Forum Discussion

gdoyle's avatar
gdoyle
Icon for Cirrostratus rankCirrostratus
Dec 19, 2019

TCP Health Check.

All,

I have a customer who mentioned that they took a server down for maintenance, but were still receiving customer traffic.

 

This server sits in a pool tied to a VIP and is load balanced with least connections. The pool member was not disabled, they relied on the health check to fail for the pool member to stop receiving traffic.

 

This pool member has the standard TCP health check enabled on it and I wanted to confirm that it works how I think it works. The Big IP will talk to the pool member, which is the IP address of the pool member and the port, correct? So all TCP health check attempts would only go to that server over the configured port (in this case it was an LDAP server, so 636).

 

OR does TCP just do some form of generic TCP handshake that would not necessarily go to this port? (This doesn't seem likely, but I wanted to ask the smart people, so I came here)

 

Thanks.

application delivery
BIG-IP
LTM
  • Leonardo_Souza's avatar
    Leonardo_Souza
    Dec 19, 2019

    TCP monitor will try a TCP handshake, if that is successful, marks pool member up.

    If you use the default TCP monitor, the alias address field is *, that means it will get the port from the pool member.

    So, if pool member is 192.168.1.1:639, it will try a TCP handshake with 192.168.1.1 on port 639.

     

    In the case you described, if the application itself was down, but the server still had the port TCP/639 open, the monitor will still mark the server up.

     

    You need an application layer monitor.

    The system has a built in LDAP monitor, so you should use that.

  • Leonardo_Souza's avatar
    Leonardo_Souza
    Icon for Cirrocumulus rankCirrocumulus
    Dec 19, 2019

    TCP monitor will try a TCP handshake, if that is successful, marks pool member up.

    If you use the default TCP monitor, the alias address field is *, that means it will get the port from the pool member.

    So, if pool member is 192.168.1.1:639, it will try a TCP handshake with 192.168.1.1 on port 639.

     

    In the case you described, if the application itself was down, but the server still had the port TCP/639 open, the monitor will still mark the server up.

     

    You need an application layer monitor.

    The system has a built in LDAP monitor, so you should use that.

  • gdoyle's avatar
    gdoyle
    Icon for Cirrostratus rankCirrostratus
    Dec 19, 2019

    Thanks for the confirmation, Leonardo, and I concur about the use of an application monitor, unfortunately I did not architect their solution. I think the main cause in this case was that they decided to rely upon the health monitor to mark the pool as down while they did planned maintenance.