GSS/CSS Misc Issues

[ssh]

Folks,

Please help me out here as I am about to bang my head against the door :-)

1. Do you guys know that CSS with content rule having application ssl or content rule with url "*/" (layer 5 content rule) replies to port ping. GSS is configured to send tcp 443 to a VIP and it always respond though backend services are dead!!

2. From 1, if this behaviour is true,how do I'll able to detect VIP failure using GSS?

3. KAL-AP keepalives on GSS! how they work or able to detect failures for VIPs with same ip address but different ports! Say I have VIP 1.1.1.1 configured for port 80 and port 443. I am using KAL-AP on GSS, how GSS will know whether port 443 is down or 80.

Thanks in advance,

Shahid

[mchoo2005]

First of all, I am by no means an expert in GSS, but, hopefully I'll be able to help a bit...

Your questions seem to hinge on 1 particular problem: VIP is still up although the back-end service(s) is/are down, caused by keepalive reporting active server(s).

Now, based on my understanding of the CSS and GSS, CSS is really the one responsible to make sure if a VIP is up or down, not the GSS. GSS only polls the VIP(s) to see if it's up/down/loaded. So, the solution to your problem should lie in your CSS implementation.

In our CSS implementation, we have also found that sometimes when the backend services are down, the CSS still reports the VIP being up. The primary cause of this problem has been the keepalive using a basic TCP polling. Consider this, an web application running on a web server may be down, but the web service itself is still up. In this situation, when you configure a keepalive to poll on TCP 80, it will be successful. This is normal, because the web service itself (which listens on TCP 80) is still up.

One possible solution to the problem is for the app developer to come up with a keepalive within the app itself, that generates a specific web page (say alive.html). Now, you can then configure a CSS keepalive to check the existence of this file. If the file does not exist, then the keepalive will fail, hence the VIP will be down.

Just my 2cents.

Cheers