Prove F5 — first tool + proof field

1. Why prove beats rebuild

A night ticket is a VIP name plus a panicked paste. The last engineer already asked for failover. Your job is to prove what the pair already decided — listener, member, persist pin, or packet on the wire — before you touch change-control.

Hero · four proof monitors

BIG-IP is a listener that selects a pool member, optionally pins the client, and may rewrite the source. That is why one colour is never enough: the virtual can be available while a cookie still names a down member, and the pool can be green while SYN never arrives on the VLAN.

2. Four tools, four proof fields

Pre-train the vocabulary before the tickets. Each tool answers one question. Mixing them is how interviews fail.

Journey · virtual, pool, persist, capture

3. First-tool decision

Do not start every ticket on persist-records. Do not start on failover. Start from what the user already handed you. The diamond is the first tool. The box under it is the field you paste.

Feel · four paths

4. How to choose

Same VIP, same client, same unit. If you mix hosts, the desk fails. Confirm Active first with tmsh show /sys ha-status. Standby tables can be empty even when the pair is In Sync.

5. Five tickets

Each ticket is first tool, proof field, dummy output, what you say, next tool. Lab output is training-shaped. Confirm live syntax from the cited F5 page before you type on a real pair.

Ltm::Virtual Server: vip_finance_443
  Availability     available
  State            enabled
  Reason           The virtual server is available
  Destination      198.51.100.50:443
  VLAN             external
  Current Conns    41

Ltm::Pool: pool_finance_web
  Availability     available
  State            enabled
  Reason           The pool is available
  Monitor          https
  +-> 10.20.30.11:443
        Availability  available    State enabled    Conn 41
        Reason        Pool member is available
  +-> 10.20.30.12:443
        Availability  offline      State enabled    Conn 0
        Reason        Monitor /Common/https : no successful responses before timeout

Sys::Persist
Mode     Value      Age  Virtual            Node
cookie   8f2a…c1    62   vip_finance_443    10.20.30.12:443

Sys::Connections
10.10.8.22:51901  198.51.100.50:443  10.20.30.12:443  tcp  age 48

# attempt A — packet never arrived
(no packets captured)

# attempt B — arrived, no listener
12:41:08.102 IP 10.10.8.22.51901 > 198.51.100.50.443: Flags [S]
    in slot1/tmm0 lis=

ltm virtual vip_finance_443 {
    source-address-translation { type none }
    persist { cookie { default yes } }
    pool pool_finance_web
}

12:44:01.220 IP 10.10.8.22.51901 > 198.51.100.50.443: Flags [S]
    in slot1/tmm0 lis=/Common/vip_finance_443
12:44:01.221 IP 10.10.8.22.18422 > 10.20.30.11.443: Flags [S]
    out slot1/tmm0
(no SYN-ACK)

6. Runtime path of one HTTPS flow

After go-live, one user packet walks this path. Each hop has a proof field. If you skip a hop, you will “fix” the wrong object.

Proof · ticket close

1. Side A — Confirm the unit and the 5-tuple

   Write client, VIP, port, and VLAN. tmsh show /sys ha-status — Failover State must be active. In Sync is not the same as mirrored connections for every virtual.

2. Side B — First tool from the chooser

   “VIP down” → show virtual. “Some users fail” → show pool. “Member down + half fail” → persist-records. “No SYN” → tcpdump :nnn. “No return” → SAT type then tcpdump :nnnp.

3. Side C — Paste the proof field, then decide change-control

   No named object, no write. Cookie at a down member → wait TTL or approved delete persist-records. Empty lis= → destination / VLAN / unit. SAT none + no SYN-ACK → automap or a SNAT pool. Green virtual + green pool is not a close.

7. Traps and proof

Sources

• tmsh reference — ltm virtual — show virtual [name] displays statistics and status; list virtual displays config; source-address-translation type automap / snat / lsn / none; persist and pool attachments.
• tmsh reference — ltm pool — show pool [name] displays statistics and status; member session vs state; monitor attachment.
• tmsh reference — ltm persistence persist-records — display or delete; filters virtual, client-addr, node-addr, mode.
• tmsh reference — sys connection — show connection cs-client-addr; unfiltered delete removes all connections including mirrored.
• K411: Overview of packet tracing with the tcpdump utility — interface or VLAN; 0.0 is not rate-limited; use filters.
• K6546: Recommended methods and limitations for running tcpdump on a BIG-IP system — 0.0 is not rate-limited like a hardware switch interface.
• K13637: Capturing internal TMM information with tcpdump — :n / :nn / :nnn TMM noise.
• K20233108: Running the tcpdump utility using the p interface modifier — :p with the n modifier follows the peer flow (11.2.0+).
• K000156942: How to verify if cookie persistence is working as expected — persist records plus a capture of the cookie.
• K00463541: A breakdown of the tcpdump utility — index of official capture K articles.

Related: F5 session factory · LTM troubleshooting scenarios · Command ladder cheatsheet · Virtuals and pools · F5 practice dashboard

Every output block is fictional lab data. Confirm live syntax, permissions and privacy rules on the production release before you type anything on a live system.