In what order do I configure networking when connecting TR7 to a new network (route table, interface, IP, route, firewall)?

Short answer

In TR7, network elements depend on each other: an interface belongs to a route table, an IP address and a route belong to an interface, and a firewall rule belongs to a route table. That is why the order is as follows: (1) if a separate network area or a separate default gateway is needed, a route table is created on the Network → Route Tables screen; otherwise, DEFAULT, which always exists, is used; (2) the interface is prepared: physical ETH interfaces come in DEFAULT and are moved to another route table with Edit Interface, while interfaces such as VLAN, Bond and LACP are created directly in the desired route table with Add Interface; (3) an IP address is added to the interface with Add IP (Interface IP and VIP in a cluster); (4) the Default Gateway and static routes are added; for the default gateway, the route table must have an IP in the same subnet as the gateway; (5) the firewall is closed by default for incoming and transit traffic; since the permissions for vService listening ports and management access are generated automatically, rules are added only for the traffic other than these. Then the same route table is selected in the vService and Backend Service forms.

Problem: When the Order Is Wrong, the Steps Return Errors

Each network element is built on top of the previous one: an IP address is defined on an interface and is valid in the route table of that interface; a route is bound to an interface; a firewall rule is written to a route table and, optionally, to an interface. When a step in the order is skipped, the following results are seen:

• If an attempt is made to define the default gateway before an IP is added, the Route Tables form returns the No network matches default gateway <gw> (IPv4) error and no change is applied.
• If the interface is moved to another route table after the IPs and routes have been added, the IPs and routes move to the new table together with the interface; the connection is briefly interrupted while the interface is recreated in the system (behavior after saving).
• If a firewall rule is written to the wrong route table, it is not applied to the expected traffic at all; each route table has a separate rule set.

Solution

The configuration is done in a single order, from the same family of screens: Network → Route Tables, Network → Interfaces and Network → Firewall.

Recommended Configuration Order

• How it works The route table determines the network area, the interface determines the connection point bound to this area, the IPs and routes determine the address and the path of the traffic, and the firewall determines the permitted traffic. Each step selects the element created by the previous one.
• Where it is opened Configuration Menu → Network → Route Tables · Interfaces (Actions menu: Add Interface, Add IP, Add Route, Add Route Table) · Firewall
• Requirement Modify permission in the Network area; the subnet, gateway and VLAN information obtained from the network administrator
• Scope Device-wide; in a cluster, the configuration is common to both devices

Step-by-Step Configuration

1

Adım 1 Determine the route table (create it if needed)

TR7 comes with the DEFAULT route table, which cannot be deleted, and all physical interfaces are initially in this table. If the new network will be kept in a separate network area (e.g. a DMZ, a separate customer) or requires a separate default gateway, a route table is created with Network → Route Tables → Add: Route Table Name (1–15 characters) is entered, Dynamic Route Table is checked if dynamic routing is needed, and the Add button is clicked. The created table is empty.

2

Adım 2 Prepare the interface

On the Network → Interfaces screen:

• If a physical ETH interface will be used and will belong to a table other than DEFAULT, the interface is selected and Actions → Edit Interface is opened, the target table is selected in the Route Table field and the Edit Interface button is clicked. Interfaces that carry a management access IP or that are the cluster sync interface cannot be moved out of DEFAULT.
• If VLAN, VXLAN, Bond, LACP, Bridge or V-ETH is needed, the interface is created with Actions → Add Interface; when there is more than one route table, the target table is selected in the Route Table field (Add Interface).

The Route Table field is visible only when more than one route table is defined.

3

Adım 3 Add the IP address

Actions → Add IP is opened; the interface is selected in the IP Interface field, the address and the CIDR (default 24) are written in the IP field and the Add IP button is clicked. Example: 192.0.2.10/24.

