F5CAB5 Exam Dumps - BIG-IP Administration Support and Troubleshooting (F5CAB5) exam

Troubleshooting SSL connection resets often involves verifying license limits against actual resource utilization. F5 devices use a "Transactions Per Second" (TPS) license to control the amount of SSL processing the device can handle. The log entry SSL transaction (TPS) rate limit reached is a clear indicator that the traffic volume has exceeded the licensed capacity. When determining the necessary license level, it is important to know that F5 primarily licenses and limits the "Client-side" SSL TPS—which represents the encrypted connections between the users and the virtual servers. In this specific scenario, the peak demand reached 1200 client-side transactions per second. Although there were also 800 server-side transactions (re-encryption from the BIG-IP to the pool), these typically do not count against the primary TPS license limit in the same manner. Therefore, to ensure that the virtual server works as expected during peak load, the administrator must upgrade the license to at least 1200 TPS. This troubleshooting process links system log errors to license-enforced resource constraints.

The issue described is a classic case of asymmetric routing in a "one-arm" or same-subnet topology.

Symptom Analysis: The Virtual Server (10.10.1.100) and the pool members (10.10.1.101 and 10.10.1.102) are on the same subnet.

The Problem: When a client sends a request to the VIP, the BIG-IP translates the destination IP but keeps the client's original source IP. The server receives the packet and sees a source IP from a different subnet. Instead of sending the response back to the BIG-IP, the server sends it directly to its default gateway. The client receives a response from the server's IP, which it doesn't recognize, causing the connection to fail.

The Solution: Enabling SNAT Auto Map ensures the BIG-IP changes the source IP of the packet to its own self-IP. This forces the pool member to send the response back to the BIG-IP, which then translates it correctly and sends it to the client.

Incorrect Options: Adding an HTTP profile (Option B) or an HTTP monitor (Option C) would enhance the configuration but would not fix the underlying Layer 3 routing issue causing the traffic drop.

According toofficial F5 documentation (K52015891 – Troubleshooting BIG-IP power supply issues),hardware-related alerts for power supplies, fans, and chassis components are logged in /var/log/ltm.

When a BIG-IP device experiences a power supply issue—such as failure, intermittent outages, or fan-related faults—the system generates alerts through internal platform monitoring services. These alerts are written to the/var/log/ltmfile and often appear with messages similar to:

Chassis power supply 2 has experienced an issue. Status is as follows: FAN=bad; STATUS=bad.

This makes /var/log/ltm theauthoritative log filefor identifying and verifying power supply and chassis-related problems on BIG-IP systems.

The other log files are not appropriate for this purpose:

/var/log/daemon.logcontains general daemon messages but isnot the primary sourcefor chassis hardware alerts.

/var/log/kern.loglogs kernel-level events, not platform power status.

/var/log/auditrecords administrative actions and configuration changes.

Conclusion:

Per F5-supported guidance, when suspecting power supply outages or chassis hardware issues, the BIG-IP Administrator shouldalways check /var/log/ltm first.

To collect application-layer details such asHTTP status codes(200, 404, 500, etc.) andHTTP methods(GET, POST, PUT, DELETE), the BIG-IP system must use a profile designed for traffic visibility and reporting rather than basic traffic handling. TheAnalytics profile (Option C)is the correct choice because it is specifically designed to collect, store, and present detailed statistics about HTTP and TCP traffic passing through a virtual server.

When an Analytics profile is attached to a virtual server, BIG-IP can record metrics such as HTTP response codes, request methods, URI paths, latency, throughput, and client-side/server-side performance data. These statistics are then accessible through the BIG-IP GUI underStatistics → Analytics, allowing administrators to validate application behavior and troubleshoot performance or functional issues.

TheHTTP profile (Option B)enables HTTP protocol awareness and features like header insertion and compression, but it does not provide historical or statistical reporting of HTTP methods and response codes.Request Adapt (Option A)is used for ICAP-based content adaptation, not visibility.Statistics (Option D)is not a standalone profile and does not provide HTTP-level insight.

Therefore, the Analytics profile is the only default profile that fulfills this requirement.

