Smarter by Design.Simpler for Business
lb backend
The lb backend command manages a single backend server to which the traffic will be forwarded — an IP and port pair — and the health check, SSL, source address and traffic distribution settings bound to it. Its panel equivalent is the Backend Services screen.
A backend does not receive traffic on its own: it is bound either directly to the default list of a vService, or to an lb backend-group record.
Command Summary
# Tab after the command
admin@TR7LBWAF01> lb backend
add delete list show update update-many
admin@TR7LBWAF01> lb backend list # list all of them
admin@TR7LBWAF01> lb backend show <id> # show one
admin@TR7LBWAF01> lb backend add name <name> v-device <v-device> …
admin@TR7LBWAF01> lb backend update id <id> … # change
admin@TR7LBWAF01> lb backend update-many <target> … # bulk change
admin@TR7LBWAF01> lb backend delete <id> # delete
admin@TR7LBWAF01>
Writing Order
Step 1 Write the name
lb backend add web-server-1Step 2 Select the virtual device
The v-device on which the backend will be defined. Tab lists the options; the default is the device on which the command runs.
Step 3 Select the route table
Which route table the backend will be reached over. The default value is
1. Step 4 Write the address and the port
10.0.10.21 8080Step 5 Add the settings if needed
The health check, SSL, weight and SNAT fields are added with
--. Required Fields
| Order | Field | Status | Value |
|---|---|---|---|
| 1 | name | Required | The name of the backend; it must be unique in the collection |
| 2 | v-device | Required | The virtual device; the default is the device on which the command runs |
| 3 | namespace | Required | The route table; the default is 1 |
| 4 | addr.ip | Required | The IP address or the domain name of the backend |
| 5 | addr.port | Required | The port of the backend |
| — | differentIp.ip | Conditionally required | It is asked for only when --useDifferentIp true is written |
The five required fields are written without a prefix in every case and the CLI does not accept any field starting with -- until they are completed. When --useDifferentIp true is written, differentIp.ip is also asked for without a prefix right after it; another -- field cannot be written until this field is given.
The fields that have a default are also asked for
The v-device and namespace fields have a default value, but the command still asks for these two fields. They are selected from the list with Tab.
The Health Check Fields
| Field | Default | Value |
|---|---|---|
--hc | None | The lb hc record to be applied |
--enableHcLog | true | Whether the health check logs will be kept or not |
--useDifferentIp | false | The health check being done to a different address |
differentIp.ip | — | The address on which the check will be done; it is required while --useDifferentIp true and is written without a prefix |
--differentIp.port | None | The port on which the check will be done |
--differentSrcType | None | The source address of the check: empty or deviceSrc |
--deviceSrc | — | The device address to be used while --differentSrcType deviceSrc |
The SSL Fields
These fields are applied to the connection between TR7 and the backend and are effective only when --sslService true is written.
| Field | Default | Value |
|---|---|---|
--sslService | false | Connecting to the backend with SSL |
--ciphers | standard | The cipher suite: standard or low |
--sni | None | The SNI value to be sent in the connection |
--alpn | http20_disabled | http20_disabled (HTTP/2 off) or http20_enabled (HTTP/2 on) |
--sslSecurityProfile | None | The lb ssl-security profile to be applied |
--sslVerify | none | The verification of the certificate of the backend: none or required |
--sslVerifyCa | None | The CA profile to be used in the verification; it is written while --sslVerify required |
--sslClientCert | None | The client certificate that TR7 will present while identifying itself to the backend |
The two directions should not be confused
--sslClientCert is the certificate that TR7 presents in order to identify itself to the backend; in this connection TR7 is on the client side. The client certificate verification in the SSL security profile is the opposite direction: the verification of the certificate of the visitor on the listening side. In the backend connection only the minimum and the maximum SSL version, the cipher list and the curve settings of the security profile are valid.
