F5 F5CAB3 - BIG-IP Administration Data Plane Configuration (F5CAB3) exam

From the exhibit, the pool contains different applications on different service ports (for example, HTTP/80, FTP/21, HTTPS/443, SSH/22). To mark pool members correctly, BIG-IP must be able to verify the actual service running on each member’s port.

In BIG-IP Administration: Data Plane Configuration, monitor behavior is described as follows:

When multiple monitors are assigned to a pool, the Availability Requirement controls how monitor results are evaluated:

At least one = the pool member is marked up if any one of the assigned monitors succeeds.

All = the pool member is marked up only if every assigned monitor succeeds.

For pools containing members with different services/ports, using All can incorrectly mark members down because monitors intended for other services will fail on the wrong port.

Why C is correct:

Assigning HTTPS, HTTP, FTP, and SSH covers the actual services shown in the pool.

Setting the Availability Requirement to at least one ensures that each pool member is considered available when its appropriate service monitor succeeds, without being forced to pass unrelated service monitors.

Why the other options are incorrect:

A / D (Availability Requirement = all): would cause members to be marked down when unrelated monitors fail (e.g., SSH monitor against an HTTP member).

B (includes ICMP): ICMP can indicate the host is reachable even if the application service is down, which does not “accurately” reflect service availability.

Therefore, the best choice is HTTPS, HTTP, FTP, and SSH with Availability Requirement of at least one health monitor.

When a failover occurs in a standard BIG-IP High Availability (HA) pair, the newly active device takes over the floating IP addresses (Virtual Servers, Self IPs). By default, the new active device sends Gratuitous ARP (GARP) messages to the local network switch to inform it that these IP addresses are now associated with its own physical MAC addresses. However, network switches and intermediate routers often have ARP aging timers or security features that may delay the updating of their ARP tables, leading to " black-holed " traffic or dropped packets for several seconds or minutes until the network infrastructure correctly relearns the new path.

To eliminate this delay and ensure a seamless transition, a BIG-IP Administrator should Configure MAC Masquerade. MAC Masquerade allows the administrator to assign a unique, " virtual " MAC address to a specific traffic group. Instead of using the hardware-burned MAC address of the individual appliance, the active device uses this shared virtual MAC address for all communication involving floating IPs. When a failover occurs, the standby device assumes control of the traffic group and begins using the exact same virtual MAC address. Because the MAC address associated with the VIPs never changes from the switch ' s perspective, there is no need for the switch to update its MAC address table or for the surrounding infrastructure to update its ARP caches. This effectively eliminates the " stabilization period " reported by users, as the data plane transition happens almost instantaneously at Layer 2, maintaining continuous traffic flow without being hindered by external network re-convergence times.

In a default BIG-IP configuration, the system utilizes the Load Balancing Method (typically Round Robin) to distribute each new connection across available pool members. However, the introduction of a persistence profile fundamentally changes this behavior. Persistence (also known as " stickiness " ) ensures that once a client has been load balanced to a specific pool member, all subsequent requests from that same client during a defined session or timeout period are directed to that same member, bypassing the standard load balancing algorithm. This is critical for applications that maintain state, such as shopping carts or authenticated sessions, where moving a user to a different server would result in a loss of session data.

While other options affect traffic handling, they do not " alter " the fundamental load balancing decision in the same way. A OneConnect profile (Option A) optimizes connection management by pooling idle server-side connections; while it changes how connections are reused, the initial load balancing decision still follows the configured method. A fallback host (Option C) is only utilized when the primary pool is unavailable, and since the question states all pool members are online, it remains inactive. SNAT Automap (Option D) changes the source IP address of the packet as it exits the BIG-IP toward the server to ensure return traffic passes back through the ADC, but it does not dictate which server is chosen for the request. Therefore, the persistence profile is the primary configuration element that overrides the load balancing algorithm to maintain a client-to-server relationship.

SSH is a Layer 4 TCP-based protocol that operates on TCP port 22 and does not use HTTP in any capacity. In the exhibit, the Virtual Server is configured with an HTTP Profile applied, which is inappropriate for SSH traffic and causes connection failures.

According to the BIG-IP Administration: Data Plane Configuration documentation:

An HTTP profile must only be applied to Virtual Servers handling HTTP or HTTPS traffic.

When an HTTP profile is attached, BIG-IP expects HTTP headers and attempts to parse application-layer data.

Non-HTTP protocols such as SSH, FTP (control), SMTP, and other raw TCP services will fail if an HTTP profile is enabled.

Why the other options are incorrect:

A. Set Protocol to UDPSSH uses TCP, not UDP. Changing the protocol would break SSH entirely.

B. Set Source Address to 10.1.1.2The source address setting controls client access restrictions and is unrelated to protocol parsing issues.

C. Set Destination Address/Mask to 0.0.0.0/0The destination address is already valid for a specific SSH service and does not impact protocol handling.

Correct Resolution:

The BIG-IP Administrator should remove the HTTP Profile (set it to None) so the Virtual Server functions as a pure Layer 4 TCP service, allowing SSH connections to pass through successfully.

