17 Networking Review for BIG-IP
The F5 Administrator exams include networking fundamentals (CAB1 and CAB2). Most of it I already know from CCNA/CCNP; this note keeps only what the F5 exams ask and links it to BIG-IP. For the full OSI model see Modelo OSI.
End-to-end communication
- DHCP hands out IP addressing automatically. Lease process = DORA: Discover → Offer → Request → Acknowledge.
- Layer 2 uses MAC addresses; ARP finds the MAC of an IP on the local segment.
- Layer 3: routers forward between networks using the routing table. They learn routes from connected networks, static routes and dynamic routing protocols — never from switches. Route installation: for the same prefix, lowest administrative distance wins, then lowest metric. Forwarding: each packet uses the longest prefix match in the routing table.
- VLANs separate a switch into L2 broadcast domains; frames are identified by 802.1Q VLAN tagging.
- MACs change at every L3 hop; IPs stay the same unless NAT changes them.
Firewalls
- Ordered rules, first match wins; the implicit deny blocks anything not matched by a previous rule.
- Types: packet filter (stateless, like an ACL), stateful (tracks sessions, allows the return traffic), NGFW (application, user, IPS, URL filtering — e.g. Palo Alto).
- BIG-IP itself is default-deny: it only processes traffic that matches a listener.
OSI mapping of BIG-IP features
| Layer | Examples | BIG-IP features |
|---|---|---|
| L1 Physical | Cables, optics, interfaces | Interface media/duplex, front panel LEDs |
| L2 Data link | MAC, VLAN, ARP | VLANs, trunks, ARP cache, MAC masquerading |
| L3 Network | IP addresses, routing | Self IPs, routes, route domains, SNAT/NAT |
| L4 Transport | TCP/UDP ports | VS ports, TCP/UDP/FastL4 profiles, Port Lockdown |
| L7 Application | HTTP, DNS, TLS | HTTP profile, iRules, cookie persistence, compression, WAF |
ICMP
- Used by devices to report problems; tools: ping and traceroute.
- When a packet’s TTL reaches 0 it’s dropped and an ICMP Time Exceeded message is returned — that’s how traceroute works.
- On BIG-IP: virtual addresses can answer ICMP echo; Port Lockdown always allows ICMP to self IPs.
VPNs
- Secure connections between networks or devices over the Internet: site-to-site or remote access.
- Common protocols: IPsec and SSL/TLS. On BIG-IP, SSL VPN is provided by the APM module.
Support services
| Service | Purpose |
|---|---|
| DNS | Name resolution |
| NTP | Keep clocks synchronized (logs, auth, certificates, HA) |
| Syslog | Send logs to a remote server |
| SNMP | Polling and traps for monitoring |
Self-check
Q1 — What acronym describes the DHCP lease process?
Respuesta
DORA.
Q2 — Which protocol identifies the MAC address of an IP?
Respuesta
ARP.
Q3 — Which is NOT a way routers learn routes: connected, static, dynamic protocols, or from switches?
Respuesta
From switches they’re connected to.
Q4 — What does the implicit deny do?
Respuesta
Blocks anything that didn’t match a previous rule.
Q5 — What happens when a packet's TTL reaches zero?
Respuesta
The packet is dropped (and ICMP Time Exceeded is sent back).
Q6 — At which OSI layer are IP addresses?
Respuesta
Network (Layer 3).
Q7 — Which two protocols are commonly used for VPNs?
Respuesta
SSL/TLS and IPsec.
Q8 — Which protocol keeps system clocks up to date?
Respuesta
NTP.