lb

The lb command branch manages the load balancing resources of TR7 from the command line: the vServices, the Backend Services and their groups, the conditions and the actions, the profiles, the certificates and the protection settings. Its panel equivalent is the Load Balancer - ADC section.

This is the widest branch of the command tree: it carries twenty-six resources and most of the records that connect to the other branches of the tree (WAF, AGS, certificates) are here.

26 Resources

the commands under lb

All the records of load balancing, from the vService to the certificate, from the profiles to the protection.

5 Commands

list · show · add · update · delete

On some resources there are additional actions too: restarting, status, bulk update.

Narrows on type selection

type · criteria · checkType

In the vService, action, condition and certificate commands the type is selected first.

Load Balancer permission

the permission area of the lb branch

The view permission is required for reading and the modify permission for writing.

Command Map

Traffic and vService

Command	What it manages	Panel screen
lb service	The vServices: the listened address, the type and the bound profiles	vService Management
lb vhost	The shared front-end layer: status and restart	vService Management
lb backend	The Backend Services	Backend Services
lb backend-group	The backend server groups	Backend Groups
lb condition	The traffic conditions	Conditions
lb action	The actions to be applied when the condition is met	Actions

Profiles

Command	What it manages	Panel screen
lb hc	The health checks	Health Checks
lb cache	The cache profiles	Caching
lb compression	The compression profiles	Compression
lb log	The log profiles	Logging
lb notification	The alert and notification profiles	Alert Notifications
lb page	The content pages	Content Pages
lb limits	The vService limits	vService Limits
lb report	The report profiles	Reports
lb timeouts	The timeout profiles	Timeouts
lb trusted-proxy	The trusted proxy profiles	Trusted Proxy

Certificate and TLS

Command	What it manages	Panel screen
lb certificate	The SSL/TLS certificates; additionally creating a request and internal creation	SSL/TLS Certificates
lb ca	The certificate authorities; additionally creating an internal CA	Certificate Authorities
lb ssl-security	The TLS security profiles	TLS Security Profiles
lb certificate-request	The certificate requests (CSR)	SSL/TLS Certificates
lb client-certificate	The client certificates	Client Certificates
lb private-key	The private key library	Private Key Library
lb pki-profile	The certificate profiles	Certificate Profiles
lb pki-issued	The certificates created with the internal CA	Certificate Profiles
lb acme-dns-provider	The ACME DNS providers	ACME DNS Providers

Protection

Command	What it manages	Panel screen
lb threat-protection	The threat protection settings of the vService; the record is born together with the vService, it is not added and not deleted	Bot & DDoS Protection

The Same Five Commands on Every Resource

TR7 WEB-CLI · the five command pattern

admin@TR7LBWAF01> lb backend list # list all of them

admin@TR7LBWAF01> lb backend show <id> # show one

admin@TR7LBWAF01> lb backend add <fields> # new record

admin@TR7LBWAF01> lb backend update id <id> <fields> # change

admin@TR7LBWAF01> lb backend delete <id> # delete

admin@TR7LBWAF01>  

Command	How the identity is written
show · delete	Right after the command, without writing the field name: show <id>
update	With the id field: update id <id>

The Actions Outside the Five Commands

Some resources offer their own operations too:

Command	Function
lb service status list · lb service status id	Shows the running status of the vServices
lb service restart	Restarts the vService
lb vhost status list · lb vhost status id	Shows the status of the shared front-end layer
lb vhost restart	Restarts the shared front-end layer
lb ca create	Creates an internal certificate authority
lb certificate create-csr	Creates a certificate request
lb certificate issue-internal · lb certificate renew-internal	Creates and renews a certificate with the internal CA
lb service update-many · lb backend update-many · lb backend-group update-many · lb hc update-many · lb threat-protection update-many	Applies the same change to many records at once; the targets are marked from the selection list and the command asks for confirmation (detail)

The Field Writing Rules

Rule	How it is written
Required field	It is written without a prefix and is asked for in order: add name web-01 v-device <device>
Optional field	It takes the -- prefix: --weight 3
List field	Every item with its own index: --servers.0.ip, --servers.1.ip
Nested field	With a dot: --addr.ip, --addr.port
Duration field	The value and the unit are written separately: --field.val 30 --field.unit s
Type field	After type, criteria, checkType is selected, only the fields of that type are asked for
Emptying a field	Only during update: --field.delete

In the vService command the type is written first

In the lb service add command the first field asked for is type (http, tcp, layer4). Without the type being written, not even the name of the record is listed. The same pattern is valid in the lb certificate command too: first type, then name.

Setting Up a vService from Scratch

Step 1 Define the Backend Service

The address and the port of the server are given here.

lb backend add name web-01 v-device <device> namespace <route-table> addr.ip 10.20.0.15 addr.port 8080

Step 2 Create a group if needed

If more than one server will be used as a single target, a group is opened.

lb backend-group add name web-group v-device <device> namespace <route-table>

Step 3 Set up the health check

The check type is selected, then the name and the target of the check are written.

lb hc add checkType http name web-check

Step 4 Create the vService

First the type, then the remaining fields are written.

lb service add type http …

Step 5 Bind the profiles and the rules

The profiles such as cache, compression, log, timeout and the condition-action rules are bound to the vService.

Permission

The lb commands are bound to the Load Balancer permission area: the view permission is required for reading the branch, and the modify permission for adding, changing or deleting a record. This branch additionally covers the WAF and certificate areas; a user who has permission in one of these areas can enter the branch, and the server decides which resource they can access. For the details the API Commands page can be looked at.