F5CAB5 BIG-IP Administration Support and Troubleshooting (F5CAB5) exam Questions and Answers

To understand which device becomes active, we must look at how the BIG-IP system handles HA Order and Auto Fallback within a traffic group.

HA Order Mechanism: When a traffic group is configured with an " HA Order " list, the system prefers to host the traffic group on the highest-ranking available device in that list (1 being the highest).

The Impact of " Forced to Standby " : BIGIP-D is the first choice in the order, but it has been " Forced to Standby. " This state is persistent and manual; until an administrator releases the " Force to Standby " state, the device is ineligible to host the traffic group, effectively removing it from the top of the preference list.

Auto Fallback: When " Auto Fallback " is enabled, the traffic group will automatically migrate back to a higher-priority device in the HA order as soon as that device becomes available and is in a healthy " Standby " state.

The Scenario Logic: 1. BIGIP-D is ineligible (Forced Offline/Standby).

2. BIGIP-B is the next highest device in the HA Order (Rank 2).

3. While BIGIP-B was rebooting, the traffic group would have failed over to BIGIP-C (Rank 3).

4. Once BIGIP-B finishes booting and joins the cluster in a " Standby " state, the Auto Fallback setting triggers.

5. Because BIGIP-B is higher in the HA Order than the current active device (BIGIP-C) and the only device above it (BIGIP-D) is ineligible, the traffic group fails back to BIGIP-B .

In the BIG-IP Configuration Utility, the status icon (shape and color) provides immediate feedback on why a virtual server is not working as expected81. A " Red Diamond " indicates that the object is " Offline " and unavailable to process traffic82. For a virtual server, this specific status typically means it has inherited an offline state from its mandatory backend resources8383. If all pool members associated with the virtual server have failed their health monitors, the virtual server will transition to a red diamond status because it has no healthy destination for incoming requests. This is distinct from a " Black Circle, " which would indicate the virtual server has been manually " Disabled " by an administrator85858585. To troubleshoot a red diamond, the administrator must examine the associated pool and its members to determine why the health monitors are failing (e.g., server crashes, network path failures, or incorrect monitor strings). Resolving the health check failures on the pool members will return the virtual server to an " Available " (Green) status.

Status changes for local traffic objects (Virtual Servers, Pools, Nodes) are recorded in the Local Traffic Manager (LTM) log.

Health State Logging: When a health monitor marks a resource as available (Green) or unavailable (Red), the system generates a log message in /var/log/ltm .

Log Entry Example: A transition from Red to Green will appear as a message similar to: 01010027:3: Pool /Common/my_pool member /Common/10.0.0.1:80 monitor status up.

Evaluation of Other Options:

/var/log/audit (Option A) logs who changed a configuration, not automated state changes from health monitors.

/var/log/lastlog (Option C) is a standard Linux file that tracks the last login time of users.

/var/log/monitors (Option D) is not a standard log file on the BIG-IP system.

The BIG-IP system uses the audit log to track administrative actions and configuration changes.

Audit Logging Functionality: When a user modifies the configuration via the Configuration Utility (GUI), the Traffic Management Shell (tmsh), or iControl, the system records the event in the audit log. This includes the name of the user who made the change, the timestamp, and the specific command or object that was modified.

Log Location: The audit log is stored at /var/log/audit .

Evaluation of Other Options:

/var/log/messages (Option A) contains general system and kernel messages but is not the primary source for configuration change details.

/var/log/secure (Option B) primarily logs authentication and authorization attempts (logins and logouts).

/var/log/user.log (Option D) is a generic Linux log file for user-level applications and does not track BIG-IP LTM configuration changes.

The key clue in the exhibit is the pool member’s availability showing“Offline (Enabled) – Parent down”. In BIG-IP terminology, a pool member inherits the status of itsparent node. If thenodeis marked down (for example, by a node-level monitor or a default “node is down” condition), thenall pool members using that node IPwill also be marked down and will not receive any traffic, even if the application service on the member port might be healthy.

