21 Interview Questions
Questions that come up in F5 / load balancing interviews, with short answers. Interviewers value “how would you troubleshoot…” answers with a clear order of steps more than memorized definitions.
How to practice
Read the question, answer out loud in 30–60 seconds, then open the answer. Practice in English and in Spanish.
Fundamentals
Q1 — What are a virtual server, a pool, a pool member and a node?
Respuesta
VS = listener (IP:port) clients connect to. Pool = group of servers for one service. Member = IP:port inside a pool. Node = the server IP; one node can be a member of several pools.
Q2 — Full proxy vs half proxy?
Respuesta
Full proxy (Standard VS) terminates the client connection and opens a separate server connection → L7 visibility and independent TCP/SSL settings per side. Half proxy (FastL4) forwards packets after connection setup → faster, no L7.
Q3 — What is SNAT and when do you need it?
Respuesta
It replaces the client’s source IP with a BIG-IP IP so replies come back through BIG-IP. Needed when servers’ gateway isn’t BIG-IP, in one-arm designs and VS-to-VS. Downside: servers lose the client IP → X-Forwarded-For for HTTP.
Q4 — SNAT Automap vs SNAT pool?
Respuesta
Automap uses BIG-IP self IPs (floating first). A SNAT pool uses dedicated IPs — needed beyond ~64K concurrent connections to the same member (port exhaustion) or to control which IPs servers see.
Q5 — Cookie insert or source address persistence?
Respuesta
Cookie insert for HTTP: works behind NAT/proxies, no records on BIG-IP, survives failover without mirroring. Source address for non-HTTP; beware of many users behind one IP all landing on one server.
Q6 — Monitor on a node vs on a pool?
Respuesta
A node monitor marks the server down in every pool. A pool/member monitor checks the specific service. Best practice: an application-level monitor on the pool.
Q7 — Disabled vs Forced Offline?
Respuesta
Disabled keeps active and persistent connections, no new clients. Forced Offline only lets active connections finish; nothing new, not even persistent clients.
Q8 — Which load balancing methods would you use and why?
Respuesta
Round Robin for equal servers; Ratio for known capacities; Least Connections for long connections; Observed/Predictive for very different servers; Fastest for members in different locations; Least Sessions with persistence.
Q9 — What is Priority Group Activation?
Respuesta
Backup servers inside the same pool. The highest priority group gets traffic; when available members drop below N, the next group is activated. Needs monitors.
SSL/TLS
Q10 — Offloading vs bridging vs pass-through?
Respuesta
Offloading: decrypt on BIG-IP, HTTP to servers. Bridging: decrypt and re-encrypt (L7 + end-to-end encryption). Pass-through: no decryption, L4 only.
Q11 — The certificate is "not trusted" only on some phones. Why?
Respuesta
The intermediate chain is missing in the Client SSL profile. Check with
openssl s_client -showcerts.
Q12 — How do you renew a certificate without downtime?
Respuesta
Import the new cert with a new name, update the Client SSL key chain, verify, keep the old one until confirmed, sync HA.
Q13 — How do you host many HTTPS sites on one VIP?
Respuesta
SNI: several Client SSL profiles on the VS, each with its server name and certificate, one as SNI default. Or a SAN/wildcard certificate.
High availability
Q14 — Device trust, device group and traffic group?
Respuesta
Trust = certificate-based peering. Device group = devices that sync config (Sync-Failover or Sync-Only). Traffic group = floating objects that fail over together.
Q15 — What is synced and what isn't?
Respuesta
Synced: VSs, pools, profiles, monitors, iRules, floating self IPs. Not synced: hostname, management IP, non-floating self IPs, interfaces, license, provisioning.
Q16 — What causes a failover and how do you find the reason?
Respuesta
Admin action, heartbeat loss, TMM/daemon failure, VLAN or gateway fail-safe, HA group score, hardware. Look at
/var/log/ltmaround the time,tmsh show sys ha-status,tmsh show cm traffic-group, performance graphs.
Q17 — Should connection mirroring always be on?
