01 ADC and Full Proxy Architecture
F5 BIG-IP is an Application Delivery Controller (ADC): a device that sits in front of applications and controls how they are delivered — which server answers, whether it’s healthy, whether the session stays on the same server, and whether the traffic is encrypted, compressed, inspected or authenticated on the way. This note explains what an ADC is, how BIG-IP works as a proxy, and how the system is built inside.
What an ADC does
ADC in one line
A reverse proxy in front of the servers that adds availability, performance and security to the applications behind it.
Core services:
- Load balancing — spread connections across several servers (pool members).
- Health monitoring — stop sending traffic to servers that fail.
- Persistence — keep a client on the same server for its whole session.
- SSL offloading — decrypt on BIG-IP so the servers don’t spend CPU on encryption.
- Optimization — compression, caching, TCP optimization, connection reuse (OneConnect).
- Security — WAF, DoS protection, authentication, hiding the real servers.
- Programmability — iRules and policies to make custom decisions on the traffic.
Proxy types
| Type | Acts on behalf of | Sits | Typical use |
|---|---|---|---|
| Forward proxy | Clients | Between internal users and the Internet | URL filtering, caching, hiding users’ IPs |
| Reverse proxy | Servers | In front of the servers | Load balancing, SSL offload, WAF, auth — this is BIG-IP LTM |
| Transparent proxy | Either | Inline, the client doesn’t know | Inline inspection/caching |
Reverse proxy in practice
Clients only ever talk to the virtual IP (VIP) published on BIG-IP, never directly to the servers. BIG-IP decides which server answers and can add services (SSL, persistence, compression, WAF, authentication) along the way.
Full proxy vs half proxy
- Full proxy — BIG-IP terminates the client connection and opens a separate connection to the server. There are two independent TCP sessions (client-side and server-side), each with its own TCP/SSL settings. BIG-IP can read and modify Layer 7 (HTTP headers, URIs, cookies). Also called connection-based load balancing. Used by the Standard virtual server.
- Half proxy — BIG-IP handles the start of the connection and then forwards packets; there’s one end-to-end TCP session. Much faster, but no Layer 7 visibility. Also called packet-based load balancing. Used by Performance (Layer 4) with the FastL4 profile.
The 3-way handshake happens twice in a full proxy
The client completes its handshake with BIG-IP, and BIG-IP completes a new handshake with the pool member. The server-side handshake is never skipped.
System architecture
| Component | Role |
|---|---|
| TMOS (Traffic Management Operating System) | The software platform that gives BIG-IP its ADC functionality |
| TMM (Traffic Management Microkernel) | The data plane: processes all client/server traffic, profiles, iRules, SSL |
| Linux host (CentOS/RHEL based) | The control plane: GUI, tmsh, daemons (mcpd config, bigd monitors, sod failover), logging |
| PVA / ePVA (hardware) | Acceleration chip on physical platforms for FastL4 traffic |
- High TMM CPU affects traffic; high control-plane CPU affects management, monitors and logging.
- Management traffic uses the dedicated mgmt port, separate from the traffic interfaces.
Modules
BIG-IP is modular: each function is a module that must be licensed and then provisioned (given CPU, memory and disk).
| Module | Function |
|---|---|
| LTM — Local Traffic Manager | Load balancing, the core of BIG-IP |
| DNS (formerly GTM) | Global server load balancing across data centers |
| Advanced WAF / ASM | Web application firewall (PCI compliant) |
| AFM | Network firewall and DoS protection |
| APM | Access control, SSL VPN, SSO, MFA |
| AVR | Analytics and visibility |
| SSL Orchestrator | Decrypt and steer traffic through security tools |
Provisioning levels
| Level | Meaning |
|---|---|
| Dedicated | The module gets all resources; every other module must be None |
| Nominal | Gets its minimum and shares the rest as needed → normal choice to run a module next to LTM without restrictions |
| Minimum | Only the minimum to run; it can’t grow |
| None | Not provisioned |
Defaults to remember
- BIG-IP blocks all traffic by default. It only processes traffic that matches a listener: virtual server, SNAT, NAT, or a self IP allowed by Port Lockdown.
- Default management IP:
192.168.1.245/24. - Default credentials: GUI
admin/admin, SSH/consoleroot/default(recent versions force a password change at first login). - Inside tmsh the prompt ends in
(tmos)#. - BIG-IQ = centralized management for many BIG-IPs (config, licensing, analytics).
Self-check
Q1 — When BIG-IP load balances an application, is it a forward or a reverse proxy?
Respuesta
A reverse proxy: it acts on behalf of the servers. A forward proxy acts on behalf of clients going out.
Q2 — Which ADC service removes the encryption workload from the servers?
Respuesta
SSL offloading.
Q3 — What is the name of the OS that gives BIG-IP its ADC functionality, and which component is the data plane?
Respuesta
TMOS. The data plane is TMM; the Linux host is the control plane.
Q4 — Which module provides a PCI-compliant web application firewall?
Respuesta
ASM / Advanced WAF.
Q5 — You want to add a module next to LTM with no resource restrictions. Which provisioning level?
Respuesta
Nominal.
Q6 — True or false: by default BIG-IP forwards any traffic it receives.
Respuesta
False. BIG-IP blocks all traffic that doesn’t match a configured listener.