What is the difference between L7 TCP and Network (TCP - L4); aren't they both TCP?

Short answer

Both carry TCP traffic, but they work differently. L7 TCP accepts the connection on TR7: it establishes two separate connections, one with the client and one with the Backend Service; this way, TLS termination, routing by SNI, Conditional Backend Services, conditions and actions, L7 DDoS & Threat Protection, and profiles such as LOG, Timeout and vService Limits can be used. Network (TCP - L4) does not terminate the connection; it forwards the flow to the Backend Service at the L3/L4 level, does not look at the content, and offers LB Mode (Direct Server Return, Route Mode, SNAT) and Port Range.

How Does It Work?

L7 TCP

Client ⇄ TR7 (1st connection)
TR7 ⇄ Backend Service (2nd connection)

TR7 reads the connection information: TLS, SNI, source IP, port.

Network, TCP - L4

Client ⇄ Backend Service (single flow)
TR7 forwards the packets

The content is not read; the return path depends on LB mode.

• L7 TCP: The client's TCP connection is accepted on TR7, and TR7 opens its own connection to the Backend Service. The connection information (TLS, SNI, source IP, destination port, RDP cookie) can be used in rules and in routing.
• Network (TCP - L4): The connection remains a single flow between the client and the Backend Service. TR7 selects the Backend Service on the first packet of the flow and forwards the packets; whether the response passes through TR7 depends on the LB mode.

Comparison

The values are the same as in the vService · Feature / Capability Comparison table in the docs.

	L7 TCP	Network (TCP - L4)
Operating layer	L7 (TCP stream)	L3 / L4 (packet level)
Connection termination	✓ (two connections)	✗ (single flow)
SSL/TLS Offloading / Termination	✓ (Protocol: TCP + TLS)	✗
SNI-based routing	✓	✗
Conditional Backend Services (Content Switching)	✓	✗
Conditions / Actions	✓	✗
L7 DDoS & Threat Protection	✓	✗
Profile: LOG, SSL security, Notification, Report, vService limits, Timeout	✓	✗
QOS, Bandwidth	✓	✗
Health Check	✓	✓ (not applied in Port Range mode)
Load balancing algorithms	✓ (10; including RDP Cookie)	✓ (7; including Source Hash, Destination Hash, Locality-Based Least-Connection)
Session persistence	✓ (Hash)	✓ (L4 Persistence, by source IP)
LB Mode (Direct Server Return / Route Mode / SNAT)	✗	✓
Frontend port range	✓	✓ (with the Port Range switch)

Behaviors specific to these two types that have no separate row in the docs table:

	L7 TCP	Network (TCP - L4)
Source IP seen by the Backend Service	By default (SNAT: Default), TR7's Interface IP on the interface leading to the server in the Backend Service's route table, in the same subnet as the server (or the gateway); for the client IP, Use Client IP or Proxy Protocol	Depends on LB mode: the client's IP with Direct Server Return and Route Mode, the SNAT IP with SNAT
Effect of saving	The reload is uninterrupted for most changes; a change in some fields such as QOS and Buffer Size restarts the vService	Each save (including a name change) restarts the vService
Request / connection records	TCP Logs	There are no TCP Logs; connection and traffic statistics are monitored from the vService monitoring screens

Which One Should I Choose?

Your situation	Type
I want to terminate TLS on TR7 and send traffic to different servers by SNI	L7 TCP
RDP server farm; I want to keep the session on the same server with the RDP cookie	L7 TCP (RDP Cookie)
Blocking or connection limiting by source IP is needed	L7 TCP (L7 DDoS & Threat Protection, Actions)
The server must see the client's real IP in the connection; TR7 is on the return path	Network (Route Mode)
Very high volume; responses should bypass TR7	Network (Direct Server Return)

Common Misconceptions

• "Since both are TCP, they do the same job." L7 TCP accepts the connection on TR7, Network forwards the packets; the features that can be used differ greatly accordingly.
• "I can also terminate TLS in Network." Network does not decrypt TLS; encrypted traffic goes to the Backend Service as it is.
• "In L7 TCP, the client IP reaches the server on its own." In L7 TCP, the server sees TR7's IP by default; for the client IP, SNAT → Use Client IP or Proxy Protocol is used on the Backend Service (How do I pass the real client IP for non-HTTP TCP services?).
• "Network is required for a port range." In L7 TCP too, a range can be written directly in the frontend Port field (Can I make a vService listen on a wide port range (e.g. 4000-5000)?).

How it is done in the documentation

• vService · HTTP and L7 TCP (application layer)
• vService · Network (packet level)
• L7 TCP vService · Supported Features
• Network vService · LB Mode

Related questions

• How many types of vService does TR7 have, and how do they differ?
• Is a load balancer different from a reverse proxy?
• Can I load balance an RDP server farm?
• Choosing the LB Mode: how do I decide between DSR, Route Mode and SNAT?