Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What are the feature differences between HTTP, L7 TCP and Network vServices?
Short answer
HTTP has the widest feature set; Virtual Hosting, HTTP/2 and HTTP/3, Debug, WAF, AGS, Cache, Compression, X-Forwarded-For, Trusted Proxy and SAM exist only in this type. L7 TCP shares SSL/TLS termination, Conditional Backend Services, routing by SNI, conditions and actions, L7 DDoS & Threat Protection, QOS, Bandwidth and the LOG, SSL Security, Notification, Report, vService Limits, Timeout profiles with HTTP; the RDP Cookie algorithm exists only in L7 TCP. Network includes none of these features; only it offers LB Mode (Direct Server Return / Route Mode / SNAT), SIP Persistence, and the UDP and ANY - L3 protocols.
How Does It Work?
The differences come from the level at which each type reads the traffic. Since HTTP reads the request as HTTP, it offers all the features based on the path, headers, cookies and body. L7 TCP also accepts the connection on TR7, but does not interpret the content as HTTP; for this reason, it shares the connection-level features (TLS termination, SNI, source IP, port) with HTTP and does not offer the HTTP-specific ones. Since Network does not terminate the connection, it includes no content-based feature; in return, LB Mode, which selects the return path of the response, and UDP / ANY - L3 support exist only in this type.
Comparison
The table gives all the rows of the vService · Feature / Capability Comparison table in the docs in the same order and with the same values; the names in the UI are used for the row names.
| Feature / Capability | HTTP | L7 TCP | Network |
|---|---|---|---|
| Operating layer | L7 (HTTP) | L7 (TCP stream) | L3 / L4 (packet level) |
| Protocol support | HTTP / HTTPS / HTTP/2 / HTTP/3 | TCP | TCP / UDP / ANY |
| Connection termination | ✓ | ✓ | ✗ |
| SSL/TLS Offloading / Termination | ✓ | ✓ | ✗ |
| HTTP/2 · HTTP/3 (QUIC) | ✓ | ✗ | ✗ |
| Virtual Hosting | ✓ | ✗ | ✗ |
| Content-based routing (Content Switching) | ✓ | ✓ | ✗ |
| SNI-based routing | ✓ | ✓ | ✗ |
| Conditions / Actions | ✓ | ✓ | ✗ |
| Conditional Backend Services | ✓ | ✓ | ✗ |
| Debug | ✓ | ✗ | ✗ |
| WAF | ✓ | ✗ | ✗ |
| L7 DDoS & Threat Protection | ✓ | ✓ | ✗ |
| IP Reputation / blacklist-whitelist | ✓ | ✓ (via L7 DDoS & Threat Protection) | ✗ |
| AGS | ✓ | ✗ | ✗ |
| Cache | ✓ | ✗ | ✗ |
| Compression | ✓ | ✗ | ✗ |
| X-Forwarded-For | ✓ | ✗ | ✗ |
| Trusted Proxy | ✓ | ✗ | ✗ |
| Profile: LOG | ✓ | ✓ | ✗ |
| Profile: SSL Security | ✓ | ✓ | ✗ |
| Profile: Notification | ✓ | ✓ | ✗ |
| Profile: Report | ✓ | ✓ | ✗ |
| Profile: vService Limits | ✓ | ✓ | ✗ |
| Profile: Timeout | ✓ | ✓ | ✗ |
| QOS | ✓ | ✓ | ✗ |
| Bandwidth | ✓ | ✓ | ✗ |
| Health Check | ✓ | ✓ | ✓ (not applied in ANY - L3 and Port Range mode) |
| Load balancing algorithms (LB Algorithm) | ✓ (13) | ✓ (10) | ✓ (7, packet level; 2 in ANY - L3) |
| Session persistence (Persistence) | ✓ (Cookie / Hash / SAM) | ✓ (Hash) | ✓ (L4 Persistence) |
| SAM (Session Affinity Manager) | ✓ | ✗ | ✗ |
| RDP Cookie | ✗ | ✓ | ✗ |
| SIP Persistence | ✗ | ✗ | ✓ |
| LB Mode (Direct Server Return / Route Mode / SNAT) | ✗ | ✗ | ✓ |
| Frontend port range | ✓ | ✓ | ✓ (with the Port Range switch) |
| Example use | Web applications | RDP, SQL, LDAP, SMTP, MQTT | DNS, Syslog, RADIUS, SIP |
The UI equivalents of the numbers and names in the table:
- Algorithms: In HTTP, Round robin, Weighted Round Robin, Least Connection, Least Response Time, Least Bandwidth, First, Random, Fastest, Fastest+, Source, URI, URL Param, HDR (13). In L7 TCP, Source, URI, URL Param and HDR from these do not exist, and RDP Cookie exists (10). In Network, Round-Robin, Weighted Round-Robin, Least-Connection, Locality-Based Least-Connection, Weighted Least-Connection, Source Hash, Destination Hash (7); while the Protocol is ANY - L3, only Round-Robin and Weighted Round-Robin can be selected (Which load balancing algorithms are supported?).
- Persistence: In HTTP, New Cookie, Current Cookie, Hash and Session Affinity Manager (SAM); in L7 TCP, Hash; in Network, L4 Persistence and SIP Persistence (Which persistence methods are available?).
- Port range and ANY - L3 in Network: In these two cases, the health check result is not reflected in distribution, LB mode is not applied, and distribution is done only with Round-Robin / Weighted Round-Robin.
In TR7
The selected type determines which fields appear in the vService form and in the Details panel; features that do not exist in that type do not appear in the form at all. For example, the Details panel of a Network vService has only the Report and LB Algorithm boxes, and Report is not saved in this type. The type cannot be changed after it is saved (Can I change the type of a vService later?).
Common Misconceptions
- "L7 TCP also has Cache and Compression." Cache and Compression exist only in HTTP.
- "In Network, the health check always works." While the Protocol is ANY - L3 and while Port Range is on, the health check result is not reflected in distribution; a failed Backend Service continues to receive packets.
- "L7 TCP has the Source (source IP hash) algorithm." Source is not among the 10 algorithms in L7 TCP; persistence by source IP is provided with Hash persistence, by selecting Client IP Address as the key.
- "In Network, the Report profile produces reports." The Report box is listed in Network, but the profile is not saved in this type and no report is produced; reports are produced in HTTP and L7 TCP vServices (in L7 TCP, only with time series charts).
How it is done in the documentation
