vendor hub
F5
Everything on ronutz.com for F5, in one place: every tool, grouped by family, followed by every article. Tools compute locally in your browser; articles are grounded in vendor documentation.
Working with F5 →
The career chapter: what the work with F5 actually was, which accounts, which escalations, and what it certified.
The F5 story in the industry section →
How F5 got here: the acquisitions, the pivots, and the people whose work ended up inside the platform.
F5 lineage →
What F5 is made of, and who made it. Every acquisition below is verified against primary sources, with the product line it turned into where that connection is documented rather than inferred.
Certification prep
Tools (55)
BIG-IP LTM - Local Traffic Manager
BIG-IP LTM load balancing simulator
Configure pool members, pick a load balancing method and a request count, and see where the next N connections land.
NetworkingBIG-IP persistence-cookie decoder
Decode an F5 BIGipServer persistence cookie into the backend pool member's IP and port, or encode one from an address and port. Runs entirely in your browser.
NetworkingF5 cipher-string explainer
Paste an F5 BIG-IP cipher string and get every keyword and operator explained plus a security read, all in your browser.
TLS & transportF5 SSL profile explainer
Paste a tmsh client-ssl or server-ssl profile and get its role, the TLS protocol matrix, and a security read covering chain, renegotiation, SNI, OCSP, and mutual TLS — all in your browser.
TLS & transportLB-method chooser
Paste an ltm pool and get its load-balancing method explained in F5's own terms, with cross-checks against the rest of the pool, or answer two questions and get a sourced recommendation. All in your browser.
NetworkingLTM L4 protocol profile explainer
The protocol-profile decision in cards: full-proxy tcp with every feature, the living f5-tcp-* four that F5 continually updates (read-only, tuned via child profiles) versus the frozen legacy -optimized trio, FastL4's PVA packet path with the loose pair for asymmetric routing, and FastHTTP's narrow-but-fast HTTP case with its complete when-to-use criteria list and K8024 as required reading.
NetworkingOneConnect source-mask explainer
Paste a one-connect profile for the full option audit with the man page's own semantics and defaults, or simulate a mask against real client IPs and watch the reuse groups form. The marquee demonstration: SNAT translates first, so a single SNAT address collapses every client into one reuse group no matter how narrow the mask.
NetworkingPersistence-method explainer
Paste BIG-IP persistence profiles and virtual servers and get the method behind each, its failure modes, and the primary-to-fallback chain, all in your browser.
Networking
iRules
iRules command-context explainer
Paste an iRule: every when block explained with the event's own reference one-liner, its commands inventoried and linked, the documented priority evaluation order, and a CMP audit that catches the constructs that demote your virtual server to a single TMM.
NetworkingiRules event-order explainer
Pick the profile stack on a BIG-IP virtual server — client-SSL, HTTP, server-SSL, pool — and see the order the common iRule events fire, from CLIENT_ACCEPTED to CLIENT_CLOSED, as a timeline and a list. All in your browser.
NetworkingiRules performance linter
Paste an iRule; it flags F5-documented performance anti-patterns line by line, with severity, cause, and fix. The big one: global variables demote CMP. Local, no network.
NetworkingiRules runtime calculator
Turn iRule timing statistics into real runtime, CPU cost per request, and maximum requests per second.
NetworkingiRules vs LTM policy classifier
Per when block, an honest verdict: expressible in an LTM policy (with a migration sketch in the vendor's own example grammar), verify on your version, or iRule-required with the blockers named. Policies are the no-programming layer; this tool tells you which blocks belong there.
Networking
TMOS - Traffic Management Operating System · F5OS · Platforms
BIG-IP packet-filter explainer
Paste net packet-filter rules for the ordered first-match walk with the man page's own semantics, shadow detection, and the platform context every filter decision sits inside. Add a sim: line and an honest three-state simulator answers which rule matches your packet.
NetworkingBIG-IP tcpdump builder
Assemble a BIG-IP-correct tcpdump command from structured choices: the TMM interface syntax, flow detail, snaplen, file output, and a BPF filter. It formats the command for you to run; it captures nothing.
NetworkingBigD thread calculator
Enter your vCPU count (and whether the system is hyperthreaded) to get the BigD thread count BIG-IP 21.1 derives automatically, per F5's documented formulas, plus the bigd.numprocs override cap and the 15,000-monitor ceiling.
NetworkingF5 BIG-IP license explainer
Paste your /config/bigip.license, full file or a fragment, and get a plain-language reading: management flavor, licensing dates with the K7727 upgrade verdict, Registration Key and platform, active and optional modules, constraints, and feature tokens. Runs entirely in your browser.
NetworkingF5 release cadence calendar
F5 moved to a monthly security cadence in July 2026. This computes the upcoming hardened-release and security-notification dates so you can plan patch windows. Local, no network.
NetworkingF5 service check date
Enter a BIG-IP version to get the minimum service check date its license must carry, or enter a service check date to see the newest version you can upgrade to. Based on F5's published License Check Date table (K7727); runs entirely in your browser.
Networkingtmsh config explainer
Paste a BIG-IP bigip.conf snippet and get a plain-English breakdown of every object, plus the structure, entirely in your browser.
Networking
BIG-IP DNS (formerly GTM - Global Traffic Manager)
BIG-IP DNS (GTM) GSLB simulator
Model two-tier global server load balancing: a wide IP picks a pool, then the pool picks a virtual server. See how N DNS requests resolve across pools and members.
NetworkingGSLB decision-flow explainer
The BIG-IP DNS two-tier decision, explained: pool selection at the wide IP, then the preferred, alternate and fallback chain inside the pool, with the grammar validated and the manual's rules cross-checked.
NetworkingGTM topology longest-match scorer
Topology decisions computed the way BIG-IP DNS computes them: the Longest Match sort with per-record rationale, the scoring walk with shadowing shown, highest score wins, ties round-robin.
NetworkingiQuery protocol explainer
Decode F5 BIG-IP DNS iqdump output and /var/log/gtm iQuery messages, or explain the iQuery architecture (mesh, port 4353, SSL trust, iqdump, gtmd, big3d). Runs locally.
Networking
F5 AWAF - Advanced WAF (formerly BIG-IP ASM - Application Security Manager)
AWAF automatic-learning poisoning estimator
How many requests does an attacker need to drill a hole through your BIG-IP Advanced WAF policy when the Policy Builder is left in Automatic learning against untrusted traffic? Enter your Loosen thresholds and the attacker's resources; it computes the minimum sources, requests, and time to force one automatic relaxation, and gates on the rules that make it impossible. Runs entirely in your browser.
Security & WAFAWAF declarative-policy explainer
Paste a BIG-IP Advanced WAF declarative security policy (JSON) and get a section-by-section, plain-language reading grounded in F5's published schema, with security callouts that read the values: transparent enforcement means monitor-only, plus signature staging, Data Guard off, and cookies missing Secure or HttpOnly. Runs entirely in your browser.
Security & WAFAWAF evasion-technique explainer
Type a sub-violation name or "evasions" for F5's eight evasion sub-violations explained, each with its default and the encoding trick it catches, or paste the evasions block of a declarative WAF policy to read each one back as enabled or disabled with the Multiple-decoding pass count. Grounded in F5 K7929; runs entirely in your browser.
Security & WAFAWAF false-positive triage
The flip side of the poisoning estimator: relax a genuine Advanced WAF false positive correctly, with scope, and stop before relaxing a real attack. Pick a violation category, its average violation rating, and whether it is enforced, staged, or transparent, and get F5's rating-based verdict and the scoped fix. Runs entirely in your browser.
Security & WAFAWAF learning-suggestion interpreter
Ties the poisoning estimator and the false-positive triage together. Characterise a Traffic Learning suggestion and it tells you whether accepting it loosens or tightens the policy, whether a loosening is a false-positive fix or a security relaxation, and whether Automatic learning is about to enforce it for you. Runs entirely in your browser.
Security & WAFAWAF policy-diff hole checker
Paste a before and an after declarative WAF policy and it classifies every security-relevant change as a relaxation or a tightening, then answers the question that matters after tuning: did this open a hole? It flags relaxations that widen protection beyond a single entity apart from a properly-scoped single-entity allow. Runs entirely in your browser.
Security & WAFAWAF request-log triage
Paste an ASM request-log entry (syslog key-value or CEF) and it extracts the policy, the support ID for log correlation, the request status, the violation rating, the client IP, method, and URI, classifies each violation, and gives F5's rating-based verdict, then bridges to the false-positive triage tool. Runs entirely in your browser.
