Do I need to change my network topology to add TR7 (one-arm / two-arm / inline)?

Short answer

In most cases, no. While HTTP and L7 TCP vServices work with the default SNAT setting, the Backend Services receive the request from TR7's IP and also return the response to TR7; therefore it is sufficient for TR7 to be able to reach the servers over IP, and it can be added to the existing network as one-arm. A topology change is required only if the client's IP will be preserved at the connection level (SNAT → Use Client IP) or if Route Mode or Direct Server Return will be used in a Network vService: in these cases, TR7 must be on the return path of the servers (inline) or Spoofing must be used; in Direct Server Return, on the other hand, the servers are prepared in the same L2 network as TR7.

How Does It Work?

Load balancer placement types (general terms common among vendors):

Placement	Meaning	Return traffic
One-arm	The load balancer is connected to the network with a single interface (a single segment); the client-side and server-side traffic pass through the same leg.	Since the server's gateway is not the load balancer, the return of the response to the load balancer is usually ensured with SNAT.
Two-arm	The load balancer has separate interfaces (segments) on the client side and on the server side.	The load balancer is made the gateway of the servers, or SNAT is used.
Inline	The load balancer is on the path of the traffic; the gateway of the servers is the load balancer, and all the traffic going to and returning from the servers passes through the load balancer. Some vendors (e.g. NetScaler) use inline as a synonym for two-arm.	The response returns through the load balancer on its own; therefore the client IP can be preserved without SNAT.
Direct Server Return (DSR)	The request passes through the load balancer, and the response goes directly from the server to the client. On the server, the virtual address is defined on a loopback interface that does not give ARP responses.	The response bypasses the load balancer; it is used only in L4 distribution.

The decisive question is: How will the Backend Service's response return to TR7? If the server receives the request from TR7's IP, the response returns to TR7 on its own and the placement does not matter. If the server sees the client's real IP, the response tries to go directly to the client; TR7 must be on the return path.

Requirement by Scenario

Scenario	Topology requirement
HTTP / L7 TCP, SNAT Default	No change is required; one-arm is sufficient. The source address is the Interface IP, on the same subnet as the server (or as the gateway, if the server is reached via a gateway), of the interface that goes to the server in the Backend Service's route table. In HTTP, the client IP is forwarded with the X-Forwarded-For header.
HTTP / L7 TCP, SNAT Use Device IP	No change is required; the source address is the selected TR7 IP.
HTTP / L7 TCP, SNAT Use Client IP	The response must return from TR7: the server's default gateway is made TR7 (inline), or Spoofing is turned on. With Spoofing, TR7 draws the server's gateway traffic to itself with ARP responses on the network where the Backend Service is located; therefore TR7 must have an interface on that L2 network.
Network vService, SNAT mode	No change is required; the client IP is not forwarded to the server, and the source address is the selected SNAT IP.
Network vService, Route Mode	TR7 must be on the return path as the gateway (inline). The client IP is preserved.
Network vService, Direct Server Return	The Backend Services must be on the same L2 segment as TR7 and must be prepared so that they define the vService address on the loopback and turn off the ARP response for this address; the responses bypass TR7 and go directly to the client.

In TR7

• With the default settings (HTTP / L7 TCP, SNAT Default), no change is required on the server side.
• For access to servers in different network segments, the related interfaces, IPs and Route Tables are defined on TR7; this does not require changing the location of the servers. When TR7 is connected to two networks with separate interfaces, the placement becomes two-arm; with SNAT Default, again no change is required on the server side.
• Mode selection in the Network vService and its requirements: LB Mode.

Common Misconceptions

• "To set up the load balancer, I must make TR7 the gateway of the servers." With the default SNAT, it is not required; this is required only if the client IP will be preserved at the connection level (Use Client IP, Route Mode).
• "Turning on Use Client IP is sufficient." If the response does not return from TR7, the connections are not completed; a gateway or Spoofing setting is required.
• "Two-arm placement preserves the client IP on its own." It does not; even if there are two separate interfaces, with SNAT Default the server sees TR7's IP. The client IP is forwarded with Use Client IP, with the return path passing through TR7, or with X-Forwarded-For in HTTP.
• "To see the client IP, I must always change the topology." In HTTP, X-Forwarded-For forwards the client IP without touching the topology.

How it is done in the documentation

• Backend Services · SNAT
• Backend Services · Spoofing
• Network vService · LB Mode
• Network vService · Flexible Network Topology

Related questions

• Do TR7 and the backends have to be on the same L2 network?
• Is it possible to work without SNAT (transparent mode); what are the requirements?
• Choosing the LB Mode: how do I decide between DSR, Route Mode and SNAT?
• Why do my backend servers see all requests as coming from TR7's IP?