ACE - Sorry Server

Here is a description of the problem I am having:
I have a VIP configured using 2 serverfarms. ServerFarm-A as the primary and ServerFarm-B as the backup.
Serverfarm-A (Primary) contains 2 webservers hosting the website
Serverfarm-B (BackUp) contains 1 server simply hosting a sorry page
When Serverfarm-A (Primary) fails, I recieve the sorry page hosted on Serverfarm-B (Backup)
This action works fine with no issues. I simply click the refresh button on my browser and get the sorry page.
When Serverfarm-A (Primary) comes back on-line I still recieve the sorry page hosted on Serverfarm-B (Backup)
The only way I do not recieve the sorry page is if the client deletes its cache from the browser. (This issue occurs in both IE and FireFox)
I am assuming that since this action does not occur when ServerFarm-A goes down why would it happen the opposite way.
I have tried several differnt configs recommended by TAC and still no luck.
I am hoping someone has come across this issue and can help.

Larry,
Have you compared the headers that are being sent by the servers in the primary farm with those of the sorry serverfarm? If the sorry servers are marking the content as cacheable but the primary servers are not then you could perhaps configure the sorry servers with the same settings.
Is the sorry server giving actual application content or just a sorry page telling the user the site is unavailable?
Also when you refresh is the browser making a new tcp connection to the vip or is it just sending a get on the existing tcp conversation? A wireshark trace on the client would show if it is a new connection or a continuation of the existing one. If the connection is still established and you are just sending another get on the same tcp stream you may want to try and disable connection keepalive on the web server. When the primary farm comes back up only new tcp connections should be sent there. The existing connection will stay on the server they were initially sent to.

Similar Messages

ACE sorry server and sticky

I have configured 3 different serverfarms with including realservers
2 of them are with websites, the other 1 is with webservices
I also have configured a sorry server farm and the including rserver.
On the sorry rserver i have configured 2 maintenance websites, listening to an unique hostheader.
So for serverfarm A & B i have configured a seperate maintenance website.
Now when i take rservers from serverfarm A or B down, the sorry server will get active for the needed farm.
However i can only reach 1 maintenance website. And even so, an url used to reach farm A gets on maintenance site from B
This is strange behaviour, doesnt a sorryserver just accept requests with the requested hostheader by the client ?
Also, when i put the rservers from A and B back into service i have to do a "clear stick database all" otherwise the sorryserver will remain active.
What is wrong here ?
probe http EHIC-http
description Test op WWW functionaliteit
interval 10
passdetect interval 30
request method get url http://acc.site-B.nl/web/
expect status 200 200
header Host header-value "acc.site-B.nl"
expect regex 1.8.0.2
probe http WWW-http
description Test op WWW functionaliteit
interval 10
passdetect interval 30
request method get url http://acc.site-A.nl/web/default.aspx
expect status 200 200
header Host header-value "acc.site-A.nl"
expect regex v1.9.2.327
serverfarm host EHIC-FARM
failaction purge
predictor leastconns slowstart 30
probe EHIC-http
rserver ehic_server01.site-B.nl
inservice
serverfarm host SORRY-FARM
failaction purge
predictor leastconns
rserver sorrypage.site-C.nl
inservice
serverfarm host WBS-FARM
failaction purge
predictor leastconns slowstart 30
probe ICMP-PROBE
rserver acc-wbs01v.site-D
inservice
rserver wbs_01.site-D
inservice
rserver wbs_02.site-D
inservice
serverfarm host WWW-FARM
failaction purge
predictor leastconns slowstart 30
probe WWW-http
rserver acc-www01v.site-A
inservice
rserver acc_server01.site-A
inservice
rserver acc_server02.site-A
inservice
sticky ip-netmask 255.255.255.255 address source EHIC-FARM-STICKY
serverfarm EHIC-FARM backup SORRY-FARM
sticky ip-netmask 255.255.255.255 address source WWW-FARM-STICKY
serverfarm WWW-FARM backup SORRY-FARM
class-map match-any EHIC-VIP
2 match virtual-address 172.30.9.4 tcp eq https
3 match virtual-address 172.30.9.4 tcp eq www
class-map match-any WBS-VIP
6 match virtual-address 172.30.5.4 tcp eq www
7 match virtual-address 172.30.5.4 tcp eq https
class-map match-any WWW-VIP
2 match virtual-address 172.30.6.4 tcp eq www
3 match virtual-address 172.30.6.4 tcp eq https
policy-map type loadbalance first-match EHIC-FARM-STICKY-BALANCE
class class-default
sticky-serverfarm EHIC-FARM-STICKY
policy-map type loadbalance first-match WBS-FARM-BALANCE
class class-default
serverfarm WBS-FARM
policy-map type loadbalance first-match WWW-FARM-STICKY-BALANCE
class class-default
sticky-serverfarm WWW-FARM-STICKY
policy-map multi-match LOADBALANCING-EHIC
class EHIC-VIP
loadbalance vip inservice
loadbalance policy EHIC-FARM-STICKY-BALANCE
loadbalance vip icmp-reply active
appl-parameter http advanced-options EHIC-PARAMETERS
policy-map multi-match LOADBALANCING-WBS
class WBS-VIP
loadbalance vip inservice
loadbalance policy WBS-FARM-BALANCE
loadbalance vip icmp-reply active
appl-parameter http advanced-options WBS-PARAMETERS
policy-map multi-match LOADBALANCING-WWW
class WWW-VIP
loadbalance vip inservice
loadbalance policy WWW-FARM-STICKY-BALANCE
loadbalance vip icmp-reply active
appl-parameter http advanced-options WWW-PARAMETERS
Regards,
Sebastian

