Self-IPs include a security feature calledPort Lockdown, which restricts which services respond on that Self-IP.
By default, Self-IPs block management access (SSH and HTTPS/TMUI), meaning an administrator cannot manage the device through in-band Self-IPs unless explicitly allowed.
Allow Mgmt / Allow Management
These settings enable only the management services required for administrative access, specifically:
These options allow secure administration without opening unnecessary ports.
Why these are correct:
They provide only the essential access for management.
They follow F5 security best practices when using in-band admin access.
They donotexpose all services, reducing the attack surface.
Why the other options are incorrect:
A. Allow Default
This allows only a minimal set of system-required ports (e.g., failover, config sync), not SSH or HTTPS.
Administrator access would still fail.
B. Allow All
Opens all ports on the Self-IP, which isnot secure.
Exposes services that should remain restricted.
Therefore,Allow Mgmt / Allow Managementare the correct choices.