Security & WAFAWAF signature accuracy/risk interpreter
Read an attack signature's published Accuracy and Risk and it tells you how false-positive-prone it is, how damaging a real match would be, and the tuning move. F5 defines accuracy as false-positive susceptibility, so low accuracy means many false positives. Runs entirely in your browser.
Security & WAF
BIG-IP AFM - Advanced Firewall Manager
AFM DoS-vector & profile explainer
Every AFM DoS vector explained in F5's own words, with the threshold mechanics spelled out and the configuration cross-checked: the silent mitigation-below-detection inversion, automatic-mode semantics, policing without detection, and the SYN-cookie interplay. Defensive configuration only.
NetworkingAFM rule-context & match explainer
Walk a packet through AFM's documented context order and watch the semantics that decide real outcomes: accept passes one context and the traffic is processed again at the next, only accept-decisively ends the walk, ICMP rules at a virtual server or self IP are ignored, and staged policies log without enforcing. A lone policy gets the redundant-and-conflicting audit the system itself defines.
Networking
BIG-IP Zero Trust Access (formerly BIG-IP APM - Access Policy Manager)
APM session-variable reference
The Session Variables chapter as a pattern-aware lookup: paste session.ad.last.attr.memberOf and it resolves against the chapter's own templates, paste an mcget expression and every reference inside is explained with the secure audit riding along, the classic empty-value trap named exactly: a bare mcget on session.logon.last.password reads back empty, because secure variables require -secure.
Identity & tokensAPM SSO method explainer
The eight SSO methods APM's own chapter defines, each card carrying the verdict that decides outages: a misconfigured SSO object for any non-form method can disable SSO for every method in that user's session; Form Based and Forms - Client Initiated are the only exempt ones. Kerberos ships its full prerequisite list, including the line worth framing: APM Kerberos SSO does not need or use a keytab file.
Identity & tokens
Automation & Integration
AS3 declaration explainer
Paste the JSON you POST to /mgmt/shared/appsvcs/declare and it reads it back: whether it is a full AS3 request or an ADC-only declaration, the schemaVersion and metadata, and the Tenant to Application to resource tree with every class explained, while checking the structural rules F5 documents. Runs entirely in your browser.
NetworkingDO declaration explainer + validator
Paste the JSON you POST to /mgmt/shared/declarative-onboarding and it reads it back: whether it is a DO request wrapper or a bare Device declaration, the top-level options, and the Common tenant's class-objects grouped by the phase DO onboards them in, with every class named and explained. It also checks the structural rules F5 documents and flags the gotchas that bite in production, from the DO 1.36 allowService default change to a root user missing its oldPassword. DO is the sibling of AS3: DO does the L1-L3 onboarding, AS3 the L4-L7 services.
NetworkingTelemetry Streaming (TS) explainer
Paste the JSON you POST to /mgmt/shared/telemetry/declare and it reads it back: it confirms the top-level Telemetry class, reads the optional Controls, and walks every class-object grouped by its role in the telemetry pipeline: the data sources that produce telemetry (system pollers, event listeners), the consumers that forward it out (Splunk, Azure, AWS, DataDog, Prometheus, and the rest of the catalogue), and the grouping and endpoint classes. It flags the pipeline gaps that make a declaration succeed but do nothing. TS is the third F5 Automation Toolchain extension: AS3 and DO configure the box, TS observes it.
Networking
F5XC - F5 Distributed Cloud
F5XC API path explainer
Paste the OpenAPI / Swagger spec you import into (or download from) F5XC API Protection and it lists every path and operation with its method, parameters, request body, responses, and authentication.
NetworkingF5XC CE egress checklist & verifier
Paste F5's published Customer Edge IP/domain reference file and get a purpose-organized, site-type-filtered allowlist, the port matrix, a firewall-request text, and a curl-host verifier - parsed from what you paste, never a hardcoded list.
NetworkingF5XC domain / SNI match resolver
Paste the domain lists of one or more F5XC HTTP load balancers and a test hostname, and see which load balancer and domain entry wins - exact beats wildcard, with the Default LB catching the rest.
NetworkingF5XC HTTP LB route explainer
Paste the routes of an F5XC HTTP load balancer and get each route decoded in order - type, path/method/header match, action, header mutations, and per-route WAF - plus a first-match simulator for a test request.
NetworkingF5XC load-balancing algorithm chooser
A short questionnaire recommends an F5XC origin-pool load-balancing algorithm - with the BIG-IP equivalent, caveats, and where to set it - and explains the XC model where consistent hashing IS the persistence method.
NetworkingF5XC object linter
Paste an F5XC origin_pool, http_loadbalancer, or app_firewall object and it flags risky or surprising settings, each with a severity and a grounded explanation.
Security & WAFF5XC origin pool explainer
Paste an F5XC origin_pool spec and get it decoded - origin-server types and addresses, the pool port, the load-balancing algorithm and endpoint selection, health checks, and the TLS-to-origin settings.
NetworkingF5XC rate-limit calculator
Turn an F5 Distributed Cloud rate-limiter configuration into its effective rate, burst ceiling, and exact leaky-bucket behavior - including why Disabled is not a bypass and how a Block lockout holds.
Security & WAFF5XC security event explainer
Paste an F5XC security event (WAF, Bot Defense, Service Policy, or API) and it decodes the type, the action and disposition, the request context, and the specific reason it fired.
Security & WAFF5XC service-policy explainer
Paste an F5 Distributed Cloud service_policy and see exactly how it matches: the server scope, the rule order, and every rule's action and conditions. iRules for XC, decoded.
Security & WAFF5XC TLS security-level cipher mapper
Map an F5 Distributed Cloud TLS security level to its exact TLS versions and cipher suites, or paste a cipher to see which levels include it - from F5's verbatim TLS Reference.
TLS & transport
More
F5 Ethernet trailer decoder
Paste the F5 Ethernet trailer that a BIG-IP appends to packets captured with the tcpdump noise flags, and get each field explained: direction, slot and TMM, the virtual server, flow and peer identifiers, and the device's own RST cause. It detects a TLS provider section and deliberately decodes none of it, because from v15 that section carries session secrets. Local and offline.
NetworkingF5OS RESTCONF path explainer
Paste an F5OS RESTCONF path and get it decoded segment by segment: the YANG module prefix, the container hierarchy, list keys such as tenant=tenant1, and the module:node prefixing convention. It also explains the port 8888 /restconf versus port 443 /api duality from F5OS 1.8. Local and offline.
NetworkingF5OS tenant config explainer
Paste an f5-tenants:tenants block, from the CLI or from RESTCONF, and get it read back plainly: the configured / provisioned / deployed lifecycle and what each state means, the image and platform it belongs to, blades and VLANs, and the memory allocation checked against F5's published minimum of (3.5 × 1024 × vCPU) + 512. Local and offline.
Operations & FieldcraftiControl REST path explainer
Paste an iControl REST URL and get it decoded: the TMOS module, the collection, the tilde-encoded partition and folder path with its tmsh equivalent, sub-collections such as pool members, and the query options. Local and offline; it never contacts a device.
NetworkingiControl REST stats decoder
Paste an iControl REST stats response and get it flattened into one line per statistic. It unwraps the entries, nestedStats, value and description envelopes, reduces the URL keys to the objects they name, and combines 64-bit counters that arrive split into high and low halves. A pure local transform; nothing is fetched.
Networking
Articles (141)
BIG-IP LTM - Local Traffic Manager
AI Traffic on BIG-IP: MCP From Profiles to Persistence to Protection
BIG-IP 21.0 taught TMOS to speak Model Context Protocol with HTTP, JSON, and SSE profiles; 21.1 made it fluent, with a native aimcp persistence profile that pins an AI session to one backend using a wrapped, encrypted Mcp-Session-ID, and an Advanced WAF MCP Protection Policy template aimed at the OWASP MCP Top 10: tool poisoning, secret exposure, and injection. Here is what each piece does, verified against F5's release notes and manuals, including the caveat that matters: SSE streaming responses bypass response-side inspection.
NetworkingReadBIG-IP Cookie Persistence Methods and Settings
Beyond what a BIG-IP persistence cookie contains, there is the question of how it gets there. BIG-IP offers four cookie methods, insert, rewrite, passive, and hash, and a set of profile options for the cookie's name, lifetime, and safety flags. These decide the cookie's operational behavior, separate from its encoded value.
