# F5 LTM Module 4 profiles, SNAT & SSL Source: https://ai.techclick.in/blog_f5_ltm_module_4_profiles_snat_ssl Markdown: https://ai.techclick.in/blog_f5_ltm_module_4_profiles_snat_ssl.md Publisher: Techclick Infosec Pvt Ltd Choose TCP/HTTP profiles, SNAT Automap vs No-SNAT vs SNAT pool, cookie vs source persistence, and SSL offload vs re-encrypt vs passthrough. Lessons · F5 LTM series · Module 4 F5 LTM recorded course · 7 modules Same lab numbers on every page: client 198.51.100.50 , VIP 192.0.2.100 , Self IPs 192.0.2.10 / 10.20.20.10 , members 10.20.20.101–103 . - Hub · Course map - M1 · Fundamentals & admin - M2 · Networking & traffic flow - M3 · Virtual Servers & pools - M4 · Profiles, SNAT, SSL ← you are here - M5 · Monitors, iRules, policies - M6 · High availability - M7 · Troubleshooting Next → M5 · Monitors, iRules, policies Recorded course + workbooks: My Courses · syllabus F5 LTM / GTM / ASM ## The Virtual Server matched. Now what? Module 3 intercepts traffic. Module 4 decides how each side of the full proxy behaves: TCP, HTTP, SNAT, persistence, TLS. Ticket: “Cookie persistence does nothing.” The VS is FastL4 or SSL passthrough — BIG-IP never saw HTTP. Hero · two TLS legs Client SSL = BIG-IP is the TLS server to the user. Server SSL = BIG-IP is the TLS client to the pool. Offload uses only the first. Quick answer Offload : Client SSL only, HTTP to the pool. Re-encrypt / bridge : Client SSL + Server SSL. Passthrough : no HTTP profile, no cookie persist, no HTTP iRules. SNAT Automap rewrites the server-side source to a Self IP so the return path cannot skip BIG-IP. ## Full proxy = two stacks Flow 1 · client side vs server side Flow 1 · client side vs server side - Client TCP + ClientSSL HTTP needs decrypt SNAT return path Server TCP + ServerSSL? Profiles attach per side. tcp-wan-optimized toward clients, tcp-lan-optimized toward servers is the usual starting pair. Say this out loud An HTTP profile does not decrypt TLS. Client SSL must terminate first. Attaching Server SSL on an offload design will break the backend HTTP port. ## SNAT and SSL — pick on purpose SNAT Backend sees When No-SNAT Real client IP Servers default-gateway through BIG-IP (or policy route back) Automap Self IP on egress VLAN Default when you cannot control server routing SNAT Pool Addresses you listed Need many ephemeral ports / dedicated NAT range SSL mode Profiles HTTP / cookie persist Offload Client SSL Yes — HTTP to pool Re-encrypt Client SSL + Server SSL Yes — still decrypted on BIG-IP Passthrough none of those No — TMM never sees HTTP Deeper SSL lesson: Offload vs re-encrypt vs passthrough . Deeper SNAT: SNAT concept and issues . Persistence: cookie vs source address . Journey · SNAT Automap Without SNAT, a server whose default gateway is the core switch replies past BIG-IP. The client TCP session on TMM never completes. ## Runbook — HTTPS offload with Automap ### Side A · profiles #### TCP pair Client side: tcp-wan-optimized. Server side: tcp-lan-optimized. Custom profiles inherit a parent — change one knob, not a clone of everything. - #### HTTP profile Required for cookie persistence, X-Forwarded-For, HTTP iRules, redirects. - #### Client SSL profile Local Traffic > Profiles > SSL > Client. Cert/key for the VIP hostname. SNI if multiple certs on one IP. https://192.168.100.10/tmui/Control/jspmap/tmui/locallb/profile/clientssl/create Training mock · not live Local Traffic > Profiles > SSL > Client > Create ### New Client SSL Profile Name clientssl_www Parent Profile clientssl Certificate / Key www.example.com.crt / .key SNAT later on VS Auto Map Cancel Finished Never export private keys casually. UCS