The Traffic and Distribution Fields
| Field | Default | Value |
|---|---|---|
--weight | None | The distribution weight; between 1 and 256 |
--connLimit | None | The concurrent connection limit; between 1 and 65535 |
--cookieContent | None | The cookie value that marks this backend in the session persistence |
--proxyOpt | None | send-proxy (PROXY protocol v1) or send-proxy-v2 |
--useFrontendPort | false | Connecting to the backend with the listening port on which the request arrived |
--backupService | false | Marking the backend as a backup; it comes into play when the others go down |
--maintenanceMode | false | Taking the backend into maintenance; no traffic is sent |
The Source Address Fields
| Field | Default | Value |
|---|---|---|
--snatOpt | None | The source address translation: clientIp or customIpDevice |
--snatIpDevice | — | The address to be used while --snatOpt customIpDevice |
--spoofing | false | The MAC relay behavior while --snatOpt clientIp |
--spoofingIp | — | The address to be used for the relay |
--spoofingClusterIp | — | The VIP that determines the relay condition |
--spoofingDefaultClusterId | 1 | The default device for the relay |
Examples
# name · virtual device · route table · ip · port
admin@TR7LBWAF01> lb backend add name web-1 v-device <v-device> namespace 1 addr.ip 10.0.10.21 addr.port 8080
admin@TR7LBWAF01>
# the required fields are written without a prefix and before the -- fields in every case
admin@TR7LBWAF01> lb backend add name web-2 v-device <v-device> namespace 1 \
addr.ip 10.0.10.22 addr.port 8080 --hc <check> --weight 30 --connLimit 2000
admin@TR7LBWAF01>
admin@TR7LBWAF01> lb backend add name web-tls v-device <v-device> namespace 1 \
addr.ip 10.0.10.23 addr.port 443 --sslService true \
--sni portal.kurum.com.tr --sslVerify required --sslVerifyCa <ca-profile>
admin@TR7LBWAF01>
# when useDifferentIp is true, differentIp.ip becomes required
admin@TR7LBWAF01> lb backend add name web-3 v-device <v-device> namespace 1 \
addr.ip 10.0.10.24 addr.port 8080 \
--useDifferentIp true differentIp.ip 10.0.99.24 --differentIp.port 9000
admin@TR7LBWAF01>
Binding to a vService
# a single backend directly, for more than one a backend-group is used
admin@TR7LBWAF01> lb service update id <vService> --defaultBackendList.0 <backend>
admin@TR7LBWAF01>
Updating and Deleting
# taking a single record into maintenance
admin@TR7LBWAF01> lb backend update id <id> --maintenanceMode true
admin@TR7LBWAF01> lb backend delete <id>
admin@TR7LBWAF01>
Bulk Update
update-many applies the same change to many backend records at once. The writing order is the same on every resource.
Step 1 Select the target
The only required field is
target: selected for the records selected from the list, all for the entire collection. Step 2 Add the fields to be written
Only the fields that can be written to many records with the same value are present; the fields specific to the record, such as the id, the name and the address, do not take place in this command.
Step 3 Mark the targets from the list
When
target selected is written and no id is given, a selection list with checkboxes opens. Step 4 Confirm
A warning stating how many records will be affected appears; nothing is written until the confirmation word is typed.
| Field | Status | Value |
|---|---|---|
target | Required | selected — the records selected from the list · all — the whole collection |
--ids.N | Conditional | The target ids for target selected. It is not suggested in the Tab list: the targets are marked from the selection list. In a script and in a pipeline it is written manually. |
--onError | Optional | abort (default) — if even one of the targets does not pass the validation, nothing is written · skip — the targets that pass are written |
Writable Fields
# Tab after the command
admin@TR7LBWAF01> lb backend update-many
--info target
# Tab after the target field
admin@TR7LBWAF01> lb backend update-many target
all selected
# write -- and Tab: all the writable fields
admin@TR7LBWAF01> lb backend update-many target all --
--alpn --backupService --ciphers
--connLimit --cookieContent --differentSrcType
--enableHcLog --hc --info
--maintenanceMode --onError --proxyOpt
--snatOpt --spoofing --spoofingDefaultClusterId
--sslClientCert --sslSecurityProfile --sslService
--sslVerify --sslVerifyCa --useDifferentIp
--useFrontendPort --weight
admin@TR7LBWAF01>
There are 23 fields in the command; the list above is the same as what appears when -- is written and Tab is pressed on the device. What each one does and what is written after it is in the table below.
The fields that are condition-bound in the single command (those that open according to the value of another field) are listed here without a condition: in the bulk update every target is validated separately according to its own record, and if the field is not active on a target it is skipped only on that target.