Security & WAFReadBIG-IP Load-Balancing Methods, and What Each One Weighs
A pool's load-balancing-mode decides who gets the next connection, and BIG-IP documents 19 of them. They differ along two axes: whether they react to live server state at all, and what exactly they weigh when they do, connections, sessions, response speed, or monitor-fed measurements.
NetworkingReadBIG-IP Persistence Cookies: What They Are and Why They Leak
Why an F5 BIG-IP inserts a BIGipServer cookie, what cookie persistence does, what the cookie value actually encodes, and why the default unencrypted form hands an internal address and port to anyone who reads the response.
Security & WAFReadBIG-IP Persistence Methods, and What Each Keys On
BIG-IP offers several persistence methods, and the only thing they have in common is the goal: send a returning client to the same pool member. What they key on, cookie, source address, SSL session ID, or an iRule-extracted value, decides where each one fits and where each one breaks.
NetworkingReadCertificates, Keys, and Chain Building in an SSL Profile
A client-ssl profile binds a server certificate to its private key and, crucially, to a chain bundle that lets clients build a path to a trusted root. The modern cert-key-chain construct also lets one profile serve several certificate types, picked per client — the foundation of RSA-plus-ECDSA and SNI deployments.
Certificates & PKIReadChoosing a Persistence Method (and Its Failure Modes)
Most persistence requirements are met by source address affinity or cookie persistence, but both have well-known failure modes: source affinity collapses behind NAT, and cookies need HTTP. Knowing where each method breaks is what turns a default choice into a deliberate one.
NetworkingReadCipher Families: The Working Map
Every cipher suite is assembled from a small set of algorithm families, and each family carries its own advantages, disadvantages, and history. Block versus stream, AES versus ChaCha20, why AEAD modes replaced the old assemble-it-yourself pattern, what RSA, elliptic curves, and (EC)DHE each contribute, and which families are already retired - the encryption counterpart to the hash-families map.
TLS & transportReadCipher Ordering and Negotiation on BIG-IP
An expanded cipher string is an ordered list, and the order is not cosmetic: with server preference, BIG-IP picks the first cipher in its own list that the client also supports. That makes the position of each cipher a real security control, which is why expansion shows them in order.
TLS & transportReadClient SSL vs Server SSL Profiles on BIG-IP
A BIG-IP can sit in the middle of a TLS connection and decrypt it. A client-ssl profile makes the BIG-IP the TLS server to the client; a server-ssl profile makes it the TLS client to the pool. Knowing which side each profile owns is the key to offload, bridging, and re-encryption designs.
TLS & transportReadClosing the Leak: BIG-IP Cookie Encryption
How to stop a BIG-IP persistence cookie from disclosing internal addresses by encrypting it, what the encrypted value looks like, the related cookie hashing and naming options, and the trade-offs of each.
Security & WAFReadEnabling and Disabling TLS Versions with the options Field
An SSL profile's options field is a list of flags, and the protocol flags work by SUBTRACTION: a TLS version is offered unless a matching no- flag disables it. That 'disable, not enable' logic is a frequent source of surprise, and it is where TLS 1.0/1.1 hygiene lives.
TLS & transportReadEnforcing Forward Secrecy on F5 BIG-IP
Forward secrecy is not a checkbox on BIG-IP; it is a consequence of the cipher configuration on an SSL profile. This shows how BIG-IP cipher rules and cipher groups control whether the negotiated suite uses an ephemeral (ECDHE/DHE) or static-RSA key exchange, why server-side cipher preference matters, and how TLS 1.3 removes the choice. It closes with how Fortinet and Netskope enforce the same property.
TLS & transportReadF5 Cipher Rules, Cipher Groups, and Why Expansion Is Version-Specific
BIG-IP v13 replaced hand-edited cipher strings with cipher rules and cipher groups, a more readable model where rules hold strings and groups combine them with allow, restrict, and exclude. The final ordered suite list still comes from the per-TMOS cipher database, which is why the same string expands differently across versions.
TLS & transportReadFallback Persistence and the Match-Across Settings
A virtual server can carry two persistence methods, a primary and a fallback used when the primary finds no record, and three match-across settings that decide how widely a persistence record is shared. Both are easy to misconfigure in ways that only show up under load.
NetworkingReadMutual TLS with peer-cert-mode
Most TLS proves the server to the client. Mutual TLS also proves the client to the server, and on a BIG-IP that is the job of peer-cert-mode plus a trusted-CA bundle. The gap to watch is the difference between requesting a client certificate and actually requiring and validating one.
Certificates & PKIReadOneConnect: Reuse Is a Grouping Problem, and SNAT Rewrites the Groups
OneConnect parks idle server-side connections and hands them to the next eligible request. The source mask defines eligible, from 0.0.0.0 sharing across all clients to a host mask keeping reuse per client. The catch both K articles state: SNAT translates first, the mask sees only the translated address, so one SNAT address means one group.
NetworkingReadPersistence Mirroring Across an HA Pair
Persistence records live in memory on the active BIG-IP. On failover, the standby takes over connections, but unless persistence has been mirrored to it, it does not know the existing client-to-member mappings, and clients can be rebalanced mid-session. Mirroring trades a little overhead for sticky sessions that survive failover.
NetworkingReadPost-Quantum TLS on BIG-IP: ML-KEM Hybrids From 17.5 to 21.1
BIG-IP's post-quantum story is a lineage: X25519MLKEM768 hybrid key exchange arrived in the 17.5.0 era, and 21.1.0 completes the NIST curve family with SecP256r1MLKEM768 and SecP384r1MLKEM1024, on both client-side and server-side TLS, per FIPS 203. Around it, 21.1 makes the classical side faster and stricter: X25519 hardware acceleration via Intel QAT on by default, parent SSL profiles defaulting to TLS 1.3 and DTLS 1.2, an OCSP request nonce, and C3D enhancements. Here is what each piece means and how to roll it out without breaking a single legacy client.
NetworkingReadProtocol Profiles: Living TCP, Frozen TCP, and the Two Fast Paths
The tcp dropdown hides three decisions. F5's 13.0 announcement split the full-proxy family into living profiles it continually updates (read-only, tuned via children) and a frozen legacy trio that still ships. FastL4 trades the proxy for a hardware packet path, and FastHTTP is the narrow HTTP case that must clear every criterion on its list.
NetworkingReadReading an F5 Cipher String
An F5 cipher string is an ordered list of cipher sets separated by colons, where each set combines keywords with a plus sign and a leading operator can exclude, delete, or de-prioritize. Once you can read the grammar, a dense string like ECDHE:RSA:!SSLv3:@STRENGTH becomes a clear set of instructions.
TLS & transportReadRenegotiation, Secure Renegotiation, and OCSP Stapling
Three SSL profile settings shape the handshake's safety after the first message: renegotiation decides whether a connection may renegotiate at all, secure-renegotiation enforces the RFC 5746 protection, and ocsp-stapling lets the BIG-IP attach a fresh revocation proof so clients need not phone the CA.
TLS & transportReadSource-Address Persistence and the Mega-Proxy Problem
Source-address persistence pins a client to a pool member by its IP, which is simple and protocol-agnostic but fragile on the modern internet. Large NATs make many clients look like one, and mobile clients change address mid-session. Both break the assumption the method depends on.
NetworkingReadThe Four BIG-IP Cookie Encodings, Byte by Byte
A precise walk through the four unencrypted BIG-IP persistence cookie formats: default IPv4 with its reversed address bytes and byte-swapped port, IPv4 and IPv6 in route domains, and the IPv6 form, each with a worked decode.
Security & WAFReadTLS 1.3 and TLS 1.2 Ciphers on BIG-IP
TLS 1.3 changed what a cipher suite even is, and BIG-IP treats 1.3 and 1.2 differently as a result. A 1.2 suite bundles key exchange, authentication, and the bulk cipher; a 1.3 suite names only the bulk cipher and hash. Knowing that explains why old cipher-string keywords do not steer 1.3.
TLS & transportReadWhat a BIG-IP Cookie Tells an Attacker
The persistence cookie is a textbook information disclosure: it reveals internal IP addresses, ports, pool size, and route domains to any client. Why that matters for reconnaissance, how scanners harvest it, and how to think about the risk.
