101 · Question #72
Which statement is true concerning packet filters?
The correct answer is B. Filters cannot prevent access to the management port.. This question tests understanding of the scope and limitations of BIG-IP packet filters.
Question
Which statement is true concerning packet filters?
Options
- AIn addition to administratorcreated filters, three always exists a "deny all" filter that processes
- BFilters cannot prevent access to the management port.
- CThe order of filters does not affect which traffic is accepted or denied
- DFilters cannot prevent the BIG_IP synching process from taking place.
How the community answered
(42 responses)- A7% (3)
- B88% (37)
- C2% (1)
- D2% (1)
Why each option
This question tests understanding of the scope and limitations of BIG-IP packet filters.
BIG-IP does not have a built-in implicit 'deny all' packet filter - the default behavior without a matching filter is to allow traffic, meaning traffic is passed unless an explicit deny filter matches.
BIG-IP packet filters are processed by TMM (Traffic Management Microkernel) and apply only to traffic handled by the data plane. The management port operates on a separate Linux network stack independent of TMM, so packet filters configured in the LTM policy framework cannot block or restrict access to the management interface. Management port access is controlled separately via management IP allow lists.
Filter order absolutely affects outcomes because BIG-IP evaluates filters in sequence and applies the action of the first matching filter, making order critical to correct policy enforcement.
BIG-IP ConfigSync traffic does travel through TMM-managed interfaces and can be blocked by incorrectly configured packet filters, so filters can interfere with the sync process.
Concept tested: BIG-IP packet filter scope and management port behavior
Source: https://support.f5.com/csp/article/K3383
Topics
Community Discussion
No community discussion yet for this question.