Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
Choosing the LB Mode: how do I decide between DSR, Route Mode and SNAT?
Short answer
On a Network vService, the LB Mode decision depends on three questions: is the client IP needed on the server, can the servers be prepared, and are the servers on the same L2 network as TR7? If the servers cannot be touched, SNAT is selected and the SNAT IP is set; the client IP is lost, but no additional preparation is required. If the client IP is needed and the servers' default gateway can be set to TR7, Route Mode is selected; if the client IP is needed, the traffic is high, and the servers are on the same L2 network and can be prepared, Direct Server Return (default) is selected. If Protocol is ANY - L3 or Port Range is on, the LB mode is not applied; only the selected SNAT IP translates the source address.
How Does It Work?
- Direct Server Return: TR7 forwards the packet to the server at L2 without changing its destination address; the response goes directly from the server to the client (What is Direct Server Return (DSR); what preparation is needed on the server side?).
- Route Mode: TR7 translates the destination address and port to those of the Backend Service; while the response returns through TR7, the source address is translated back to the VIP (Why does return traffic have to flow through TR7 in Route Mode?).
- SNAT: TR7 translates the destination address and also replaces the source address with the SNAT IP on the vService; the response returns to TR7 on its own.
Comparison
| Direct Server Return | Route Mode | SNAT | |
|---|---|---|---|
| Client IP on the server | Preserved | Preserved | Lost (the SNAT IP appears) |
| Response path | Bypasses TR7 | Must pass through TR7 | Through TR7 (on its own) |
| Server preparation | VIP as a local address, ARP suppression | Default gateway TR7 | None |
| Same L2 network | Required | Not required | Not required |
| Port translation | None | Yes | Yes |
| TR7 load | Lowest | Medium | Medium |
| Protocol ANY - L3 or Port range on | Not applied | Cannot be selected with ANY - L3; not applied with Port range | The source is translated with the selected SNAT IP |
Decision Order
- No changes can be made on the server → SNAT. In the SNAT IP field, a TR7 IP in the vService's Route table is selected (required); the client IP is not carried to the server.
- The client IP is needed, the servers' default gateway can be set to TR7 → Route Mode.
- The client IP is needed, high volume, same L2 network, the servers can be prepared → Direct Server Return.
- Protocol ANY - L3 or Port range on → the LB mode is not applied; the distribution is done with Round-Robin / Weighted Round-Robin, the health status is not reflected in the distribution, and if no SNAT IP is selected, the responses must return from TR7 (Port Range).
In TR7
- Location: Load Balancer → Load Balancer vService List → Network vService → Edit → LB Mode; the options are Direct Server Return (default), Route Mode and SNAT. While Protocol ANY - L3 is selected, Route Mode is not in the list.
- SNAT IP: It appears only while the LB mode is SNAT; the list is limited to the IPs in the vService's Route table.
- Saving: On a Network vService, every save restarts the vService; the change is made at a low-traffic time.
- HTTP and L7 TCP: These vServices have no LB mode; the source address is determined by the SNAT field of the Backend Service (What is the difference between the SNAT options on a Backend Service (Default, Use Client IP, Use Device IP)?).
Common Misconceptions
- "DSR is always the best." It is the fastest, but it requires server preparation and the same L2 network; the port cannot be translated either.
- "In SNAT, the client IP is carried with a header." On a Network vService, a header cannot be added; if the client IP is needed, Route Mode or DSR is selected.
- "In SNAT mode, the SNAT IP can be left empty." When SNAT is selected, the SNAT IP is required.
How it is done in the documentation