Security & WAFReadWhere Do the Requests Go? Simulating BIG-IP LTM Distribution
A method name tells you the rule; the distribution tells you the outcome. This covers how BIG-IP LTM actually spreads N requests across pool members: why Ratio is a full cycle and not a percentage, how priority group activation leaves lower tiers on visible standby, how Least Sessions uses the persistence-record count (and falls back to Round Robin under cookie persistence), and why the dynamic methods - Fastest, Observed, Predictive, Dynamic Ratio - cannot be simulated from configuration.
NetworkingReadWhich Cipher Suites to Use: The Verdict Ledger
The decisive answer to the configuration question, tier by tier: what to run today (the TLS 1.3 trio plus ECDHE AEAD suites on 1.2), what is acceptable in narrow niches, what is declining, what is absolutely forbidden and by which RFC, and what the future holds - grounded in RFC 8446, RFC 9155, Mozilla's current profiles, and NIST SP 800-52r2.
TLS & transportReadWhich TLS Cipher Keywords Are Safe, and Which Are Not
The difference between a hardened cipher string and a dangerous one is a handful of keywords. Forward secrecy comes from ECDHE and DHE; the risks come from RC4, 3DES, SSLv3, EXPORT, NULL, and anonymous DH. Knowing the short list lets you read a cipher string's security at a glance.
TLS & transportRead
iRules
Client Side vs Server Side in iRules
A BIG-IP virtual server is a full proxy: it holds a separate connection to the client and to the pool member. iRule events run in one context or the other, and commands like IP::remote_addr return different things depending on which side you are on. Knowing the boundary prevents a whole class of confusing bugs.
NetworkingReadCMP: The Cores You Paid For, and the iRule Lines That Give Them Back
Clustered multiprocessing runs one TMM per core and spreads flows across them. A demoted virtual server runs everything on TMM0. The demotion list is short and documented: global variables above all, with static:: as the cure, plus two per-TMM traps (RULE_INIT keys, statistics profiles) that do not demote but quietly break assumptions.
NetworkingReadFastL4 vs Standard: Which iRule Events You Get
A Standard virtual server is a full TCP proxy and exposes the rich set of L7 and SSL iRule events. A FastL4 virtual server is a packet-based fast path optimized for throughput, and it deliberately gives up most of those events. Choosing the profile is choosing which events exist.
NetworkingReadiRule Event Order: The Connection Lifecycle
iRules are event-driven, and the events fire in a fixed order as the BIG-IP processes a connection: accept the client, finish the client TLS handshake, parse the request, pick a pool member, connect to it, finish the server TLS handshake, send the request, read the response, tear down. Knowing that order is the difference between an iRule that works and one that errors.
NetworkingReadiRule Priority and Multiple Rules
Event order governs which events fire and when. The priority command governs something different: when several iRules (or several handlers) listen for the same event, which one runs first. The default priority is 500, lower numbers run earlier, and getting this right matters when one rule's output feeds another.
NetworkingReadiRule SSL Handshake Events
The client-SSL and server-SSL profiles add their own iRule events around the TLS handshake. CLIENTSSL_CLIENTHELLO fires before the handshake completes, which is what makes SNI-based profile and pool selection possible; CLIENTSSL_HANDSHAKE fires after. The server-SSL side mirrors them on the connection to the pool.
TLS & transportReadiRules performance: cycles, timing, and the runtime calculator
How iRules actually execute inside TMM (a Tcl interpreter compiling to bytecode), what the timing command measures, why average cycles is the reliable number and maximum is discarded, and how to turn cycles into real runtime, CPU cost per request, and maximum requests per second.
NetworkingReadiRules procedures: reusable code with proc and call
Since BIG-IP 11.4, an iRule can define a block of code once as a procedure and call it from anywhere, including from other iRules that are not attached to any virtual server. Here is how proc and call work, how arguments and defaults are declared, and the one namespace rule that trips everyone up.
NetworkingReadiRules, CMP, and the static:: namespace
Clustered Multiprocessing spreads a virtual server's traffic across every TMM, but one construct quietly undoes it: a global variable demotes the virtual to a single core. This is why globals are deprecated, what the static:: namespace and data groups do instead, and how RULE_INIT ties them together.
NetworkingReadiRules: choosing between if, switch, class match, and static arrays
When an iRule has to match one value against many and act, there are four common tools: chained if, switch, a data group with class match, and a directly-indexed static:: array. F5 has actually ranked them for speed. Here is that ranking, and the two questions that decide which one you should reach for.
NetworkingReadLoops and lists in iRules, and why they block
iRules support foreach, for, and while, and most of Tcl's list commands. But loops run inline in a single-threaded TMM, so a large loop per request stalls that connection. Here is which loop to use, which list commands you actually have, and why foreach is the one to reach for first.
NetworkingReadWhat Makes an Event Fire: Provisioning and Profiles
An iRule event is only available if two things line up: the module it belongs to is provisioned, and the profile that produces it is attached to the virtual server. Some events need a third ingredient — an explicit collect command. Specify an event whose prerequisites are missing and there is no error; it simply never fires.
NetworkingRead
TMOS - Traffic Management Operating System · F5OS · Platforms
Anatomy of a BIG-IP License File
The /config/bigip.license file is human-readable, and learning to read it answers real operational questions: which modules are actually licensed, what the throughput and session limits are, whether an upgrade will load, and whether BIG-IQ is managing the license. Here is the file, section by section, from two real lab licenses.
NetworkingReadBIG-IP Pools and Load-Balancing Methods
A pool is the group of backend members a virtual server sends traffic to, and the load-balancing method decides which member gets each connection. The methods split into static ones that follow a fixed pattern and dynamic ones that react to live load, and the choice shapes how evenly and how smartly traffic spreads.
NetworkingReadBIG-IP tcpdump: How It Differs from Standard tcpdump
On a BIG-IP, tcpdump is the same binary you know from Linux, but the interface you capture on is not a NIC. The special 0.0 interface and the F5-only detail suffixes change how you build the command. This is the orientation for everything else.
NetworkingReadBIG-IP Upgrade vs Update: Why the Distinction Decides Whether the License Date Is Checked
F5 draws a precise line between an upgrade and an update, based on which part of the version number changes. It is not just terminology: the service check date is only enforced on an upgrade, so knowing which one you are doing tells you whether a licensing date can block you.
NetworkingReadBIG-IP Virtual Server Types, and What Each One Actually Does
A BIG-IP drops traffic by default; a virtual server is the listener that accepts it, and its type decides the processing model, from a full proxy that terminates and re-originates connections to a packet-by-packet forwarder that behaves like a router. Choosing the type is choosing how much the box is allowed to understand.
NetworkingReadBIG-IP, TMOS, and F5OS: A Version Timeline You Can Slide Through
BIG-IP the platform and TMOS the software were the same thing until 2004, when version 9.0 split them and moved the box from BSD to a Linux host with the TMM microkernel. This interactive timeline slides from the 1997 BIG-IP Controller to BIG-IP 21.0, showing the software version and the operating system underneath it at each step, including why the numbers jump straight from 17 to 21.
NetworkingReadCapturing on VLANs, Self-IPs, and Trunks
0.0 captures on every TMM interface, but sometimes you want to scope a capture to one segment. BIG-IP lets you name a VLAN, a self-IP, or other interface specifiers in place of 0.0, and each choice changes what you see.
NetworkingReadCapturing Safely on a Production BIG-IP
tcpdump on a BIG-IP touches the data plane and the file system of a device that is carrying live traffic. A few habits, bounding the capture, watching disk space, and being deliberate about detail, keep a troubleshooting capture from becoming an incident.
NetworkingReadConfig Sync on BIG-IP: When to Sync, and Why It Fails
Config sync keeps the members of a device group holding the same configuration - when you tell it to, in the direction you tell it. This article covers manual versus automatic sync, reading sync status, the recommended discipline, and the short list of root causes behind nearly every sync failure.
NetworkingReadDeploying Applications with Templates: iApps and FAST
Templates turn a bag of virtual servers, pools, profiles, and monitors into one managed application service. How iApps work, what strict updates protects, how FAST modernizes the idea declaratively, how to modify an application deployed either way, and how to recognize template-created objects in a configuration.
NetworkingReadF5's faster release cadence: monthly hardened releases and security notifications
On 6 July 2026 F5 moved from a quarterly to a monthly security release cadence: hardened software releases on the third Wednesday of every month from 15 July, and security notifications one month later starting 19 August. Here is exactly what changed, why F5 says it changed, what stays the same, and what it means for how you patch.
