Configuring F5 BIG-IP LTM

Explore configuring tagged interfaces to run multiple VLANs on a single physical interface, creating vlan ten and vlan 11 with self IPs, and testing connectivity between subnets.

Learn how the link selection policy governs which ports join a trunk, choosing between auto and maximum bandwidth, using the reference link (the lowest interface number) to optimize aggregation.

Explain the frame distribution hash for trunk links on the big-ip, covering the default source ip, destination ip, source port, destination port hashing and mac-based options for multi-vlan environments.

Lacp governs link aggregation in ethernet 802.3 by exchanging hello messages between Big-IP and the neighbor switch to monitor link health.

Explore how auto last hop influences return traffic on the Big-IP, including outbound routing, default routes, and testing with virtual servers and VLAN configurations.

Configure the snat list as a global nat to translate traffic from a specified origin subnet to a snat ip, applied to all virtual servers.

Use intelligent nat with iRules to enable app-based snat by http host. Attach the rule and define ip objects to achieve granular nat control using 11, 22, or auto map.

Learn to navigate the big-ip ltm cli, switch between the advanced Linux shell and tmos mode, and manage pools, members, and load balancing with show, list, and modify commands.

Configure root domains to create separate layer 3 routing tables on a single BIG-IP, enabling isolated networks with overlapping IP spaces via per-root-domain self IPs and VLANs.

configure and test packet filters on Big-IP to allow or block traffic by source and destination, manage interfaces, and understand rule order, logging, and discard versus reject actions.

configure a packet filter rule to secure management access on the external interface by allowing a single source IP and specific ports, with the rule order preventing a global block.

Configure the hash persistence profile to hash the first six bytes of the http payload, then bind the resulting hash to a chosen node via the load balancing algorithm.

Enable match across services on persistence profile to share source IP persistence across virtual servers with the same IP and pools, creating one persistence record per user for both ports.

Explore how match across virtual servers implicitly includes match across services, enabling shared source IP persistence across two virtual servers with different IP addresses.

Learn how hash persistence profiles with match across virtual servers affect persistence records, using the first seven bytes of http requests to share hash values across virtual servers.

Configure match across pools with source IP persistence to keep a client on the same server when switching between apps, using an iRule-driven pool selection and a persistence profile.

Learn how cookie insert persistence uses a session cookie to bind users to a pool member on a virtual server, and how to create and apply a cookie persistence profile.

Discover how cookie hash persistence works in F5 BIG-IP LTM: the server sets a cookie, BIG-IP links its value to a pool member via a persistence record, with expiration.

Configure SNMP on Big-IP by enabling SNMP agent and traps, using SNMP v3 with encryption, restricting allowed hosts, and testing with SNMP walk to monitor pool, virtual server, and node.

Configure snmp traps on the big ip for real-time notifications to the nms about node up and node down, using default traps and port 162.

Configure two BIG-IP devices in an active-active setup using traffic groups to distribute traffic. Learn to create floating and self IPs, virtual servers, SNAT, and deterministic failover between devices.

Explore high-availability networking with two virtual servers: assign floating IPs, traffic groups, and SNATs, linking virtual servers to VLAN-based traffic groups for resilient load balancing.

Learn how failover triggers work in a two-device ha pair, including system service failures, vlan fail-safe configurations, and fail-safe gateway monitoring with icmp, plus practical testing.

Learn how the best match strategy selects the most matched rule, breaks ties by operand priority (tcp vs http headers), then by rule order.

Learn to integrate BIG-IP with Active Directory to authenticate admin users, map AD groups to local roles, and enable LDAP TLS, fallback to local, and SSL peer verification.

Learn how to configure the geolocation database on BIG-IP, compare edge and pulse data from Digital Envoy, and update /shared/geoip while preserving the built-in database.

Configure FQDN nodes on the big-ip by resolving hostnames via DNS rather than hardcoding IPs. Enable auto populate to reflect DNS changes in pool members and monitor health.

Protects the BIG-IP from syn flood attacks by using syn cookies, eliminating half-open connection records and using a deterministic initial sequence number based on client IP, port, and time.

Demonstrate syn cookie protection by observing the tcp three-way handshake with tcpdump, simulating half-open connections, and configuring the virtual server to enforce maximum half-open connections and trigger syn cookie protection.

Protect the established connection table with the eviction policy by aggressively cleaning idle connections, using 85% and 95% capacity thresholds across global, virtual server, and root domain scopes.

Enable slow flow monitoring with 32 bytes per second threshold and 10-second grace; throttle connections; limit tcp reset and icmp unreachable, and apply max reject rate and max icmp rate.