F5 provides several pre-configured (built-in) TCP profiles designed to optimize traffic for different network conditions. When an administrator is looking to improve general performance but does not have a specific, narrow use case (like strictly mobile or strictly long-haul WAN), the f5-tcp-progressive profile is the recommended starting point.

The f5-tcp-progressive profile is designed as a modern, high-performance replacement for the older default TCP settings. It incorporates several advanced congestion control algorithms and buffer management techniques that allow it to adapt dynamically to varying network latencies and packet loss scenarios. Unlike f5-tcp-legacy (Option A), which uses older, less efficient stacks, the progressive profile leverages modern TMM (Traffic Management Microkernel) optimizations.

While f5-tcp-mobile (Option B) is highly effective for high-loss cellular networks and f5-tcp-wan (Option D) is optimized for high-latency long-distance links, they can sometimes be too aggressive or poorly suited for standard campus or data center environments. The f5-tcp-progressive profile acts as a " best-of-all-worlds " template that typically provides an immediate performance boost for most web applications by improving window scaling and fast-retransmit behavior. Therefore, it is the procedural " first step " in TCP performance tuning before moving to more specialized, niche profiles.

The log message “Intercept exhaustion” indicates that the BIG-IP system has exhausted the available source port translations for one or more SNAT addresses. This occurs when too many concurrent client connections are being translated through a limited number of SNAT IP addresses, and all ephemeral source ports (typically ~64,000 per SNAT IP) are in use.

According to the BIG-IP Administration: Data Plane Configuration documentation:

Each SNAT IP address provides a finite number of available source ports.

When the number of concurrent connections exceeds the available port space, the BIG-IP logs an Intercept exhaustion error and new connections fail.

The recommended resolution is to increase the available SNAT resources by adding additional IP addresses to the SNAT pool.

Why the other options are incorrect:

A. Increase the timeout of the SNAT addressesIncreasing timeouts may actually worsen the problem by keeping ports allocated longer, accelerating port exhaustion.

B. Remove the SNAT pool and apply SNAT AutomapSNAT Automap uses the Self IP addresses on the egress VLAN, which may not provide additional capacity and can introduce routing or design issues. This is not a direct or recommended fix for SNAT exhaustion.

C. Remove an IP address from the SNAT poolThis would reduce the number of available source ports and further exacerbate the intercept exhaustion condition.

Correct Resolution:

By adding an IP address to the SNAT pool, the BIG-IP increases the total number of available source ports, alleviating intercept exhaustion and restoring successful client connections.

Application-specific health checks must validate application responses, which requires HTTP monitors with custom send/receive strings.

Connection rate limiting controls how many new connections per second are accepted, protecting backend resources.

Source Address Affinity (Persistence) works by tracking the source IP address of incoming packets to ensure a client stays connected to the same backend server. The " netmask " setting within the persistence profile determines the " granularity " of this tracking. A netmask tells the BIG-IP how many bits of the source IP address to ignore when creating the persistence record. For example, the current setting of 255.0.0.0 (a /8 mask) means the BIG-IP only looks at the first octet of the IP; this results in all users from the same large Class A network (e.g., everyone from 10.0.0.0 to 10.255.255.255) being persisted to the exact same server, which can lead to severe load imbalance.

To ensure that each unique IP address creates its own individual persistence record, the administrator must set the netmask to 255.255.255.255 (for IPv4). This is a " host mask " or /32, which instructs the BIG-IP to evaluate all 32 bits of the client ' s source IP address. With this setting, 10.1.1.1 and 10.1.1.2 will be treated as distinct entities and can be load balanced to different servers, each maintaining their own " stickiness " . While Option A (255.255.255.0) would group users by their local subnet, only the full 255.255.255.255 mask satisfies the requirement for true unique-IP persistence. This configuration is standard for internet-facing applications where users arrive from diverse locations and the administrator wants to maintain the most granular and balanced distribution of traffic possible.

Standard BIG-IP administration dictates that hardware-level physical attributes are managed within the Network section of the configuration. When a network switch and a BIG-IP fail to successfully negotiate speed and duplex settings (Auto-Negotiation), it can result in CRC errors, late collisions, or a total lack of link. To resolve this manually, the administrator must navigate to the Configuration Utility (GUI) and go to Network > Interfaces.

Within the Interfaces list, the administrator can select the specific physical port (e.g., 1.1 or 1.2) and modify its properties. By default, the media speed is set to " Auto, " but the drop-down menu allows for manual selection of specific speeds (e.g., 100Mb/s, 1Gb/s, 10Gb/s) and duplex settings (Full or Half). While these changes can also be made via the TMOS Shell (TMSH) (Option B) using the modify net interface command, the question asks for the standard location, which in most administrative contexts refers to the primary GUI path. System > Configuration (Option D) is used for global device settings like NTP, DNS, and licensing, not for interface-specific physical layer parameters. The Front Console (Option A), referring to the LCD panel on physical appliances, is primarily used for initial management IP setup and viewing system alerts, but does not provide the granular interface configuration required for media speed adjustments.