Smarter by Design.Simpler for Business
Getting Started
What Is Getting Started?
Getting Started is the introduction page prepared for those who come to the TR7 documentation for the first time. It gathers in a single place which products the platform consists of, which layers a request passes through inside TR7, the main parts of the management interface and the concepts that recur in all the sections. At the end of the page, the reading paths according to the need and how the document pages are read are located.
TR7 combines application delivery, web application and API security, access management and global traffic management in a single platform. All the configuration is done from the web interface; it does not require programming or scripting knowledge.
4
Products
Load Balancer - ADC · WAF - WAAP · AGS - AAM · GTM (Global Traffic Manager); each one is licensed separately
3
Add-ons
L7 Reporting · Bot/DDoS (L7 DDoS) · L4 DDoS Protection; they extend the scope of the products
vService
The Central Object
The listener that meets the traffic; the security layers are enabled per vService
A Quick Look at TR7
TR7 consists of four products; the products undertake the delivery of the traffic, its protection, the control of access and the routing between the data centers. Every product is licensed separately; the products can be purchased on their own or in bundles. A summary of the products and the add-ons is on the Products & Licensing page, and the licensing details are on tr7.com.
Load Balancer - ADC
Meets the traffic on the vService; passes it through TLS termination, conditions and actions and distributes it to the healthy Backend Services.
→
WAF - WAAP
Protects the web applications and the APIs with signatures, structural checking and learned rules.
→
AGS - AAM
Controls access to the application with authentication, MFA, Backend SSO and session protection policies.
→
GTM (Global Traffic Manager)
Gives the DNS response according to the health of the targets, the location of the client and the load of the data centers.
→
Besides the products, three add-ons extend the scope. Basic reporting and standard DDoS protection come with the product licenses; the add-on spreads the reporting or the protection to more vServices or route tables:
L7 Reporting
Converts the vService traffic statistics into PDF, Excel and HTML reports; basic reporting comes with the ADC license.
→
Bot/DDoS
The bot management of the L7 DDoS Protection add-on and the WAF - WAAP product: measurement of volume, source reputation and client behavior.
→
L4 DDoS Protection
Evaluates the traffic entering the route table at the packet and connection layer, before a request is formed.
→
Certificates & PKI, on the other hand, is the certificate and TLS infrastructure that all the products use in common: SSL/TLS certificates, TLS security profiles, certificate authorities and ACME.
How Does a Request Progress in TR7?
The request of a client passes through the layers below until it reaches the Backend Service. Every layer takes effect only where it is enabled; a layer that is not enabled is skipped:
01 · GTMThe address is determinedThe domain name query is answered with the address of the healthy and suitable data center
02 · L4 DDoS ProtectionThe packets are filteredThe traffic entering the route table is checked with the rate, the concurrency and the packet form, before a request is formed
03 · vServiceThe request is metThe request is received by the vService listening on the IP:port; the TLS is terminated
04 · Application SecurityThe request is checkedBot/DDoS, WAF - WAAP and AGS - AAM check the request if they are enabled on the vService
05 · Condition & ActionThe request is shapedThe actions bound to the matching conditions are applied; the distribution algorithm selects the healthy target
06 · DeliveryIt is forwarded to the Backend ServiceThe request is forwarded to the selected Backend Service; the response returns to the client
The vServices of the Network type work on a separate L3/L4 data plane; in this type the request content is not parsed, and the TLS, application security and L7 condition-action stages are not applied.
The equivalent of the path on the screen
The real configuration of a vService on this path is seen on a single screen in the Data Flow Panel diagram on the right of the vService Dashboard.
The Enabling Units
The security layers are not a single switch that is turned on and off across the device; each one is enabled in its own unit:
| Layer | Enabling Unit | Initial State |
|---|---|---|
| WAF - WAAP | Separate for every vService | The protection starts in Learning mode; the traffic is not blocked from the first day, it is learned. Detail: How to Enable WAF? |
| Bot/DDoS | Separate for every vService | The default configuration is created by itself; the initial mode of the three protections is not the same. Detail: How to Enable Bot/DDoS Protection? |
| AGS - AAM | Separate for every HTTP vService | A ready login flow is created; in the default flow there is no path that reaches the Allow step. Detail: How to Enable AGS? |
| L4 DDoS Protection | Ready on every route table | The rule catalog is created together with the route table; even on a table that has not been touched at all, a part of the rules works in enforcement and a part in monitoring. Detail: L4 DDoS Protection |
A First Look at the Interface
The TR7 management interface consists of a few main parts that stay in the same place on every screen:
| Position | Part | What It Is For |
|---|---|---|
| The login screen | Home & Dashboard | The screen that comes when a login is made; it gathers the general status of the device in a single dashboard divided into view tabs. |
| Top | Header Bar | It gathers widgets such as the user information, the language and theme selection, the shortcuts and the live metrics in a single strip visible on every screen; its layout is specific to the user. |
| Left | Left Monitor Panel | It lists the objects in the selected category (vServices, Backend Services, DNS services, interfaces, route tables) with their statuses and one metric; when a row is clicked, the Dashboard of the object opens. |
| Bottom left, the TR7 logo | Configuration Menu | The menu that provides access to the configuration screens from a single point; it is also opened with Alt + M. |
| Bottom left, the Search TR7... field | Search Bar | The search window reached by typing the name of the screens and the records; it is also opened with Alt + T. |
| Bottom right | Web CLI | The in-browser command line with auto-completion. |
The monitoring screens are generally reached over the Left Monitor Panel, and the configuration screens over the Configuration Menu. The Screen Access steps on the document pages also follow one of these two paths.
