Is it possible to work without SNAT (transparent mode); what are the requirements?

Short answer

Yes. On HTTP and L7 TCP vServices, Use Client IP is selected in the SNAT field of the Backend Service; TR7 connects to the server with the client's IP. For this, the server's responses must return through TR7: the server's default gateway is set to TR7, or Spoofing is enabled for servers in a subnet to which TR7 is connected. On a Network vService, on the other hand, Direct Server Return (default) or Route Mode as the LB Mode preserves the client IP.

How Does It Work?

The server always sends the response to the source address of the request. When the source is the client's IP, the response goes to the server's default gateway. If the gateway is not TR7, the response bypasses TR7; the client does not recognize a packet coming from the server's address instead of the vService address it connected to, and the connection cannot be established. For this reason, in every layout where SNAT is not used, the return traffic is directed to TR7.

HTTP and L7 TCP: Use Client IP

Requirement	Description
SNAT = Use Client IP	Selected in the Details → SNAT field of the Backend Service (or Backend Group); the default is Default
Return traffic from TR7	The server must send the responses going to the client to TR7; otherwise, the client receives a response from a server it did not connect to, and the connection cannot be established
Path 1: Default Gateway	The server's default gateway is set to TR7's address in the same network as the server (in a cluster, the VIP in this network; this way the gateway moves to the peer device on failover)
Path 2: Spoofing	Spoofing is enabled (off by default; the field appears only while Use Client IP is selected); TR7 takes over, via ARP in the Backend Service's network, the server's responses going to the gateway. If Spoofing IP is empty, the default gateway of the Route table is targeted; in a cluster, with Spoofing IP VIP Condition, it works on the device where the VIP is active. The Backend Service must be in a subnet to which TR7 is connected

Network vService

LB mode	Client IP	Requirement
Direct Server Return (default)	Preserved	The server is on the same L2 as TR7; the vService address is a local address on the server, and it does not respond to ARP for this address (What is Direct Server Return (DSR); what preparation is needed on the server side?)
Route Mode	Preserved	The response must return from TR7: the server's default gateway is TR7 (Why does return traffic have to flow through TR7 in Route Mode?)
SNAT	Lost (the source becomes the SNAT IP on the vService)	None

On a Network vService, the SNAT field of the Backend Service is not used; the behavior is determined by LB Mode.

In TR7

• Alternatives: On HTTP, the client IP is also carried with the X-Forwarded-For header and, if the server supports it, over the PROXY protocol with the Proxy field of the Backend Service; these paths do not require a change in the network structure (How do I see the real client IP on the backend?).
• Health check: Use Client IP does not affect the health check; the check goes from TR7's address according to the Health Check Source IP field.
• View: In the Details tab of the Backend Service preview, the SNAT row shows Use Client IP and, if Spoofing is on, the Spoofing row also appears (Details rows).

Common Misconceptions

• "Selecting Use Client IP is enough." If the responses do not return from TR7, the connections cannot be established.
• "Use Client IP always works for a server in a remote data center." Unless the remote server's responses are routed through TR7 in the network, they bypass TR7 and the connection cannot be established; Spoofing can be used only for servers in a subnet to which TR7 is connected.
• "On a Network vService, Use Client IP on the Backend Service applies." On a Network vService, the LB mode is decisive.

How it is done in the documentation

• Backend Services · Use Client IP
• Backend Services · Spoofing
• Network vService · LB Mode

Related questions

• What is the difference between the SNAT options on a Backend Service (Default, Use Client IP, Use Device IP)?
• Why does return traffic have to flow through TR7 in Route Mode?
• Why do my backend servers see all requests as coming from TR7's IP?