An administrator has configured an existing Layer 7 Virtual Service terminating SSL/TLS with WAF enabled. The administrator needs to include support for SMTP on the same FQDN/Virtual Service IP…

Question

Options

• ACreate a second Virtual Service and IP for SMTP, and add a new record in DNS to handle SMTP
• BAdd the SMTP listening ports with separate L4 Application Profile to the same L7 SSL/TLS VS,
• CCreate a second Virtual Service that re-uses the same Virtual IP as the L7 SSL/TLS VS with
• DAdd the SMTP listening ports with separate L4 Application Profile to the same L7 SSL/TLS VS,

• A
  6% (1)
• B
  6% (1)
• C
  76% (13)
• D
  12% (2)

Explanation

Option C is correct because most enterprise load balancers (such as VMware NSX ALB / Avi Networks) support shared VIPs, meaning multiple Virtual Services can bind to the same IP address on different ports or protocols. SMTP is a Layer 4 protocol and fundamentally incompatible with an L7 SSL/TLS Application Profile that has WAF enabled - it requires its own VS with a dedicated L4 Application Profile, while still reusing the same Virtual IP to satisfy the "same FQDN/IP" requirement.

Option A is wrong because creating a second IP is unnecessary and defeats the requirement of keeping the same FQDN/VIP - shared VIP support exists precisely to avoid this.

Options B and D are wrong because a single Virtual Service can only have one Application Profile; you cannot bolt an L4 profile onto an existing L7/WAF VS. Mixing protocol profiles on the same VS is not supported, and attempting to shoehorn SMTP into an HTTP/WAF pipeline would break both.

Memory tip: Think "same IP, different VS" - when two protocols are incompatible (L7 HTTP vs. L4 SMTP), you always create a new VS that shares the VIP, rather than cramming conflicting profiles into one VS.

No community discussion yet for this question.