The failure to connect is caused by a restrictive Source Address filter configured on the Virtual Server.

Source Address Filtering: In the BIG-IP system, the Source Address field on a Virtual Server acts as an implicit Access Control List (ACL). Only traffic originating from a client IP address that matches the specified network range will be accepted and processed by the Virtual Server.

Analyzing the Exhibit: The provided configuration for vs_http shows the Source Address is set to 10.128.10.0/24. This means the Virtual Server will only accept connections from the subnet ranging from 10.128.10.1 to 10.128.10.254.

Identifying the Conflict: The user trying to connect has the IP address 192.168.162.70. Since 192.168.162.70 does not fall within the allowed 10.128.10.0/24 range, the BIG-IP system will not match this traffic to the Virtual Server, effectively blocking the connection attempt.

Evaluation of Other Options:

All Ports (Option A): Configuring a Virtual Server for "All Ports" (port 0) allows it to handle traffic for any destination port, which would not block a standard HTTP application.

Destination Address (Option B): The destination address 192.168.162.80 is the Virtual IP (VIP) users should be connecting to; this is a standard configuration and not the cause of the failure for a user reaching out to it.

Standard Type (Option C): A "Standard" Virtual Server is the most common type used for HTTP applications as it allows for Layer 7 profiles and full proxy capabilities.

Comprehensive and Detailed Explanation From BIG-IP Administration Supp13ort and Troubleshooting documents: When troubleshooting a Virtual Server that is not working as expected, it is critical to ensure that the applied profiles match the type of traffic being processed. SSH (Secure Shell) is a non-HTTP protocol that operates over TCP. The exhibit indicates that an HTTP profile is applied to the Virtual Server14. An HTTP profile instructs the BIG-IP system to parse traffic as HTTP; however, since SSH traffic does not follow HTTP specifications, the BIG-IP's parser will fail to understand the data stream, typically resulting in dropped packets or reset connections15. To fix this, the administrator must set the HTTP profile to "None"16. This allows the Virtual Server to act as a "Standard" or "FastL4" listener that passes the encrypted SSH data transparently to the backend pool members without attempting application-layer inspection. This highlights a common troubleshooting step: verifying that L7 profiles are not inadvertently applied to L4 traffic, which disrupts the expected traffic flow between the client and the server.

To gather granular Layer 7 data such as specific HTTP methods (GET, POST, etc.) and HTTP status codes (200, 404, 500), the BIG-IP system utilizes the Analytics (AVR) profile.

Analytics Profile (Application Visibility and Reporting): While a standard HTTP profile tracks basic byte counts and requests, the Analytics profile is designed specifically to capture, analyze, and display detailed application performance metrics.

Metrics Captured: When attached to a virtual server, it records URL-level statistics, response codes, page load times, and client-side metrics.

Why not others? * HTTP Profile (Option A): This profile handles the parsing of HTTP traffic but does not provide a built-in reporting dashboard for status code distribution.

Statistics Profile (Option C): This is a legacy profile used for custom user-defined counters and does not automatically categorize HTTP methods or status codes.

Request Adapt (Option D): This is used for integrating with ICAP servers (like virus scanners) and does not perform traffic reporting.

When a physical network link (like Interface 1.1) reaches its maximum capacity, it creates a bottleneck that negatively impacts network-level performance. To overcome the physical limits of a single interface, BIG-IP administrators use "Trunking," which is the F5 term for Link Aggregation (often implemented via LACP). A trunk object bundles multiple physical interfaces into a single logical link. By creating a trunk with two or more interfaces, the BIG-IP can spread the traffic load across all members of the trunk, effectively doubling or tripling the available bandwidth for the associated VLANs. Beyond performance, troubleshooting redundancy often leads to the use of trunks; if one cable in a trunk fails, the others continue to carry traffic, preventing a complete outage. This is a superior solution to simply increasing MTU (which requires end-to-end support) or manually setting media speeds. In a high-availability environment, configuring trunks is a foundational troubleshooting and optimization step to ensure that traffic spikes do not result in packet loss due to link saturation.