F5CAB1: BIG-IP Administration Install, Initial Configuration, and UpgradeDemo

BIG-IP module provisioning includes the Dedicated and Nominal resource-allocation levels. Dedicated assigns all CPU, memory, and disk resources to one module, while Nominal assigns the minimum required resources initially and may allocate remaining resources afterward.

BIG-IP creates a new volume when a software image is installed with the TMSH create-volume option, using install /sys software image <software>.iso volume <volume_number> create-volume. The Configuration Utility also creates a new volume when an available image is installed from System > Software Management and a new volume-set name or number is entered.

When an unlicensed module is provisioned, BIG-IP displays a Provisioning Warning in the Configuration utility. F5 documentation also notes a ModuleNotLicensed status at the command line.

Traffic for a defined virtual server is permitted independently of the self IP’s Port Lockdown setting. ICMP to a self IP is implicitly allowed, and Centralized Management Infrastructure (CMI) peer communication uses TCP port 4353 regardless of that setting. SSH is not a Port Lockdown exception.

The Service Check Date controls which BIG-IP software versions the license is entitled to run. Installing a BIG-IP release issued after that date requires renewing or reactivating the license so the Service Check Date is updated. F5 documentation identifies the Service Check Date as important for upgrades because it determines which BIG-IP upgrades are available.

The sys management-ip component contains the management-interface IP address configuration, and its documented display command is list management-ip. The fully qualified tmsh form is list / sys management-ip.

The sys httpd allow setting controls which clients may access the Configuration Utility. Its add operation appends permitted entries, and each /24 network must be specified as a network-and-netmask pair, such as 172.28.31.0/255.255.255.0.

Configuration Utility access is handled by BIG-IP's HTTP daemon. Its allowed client IP addresses are configured with the command-line sys httpd allow setting; the separate SSH IP allow list applies only to the SSH daemon.

replace-all-with { 10.0.0.0/24 } replaces the SSH daemon allow list with the 10.0.0.0/24 subnet. Its usable host addresses include 10.0.0.100 and 10.0.0.254. F5 documents sys sshd allow as the setting that configures servers permitted to access the system.

LTM provides load balancing and ASM provides web application firewalling, so those two modules should be provisioned at Nominal and the unused APM and AFM modules set to None. Nominal shares the available resources among active modules. A Dedicated setting allocates all resources to one module and requires all other modules to be set to None, so it cannot be used for both LTM and ASM.

The Dedicated provisioning level assigns all CPU, memory, and disk resources to a single module and sets every other module to disabled. This provides exclusive system resources for ASM.

BIG-IP automatic activation contacts F5’s default licensing server at activate.f5.com (typically over TCP port 443) to obtain and validate the license.

BIG-IP VE can set an unassigned management address from the hypervisor console by running config, which opens the Management Port Setup utility. A management interface address is also configured in TMSH through the sys management-ip object, using create sys management-ip <IP>/<prefix>. The ltm module does not own management-IP configuration.

BIG-IP Self IP Port Lockdown uses an allow list. Allow Custom lets an administrator specify the TCP and UDP ports/services permitted on that Self IP; services not included in the custom list, including port 443, are refused. This preserves connectivity for the other explicitly allowed ports.

The Service Check Date determines whether the installed BIG-IP software version is covered by the system license. BIG-IP verifies this license requirement as part of software installation or upgrade; if the date is insufficient for the target release, the license must be reactivated before proceeding.

For devices configured in a synchronization group, peer devices use CMI over TCP port 4353. This traffic is permitted regardless of the Self-IP Port Lockdown configuration.

HD1.2 is the completed software volume containing BIG-IP 13.1.0.6. switchboot -b HD1.2 selects that volume as the next boot location, and a subsequent reboot starts the device from it. F5 TMSH documentation likewise identifies a named software volume as the boot target when rebooting.

list /sys provision displays the current provisioning configuration for BIG-IP modules. The GUI’s System > Resource Provisioning page also shows provisioned modules and their allocation levels. The generic show command is intended for status and statistics; the provisioning component’s documented configuration display command is list provision (or show running-config provision).