While the HTTPS monitor configuration (send/receive strings) is displayed, the statusspecificallyindicates anode (parent) failure, not a service-level failure. If the problem were the application not matching the receive string, you would typically see the member down due to themember’s monitorfailing (and the status would reflect monitor failure details), rather than “parent down.”

Option D is too broad; BIG-IP can generally reach the subnet (other servers work), and this symptom points to a specific node condition. Option C is incorrect because HTTP/1.1 is commonly used for monitoring and is valid when properly formatted (especially with a Host header). Therefore, the most likely cause is that thenode health monitor is not responding, causing the node—and consequently the member—to be marked down.

To gather granular Layer 7 data such as specific HTTP methods (GET, POST, etc.) and HTTP status codes (200, 404, 500), the BIG-IP system utilizes the Analytics (AVR) profile.

Analytics Profile (Application Visibility and Reporting): While a standard HTTP profile tracks basic byte counts and requests, the Analytics profile is designed specifically to capture, analyze, and display detailed application performance metrics.

Metrics Captured: When attached to a virtual server, it records URL-level statistics, response codes, page load times, and client-side metrics.

Why not others? * HTTP Profile (Option A): This profile handles the parsing of HTTP traffic but does not provide a built-in reporting dashboard for status code distribution.

Statistics Profile (Option C): This is a legacy profile used for custom user-defined counters and does not automatically categorize HTTP methods or status codes.

Request Adapt (Option D): This is used for integrating with ICAP servers (like virus scanners) and does not perform traffic reporting.

When a pool member is markedDOWN, it indicates that the configured health monitor is failing. The most effective troubleshooting approach is to focus on the monitor behavior and the actual traffic between BIG-IP and the pool member.

Enabling monitor logging (Option B)is a recommended first step. Monitor logging provides detailed information about why the health check is failing, such as timeouts, connection refusals, incorrect responses, or unexpected status codes. This directly correlates with BIG-IP troubleshooting best practices and allows administrators to confirm whether the failure is due to application behavior, incorrect monitor configuration, or network reachability.

Collecting a TCPdump packet capture (Option D)is also a highly effective method. A packet capture allows the administrator to verify whether the monitor probes are being sent, whether responses are received, and whether packets are being dropped, reset, or malformed. This is especially valuable when diagnosing firewall issues, SSL problems, or application-level failures.

Reviewing pool statistics (Option C) is useful for general monitoring but does not explainwhya health monitor is failing. Reviewing the routing table (Option A) is typically unnecessary unless there is evidence of a broader routing issue affecting multiple destinations.

The pool member is markedDOWNbecause it is monitored bymultiple health monitors, specifically anHTTPmonitor and anHTTP/2monitor. The status message clearly shows that theHTTP monitor is UP, while theHTTP/2 monitor is DOWN. In BIG-IP, when multiple monitors are assigned to a pool member, the default behavior isAND logic, meaningall assigned monitors must succeedfor the pool member to be considered healthy.

In this scenario, the server is responding successfully to standard HTTP (likely HTTP/1.1) requests but does not support or respond correctly to HTTP/2 requests. As a result, the HTTP/2 monitor fails, which causes the overall monitor status to beDOWN, even though HTTP traffic itself is working.

This behavior is expected and documented in BIG-IP monitoring logic. Unless the monitor rule is explicitly changed to“at least one of”, a single failing monitor will mark the pool member down. Therefore, the correct conclusion is that the pool member isonly serving HTTP traffic, not HTTP/2.

The resolution would be to either remove the HTTP/2 monitor, correct the application to support HTTP/2, or adjust the monitor rule to match the intended health-check logic.

When a physical network link (like Interface 1.1) reaches its maximum capacity, it creates a bottleneck that negatively impacts network-level performance. To overcome the physical limits of a single interface, BIG-IP administrators use " Trunking, " which is the F5 term for Link Aggregation (often implemented via LACP). A trunk object bundles multiple physical interfaces into a single logical link. By creating a trunk with two or more interfaces, the BIG-IP can spread the traffic load across all members of the trunk, effectively doubling or tripling the available bandwidth for the associated VLANs. Beyond performance, troubleshooting redundancy often leads to the use of trunks; if one cable in a trunk fails, the others continue to carry traffic, preventing a complete outage. This is a superior solution to simply increasing MTU (which requires end-to-end support) or manually setting media speeds. In a high-availability environment, configuring trunks is a foundational troubleshooting and optimization step to ensure that traffic spikes do not result in packet loss due to link saturation.