Respuesta
No. It costs CPU and bandwidth; use it for long-lived sessions (FTP, SSH, DB, VPN).
Q18 — Why MAC masquerading?
Respuesta
The floating IP keeps the same MAC after failover, so neighbors don’t need ARP updates → faster failover.
Troubleshooting
Q19 — "The application is down." What do you do?
Respuesta
Scope → VS status and counters → members and monitor logs → client side (DNS, firewall, certificate) → server side (reachability, return path/SNAT) → iRules/persistence → resources and limits → capture both sides → escalate with QKview and captures.
Q20 — The VS is green but users get resets.
Respuesta
tmsh show /net rst-cause,/var/log/ltm, iRules that reject/drop, SSL handshake failures, wrong profile combination (HTTP iRule without HTTP profile).
Q21 — Ping to the VIP works but the site doesn't.
Respuesta
ICMP is answered by the virtual address. Check the port, pool status, SSL, and whether replies return through BIG-IP (SNAT or gateway).
Q22 — How do you capture one client's traffic on both sides?
Respuesta
tcpdump -ni 0.0:nnnp -s0 -w /var/tmp/case.pcap host <client_ip>— thepadds the server-side flow.
Q23 — Members flap up and down.
Respuesta
Monitor too aggressive, server overloaded, receive string too strict, packet loss. Check
/var/log/ltmand timers (timeout = 3×interval+1).
Q24 — Users lose their session randomly.
Respuesta
Persistence missing or expiring, cookie blocked, failover without mirroring, a member going down.
Q25 — An upgrade went wrong. What now?
Respuesta
Boot the previous volume, restore the UCS if needed, open a case with a QKview. That’s why you upgrade the standby first and keep off-box backups.
iRules, design and automation
Q26 — iRule or LTM policy?
Respuesta
Policy for standard routing, redirects and headers (faster, easier). iRule for custom logic, data manipulation, logging, iSNAT, custom persistence.
Q27 — One-arm vs two-arm vs nPath?
Respuesta
One-arm: same VLAN, needs SNAT. Two-arm: separate VLANs, BIG-IP as gateway or SNAT. nPath: responses bypass BIG-IP → high throughput, no L7.
Q28 — What is a route domain?
Respuesta
A separate routing table, like a VRF, allowing overlapping IPs (
10.1.1.1%2).
Q29 — What do BIG-IP DNS, Advanced WAF and APM do?
Respuesta
DNS: global load balancing between data centers (wide IPs). WAF: application security policies against OWASP Top 10. APM: authentication, SSL VPN, SSO, MFA.
Q30 — What is AS3 and why do companies use it?
Respuesta
Declarative JSON describing applications: idempotent, stored in Git, works with CI/CD, Ansible and Terraform, fewer manual errors.
Q31 — How do you harden a BIG-IP?
Respuesta
Isolated management with allowed IPs, Port Lockdown Allow None on external self IPs, remote auth with roles, password policy, SNMPv3, remote syslog, NTP, secure SSL profiles, patching security advisories, off-box encrypted UCS.
Q32 — Tell me about your F5 experience.
Respuesta
Certifications + what you built in the lab (HA pair, SSL offload, iRules, AS3) + how it connects with Cisco/Palo Alto (routing, firewalls, troubleshooting) + one concrete problem you solved.
Design scenarios
S1 — New app: HTTPS, cookie persistence, client IP needed in the server logs. Design the VS.
Respuesta
Standard VS 443 with TCP + HTTP + Client SSL, pool with a content monitor, cookie insert, SNAT Automap, X-Forwarded-For in the HTTP profile, a port 80 VS redirecting to HTTPS, listening only on external.
S2 — Servers must be patched one by one without dropping users.
Respuesta
Disable (or Force Offline) each member, wait for zero connections, patch, check the monitor, re-enable. Or use a receive-disable string so the app team can drain servers.
S3 — Two merged companies both use 10.0.0.0/8 and must share one BIG-IP.
Respuesta
Partitions + route domains per company.