Add IP Address (Standalone)

What Is Add IP Address?

Add IP Address is a fundamental configuration operation that provides network connectivity and service accessibility by assigning IPv4 or IPv6 addresses to the interfaces on the TR7 device. On TR7 the IP addresses define the listening points at which the vServices will accept the traffic coming from the clients.

While a vService is being created, the IP address and the port over which the service will be accessible are determined; for this reason the IP address configuration is the first step of traffic management. Every IP address is bound to a specific interface and route table; in this way the traffic coming from different network segments is routed according to the rules of the related route table. By adding more than one IP address to the same interface, more than one service can be run on a single physical or logical interface.

TR7 supports both IPv4 and IPv6 addresses; when an IP address is entered, the system detects the address format automatically and configures the appropriate protocol.

IPv4 + IPv6

Dual-stack

Both protocols can be added to the same interface in parallel

Multiple IPs

Per interface

More than one service/IP on a single interface

Route Table

Traffic isolation

Every IP is subject to the rules of a route table

vService

Listening address

The service access point with IP + port

Why Is Add IP Address Important?

IP addresses are the fundamental building blocks of network communication. On TR7 a correct IP configuration is of critical importance in terms of service accessibility, traffic routing and network security.

• vService Accessibility: Every vService accepts client requests over a specific IP address and port combination. A vService cannot be run on an interface to which no IP address has been assigned.
• Multiple Service Support: By adding more than one IP address to a single interface, different IP addresses can be used for different services over the same physical connection. It is especially important in the scenarios that require the IP-based separation of SSL/TLS certificates.
• Route Table Integration: IP addresses work integrated with the route table structure. The IP addresses assigned to the interfaces in different route tables are subject to the routing rules of the related table; in this way traffic isolation and segmentation are provided.
• IPv6 Transition: A dual-stack (IPv4 + IPv6) configuration is supported. Both IPv4 and IPv6 addresses can be added to the same interface; this provides flexibility during the IPv6 transition process.

The Profile-Based IP Model

In TR7 the IP addresses are permanent network resources that live at the device/configuration level. An IP address is defined bound to an interface and to a route table; the vServices, on the other hand, only use this IP as a listening address. That is, the IP exists at the network layer first; the vService references this address afterwards.

This separation separates TR7 fundamentally from the traditional approaches in which the IP is embedded in a service object:

TR7: The Profile-Based IP The network layer

The IP address is first defined on the interface and is part of the device configuration. The vServices use this address as a listening point; however, the life cycle of the IP is completely independent of the vService.

The Traditional Approach: VIP-Based The service object

In traditional ADCs/load balancers the IP (VIP) is entered while the service object is being created and is usually handled together with that object; the address behaves like a property of the related service object.

Important: IPs live independently of the vService

Even if an IP address is removed from a vService or that vService is deleted completely, the IP address stays defined and active on TR7 as long as it is not deleted or disabled: it is bound to the interface and continues to respond at the network layer (ARP/access). This makes it possible for the IP to be reused in another vService; however, in order to prevent unexpected IP collisions, the addresses that are no longer used need to be cleaned up.

In order to remove an IP address completely, the Delete IP operation of the related IP on the Interfaces List screen, and in order to disable it temporarily, the Disable for [Hostname] operation is used.

Best Practices

• Assign the IP addresses in a planned way. Instead of assigning them randomly, plan the IP blocks according to the service type or the purpose of use (e.g. 10.0.1.x for web services, 10.0.2.x for API services).
• Use the Disabled option in migration scenarios. While migrating from a different device to TR7, add the IP addresses as Disabled first; in this way there is no collision with the IP on the source device. When the migration is completed, the IP on the source device is deleted and it is enabled on TR7 with Enable for [Hostname].
• Determine the subnet mask (CIDR) value correctly. While adding an IP address, make sure that the CIDR notation is suitable for the network topology; a wrong subnet mask leads to routing and accessibility problems.
• Pay attention to the route table selection. The selected route table determines which routing rules the traffic will be subject to; a wrong selection may cause the traffic to be routed unexpectedly.
• Configure the IPv6 addresses in parallel. In preparation for the IPv6 transition, assign both IPv4 and IPv6 addresses to the interfaces whenever possible; this dual-stack configuration makes the future transition easier.

How to Add?

There is more than one way of adding a new IP address on the TR7 device. The first three methods open the same Add IP Address Form as a closable tab inside the interface list screen:

From the Actions Menu Method 1

The Configuration Menu is opened with the TR7 logo and the Network → Interfaces → Actions → Add IP steps are followed. In the form the first interface of the list comes selected; the correct interface must be selected in the form.

From the Preview Panel Method 2

On the Network → Interfaces screen an interface is selected; in the preview panel that opens on the right the IP tab is opened and the Add IP button is clicked. The selected interface comes ready in the form (if the Route table filter on the list screen is set to a different table, the first interface of that table is selected instead).

From the Right-Click Menu Method 3

On the Network → Interfaces screen an interface is right-clicked; Add IP is selected from the menu that opens. The selected interface comes ready in the form (if the Route table filter on the list screen is set to a different table, the first interface of that table is selected instead). On the interfaces that are Bond/LACP members this option is passive.

From the vService Form Method 4

While a vService is being created or edited, the Add IP operation in the IP selection list opens the same form as a window (modal); the IPs added come directly into the IP list of the vService. This operation is offered only to the users who have network configuration authorization.

Besides, the Add IP button on the Dashboard screen of an interface also opens the same form with the interface selected.

