What do the L2, L3, L4 and L7 layers mean; why do they appear so often on TR7 screens?

Short answer

These abbreviations describe the layers of the OSI model (ISO/IEC 7498-1): L2 is the data link layer (MAC address, switch, VLAN), L3 is the network layer (IP address, routing), L4 is the transport layer (TCP/UDP and port), L7 is the application layer (HTTP; header, path, cookie). They appear often on TR7 screens because the layer determines which information of the traffic a feature can look at. Among the vService types, the Network vService works at L3/L4 (Protocol: TCP - L4, UDP - L4, ANY - L3) and distributes based only on address, protocol and port; L7 TCP terminates the connection on TR7 but does not parse the application protocol; the HTTP vService parses the request at L7. For this reason, WAF, header operations and content-based routing are found in the HTTP vService. The same distinction exists in the protection products: L4 DDoS Protection inspects packets and connections at the route table level, and L7 DDoS Protection inspects requests at the vService level.

Where It Is Used in TR7

Where	Field / label	Layer
vService creation → Type	HTTP, L7 TCP, Network (vService Types)	HTTP: L7 · L7 TCP: the L4 connection terminates on TR7, and from L7 only connection information such as the TLS SNI is read · Network: L3/L4
Network vService form	Protocol = TCP - L4, UDP - L4, ANY - L3	The layer is written in the label
Load Balancer → Profiles → Health Checks	Check Type: Ping (L3), TCP / UDP (L4), application types such as HTTP / HTTPS (L7)	At which level the server is probed
Configuration Menu → Bot/DDoS	L4 DDoS Protection	L3/L4 protection at the route table level
Left Monitor Panel → Bot/DDoS Protected vServices → vService → Bot/DDoS Management	L7 DDoS Protection	L7 protection at the vService level
Network → Firewall	Source (IP, Country, MAC Address), Protocol, Destination Port	L2 (MAC), L3 (IP), L4 (protocol, port) matching
Network → Interfaces → Add Interface	VLAN, Bridge, VXLAN	Creating and carrying L2 segments

Layers

Layer	What it looks at	In TR7
L2 · data link	MAC address, VLAN tag	Interfaces, VLAN, Bridge, VXLAN; MAC matching in the Firewall
L3 · network	IP address, routing	Route tables, static route, default gateway; ANY - L3 in the Network vService
L4 · transport	TCP/UDP, port, connection state	Network vService (TCP - L4, UDP - L4), Firewall, L4 DDoS Protection
L7 · application	HTTP content: method, header, path, cookie, body	HTTP vService, WAF, L7 DDoS Protection

• The feature differences of the types: What are the feature differences between HTTP, L7 TCP and Network vServices?
• The difference between L4 and L7 protection: What is the difference between L4 DDoS Protection and L7 DDoS Protection?

Common Misconceptions

• "L7 TCP and TCP - L4 are the same thing." L7 TCP terminates the connection on TR7 and offers features such as TLS termination and routing by SNI; TCP - L4 in the Network vService forwards the connection without terminating it (What is the difference between L7 TCP and Network (TCP - L4); aren't they both TCP?).
• "WAF works with every vService type." Because WAF inspects HTTP content, it works only in the HTTP vService (Which vService types does TR7 WAF work with; can I use it on an L7 TCP or Network vService?).
• "An L2 connection is always required." It is mandatory for TR7 and the Backend Services to be on the same L2 network only in some modes (Do TR7 and the backends have to be on the same L2 network?).

How it is done in the documentation

• Load Balancer · vService Types
• Network vService · Protocol
• What Is L4 DDoS Protection?
• What Is Firewall?

Related questions

• What are the feature differences between HTTP, L7 TCP and Network vServices?
• What is the difference between L7 TCP and Network (TCP - L4); aren't they both TCP?
• Which vService types does TR7 WAF work with; can I use it on an L7 TCP or Network vService?
• What is the difference between L4 DDoS Protection and L7 DDoS Protection?