NetworkingReadFrom 301A and 301B to the New LTM Specialist: a Faithful Restructure, and the Few Things It Dropped
The six new LTM Specialist beta exams map almost objective-for-objective onto the retired 301A and 301B blueprints - the restructure is remarkably faithful. The genuine deltas are few and specific: serial failover, ssldump, and one synthesis bullet are gone; F5OS tenants, In-TMM monitoring, Telemetry, and FAST arrived. What changed, and what the dropped items still teach.
NetworkingReadHow a BIG-IP Virtual Server Works
A virtual server is the front door of a BIG-IP. It binds a listening IP and port, applies a stack of profiles, decides persistence, picks a pool member, and translates the source address toward the backend. Reading those pieces in order tells you exactly how a connection will be handled.
NetworkingReadHow LTM Health Monitors Decide Up or Down
A health monitor is the probe a BIG-IP uses to decide whether a backend member can receive traffic. Its send and receive strings, its interval and timeout, and where it is attached together determine how quickly a failure is noticed and how a member is marked down.
NetworkingReadPacket Filters: The Checkpoint Before Everything, and the Switch That Ships Off
BIG-IP packet filters are a BPF-based access policy on incoming traffic, evaluated as one global list in ascending order, first terminal match wins. The master switch ships disabled, trusted exemptions outrank every rule you write, ARP and the important ICMPs walk past by default, established connections are invisible to it, and the management port never meets it at all. Also: as of v16 there is a second, unrelated object wearing the same name.
NetworkingReadProfiles on a Virtual Server
A BIG-IP virtual server does not have a fixed behavior; it is assembled from profiles, each one configuring a layer of the connection. Protocol, application, SSL, and persistence profiles stack together to define how traffic is handled, and they inherit settings from parent profiles, which is the key to how BIG-IP config stays manageable.
NetworkingReadReading a BIG-IP Capture: The F5 Trailer in Wireshark
A capture taken with the TMM detail suffix carries extra bytes after each packet. On its own that looks like noise. With the f5ethtrailer dissector, Wireshark turns it into readable fields that tell you exactly how BIG-IP handled each flow.
NetworkingReadReading BIG-IP Status: Dashboard, Network Map, TMSH, and netstat
The device tells you its condition through half a dozen surfaces: the LCD panel, the dashboard, the Network Map's shapes and colors, TMSH show commands, object statistics, and the humble netstat. Knowing which surface answers which question - and how to read a listening-ports table - is bread-and-butter administration.
NetworkingReadRecovering a BIG-IP That Won't Load Its Config After an Upgrade
When an upgraded BIG-IP boots but its configuration never loads, the usual cause is a service check date older than the new version requires. The fix is to reactivate the license, which resets the date. Here is how to recognize it, how to reactivate safely, and how to avoid it next time.
NetworkingReadSNAT and the Return-Traffic Problem
For a load-balanced connection to work, the pool member's reply must come back through BIG-IP. If the member routes its return traffic straight to the client instead, the connection breaks. SNAT solves this by making BIG-IP the source address the member replies to, at the cost of hiding the real client IP.
NetworkingReadThe Anatomy of a bigip.conf File
Every object in a BIG-IP configuration follows the same shape: a module, a component, an optional type, a name, and a brace-delimited body. Once you can see that pattern, a wall of tmsh config becomes a readable tree of virtual servers, pools, monitors, and profiles.
NetworkingReadThe BIG-IP 21.x Ops Story: In-Place Upgrades, a 64-Bit Control Plane, and BigD at Scale
BIG-IP 21.1 changes how you upgrade (in-place, with a Dry Run compatibility check), what the control plane is built from (64-bit mergeD, Java 21, 64-bit TMSH libraries), how it survives memory pressure (OOM priority for MCPd), how fast it answers (multi-threaded MCPD and a 15,000-monitor multi-threaded BigD), and how it migrates (UCS platform-migrate with validate). Every claim here is from F5's release notes, including the honest limits: in-place is not in-service, and 21.x does not run on iSeries or VIPRION.
NetworkingReadThe BIG-IP Service Check Date, and Why an Upgrade Can Refuse to Load
Every BIG-IP version carries a static License Check Date, and every license carries a Service Check Date. If the license's date is older than the version's date, the upgraded system boots but silently refuses to load its configuration. Here is what each date is, where it comes from, and how the check works.
NetworkingReadTMM Detail Levels and Peer Flows (:n, :nn, :nnn, :p)
The colon suffix on a BIG-IP capture interface is the most confusing and most useful part of the syntax. It controls how much internal TMM metadata is attached to each packet, and whether you capture one side of a connection or both.
NetworkingReadUCS Archives: the BIG-IP Backup That Contains Everything
A User Configuration Set (UCS) is the full-device backup: configuration, licenses, and - the part people forget - private SSL keys. This article covers creating and restoring archives, what is inside the file, the flags that matter when restoring to different hardware, and why long-term storage is a security decision.
NetworkingRead
BIG-IP DNS (formerly GTM - Global Traffic Manager)
BIG-IP DNS Load Balancing: the Wide IP, the Pool, and the Three-Step Chain
A GSLB answer is decided twice: the wide IP picks a pool, then the pool picks a member through a preferred, alternate and fallback chain. The chain carries the rules people trip over: the alternate can only be static, the fallback ignores availability on purpose, and None cascades all the way to a BIND aggregate.
NetworkingReadDNS as a Policy Engine: Multi-RPZ in BIG-IP 21.1
Response Policy Zones turn a resolver into a policy enforcement point, and BIG-IP DNS 21.1 turns one feed into many: up to 65,535 RPZ zones per DNS cache, evaluated by configurable precedence, transferred securely with TSIG HMAC-SHA-512, and armed with the full RPZ action set from NXDOMAIN and walled-garden CNAME to PASSTHRU, DROP, and TCP-only. Per-FQDN A-record answers replace the single global walled-garden IP, and triggers extend beyond QNAME to client IP and response IP.
NetworkingReadGSLB in Two Tiers: The Wide IP Picks a Pool, the Pool Picks a Server
The single most common BIG-IP DNS misunderstanding is treating global load balancing as one decision. It is two: a wide IP first selects a pool, then that pool selects a virtual server - and each tier can use a different method. Walking the two-tier decision with a worked example.
NetworkingReadGTM Topology Records: Longest Match Is a Sort, Not the Pick
Topology load balancing scores candidates from an ordered record list, and the ordering is what Longest Match actually does. The first record to match a candidate scores it, later records are shadowed, and the highest score wins, which is why a heavy wildcard really can beat a light /32.
NetworkingReadHow iQuery Connects BIG-IP DNS to the Rest of the Network
iQuery is the XML protocol BIG-IP DNS uses to learn whether the objects it answers for are actually up. This walks the mesh: gtmd and big3d, the long-lived TCP 4353 connections, the SSL certificate trust that bigip_add bootstraps, what iqdump shows you, and the classic reason a virtual server is green on the LTM but red on DNS.
NetworkingReadOne Query, Six Answering Machines: the BIG-IP DNS Processing Order
A DNS query arriving at a BIG-IP listener can be answered by iRules, DNSSEC processing, a GSLB wide IP, DNS Express, a DNS cache, local BIND, or a pool of real DNS servers. F5 documents a strict precedence among them, and most surprises in BIG-IP DNS, from the record that answers when you expected GSLB to Rapid Response silencing BIND, come down to reading that order correctly.
NetworkingRead
F5 AWAF - Advanced WAF (formerly BIG-IP ASM - Application Security Manager)
Advanced WAF Content Profiles: Parsing JSON, XML, GraphQL, and GWT Safely
A content profile tells Advanced WAF how to parse a structured payload, JSON, XML, GraphQL, GWT, or plain text, so it can apply attack signatures to individual fields and enforce structural limits that stop parser abuse and denial-of-service. Here is what each profile type does, the defense attributes that matter, and the best practices and caveats.
Security & WAFReadAdvanced WAF Session Tracking: Finding and Stopping the Client Behind the Requests
Session tracking lets Advanced WAF identify the user, session, device, or IP behind a stream of requests, and act on that identity, logging, delaying blocking, or blocking everything, once a client crosses a violation threshold. Here is how session awareness works, the three actions, and why username tracking beats session-ID tracking.
