Port Lockdown controls which ports and protocols aSelf IPwill respond to.
However, certain traffic types bypass Port Lockdown for BIG-IP functionality and routing integrity.
The three types that areNOT affectedby Port Lockdown are:
1. Defined Virtual Server Traffic
Traffic destined to a Self IP that matches aconfigured virtual serveris always accepted by the BIG-IP, regardless of Port Lockdown settings.
This ensures that traffic processing does not break when administrators restrict Self-IP ports.
2. ICMP (Internet Control Message Protocol)
ICMP (such as ping, traceroute responses, etc.) always passes through a Self IP even when Port Lockdown is set to:
* Allow Default
* Allow None
* Allow Custom
F5 allows ICMP for reachability and diagnostic purposes independent of Port Lockdown rules.
3. Centralized Management Infrastructure (CMI)
CMI includes the internal HA services used for:
* Device Trust
* ConfigSync
* Failover
* Mirroring
These essential HA communications bypass Port Lockdown to prevent accidental cluster failure.
The well-known port for this traffic isTCP 4353, which is always permitted.
Why the other options are incorrect:
Option A:SSHisrestricted by Port Lockdown unless explicitly allowed.
Option B:Same issue - SSH does not bypass Port Lockdown.
OnlyDefined VS Traffic,ICMP, andCMIbypass Port Lockdown.

A newly deployed BIG-IP Virtual Edition (VE) in VMware requires initial configuration of itsmanagement- ipaddress so it can be accessed over the network. F5 provides several valid mechanisms during initial console access:
A). Running the config utility
* The config script is available on new BIG-IP installations and VE deployments.
* It launches a guided text-based wizard allowing configuration of:
* Management IP
* Netmask
* Default route
* This is a standard and recommended method during first-time setup.
B). Using TMSH with create sys management-ip
* Administrators can enter TMSH directly from the console and run:
* create sys management-ip <ip>/<mask>
* The management-ip object resides undersys, not under ltm or any other module.
* This is the correct tmsh method for defining the management interface address.
Why the other options are incorrect:
C). create ltm management-ip
* There isnosuch object under /ltm.
* LTM handles traffic objects (virtual servers, pools), not system management interfaces.
D). Running the setup command
* The setup command is used for general system configuration butdoes not configure the management- ip.
* It is not the supported method for initial management IP assignment on VE deployments.
Therefore, the valid methods are running theconfigutility and using thesys management-ipcommand within TMSH.

When you chooseAutomaticas the activation method in the License Re-activate screen, the BIG-IP device itself contacts F5'slicense activation serviceover the Internet.
For successful automatic activation:
* The BIG-IP must have outbound network connectivity (typically via the management interface).
* DNS resolution and routing must allow it to reach theF5 license activation host(the one shown in option D).
* The device sends its dossier and registration key to that service and receives an updated license file in return, which is then installed automatically.
The other hostnames in the options are not used by BIG-IP for license activation, so they cannot be correct in the context ofAutomatic Activation.

Self-IPs include a security feature calledPort Lockdown, which restricts which services respond on that Self- IP.
By default, Self-IPs block management access (SSH and HTTPS/TMUI), meaning an administrator cannot manage the device through in-band Self-IPs unless explicitly allowed.
Allow Mgmt / Allow Management
These settings enable only the management services required for administrative access, specifically:
* SSH (22)
* HTTPS/TMUI (443)
These options allow secure administration without opening unnecessary ports.
Why these are correct:
* They provide only the essential access for management.
* They follow F5 security best practices when using in-band admin access.
* They donotexpose all services, reducing the attack surface.
Why the other options are incorrect:
A). Allow Default
* This allows only a minimal set of system-required ports (e.g., failover, config sync), not SSH or HTTPS.
* Administrator access would still fail.
B). Allow All
* Opens all ports on the Self-IP, which isnot secure.
* Exposes services that should remain restricted.
Therefore,Allow Mgmt / Allow Managementare the correct choices.