During setup, should I create the Backend Service or the vService first?

Short answer

The recommended order is first the Backend Service, then the vService, because the vService routes the traffic to the Backend Service. However, this order is not mandatory: the Backend Service, the Backend Group and the IP address on which the vService will listen can also be created without leaving the vService form. The only thing that must be ready beforehand is the certificate for HTTPS publishing; the certificate cannot be added from inside the vService form.

How Does It Work?

• The vService points to the target. The vService forwards the traffic to the Backend Services in the Default Backend Services and Conditional Backend Services lists. If the Backend Service is ready, it is selected directly from the list while the vService is being created.
• The vService listens on an IP. The IP is not typed in the vService form; it is selected from among the IPs added to an interface under Network → Interfaces.
• A Backend Service does not receive traffic on its own. It is not used until it is added to the list of a vService.
• Saving is also possible with an empty target. The vService can be saved without any Backend Service selected; in this case, the requests cannot go to a target and TR7 returns 503.

Recommended Order

#	Step	Where
1	The IP on which the vService will listen is added to an interface	Network → Interfaces → Add IP
2	The Backend Service or Backend Group is added; a profile is selected in the Health Check field	Load Balancer → Backend Services / Backend Groups
3	The certificate for HTTPS publishing is added	Certificates & PKI → SSL/TLS Certificates
4	The vService is created; the Frontend, the certificate and Default Backend Services are defined	Load Balancer → Load Balancer vService List
5	TLS and the profiles are applied	vService form (SSL Security, Details)
6	Conditions and actions are defined and added to the vService	Load Balancer → Conditions / Actions
7	DNS is pointed, and the traffic is monitored	DNS; vService Dashboard

This order is the same as the typical setup flow in the docs; the IP adding step is the prerequisite on the network side. Step-by-step description: What are the most basic steps to set up my first vService?

What Can Be Created Without Leaving the Form

Object	From where	Is it created without leaving the form?
Backend Service / Backend Group	The Default Backend Services selector in the vService form (Backend Service, Backend Group buttons)	Yes
Health Checks profile	The add button of the Health check list in the Backend Service form	Yes
Frontend IP	The + Add IP button of the Frontend IP list in the vService form (visible to users with the network configuration permission)	Yes
Certificate	The Certificate field in the vService form	No; it is first added under Certificates & PKI

Common Misconceptions

• "The vService cannot be saved without a Backend Service selected." It can be saved; but requests arriving at a vService without a target receive 503.
• "Once the Backend Service is added, it starts receiving traffic." Unless it is added to the Default or Conditional Backend Services list of a vService, it does not receive traffic.
• "I type the IP of the vService in the form." The IP must have been added to an interface; in the vService form, it is only selected or added to an interface with + Add IP.
• "I upload the certificate in the vService form." The certificate is uploaded beforehand under Certificates & PKI → SSL/TLS Certificates; in the vService form, it is only selected.

How it is done in the documentation

• Load Balancer - ADC · Typical Setup Flow
• Getting Started · The First Setup Path
• HTTP vService · Default Backend Services
• HTTP vService · Frontend IP
• HTTP vService · Certificate

Related questions

• What are the most basic steps to set up my first vService?
• Can I create a new action, health check or SSL profile without leaving the vService form?
• What is a Backend Service?
• Users see "503 Service Unavailable" / "No Available Server"; what should I do?