Configuring F5 BIG-IP LTM

Explore configuring tagged interfaces to run multiple VLANs on a single physical interface, creating vlan ten and vlan 11 with self IPs, and testing connectivity between subnets.

Aggregate multiple physical links into a single trunk interface to boost bandwidth and provide resiliency and high availability. Attach VLANs as tagged on the trunk to serve multiple subnets.

Learn how the link selection policy governs which ports join a trunk, choosing between auto and maximum bandwidth, using the reference link (the lowest interface number) to optimize aggregation.

Explain the frame distribution hash for trunk links on the big-ip, covering the default source ip, destination ip, source port, destination port hashing and mac-based options for multi-vlan environments.

Lacp governs link aggregation in ethernet 802.3 by exchanging hello messages between Big-IP and the neighbor switch to monitor link health.

Understand how routing on BIG-IP uses the longest subnet mask across two routing tables—management and data—to determine the next hop, with default routes applied for unknown destinations.

Explore how auto last hop influences return traffic on the Big-IP, including outbound routing, default routes, and testing with virtual servers and VLAN configurations.

Learn how to configure source NAT on the BIG-IP LTM using auto map or a SNAT pool to ensure server responses are translated correctly and avoid gateway issues.

Configure the snat list as a global nat to translate traffic from a specified origin subnet to a snat ip, applied to all virtual servers.

Configure the snat list and IP forwarding on Big-IP to provide internet access for internal servers and enable all traffic through an IP forwarding virtual server.

Use intelligent nat with iRules to enable app-based snat by http host. Attach the rule and define ip objects to achieve granular nat control using 11, 22, or auto map.

Insert the x-forwarded-for header via the http profile to reveal the original client ip behind snat. Use i rules for advanced header enrichment when simple header insertion falls short.

Learn to navigate the big-ip ltm cli, switch between the advanced Linux shell and tmos mode, and manage pools, members, and load balancing with show, list, and modify commands.

Configure root domains to create separate layer 3 routing tables on a single BIG-IP, enabling isolated networks with overlapping IP spaces via per-root-domain self IPs and VLANs.

Show how route domains create isolated routing tables and how a parent-child relationship lets a child use the parent's routing table for internet access when isolation is relaxed.

configure and test packet filters on Big-IP to allow or block traffic by source and destination, manage interfaces, and understand rule order, logging, and discard versus reject actions.

configure a packet filter rule to secure management access on the external interface by allowing a single source IP and specific ports, with the rule order preventing a global block.

Explore how profiles on Big-IP change protocol parameters for client and server sides, attach http and authentication profiles to virtual servers, and enable ssl offload with full proxy mode.

Apply a source IP persistence profile on F5 BIG-IP LTM to keep a user's requests on the same pool member, adjusting prefix length to group by subnet.

Configure the hash persistence profile to hash the first six bytes of the http payload, then bind the resulting hash to a chosen node via the load balancing algorithm.

Enable match across services on persistence profile to share source IP persistence across virtual servers with the same IP and pools, creating one persistence record per user for both ports.

Explore how match across virtual servers implicitly includes match across services, enabling shared source IP persistence across two virtual servers with different IP addresses.

Learn how hash persistence profiles with match across virtual servers affect persistence records, using the first seven bytes of http requests to share hash values across virtual servers.

Configure match across pools with source IP persistence to keep a client on the same server when switching between apps, using an iRule-driven pool selection and a persistence profile.

Learn how cookie insert persistence uses a session cookie to bind users to a pool member on a virtual server, and how to create and apply a cookie persistence profile.

Enable cookie encryption for persistence to prevent information leakage of pool IPs and ports, and mitigate replay risks; configure via persistence or legacy http profile with a strong passphrase.

Discover how cookie hash persistence works in F5 BIG-IP LTM: the server sets a cookie, BIG-IP links its value to a pool member via a persistence record, with expiration.

Configure SNMP on Big-IP by enabling SNMP agent and traps, using SNMP v3 with encryption, restricting allowed hosts, and testing with SNMP walk to monitor pool, virtual server, and node.

Configure snmp traps on the big ip for real-time notifications to the nms about node up and node down, using default traps and port 162.

Configure smtp email alerts on the BIG-IP by editing the user alert conf, defining from and to addresses, and enabling smtp outbound with domain rewrite, then test and verify delivery.

Configure two BIG-IP devices in an active-active setup using traffic groups to distribute traffic. Learn to create floating and self IPs, virtual servers, SNAT, and deterministic failover between devices.

Explore high-availability networking with two virtual servers: assign floating IPs, traffic groups, and SNATs, linking virtual servers to VLAN-based traffic groups for resilient load balancing.

Learn how failover triggers work in a two-device ha pair, including system service failures, vlan fail-safe configurations, and fail-safe gateway monitoring with icmp, plus practical testing.

Explore local traffic policy in F5 BIG-IP LTM, using first‑match rules to match geo location, headers, cookies, and user agents, and to forward, log, or drop traffic in load balancing.

Demonstrate the match all policy in local traffic, showing how execute all runs all rules, logs header and source IP matches, forwards traffic, and avoids conflicting actions due to nondeterministic behavior.

Learn how the best match strategy selects the most matched rule, breaks ties by operand priority (tcp vs http headers), then by rule order.

Learn to integrate BIG-IP with Active Directory to authenticate admin users, map AD groups to local roles, and enable LDAP TLS, fallback to local, and SSL peer verification.

Learn how to configure the geolocation database on BIG-IP, compare edge and pulse data from Digital Envoy, and update /shared/geoip while preserving the built-in database.

Configure FQDN nodes on the big-ip by resolving hostnames via DNS rather than hardcoding IPs. Enable auto populate to reflect DNS changes in pool members and monitor health.

Protects the BIG-IP from syn flood attacks by using syn cookies, eliminating half-open connection records and using a deterministic initial sequence number based on client IP, port, and time.

Demonstrate syn cookie protection by observing the tcp three-way handshake with tcpdump, simulating half-open connections, and configuring the virtual server to enforce maximum half-open connections and trigger syn cookie protection.

Protect the established connection table with the eviction policy by aggressively cleaning idle connections, using 85% and 95% capacity thresholds across global, virtual server, and root domain scopes.

Explore the eviction policy in practice by configuring a virtual server with ten connections, setting low and high water marks, and applying aggressive sweeper behavior to manage oldest connections.

Enable slow flow monitoring with 32 bytes per second threshold and 10-second grace; throttle connections; limit tcp reset and icmp unreachable, and apply max reject rate and max icmp rate.