BIG-IP LTM Specialist: Maintain and Troubleshoot

7 Sub-Modules | 25 Lessons

• Profile setting modifications from a scenario (TCP and UDP profiles for buffer issues, packet loss or congestion, when compression or Web Acceleration helps)

• Simplifying a configuration by removing or consolidating objects (which iRules can become a profile or policy, when host virtual servers should be a network virtual server)

• Using device statistics to find what to remove (redundant objects, unnecessary monitoring, the effect of removing a function)

• Upgrade and recovery steps to restore functionality (clean install methods, TMSH sys software install, licence renewal, upgrade path validation, copying config to a boot location, rollback)

• Upgrading with minimal application outage (GUI upgrades, device groups and traffic groups, high availability groups)

• The benefits of custom alerting (specifying OIDs, local traffic log levels, triggering alerts for testing)

• Setting up custom alerting (SNMP, email and Remote Syslog, alert configuration file locations, available logging levels)

15 Sub-Modules | 41 Lessons

• Choosing the right iRule for an application issue (which events and commands to use, what is available within a given event)

• Reading a simple iRule and its logs (identifying the rule and event from log output, the results of iRule errors)

• Predicting the effect of an iRule on live traffic (traffic steering and application data)

• AVR for performance issues and application attacks (modifying profiles from AVR data, advanced filters, latency increases)

• AVR for device misconfiguration (tracing application traffic, latency trends that expose tier bottlenecks)

• Root cause from headers and traces (response codes, Cookies, Cache Control, Vary, Content Type and Host, HTTP methods, decoding POST data)

• Solutions from headers and traces (a specific response code, SSL handshake failure, predicting browser caching behaviour)

• Comparing a direct trace against a trace through the device to find root cause

• Comparing traces to determine the solution, including SSL handshake failures

• Choosing the protocol analyser and its options (following a conversation across client and server side, how SNAT and OneConnect affect traces, decrypting SSL, recognising drops, RSTs, retransmits, ICMP errors and CMP demotion)

• Root cause from a tcpdump and supporting documentation

• The solution from a tcpdump and supporting documentation

• Deciding where the capture should be taken (Wireshark, tcpdump, ssldump, and what each vantage point shows)

• Identifying monitor issues from a trace (capturing and interpreting monitor traffic, obtaining the input and output needed to build one)

• Solving a monitor issue (monitor choice and timing against application and server limits, modifying settings to resolve it)

5 Sub-Modules | 20 Lessons

• Interpreting log messages and command line output (qkview heuristic results, NTP troubleshooting, licence problems in the logs)

• Choosing the right command to find the cause (hardware problems, resource exhaustion, connectivity problems, and which log file to examine)

• Analysing performance data to identify a resource problem

• Determining the cause of a failover (network failover settings, serial versus network failover, unicast versus multicast, identifying the cause from logs and statistics)

• Determining the cause of lost high availability or sync failure (device trust and device groups, config sync failures, traffic groups and their objects, log interpretation)

Yes. 301b completes F5 Certified Technology Specialist, BIG-IP LTM (F5-CTS, LTM). 301a on its own earns nothing. Passing this one is the point at which you hold the certification.

To sit the exam, yes. You need F5-CA and a 301a pass before F5 will let you book 301b. To take this course, no. Nothing stops you studying both halves together, and many engineers do, because the diagnostic reasoning here makes the design decisions in 301a easier to understand.

More than any other exam in the track. 301b assumes you have sat in front of a broken application and had to explain why. It expects you to read a tcpdump, recognise an SSL handshake failure, and know what SNAT and OneConnect do to a trace. The course teaches that reasoning explicitly rather than assuming you already have the scar tissue, but it is not a beginner course.

Yes, and this exam demands them. The course works through packet captures, header traces, iRule logs, AVR output and device statistics in both the GUI and TMSH. 301b presents you with evidence and asks what it means, so the demonstrations focus on the reasoning that gets from symptom to cause rather than the click path.

With F5-CTS, BIG-IP LTM held, the specialist track opens up: 302 (DNS), 303 (ASM) or 304 (APM), depending on where your work sits. LTM is also the prerequisite for both the Cloud and Security Solutions Expert tracks, so this is the certification that unlocks the 401 level.