Hi Gilles,
Here is our full config, i only changed some domain names.
I'll try to describe the problem again ;
We have published a website by vip 172.30.6.4
We have another website published by vip 172.30.9.4
These websites are hosted by realservers configured in 2 serverfarms and can be reached from the internet (secured by an ASA)
For both of these farms i have configured a sorryserver. This sorry server should serve a webpage containing a maintenance message whenever a farm should get down.
The sorry server is configured with 2 websites, each listening to the specific hostheader. This hostheader is the same as configured on the rservers for the specific farm 172.30.6.4 or 172.30.9.4.
So what i am trying to accomplish is that i only need 1 sorryserver to server 2 sorry webpages, ofcourse listening to a hostheader to get 2 different sorrypages to be returned.
Now when i take all realservers for both serverfarms down, except for the sorryserver, i can only reach 1 sorrypage.
For example, site A and B are down, when i try to reach site A i get to the sorrypage of site A. But when i try to reach site B i too get served the sorrypage of site A.
And also when i "inservice" all rservers again i have to do a "clear sticky database", otherwise the sorryserver will remain active.
Now i have upgraded to the last version of the ACE ios, but i still have to test if the same problem persists so i will give feedback on this later.
Regards,
Sebastian

ACE and secondary sorry server?

Hi,
I need to transfer the CSS' concept of the "secondary sorry server" to the ACE.
My (so far untested) idea is: attaching a backup server-farm to the primary server-farm to get the "sorry server" function; attaching a backup rserver to the rserver used in the backup server-farm to get a backup for the backup.
Will it work this way?
Arno

Cascading serverfarms is restricted to one backup level but you can cascade backup for individual servers.

ACE 4710 - 'reverse proxy' infront of serverfarm - fail-over/sorry server design issue

Hi All,
I'm working on a specific config and have an issue in the backup farm/fail-over/sorry server area.
The customer wants the following:
They have an existing serverfarm with X web servers, they want a single server to act as a reverse-proxy in front of the farm.
So that all traffic goes trough that server, that server then forwards the request to the original serverfarm.
The problem in my design is in the fail-over, if i configure the reverse-proxy server in a new serverfarm and use the original (web servers) farm as backup it has fail-over, but if the reverse-proxy AND the original serverfarm fail, there is no nice way to get the users on a sorry server.
I could give the original serverfarms rservers a 'backup standby' server but that won't give the desired effect either.
For maintance they first take 50% of the servers offline and switch to the other 50% after that, so then users would see a sorry page even if there where operational servers in the farm left.
The 4710's are running routed mode, and the farms use Sticky Cookie, and also some http URL & Cookie matching is done.
Anyone have an idea how to build this?