| Field | What it does | What is written after it |
|---|---|---|
--info | Writes what the command will do without running it | It does not take a value; it is written on its own |
--onError | Determines what will happen if a target does not pass the validation | abort writes nothing (default) · skip writes the targets that pass |
--hc | Binds the health check to be applied to the targets | The lb hc record; Tab lists the existing ones |
--enableHcLog | Determines whether the health check logs will be kept or not | true · false (default true) |
--useDifferentIp | Turns on the health check being done to an address different from the address to which the traffic goes | true · false (default false). Since the check address is specific to the record, it cannot be written in this command; give the address with the single update |
--differentSrcType | Selects from which source address the health check will go out | It is left empty or deviceSrc is written |
--manualSrc | It is the field that serves to write by hand the source address from which the health check will go out | Since the value set of the --differentSrcType field does not contain manualSrc in this version, the field never becomes active |
--maintenanceMode | Takes the record into maintenance; no traffic is sent to the targets, the configuration is not deleted | true · false (default false) |
--backupService | Marks the record as a backup; it does not receive traffic while the others are healthy | true · false (default false) |
--useFrontendPort | Makes the connection to the backend be made with the listening port on which the request arrived | true · false (default false) |
--proxyOpt | Carries the real address of the client to the backend with the PROXY protocol | send-proxy (PROXY protocol v1) · send-proxy-v2; when it is left empty it is off |
--sslService | Turns on connecting to the backend with SSL; all the SSL fields depend on it | true · false (default false) |
--ciphers | Selects the cipher suite to be used in the SSL connection | standard · low (default standard) |
--alpn | Determines whether HTTP/2 will be used in the SSL connection or not | http20_disabled · http20_enabled (default http20_disabled) |
--sslSecurityProfile | Applies an SSL security profile to the backend connection | The lb ssl-security record. In this connection only the minimum/maximum SSL version, the cipher list and the curve settings of the profile are valid |
--sslVerify | Determines whether the certificate presented by the backend will be verified or not | none · required (default none) |
--sslVerifyCa | Selects which CA profile will be used in the verification | The lb ca record; it is meaningful together with --sslVerify required |
--sslClientCert | Selects the client certificate that TR7 will present while identifying itself to the backend (mTLS) | A certificate record. This is the opposite direction of the verification of the certificate of the visitor: here the client is TR7 |
--snatOpt | Selects how the source address of the connection going to the backend will be determined | clientIp carries the address of the client · customIpDevice uses the address selected over the device; when it is left empty no translation is done |
--spoofing | Turns on the MAC relay behavior while the source address is carried from the client | true · false (default false); it is meaningful together with --snatOpt clientIp |
--spoofingDefaultClusterId | Selects the default device for the MAC relay | It is selected from the device list (default 1) |
--weight | Determines the share of the backend in the distribution; the one whose weight is high receives more requests | A number between 1 and 256 |
--connLimit | Limits the number of connections that the backend will carry at the same time | A number between 1 and 65535 |
--cookieContent | Writes the cookie value that marks this backend in the session persistence | The text to be carried in the cookie |
Fields that exist in the single command but not here, and the reasons:
| Field | Why it is not here |
|---|---|
name | The name is unique; the same value cannot be written to many records |
v-device | The virtual device determines the set of addresses and tables that can be selected; its value depends on the sibling fields |
namespace | The route table depends on the virtual device in the same way |
sni | It is a smart content field; it carries not a value but an expression resolved according to the record |
snatIpDevice | Its value comes from the address list of the selected virtual device |
spoofingIp | It is an address field; it is written separately for every record |
spoofingClusterIp | Its value depends on the sibling fields |
deviceSrc | Its value comes from the address list of the selected device |
differentIp.ip | The health check address is specific to the record; since it is an object field it cannot be written in bulk |
differentIp.port | It is part of the same object field |
addr.ip | The address of the backend is specific to the record |
addr.port | The port of the backend is specific to the record |
Target Selection and Confirmation
admin@TR7LBWAF01> lb backend update-many target selected --maintenanceMode true
? Target objects
space: mark · ctrl+a: all · enter: confirm
Filter: (filter by typing) · esc: cancel
[x] <record-1>
[x] <record-2>
[ ] <record-3>
2 selected / 3
⚠ 2 objects will be updated
<record-1>, <record-2>
Type "yes" to confirm: yes
admin@TR7LBWAF01>
# the whole collection: the list does not open, the confirmation comes directly
admin@TR7LBWAF01> lb backend update-many target all --enableHcLog false
⚠ This operation will update ALL the objects in the collection
Type "yes" to confirm:
# in a script or in a pipeline: the targets are written by hand, the list does not open
admin@TR7LBWAF01> lb backend update-many target selected \
--ids.0 <id-1> --ids.1 <id-2> --maintenanceMode true --onError skip
admin@TR7LBWAF01>
The screen language depends on the user
The texts in the selection list and on the confirmation screen come according to the language preference of the signed-in user. The confirmation word is yes in the English interface and evet in the Turkish interface.
The detailed behavior of bulk update — which fields can be written in bulk and the report returned for each target — is on the API Commands page.
Things to Know
- The name is unique. A second backend with the same name cannot be created.
- The maintenance mode does not delete the record.
--maintenanceMode trueleaves the backend in the configuration, it only cuts the traffic;falseis written in order to take it back. - A backup backend works only when the others go down. A record marked with
--backupService truedoes not receive traffic while the other backends in the group are healthy. - The bulk update carries only the common fields. In the
update-manycommand the fields specific to the record, such as the name, the address and the port, are not present; the common fields such as the health check, SSL, the weight and the maintenance mode can be written. The command always asks for confirmation before applying. - The health check is a separate record. The check to be written in the
--hcfield is first created withlb hc.
