How to create and configure a L4xNAT farm with ZAPI v1

16 October, 2015 | Technical

Hi Zen Masters, this article presents how to create and configure a L4 (layer 4) farm, a couple of backends (web servers) and the farm guardian through our Zen Load Balancer API (ZAPI).

L4xNAT profile
The L4xNAT farm profile allows you to create a L4 farm with a very high performance and much more concurrent connections than load balancer cores in layer 7 like TCP, UDP or HTTP farm profiles. That layer 4 performance improvement counteracts the advanced content handling that the layer 7 profiles could manage.

Additionally, L4xNAT farms could bind a range of ports, not only one virtual port as is used with other layer 7 profiles. In order to be able to select a range of virtual ports or a specific virtual port in L4xNAT farms, it’s mandatory to select a protocol type. In other case, the farm will be listening on all ports from the virtual IP.

Initialize ZAPI
As we discussed in the last article, you must enable zapi user and set a key and a password to start to use our ZAPI.
For the following examples, these parameters will be used:

Key: CiEuYlS4GtfSq3yrknv0YMnA7j5fhm4piVZh49yt5JcjQ0aDyxImz2Y7DAUhstce5
Password: admin
Zen Load Balancer IP: 192.168.101.25
Zen Web Port: 444

Once ZAPI is configured… let’s get started!

How to create a L4xNAT farm with ZAPI
In the first place, you have to create a L4xNAT profile farm with the corresponding command:

curl --tlsv1 -k -X POST -H 'Content-Type: text/json' -H "ZAPI_KEY: CiEuYlS4GtfSq3yrknv0YMnA7j5fhm4piVZh49yt5JcjQ0aDyxImz2Y7DAUhstce5" -u zapi:admin  -d '{"interface":"eth0","vip":"192.168.101.25","profile":"L4xNAT"}' https://192.168.101.25:444/zapi/v1/zapi.cgi/farms/L4FARM

HTTP verb: POST, used for creating farms, backends, services…
JSON parameters: interface, vip and profile (vport is not necessary in L4xNAT profile).
URI parameters: farmname -> L4FARM, this is the name selected for the farm.

Once this command is launched, the following response will be shown:

{
    "description" : "New farm L4FARM",
    "params" : [
        {
            "interface" : "eth0",
            "name" : "L4FARM",
            "profile" : "L4xNAT",
            "vip" : "192.168.101.25",
            "vport" : 0
        }
    ]
}

This response shows the main farm parameters. What does vport: 0 mean? When a L4xNAT farm is created, it is listening on all ports from the virtual IP by default and this will be shown as 0 or *.

How to configure a L4xNAT farm with ZAPI

Once the L4xNAT farm has been created, you will be able to modify the farm parameters. It’s possible to change all parameters, a few or just one.
First, let’s get the farm parameters with a GET request:

curl --tlsv1 -k -X GET -H 'Content-Type: text/json' -H "ZAPI_KEY: CiEuYlS4GtfSq3yrknv0YMnA7j5fhm4piVZh49yt5JcjQ0aDyxImz2Y7DAUhstce5" -u zapi:admin  https://192.168.101.25:444/zapi/v1/zapi.cgi/farms/L4FARM

HTTP verb: GET, used for getting parameters of farms, backends, services…
JSON parameters: None.
URI parameters: farmname -> L4FARM.

Once this command is launched, the following response will be shown:

{
    "backends" : [],
    "description" : "List farm L4FARM",
    "params" : [
        {
            "algorithm" : "weight",
            "fgenabled" : null,
            "fglog" : null,
            "fgscript" : null,
            "fgtimecheck" : 0,
            "nattype" : "dnat",
            "persistence" : "none",
            "protocol" : "all",
            "ttl" : 120,
            "vip" : "192.168.101.25",
            "vport" : 0
        }
    ]
}

This response shows the advanced farm parameters. These parameters could be modified using ZAPI. Let’s change a few parameters:

curl --tlsv1 -k -X PUT -H 'Content-Type: text/json' -H "ZAPI_KEY: CiEuYlS4GtfSq3yrknv0YMnA7j5fhm4piVZh49yt5JcjQ0aDyxImz2Y7DAUhstce5" -u zapi:admin  -d '{"protocol":"tcp","nattype":"nat" ,"port":"80"}' https://192.168.101.25:444/zapi/v1/zapi.cgi/farms/L4FARM

HTTP verb: PUT, used for modifying parameters of farms, backends, services…
JSON parameters: protocol ,nattype and port.
URI parameters: farmname -> L4FARM.

Once this command is launched, the following response will be shown:

{
    "description" : "Modify farm L4FARM",
    "params" : [
        {
            "protocol" : "tcp"
        },
        {
            "port" : "80"
        },
        {
            "nattype" : "nat"
        }
    ]
}

If we launch another GET request, the response will show all parameters with new changes:

{
    "backends" : [],
    "description" : "List farm L4FARM",
    "params" : [
        {
            "algorithm" : "weight",
            "fgenabled" : null,
            "fglog" : null,
            "fgscript" : null,
            "fgtimecheck" : 0,
            "nattype" : "nat",
            "persistence" : "none",
            "protocol" : "tcp",
            "ttl" : 120,
            "vip" : "192.168.101.25",
            "vport" : 80
        }
    ]
}

The nattype, port, and protocol parametrs have changed successfully!

