned routes (such as those from a routing protocol or connected subnets), the show net route command is required to see the active routing table as it exists in the Traffic Management Microkernel (TMM).

Key Command Breakdown :

show net route: Displays the active TMM routing table, including destination, gateway, and the status of the route.

To meet the requirement of fault tolerance when one interface goes down , BIG-IP must use link aggregation so that loss of a single physical link does not isolate the VLAN(s).

How the objects relate (data plane view)

Interfaces = physical links.

Trunk (LACP) = bundles multiple interfaces into one logical link that provides redundancy (and possibly bandwidth aggregation).

VLANs are assigned to interfaces or trunks. If you need multiple VLANs on the same trunk , they must use 802.1Q tagging (because you can only have one untagged VLAN per interface/trunk).

Self IPs are then placed on the VLANs to provide BIG-IP presence and routing/ARP functions, but self IPs are not what provides link resiliency— the trunk does .

Why Option D is correct

You have two physical interfaces and you want resiliency if one fails → put both interfaces into one trunk with LACP enabled .

You need both external and internal VLANs on those same two links → both VLANs should be configured as tagged on that trunk, so they can coexist on the same aggregated link.

If either physical interface fails, the trunk remains up via the remaining interface, keeping both VLANs operational .

Why the other options are incorrect

A : Two VLANs cannot both be untagged on the same trunk/interface. Only one untagged VLAN is possible; additional VLANs must be tagged.

B : Two trunks “each with one VLAN” would typically mean splitting VLANs across separate trunks. With only two interfaces total, that becomes one interface per trunk—if one interface goes down, the VLAN on that interface is down (no redundancy for that VLAN).

C : Same redundancy problem as B, and disabling LACP removes the negotiated aggregation behavior expected when the switch engineer specifically requested LACP.

===========

BIG-IP Priority Group Activation causes members in the highest-numbered priority group to receive traffic first. F5 defines the activation value as the minimum number of available members required before traffic can remain confined to the higher-priority group. If availability falls below that threshold, the system activates the next lower priority group.

Here, Priority Group 3 is the highest group. Of its three members, only 172.16.15.7:80 is available. Because one available member is less than the configured threshold of 2 , BIG-IP must activate Priority Group 2 as well.

In Priority Group 2, only 172.16.15.4:80 is available. Adding this member provides two available members across the currently activated priority groups: 172.16.15.7:80 and 172.16.15.4:80. The required availability threshold is therefore satisfied, so Priority Group 1 does not need to participate. F5 specifically documents that traffic expands into lower-priority groups when the required number of members is unavailable in the higher-priority set.

Because the configured load-balancing method is Round Robin , new connections are distributed across these two eligible members.

Study Guide References/Topics: Pools; Priority-Based Member Activation; Priority Groups; Pool Member Availability; Round Robin Load Balancing.

This scenario combines session continuity , multiple protocols (HTTP and FTP) , and HA failover behavior , which directly implicates persistence handling across devices and services .

Key Requirements Breakdown

Same pool member for entire session

Session must survive failover

Session must span multiple services (HTTP and FTP)

Why Persistence Mirroring + Match Across Services Is Required

Persistence Mirroring

Ensures persistence records are synchronized from the active BIG-IP to the standby BIG-IP.

Without mirroring:

After failover, the standby device has no persistence table

Clients are load-balanced again

Sessions break, forcing users to restart

Persistence mirroring is essential for session continuity during failover

Match Across Services

Allows a single persistence record to be shared across multiple virtual servers / protocols

Required when:

HTTP and FTP must use the same pool member

Multiple services are part of a single application session

Together, these settings ensure:

Persistence survives device failover

Persistence is honored across HTTP and FTP

Why the Other Options Are Incorrect

A. Cookie persistence and session timeout Cookie persistence only applies to HTTP and does not address FTP or failover synchronization.

B. Stateful failover and Network Failover detection Stateful failover applies to connection state , not persistence records , and does not link HTTP and FTP sessions.

D. SYN-cookie insertion threshold and connection low-water mark These are DoS / SYN flood protection settings, unrelated to persistence or HA behavior.

