F5 Networks F5CAB2 Exam Questions

Comprehensive and Detailed Explanation (BIG-IP Administration -- Data Plane Concepts):

In an Active/Standby BIG-IP design, application availability during failover depends on both units having equivalent data-plane connectivity for the networks that carry application traffic. Specifically:

VLANs are bound to specific interfaces (and optionally VLAN tags).

Floating self IPs / traffic groups move to the new Active device during failover.

For traffic to continue flowing after failover, the new Active device must have the same VLANs available on the correct interfaces that connect to the upstream/downstream networks.

What the symptom tells you:

Traffic works when Device A is Active

Traffic fails when Device B becomes Active

Failback immediately restores traffic

This pattern strongly indicates the Standby unit does not have the VLAN connected the same way (wrong physical interface assignment), so when it becomes Active, it owns the floating addresses but cannot actually pass traffic on the correct network segment.

Why Interface mismatch is the best match:

If the Active unit is already working, its interface mapping is correct.

The fix is to make the Standby unit's VLAN/interface assignment match the Active unit.

That corresponds to changing the Standby device interface to 1.1.

Why the Tag options are less likely here (given the choices and the exhibit intent):

Tag issues can also break failover traffic, but the question/options are clearly driving toward the classic HA requirement: consistent VLAN-to-interface mapping on both devices so the data plane remains functional after the traffic group moves.

Conclusion: To avoid an outage on the next failover, the BIG-IP Administrator must ensure the Standby device uses the same interface (1.1) for the relevant VLAN(s) that carry the application traffic, so when it becomes Active it can forward/receive traffic normally.

Comprehensive and Detailed Explanation From BIG-IP Administration Data Plane Concepts documents:

This question tests understanding of Priority Group Activation (PGA) and how BIG-IP determines which pool members are eligible to receive traffic.

Key BIG-IP Priority Group Concepts:

Higher priority group numbers = higher priority

BIG-IP will only send traffic to the highest priority group that meets the Priority Group Activation condition

Lower priority groups are activated only when the condition is met

Only available (green) members count toward the activation threshold

Configuration from the Exhibit:

Priority Group Activation: Less than 2 available members

Pool Members and Status:

Pool Member Priority Group Status

serv1 2 Active (available)

serv2 2 Inactive (down)

serv3 1 Active (available)

serv4 1 Active (available)

Step-by-Step Traffic Decision:

BIG-IP first evaluates the highest priority group (Priority Group 2)

Priority Group 2 has:

serv1 available

serv2 unavailable

Total available members = 1

Activation rule is Less than 2 available members

Condition is true (1 < 2)

BIG-IP activates the next lower priority group (Priority Group 1)

Traffic is now sent to:

serv1 (Priority Group 2)

serv3 and serv4 (Priority Group 1)

Final Result:

Traffic is distributed to serv1, serv3, and serv4

Why the Other Options Are Incorrect:

A -- Ignores activation of the lower priority group

B -- serv4 is also active and eligible

C -- serv2 is down and cannot receive traffic

Key Data Plane Concept Reinforced:

Priority Group Activation controls when lower-priority pool members are allowed to receive traffic, based strictly on the number of available members in the higher-priority group. In this case, the failure of one high-priority member caused BIG-IP to expand traffic distribution to lower-priority members to maintain availability.

===========

Comprehensive and Detailed Explanation From BIG-IP Administration Data Plane Concepts documents:

In BIG-IP high availability (HA) configurations, MAC Masquerade is used to speed up failover by allowing traffic-group-associated Self IPs to retain the same MAC address when moving between devices. This prevents upstream switches and routers from having to relearn ARP entries during a failover event, resulting in near-instant traffic recovery.

By default, MAC masquerade applies one MAC address per traffic group, regardless of how many VLANs the traffic group spans. This can create problems in some network designs because the same MAC address appearing on multiple VLANs may violate network policies or confuse switching infrastructure.

To address this, BIG-IP provides Per-VLAN MAC Masquerade, enabled by the database variable:

`tm.macmasqaddr_per_vlan = true`

When this feature is enabled:

BIG-IP derives a unique MAC address per VLAN

The base MAC address configured on the traffic group remains the first four octets

The last two octets are replaced with the VLAN ID expressed in hexadecimal

The VLAN ID is encoded in network byte order (high byte first, low byte second)

### VLAN ID Conversion:

VLAN ID: 1501 (decimal)

Convert to hexadecimal:

1501 = 0x05DD

High byte: 05

Low byte: DD

### Resulting MAC Address:

Base MAC: `02:12:34:56:00:00`

Per-VLAN substitution last two bytes = `05:DD`

Final MAC address:

`02:12:34:56:05:dd`

### Why the Other Options Are Incorrect:

A (01:15) -- Incorrect hexadecimal conversion of 1501

B (dd:05) -- Byte order reversed (little-endian, not used by BIG-IP)

D (15:01) -- Uses decimal values instead of hexadecimal

### Key BIG-IP HA Concept Reinforced:

Per-VLAN MAC Masquerade ensures Layer 2 uniqueness per VLAN while preserving the fast failover benefits of traffic groups, making it the recommended best practice in multi-VLAN HA deployments.