FAQ
Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform

English

Türkçe

English

Türkçe

Appearance

Basic

I only have one server; would I benefit from using TR7 Load Balancer? ​

Short answer

Yes. Even with a single server, TR7 stands in front of the server without exposing it directly to the internet: TLS termination and security checks are performed in front, response headers are edited without touching the application through actions such as Manage HTTP Security Headers, a custom page is shown with Show Content for Traffic Manager Errors instead of a browser error when the server does not respond or is in maintenance, access logs are sent to the SIEM with the Logs profile, and all traffic is monitored from the Dashboard. When a second server is needed, it is added without the architecture changing.

How Does It Work? ​

The client connects only to the vService address on TR7. The vService processes the request and forwards it to the single Backend Service; the real address of the server is not visible from outside.

Client → TR7 · vService 203.0.113.10:443 → Backend Service
TR7 · vService
TLS termination
Security inspection
Header editing
Cache and compression
Error / maintenance page
Logs, SIEM and monitoring
Backend Service
192.0.2.11:80
Only runs the application; can be closed to direct access.

What Does It Provide with a Single Server? ​

Publishing the server directlyBehind TR7
Certificate and TLS settings are managed on the server.TLS is terminated on the vService; the certificate is managed on TR7, and the TLS version and cipher settings are managed with TLS Security Profiles.
The server is directly exposed to the internet.Requests are filtered on TR7 before they reach the server: access restriction with the Source IP condition (IP, country, ASN) and the Block action, request volume limits with L7 DDoS Protection; if licensed, WAF - WAAP and AGS - AAM.
Security headers are added one by one in the application code or on the web server.The Manage HTTP Security Headers action adds headers such as HSTS, Content-Security-Policy and X-Frame-Options to responses; the Remove Server Fingerprints option clears the Server and X-Powered-By headers from the response.
A code change is required for the headers the application expects (e.g. X-Forwarded-Proto).With the Add HTTP Header, Set HTTP Header and Delete HTTP Header actions, request and response headers are added, changed or deleted on TR7.
When the server crashes, the user sees a browser error.For errors such as 503 generated by TR7, a custom page is shown with Show Content for Traffic Manager Errors.
During maintenance, the site appears unreachable.The Backend Service is put into Maintenance Mode; the maintenance page prepared under Content Pages is shown to users with the Show Content for Traffic Manager Errors action.
Access logs stay on the server; an agent is installed on the server to send them to the SIEM.The Logs profile sends access logs to syslog/SIEM servers in formats such as CEF or TR7 JSON; on a vService with a WAF profile, WAF fields are also added to the log.
When the address or certificate of the server changes, clients are affected.The client always connects to the same vService address; the change behind it is not visible.
Compression and caching are the server's job.On the HTTP vService, the Compression and Cache profiles do this job on TR7; the load on the server decreases.
The state of the traffic cannot be seen.It is monitored with the vService Dashboard, Live Stats and HTTP Logs screens.
When capacity is not enough, the architecture changes.A second server is put into service by adding it to the target list; nothing changes on the client side.

Starting with a Single Server in TR7 ​

  1. The server is defined. The server is added as a Backend Service under Load Balancer → Backend Services. If the number of servers will increase in the future, defining it as a Backend Group from the start is recommended; adding a new server then means adding a row (address:port) to the server list of the group.
  2. A health check is assigned. A Health Checks profile is selected in the Health Check field of the Backend Service form. The default of the field is No Check; in this case the server is considered healthy even if it does not respond.
  3. A vService is created. The Backend Service is added to the Default Backend Services list of the vService. The IP the vService will listen on must have been added to an interface beforehand under Network → Interfaces (What are the most basic steps to set up my first vService?).
  4. An error page is defined (optional). The page to be shown when the server cannot be reached is first prepared with Load Balancer → Profiles → Content Pages → Add, and then attached to the vService with the Show Content for Traffic Manager Errors action (Can I show a custom page for 503/502/504 errors generated by TR7 itself?).

Common Misconceptions ​

  • "A load balancer is only needed for more than one server." A load balancer is also the security and delivery layer in front of the server; these functions also work with a single server.
  • "When TR7 is placed in front, nothing changes on the server." The server now sees requests coming from the IP address of TR7. If the real client IP is wanted in the logs, X-Forwarded-For or SNAT → Use Client IP is used: Why do my backend servers see all requests as coming from TR7's IP?
  • "WAF is included in Load Balancer." WAF - WAAP is a separately licensed product. Load Balancer - ADC on its own offers access controls such as IP and country restriction with conditions and actions.
  • "Security headers are also added to pages generated by TR7 itself." Manage HTTP Security Headers is applied only to responses returned from the Backend Service; the blocking, redirection and error pages generated by TR7 are not affected by this action.

How it is done in the documentation

Related questions