Layer 4 vs Layer 7 (load balancing & routing) — explain it in 90 seconds

You mentioned "layer 4 vs 7 routing." Precise framing: routing = L3 (IP). Load balancing happens at L4 (transport) or L7 (application). When people say "L7 routing" they mean content-based request routing. Say it that way and you sound precise.

L4 (transport layer — TCP/UDP)

  • Works on IP + port. DNAT/SNAT, no payload inspection.
  • Decision inputs: 5-tuple (src/dst IP, src/dst port, protocol) → hash → backend.
  • Capabilities: connection proxying, health checks = TCP handshake (or "is the port answering"), persistence = source-IP affinity (or hash).
  • Cannot: route by URL path/host (unless port-based), inspect HTTP, terminate TLS at app layer, do cookie persistence, WAF.
  • Wins: raw throughput, low latency, protocol-agnostic (DNS, NFS, DBs, anything TCP/UDP), simple HA.
  • Examples: MetalLB (BGP/L2 = pure L4 VIP), kube-proxy/OVN-K service DNAT, iptables/nftables DNAT, F5 FastL4 virtual, LVS, cloud NLBs.

L7 (application layer — HTTP/gRPC/DNS)

  • Full proxy: terminates the connection, parses the protocol, opens a new connection to the backend.
  • Decision inputs: hostname, URL path, headers, cookies, TLS SNI, method, body (WAF).
  • Capabilities: host/path routing (one VIP, many apps), TLS termination + re-encryption, cookie persistence (JSESSIONID), header injection (X-Forwarded-For), rate limiting, WAF, auth.
  • Costs: more CPU per connection, connection limits, slightly higher latency — but you get app-level control.
  • Examples: HAProxy (OpenShift Router), nginx/ingress controllers, F5 standard virtual + HTTP profile + iRules, Istio/Envoy, cloud ALBs.

One sentence each (interview-grade)

  • "L4 LB is a traffic cop at the door — fast, sees IPs and ports. L7 LB opens the envelope — sees URLs, headers, cookies, and routes accordingly."
  • "MetalLB is strictly L4: it hands out the VIP and ECMP's traffic to nodes. The OpenShift Router is L7: it terminates TLS and routes by host/path to the right service."

The chained stack (how Proforma's traffic almost certainly flows)

Client → DC edge firewall/NAT → ToR (BGP ECMP on the /32 VIP, L3) → node (L4 DNAT via OVN-K service) → HAProxy Router pod (L7: TLS, host/path) → ClusterIP service (L4) → pod.

Two LB layers = two failure domains = exactly the redundancy this team wants. Name each hop in the interview and you'll sound like an operator, not a reader.

F5 mapping (your resume strength — use it)

  • LTM virtual server types: Standard = full L7 proxy (HTTP profile, iRules); Performance L4 = FastL4 (pure L4, PVA offload); Forwarding L2.
  • GTM = global server load balancing at the DNS layer: health-aware DNS answers, topology-based routing (it's "L7 of DNS").
  • APM = identity/access (SAML/OIDC) — your Entra ID work.
  • iRules = L7 scripting (header rewrite, redirect, content switch).
  • So when they ask "L4 vs L7" you can answer with the stack you actually ran: "On F5 I ran both — FastL4 profiles for raw TCP services and Standard HTTP virtuals with iRules for app routing. MetalLB is FastL4-equivalent; the OCP Router is the Standard-virtual equivalent."

Health checks & persistence (the follow-up questions)

  • L4 monitor: SYN/ACK (TCP half-open) or connect-close. L7 monitor: HTTP GET /healthz expecting 200 — catches apps that accept TCP but serve 500s.
  • L4 persistence: source-IP hash — breaks when clients NAT (whole office = one IP → one backend). L7: cookie insert — precise per-user stickiness. State the NAT drawback unprompted; it's a classic "senior" tell.

Quick self-test

  • "A client sends HTTPS to a MetalLB VIP. Walk the layers."
  • "Why can't MetalLB do path-based routing?"

(It's L4 — it never parses HTTP; you need the Router/HAProxy for that.)

  • "When would you use L4-only load balancing for an app?"

(Non-HTTP protocols, DB replication, DNS, anything where parsing adds cost without value, high-PPS services.)