What is a load balancer and what does it do?

Short answer

A load balancer is the layer that receives incoming traffic on a single address and distributes it to more than one server providing the same service. It continuously monitors the health of the servers with health checks and sends traffic only to the servers that can respond; this way the service is not interrupted even if a server crashes, and capacity is increased by adding new servers. In TR7, this job is done by the Load Balancer - ADC product: traffic is received on a vService and distributed to healthy Backend Services.

How Does It Work?

Clients connect only to the single address offered by the load balancer; they do not know how many servers are behind it or which one they are directed to. On each request, the load balancer does the following:

1. Receives: The request is received on the virtual address (IP:port) on the load balancer.
2. Selects: A distribution algorithm (in turn, to the one with the fewest connections, weighted by server capacity…) selects one of the servers.
3. Sends only to healthy ones: The selection is made among the servers that pass the health check. A server that does not respond is automatically removed from distribution and taken back when it recovers.

Clients → Load Balancer · 203.0.113.10:443 → Servers

Server 1

192.0.2.11:80

Healthy · receiving traffic

Server 2

192.0.2.12:80

Healthy · receiving traffic

Server 3

192.0.2.13:80

Not responding · out of distribution

Even if servers are added or removed, the address the client connects to does not change; no setting is required on the client side.

What Is It For?

Without a load balancer	With a load balancer
A single server is a single point of failure; if the server crashes, the service stops.	Traffic is transferred to healthy servers; the service continues without interruption.
As traffic increases, the server slows down.	Capacity is increased by adding new servers; the address the client connects to stays the same.
The service is stopped for updates and maintenance.	Servers are taken into maintenance one at a time; traffic goes to the others.
Servers with different capacities receive equal load.	By assigning weights, more traffic is sent to the more powerful server.
Servers are directly exposed to the internet.	The client connects only to the load balancer; TLS termination and security checks are performed in front.
The state of the traffic cannot be seen.	All traffic is logged and monitored from a single point.

L4 and L7 Load Balancing

Load balancers can look at traffic at two different depths:

Layer	What it looks at	What it can do
L4 (transport)	IP address, protocol (TCP/UDP) and port	Distributes connections or packets quickly; does not see the content of the request.
L7 (application)	The content of the request: HTTP headers, path, cookie	Routes based on content, terminates TLS, modifies the request and passes it through security inspection.

The three vService types in TR7 fit into these two layers as follows:

vService type	How it handles traffic	Typical use
Network	Works at L3/L4; distributes TCP - L4, UDP - L4 or ANY - L3 traffic without terminating the connection.	DNS, NTP, Syslog, SIP, RADIUS
L7 TCP	Carries TCP-based traffic but terminates the connection on TR7; it does not parse the application protocol (SMTP, SQL, LDAP…), it only reads connection information such as the SNI in the TLS handshake and the RDP cookie.	SMTP, LDAP/LDAPS, SQL, RDP, MQTT
HTTP	Full L7: parses the request as HTTP.	Websites, APIs, gRPC, WebSocket

L7 TCP carries the same kind of traffic as the TCP - L4 protocol of the Network vService; the difference is that the connection is terminated on TR7. Thanks to this, the following features, which are not available in the Network vService, are used in L7 TCP:

• SSL/TLS termination: By selecting TCP + TLS in the frontend protocol (SSL/TLS termination), the certificate and the TLS Security Profile are applied on TR7 (e.g. LDAPS, SMTPS).
• Content-based routing: Conditional Backend Services (Content Switching) and Actions based on SNI, source IP, port, SSL cipher/version and RDP cookie.
• Profiles: Log, Notification, Timeout and vService Limits; these profiles are not used in the Network vService.
• Protection and resource management: L7 DDoS & Threat Protection, QOS and Bandwidth.

The Network vService, on the other hand, is the type with the lowest latency because it does not terminate the connection, and it also carries UDP and ANY - L3 traffic; L7 TCP is only for TCP traffic.

Load Balancer in TR7

In TR7, load balancing is set up with a few basic objects. All configuration is done from the web interface; writing code or scripts is not required. The equivalents of the objects in the names used in the industry (I'm coming from F5, Citrix, Kemp or HAProxy; what are the TR7 equivalents of concepts like virtual server, pool, node, monitor and iRule?):

In TR7	What it does	Industry name
vService	Receives traffic on an IP:port; determines its target, security layers and profiles.	virtual server / listener
Backend Service	A single target server (address:port) that the traffic reaches.	pool member / real server
Backend Group	Gathers servers that provide the same service into a single structure with common settings.	pool / service group
Health Checks profile	Periodically measures the health of the Backend Services.	monitor / health check
Algorithm	Determines which Backend Service the request goes to.	load balancing method
Persistence	Keeps the requests of the same client on the same Backend Service.	persistence / session affinity
Condition + Action	"In this case, do that" rules: redirection, header editing, blocking, error page…	policy / iRule
Profile	Reusable settings that are defined once and assigned to many vServices or Backend Services (Health Checks, Compression, Cache, Logs…).	profile

Load Balancer - ADC distributes across servers within a data center. Distribution between data centers and geographic distribution are done at the DNS layer with GTM, which is a separate product.

Common Misconceptions

• "I have a single server, a load balancer is not for me." Even with a single server, the load balancer stands in front of the server: it provides TLS termination, security inspection, a maintenance page and logging. When a second server is added, it scales without the structure breaking.
• "A load balancer and GTM do the same job." A load balancer decides within a data center, after the connection is established. GTM, on the other hand, decides between data centers, at the moment of the DNS query. The two can be used together.
• "If I don't assign a health check, the server is considered disabled." On the contrary: the health of a Backend Service whose Health Check field stays at the default No Check value is not monitored (a dark gray power icon appears in the list instead of a status dot); even if the server has crashed, it continues to receive traffic.
• "A load balancer only distributes traffic." At L7 it reads the request: it routes based on content, compresses, caches and passes it through security inspection.

How it is done in the documentation

• Load Balancer - ADC · What Is Load Balancer - ADC?
• Load Balancer - ADC · How Does It Work?
• Load Balancer - ADC · Object Model
• Load Balancer - ADC · Difference from GTM

Related questions

• I only have one server; would I benefit from using TR7 Load Balancer?
• What is a vService?
• Is a load balancer different from a reverse proxy?
• What is the difference between Load Balancer and GTM; which one should I use?