This log entry indicates that multiple monitors are assigned to the pool member, and the member is failing one of them.

Understanding Monitor Logic: By default, if multiple monitors are assigned to a pool or pool member without a " Minimum To Up " (Availability Requirement) setting, the system requires all monitors to pass for the member to be marked " Up " .

Analyzing the Log: The log clearly states: [ /Common/http: up, /Common/http2: down; ... ]. This means the standard HTTP monitor is successful, indicating the member is serving HTTP traffic, but the http2 monitor has failed.

Conclusion: Since the http monitor is " up " but the member as a whole is " down, " we can conclude the member is successfully responding to standard HTTP requests but not HTTP2 requests. Therefore, the member is currently only serving standard HTTP traffic.

This scenario describes a classic network performance issue known as the " Mega-Proxy " problem. When an organization routes all employee traffic through a single proxy server, the BIG-IP sees thousands of unique users as having the exact same source IP address. If the administrator has configured " Source Address Affinity " persistence, the BIG-IP will correctly follow the rule but incorrectly route all users to the same single backend pool member. This creates a severe load imbalance where one server is overwhelmed while others remain idle, leading to poor application response times. To resolve this, the administrator must change the persistence profile to " HTTP Cookie " . Cookie-based persistence allows the BIG-IP to place a unique identifier in each user ' s browser, allowing the system to distinguish between individual sessions even if they share the same source IP. This fix ensures that traffic is distributed evenly across the pool members, restoring4 the expect5ed load balancing functionality and resolving the slow performance reported by users behind the corporate proxy.

To manually verify a health monitor ' s " Send String " from the BIG-IP command line, the curl utility is the preferred tool because it allows for custom header insertion.

Matching the Monitor String: The monitor string requires an HTTP/1.1 request which must include a " Host " header. Option A correctly uses the --header (or -H) flag to pass Host: www.example.com to the specific IP and port of the pool member.

Troubleshooting Logic: If curl --header ' Host: www.example.com ' ' http://10.10.3.75:8080/ ' returns a " 200 OK " but the BIG-IP monitor still shows " Down, " the administrator should check if the Receive String in the monitor configuration matches the output provided by curl.

Invalid Syntax: Option D is incorrect because it tries to append the hostname to the URI path, which the web server will likely reject with a " 404 Not Found " . tracepath (Options B and C) is a path discovery tool similar to traceroute and cannot validate HTTP response content.

To verify the specific health and availability status of individual members within a specific pool, the administrator must navigate to the Members tab of that specific pool.

Navigation Path: The correct path is Local Traffic > Pools > Pool List , then clicking on the name of the <</b> pool_in_question > , and finally selecting the Members tab. This screen provides a granular view of each member ' s IP address, port, and their current status (indicated by the colored icons: Green, Red, Yellow, or Blue).

Why Option A is correct: While you can see a general status summary on the Pool List page (Option B), that page only shows the status of the pool as a whole. To troubleshoot why a pool is not working or to see which specific member is down, you must drill down into the Members tab.

Evaluation of Other Options:

Local Traffic — > Pools (Option B): This leads to the Pool List. It shows the aggregate status of all pools but does not list individual member details or their specific monitor results without further clicking.

Local Traffic — > Virtual Servers — > Statistics (Option C): This path shows traffic statistics (bits in/out, connections) for virtual servers, not the health monitor status of individual pool members.

Local Traffic — > Nodes (Option D): While this shows the health of the underlying IP address (Node), it does not show the status of the specific service (Port/Member) within a pool. A Node might be " Up " (ICMP), while the Pool Member is " Down " (HTTP failure).