F5 BIG-IP Administration & Local Traffic Manager (LTM)

1 ADC  - Network & Transport Internals  

• TCP deep dive: 3-way handshake edge cases، windowing، retransmission
• HTTP internals: keep-alive، pipelining، headers behavior
• TLS basics: handshake، session reuse
• DNS resolution path (client → resolver → authoritative)

2 Application Delivery Concepts

• ADC vs Reverse Proxy
• L4 vs L7 load balancing
• Full Proxy vs Packet Forwarding
• Latency components (client/server/network)

1 BIG-IP Architecture

• TMOS components
• TMM (Traffic Management Microkernel)
• Control Plane vs Data Plane
• CMP (multi-core processing)

2 Packet Flow

• Ingress → VLAN → TMM
• Virtual Server matching precedence
• SNAT decision tree
• Persistence lookup order
• Profile execution chain
• Egress rewrite

1  Device Initialization

• Licensing & Provisioning
• NTP, DNS, Time sync

2  Network Configuration

• VLAN / Trunk / LACP
• Self-IP و Port Lockdown
• Static/Dynamic Routing
• Route Domains (multi-tenant)

3 Configuration Management

• UCS/SCF backups
• tmsh basics
• partitions & RBAC

1 Nodes / Pools

• health state logic
• priority group activation
• slow ramp time

2 Virtual Servers

• Standard / Performance L4 / Forwarding / Reject
• match precedence (IP/Port/VLAN)

3 Profiles (Dependency Chain)

• TCP / HTTP / OneConnect
• SSL (Client/Server)
• Compression / Caching

• Static vs Dynamic algorithms
• Least Conn vs Fastest vs Observed
• Queueing & connection reuse
• Member vs Node decision impact

• Cookie (Insert/Rewrite/Passive)
• Source Address (scaling issues)
• SSL session persistence
• Universal persistence (iRule-based)
• Match Across (VS/Pool)

• L3/L4/L7 monitors
• Active vs Passive
• Timeout/Interval math
• Flapping mitigation
• Custom HTTP/External monitor

• SNAT vs Routing design
• SNAT Automap vs SNAT Pool
• Asymmetric routing issues
• Ephemeral port exhaustion
• VIP bounceback

• TCP optimization (buffers, idle timeout)
• HTTP optimization (pipeline, reuse)
• OneConnect misuse
• SSL offloading performance (TPS limits)
• Compression trade-offs

1 iRules  در context flow

• TCL basics  فقط به اندازه نیاز
• Event lifecycle:
  • CLIENT_ACCEPTED
  • HTTP_REQUEST
  • HTTP_RESPONSE
• performance impact

2 Local Traffic Policies

• match criteria (URI, header, IP)
• actions (redirect, forward, header rewrite)

• AVR analytics (HTTP/TCP metrics)
• Latency breakdown
• HSL (High-Speed Logging)
• syslog integration

• SYN flood protection (SYN cookie/check)
• Rate limiting با iRules
• Packet filters (ACL-like)
• SSL attack surface basics
• است scope LTM خارج از AFM

• Device Trust
• Sync / Failover
• Traffic Groups
• Active/Standby vs Active/Active
• Connection mirroring (cost)

1 Tools

• tcpdump  فیلترهای  F5: 0.0:nnn
• ssldump
• tmsh show/sys
• log analysis (/var/log/ltm, tmm)

2 Methodology

• Layered troubleshooting (L2→L7)
• flow reconstruction
• identify drop point

3 Common Failure Patterns

• SNAT missing
• Persistence mismatch
• Monitor false positive
• SSL handshake failure
• asymmetric routing