F5CAB3 F5 BIG-IP Administration Data Plane Configuration (F5CAB3) exam Free Practice Exam Questions (2026 Updated)

With manual resume enabled, BIG-IP does not automatically return a pool member to service after recovery. The member remains offline until manually re-enabled.

Comprehensive and Detailed Explanation From BIG-IP Administration Data Plane Configuration/Course Guide/topics:

The monitor is explicitly sending an HTTP/1.1 request. For HTTP/1.1, the request must contain a valid Host header identifying the intended virtual host. The configured monitor sends the URI and Connection: Close header but omits Host: www.f5.com. A web server using name-based virtual hosting can therefore reject the request with HTTP 400 Bad Request , which explains why every pool member is marked down.

F5 ' s official BIG-IP monitor documentation gives the HTTP/1.1 convention in the form " GET / HTTP/1.1\r\nHost: server.com\r\nConnection: close\r\n\r\n " .

Option A follows that required structure: the request line identifies HTTP/1.1, Host: www.f5.com selects the correct hosted site, Connection: Close requests connection termination after the response, and the final \r\n\r\n properly terminates the HTTP header section. F5 also specifies that when HTTP/1.0 or HTTP/1.1 is used, the monitor evaluates the HTTP status code; a non-200 response such as 400 causes the monitored resource to be considered unavailable.

Reference Topics: BIG-IP LTM Monitors Reference → HTTP Monitor Send String , HTTP/1.1 request formatting , pool-member health monitoring .

The issue described is a classic symptom of asymmetric routing, which frequently occurs when the BIG-IP system and the back-end servers reside on the same subnet (often referred to as a " one-arm " deployment).

The Routing Problem: By default, the BIG-IP system preserves the original client source IP address when forwarding traffic to a pool member. If the server is in the same subnet as the client or if the server ' s default gateway is not the BIG-IP, the server will attempt to send its response directly back to the client’s IP address, bypassing the BIG-IP.

Stateful Failure: Since the BIG-IP is a Full Proxy, it maintains a state table. Because the response packet never returns through the BIG-IP, the system cannot complete the three-way handshake or manage the application session, resulting in a connection failure for the user.

The Solution (SNAT): Enabling Source Network Address Translation (SNAT) solves this by changing the source IP address of the request to an IP address owned by the BIG-IP (typically a self-IP).

Requirement for Subnet Alignment: To ensure the server sends the response back to the BIG-IP, the translation address must be reachable. By using a self-IP configured in the same subnet as the servers, the BIG-IP ensures that the server sees the request coming from a local " neighbor. " The server will then naturally send the response back to that self-IP, allowing the BIG-IP to translate the packet back and forward it to the client.

Why other options are incorrect:

A: Disabling address translation would ensure the server-side traffic uses the client IP, making asymmetric routing inevitable in this scenario.

B: This is technically contradictory; " Auto Map " specifically uses existing self-IPs and does not require or use a " SNAT pool " configuration.

C: While using a specific translation address can work, it does not inherently guarantee the Layer 2/Layer 3 reachability mentioned in the scenario as effectively as ensuring the self-IP is correctly placed in the server ' s subnet.

In F5 BIG-IP administration, iApps are designed to manage complex application configurations as a single unit. When an iApp is deployed, it creates an " Application Service " object that owns all the associated LTM objects, such as Virtual Servers, Pools, and Nodes. By default, these iApps are created with Strict Updates enabled. Strict Updates is a safety mechanism that prevents administrators from making manual " out-of-band " changes to the individual objects created by the iApp. The system enforces this because manual changes would be overwritten the next time the iApp template is updated or re-entered.

When the administrator attempts to change the destination IP address directly on the Virtual Server object, the BIG-IP system checks the " Strict Updates " flag. If it is set to " Enabled, " the system blocks the modification and generates the error message stating the service must be updated via the application management interface. To resolve this, the administrator must navigate to the iApp > > Application Services menu, select the specific application service, and go to the " Reconfigure " tab. Within the iApp configuration form, the destination IP can be safely changed. Alternatively, if the administrator specifically wants to manage the objects manually and forgo the benefits of the iApp template management, they could disable " Strict Updates " in the iApp properties, though this is generally discouraged as it breaks the template ' s logic. The error is not related to subnetting or duplicate IPs, but strictly to the configuration authority assigned to the iApp service.