files contain keys — treat backups as secret. ### Side B · Virtual Server attachments https://192.168.100.10/tmui/Control/jspmap/tmui/locallb/virtual_server/create Training mock · not live Local Traffic > Virtual Servers > vs_web_https ### HTTPS Virtual Server resources HTTP Profile http SSL Profile (Client) clientssl_www SSL Profile (Server) None — this is offload Source Address Translation Auto Map Default Persistence cookie (needs HTTP + Client SSL) Cancel Finished If you need TLS to the pool, add a Server SSL profile (bridge). Do not add it 'just in case'. ### Side C · persistence + proof Method Needs Weakness Cookie HTTP + (usually) Client SSL Fails on passthrough / FastL4 Source address L4 is enough NAT/CGNAT makes a whole office one persistence record SSL session Client SSL Not a substitute for HTTP cookie on apps that need URI affinity Proof curl -vk https://www.example.com/ --resolve www.example.com:443:192.0.2.100 tmsh show ltm profile client-ssl clientssl_www tmsh show ltm persistence persist-records # offload: server-side capture is HTTP, not TLS Ops · TLS handshake Handshake fail = cert name, SNI, or cipher — not 'pool down' until tcpdump says so. ## Runtime Flow 2 · offload packet Flow 2 · offload packet - TLS in Client SSL HTTP profile + persist SNAT Self IP HTTP out pool member OneConnect reuses server-side TCP. Do not enable it on apps that assume one client per server connection (legacy NTLM without the NTLM profile). ## Traps + proof Failure Symptom Fix Server SSL on offload Backend HTTP port gets TLS Remove Server SSL Cookie persist + passthrough User bounces servers Terminate TLS or use source-addr No-SNAT, wrong gw SYN out, no SYN-ACK Automap or fix server gateway F5 browser refresh as LB test Always one member New TCP each time UCS emailed Private keys leaked Off-box backup with access control You are done with Module 4 when You can choose offload vs re-encrypt vs passthrough for a given app. - You can explain why Automap exists without saying “NAT is faster.” - curl -vk shows the cert you installed, not a default dummy. ## Knowledge check SSL and SNAT judgment — these are interview gold. Q1 SSL offload requires: Server SSL only Client SSL; HTTP to the pool Passthrough + cookie persist Allow All Correct: b . Do not attach Server SSL 'just in case'. Q2 Cookie persistence on passthrough: Works Does not — HTTP is not visible Requires ICMP monitor Is Port Lockdown Correct: b . Need terminate or use source-addr. Q3 Servers default-gateway past BIG-IP. You likely need: No-SNAT SNAT Automap or SNAT pool Disable TMM UCS restore Correct: b . Force return to the Self IP. Q4 HTTP profile without Client SSL on :443: Decrypts TLS Cannot see HTTP inside TLS Enables Automap Sets NTP Correct: b . Terminate first. Q5 Source-address persistence behind CGNAT is weak because: It needs Server SSL Thousands of users share one IP It disables monitors It tagged the VLAN Correct: b . Use cookie when you can see HTTP. Q6 Valid offload proof includes: Browser refresh only curl -vk plus server-side HTTP (not TLS) capture Deleting the pool Provisioning APM Correct: b . Traps table. Check answers Reset ## Sources - Techclick PDF: F5-BIG-IP-LTM-Module-4.pdf (from OneDrive_1_8-26-2026.zip, 26 Aug 2026) - Companion deck: F5-Ltm-Training-Ppt (1).pptx.pdf - Official lab paths: F5 cert Lab 1 — VLANs, Self IPs, pools, virtual servers - TMSH virtual server reference: ltm virtual - Related deep dives on this site: SSL modes · SNAT · Persistence · VS/pools · VIP down / tcpdump Related: Course hub · Syllabus · My Courses · F5 LTM interview --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt