T Techclick ← All lessons
F5 · LTM · Module 7 · Interactive lesson

F5 LTM Module 7 troubleshooting without guessing

Write the problem statement. Walk DNS → SYN on-box → VS match → pool → server-side SYN-ACK. Asymmetric routing is the silent killer. Do not change config first.

18 min read · L2 primary · Quiz at end

After this page you can

Lessons · F5 LTM series · Module 7

F5 LTM recorded course · 7 modules

Same lab numbers on every page: client 198.51.100.50, VIP 192.0.2.100, Self IPs 192.0.2.10 / 10.20.20.10, members 10.20.20.101–103.

  1. Hub · Course map
  2. M1 · Fundamentals & admin
  3. M2 · Networking & traffic flow
  4. M3 · Virtual Servers & pools
  5. M4 · Profiles, SNAT, SSL
  6. M5 · Monitors, iRules, policies
  7. M6 · High availability
  8. M7 · Troubleshooting ← you are here

Recorded course + workbooks: My Courses · syllabus F5 LTM / GTM / ASM

Do not start by changing configuration

Module 7 PDF opens with discipline: every change made without evidence risks a second outage. Convert “F5 is dropping traffic” into “Client SYN arrives on external VLAN, but no server-side SYN is observed.” That sentence already names the layer.

Hero · last known good
Vertical ladder DNS, VIP, Pool, Backend
Stop at the first layer without packet evidence. Skipping layers diagnoses the wrong component.
Quick answer

Write a problem statement (source, VIP, port, time, expected vs actual, last change). Then walk DNS → packet at BIG-IP → VS match → profiles/SNAT/iRule → pool/monitor → server-side capture. Asymmetric return path is the silent classic — SNAT Automap or fix the server gateway.

Problem statement before the terminal

FieldExampleWhy
Source IP198.51.100.50Which client to tcpdump
FQDN / VIPwww.example.com / 192.0.2.100DNS vs listener
Port / proto443 / TCPVS match
Time + TZ2026-08-26 10:30 ISTLogs
Expected / actualLogin page / timeoutTimeout vs RST vs HTTP 502
Last changeCert, iRule, firewallProbable cause
Flow 1 · master ladder
DNSright IP?On-boxSYN seen?VS matchlist vsPoolmonitorServerSYN-ACK

Ask at each box: do I have packet proof this layer works?

Say this out loud

Never say “F5 reset the connection” without a capture that shows BIG-IP as the RST source. Upstream firewalls RST too.

Which tool at which layer

LayerCommand / toolPass looks like
DNSdig / nslookup from the clientA record = VIP
Listenertmsh show/list ltm virtualEnabled, correct destination:port, stats increment
Pooltmsh show ltm pool X membersAt least one up; not all disabled
Route/ARPtmsh show net route / arpPath to member MAC
Packetstcpdump -nni 0.0 host …SYN both directions or a precise hole
TLScurl -vk ; client-ssl statsCert name + finished handshake
Journey · packet path
Client through VLANs to the load-balancer engine
If the SYN never hits 0.0, the problem is upstream of BIG-IP. Stop blaming the pool.

Runbook — first 15 minutes of an incident

Side A · facts, no changes

  1. Fill the problem statement table

    Who, VIP, port, when, last change.

  2. DNS from the failing client

    Wrong IP means you will tune the wrong VS forever.

  3. List the VS

    tmsh list ltm virtual vs_web_https destination, VLANs, pool, profiles, SNAT, rules.

TMSH · Module 7 kit
tmsh show ltm virtual
tmsh list ltm virtual vs_web_https
tmsh show ltm pool WEB_POOL
tmsh show ltm pool WEB_POOL members
tmsh show ltm node 10.20.20.101
tmsh show net route
tmsh show net arp
tmsh show sys connection

Side B · two-sided capture

https://192.168.100.10/tmui/Control/jspmap/tmui/locallb/virtual_server/list
Training mock · not live

Local Traffic > Virtual Servers > vs_web_https

Confirm VS match fields

192.0.2.100:443
Available / unknown?
WEB_POOL
Auto Map or None
Note last change

Port mismatch example from the PDF: client 443, VS 8443 — no match, no processing.

https://192.168.100.10/tmui/Control/jspmap/tmui/locallb/pool/list
Training mock · not live

Local Traffic > Pools > WEB_POOL

Member health

10.20.20.101:443 · UP
10.20.20.102:443 · DOWN
10.20.20.103:443 · UP
Monitor passing? Disabled? Priority group min members? Connection limit?

A down member is not a down VIP unless it was the last healthy member.

tcpdump — both legs
tcpdump -nni 0.0 host 198.51.100.50
tcpdump -nni 0.0 host 10.20.20.101 and port 443

Side C · asymmetric routing

Client → BIG-IP → server is not enough. If the server replies straight to the client, TMM never sees SYN-ACK and the full proxy cannot complete. SNAT Automap forces the server-side source to a Self IP so the return must come back. Do not enable Automap blindly — understand the gateway design — but do not refuse it when the server default route bypasses BIG-IP.

Ops · evidence desk
Packet capture timeline and green checkmarks
Green is a capture and a counter, not a hunch. Then you may change one thing.

Where evidence usually breaks

Flow 2 · silent SNAT fail
SYN inext VLANVS OKstats++SYN outint VLANReply?back to TMM?

No server-side SYN-ACK + No-SNAT = look at the server gateway before rewriting iRules.

Traps + proof

PatternOften isNot
No packet on 0.0Upstream routing/firewall/DNSPool monitor
Packet in, no VS statsDestination/port/VLAN mismatchSSL profile
VS stats, no server SYNNo route, member down, iRule dropClient PC
Server SYN, no SYN-ACKServer/app or asymmetric returnNeed a new iRule first
RSTProve who sent it'F5 always RSTs'
You are done with Module 7 when

Knowledge check

If you want to change config first, you fail this quiz on purpose.

Q1

First action on a P1 VIP down:

Correct: b. Module 7 opening rule.
Q2

No packets on tcpdump 0.0 for the client IP means:

Correct: b. Stop blaming the pool.
Q3

Client 443 vs VS 8443:

Correct: b. PDF mismatch example.
Q4

Server-side SYN with no SYN-ACK plus No-SNAT often is:

Correct: b. Consider Automap or fix gw.
Q5

You may say F5 sent the RST when:

Correct: b. Firewalls RST too.
Q6

tmsh show ltm virtual stats not incrementing:

Correct: b. Match layer.

Sources

Related: Course hub · Syllabus · My Courses · F5 LTM interview