In a cluster, Interface IP is first added for both devices in the IP Type field, and this pair is selected in the VIP Communication field of the interface; the VIP the vServices will listen on does not become active until this pair is defined.

4

Adım 4 Add the default gateway and static routes

For the default gateway, the pencil icon in the Default Gateway column of the table is clicked on the Network → Route Tables screen, the gateway address (e.g. 192.0.2.254) is written in the Default Gateway(IPv4) field and the Set Default Gateway button is clicked; the interface that has an IP in the same subnet as the gateway is selected automatically. If the gateway is to be monitored with ping, the default gateway is instead added by checking Default Gateway in the Actions → Add Route form, and a Gateway Monitoring profile is selected.

For networks other than the default gateway, Route Interface, Gateway and Destination Network are entered in the same Add Route form and the Add Route button is clicked.

5

Adım 5 Add a firewall rule if needed

The firewall is closed by default for incoming (INPUT) and transit (FORWARD) traffic. The permissions needed for vService listening ports, Management Access settings and GTM DNS listeners are generated automatically. For the traffic other than these (e.g. FORWARD for server traffic to be routed through TR7, SOURCE NAT (NAT) for address translation), Network → Firewall → Add is opened, the table the rule will belong to is selected in the Route Table field, the rule fields are filled in and the Add button is clicked (Rule Adding Form).

6

Adım 6 Select the route table in the vService and Backend Service

Once the network is ready, the same route table is selected in the Route Table field in the forms of the vService and the Backend Service, and the IP added in step 3 is selected from the Frontend IP list of the vService (What is a Route Table; when do I need to change it for a vService or Backend Service?).

Each save returns without asking for confirmation; applying to the system is done in the background. While applying is in progress, Network is under action. Please wait... appears in the toolbar; a save sent during this time is rejected with the Configuration sync in progress. Please try again later. error, and the completion of the operation is awaited.

Verification

1Interfaces ListTR7 side

On the Network → Interfaces screen, the interface row, the IP sub-row and the Routes column are read (status colors).

ExpectedInterface and IP green (Up); a default gateway row in the Routes column

A newly added IP appears red (Absent in system) until it is applied to the system. Yellow (No link) shows that there is no physical connection (cable, switch port).

2Gateway reachabilityTR7 side

If Gateway Monitoring has been assigned, the Gateway Health column on the Network → Route Tables screen is examined.

ExpectedGateway reachable (✓)

Common Mistakes

A broad DENY rule cuts off management access

A DENY rule in the Firewall whose source is kept broad (e.g. Source = All, Protocol = All) also drops web interface and SSH access, and the system gives no warning. While rule changes are being applied, a second management session is kept open (rule evaluation order).

• Trying to define the default gateway before the IP. The Route Tables form looks for a table IP in the same subnet as the gateway; if there is none, it returns the No network matches default gateway <gw> (IPv4) error.
• Assuming that the Add Route form performs a subnet check. This form does not verify whether the gateway is in the subnet of the interface; a wrong gateway address is saved without an error.
• Adding a second IPv4 default gateway to the same route table. There is a single default gateway per route table and per IP version; the second one is rejected with the Route destinations collide: … error. Separate route tables are used for different exits (What is a Default Gateway?).
• Moving the interface after the IPs and routes have been added. Moving also moves the IPs and routes, and the connection is briefly interrupted while the interface is recreated; the route table decision is made before the interface is configured.
• Adding firewall rules for vService ports. The permissions for vService listening addresses are generated automatically and appear in the Auto-generated Rules table; there is no need to add a rule manually.

How it is done in the documentation

• Route Tables · What Is Route Tables?
• Route Tables · The Default Gateway Form (Edit Default Gateway)
• Add IP Address · How to Add?
• Firewall · The Auto-Generated Rules

Related questions

• What is a Route Table; when do I need to change it for a vService or Backend Service?
• What is an IP address; where are IP addresses defined in TR7?
• What is a Default Gateway?
• What is a static route?