F5CAB3 Exam Dumps - F5-CA Questions and Answers

Question # 14

A Standard Virtual Server for a web application is configured with SNAT Automap. The original client IP must be known by backend servers.

What should the BIG-IP Administrator configure?

Options:

Performance (HTTP) Virtual Server

HTTP profile with X-Forwarded-For

HTTP Transparent profile

SNAT pool using client IP

Buy Now

Question # 15

A BIG-IP Administrator configures an SSH pool with five members.

Which health monitor should be applied?

Options:

HTTPS

UDP

HTTP

TCP

Buy Now

Question # 16

A BIG-IP Administrator creates a new Virtual Server. The end user is unable to access the page. During troubleshooting, the administrator learns that the connection between the BIG-IP system and server is NOT set up correctly. What should the administrator do to solve this issue? (Choose one answer)

Options:

Disable Address Translation

Set Address Translation to Auto Map, configure a SNAT pool, and have pool members in the same subnet as the servers

Set Address Translation to SNAT and configure a specific translation address

Set Address Translation to SNAT and have a self-IP configured in the same subnet as the servers

Buy Now

Answer:

Explanation:

The issue described is a classic symptom of asymmetric routing, which frequently occurs when the BIG-IP system and the back-end servers reside on the same subnet (often referred to as a "one-arm" deployment).

The Routing Problem: By default, the BIG-IP system preserves the original client source IP address when forwarding traffic to a pool member. If the server is in the same subnet as the client or if the server's default gateway is not the BIG-IP, the server will attempt to send its response directly back to the client’s IP address, bypassing the BIG-IP.

Stateful Failure: Since the BIG-IP is a Full Proxy, it maintains a state table. Because the response packet never returns through the BIG-IP, the system cannot complete the three-way handshake or manage the application session, resulting in a connection failure for the user.

The Solution (SNAT): Enabling Source Network Address Translation (SNAT) solves this by changing the source IP address of the request to an IP address owned by the BIG-IP (typically a self-IP).

Requirement for Subnet Alignment: To ensure the server sends the response back to the BIG-IP, the translation address must be reachable. By using a self-IP configured in the same subnet as the servers, the BIG-IP ensures that the server sees the request coming from a local "neighbor." The server will then naturally send the response back to that self-IP, allowing the BIG-IP to translate the packet back and forward it to the client.

Why other options are incorrect:

A: Disabling address translation would ensure the server-side traffic uses the client IP, making asymmetric routing inevitable in this scenario.

B: This is technically contradictory; "Auto Map" specifically uses existing self-IPs and does not require or use a "SNAT pool" configuration.

C: While using a specific translation address can work, it does not inherently guarantee the Layer 2/Layer 3 reachability mentioned in the scenario as effectively as ensuring the self-IP is correctly placed in the server's subnet.