Which settings are shared at group level, and which are per server?

Short answer

In a Backend Group, only four fields are per server: Address (IP or domain name and port), Cookie Content, Connection Limit and Weight. These are entered separately for each row in the Backends table. All the remaining settings, including Route Table, health check, Backup Service, Maintenance Mode, SSL settings, SNAT, Spoofing and Proxy, are at group level and are applied as they are to every server in the group.

How Does It Work?

When writing the group into the vService configuration, TR7 creates a separate server definition for each Backends row: the four values in the row are added to that server, and the shared settings of the group are added as they are to all of them. Therefore, when a shared setting is changed, all the servers in the group are affected at the same time; the health check, however, is performed separately for each server, even though the profile is shared.

Per-Server Fields

The columns in the Backends table are in the following order:

Field	Description
Address	The IP address or domain name and the port of the server; required. A new row comes with port 80
Cookie Content	The value that identifies this server in cookie-based persistence; it has no default value
Connection Limit	An integer in the range 1–65535; it has no default value, and when it is empty, no per-server limit is applied
Weight	An integer in the range 1–256; its default value is 1

Group-Level Fields

Section	Fields
Main form	Backend Group Name, Route Table, Health Check, Enable HC Logs (only while a health check profile is selected), Backup Service, Maintenance Mode, Cleartext HTTP/2 (h2c) (only while SSL Service is off)
While SSL Service is on	Ciphers, SNI, ALPN, Backend SSL Security Profile, Certificate Verification, Verification CA Profile (only while Certificate Verification is Required), Client Certificate Presented to Backend (mTLS)
Details	Use Frontend Port, SNAT (SNAT IP while Use Device IP is selected), Use Different IP for Health Check, Health Check Source IP, Spoofing (only while SNAT is Use Client IP), Proxy

In TR7

• The group is opened with Load Balancer → Backend Groups → Add or Edit; the per-server values are entered in the Backends table, and the shared settings in the upper section of the form and under the Details switch.
• To see the per-server values and the health status of each server in the list, the Show Backend Services switch is turned on.
• When Clustering is on and Manual Sync Mode is off (default), a group change is transferred to the peer device automatically.

Common Misconceptions

• "I can put a single server in a group into maintenance or make it a backup." Maintenance Mode and Backup Service are at group level; they are applied to all servers together.
• "The settings in the Details section are per server." Details settings such as SNAT, Proxy and Spoofing are also at group level.
• "The health status of the group is a single check." The profile is shared in the group, but each server is checked separately; if the statuses differ, the group appears as Partially healthy.
• "Route Table is selected per server." Route Table is at group level; for servers in different networks, separate groups or individual Backend Services are used.

How it is done in the documentation

• Backend Groups · What Is Backend Groups?
• Backend Groups · Backends
• Backend Groups · Details
• Backend Groups · Backend Group Add Form

Related questions

• Can I give the servers in a Backend Group their own Weight and connection limit?
• When should I use a Backend Group, and when individual Backend Services?
• What is the Cookie Content field used for?