HTTPS Health Monitor
The HTTPS monitor type can be used to validate the health of HTTPS encrypted web servers. Use this monitor when Avi Vantage is either passing SSL encrypted traffic directly from clients to servers, or for SSL encryption between Avi Vantage and the servers.
This article covers the specific configurations for the HTTPS monitor type.
Configuring HTTPS Monitor Type
The following are the steps to create a HTTPS monitor:
- Click on Create to view New Health Monitor screen.
- Specify a unique Name for the monitor.
- Specify a Description.
- Select HTTPS as the Type of Health Monitor.
- Specify the Send Interval value (in seconds). This value determines how frequently the health monitor initiates an active check of a server. The frequency range is 1 to 3600.
- Specify the Receive Timeout, value (in seconds). The server must return a valid response to the Health Monitor within the specified time limit. The receive timeout range is 1 to 2400 or the send interval value minus 1 second.
Note: If the status of a server continually flips between up and down, this may indicate that the Receive Timeout is too aggressive for the server.
- Specify Successive Checks. This is the number of consecutive health checks that must succeed before Avi Vantage marks a down server as up. The minimum is 1, and the maximum is 50.
- Specify Failed Checks. This is the number of consecutive health checks that on failing, Avi Vantage marks a server as down. The minimum is 1, and the maximum is 50.
- Click on Is Federated? option to replicate the object across the federation. When this option is not selected, the object is visible within the Controller-cluster and its associated SEs.
is_federatedis set to True only when GSLB is turned on. A federated health monitor is used for GSLB purposes while it is not applicable for a regular health-monitor. This implies that a GSLB service cannot be associated with a regular health monitor, because GSLB service is a federated object, while the health monitor is not. Conversely, a pool cannot be associated with a federated health monitor because the pool is not a federated object.
- Specify Client Request Data to send an HTTP request to the web server. Avi Vantage does not validate the request, as different servers may support unique request syntax.
- Method: Select any method, namely, GET, POST and HEAD are the most common for monitoring. If no method is defined, Avi Vantage will use GET.
- GET /index.htm
- POST /upload.asp HTTP/1.0\r\nHost: www.site.com\r\nContent-Length: 10\r\nABCDE12345
- Path: Specify the path that includes the URI and query, such as
/index.htm?user=test. If no path is specified, Avi Vantage will use
- Version: Specify the HTTP version. The HTTP version can be 1.0 or 1.1. If no version is specified, Avi Vantage will use 1.0.
- Host: If no Host header is specified, Avi Vantage includes a host header populated with the server’s name. HTTP 1.1 servers expect a Host header to be included in the request.
- Carriage Return: By default, Avi Vantage will add a carriage return line feed to the end of the send string in the form of \r\n. For HTTP 1.0, and additional \r\n may be required. For send strings that require multiple lines of data, such as headers, the carriage returns may need to be added, such as in the POST example above.
In Response Code field, specify HTTPS response codes to match successful. A successful HTTPS monitor requires either the Response Code, the Server Response Data, or both fields to be populated. The Response Code expects the server to return a response code within the specified range. For a GET request, a server should usually return 200, 301 or 302. For a HEAD request, the server will typically return a 304. A response code by itself does not validate the server’s response content, just the status.
In Server Response Data field, specify a snippet of content from the server’s HTTP response by copying and pasting text from either the source HTML or the web page of the server. Avi Vantage inspects raw HTML data and not rendered web pages. For instance, Avi Vantage does not follow HTTPS redirects and will compare the redirect response with the defined Server Response string, while a browser will show the redirected page. The Server Response content is matched against the first 2KB of data returned from the server, including both headers and content/body. The Server Response Data can also be used to search for a specific response code, such as 200 OK. When both Response Code and Server Response Data are populated, both must be true for the health check to pass.
Specify Health Monitor Port port that should be used for the health check. When this setting is blank, the default port configured for the server will be used. When it is specified, clients may be directed to a different port than what is monitored. For instance, a server at HTTP port 80 may have two health monitors attached, one for HTTP default port, and a second for HTTPS specifically on port 443. If both health monitors pass, the server can receive traffic on HTTP port 80. This ensures clients can input items in their shopping cart and later purchase those items over SSL on 443.
Specify Maintenance Response Code under Server Maintenance Mode. If the defined HTTP response code is seen in the server response, place the server in maintenance mode. Multiple response codes may be used by a comma separation.
Specify Maintenance Server Response Data. If the defined string is seen in the server response, place the server in maintenance mode.
Note: Custom server response can be used to mark a server as disabled. During this time, health checks will continue, and servers will operate the same as if it is manually disabled, which means existing client flows are allowed to continue, but new flows are sent to other available servers. Once a server stops responding with the maintenance string it will be brought online, being marked up or down as it normally would based on the server response data.
This allows an application owner to remove all connections from a server prior to taking the server offline without the requirement to log into Avi Vantage to first place the server in a disabled state.
- Click on Create.
Health Check Example
Sample HTTPS Health Check Send String:
GET /health/local HTTP/1.0 User-Agent: avi/1.0 Host: 10.10.10.3 Accept: */*
Sample Server Response:
HTTP/1.0 200 OK Server: Apache-Coyote/1.1 Cache-Control: no-cache, no-store Pragma: no-cache Content-Type: text/plain Content-Length: 15 Date: Fri, 20 May 2016 18:23:05 GMT Connection: close Health Check Ok
The server response includes both the Response Code, as 200, and the Server Response Data, as Health Check Ok. Therefore this server will be marked up. Notice that Avi automatically includes additional headers in the send string, including User-Agent, Host, and Accept to ensure that the server receives a fully formed request.
SSL Attributes in HTTPS Health Monitor
Prior to Avi Vantage version 17.1, the HTTPS health monitor used the pool SSL settings to verify the server health. No SSL configuration was allowed in the health monitor. Starting 17.1, you can configure SSL attributes under https_monitor mode.
The use-case for this would be in allowing SSL encrypted traffic to pass to servers without decrypting it in the load balancer.
Configuring Health Monitor
The following is the CLI sequence to enable this feature:
[admin:my-cntrlr]: > configure healthmonitor System-HTTPS [admin:my-cntrlr]: healthmonitor> https_monitor [admin:my-cntrlr]: healthmonitor:https_monitor> ssl_attributes [admin:my-cntrlr]: healthmonitor:https_monitor:ssl_attributes> ssl_profile_ref System-Standard [admin:my-cntrlr]: healthmonitor:https_monitor:ssl_attributes> ssl_key_and_certificate_ref System-Default-Cert [admin:my-cntrlr]: healthmonitor:https_monitor:ssl_attributes> pki_profile_ref System-pki-profile.
The SSL settings on health monitor are always considered if provided. If SSL settings for the health monitor are not provided, the health monitor falls back to using pool SSL settings. An HTTPS health monitor needs SSL settings on either the health monitor config itself or in the pool config. If is absent in both, Avi Vantage reports an error.
Upgrade happens smoothly and needs no manual configuration. Upgrading from releases prior to 17.1 causes the HTTPS health monitor to use pool SSL settings. If a new SSL config is added to the health monitor, it will be placed into effect.
- Read the Overview of Health Monitors article for general monitor information, implementation, and other monitor types.
- The Health Monitor Profile article introduces and explains the various settings available for all kinds of health monitors.
The HTTPS health monitor may only be applied to a pool whose virtual service has an HTTP application profile attached. Health monitoring of HTTPS is covered in the SSL Attributes in HTTPS Health Monitor section at the end of this article.