13 Networking and Self IP Security
BIG-IP is a network device first: before any application works it needs interfaces, VLANs, self IPs and routes, and those addresses must be protected. This note covers the network objects, ARP, interface problems, trunks, route domains, partitions and Port Lockdown.
Network objects
| Object | What it is | Cisco analogy |
|---|---|---|
| Interface | Physical/virtual port: 1.1, 1.2… plus the dedicated mgmt port | Physical port |
| Trunk | Link aggregation (LAG), optionally with LACP | EtherChannel / port-channel (not 802.1Q!) |
| VLAN | L2 segment; an interface/trunk carries it untagged (one per interface) or tagged (802.1Q) | VLAN |
| Self IP | BIG-IP’s own IP on a VLAN. Non-floating = this device; floating = shared in HA | SVI |
| Route | Default and static routes | ip route |
| VLAN group | Bridges two VLANs in the same subnet (transparent designs) | Bridge group |
"Trunk" means something else
In Cisco a trunk is an 802.1Q link. In F5 a trunk is a link aggregation (port-channel). 802.1Q on F5 is called tagged VLAN membership.
Lab convention: 1.1 = external (clients), 1.2 = internal (servers), mgmt = out-of-band management.
ARP on BIG-IP
- BIG-IP keeps an ARP cache (Network → ARP → Dynamic List) mapping IPs to MACs.
- When an entry’s timer reaches zero and the remote device doesn’t answer, its MAC is dropped from the cache.
- IP/MAC relationship: IPs identify the end hosts; MACs identify the next hop on each segment.
Interfaces and Layer 1
- Common physical problems: bad cables/optics, speed/duplex mismatch, CRC errors, collisions.
- Per the course, hard-code speed and duplex on both ends when autonegotiation causes trouble. A mismatch shows collisions/late collisions and slow throughput.
- Media names:
1000T-FD= 1 Gb full duplex copper ·10000T-FD/10000SR-FD= 10 Gb full duplex. - Throughput from
ifconfig: take two RX/TX byte readings N seconds apart → (Δbytes × 8) / N = bits per second. - Front panel LEDs show link and speed (course: solid amber = 1 Gbps). The LCD panel shows warnings such as high temperature or a failed fan/power supply (message list in K05171852).
Partitions and route domains
- Administrative partitions — containers for objects (
/Common,/AppTeamA) used for delegated administration: a user can have a role only in their partition./Commonis shared. - Route domains — separate routing tables on one BIG-IP, like VRFs. They allow overlapping IP ranges (multi-tenant, mergers). Notation
10.1.1.10%2= IP in route domain 2; route domain 0 is the default.
Port Lockdown
Controls which protocols and ports a self IP accepts. It protects the BIG-IP itself, not the virtual servers.
| Option | Meaning |
|---|---|
| Allow None | Nothing (except the exemptions) |
| Allow Default | The default service list (below) |
| Allow All | Everything |
| Allow Custom | Only the protocols/ports you list |
| Allow Custom (Include Default) | Your list + the default list |
Allow Default list: IGMP, OSPF, PIM, TCP/UDP 4353 (iQuery/CMI), TCP 443 (HTTPS), TCP/UDP 161 (SNMP), TCP 22 (SSH), TCP/UDP 53 (DNS), UDP 520 (RIP), UDP 1026 (network failover).
Always exempt from Port Lockdown:
- Traffic to virtual servers
- ICMP (ping/traceroute)
- TCP 4353
- TCP mirroring ports (TCP 1029–1155, one channel per traffic group; 1028 in older versions)
ICMP is implicitly allowed
Even with “Allow None” a self IP still answers ping. Port Lockdown filters by protocol/port only — it can’t filter by source address (use packet filters, AFM or the management port rules for that).
Recommended: Allow None on external self IPs; only what’s needed on internal and HA self IPs (HA needs TCP 4353 and UDP 1026).
Objects that open access to the network
When auditing exposure, look at two object types:
- Virtual servers — which destinations and ports are published, and on which VLANs.
- Self IPs — which services BIG-IP itself answers (Port Lockdown).
Limiting access to a virtual server
Contenido complementario
These 301a sections weren’t covered in my videos; this is general BIG-IP practice.
Pendiente: validar en el lab
Este contenido no salió de mis clases. Probar estos comandos y pasos en BIG-IP VE antes de usarlos en un trabajo real, y corregir lo que difiera en mi versión.
- Source address on the VS (only that client network matches).
- VLAN and Tunnel Traffic → Enabled on… specific VLANs.
- An iRule or LTM policy that rejects by client IP (data group of allowed networks).
- Packet filters or AFM firewall rules / IP Intelligence.
Profile settings that limit access: connection limit and connection rate limit (VS, member, node), Client SSL TLS versions/ciphers and required client certificates, TCP idle timeout and SYN cookies, an APM access policy for authentication.
Self-check
Q1 — What happens when an ARP entry's timer reaches zero and the remote device doesn't answer?
Respuesta
Its MAC is dropped from the ARP cache.
Q2 — In F5, what is a trunk?
Respuesta
A link aggregation (port-channel), optionally with LACP.
Q3 — Port Lockdown allows ANY protocol only from the internal network, yet an external host can ping the self IP. Why?
Respuesta
ICMP is implicitly allowed by Port Lockdown.
Q4 — Port Lockdown exempts VS traffic, ICMP and TCP 4353. What is the fourth exemption?
Respuesta
The TCP mirroring ports (TCP 1029–1155, one channel per traffic group; 1028 in older versions).
Q5 — Which BIG-IP feature is like a Cisco VRF?
Respuesta
Route domains.
Q6 — Interface 1.1 is slow with collisions and half duplex. What's wrong and how do you fix it?
Respuesta
A duplex mismatch. Fix with
tmsh modify net interface 1.1 media 1000T-FD(and match the switch side).