What is a subnet; why does TR7 require the same subnet?

Short answer

A subnet is a subdivision of an IP address block determined by the prefix length (e.g. 192.0.2.0/24); devices in the same subnet reach each other directly, without the need for a router, over the same L2 segment (RFC 4632). For this reason, TR7 requires the same subnet in two places. In a cluster, the two addresses in an Interface IP row (this device and the peer device) must be in the same subnet according to the entered CIDR; otherwise the record is rejected with Subnet error. The gateway entered in the default gateway form on the Route Tables screen must be in the same subnet as an IP in the route table; the matching address is shown in the Match line below the field, and if there is no match, the record is rejected with the No network matches default gateway error. While the SNAT field of the Backend Service is Default, the source IP is also selected according to this rule, as the Interface IP that is in the same subnet as the server (or as the gateway leading to the server).

Where It Is Used in TR7

Where	Field / label	What for
`Network` → `Interfaces` → `Add IP` / Edit IP (in a cluster, Ip Type = Interface IP)	The two addresses in the IP table and CIDR; the `Subnet error` error	Checking that the addresses of the two devices are in the same subnet
`Network` → `Route Tables` → the pencil icon in the Default Gateway column	The `Match: <ip>/<cidr> (<interface-name>)` line under Default Gateway(IPv4) / Default Gateway(IPv6)	Finding, from the IP in the same subnet, the interface through which the gateway will be reached
Backend Service form → Details	SNAT = Default, Health Check Source IP = Default	Selecting the source Interface IP of the connection going to the server and of the health check
Load Balancer actions → Ip Log Masking	Masking(subnet)	Masking the client IP according to the given prefix length
The Notifications card of the WAF and Bot/DDoS modules → Advanced Notifications	Scope = Source subnet	Counting the notification threshold per source subnet
WEB-CLI	`sys-cmd ipcalc` (ipcalc)	Calculating the subnet, the network address and the broadcast address of an address

Source IP Selection in TR7

While SNAT is Default (and Health Check Source IP = Default), TR7 selects the source address with this rule: in the Backend Service's Route Table, the Interface IP of the interface going to the server (to the gateway, if the server is reached through a gateway) that is in the same subnet as the server (or the gateway) is used. In a cluster, each device uses its own Interface IP. If there is more than one IP in the same subnet and a specific address is wanted, Use Device IP is selected. Details: What does "Default" in the SNAT field mean; can I choose a specific SNAT IP?

Common Misconceptions

"The default gateway in the Add Route form must be in the same subnet too." The same-subnet check exists only in the default gateway form on the Route Tables screen. The Add Route form does not check whether the gateway is in the subnet of the interface; the route is added by being treated as directly connected (onlink), and the correctness of the address is the user's responsibility.
"To open a vService on an IP in a different subnet, just adding the IP is enough." TR7 needs to be connected to that network with an interface (most of the time a VLAN) and, if necessary, a route needs to be defined (What do I need to do on the network side first to open a vService on an IP in a different subnet / VLAN?).
"Subnets exist only in IPv4." In IPv6 too, subnets are defined with the prefix length; in TR7, the IPv6 CIDR is in the 0–128 range.

How it is done in the documentation

What is a subnet; why does TR7 require the same subnet? ​

Where It Is Used in TR7 ​

Source IP Selection in TR7 ​

Common Misconceptions ​

What is a subnet; why does TR7 require the same subnet?

Where It Is Used in TR7

Source IP Selection in TR7

Common Misconceptions