Security & WAFReadAutomatic Learning in Production: How an Attacker Poisons a WAF Policy
Left in Automatic learning mode against untrusted traffic, the BIG-IP Advanced WAF Policy Builder will accept and enforce a suggestion once its learning score reaches 100%, and some suggestions disable violations or widen entities. An attacker who floods legitimate-looking traffic from enough sources can push a relaxation to 100% and drill a hole. F5's design resists this with source, session, and time thresholds, but the safe posture is Manual learning by default and building only from trusted traffic.
Security & WAFReadBlocking vs Transparent: What Advanced WAF Enforcement Mode Really Does
A WAF policy's enforcementMode decides whether it protects or merely watches. In blocking mode, requests that trigger a block-configured violation are rejected. In transparent mode, nothing is blocked even when a violation fires, so the policy is monitor-only. Confusing the two is one of the most common WAF mistakes.
Security & WAFReadClient-Side Signals and Challenges: How Advanced WAF Tells a Browser from a Bot
To separate real browsers from automation, Advanced WAF injects JavaScript into responses and reads what comes back, a client-side integrity check, a capabilities probe, a device fingerprint, and, as a last resort, a CAPTCHA. Here is what each artifact collects, the order they escalate in, and the caveats that break them.
Security & WAFReadData Guard: Masking Sensitive Data in Responses
Data Guard is Advanced WAF's response-side protection. It scans server responses for sensitive information, such as credit-card numbers, US Social Security numbers, and custom patterns, and masks it before it reaches the client. Unlike most WAF checks, which inspect the request, Data Guard guards what leaks out.
Security & WAFReadEvasion Techniques: How Advanced WAF Normalizes Around Attacker Encoding
Attackers hide payloads inside unusual encodings so a signature never sees the real characters. BIG-IP Advanced WAF answers with eight evasion sub-violations under the single 'Evasion technique detected' violation, each normalizing or detecting one trick: %u decoding, Apache whitespace, Bad unescape, Bare byte decoding, Directory traversals, IIS backslashes, IIS Unicode codepoints, and Multiple decoding. All eight are enabled by default.
Security & WAFReadF5 DataSafe: Client-Side Application-Layer Encryption, and Its Sharp Edges
DataSafe is F5's fraud-protection layer that encrypts sensitive fields inside the browser, before an in-browser Trojan or key logger can read them. It injects JavaScript that encrypts data client-side with a per-session public key, decrypted on the BIG-IP with the private key. Here is how it works, what each feature does, and the caveats that catch people.
Security & WAFReadHandling False Positives in Advanced WAF: Triage by Rating, Then Tune with Scope
A false positive is legitimate traffic that trips a security policy. In F5 AWAF - Advanced WAF (formerly BIG-IP ASM - Application Security Manager) the violation rating is the triage signal: ratings 1 and 2 are likely false positives you can accept, rating 3 needs investigation, and ratings 4 and 5 block even with Block flags off and should be cleared rather than relaxed. The fix is always scoped to the specific URL or parameter, never a policy-wide disable, and the governing rule is to relax only where a false positive actually occurred.
Security & WAFReadHow a BIG-IP Advanced WAF Declarative Policy Is Structured
A declarative WAF policy is a JSON file that describes a security policy as a set of adjustments on top of a base template. The key to reading one is the template-and-adjustments model: anything the policy does not mention keeps the template's default, so an absent section means default, not disabled.
Security & WAFReadL7 Behavioral DoS (BaDoS): How Advanced WAF Learns Normal and Mitigates the Rest
L7 Behavioral DoS is Advanced WAF's machine-learning defense against application-layer DDoS. It learns a baseline of normal traffic, watches server stress, and when the server strains it builds dynamic signatures and isolates bad-actor IPs, mitigating with escalating measures. Here is how it works, the two detection modes, and the caveats that matter.
Security & WAFReadNested Policies in Advanced WAF: Parent/Child Inheritance and Policy Microservices
Advanced WAF gives you two ways to layer policy configuration rather than write one flat policy: parent and child policies, where children inherit mandatory elements from a parent, and security policy microservices, where a single policy carries nested sub-configurations matched by hostname and URL. Here is how each works and when to use it.
Security & WAFReadSignature Staging and the Enforcement Readiness Period
Staging is how Advanced WAF lets a new or updated attack signature match and log without blocking, so you can review it before it can reject traffic. Combined with the enforcement readiness period, it means a policy can be in blocking mode and still not block a staged signature. Here is how to read that state.
Security & WAFReadWAF Over QUIC: HTTP/3 Web Protection in BIG-IP 21.1
BIG-IP 21.1 extends Advanced WAF, Bot Defense, and L7 (layer 7) DoS protection to HTTP/3 virtual servers, with the same inspection fidelity as HTTP/1.1 and HTTP/2 and any policy template type. The limits matter as much as the feature: client-side only, no behavioral DoS, no HTTP/3 virtual server creation from the WAF UI, and the underlying LTM HTTP/3 implementation remains experimental. Alongside it, API Security gains OpenAPI 3.1 import and remote logging gains a Splunk key-value Extended format.
NetworkingRead
BIG-IP AFM - Advanced Firewall Manager
AFM Contexts: Accept Is a Ticket to the Next Checkpoint
The Network Firewall walks packets through contexts in a fixed order: global, route domain, then virtual server or self IP, with the management port apart. A match's action applies and the traffic is processed again at the next context, so accept continues, only accept-decisively ends the walk, ICMP rules at edge contexts are ignored, and staging logs without enforcing.
NetworkingReadConnection Eviction Policies: What BIG-IP Throws Overboard, and When
The connection table is finite, and something decides what dies first when it fills. Before 11.6 that was the adaptive reaper and two db keys; since 11.6 it is the eviction policy: watermark triggers whose meaning changes with the attachment context, strategies the manual honestly calls statistical and opportunistic, and a slow-flow block with a clean monitor-first pattern.
NetworkingReadSYN Flood Protection on BIG-IP: Cookies, Thresholds, and Who Answers First
A SYN flood attacks the connection table's half-open state. BIG-IP's answer is the SYN cookie: a stateless SYN-ACK with the state encoded in the sequence number. The interesting part is the layering: LTM global and per-VS thresholds, per-VLAN hardware cookies, and an AFM device vector that takes precedence over all of it, plus one threshold arrangement that mitigates silently with no attack log.
NetworkingRead
BIG-IP Zero Trust Access (formerly BIG-IP APM - Access Policy Manager)
Access and Identity in BIG-IP 21.1: DCR, Native SAML, and IPsec Comes Home
The access layer of BIG-IP 21.1 modernizes in four directions at once: OAuth 2.0 Dynamic Client Registration (RFC 7591) lets clients, including agentic AI systems, register themselves with an Initial Access Token; SAML through the system's default browser goes native on Windows and macOS, unlocking FIDO2 and Entra ID flows without the old iRules; the Edge Client gains real IPsec VPN tunnels alongside SSL-VPN; and the supporting cast spans an HTTP Connector in per-session policies, ES13 in Portal Access, and endpoint inspection on Ubuntu ARM64.
NetworkingReadAPM SSO Methods: One Bad Object Can Dim the Whole Session
APM's chapter defines eight SSO methods and states a blast radius most designs ignore: a misconfigured object for any non-form method can disable SSO for every method in the session; the two form methods are the only exempt ones. Plus the Kerberos prerequisites (no keytab, by the manual's own words), NTLMv2's single-header quirk, and the FBCI password token.
Identity & tokensReadF5 BIG-IP APM as a SAML Proxy: SP and IdP Modes
BIG-IP APM (now BIG-IP Zero Trust Access) is a concrete SAML proxy: as a reverse proxy in front of an application it acts as a SAML service provider, delegating login to an external identity provider and then doing single sign-on to the backend; it can also act as a SAML identity provider that federates SSO to SaaS. This maps the generic SAML-proxy roles onto APM's SP service, IdP service, and connector objects.
Security & WAFReadSession Variables: Where APM Keeps Everything It Learned
Every access-policy action writes its results into session.* variables, named by an anatomy the manual draws and read by three official syntaxes. The layer has one contract worth memorizing: secure variables are encrypted, hidden from reports and logs, and readable only with -secure, which makes a bare mcget on a password the classic silent empty read.
