BIG-IP Administration Data Plane Concepts (F5CAB2)

Cookie persistence identifies the selected member through information carried in an HTTP cookie, so it does not depend on the client's source IP remaining constant. That allows the persistence relationship to survive an IP address change. End-to-end encryption can prevent HTTP inspection, and cookie handling does not guarantee a file-system write.

Forced Offline removes the appliance from traffic service for maintenance and prevents it from becoming active. Unlike a state intended to drain or preserve established application flows, this state terminates existing virtual-server connections. It therefore provides both required effects: clearing current traffic and keeping the unit out of the active role.

Port lockdown governs services addressed directly to the self IP, such as management or other locally hosted services. The client instead targets a different destination owned by the virtual server. That traffic can still match the virtual server on TCP 443 because restricting direct self-IP services does not disable virtual-server matching.

VLAN classification follows the tagging mode of the trunk's memberships. An incoming frame without a VLAN tag belongs to the VLAN configured as untagged on that trunk, which is the native VLAN here. The app VLAN membership expects tag 100, so an untagged frame is not classified into the app VLAN merely because both memberships share the trunk.

A Reject virtual server can be defined for the individual IP that must not receive responses. Its more specific destination match handles that address instead of the broader subnet virtual server, and rejection actively refuses matching traffic. A Standard virtual server would process the flow normally rather than enforce the required refusal.

The Self IP gives BIG-IP a Layer 3 address on the new VLAN, but the VLAN still needs a Layer 2 attachment to the network. Assigning a physical interface to the new VLAN supplies that path to the switch and servers. Port Lockdown controls services accepted at the Self IP; it does not create missing VLAN connectivity.

Persistence mirroring transfers persistence records to the standby unit so that a failover does not erase the session-to-member mapping. Match Across Services extends that mapping across different services, allowing the HTTP and FTP flows in the same session to remain associated with the same pool member after the peer becomes active.

The requirement is accelerated Layer 4 processing without HTTP optimization. A Performance (Layer 4) virtual server with the fastL4 protocol profile handles traffic at the transport layer and fits that performance goal. A Performance (HTTP) server would introduce HTTP-specific processing that the application does not require.

Each object has a distinct role in the flow. The virtual server provides the listener that accepts matching client traffic, attached profiles handle the required protocol processing, and the pool supplies the service endpoints from which an eligible member can be chosen. Profiles do not select nodes, and pools do not define the client listener.

The BIG-IP system terminates the client-side TCP handshake and establishes a separate TCP connection to the node. This full-proxy behavior creates independent client-side and server-side connection state, which is characteristic of a Standard virtual server. A forwarding or stateless virtual server would not perform the two distinct proxied handshakes depicted here.