F5 BIG-IP General Reference

Concepts, architecture, and admin reference for F5 BIG-IP.

For CLI commands see: F5 - Load Balancer Commands For packet captures see: F5 - Packet Capture (tcpdump)

Platform Types

Type	Description
Hardware	Physical appliances (i-series, VIPRION)
Virtual Edition (VE)	VM deployment (VMware, Hyper-V, KVM, cloud)
vCMP Guest	Virtual instance on vCMP-capable hardware

vCMP (Virtual Clustered Multiprocessing)

Virtualization technology that couples a custom hypervisor on the BIG-IP host with hardware-specific scalable guest VMs running TMOS. Now called “Tenant” in newer documentation. Allows multiple isolated BIG-IP instances on a single chassis.

Core LTM Objects

Object	What it is	Why it matters
Virtual Server (VS)	Listener on an IP:port (VIP)	Front door for client traffic
Pool	Group of backend members	Defines where traffic can go
Pool Member	IP:port of a backend service	Actual target for load balancing
Node	Backend server IP	Reusable server definition for members
Profiles	L4/L7 behavior settings	Enable TCP/SSL/HTTP behaviors
iRules / LTM Policy	Event-driven logic or declarative rules	Customize traffic handling
Persistence	Stickiness configuration	Keeps a client on the same member

Object Hierarchy

Node → Pool Member → Pool → Virtual Server
         ↑              ↑
      Monitor      Load Balance Method

Virtual Server Types

Type	Layer(s)	Description	Use Case
Standard	L4 / L7	Most common. Manages TCP/UDP and listens on a specific IP:port	General applications requiring traffic management
Forwarding (IP)	L3	Forwards packets based on IP headers. No connection termination	Simple packet forwarding without ADC features
Performance (L4)	L4	Optimized for high-speed L4 traffic. Terminates at TCP/UDP layer	High throughput / low latency (e.g., telecom)
Reject	L3 / L4	Rejects traffic. Can log or drop connections	Blocking unwanted traffic or null routing
DHCP	L7 (DHCP)	Manages DHCP traffic	DHCP services managed through BIG-IP
Internal	L7	Internal processes within BIG-IP, not for client-server traffic	Internal BIG-IP process management

HTTPS Flow Through BIG-IP

Client connects to a VIP on :443, BIG-IP terminates TLS, inspects HTTP, then optionally re-encrypts to servers.

Phases

Phase	What happens	Profiles that matter	Notes
1	Client TCP handshake to VIP:443	Client TCP	L4 connection establishment
2	TLS handshake (clientside). BIG-IP terminates TLS	Client SSL	Client cert validation only if mTLS configured
3	HTTP parsing / normalisation (traffic is decrypted)	HTTP profile	Enables iRules/LTM policy actions based on headers/URI
4	Policy / iRules / persistence / LB selection	VS + iRules + persistence + pool	Decision can be L4 or L7 depending on config
5	BIG-IP establishes or reuses serverside TCP connection	Server TCP (+ OneConnect if used)	Not always a new connection
6	BIG-IP establishes serverside TLS (re-encrypt)	Server SSL	Server cert validation depends on trust settings
7	HTTP request sent to pool member; response returns	HTTP profile	HSTS insertion happens on response to client, not to server
8	Response is re-encrypted to clientside TLS session	Client SSL	Client receives HTTPS response

At-a-Glance

Client -> VIP:443 (TCP)
Client <-> BIG-IP (TLS clientside)
BIG-IP (HTTP parse, policy, persistence, LB)
BIG-IP <-> Pool Member (TCP)
BIG-IP <-> Pool Member (TLS serverside, if enabled)
Response -> BIG-IP -> Client (TLS)

Client SSL and Server SSL are separate profiles — validation and certs are independent.

Modules and Products

Module	Description	Key Features
LTM	Local Traffic Manager — virtual servers, pools, load balancing	Traffic management, load balancing, SSL offloading
DNS (formerly GTM)	Authoritative DNS resolver, DNSSEC, and DR. Directs traffic by requestor IP to closest data center	Geo-location routing, disaster recovery
APM	Access Policy Manager — access control, identity, federation (SSO, SAML, OAuth). Inspects device and applies granular policies	Access control, identity management, policy enforcement
SWG	Secure Web Gateway — works with APM. Restricts outbound traffic via allow/deny lists	Web traffic filtering, data loss prevention
ASM	Application Security Manager — Layer 7 WAF. Protects against SQL injection, XSS, etc.	Web app protection, OWASP mitigations
AFM	Advanced Firewall Manager — L3/L4 firewall, primarily DDoS protection. Works alone or with ASM	Network firewall, DDoS protection
AAM	Application Acceleration Manager — optimisation for high-latency, WAN, database replication	Traffic optimisation, WAN acceleration
BIG-IQ	Centralised management for BIG-IP devices	Device management, configuration, reporting
Silverline	Cloud-based DDoS protection service	DDoS mitigation, cloud security

High Availability

HA Modes

Mode	Description
Active/Standby	One unit handles traffic, other is backup
Active/Active	Both handle traffic for different virtual addresses
N+M	Multiple active units with M standbys (VIPRION)

Key Concepts

Device Trust: Secure communication between HA peers
Device Group: Collection of devices that sync configurations
Traffic Group: Floating IP addresses that failover together
Sync-Failover: Devices sync config AND can failover traffic groups

HA Verification

show sys failover
show cm device
show cm device-group
show cm sync-status
show cm traffic-group

Networking

VLAN and Self-IP Concepts

VLAN: Layer 2 segment
Self-IP: IP assigned to F5 on a VLAN
Floating IP: Shared IP that moves between HA peers

SNAT (Source NAT)

Mode	Description
Automap	Uses self-IP of egress VLAN
SNAT Pool	Dedicated pool of IPs for translation
None	Preserves client IP (requires server default route through F5)

Admin Tasks

UCS Backup

# Create backup
tmsh save sys ucs /var/local/ucs/backup-$(date +%Y%m%d).ucs
 
# With private keys
tmsh save sys ucs /var/local/ucs/backup.ucs passphrase [password]
 
# List backups
ls -la /var/local/ucs/

Restore UCS

tmsh load sys ucs /var/local/ucs/backup.ucs
# Optionally: no-license, no-platform-check

Upgrade Workflow

Prep
- Save UCS backup
- Verify HA sync
- Download ISO to /shared/images/

Install (standby first)

install sys software image [image-name] volume [HD1.2]

Reboot to new volume
```
reboot volume [HD1.2]
```
Verify
- Check version: show sys version
- Test functionality
- Failover and repeat on peer

License Check

show sys license
show sys license detail

Logging

Log File	Contents
`/var/log/ltm`	LTM events, pool/member status
`/var/log/apm`	Access Policy Manager
`/var/log/gtm`	Global Traffic Manager
`/var/log/asm`	Application Security Manager (WAF)
`/var/log/audit`	Configuration changes

Quick Reference

Common Ports

Port	Use
443/TCP	GUI (Configuration utility)
22/TCP	SSH
4353/TCP	iQuery (GTM sync)
1026/UDP	Network failover
6699/TCP	ConfigSync

Reminders

HSTS: Inserted on the response to the client, not sent to the pool member
OneConnect: Allows serverside connection reuse; affects Phase 5 (serverside TCP) behavior

Michael Lorincz — Technical Notes

Explorer

F5 - General Notes