Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
How many types of vService does TR7 have, and how do they differ?
Short answer
TR7 has three types of vService: HTTP, L7 TCP and Network. HTTP reads the request as HTTP; it makes decisions according to the path, header and cookie, and the modules such as WAF, AGS, Cache and Compression are all in this type. L7 TCP accepts the connection on TR7 for non-HTTP TCP applications (database, RDP, LDAP, SMTP…); it can terminate TLS and routes according to connection information such as SNI, source IP and port. Network does not terminate the connection; it distributes TCP, UDP and IP traffic without a port concept at the L3/L4 level. The type is selected from the Type field when the vService is created and cannot be changed later.
How Does It Work?
The three types differ in the level at which they read the traffic:
- HTTP: TR7 accepts the connection of the client and reads the request as HTTP: the method, path, headers and cookies are seen. Routing, security and content operations are performed at the request level; then TR7 opens its own connection to the Backend Service.
- L7 TCP: TR7 again accepts the connection of the client and opens a separate connection to the Backend Service; however, the content of the flow is not interpreted as HTTP. Decisions are made according to the information of the connection: source IP, destination port, SNI in TLS, TLS version and cipher suite, RDP cookie.
- Network: The connection is not terminated on TR7. A Backend Service is selected at the first packet of the flow, and the subsequent packets of the same flow are forwarded to the same Backend Service; the content is not looked at. The path through which the response returns to the client is determined by LB Mode.
Comparison
The rows below are taken from the Feature / Capability Comparison table in the docs; the values are identical.
| Feature / Capability | HTTP | L7 TCP | Network |
|---|---|---|---|
| Operating layer | L7 (HTTP) | L7 (TCP stream) | L3 / L4 (packet level) |
| Protocol support | HTTP / HTTPS / HTTP/2 / HTTP/3 | TCP | TCP / UDP / ANY |
| Connection termination | ✓ | ✓ | ✗ |
| SSL/TLS Offloading / Termination | ✓ | ✓ | ✗ |
| Conditional Backend Services (Content Switching) | ✓ | ✓ | ✗ |
| WAF · AGS · Cache · Compression | ✓ | ✗ | ✗ |
| Load balancing algorithms | ✓ (13) | ✓ (10) | ✓ (7, packet level; 2 in ANY - L3) |
| Session persistence | ✓ (Cookie / Hash / SAM) | ✓ (Hash) | ✓ (L4 Persistence) |
| Example use | Web applications | RDP, SQL, LDAP, SMTP, MQTT | DNS, Syslog, RADIUS, SIP |
Their counterparts in the interface:
| HTTP | L7 TCP | Network | |
|---|---|---|---|
| Frontend Protocol options | HTTP, HTTP/1.1, HTTP/2 (both with an optional HTTP/3 badge), HTTP → HTTPS | TCP, TCP + TLS | TCP - L4, UDP - L4, ANY - L3 in the Protocol field |
| Available only in this type | Virtual Hosting, Debug, Trusted Proxy, X-Forwarded-For, SAM | RDP Cookie algorithm | LB Mode, Port Range, SIP Persistence |
Comparison with all rows: What are the feature differences between HTTP, L7 TCP and Network vServices?
In TR7
- Selection: The type is selected from the Type field in the form opened with Load Balancer → Load Balancer vService List → Add; the default is HTTP. The selected type determines which fields appear in the form and in the Details panel.
- Editing: While an existing vService is being edited, the Type field is locked; for a different type, a new vService is created (Can I change the type of a vService later?).
- Appearance in the list: The type selected as L7 TCP in the form appears as TCP in the Type column of the vService list. HTTP vServices with Virtual Hosting defined have a cloud icon in their Type cell.
Common Misconceptions
- "L7 TCP and Network are the same, both carry TCP." L7 TCP accepts the connection on TR7; it can terminate TLS and route according to SNI. Network forwards the packets without terminating the connection (What is the difference between L7 TCP and Network (TCP - L4); aren't they both TCP?).
- "L7 TCP is sufficient for an HTTPS site." If L7 TCP is selected for HTTPS web traffic, WAF, Cache, header editing and path-based routing cannot be used; the HTTP type is selected for websites (Should I use an HTTP vService or an L7 TCP vService for my HTTPS site?).
- "I'll change the type later." The type is selected only at creation time; if a different type is needed, a new vService is created.
How it is done in the documentation