Identity & tokensRead
Automation & Integration
Anatomy of an AS3 Declaration: From the AS3 Class Down to the Pool
An F5 BIG-IP AS3 declaration is a JSON tree that describes the configuration you want, in tenant and application terms, and lets AS3 work out the order of operations. This walks the structure top to bottom: the AS3 request wrapper versus an ADC-only declaration, the ADC class and its schemaVersion, the Tenant that becomes a partition, the Application and its template, and the resource classes like Service_HTTP, Pool, and TLS_Server, plus the rules that make a declaration valid.
NetworkingReadDeclarative Onboarding: The L1-L3 Half of the Automation Toolchain
AS3 configures application services on a BIG-IP that is already on the network. Declarative Onboarding is what gets it there: licensing, provisioning, DNS and NTP, VLANs and self IPs and routes, users, and clustering, expressed as one JSON declaration against a Device with a single tenant named Common. This walks the model, the onboarding phases, and the version-specific gotchas that bite in production.
NetworkingReadTelemetry Streaming: The Automation Toolchain Extension That Observes Instead of Configures
AS3 configures application services and DO onboards the device. Telemetry Streaming is the third F5 Automation Toolchain extension, and it is the one that observes rather than configures: it aggregates, normalizes, and forwards statistics and events from the BIG-IP to a consumer like Splunk, ElasticSearch, DataDog, or Prometheus, all from one JSON declaration. This walks the Telemetry class model, the source-and-consumer pipeline, and the gaps that make a declaration succeed while collecting nothing.
NetworkingRead
F5XC - F5 Distributed Cloud
Actions and Default Deny in XC Service Policies
A rule's action is ALLOW, DENY, or NEXT_POLICY. Beyond the verdict, a rule can attach modifiers like WAF, bot defense, or rate limiting that fire on a match. And the whole system is deny-by-default: a request that matches nothing is denied. Knowing these makes a policy's real effect legible.
Security & WAFReadCase Sensitivity and Transformers in XC Matchers
In an XC service policy, header names are case-insensitive but header values, query keys, and cookie names are case-sensitive. Exact matches compare byte for byte unless you apply a transformer like LOWER_CASE first. This is the single most common reason a rule that looks right fails to match.
Security & WAFReadCommon XC Config Hazards a Linter Can Catch
XC objects accept settings that are valid but operationally wrong. This walks the hazards a single-object linter can flag: origin-pool skip-verification, cleartext, disabled SNI, and missing health checks; load-balancer no-WAF, plain-HTTP listeners, missing HTTP-to-HTTPS redirect, per-route WAF disable, catch-all route shadowing, and wildcard+apex; and a WAF left in monitoring mode - plus why severity is a prioritizer, not a verdict, and the limits of reading one object at a time.
Security & WAFReadF5XC TLS Security Levels Decoded: What High/Medium/Low Negotiate, and Why Your Scanner Flags a Load Balancer
The three predefined XC TLS levels plus Custom, why Default is the High level (min TLS 1.2), how the cipher lists are cumulative, why a scanner reports TLS 1.0/1.1 on Medium or Low, and why the Low level's static-RSA ciphers are flagged as weak.
TLS & transportReadHow F5 XC Service Policies Match a Request
An F5 Distributed Cloud service_policy has two moving parts: a set of predicates that scope which requests the policy even applies to, and a list of rules that decide what happens. A request matches only when every policy-level predicate is true and it matches one of the rules. This is the model everything else builds on.
Security & WAFReadHow F5XC Rate Limiting Actually Counts: Leaky Bucket, Burst, Lockout, and Overshoot
Why [1, Seconds, 60] and [1, Minutes, 1] are the same limit, how the leaky bucket and burst multiplier really behave, the mitigation trap where Disabled is not off, why distributed counting can overshoot, and why layered API rules are first-match.
Security & WAFReadHow the XC HTTP Load Balancer Picks a Route: First-Match, Path Types, and the Per-Route WAF
XC routes are an ordered list evaluated first-match; the four route types (simple, redirect, direct-response, custom); prefix vs exact vs regex path match; method/header/query conditions; and how any route can attach or disable its own WAF.
NetworkingReadHow XC Decides Which Load Balancer Wins a Hostname: Listener Logic, Wildcards, and the Apex
The advertise policy narrows a request to an IP and port; within it, XC picks the most specific domain match (exact beats wildcard). The hostname comes from SNI (HTTPS) or the Host header (HTTP). One Default load balancer per advertise policy catches the unmatched. Wildcards are suffix matches that do not cover the apex, wildcard certs cover a single label, and mixing a wildcard with its apex across auto-cert LBs is a hazard.
NetworkingReadPredicates and Boolean Logic in XC Service Policy Rules
Inside one rule, every predicate you set is combined with AND, and an unset predicate is implicitly true. Inside one matcher, multiple values are combined with OR. Getting these two levels straight is the difference between a rule that matches what you meant and one that quietly matches too much or too little.
Security & WAFReadReading an XC Security Event: Type, Action, and the Reason It Fired
XC's WAF, Bot Defense, service policies, and API protection all write to one security-events stream. The sec_event_type field tells you the source; action versus recommended action (and enforcement/staging) explains why a matched signature may not block; and the reason lives in different fields per type - WAF signatures/violations/attack types, the bot verdict, the matched service policy and rule, or API OpenAPI validation and policy hits.
Security & WAFReadThe Anatomy of an XC Origin Pool: Origin Types, Endpoint Selection, and TLS to Origin
What an origin pool holds, the ways to name an origin (public IP/DNS, on-site with a locator, K8s/Consul, virtual network, custom endpoint), why one origin appears once per Regional Edge, the automatic-port rule (443 with TLS, else 80), the TLS-to-origin settings, and why weights and priorities live on the pool reference in a route, not on the servers.
NetworkingReadThe OpenAPI Spec as XC's API Inventory: Paths, Auth, and the Shadow
XC API Protection is a positive security model built from an OpenAPI spec (2.0 or 3.0.x): the spec's paths and methods become the API inventory that drives validation, and undocumented endpoints are Shadow APIs. This covers why the spec is the source of truth, how API Discovery generates one from traffic, how to resolve authentication correctly (global vs per-operation, and the empty-list public override), and why path-parameter endpoints are the Broken Object Level Authorization surface.
NetworkingReadWhat Actually Happens When a CE Registers: Token, Two REs by GeoIP, IPsec-with-SSL-Fallback, and the Allowlist That Makes It Work
The CE registration handshake - token call-home, two Regional Edges chosen by GeoIP, PKI certificates - why the CE tunnels prefer IPsec and fall back to SSL, and how F5's published firewall reference (Secure Mesh v2 vs Legacy, domains over IPs) is the allowlist that lets it all connect.
NetworkingReadXC Load-Balancing Algorithms and Persistence, for BIG-IP People
On BIG-IP the load-balancing method and the persistence profile are two separate knobs; on XC they are one. Why the consistent-hashing algorithms (Source IP, Cookie, Ring Hash) ARE the persistence method, what you can hash, when to use the non-hash algorithms, and how Load Balancer Override gives per-route persistence.
NetworkingReadXC Rule Combining Algorithms: FIRST_MATCH, ALLOW_OVERRIDES, DENY_OVERRIDES
When a service policy holds a list of rules, the rule combining algorithm decides the order they are evaluated in. FIRST_MATCH walks top to bottom and stops at the first hit. ALLOW_OVERRIDES and DENY_OVERRIDES reorder by action first. The choice changes which rule wins when several could match.
Security & WAFReadXC Service Policy vs BIG-IP iRules: A Mental Model
iRules are event-driven scripts that run procedural code as a request is processed. An XC service policy is a declarative list of rules with predicates and actions. If you think in iRules, this maps the concepts across so you can read XC policies without hunting for the equivalent of a when-HTTP_REQUEST block.
Security & WAFRead
More
ACME on BIG-IP: from DevCentral scripts to a native client
How Let's Encrypt and other ACME certificate automation works on F5 BIG-IP: the native ACMEv2 client introduced in BIG-IP 21.1.0 (provisioning, renewal, and deployment for any ACMEv2 CA), the community dehydrated-based solutions that came before it, BIG-IQ's centralized Let's Encrypt CA management profile, and where the shared ACME concepts and rate limits fit.
Certificates & PKIReadAVR: Application Visibility and Reporting on BIG-IP
The on-box analytics module that turns traffic into queryable statistics - latency by virtual server, pool member, URL, and response code. Enabling it with an analytics profile, filtering to the view that answers your question, using latency trends to find the slow tier, and reading AVR's evidence for misconfiguration.
