02 Virtual Servers and Listeners

A virtual server (VS) is the listener clients connect to: a destination IP + port that tells BIG-IP “accept this traffic and do this with it”. Because BIG-IP blocks everything by default, no listener means no traffic. This note covers what a VS is made of, the VS types, and how BIG-IP decides which listener handles a packet.

Anatomy of a virtual server

Part	Meaning
Destination address/mask + service port	The VIP, e.g. 172.16.101.11:443. The IP part is the virtual address
Source address	Which clients match (default 0.0.0.0/0 = everyone)
Type	Standard, Forwarding, Performance… (table below)
VLAN and Tunnel Traffic	Where it listens. Default = all VLANs and tunnels
Profiles	Protocol (TCP/UDP/FastL4), HTTP, SSL client/server, OneConnect, compression…
Resources	Default pool, persistence profiles, iRules, LTM policies
Source Address Translation	None (default), Auto Map, SNAT pool
Connection limits	Max concurrent connections / rate limit

Virtual address vs virtual server

• Virtual address = only the destination IP (172.16.101.11). It’s created automatically with the first VS that uses it.
• Virtual server = virtual address + port + everything else.
• Several virtual servers can share one virtual address (:80 and :443).
• The virtual address has its own settings: ARP, ICMP echo, route advertisement, traffic group. That’s why ping to a VIP can work while the website doesn’t — ICMP is answered by the virtual address, not by the service.

Restrict where a VS listens

By default a VS listens on every VLAN and tunnel, which wastes resources and widens the attack surface. Set VLAN and Tunnel Traffic → Enabled on… and select only the VLAN where clients arrive (e.g. external).

How a Standard VS processes a connection

1. The client sends a SYN to the VIP.
2. BIG-IP finds the most specific matching listener.
3. BIG-IP completes the handshake with the client (full proxy) and applies the profiles: decrypt SSL, parse HTTP, run iRules and policies.
4. It picks a pool member with the load balancing method (or persistence), applies SNAT if configured and opens the server-side connection.
5. It relays the responses back, applying profile functions (compression, cookie insert, re-encryption).

Virtual server types

Type	Pool	Proxy	Use
Standard	Yes	Full	Default; all L4–L7 features
Forwarding (Layer 2)	No	—	Transparent forwarding when the same subnet spans both sides (VLAN group)
Forwarding (IP)	No	—	Route traffic through BIG-IP like a router (e.g. wildcard 0.0.0.0/0:* for Internet access)
Performance (Layer 4)	Yes	Half	FastL4 profile + hardware acceleration; no L7
Performance (HTTP)	Yes	—	FastHTTP profile; simple HTTP at high throughput
Stateless	Yes	—	UDP without a connection table
Reject	No	—	Rejects matching traffic (RST / ICMP unreachable)
DHCP	—	—	DHCP relay
Internal	Yes	—	Only reachable from other virtual servers (ICAP, request/response adapt)
Message Routing	—	—	SIP, Diameter, MQTT, generic message protocols

Forwarding VSs don't load balance

They have no pool, so load balancing methods like Round Robin don’t apply. If you insert BIG-IP in the path between clients and the Internet, you need a forwarding VS or traffic is dropped (BIG-IP blocks by default). Between two routed subnets use Forwarding (IP); use Forwarding (Layer 2) only when the same subnet exists on both sides.

Listener precedence (packet processing order)

When a packet arrives, BIG-IP checks in this general order (confirm the exact list for your version in the BIG-IP documentation on listener precedence):

1. An existing entry in the connection table
2. Packet filters (if enabled)
3. Virtual server
4. SNAT listener
5. NAT
6. Self IP (subject to Port Lockdown)
7. Nothing matched → drop

Virtual server matching order (most specific wins)

Several VSs can match the same packet. BIG-IP picks the most specific by checking, in order: Destination → Source → Port (DSP).

• A host destination (/32) beats a network destination (/24).
• A specific source beats 0.0.0.0/0.
• A specific port beats * (any).

VS	Destination	Port	Source
VS1	172.16.101.11	80	0.0.0.0/0
VS2	172.16.101.12	80	192.168.101.0/24
VS3	172.16.101.11	*	0.0.0.0/0
VS4	172.16.101.0/24	*	*

• 10.10.100.62 → 172.16.101.11:80 → VS1 (host destination, exact port).
• 10.41.131.12 → 172.16.101.11:443 → VS3 (host destination, wildcard port).
• 10.1.1.1 → 172.16.101.50:22 → VS4 (only the network VS matches).

Host VS vs network VS

• Host VS — destination is a single IP (/32).
• Network VS — destination is a subnet (172.16.101.0/24:443). One network VS can replace many host VSs with identical settings, and it’s how wildcard forwarding VSs are built.

Why a VS doesn’t receive traffic

• Wrong destination, port, source or VLAN setting; VS disabled.
• Upstream routing/ARP problem (the VIP isn’t reachable).
• Connection limit reached → new TCP connections get a RST, UDP is dropped. Visible in /var/log/ltm and tmsh show /net rst-cause.
• Confirm traffic is arriving with tmsh show /sys connection and the VS statistics.

Self-check

Q1 — What is the difference between a virtual address and a virtual server?

Respuesta

The virtual address is only the destination IP; the virtual server is that IP plus the service port and all its settings (profiles, pool, iRules…). Several VSs can share one virtual address.

Q2 — Which VS setting defines where the virtual server listens?

Respuesta

VLAN and Tunnel Traffic (Enabled on… specific VLANs).

Q3 — Using the table above, a client 10.41.131.12 goes to 172.16.101.11:443. Which VS?

Respuesta

VS3: host destination match with a wildcard port.

Q4 — BIG-IP is placed between users and the Internet router and users lose Internet access. Why, and what fixes it?

Respuesta

BIG-IP blocks all traffic by default. Deploy a forwarding virtual server (Forwarding IP for routed subnets) with a wildcard destination.

Q5 — Which VS type is used to reach a pool of ICAP servers?

Respuesta

An Internal virtual server.

Q6 — How do you know a VS is hitting its connection limit?

Respuesta

Look for “connection limit reached” messages in /var/log/ltm and check tmsh show /net rst-cause.