Deployment Methods

Deployment Methods is the section that describes the ways in which TR7 is placed in a network. The same device is added next to the existing network with a single arm, sits between the publishing network and the server network, or is placed on the traffic path as a bridge; which deployment is chosen is determined by the structure of the network and the requirements of the application.

Each deployment is a different answer to the same two questions: where TR7 sits in the network and whom the Backend Service sees as the source of the connection. The pages in this section introduce the deployments through these two questions and set their strengths and requirements side by side; step-by-step installation is not the subject of this section.

10

Deployments

From the single-arm setup to the bridge deployment and direct response

2

Core questions

Where TR7 sits in the network; whom the server sees as the source

Per Service

Used together

In HTTP and L7 TCP vServices, the source address behavior is selected per Backend Service; different services are set up with different deployments

L4 and L7

Every vService type

A suitable deployment for HTTP, L7 TCP and Network vServices

Two Core Questions

Where does TR7 sit in the network? Network position

TR7 is added next to the existing network with a single arm (One Arm Topology), separates the publishing network and the server network with two arms (Two Arm Topology), or is placed on the traffic path as a bridge (Inline Mode).

Whom does the server see as the source? Source address

When TR7 connects to the server with its own address, the response returns to TR7 and no additional arrangement is needed in the network. When it connects to the server with the client's address (Use Client IP), the response must be brought back to TR7; Gateway Mode, Gateway Mode - Spoofing and Route Mode are three separate ways of doing this.

Deployments Side by Side

Deployment	vService type	Source seen by the server	What brings the response to TR7	Where the change is made
One Arm Topology	HTTP, L7 TCP, Network (SNAT mode)	TR7's address	The response returns to TR7's address	TR7 only
One Arm Topology - Routed Backend	HTTP, L7 TCP	TR7's address	The response returns to TR7's address	TR7 (the route to the server networks)
Two Arm Topology	HTTP, L7 TCP, Network (SNAT mode)	TR7's address in the server network	The response returns to TR7's address	TR7 and the network design (two separate networks)
Two Arm Topology - Routed Backend	HTTP, L7 TCP	TR7's address in the transit network	The response returns to TR7's address	TR7 (the route to the server networks)
Gateway Mode	HTTP, L7 TCP	The client's address	The server's default gateway (TR7)	Server (default gateway)
Gateway Mode - Spoofing	HTTP, L7 TCP	The client's address	TR7 (Spoofing)	TR7
Route Mode	HTTP, L7 TCP	The client's address	A routing rule in the network	Firewall or router
Inline Mode	HTTP, L7 TCP	The client's address	TR7 (Bridge interface and Spoofing)	TR7 and the connection path
Direct Server Return	Network	The client's address	The response does not pass through TR7	Server (acceptance of the vService address)

Multi-Tenant Topology is outside this table: it does not describe how an environment is connected to the network, but how multiple environments sit side by side on the same device in separate route tables, and it is used together with the deployments above.

Same Setting, Three Return Paths

In Gateway Mode, Gateway Mode - Spoofing and Route Mode, the basic setting on the TR7 side is the same: Use Client IP is selected in the SNAT field of the Backend Service, and TR7 connects to the server with the client's address. What distinguishes the three deployments from one another is how the response that the server sends to the client's address is brought back to TR7. In all three, the client is in a different network from the server. Inline Mode also uses the same setting; the difference is that the client connects not to the vService address but to the server's own address. In all four deployments, the request and the response pass through TR7; the server sees the connection from the client's real address.

Gateway ModeThe server provides the return path: the server's default gateway is TR7.

Gateway Mode - SpoofingTR7 provides the return path: the server's gateway setting stays the same; Spoofing is additionally enabled in the Backend Service, and TR7 receives the response in the server's network.

Route ModeThe network provides the return path: a rule on the firewall or router routes the response to TR7.

Inline: Not a Single Mode, but an Architecture

In the industry, an inline (or transparent) deployment is the architecture that sits on the traffic path and lets the server see the connection from the client's real IP address. TR7 does not limit this architecture to a single mode; it offers it through four different deployments depending on the state of the network: Gateway Mode, Gateway Mode - Spoofing, Route Mode and Inline Mode. In all four, the server sees the client's real address; the difference between them is how the return traffic is brought to TR7. The name Inline Mode belongs to the bridge setting in the interface; this deployment is also known in the industry as bridge mode.