NetworkingReadBIG-IP 21.x: what changed, and why there is no version 18, 19, or 20
TMOS jumped from 17.x straight to 21.0.0 (November 2025) and 21.1.0 (May 2026), absorbing the modernization originally planned for the discontinued BIG-IP Next. Here is the full picture, verified against F5's own release notes and announcements: the version-numbering story, the platform and lifecycle rules you must check first, and a themed tour of what 21.0 and 21.1 actually deliver, from MCP-aware AI traffic handling and post-quantum TLS to in-place upgrades, a 64-bit control plane, HTTP/3 WAF, and multi-RPZ DNS.
NetworkingReadBIG-IP High Availability: Device Trust, Device Groups, and Traffic Groups
High availability (HA) on BIG-IP is built from three objects that are easy to conflate: device trust decides who may talk, device groups decide what is shared, and traffic groups decide what actually floats between devices during a failover. Understanding how they relate is the difference between an HA pair that behaves and one that surprises you.
NetworkingReadCustom Alerting on BIG-IP: SNMP Traps, Email, and Remote Syslog
The alerting pipeline watches the log stream and acts on matches: built-in alerts ship in alert.conf, yours belong in user_alert.conf. Defining a custom alert, the three delivery mechanisms, choosing local traffic log levels, and triggering test alerts on purpose with logger.
NetworkingReadEUD: BIG-IP Hardware Diagnostics Before You RMA
The End User Diagnostics suite is the offline test battery for BIG-IP hardware - memory, storage, sensors, interfaces - run from its own boot image with the operating system out of the way. The impact of running it, the requirements, how to boot it and collect its output, and where it fits between a suspicion and a return authorization.
NetworkingReadF5OS 2.0 From the Tenant's Seat: Cloud-Init, Per-Port RRDAG, and Q-in-Q
F5OS 2.0 is the platform-layer release that BIG-IP 21.1's hardware-facing features assume. Verified against F5's release documentation, this is the tenant operator's view: cloud-init for zero-touch BIG-IP tenant deployment on VELOS and rSeries (including DO and AS3 declarations at first boot), Round Robin DAG scoped to specific UDP ports instead of whole VLANs, and Q-in-Q arriving on VELOS under F5OS Confd, each with its exact platform list and the F5OS 2.0 host requirement spelled out.
NetworkingReadFailover on BIG-IP: States, Forcing, and Network Failover
Active, standby, offline, and forced offline are precise states with precise rules. This article walks the failover state machine, the difference between forcing standby and forcing offline, unicast versus multicast network failover, and where to look when a failover happens that nobody ordered.
NetworkingReadFrom 101 and 201 to F5-CA: What the Retired Exams Taught That the New Track Dropped
The modern F5-CA blueprint is essentially the old 201 restructured into five modular exams - but the 101 fundamentals layer and 201's entire support-resources section fell away in the move. A blueprint-against-blueprint comparison, and why the dropped material is still worth studying for the job, if no longer for the exam.
NetworkingReadFrom Interface to Self-IP: BIG-IP Layer 2 and 3 Dependencies
Interfaces aggregate into trunks, trunks and interfaces carry VLANs tagged or untagged, VLANs anchor self-IPs, and routes choose the egress - a dependency chain where status cascades downward. Reading it fluently answers half the connectivity questions on the administration blueprint.
NetworkingReadLimiting requests, connections and bandwidth in NGINX: leaky buckets and the burst that surprises people
Three different limits, three different directives, and one shared mechanism worth understanding before you tune it. The request limiter is a leaky bucket, not a quota per second, and burst plus nodelay change its behaviour in ways the names do not suggest.
NetworkingReadManagement Access on BIG-IP: the Management IP, Port Lockdown, and Access Lists
Two doors lead into a BIG-IP: the dedicated management interface and the self-IPs on traffic VLANs. This article covers configuring and finding the management address, what port lockdown actually permits on a self-IP, the httpd and sshd access lists, and how to diagnose the classic can't-reach-the-management-IP situations.
NetworkingReadNGINX caching: what gets stored, what gets served, and the gap where user data leaks
Whether a response is stored and whether a later request is served from it are different questions with different answers. NGINX protects you from caching a cookied response, and does not protect you from serving a cached response to a cookied request. That asymmetry is where one user receives another user's page.
NetworkingReadNGINX location matching: why the block you expected is not the one that ran
NGINX does not pick the first location that matches, and it does not pick the last. It follows a fixed five-step order in which the file's own order matters for exactly one step, which is why reading a config top to bottom will mislead you about which block wins.
NetworkingReadqkview and iHealth: the Support Snapshot Workflow
A qkview is the device's diagnostic self-portrait - configuration, logs, and system state in one file. Generate it from the GUI or command line, upload it to iHealth, and read the heuristics: known-issue matches, severity-ranked findings, and upgrade guidance. When to run one, and how to interpret what comes back.
NetworkingReadQUERY Meets BIG-IP: LTM, iRules, and the Advanced WAF Verdict
How BIG-IP handles the new HTTP QUERY method (RFC 10008): LTM's HTTP profile passes unknown methods by default, Advanced WAF blocks QUERY as an Illegal method until you allow it, and twenty years of iRules ambiguity between HTTP::method and HTTP::query suddenly matters. What to audit, where to click, and why the body still gets full inspection.
NetworkingReadReading an F5OS RESTCONF path
F5OS is driven by RESTCONF over YANG, not by iControl REST over a TMOS object model. This explains how to read a path: the module prefix, the container hierarchy, list keys, the module:node convention, and the 8888 versus 443 duality.
NetworkingReadReading an iControl REST path
Why iControl REST URLs contain tildes, how the module and collection are laid out, what a partition and folder path means, and which query options change the size of the answer.
NetworkingReadReading BIG-IP statistics
Why an iControl REST stats response is wrapped in three envelopes, what the high and low halves of a counter mean, and why a single sample can never give you a rate.
NetworkingReadReloading NGINX without dropping traffic, and the first four things to check when it breaks
A reload is not a restart: the master validates the new configuration, starts new workers, and lets the old ones finish what they were doing. Knowing that, and knowing which log answers which question, resolves most NGINX problems before they become interesting.
NetworkingReadRoute Domains: Layer 3 Segmentation Inside One BIG-IP
A route domain is a separate routing table with an ID, letting one device serve tenants whose address spaces overlap completely. The percent-sign notation, strict isolation, parent domains, and the partition connection - the functionality the LTM blueprint asks you to explain.
NetworkingReadThe BIG-IP Log Files: a Map of /var/log
Which log answers which question: /var/log/ltm for traffic objects and system events, /var/log/secure for who got in, /var/log/audit for who changed what - plus the severity ladder and how to read an event line. The fastest troubleshooters are the ones who open the right file first.
NetworkingReadThe NGINX configuration tree: what includes, in what order, and who owns the worker
One file, a directory of fragments, and an include order that decides which directive wins. Plus the two ownership questions that explain most permission failures: which user the master runs as, which user the workers run as, and why those are deliberately different.
NetworkingReadThe NGINX proxy_pass trailing slash: one character that decides what your backend receives
proxy_pass with a URI part replaces the matched location prefix. Without one, the original request URI passes straight through. That is the entire rule, it is a binary switch rather than a shade of difference, and a single slash is enough to flip it.
NetworkingReadThe System Services Behind a Healthy BIG-IP: DNS, NTP, SNMP, Syslog
Four small configurations with outsized blast radius. Name resolution feeds monitors and licensing, time sync underpins device trust and every log timestamp, SNMP is how the monitoring system sees you, and remote syslog is where the evidence survives. Proper configuration for each, and what breaks when they are wrong.
NetworkingReadThe three states an F5OS tenant can be in
Configured, provisioned, deployed — and the rule that changing vCPU or memory means going backwards through them. Plus the published memory formula, and why a VELOS example will not commit on an rSeries.
Operations & FieldcraftReadvCMP: Hosts, Guests, and How Resources Are Carved
Virtualized Clustered Multiprocessing turns one hardware platform into several independent BIG-IP instances. The host-guest model, the configured-provisioned-deployed lifecycle, how CPU cores drive memory allocation, version rules between host and guest, and how VLANs pass from host to guest.
NetworkingReadWhat the BIG-IP writes into your capture
The F5 Ethernet trailer carries what TMM knew about each packet — slot, TMM, virtual server, flow IDs and the reset cause. From v15 it can also carry TLS session secrets, which changes what a pcap is.
NetworkingRead