19 Platforms, Modules and the F5 Ecosystem

The certification focuses on LTM, but jobs ask about the hardware you’ll find, the other BIG-IP modules, and F5’s cloud and NGINX products. This note is the map of that ecosystem.

Contenido complementario

Not covered in my courses; written from F5 documentation and general industry practice to prepare for real jobs. Verify current product names and versions on f5.com.

Pendiente: validar en el lab

Este contenido no salió de mis clases. Probar estos comandos y pasos en BIG-IP VE antes de usarlos en un trabajo real, y corregir lo que difiera en mi versión.

Platforms

Platform	Description
iSeries (i2000–i15000)	Classic appliances running TMOS directly (being replaced)
rSeries	Current appliances running F5OS-A; BIG-IP runs as a tenant
VELOS	Current chassis with blades running F5OS-C; tenants can span blades
VIPRION	Older chassis with blades, often with vCMP
vCMP	Virtualization on iSeries/VIPRION: several BIG-IP guests on one box
BIG-IP VE	Virtual Edition: VMware, KVM, Hyper-V, Nutanix, AWS, Azure, GCP
BIG-IP Next	Discontinued: its last release (20.3.0) reached end of support on April 30, 2025, and F5 continues with TMOS (version 21.x) instead (K000152956). BIG-IP Next for Kubernetes / SPK / CNF continue

• On F5OS platforms there are two layers to manage: the platform (interfaces, LAGs, VLANs, tenants) and the BIG-IP tenant (LTM configuration).
• Production networks usually run the long-term stability release of each major version. Older branches (15.1.x, 16.1.x) have reached or are near end of support, so check the BIG-IP software support policy (K5903) for current dates before choosing a version.

Other BIG-IP modules

BIG-IP DNS (formerly GTM)

• Global server load balancing: answers DNS queries with the IP of the best data center.
• Objects: data centers → servers → virtual servers → pools → wide IPs (the FQDN, e.g. www.company.com).
• Methods: Global Availability (active/standby sites), Round Robin, Ratio, Topology (by client location), Round Trip Time, Least Connections.
• Gets health and load data from LTMs over iQuery (TCP 4353). Also: DNS Express, DNSSEC, DNS firewall.

Advanced WAF / ASM

• Web application firewall with a security policy: attack signatures, file types, URLs, parameters, cookies, HTTP compliance.
• Starts in Transparent mode (log and learn), then moves to Blocking. Tuning false positives is a large part of the job.
• Protects against the OWASP Top 10, bots, L7 DoS, credential stuffing, and APIs (OpenAPI).

APM — Access Policy Manager

• Authentication and access control with the visual policy editor (VPE): logon page → AD/LDAP/RADIUS → MFA → endpoint checks → allow/deny.
• Use cases: SSL VPN (Network Access), web portals, SAML IdP/SP, SSO (Kerberos, NTLM, forms), Zero Trust access, OAuth.

AFM — Advanced Firewall Manager

• Network firewall rules (global, route domain, VS, self IP contexts), DoS/DDoS protection, IP Intelligence.
• AFM must be provisioned to edit the device DoS/DDoS vectors (menu Security → DoS Protection → Device Protection). References: BIG-IP AFM Getting Started and Detecting and Preventing System DoS and DDoS Attacks.

AVR — Application Visibility and Reporting

• Analytics module: provision it (Nominal), create an Analytics profile and attach it to the virtual server.
• Metrics: transactions per second, server latency (BIG-IP ↔ server), page load time (measured in the browser), throughput, response codes, top URLs, clients and members.
• Troubleshooting latency: compare server latency, client RTT and page load time to see whether the delay is in the server, the network or the client.
• Advanced profile filters collect only some URLs, clients or response codes, and can capture matching transactions.
• Custom dashboards and scheduled reports in Statistics → Analytics.

Others

• SSL Orchestrator — decrypts traffic and steers it through security tools (IPS, DLP, sandbox).
• CGNAT / PEM — service provider features.

Beyond BIG-IP

• BIG-IQ — centralized management: configuration, licensing, analytics for many BIG-IPs.
• NGINX (owned by F5) — NGINX Plus (software load balancer / API gateway), NGINX Ingress Controller for Kubernetes, NGINX App Protect (WAF).
• F5 Distributed Cloud (XC) — SaaS platform: WAAP (WAF + bots + API + DDoS), multi-cloud networking, DNS/GSLB from F5’s global PoPs.
• BIG-IP in the cloud — VE in AWS/Azure/GCP. HA uses the Cloud Failover Extension (CFE) to move IPs/routes through the cloud API (no gratuitous ARP in clouds).
• Container Ingress Services (CIS) — watches Kubernetes/OpenShift and configures BIG-IP automatically (with AS3).

Equivalents with other vendors

F5 BIG-IP	Citrix NetScaler	NGINX / HAProxy	AWS
Virtual server	vServer	server {} / frontend	Listener
Pool	Service group	upstream / backend	Target group
Pool member	Service / server	Server line	Target
Health monitor	Monitor	Health check	Health check
SNAT Automap	SNIP	Proxy source	Always proxied
Persistence	Persistence	Sticky / hash	Stickiness
iRule	AppExpert / rewrite policies	Lua / config	Listener rules

Certification path

• F5 Certified BIG-IP Administrator (F5-CA) — exams F5CAB1–F5CAB5.
• F5 Certified Technology Specialist (F5-CTS) — LTM (301a + 301b), DNS, Advanced WAF, APM, and others.
• The program was redesigned recently; check current exams and prerequisites on F5’s certification site.
• After LTM, the most requested next steps are BIG-IP DNS or Advanced WAF, plus AS3/Ansible automation.

Self-check

Q1 — On an rSeries appliance, where does the LTM configuration live?

Respuesta

In the BIG-IP tenant; the platform layer (F5OS-A) handles interfaces, LAGs and tenants.

Q2 — What does a wide IP represent in BIG-IP DNS?

Respuesta

The FQDN being load balanced globally (e.g. www.company.com).

Q3 — In which mode should a new WAF policy start?

Respuesta

Transparent (learning, no blocking), then move to Blocking after tuning.

Q4 — How does BIG-IP VE fail over IPs in AWS or Azure?

Respuesta

With the Cloud Failover Extension, which moves IPs/routes through the cloud API.