F5 Networks F5CAB2 Exam Questions

In a large-scale BIG-IP environment with hundreds of virtual servers, the Network Map is the most effective tool for visualizing and auditing the relationships between various ADC objects.

The Network Map Functionality: The Network Map provides a hierarchical view of the local traffic objects. It allows an administrator to see the status and dependencies of Virtual Servers, Pools, Pool Members, and associated iRules all in one screen.

Search and Filter: By navigating to Local Traffic > Network Map, the administrator can use the Advanced Filter. This feature allows for searching specifically for an iRule name or a string within an iRule definition. Once the filter is applied, the system displays only the Virtual Servers that are associated with that specific iRule.

Efficiency: While the 'Virtual Server List' (Option D) can be customized to show columns for iRules, it is often cumbersome to scroll through hundreds of entries. The 'iRules List' (Option B) displays the scripts themselves but does not provide a reverse-lookup list of all associated virtual servers in a single view as efficiently as the Network Map.

Summary of Relationships: The Network Map is specifically designed to answer the question, 'What is this object connected to?' making it the primary administrative interface for impact analysis during configuration changes.

According to F5 BIG-IP documentation regarding High Availability and MAC Masquerade behavior, the system allows for more granular control over Layer 2 addresses during failover events.

Standard MAC Masquerade: By default, when a traffic group is assigned a MAC masquerade address (like 02:12:34:56:00:00), the BIG-IP system uses that exact MAC address for all traffic associated with that traffic group across all VLANs. This ensures that upstream switches do not need to relearn ARP entries for the Virtual IP, but it can cause issues in environments where multiple VLANs share the same physical infrastructure or monitoring tools that flag identical MACs across segments.

Per-VLAN MAC Masquerade: When the system database variable tm.macmasqaddr_per_vlan is set to true, the BIG-IP system calculates a unique MAC address for each VLAN. It does this by taking the base MAC masquerade address configured in the traffic group and adding the VLAN ID (tag) to it.

Calculation Logic:

Base MAC: 02:12:34:56:00:00

VLAN ID: 1501

To find the suffix, the VLAN ID is converted from decimal to hexadecimal:

$1501$ in decimal = 05DD in hex.

The system then applies this offset to the last two octets of the base MAC address.

00:00 + 05:DD = 05:DD.

Result: The final MAC address for VLAN 1501 becomes 02:12:34:56:05:dd.

This ensures that every VLAN has a unique Layer 2 identity while still reaping the benefits of 'gratuitous ARP-less' failover provided by MAC masquerading.

In the BIG-IP system, when you need to prevent traffic from reaching a specific destination or being processed by the system, you utilize specific Virtual Server types that act as 'denial' points.

Reject Virtual Servers: When a packet matches a Reject virtual server, the BIG-IP system stops the packet from being processed and sends a reset (RST) in the case of TCP, or an ICMP unreachable message in the case of UDP. This is the preferred method for 'blocking' specific IPs when you want the sender to receive immediate notification that the connection was refused.

Drop Virtual Servers: A Drop virtual server simply discards the packet without sending any response back to the source. While effective for 'stealthing' a network, it is often less desirable for standard administration unless specifically mitigating a DoS attack.

Comparison with Standard: A Standard virtual server is used to process and load balance traffic to a pool of members; it does not inherently act as a 'blocking' mechanism for a single IP within a subnet unless combined with complex iRules or Packet Filters.

Context of the Questio n: To block responses (or connection attempts) for a specific IP while other traffic in the subnet might be handled by more permissive virtual servers, a more specific (higher precedence) Reject virtual server is the standard administrative approach.

When managing a large environment with hundreds of Virtual Servers, the most efficient way to identify the relationship between an iRule and the objects it manages is to view the properties of the iRule itself.

iRule Properties: Within the BIG-IP Configuration Utility, navigating to Local Traffic > iRules and selecting a specific iRule provides a 'Statistics' or 'Usage' tab (depending on the version). This view explicitly lists all Virtual Servers currently associated with that specific iRule.

Centralized Management: Instead of manually checking 235 individual Virtual Servers under the 'Virtual Servers' menu, the iRules menu acts as a central point of reference for that specific logic.

Data Plane Impact: Because iRules can modify traffic flow, headers, and load balancing decisions, seeing the full list of affected Virtual Servers is critical before making adjustments to avoid unintended side effects across the application portfolio.

With Least Connections (member), BIG-IP attempts to send new connections to the pool member with the fewest current connections. In a perfectly ''stateless'' scenario (no affinity), this often trends toward a fairly even distribution over time.

However, persistence overrides load balancing:

When a persistence profile is applied, BIG-IP will continue sending a client (or client group) to the same pool member based on the persistence record (cookie / source address / SSL session ID, etc.).

This means even if another pool member has fewer connections, BIG-IP may still select the persisted member to honor session affinity.

The result can be uneven active connection counts, even though the configured load balancing method is Least Connections.

Why the other options are not the best cause:

A . Priority Group Activation is disabled

Priority Group Activation only affects selection when priority groups are configured; disabling it does not inherently create uneven distribution under Least Connections.

B . SSL Profile Server is applied

A server-side SSL profile affects encryption to pool members, but it does not by itself cause skewed selection across pool members. (Skew could happen indirectly if members have different performance/latency, but that's not the primary, expected exam answer.)

D . Incorrect load balancing method

Least Connections is a valid method and does not itself explain unevenness unless something is overriding it (like persistence) or pool members are not all eligible.

Conclusion:

A persistence profile is the most common and expected reason that active connections become unevenly distributed, because persistence takes precedence over the Least Connections load-balancing decision.