The permission areas
The screens and the operations are opened according to the permission areas of the user. The names of the permission areas come from the sections in the interface (e.g. Load Balancer, WAF, GTM); the fact that a screen requires the Load Balancer permission is related to the user role, not to the product license.
The Basic Concepts
The concepts below occur in almost every section of the document. Their names in the interface are in English and they are written with these names in the document as well; the only exception is Backend Service, which is referred to as Kurum Servisi in the Turkish text.
| Concept | Description |
|---|---|
| vService | The central object that meets the traffic on an IP:port. It determines its target, its security layers and its profiles. It has three types: HTTP (L7), L7 TCP and Network. Detail: vService |
| Backend Service | A single target server (address:port) that the traffic reaches. The weight, the connection limit, the health check, the SSL and the maintenance mode are defined separately for each one. Detail: Backend Services |
| Backend Group | The structure that gathers more than one server giving the same service with common settings, independently of the Backend Service. Detail: Backend Groups |
| Health Check | The check that periodically measures the status of the Backend Services; it takes the target that exceeds the failure threshold out of the rotation and brings it back when it recovers. Detail: Health Checks |
| Profile | The reusable setting package defined once and assigned to many objects (health check, compression, cache, timeout, log, report). Detail: Profiles |
| Condition | The "when" criterion by which the request, the source or the security state is evaluated. Detail: Conditions |
| Action | The "what to do" intervention applied when the condition matches: redirection, header, limit, block, quarantine. Detail: Actions |
| Route Table | The table to which the network traffic is routed; it is the working unit of L4 DDoS Protection. Detail: Route Tables |
| Smart Variables (fx) | It makes it possible to write a value calculated while the request is being processed in a field instead of a fixed value. Detail: Smart Variables (fx) |
The First Setup Path
The typical order followed while an application is published with TR7 for the first time is below. Every step links to the page on which its detail is explained:
1
Step 1 The interface is recognized
The login screen Home & Dashboard, the Left Monitor Panel for monitoring and the Configuration Menu for configuration are examined.
2
Step 2 The target servers are defined
The servers that the traffic will reach are added as Backend Services, and more than one server giving the same service as Backend Groups; a Health Checks profile is assigned for health.
3
Step 3 The corporate certificate is added
For HTTPS publishing, the TLS certificate of the organization is added to TR7 over SSL/TLS Certificates.
4
Step 4 The vService is created
The vService that will meet the traffic is added; its type, its listener IP:port, its target and its certificate are determined.
5
Step 5 The protection is enabled
The necessary security layers are enabled on the vService: How to Enable WAF?, How to Enable Bot/DDoS Protection?, How to Enable AGS?
6
Step 6 The traffic is monitored
The traffic and the health status are monitored with the Dashboard screen of the vService, the Data Flow Panel diagram, Live Stats and the log screens.
Reading Paths According to the Need
Starting points for the reader who comes with a specific need:
Publishing an Application Load Balancer - ADC
It is started with the Load Balancer - ADC overview; then Backend Services, vService and Profiles are read.
Protecting the Web Application and the API WAF - WAAP
It is started with How to Enable WAF?; then WAF-Protected vServices and WAF Mode are read.
Being Protected against Bot and DDoS Attacks Bot/DDoS · L4 DDoS Protection
For the application layer How to Enable Bot/DDoS Protection?, and for the network layer L4 DDoS Protection are read.
Controlling User Access AGS - AAM
It is started with How to Enable AGS?; the login flow is set up on the Flowchart screen and the identity sources are defined under Authentication.
A Multi-Region Structure and Disaster Recovery GTM (Global Traffic Manager)
It is started with the GTM (Global Traffic Manager) overview; then GTM and Remote Devices (Data Centers) are read.
How Is the Document Read?
The pages that describe a screen follow the same skeleton; the layout learned on one page is valid on the others as well:
| Section | Content |
|---|---|
| What Is It? | What the screen or the object is for and its place inside TR7. |
| Screen Access | The opening steps of the screen; mostly over the Left Monitor Panel or the Configuration Menu. |
| Column and Field Tables | The meaning, the default value and the options of every column in the list and every field in the form. |
| Numbered Steps | The explanation of the operation in order, together with the screenshots. |
| Right-Click Menu | The operations that open when a list row is right-clicked. |
| Usage Location and Scenarios | On which other screens the object is used and typical usage examples. |
Help
- A search in the whole document is made from the Search field on the top bar or with the Ctrl + K shortcut.
- The View/Download PDF button at the top right of every page creates a PDF copy of the page.
- The language selection is made from the language menu on the top bar.
- For the subjects that cannot be found in the document, the TR7 team is reached at support@tr7.com.
