F5 · LTM · Module 5 · Interactive lesson

F5 LTM Module 5 monitors, iRules & policies

ICMP is not application health. HTTP monitors need Host and a recv string. Use LTM Policies before iRules. HTTP_REQUEST never fires without an HTTP profile.

20 min read · L2 primary · Quiz at end

After this page you can

Write an HTTP monitor that fails when /health is wrong.
Know node vs member vs pool monitor scope.
Name CLIENT_ACCEPTED, HTTP_REQUEST, LB_SELECTED.
Default to an LTM Policy for Host-based pool select.

Lessons · F5 LTM series · Module 5

F5 LTM recorded course · 7 modules

Same lab numbers on every page: client 198.51.100.50, VIP 192.0.2.100, Self IPs 192.0.2.10 / 10.20.20.10, members 10.20.20.101–103.

Hub · Course map
M1 · Fundamentals & admin
M2 · Networking & traffic flow
M3 · Virtual Servers & pools
M4 · Profiles, SNAT, SSL
M5 · Monitors, iRules, policies ← you are here
M6 · High availability
M7 · Troubleshooting

Next → M6 · High availability

Recorded course + workbooks: My Courses · syllabus F5 LTM / GTM / ASM

Green pool, broken app

ICMP replies. TCP 443 is open. HTTP is 500. A TCP monitor still paints the member green. That is the Module 5 lesson: monitor the thing the user needs, then use LTM Policies before iRules for simple L7 steering.

Health probe hitting three servers, one failing — The probe is TMM-generated. It is not a client request. It still needs the Host header the vhost expects.

Quick answer

Use an HTTP/HTTPS monitor with a real GET, a Host header, and a recv string. Prefer an LTM Policy for host/URI routing. Write an iRule when you need events the policy cannot express. Never log cookies or passwords in iRules.

Monitor scope and iRule events

Flow 1 · probe lifecycle

Timeout is usually 3× interval + 1 (interval 5 → timeout 16). Mark down only after failed probes, not after one blip.

Scope	Checks	Misses
Node monitor	Host (often ICMP)	Service port / app
Member monitor	That IP:port	Other ports on the same node
Pool monitor	All members the same way	Special snowflake members — override per member
Gateway ICMP	Path to a gateway	Any application

Say this out loud

HTTP_REQUEST only fires if an HTTP profile is on the VS. CLIENTSSL_HANDSHAKE only fires if Client SSL is attached. Events are not a continuous script.

Policy vs iRule

Need	Use	Why
If Host is app.example.com → pool X	LTM Policy	Draft → publish; readable; fast
HTTP→HTTPS redirect	iRule or policy redirect	Common iRule; still keep it tiny
Header inject / strip XFF safely	iRule	Replace client-supplied XFF; do not trust it
Complex Tcl branching	iRule	Last resort — every line is a future outage

HTTP request, match host, redirect or pool, response — Policies are draft then published. Only published policies attach to a Virtual Server.

Runbook — HTTP monitor then a tiny iRule

Side A · monitor

https://192.168.100.10/tmui/Control/jspmap/tmui/locallb/monitor/create

Training mock · not live

Local Traffic > Monitors > Create

New HTTP Monitor

Name

mon_web_health

Type / Parent

HTTP / http

Interval / Timeout

5 / 16

Send String

GET /health HTTP/1.1 | Host: app.example.com | Connection: close | blank line

Receive String

APP_STATUS=READY

Incomplete Send (missing Host or final blank line) is the classic false-down. Source: Module 5 PDF.

TMSH · HTTP monitor

tmsh create ltm monitor http mon_web_health defaults-from http interval 5 timeout 16 \
  send "GET /health HTTP/1.1\r\nHost: app.example.com\r\nConnection: close\r\n\r\n" \
  recv "APP_STATUS=READY"
tmsh modify ltm pool WEB_POOL monitor mon_web_health
tmsh show ltm pool WEB_POOL detail

Side B · iRule (only if policy cannot)

https://192.168.100.10/tmui/Control/jspmap/tmui/locallb/rule/create

Training mock · not live

Local Traffic > iRules > iRule List > Create

New iRule

Name

rule_host_pool

Event

HTTP_REQUEST

Definition

when HTTP_REQUEST / if HTTP::host eq app.example.com / pool APP_POOL

Attach the iRule on the Virtual Server Resources tab. HTTP profile required.

Tiny iRule — Module 5 PDF

when HTTP_REQUEST {
  if { [HTTP::host] eq "app.example.com" } {
    pool APP_POOL
  }
}

Events cheat-sheet: CLIENT_ACCEPTED (TCP accepted), CLIENTSSL_HANDSHAKE (TLS done, SNI available), HTTP_REQUEST (headers parsed), LB_SELECTED (member chosen), SERVER_CONNECTED (server TCP up).

Side C · prove the monitor, not the ping

Break the recv string in lab
Member goes down in tmsh show ltm pool WEB_POOL detail.
Restore it
Member returns; Slow Ramp (Module 3) should protect it.
tcpdump the probe
You will see BIG-IP's Self IP as source — not the client.

Health-monitor results and event traces — If the monitor source cannot route to the member, every member goes down together — that is a network problem, not an app problem.

Runtime

Flow 2 · client vs probe

Probes keep using the server-side path even when no user is connected.

Traps + proof

Failure	Symptom	Fix
ICMP/TCP monitor only	Green pool, HTTP 500	HTTP recv string
Missing Host	All members down on vhosts	Send String includes Host
Gateway ICMP as app health	Path up, app dead	Never substitute
iRule without HTTP profile	Nothing fires	Attach http + (for HTTPS) Client SSL
Log HTTP cookies or tokens	Secret in /var/log/ltm	Log host/URI only

You are done with Module 5 when

A wrong recv string marks the member down.
You can name four iRule events and when they fire.
You default to an LTM Policy for simple host routing.

Sources

Techclick PDF: F5-BIG-IP-LTM-Module-5.pdf (from OneDrive_1_8-26-2026.zip, 26 Aug 2026)
Companion deck: F5-Ltm-Training-Ppt (1).pptx.pdf
LTM policy TMSH: ltm policy
Official lab paths: F5 cert Lab 1 — VLANs, Self IPs, pools, virtual servers
TMSH virtual server reference: ltm virtual
Related deep dives on this site: SSL modes · SNAT · Persistence · VS/pools · VIP down / tcpdump

Related: Course hub · Syllabus · My Courses · F5 LTM interview