What do I need to do on the network side first to open a vService on an IP in a different subnet / VLAN?

Short answer

First, TR7 must be connected to that network; a vService can listen only on an IP defined on the device. The order is as follows: the switch port is set to carry the new VLAN tagged; if the new network will be kept separate from the other networks with its own gateway, a route table for it is created first; on TR7, a VLAN interface is created under Network → Interfaces and an IP from that subnet is added to it; if clients come through another gateway, a default gateway or a static route is defined in the relevant route table. Then the IP is selected from the Frontend IP list of the vService.

Problem: Why Can't a vService Be Opened Directly on a New Network?

The Frontend IP list of the vService contains only the IPs defined on the interfaces of TR7. If none of the interfaces of TR7 is connected to the new subnet, an IP from that subnet cannot be selected. If the new network is in a separate VLAN, both the physical connection (switch) and the VLAN interface on TR7 must be ready for TR7 to receive the traffic of that VLAN.

Solution

VLAN Interface, Route Table, IP and Routing

• How it works TR7 receives tagged VLAN traffic through the physical interface; the IP added to the VLAN interface becomes the address on which the vService can listen.
• Where it is openedNetwork → Interfaces → Add Route Table (if needed) → Add Interface (VLAN) → Add IP
• Requirement The switch port must carry the VLAN tagged (trunk); the gateway address if routing is needed
• vService type All

Step-by-Step Configuration

1

Adım 1 Prepare the switch side

The switch port to which TR7 is connected is configured to carry the new VLAN tagged (trunk). This setting is made on the switch, not on TR7.

2

Adım 2 Open the route table form (if needed)

If the new network will work with its own gateway, uses the same IP range as another network, or will be kept separate from the other networks for security reasons (e.g. DMZ), a route table for it is created; otherwise, steps 2–4 are skipped and the interface stays in the DEFAULT table (What is a Route Table; when do I need to change it for a vService or Backend Service?). Network → Interfaces → Actions → Add Route Table is selected (the same form also opens with Add on the Network → Route Tables screen).

3

Adım 3 Enter the name of the route table

A unique name of 1–15 characters (e.g. RT_DMZ) is entered in the Route Table Name field; if dynamic routing (BGP, OSPF) is not needed, Dynamic Route Table is left unchecked.

4

Adım 4 Save the route table

The Add button is clicked. The table is created empty; interfaces, IPs and routes are added to this table in the next steps.

5

Adım 5 Open the VLAN interface form

Network → Interfaces → Actions → Add Interface is selected.

6

Adım 6 Enter the VLAN information

VLAN is selected as the Type; VLAN ID (2–4094), Interface Name and Master Interface (ETH, Bond or LACP) are entered. In the Route Table field, the table in which the interface will be created is selected; this field appears only when there is more than one route table, and if there is a single table, the interface is created in the DEFAULT table.

7

Adım 7 Save the VLAN interface

The Add Interface button is clicked.

8

Adım 8 Open the IP add form

The new VLAN interface is right-clicked and Add IP is selected.

9

Adım 9 Enter the IP and the CIDR

It is checked that the VLAN interface is selected in the IP Interface field; an IP from the subnet (e.g. 192.0.2.50) and the CIDR (e.g. 24) are entered. In a cluster setup, the Interface IPs of the two devices are added first, this pair is selected in the VIP Communication field in the Edit Interface form of the interface, and then the VIP is added for the vService (What is a VIP, and when is it needed?).

10

Adım 10 Save the IP

The Add IP button is clicked.

11

Adım 11 Define the routing (if needed)

If clients come through another gateway, the gateway is defined in the route table where the IP is located: if a new route table was created, its default gateway is empty and is entered with Set Default Gateway in the Network → Route Tables list; for a specific destination network, the interface is right-clicked, the destination network and gateway are entered with Add Route, and the route is saved with Add Route. Each table can have a single default gateway per IP version.

12

Adım 12 Select the IP on the vService

On the Load Balancer → Load Balancer vService List screen, the vService is opened and the new IP is selected from the Frontend IP list. On HTTP and L7 TCP vServices, the Frontend IP is listened on in its own table, and no table is selected separately; on a Network vService, the table where the IP is located is first selected in the Route Table field. If the Backend Services are also on the network in this table, the same table is selected in the Route Table field of the Backend Service.

13

Adım 13 Save

The Save button is clicked.

Verification

1Interface and IP statusTR7 side

The VLAN interface and its IP are checked in the Network → Interfaces list.

ExpectedVLAN interface and IP: Up

2Access from the new subnetClient side

Commandcurl -v http://192.0.2.50/

ExpectedThe response of the vService

Common Mistakes

• Leaving the switch port in access mode. The VLAN tag does not reach TR7; even if the interface appears Up, no traffic arrives.
• Adding the IP to the wrong interface. The IP add form can open with the first interface selected; the IP Interface field is checked.
• Adding a second default gateway for the same IP version. A table can have a single default gateway per IP version; the record is rejected with the Route destinations collide error.
• Opening the route table after creating the VLAN interface. The interface is created in the DEFAULT table; it is moved to the new table from the Route Table field in the Edit Interface form, and its IPs and routes go along with it.
• Forgetting the default gateway in the new route table. The table is created empty; if no gateway is defined, no response returns to clients coming from other networks.
• Not selecting the route table on a Network vService. The list is limited to the IPs in the selected table; the new IP does not appear.

How it is done in the documentation

• Add Interface · The VLAN (IEEE 802.1Q) Add Interface Form
• Add IP Address · How to Add?
• Add Route Table · How to Add?
• Add Static Routing · Default Gateway
• Add IP Address (Cluster) · The IP Types in Cluster Mode

Related questions

• Why can't I type the Frontend IP manually; what should I do to use an IP that is not in the list (e.g. IPv6) on a vService?
• What is a Route Table; when do I need to change it for a vService or Backend Service?
• Can my backends be on different networks / in different route tables?