What is a vService?

Short answer

A vService is the service definition in TR7 that receives traffic on an IP address and port. It passes every incoming request through the defined rules and profiles, and then forwards it to a healthy Backend Service or Backend Group according to the algorithm. It is the TR7 equivalent of the concept known in the industry as a virtual server or listener; publishing an application through TR7 always starts with defining a vService.

How Does It Work?

The client does not see the servers behind it; it sees only the address of the vService. In HTTP and L7 TCP vServices, a request goes through the following stages in outline:

1. Receiving: The request is received on the IP:port the vService listens on.
2. TLS termination: For encrypted connections, the TLS session is decrypted on TR7.
3. Security checks: If enabled, WAF (HTTP only) and L7 DDoS & Threat Protection (including IP reputation and bot checks) are applied.
4. Actions: The Actions added to the vService run in their order in the list (header editing, redirection, blocking…).
5. Target selection: The Conditional Backend Services (Content Switching) rules are evaluated from top to bottom, and the first matching rule determines the target; if none matches, Default Backend Services is used. On an HTTP vService, if AGS is enabled, a client without a session is first taken into the login flow.
6. Backend Service selection: A healthy Backend Service in the target is selected according to the algorithm and the persistence setting.
7. Response: The response of the Backend Service is passed through the response actions and returned to the client.

Detailed order of the stages: Which stages does a request go through inside TR7 before it reaches the backend?

Network vServices, on the other hand, do not terminate the connection; they forward packets directly to a Backend Service according to the selected LB Mode. This type does not have TLS termination, WAF, actions or content-based routing.

What Does a vService Bring Together?

Part	What it defines
Frontend	On which IP:port and in which protocol the traffic is received, and the SSL/TLS behavior (Frontend IP, Protocol, Certificate)
Target	The Backend Services and Backend Groups the traffic is forwarded to (Default Backend Services, Conditional Backend Services)
Rules	Condition + Action pairs and content-based routing
Profiles	Profiles defined once and assigned to many vServices, such as Cache, Compression, Logs, Reports, Notifications, Timeouts and vService Limits
Security	Attaching the WAF, AGS and L7 DDoS & Threat Protection layers

vService Types

The type is selected in the Type field when the vService is created and determines which features can be used on that vService.

Type	How it works	What for	Example
HTTP	L7; parses the request as HTTP	Websites, APIs, web applications; the widest feature set	HTTPS, HTTP/2, HTTP/3, WebSocket, gRPC
L7 TCP	Carries TCP traffic by terminating the connection on TR7; does not parse the application protocol	Non-HTTP TCP applications; when SSL/TLS termination and SNI-based routing are needed	RDP, SQL, LDAP, SMTP, MQTT
Network	L3 / L4; distributes without terminating the connection	UDP and raw IP services, minimum latency	DNS, NTP, Syslog, SIP, RADIUS

vService in TR7

• Prerequisite: The IP address the vService will listen on is first added to an interface under Network → Interfaces; in the vService form, this IP is only selected from the list.
• Creation: It is added with Add on the Load Balancer → Load Balancer vService List screen. The list shows the Status, Type, WAF, Name and IP columns of each vService; the IP column shows the IP:port addresses the vService listens on.
• Monitoring: For each vService, a separate monitoring screen is opened through the Left Monitor Panel: Dashboard, Load Balancer Management, logs, Live Stats and Report.
• When disabled: The vService stops receiving traffic, but the IP it listens on stays on the network; the Network → Interfaces screen is used to remove the IP.

Common Misconceptions

• "A vService is a server." A vService is a service definition; the servers that run the application are the Backend Services. The vService receives the traffic and distributes it to them.
• "Each site needs a separate IP." On HTTP vServices, with Virtual Hosting, more than one vService separated by the Host header or SNI is published on a single IP:port.
• "I'll change the type later." The type of a vService cannot be changed after it is created; if a different type is needed, a new vService is created.
• "L7 TCP and Network are the same, both are TCP." L7 TCP terminates the connection on TR7; thanks to this, SSL/TLS termination, SNI-based routing, and the use of actions and profiles are possible. Network, on the other hand, forwards packets without terminating them.

How it is done in the documentation

• vService · What Is vService?
• vService · vService Types
• vService · Feature / Capability Comparison
• vService · How Does It Work?

Related questions

• How many types of vService does TR7 have, and how do they differ?
• Which vService type should I choose for my application?
• Can I change the type of a vService later?
• What are the most basic steps to set up my first vService?