Which Deployment Should Be Chosen?

Need	Suitable deployment
Adding load balancing and security layers to a running network without changing its design	One Arm Topology
Serving servers in different networks with the same single-arm setup	One Arm Topology - Routed Backend
Separating the servers from the client network and publishing from a single point between the two networks	Two Arm Topology
Reaching servers spread across different networks through a single transit arm while the publishing network stays separate	Two Arm Topology - Routed Backend
The server knowing the client's address in an HTTP application	The X-Forwarded-For header or Proxy Protocol in any deployment set up with an HTTP vService
The server seeing the client's address as the connection source; the server's gateway can be changed	Gateway Mode
The same result; the server's settings cannot be touched, TR7 is in the same network as the server	Gateway Mode - Spoofing
The same result; the return path is to be defined at the point managed by the network team	Route Mode
Clients continuing to access the application at the server's own address	Inline Mode
TCP and UDP services whose response is much larger than the request or that are latency-sensitive	Direct Server Return
Keeping multiple customers, environments or security zones in separate network spaces on the same device	Multi-Tenant Topology

Header First, Deployment Second

To pass the client address to the Backend Service, the X-Forwarded-For header should be used first in HTTP vServices, and Proxy Protocol in HTTP and L7 TCP vServices when the Backend Service supports it; these two methods do not touch the network design. Deployments that preserve the client address in the connection itself are mainly for TCP applications where these methods cannot be used.

Security Layers and vService Type

The vService type, not the deployment, determines which layers are used.

vService type	Load balancing	TLS termination	Bot/DDoS	WAF	AGS
HTTP vService	Yes	Yes	Yes	Yes	Yes
L7 TCP vService	Yes	Yes	Yes	No	No
Network vService	Yes	No	No	No	No

In the table, Bot/DDoS refers to the L7 protection module enabled on the vService. In L7 TCP vServices, the protections of this module that work at the connection level are applied; in HTTP vServices, the protections that work at the request level are applied in addition.

Terms

Name in this documentation	Names used in the industry
One Arm Topology	One-arm mode
Two Arm Topology	Two-arm mode
Gateway Mode, Gateway Mode - Spoofing, Route Mode	Inline mode, transparent mode (in the sense of preserving the client address); routed mode for Gateway Mode
Inline Mode	Bridge mode, transparent bridge
Direct Server Return	DSR, direct routing

Two Settings with the Same Name

Two names in this section collide with the name of another setting in the interface. The Route Mode option in the LB Mode field of the Network vService form is the distribution method for L4 traffic and is different from the Route Mode deployment here. The Gateway Mode field in the AGS module, on the other hand, determines the mode in which a vService works as an access gateway and is not related to the Gateway Mode deployment here.

Deployment Pages

One Arm Topology

One arm, one network: the deployment added next to the existing network.

→

One Arm Topology - Routed Backend

The deployment in which servers in different networks are reached through routing with a single arm.

→

Two Arm Topology

The two-arm deployment in which the publishing network and the server network are separated.

→

Two Arm Topology - Routed Backend

The deployment in which servers are reached through routing over a single transit network.

→

Gateway Mode

The server's gateway is TR7; the server sees the real client address.

→

Gateway Mode - Spoofing

Preserving the client address without changing the server's gateway setting.

→

Route Mode

The deployment in which the return path is provided by a routing rule in the network.

→

Inline Mode

Placement on the traffic path with a bridge interface; the application address stays the same.

→

Direct Server Return

The L4 deployment in which the response returns to the client without passing through TR7.

→

Multi-Tenant Topology

Running multiple environments on the same device in separate route tables.

→

Related Pages

Backend Services

Source address selection (SNAT), Spoofing and Proxy Protocol settings.

→

Network vService

LB Mode field: Direct Server Return, Route Mode and SNAT.

→

Route Tables

Placing the arms in separate network spaces.

→

Firewall

Automatically generated rules and forwarding (FORWARD) permissions.

→