How to create and modify a backend
How can we create and configure a backend of L4xNAT farm through ZAPI? You just have to follow the same steps above using several commands with curl:

curl --tlsv1 -k -X POST -H 'Content-Type: text/json' -H "ZAPI_KEY: CiEuYlS4GtfSq3yrknv0YMnA7j5fhm4piVZh49yt5JcjQ0aDyxImz2Y7DAUhstce5" -u zapi:admin  -d '{"ip":"46.120.34.160","port":"80","priority":"1","weight":"1"}' https://192.168.101.25:444/zapi/v1/zapi.cgi/farms/L4FARM/backends

HTTP verb: POST, used for creating farms, backends, services…
JSON parameters: ip, port, priority and weight (all parameters are required).
URI parameters: farmname -> L4FARM, this is the name selected for the farm.

Once this command is launched, the following response will be shown:

{
    "description" : "New backend 0",
    "params" : [
        {
            "id" : 0,
            "ip" : "46.120.34.160",
            "port" : 80,
            "priority" : 1,
            "weight" : 1
        }
    ]
}

This response shows the backend parameters and its ID.
How can we modify a backend of L4xNAT farm? Using the PUT HTTP verb with curl:

curl --tlsv1 -k -X PUT -H 'Content-Type: text/json' -H "ZAPI_KEY: CiEuYlS4GtfSq3yrknv0YMnA7j5fhm4piVZh49yt5JcjQ0aDyxImz2Y7DAUhstce5" -u zapi:admin  -d '{"ip":"46.120.101.65","port":"25","priority":"2","weight":"3"}' https://192.168.101.25:444/zapi/v1/zapi.cgi/farms/L4FARM/backends/0

HTTP verb: PUT, used for modifying parameters of farms, backends, services…
JSON parameters: ip. port, priority and weight.
URI parameters:
farmname -> L4FARM.
backend id -> 0.

Once this command is launched, the following response will be shown:

{
    "description" : "Modify backend 0 in farm L4FARM",
    "params" : [
        {
            "ip" : "46.120.101.65"
        },
        {
            "weight" : "3"
        },
        {
            "priority" : "2"
        },
        {
            "port" : "25"
        }
    ]
}

If we launch another GET request, response will show all the parameters with new changes:

{
    "backends" : [
        {
            "id" : 0,
            "ip" : "46.120.101.65",
            "port" : 25,
            "priority" : 2,
            "weight" : 3
        }
    ],
    "description" : "List farm L4FARM",
    "params" : [
        {
            "algorithm" : "weight",
            "fgenabled" : null,
            "fglog" : null,
            "fgscript" : null,
            "fgtimecheck" : 0,
            "nattype" : "nat",
            "persistence" : "none",
            "protocol" : "tcp",
            "ttl" : 120,
            "vip" : "192.168.101.25",
            "vport" : 80
        }
    ]
}

The weight, priority and port parameters have changed successfully!

How to configure the Farm Guardian
To close, let’s configure the farm guardian of L4xNAT farm. We have to use the following request with curl:

curl --tlsv1 -k -X PUT -H 'Content-Type: text/json' -H "ZAPI_KEY: CiEuYlS4GtfSq3yrknv0YMnA7j5fhm4piVZh49yt5JcjQ0aDyxImz2Y7DAUhstce5" -u zapi:admin  -d '{"fgenabled":"true","fgscript":"check_tcp -w 10 -c 10 -H HOST -p PORT","fgtimecheck":"15","fglog":"false"}' https://192.168.101.25:444/zapi/v1/zapi.cgi/farms/L4FARM/fg

HTTP verb: PUT, used for modifying parameters of farms, backends, services…
JSON parameters: fgenabled, fgscript, fgtimecheck and fglog.
URI parameters: farmname -> L4FARM.

Once this command is launched, the following response will be shown:

{
    "description" : "Modify farm L4FARM",
    "params" : [
        {
            "fglog" : "false"
        },
        {
            "fgenabled" : "true"
        },
        {
            "fgscript" : "check_tcp -w 10 -c 10 -H HOST -p PORT"
        },
        {
            "fgtimecheck" : "15"
        }
    ]
}

What do these paramaters do? ‘fgenabled’ parameter enable the farm guardian, ‘fgtimecheck’ parameter is the time between checks (in seconds), ‘fglog’ enable the farm guardian logs and ‘fgscript’ is the command to check.

On behalf of Zen Team, we truly hope you enjoyed this article. See you in the next!

Related Blogs

Posted by reluser | 02 November 2026
The Linux kernel is the foundation of countless enterprise infrastructures, cloud environments, networking platforms, and security appliances. Maintaining its security is therefore essential to ensuring the availability, integrity, and confidentiality…
136 LikesComments Off on CVE-2026-98432: Critical Linux Kernel Vulnerability Exposes Systems to Remote Attacks
Posted by reluser | 22 October 2026
Executive Summary The PHP development team has released urgent security updates addressing two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 under CVSS v4.0, according to…
635 LikesComments Off on Critical PHP Remote Code Execution Vulnerabilities CVE-2026-109618 and CVE-2026-109619: Update Required
Posted by reluser | 13 August 2025
July 2025 – Microsoft has issued an urgent security alert regarding active exploitation of four vulnerabilities affecting on-premises SharePoint servers: CVE-2025-49706 – Spoofing CVE-2025-49704 – Remote Code Execution CVE-2025-53770 –…
5.02K LikesComments Off on New SharePoint Vulnerabilities: How RELIANOID Helps You Stay Protected