<div>i am not working for any vendor but you need a monitor & dependancy feature already available on bigip</div>
<div> </div>
<div class="gmail_quote">On Wed, Jul 15, 2009 at 4:57 PM, Oliver Adam <span dir="ltr"><<a href="mailto:oadam@madao.de">oadam@madao.de</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid">Do you have any traces from the time the problem occured? The config itself seems to be fine - testing this quickly at a 4G result in log messages like:<br>
<br>Dynamic Log Buffer (50 lines):<br>Jul 15 16:56:34:N:L4 server 192.168.9.101 rs101 port 80 is down due to healthcheck<br>Jul 15 16:56:34:C:Real server rs101 track group 80 443 state changed from ACTIVE to DOWN<br>Jul 15 16:49:45:N:L4 server 192.168.9.101 rs101 port 80 is up<br>
Jul 15 16:49:45:C:Real server rs101 track group 80 443 state changed from DOWN to ACTIVE<br><br>The track group is working as expected. Is it anyhow possible that you had problems with sessions which were open already at the time the problem occured? The SI is not going to cut all the sessions hardly by default. Have a look at "reset-on-port-fail" as an option in this area. On top of that I am confused because you are using healthck's why do not you do it this way:<br>
<br><br>
<blockquote class="gmail_quote" style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid">
<div class="im">server real server1 192.168.0.60<br>source-nat access-list 1<br>port http<br></div>port http url "GET /status.html"<br>port http content-match Content_Match
<div class="im"><br>port ssl<br>port ssl keepalive<br>port ssl l4-check-only<br>port 8080<br>port 9000<br>port 4443<br>hc-track-group 80 443<br></div></blockquote><br><br>No healthck needed - much shorter and simple to understand - same behaviour.<br>
<br>Please ensure you do have "server no-fast-bringup" in the config - this is to ensure the health check is only successful in case everything up to L7 is working.<br><br>Something to look at in the future: <a href="http://community.brocade.com/adi" target="_blank">http://community.brocade.com/adi</a><br>
<br>Best regards,<br><font color="#888888"><br>Oliver</font>
<div>
<div></div>
<div class="h5"><br><br>At 15:16 15.07.2009, David Miller wrote:<br>
<blockquote class="gmail_quote" style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid">Oliver Adam wrote:<br>
<blockquote class="gmail_quote" style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid">I am not sure why you would like to solve this problem with another vendors box. I would suggest to look at the features of the 4G. There is something called health check track groups.<br>
<br>Out of the documentation:<br><br>ServerIron(config)# server real r1 1.1.1.1<br>ServerIron(config-real-server-r1) port 80<br>ServerIron(config-real-server-r1) port ftp<br>ServerIron(config-real-server-r1) port dns<br>ServerIron(config-rsr1) hc-track-group 80 21 53<br>
<br>The ServerIron now tracks health status for ports 80, 21, and 53. If any of these ports is down then the combined<br>health would be marked as failed and the ServerIron will not use these ports for load balancing traffic.<br>
<br>You would have to combine port 80 and port 443 in a health check track group.<br><br>Is not that what you are looking for?<br></blockquote><br>Ahh, now that's just what I was looking for. I already have that though:<br>
<br><br>healthck Server1_HC tcp<br> dest-ip 192.168.0.60<br> port http<br> protocol http<br> protocol http url "GET /status.html"<br> protocol http content-match Content_Match<br> l7-check<br><br><br>server real server1 192.168.0.60<br>
source-nat access-list 1<br>port http<br>port http healthck Server1_HC<br>port http url "HEAD /"<br>port ssl<br>port ssl keepalive<br>port ssl l4-check-only<br>port 8080<br>port 9000<br>port 4443<br>hc-track-group 80 443<br>
<br><br>server virtual vserver 1.2.3.4<br>sym-priority 110<br>port http<br>port http lb-pri-servers backup-stay-active<br>port ssl sticky<br>port ssl ssl-terminate Action<br>port ssl lb-pri-servers backup-stay-active<br>bind http server1 8080 real-port http server2 8080 real-port http<br>
bind ssl server1 4443 real-port ssl server2 4443 real-port ssl<br><br><br>However, we recently ran into the situation where server1 was responding very slowly and http failed over to server2 but ssl remained on server1.<br>
<br><br>The 8080 and 4443 are so we can access the real server for testing before binding it to the LB VIP. Are they what's causing the problem here? Should I have hc-track-group 80 443 8080 4443 ?<br><br>Thanks! I love the S/N ratio on this list!<br>
<br>--- David<br></blockquote><br><br></div></div></blockquote></div><br>