What are the two options for securing a BIG-IP’s management interface? (Choose two.)

Securing the BIG-IP management interface involves a layered approach. The first fundamental best practice is network isolation. The management interface should be connected to a dedicated, trusted, and secure management network (VLAN) that is separate from data plane traffic. This significantly reduces the attack surface by limiting network-level access.

The second layer of security is applied directly on the BIG-IP device. The system allows administrators to configure specific access control lists, restricting which source IP addresses or subnets are permitted to connect to administrative services like the Configuration utility (HTTPS) and SSH. This ensures that even within the trusted network, only authorized administrative workstations can manage the device.

B. Blocking all administrative ports would make the BIG-IP system unmanageable over the network, which is counterproductive to administrative needs. The goal is to secure access, not eliminate it.

C. Using Self-IPs for management is an alternative configuration (in-band management), not a method for securing the dedicated management interface itself. Best practices recommend out-of-band management via the management port.

1. F5 Networks Knowledge Base, K13092: Overview of securing access to the BIG-IP system.

Section: Network access states, "F5 recommends that you secure access to the BIG-IP management interface and self IP addresses to a trusted management network." This directly supports option A.

Section: BIG-IP configuration discusses using features like packet filters and port lockdown to control access, which aligns with the principle of restricting access by IP address (Option D).

2. F5 Networks Knowledge Base, K13309: Restricting access to the Configuration utility by source IP address (11.x - 17.x).

This document provides the exact procedure for implementing the security control described in option D. The introductory summary states, "You can secure the BIG-IP system from unwanted connection attempts by restricting access to the Configuration utility to trusted IP addresses."

3. F5 BIG-IP System: Administration and Maintenance Guide.

Chapter: Securing the BIG-IP System, Section: Creating a secure password policy. In security overview sections, the guide consistently emphasizes the principle of a dedicated management network. For example, it notes, "For maximum security, you should connect the management port on the BIG-IP system to a secure, dedicated management network." This supports option A.

4. F5 Networks Knowledge Base, K17333: Overview of port lockdown behavior (12.x - 17.x).

This article details the "port lockdown" feature, a primary mechanism for restricting access. It explains how to configure a list of allowed protocols and services for specific IP addresses, which is the implementation behind option D. The article states, "The port lockdown feature allows you to specify the protocols and services from which a self IP address can accept connections," and similar controls are available for the management interface.