Do TR7 and the backends have to be on the same L2 network?

Short answer

No; it is enough that TR7 can reach the Backend Services by IP (through routing) via the Route Table of the Backend Service. The same L2 network is mandatory in only two cases: the Direct Server Return mode on a Network vService, and Spoofing together with Use Client IP on HTTP/L7 TCP. In Route Mode and in Use Client IP without Spoofing, there is no L2 requirement, but the responses of the servers must return through TR7 (the default gateway of the servers is TR7).

How Does It Work?

vService / setting	Is the same L2 required?	Note
HTTP / L7 TCP, SNAT = Default or Use Device IP	No	Access through routing is enough
HTTP / L7 TCP, SNAT = Use Client IP	No	The server's response must return through TR7 (the server's default gateway is TR7)
HTTP / L7 TCP, Use Client IP + Spoofing	Yes	Spoofing pulls the response traffic to TR7 with ARP on the Backend Service's network; TR7 must have an interface on this network
Network, Direct Server Return	Yes	The packet is forwarded to the server at L2 without changing the destination address; the response goes directly from the server to the client (What is Direct Server Return (DSR); what preparation is needed on the server side?)
Network, Route Mode	No	The response must return through TR7 (Why does return traffic have to flow through TR7 in Route Mode?)
Network, SNAT	No	Since the source address is the SNAT IP on the vService, the response returns to TR7 by itself

In TR7

• Servers on different networks: If the servers are on another subnet, TR7 must have a path to that network: an interface connected to that subnet in the Route Table of the Backend Service, a static route to that subnet, or the default gateway of the Route table. This is the only requirement for the most common configurations, such as SNAT = Default (Route Table).
• Where it is defined: Interface IPs and static routes are defined per Route table on the Network → Interfaces screen (Add IP Address, Add Static Routing).
• Source address: With SNAT = Default, TR7 connects to the server with the Interface IP of the interface going to the server (or to the gateway) in the Backend Service's Route table, in the same subnet as the server (or as the gateway) (What is SNAT, and why is it used by default?).

Common Misconceptions

• "The load balancer must always be on the same network as the servers." Only Direct Server Return and Spoofing require this.
• "The same L2 is a requirement for Use Client IP." What is required is that the responses return through TR7; if Spoofing is not used, the servers can be on a different network.
• "Route Mode requires the same L2." Route Mode only requires the return traffic to pass through TR7.

How it is done in the documentation

• Network vService · LB Mode
• Network vService · Flexible Network Topology
• Backend Services · Use Client IP

Related questions

• Choosing the LB Mode: how do I decide between DSR, Route Mode and SNAT?
• Is it possible to work without SNAT (transparent mode); what are the requirements?
• Can my backends be on different networks / in different route tables?