For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

ILIAS_g_183177's avatar
ILIAS_g_183177
Icon for Nimbostratus rankNimbostratus
Apr 20, 2015

Difference between "Health Monitors" and "service port"

Hello,

 

I would like to verify that the service port dominates the health port at the pool configuration. In other words, when we set up the service port at the member and is different than the health monitor, then BigIP first checks the service port. Is this right? For example, below the pool nodes listen on port 8080, but there is also a health monitor at HTTP. What is the difference between them? Should both be the same?

 

(tmos) list ltm pool APPLICATION ltm pool APPLICATION { load-balancing-mode least-connections-member members { 10.10.10.10:webcache { address 10.10.10.10 session monitor-enabled state up } 10.10.10.11:webcache { address 10.10.10.11 session monitor-enabled state up } } monitor http }

 

thank you.

 

6 Replies

  • Hi,

     

    Default config for monitor for Alias Address and Alias Service Port is All Addresses/Ports. It means that monitor is using IP and Port configured for member to which it is assigned. So if you have http monitor assigned to memebr with 10.10.10.1:8080 monitor will use this socket for HTTP request used to monitor member state.

     

    In case you would like to not use IP or port configured for member you can enter static values in the Alias Address and Alias Service Port for monitor. So you can put 10.10.10.12 and 80 in monitor configuration. When such monitor is assigned to any member it will not use IP or port set for pool member but the ones set in monitor config. So for any member monitor will always use 10.10.10.12:80 to send HTTP requests.

     

    Hope it makes sense.

     

    Piotr

     

  • So, if the application nodes listens on port 8080, I have to configure the health monitor to check tcp 8080 at the pool configuration and this will check also the node members at the same port. Correct?

     

  • can you provide me the command (tmsh) for this?

    e.g.

    root@(ve11c)(cfg-sync In Sync)(Active)(/Common)(tmos) list ltm monitor https https
    ltm monitor https https {
        adaptive disabled
        cipherlist DEFAULT:+SHA:+3DES:+kEDH
        compatibility enabled
        destination *:*
        interval 5
        ip-dscp 0
        send "GET /\r\n"
        time-until-up 0
        timeout 16
    }
    
    root@(ve11c)(cfg-sync In Sync)(Active)(/Common)(tmos) list ltm monitor https https_443
    ltm monitor https https_443 {
        adaptive disabled
        cipherlist DEFAULT:+SHA:+3DES:+kEDH
        compatibility enabled
        defaults-from https
        destination *:443
        interval 5
        ip-dscp 0
        send "GET /\r\n"
        time-until-up 0
        timeout 16
    }
    
  • I meant what is the tmsh for pool creation if I want to inherit address and port from pool member. The pool nodes listen on port 8080 and I want to create the pool by tmsh as initially asked. Below I have also created a monitor that checks port 8080 in case I need to apply it to the health monitor.

     

    ltm monitor tcp app_monitor_8080 { adaptive disabled defaults-from tcp destination *:webcache interval 5 ip-dscp 0 time-until-up 0 timeout 16 }

     

  • I meant what is the tmsh for pool creation if I want to inherit address and port from pool member.

    if you want to monitor pool member port, you do not need to specify port when creating health monitor. by default, health monitor inherits port from pool member.

    root@(ve11c)(cfg-sync In Sync)(Active)(/Common)(tmos) create ltm monitor tcp mytcp
    root@(ve11c)(cfg-sync In Sync)(Active)(/Common)(tmos) list ltm monitor tcp mytcp
    ltm monitor tcp mytcp {
        adaptive disabled
        defaults-from tcp
        destination *:*
        interval 5
        ip-dscp 0
        time-until-up 0
        timeout 16
    }
    root@(ve11c)(cfg-sync In Sync)(Active)(/Common)(tmos) create ltm pool foo members add { 200.200.200.101:8080 } monitor mytcp
    root@(ve11c)(cfg-sync In Sync)(Active)(/Common)(tmos) list ltm pool foo
    ltm pool foo {
        members {
            200.200.200.101:8080 {
                address 200.200.200.101
                session monitor-enabled
                state up
            }
        }
        monitor mytcp
    }
    root@(ve11c)(cfg-sync In Sync)(Active)(/Common)(tmos) q
    [root@ve11c:Active:In Sync] config 
    [root@ve11c:Active:In Sync] config  tcpdump -nni 0.0 -s0 port 8080
    tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
    listening on 0.0, link-type EN10MB (Ethernet), capture size 65535 bytes
    18:59:57.180432 IP 200.200.200.13.33873 > 200.200.200.101.8080: S 2810917797:2810917797(0) win 14600  out slot1/tmm1 lis=
    18:59:57.181936 IP 200.200.200.101.8080 > 200.200.200.13.33873: S 1824924698:1824924698(0) ack 2810917798 win 5792  in slot1/tmm1 lis=
    18:59:57.184047 IP 200.200.200.13.33873 > 200.200.200.101.8080: . ack 1 win 115  out slot1/tmm1 lis=
    18:59:57.184057 IP 200.200.200.13.33873 > 200.200.200.101.8080: F 1:1(0) ack 1 win 115  out slot1/tmm1 lis=
    18:59:57.187998 IP 200.200.200.101.8080 > 200.200.200.13.33873: F 1:1(0) ack 2 win 46  in slot1/tmm1 lis=
    18:59:57.190237 IP 200.200.200.13.33873 > 200.200.200.101.8080: . ack 2 win 115  out slot1/tmm1 lis=