What are the most basic steps to set up my first vService?

Short answer

First, the IP address on which the vService will listen is added to an interface on the Network → Interfaces screen. Then the server to which the traffic will go is added as a Backend Service, and a Health Checks profile is selected for it; if HTTPS publishing will be done, the certificate is uploaded under SSL/TLS Certificates. Finally, the vService is created: this IP, the port and the protocol are selected in the Frontend row, the certificate is attached, the Backend Service is added to the Default Backend Services list, and the vService is saved. After the save, the DNS record of the domain name is pointed to the IP address of the vService.

Problem: What Is Required to Publish an Application Through TR7?

Publishing an application through TR7 depends on four parts being defined together: the IP address on which the vService will listen, the server to which the traffic will go (Backend Service), the vService that receives the traffic, and the certificate for HTTPS publishing. The IP address is not typed in the vService form; it is only selected from among the IPs added to TR7's interfaces; if no IP has been added, the address on which the vService will listen does not appear in the list. If one of the parts is missing, the traffic does not reach the server or the HTTPS connection cannot be established, even if the vService is saved. Since the parts depend on one another, creating them in the right order shortens the setup.

Solution

Publishing an HTTPS Web Application with an HTTP vService

• How it works The vService receives the client's HTTPS connection on the IP added to the interface, terminates TLS and forwards the request to the healthy Backend Service in the Default Backend Services list.
• Where it is openedNetwork → Interfaces; Load Balancer → Backend Services and Load Balancer vService List; for the certificate, Certificates & PKI → SSL/TLS Certificates
• Requirement A TR7 interface connected to the network where the vService IP will be located, TR7 being able to reach the Backend Service over IP, a valid certificate for the domain name
• vService type HTTP
• Backend Service side No change is required; the server receives the requests from TR7's IP

Step-by-Step Configuration

The menus are reached through the Configuration Menu, which is opened by clicking the TR7 logo at the bottom left.

1

Adım 1 Open the IP add form

On the Network → Interfaces screen, the interface connected to the network where the vService IP will be located is right-clicked and Add IP is selected (the same form is also opened with Actions → Add IP). If the IP on which the vService will listen is already defined on the interface, steps 1–3 are skipped.

2

Adım 2 Enter the interface, the IP and the CIDR

In the IP Interface field, it is checked that the correct interface is selected; if the form was opened from the Actions menu, the first interface in the list comes selected. Ip Type is Interface IP in a single-device setup; in a cluster setup, VIP is selected so that the vService is published redundantly (What is a VIP, and when is it needed?). The address (e.g. 203.0.113.10) and the CIDR (default 24) are entered in the IP table; IP Status stays at the default Enabled.

3

Adım 3 Save the IP

The Add IP button is clicked. In the interface list, the address first appears briefly as Absent in system (red), and as Up (green) once the configuration is applied.

4

Adım 4 Open the Backend Service form

The Load Balancer → Backend Services → Add steps are followed.

5

Adım 5 Enter the name and the address

Backend Service Name and Address (IP address or domain name and port, e.g. 192.0.2.11 : 80) are entered; the other fields are optional. If there is more than one server providing the same service, each one is added as a separate Backend Service or they are gathered under a single Backend Group.

6

Adım 6 Select a health check

A profile is selected from the Health Check field in the same form. The default is No Check; in this case, the server continues to receive traffic even if it crashes. If there is no suitable profile, a new profile is created with the add button next to the field without leaving the form: in the profile form, Name is entered and Check Type is selected (HTTP (default) or HTTPS for web applications, TCP for a port check only); the type cannot be changed after the save. Period, Timeout, Required Successes and Required Failures come as 1 s / 1 s / 3 / 2 by default.

7

Adım 7 Save the Backend Service

The Add button at the bottom of the form is clicked.

8

Adım 8 Open the certificate form and enter the certificate

If HTTPS publishing will be done, the Certificates & PKI → SSL/TLS Certificates → Add steps are followed; a name is given to the certificate, Type is selected, and the organization's certificate, private key and, if any, intermediate certificate chain are entered. The certificate cannot be created from inside the vService form; therefore it is added before the vService.

9

Adım 9 Save the certificate

The Add button at the bottom of the form is clicked.

10

Adım 10 Open the vService form

The Load Balancer → Load Balancer vService List → Add steps are followed. Name is entered; Type comes as HTTP by default, and Status comes as Enabled by default.

11

Adım 11 Define the Frontend rows and attach the certificate

A row is added to the Frontend table with the (+) icon. The IP added in step 3 is selected from the Frontend IP list, 443 is entered in the Port field, and HTTP/1.1 or HTTP/2 is selected from the Encrypted (HTTPS) group in the Protocol field. If a second row is opened for port 80 and HTTP → HTTPS in the Redirect group is selected, requests arriving unencrypted are redirected to HTTPS. The certificate saved in step 9 is selected from the Certificate field that appears when the HTTPS row is added.

12

Adım 12 Add the Backend Service as the target

The Backend Service (or Backend Group) saved in step 7 is added to the Default Backend Services list. If the Backend Service does not exist yet, it can be created with the Backend service button in the selector without leaving the form. Algorithm is Round Robin by default.

13

Adım 13 Save

The Save button is clicked. If Status is Enabled, the vService starts receiving traffic as soon as the configuration is applied; the progress of applying the change is followed from the sync indicator at the bottom right of the screen (Syncing Traffic manager... → All synced). Then the DNS record of the domain name is pointed to the IP address added in step 3.

Verification

1Status colorsTR7 side

The Status circle in the vService list and the Health indicator in the Backend Services list are checked.

ExpectedvService: green · Backend Service: OK, green

If the vService is red, no Backend Service is healthy, the frontend IP address or interface cannot be found, or there is a configuration error.

2Access from the browserClient side

The site is opened with the domain name; it is checked that it is redirected to HTTPS when entered with http:// and that the certificate appears correctly. The traffic is monitored from the Dashboard and Live Stats screens of the vService.

Commandcurl -I http://www.example.com/

ExpectedHTTP/1.1 301 · location: https://www.example.com/

Common Mistakes

• Adding the IP to the wrong interface. When the IP add form is opened from the Actions menu, the first interface in the list comes selected; an IP added without checking the IP interface field is defined on the wrong network, and traffic does not arrive.
• Leaving Default Backend Services empty. The vService is saved, but the requests cannot go to a Backend Service; TR7 returns 503.
• Not assigning a health check. If the Backend Service stays with No Check, it continues to receive traffic even when it crashes.
• Leaving the certificate for later. The certificate cannot be created in the vService form; for HTTPS, it is first uploaded under Certificates & PKI.
• Selecting an HTTPS protocol but not selecting a certificate. Saving is not prevented, but the row without a certificate listens as unencrypted HTTP, and the HTTPS connection cannot be established.
• Thinking that the IP is also turned off when the vService is turned off. When the vService is disabled, the IP continues to respond on the network; the Network → Interfaces screen is used to remove the IP.
• Expecting the client IP in the server logs. The server sees TR7's IP by default: Why do my backend servers see all requests as coming from TR7's IP?

How it is done in the documentation

• Add IP Address · How to Add?
• Backend Services · How to Add?
• SSL/TLS Certificates · How to Add?
• HTTP vService · How to Add?
• Load Balancer - ADC · Typical Setup Flow

Related questions

• During setup, should I create the Backend Service or the vService first?
• Why can't I type the Frontend IP manually; what should I do to use an IP that is not in the list (e.g. IPv6) on a vService?
• How do I upload my certificate to TR7; which formats are supported?
• How do I redirect HTTP to HTTPS?