WARNING

While a network operation continues (while the "Network is under action. Please wait..." warning is seen), the Add IP in the right-click menu becomes passive; the Add IP in the Actions menu, on the other hand, stays open. A record sent during this time is rejected with the "Configuration sync in progress. Please try again later." error; the operation must be waited to finish and the record must be tried again.

The Add IP Address Form

By following one of the methods above, the IP address adding form is opened. There is no Details section in the form; the fields are explained below in screen order.

The Add IP Address Form

INFO

Route Table

A route table is selected in order to narrow the IP interface list; this field is seen only if more than one route table is defined. If a specific table is selected in the Route table filter on the interface list screen, that table comes ready; if the filter is in the All route tables position, the table of the interface from which the form is opened comes ready. The field is only for filtering; the route table of the IP is the table of the selected interface. For the details see the Route Tables page.

INFO

IP Interface

The interface to which the IP address will be added is selected; all the interfaces in the selected route table are listed and the interfaces that are bond/LACP members are passive. If the form has been opened from a specific interface, the related interface comes selected but can be changed; when it is opened from the Actions menu or while the Route table filter is set to another table, the first interface of the list comes selected. Before the record it must be checked that the correct interface is selected. If an interface that is a bond/LACP member is selected, the "... is a bond/LACP member" warning is given and the form cannot be submitted.

INFO

IP Type

The type of the IP address (Ip type) is selected. In a standalone setup the only option is Interface IP; the interface IP addresses are used as the listening address in the vServices. The VIP type is listed only in a cluster (two-device) setup.

INFO

IP

The IP addresses to be added are entered as a table. The header of the first column of the table is the machine name (hostname) of the device; next to it there is the CIDR column. In every row:

• The IP address: an IPv4 or IPv6 address is entered (e.g. 192.168.1.100, 2001:db8::1); the badge next to the box shows the version of the address entered (IPv4 / IPv6) automatically.
• CIDR: the prefix length is entered; the default is 24. It must be in the 0–32 range for IPv4 and in the 0–128 range for IPv6.
• IP description: an optional description is entered in the box on the right of the row; the description is displayed in the tooltip of the IP and, when it is opened from the Columns window, in the IP description column of the interface list, which is hidden by default.

Adding Multiple IPs

By clicking the + icon in the CIDR header, new rows are added to the table; all the addresses are assigned to the same interface. The rows are removed with the trash can icon, but the last row cannot be deleted.

WARNING

The form does not validate the addresses before they are sent; an address row left empty, an invalid address, a CIDR outside the range or an address already defined in the same route table is rejected during the record by the server with the "IP not given", "Invalid IP: ...", "Invalid CIDR: ..." or "IP collision: ..." error; when an attempt is made to add an IP to the cluster synchronization interface, the "Interface '...' is protected (...)" error is returned. In this case the form stays open and the values entered are preserved.

INFO

IP Status

The IP status selection below the table determines the status of all the addresses added (the default is Enabled):

• Enabled: The IP address is added as active; it becomes accessible as soon as the configuration is applied to the system.
• Disabled: The IP address is defined but is not applied to the system; it cannot be reached over the network and is shown gray and struck through in the interface list. It is used in order to prevent an IP collision in migration scenarios; the address is enabled later from the interface list with the Enable for [Hostname] operation.

INFO

Add IP

The IP addresses are saved by clicking the Add IP button. The adding does not ask for confirmation; the record returns immediately, the system application starts in the background (if necessary the interface is turned on automatically) and the form tab closes. The addresses added are displayed as sub-rows in the row of the related interface on the Interfaces List screen:

Absent in system · redThe record has been taken but the configuration has not been applied to the system yet; the address appears red for a short time.

Up · greenThe configuration has been applied to the system; an address added as Enabled appears green and is usable.

Disabled · light gray, struck throughAn address added as Disabled is not applied to the system; it is shown dimmed and struck through.

In the list the status color is applied to the text of the IP address; the color tones may change according to the selected theme. When the interface itself is down or has no link, the address inherits the status of the interface (Down, No link, etc.).

Editing an IP Address (Edit IP)

An existing IP address is edited on the Interfaces List screen by right-clicking the IP or by selecting it in the IP tab of the preview panel and using the Edit IP operation. The editing form has the same structure as the adding form; its differences are as follows:

• The Route table and IP interface fields are locked; an IP cannot be moved to another interface.
• In the IP table there is only the row of the address being edited; a row cannot be added or deleted.
• The button of the form becomes Edit IP. A change of the address, the CIDR or the description is saved without confirmation being asked; only in the changes that have a side effect (such as changing the IP type in a cluster setup) is the "Are you sure?" confirmation and the warnings that list the effects displayed; in the changes that have a destructive effect a second "This action has destructive consequences. Are you REALLY sure?" confirmation is asked as well.

IP deletion and protected addresses

• An IP defined in the management access lists (HTTP, HTTPS, SSH, SNMP) of the device cannot be deleted and cannot be disabled with the Disable for [Hostname] operation in the interface list; the operation is rejected with the "${ip} is protected. (${reason})" error. This protection is not applied to the IP status selection in the Edit IP form: making an access IP Disabled from the editing form may lead to management access to the device being cut off.
• The IP deletion operation opens a confirmation window; however, no separate warning is given for the routes and the default gateway reached over the IP; since the routes are bound to the interface, they stay in place. Before deleting an address, it must be checked that the routes in the network of that address will still be accessible.