{"id":3962,"date":"2018-02-20T17:35:20","date_gmt":"2018-02-20T13:35:20","guid":{"rendered":"https:\/\/rakhesh.com\/?p=3962"},"modified":"2018-02-20T17:37:07","modified_gmt":"2018-02-20T13:37:07","slug":"adfs-monitoring-on-nsx","status":"publish","type":"post","link":"https:\/\/rakhesh.com\/virtualization\/adfs-monitoring-on-nsx\/","title":{"rendered":"ADFS monitoring on NSX"},"content":{"rendered":"

Was looking at setting up monitoring of my ADFS servers on NSX.<\/p>\n

I know what to monitor on the ADFS and WAP servers thanks to this article<\/a>.<\/p>\n

\n

http:\/\/<Web Application Proxy name>\/adfs\/probe
\n http:\/\/<ADFS server name>\/adfs\/probe
\n http:\/\/<Web Application Proxy IP address>\/adfs\/probe
\n http:\/\/<ADFS IP address>\/adfs\/probe<\/p>\n<\/blockquote>\n

Need to get an HTTP 200 response for these.<\/p>\n

So I created a service monitor in NSX along these lines:<\/p>\n

\"\"<\/p>\n

And I associated it with my pool:<\/p>\n

\"\"<\/p>\n

Bear in mind the monitor has to check port 80, even though my pool might be on port 443, so be sure to change the monitor port as above.<\/p>\n

The “Show Pool Statistics” link on the “Pools” section quickly tells us whether the member servers are up or not:<\/p>\n

\"\"<\/p>\n

The show service loadbalancer pool<\/code> command can be used to see what the issue is in case the monitor appears down. Here’s an example when things aren’t working:<\/p>\n

NSX-edge-15-1> show service loadbalancer pool pool-adfs-https_443\r\n-----------------------------------------------------------------------\r\nLoadbalancer Pool Statistics:\r\n\r\nPOOL pool-adfs-https_443\r\n|  LB METHOD round-robin\r\n|  LB PROTOCOL L7\r\n|  Transparent disabled\r\n|  SESSION (cur, max, total) = (0, 0, 0)\r\n|  BYTES in = (0), out = (0)\r\n   +->POOL MEMBER: pool-adfs-https_443\/ADFS01, STATUS: DOWN\r\n   |  |  HEALTH MONITOR = MONITOR SERVICE, default_adfs_monitor:CRITICAL\r\n   |  |  |  LAST STATE CHANGE: 2018-02-20 10:02:13\r\n   |  |  |  LAST CHECK: 2018-02-20 12:47:15\r\n   |  |  |  FAILURE DETAIL: HTTP CRITICAL - Invalid HTTP response received from host: HTTP\/1.1 400 Bad Request\r\n   |  |  SESSION (cur, max, total) = (0, 0, 0)\r\n   |  |  BYTES in = (0), out = (0)<\/pre>\n
Here’s an example when all is well:<\/p>\n
NSX-edge-15-1> show service loadbalancer pool pool-adfs-https_443\r\n-----------------------------------------------------------------------\r\nLoadbalancer Pool Statistics:\r\n\r\nPOOL pool-adfs-https_443\r\n|  LB METHOD round-robin\r\n|  LB PROTOCOL L7\r\n|  Transparent disabled\r\n|  SESSION (cur, max, total) = (0, 0, 0)\r\n|  BYTES in = (0), out = (0)\r\n   +->POOL MEMBER: pool-adfs-https_443\/ADFS01, STATUS: UP\r\n   |  |  HEALTH MONITOR = BUILT-IN, default_adfs_monitor:L7OK\r\n   |  |  |  LAST STATE CHANGE: 2018-02-20 12:51:02\r\n   |  |  SESSION (cur, max, total) = (0, 0, 0)\r\n   |  |  BYTES in = (0), out = (0)<\/pre>\n
Thanks to this document<\/a> for pointing me in the right troubleshooting direction. Quoting from that document, the list of error codes:<\/p>\n
\n
UNK: Unknown<\/p>\n
INI: Initializing<\/p>\n
SOCKERR: Socket error<\/p>\n
L4OK: Check passed on layer 4, no upper layers testing enabled<\/p>\n
L4TOUT: Layer 1-4 timeout<\/p>\n
L4CON: Layer 1-4 connection problem. For example, “Connection refused” (tcp rst) or “No route to host” (icmp)<\/p>\n
L6OK: Check passed on layer 6<\/p>\n
L6TOUT: Layer 6 (SSL) timeout<\/p>\n
L6RSP: Layer 6 invalid response – protocol error. May caused as the:<\/p>\n
Backend server only supports \u201cSSLv3\u201d or \u201cTLSv1.0\u201d, or<\/p>\n
Certificate of the backend server is invalid, or<\/p>\n
The cipher negotiation failed, and so on<\/p>\n
L7OK: Check passed on layer 7<\/p>\n
L7OKC: Check conditionally passed on layer 7. For example, 404 with disable-on-404<\/p>\n
L7TOUT: Layer 7 (HTTP\/SMTP) timeout<\/p>\n
L7RSP: Layer 7 invalid response – protocol error<\/p>\n
L7STS: Layer 7 response error. For example, HTTP 5xx<\/p>\n<\/blockquote>\n
Nice!<\/p>\n","protected":false},"excerpt":{"rendered":"
Was looking at setting up monitoring of my ADFS servers on NSX. I know what to monitor on the ADFS and WAP servers thanks to this article. http:\/\/<Web Application Proxy name>\/adfs\/probe http:\/\/<ADFS server name>\/adfs\/probe http:\/\/<Web Application Proxy IP address>\/adfs\/probe http:\/\/<ADFS IP address>\/adfs\/probe Need to get an HTTP 200 response for these. So I created a … Continue reading ADFS monitoring on NSX<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false}}},"categories":[196,183],"tags":[746,521,660],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/3962"}],"collection":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/comments?post=3962"}],"version-history":[{"count":0,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/3962\/revisions"}],"wp:attachment":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/media?parent=3962"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/categories?post=3962"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/tags?post=3962"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}