VMware 6V0-22.25 - VMware Avi Load 30.x Administrator

Avi upgrades can be performed with minimal disruption when Virtual Services have sufficient Service Engine redundancy. VMware Avi documentation for upgrades explains that upgrades are disruptive for Virtual Services running in Elastic HA N+M Buffer mode when the Virtual Service is placed on only one Service Engine and is not scaled out. The default Service Engine Group configuration commonly results in a Virtual Service being placed on a single active Service Engine unless it is manually or automatically scaled out. During a Service Engine upgrade, traffic can be interrupted if there is no additional active Service Engine already carrying that Virtual Service. Therefore, the most likely cause of the outage is that the Virtual Service was not scaled out.

Avi Virtual Services need a valid traffic-forwarding path. A default pool, pool group, or valid scripted pool-selection logic is required so the Service Engine can determine where to send matching application traffic. Broadcom’s DataScript documentation includes pool functions such as forwarding a request to the default pool and selecting pools by script, which shows that DataScript pool handling depends on valid pool references. If a DataScript is attached without an appropriate default pool or pool-selection path, the Service Engine cannot correctly process traffic for that Virtual Service, which can result in the Virtual Service being marked down. A wrong health monitor marks pool members down, not necessarily the Virtual Service itself. A local response or redirect policy can still respond without forwarding to a pool.

In Avi Elastic HA N+M mode, the N value represents the minimum active scale required for a Virtual Service, while M represents additional capacity maintained for resiliency. Broadcom’s Avi documentation explains that in N+M Elastic HA, M is the number of additional or buffer Service Engines that the Avi Load Balancer Controller maintains in the Service Engine Group. These buffer Service Engines provide spare capacity for failover, scale-out, and placement flexibility. This is separate from the maximum number of Service Engines in the group, which defines the upper limit of SEs that can exist. It is also separate from the maximum number of Virtual Services per Service Engine. Therefore, the “M” in N+M Elastic HA refers to the number of buffer Service Engines .

The Basic Virtual Service creation workflow is intended for common settings and does not expose every placement and advanced option. VMware Avi documentation states that creating a Virtual Service in Advanced Setup allows configuration of all options through the available tabs. Service Engine Group selection is a Virtual Service placement property, so when a Virtual Service must be placed on Service Engines belonging to a specific Service Engine Group, the administrator should use Advanced Setup and set the Service Engine Group in the Advanced section. The Policy section is for traffic policy logic, not Service Engine placement. Therefore, the correct method is to create the Virtual Service in Advanced mode and override the default Service Engine Group in the Advanced section.

The Avi architecture separates control-plane and data-plane responsibilities. Service Engines perform data-plane tasks, including traffic processing, inserting persistence cookies, health checking pool members, and handling load-balanced connections. The Avi Controller provides centralized management, analytics, configuration, and operational visibility. Broadcom’s Avi documentation explains that when an administrator requests to view Virtual Service or pool logs, the Controller pulls logs from Service Engines, indexes them, and displays the results. This makes log indexing a Controller function. By contrast, inserting cookies and checking backend server health occur in the Service Engine data plane. Active-active packet processing decisions are also handled by Service Engines according to the Virtual Service placement and traffic flow. Therefore, the task performed by the Avi Controller is indexing client logs .

The default Avi Load Balancer behavior for impending SSL/TLS certificate expiration includes visible operational indicators in the UI and health score impact. VMware Avi documentation explains that certificates approaching expiration affect the Virtual Service by applying a security penalty. At 30 days before expiration, the Virtual Service incurs a 20-point security penalty and the maximum health score is capped at 80. The certificates page also provides visual indication of certificate status using color changes as certificates approach expiration. Email and SNMP alerting require notification or external integration configuration, so they are not the default mechanisms. A top red UI banner is not the standard default certificate-expiry alerting mechanism described for this case. Therefore, the correct default mechanisms are health score security penalty and SSL certificate color status indicators.

In a VMware vSphere environment, an Avi Service Engine is deployed as a virtual machine with virtual network adapters. Broadcom’s Avi documentation references Service Engine VM adapters as network adapter 1 through network adapter 10. Adapter 1 is normally used for management, while the remaining adapters can be used for data, VIP, or backend connectivity depending on the cloud and network design. The documentation also references the “remaining nine data interfaces,” which confirms that the Service Engine VM can have a total of ten virtual network adapters. Therefore, the maximum number of virtual network adapters that can be used on a single Service Engine in vSphere is 10 .

Avi Load Balancer supports sharing a single VIP across multiple Virtual Services when the Virtual Services use different listener ports. This is the correct design when different application protocols must be served on the same IP address but require different profiles, pools, and processing behavior. An existing Layer 7 HTTPS Virtual Service with SSL termination and WAF should not be converted into a mixed L7/L4 object for SMTP. SMTP should use its own Virtual Service with an appropriate Layer 4 profile and backend SMTP pool. Broadcom documentation specifically states that a single VIP can be shared across multiple Virtual Services by choosing different ports for each Virtual Service. Therefore, the correct approach is to create a second Virtual Service reusing the same VIP, with separate SMTP listener ports, L4 profile, and SMTP pool.

Connection Multiplexing is most valuable when client behavior would otherwise create many short-lived server-side TCP connections. HTTP/1.0 is the best fit for this benefit because HTTP/1.0 commonly opens a separate TCP connection for each request unless keepalive behavior is specifically used. Avi Connection Multiplexing decouples the client-side connection from the server-side connection and allows the Service Engine to reuse server-side TCP connections for multiple HTTP requests. This reduces connection setup and teardown load on backend servers. HTTP/1.1 already introduced persistent connections as a standard behavior, so the relative benefit is smaller than with HTTP/1.0. HTTP/2 has its own multiplexing model at the protocol level. Therefore, Connection Multiplexing is most valuable for HTTP v1.0 .