For BIG-IP to send or receive traffic on a VLAN, that VLAN must be bound to a physical interface or a trunk . Creating a VLAN object and a Self IP alone is not sufficient to establish data-plane connectivity.

From the exhibit:

The VLAN ( vlan_1033 ) exists and has a tag defined.

A Self IP is configured and associated with the VLAN.

However, traffic cannot reach servers on that VLAN.

This indicates a Layer 2 connectivity issue , not a Layer 3 or HA issue.

Why assigning a physical interface fixes the problem:

BIG-IP VLANs do not carry traffic unless they are explicitly attached to:

A physical interface (e.g., 1.1), or

A trunk

Without an interface assignment, the VLAN is effectively isolated and cannot transmit or receive frames, making servers unreachable regardless of correct IP addressing.

Why the other options are incorrect:

A. Set Port Lockdown to Allow All Port Lockdown controls which services can be accessed on the Self IP (management-plane access), not whether BIG-IP can reach servers on that VLAN.

B. Change Auto Last Hop to enabled Auto Last Hop affects return traffic routing for asymmetric paths. It does not fix missing Layer 2 connectivity.

D. Create a Floating Self IP address Floating Self IPs are used for HA failover. They do not resolve reachability issues on a single device when the VLAN itself is not connected to an interface.

Conclusion:

The servers are unreachable because the VLAN has no physical interface assigned . To restore connectivity, the BIG-IP Administrator must assign a physical interface (or trunk) to the VLAN , enabling Layer 2 traffic flow.

When handling high-volume UDP traffic where the BIG-IP does not need to maintain any session history or relationship between packets, a Stateless virtual server is the appropriate choice.

No Connection Tracking: A stateless virtual server does not create or maintain entries in the BIG-IP connection table. This means the system processes each packet as an individual event, without " considering previous connections " or packets from the same source.

High Performance: Because the system bypasses the overhead of state management, stateless virtual servers provide the highest possible throughput for UDP and ICMP traffic.

Use Cases: This is ideal for services like DNS (stateless queries) or some types of syslog traffic where each packet is independent and doesn ' t require the persistence or protocol inspection typically provided by a full-proxy.

Why other options are incorrect:

Forwarding: While a Forwarding (IP) virtual server can handle UDP, it still maintains a state entry in the connection table to ensure return traffic is handled correctly.

Standard: This is a full-proxy virtual server. It is inherently stateful and requires a connection table entry for every flow it manages.

Reject: This is a special virtual server type that simply drops incoming traffic and, in the case of TCP, sends a reset (RST) or, for UDP, sends an ICMP unreachable message. It is not a load balancing type.

According to F5 BIG-IP documentation regarding High Availability and MAC Masquerade behavior, the system allows for more granular control over Layer 2 addresses during failover events.

Standard MAC Masquerade: By default, when a traffic group is assigned a MAC masquerade address (like 02:12:34:56:00:00), the BIG-IP system uses that exact MAC address for all traffic associated with that traffic group across all VLANs. This ensures that upstream switches do not need to relearn ARP entries for the Virtual IP, but it can cause issues in environments where multiple VLANs share the same physical infrastructure or monitoring tools that flag identical MACs across segments.

Per-VLAN MAC Masquerade: When the system database variable tm.macmasqaddr_per_vlan is set to true, the BIG-IP system calculates a unique MAC address for each VLAN. It does this by taking the base MAC masquerade address configured in the traffic group and adding the VLAN ID (tag) to it.

Calculation Logic:

Base MAC: 02:12:34:56:00:00

VLAN ID: 1501

To find the suffix, the VLAN ID is converted from decimal to hexadecimal:

$1501$ in decimal = 05DD in hex.

The system then applies this offset to the last two octets of the base MAC address.

00:00 + 05:DD = 05:DD.

Result: The final MAC address for VLAN 1501 becomes 02:12:34:56:05:dd.

This ensures that every VLAN has a unique Layer 2 identity while still reaping the benefits of " gratuitous ARP-less " failover provided by MAC masquerading.