F5CAB3: BIG-IP Administration Data Plane ConfigurationDemo

Cookie persistence uses an HTTP cookie stored by each client to return that client to its previously selected pool member. It avoids treating every NATed client as the same source address, allowing initial client sessions to be distributed among pool members while retaining session affinity. Source-address affinity would map the shared NAT IP address to one member.

With priority-group activation set to a minimum of two active members, BIG-IP initially distributes connections to priority group 3. If priority groups 3 and 2 each have fewer than two available members, BIG-IP directs traffic to priority group 1. A priority-3 group with one failed member still has two active members, so traffic remains confined to that group.

A persistence profile maintains affinity between a client and a selected pool member. That affinity is honored for later traffic, so normal load-balancing selection may no longer distribute each new connection independently across the available members.

The virtual server must use UDP because conventional DNS queries are sent on UDP port 53. A TCP virtual server does not match those UDP flows. The configured /23 source network already includes both 192.168.101.100 and 192.168.101.200.

Least Connections (node) evaluates active connections for each backend node across the pool members that reference that node, so it directs new connections toward the backend server with the fewest current connections. Member-level methods count connections only for a specific pool member and can therefore fail to equalize totals when one server supports multiple services through several pools or virtual servers.

URI-based pool-member selection must occur in HTTP_REQUEST, when BIG-IP can examine HTTP::uri and use the pool command to select a pool or specific pool member before forwarding the request. F5’s iRule examples use HTTP_REQUEST for URI-based pool selection.

SSL termination on BIG-IP requires a Client SSL profile to decrypt client HTTPS connections, allowing HTTP processing and HTTP-level iRules. A Server SSL profile re-encrypts traffic between BIG-IP and the pool members; removing it and configuring the pool members for HTTP sends clear-text traffic to the web servers, offloading their SSL processing.

An HTTP/1.1 monitor request must include a Host header naming the target virtual host and end its headers with \r\n\r\n. Host: www.f5.com allows the server to select the intended website, while the final blank line completes the HTTP request. F5 documents this HTTP/1.1 send-string format, including the Host header and optional Connection: close header.

The built-in f5-tcp-progressive TCP profile enables Auto Proxy Buffer behavior, adjusting TCP buffer settings based on connection performance and bandwidth-delay characteristics. It is therefore the appropriate first profile to test for general TCP-performance improvement; f5-tcp-mobile is specialized for mobile traffic, and f5-tcp-legacy exists for backward compatibility.

A Forwarding (IP) virtual server forwards packets directly to the destination IP address in the client request and has no pool members to load balance; consequently, it cannot use a default pool.

SNAT port exhaustion means that the available TCP source-port translations for a SNAT address have been consumed for the relevant destination. Adding an IP address to the SNAT pool supplies another source-address range of ports, increasing the number of concurrent translations available. F5 documents log message 01010201 as an Inet port-exhaustion condition.