Hi,
It need additional testing but as per my understanding if you put the back up in this order then the last backup server will be choosen first.
In your case it will be like " RSERVER1 >> backup sorry server >> backup web content
As per the below example:
I put test 2 as first backup server and test1 as second backup server but if you look at the first part it took rserver test1 as first backup.
serverfarm host 1313-GIN-GWAP-SDC-80
rserver RSERVER1
    backup-rserver test1
    inservice
rserver test1
    inservice standby
rserver test2
    inservice standby
regards,
Ajay Kumar

ACE Backup-server failover

I'm having trouble with the functionality of backup servers in a serverfarm.
Lets say I have three rservers in a serverfarm. Each rserver has a backup-server assigned to it. When a probe detects that one of the three nodes failed, the ACE puts the backupserver in rotation for the whole serverfarm. This causes one out of three connections to show a "under construction" page. However two of the three nodes are still functioning, but users randomly see a construction page, which confuses them.
Is there a way to configure the ACE to follow this procedure?
One server fails a probe, take server out of rotation
Second server fails a probe, take server out of rotation
Third server fails a probe, take server out of rotation
Place backupserver in rotation for the whole farm
When one server comes back online, put it inservice and take backupserver out of rotation.
The intent is for the rservers to be self-sufficient making server administrators not have to have any knowledge of ACE and need to login and manually place a serever out of service. I want a probe to detect IIS failing and allow server administrators to work on one node at a time without an outage, and still retain a construction page if all nodes fail.

Hi,
Probably, you may need a "sorry server" configuration but also there´s another way which you may take into account which backup serverfarm, please take a look:
http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/ace/vA5_1_0/configuration/slb/guide/classlb.html
backup
name2
—(Optional) Designates an existing host (with valid content) or a redirect (sorry) server farm as a backup server farm in case all the real servers in the primary server farm become unavailable. You can configure one backup server farm for each existing primary server farm. When at least one server in the primary server farm becomes available again, the ACE sends all new connections back to the primary server farm. The ACE allows existing connections to the backup server farm to complete."
Regards,
Jorge

ACE sorry farm url redirection query

Hi
I've had the following config tested :
===
rserver redirect sorry-server
webhost-redirection http://sorry.test.com/
inservice
serverfarm redirect sorry-farm
rserver sorry-server
inservice
policy-map type loadbalance first-match test-policy
class class-default
serverfarm farm1 backup sorry-farm
===
...and this is ok - but it will result in the client getting a redirected URL.
eg. If they visit www.test.com and that farm was down, they'll be redirected to sorry.test.com via the backup farm.
However, is it possible to 'silently' retrieve the sorry page from sorry.test.com but not redirect the client?
That is, if the main farm was down, is it possible for the ACE to retrieve the page at sorry.test.com and present it back to the client without the client seeing a change in URL (eg. they would still see www.test.com in their browser)?
Cheers
Cameron

Hi Syed
Thank you for responding.
In our case the "sorry.test.com" server would not exist in the same context as the original farm - hence I thought the web redirect was the only way to go.
I was trying to see if there was a way to provide the sorry page content that could be retrieved from either another context or any external URL - but not from a rserver in the same context as the real server farm.
As you suggest, we could put another vm in the same context that is soley used for the sorry page - but it would have been cool to use one sorry page for multiple contexts.
Thanks
Cameron

CSS 11501 - Balancing vs. Sorry Server

Hi,
I need a little advice.
I have configured my test CSS box with two services. I enabled keepalives and load balancing with one server having a weight of 5, while the other is set to the default.
Testing has proven successfull in redirecting requests when the primary server (weight 5) is taken offline. However, when it comes back online, not all requests are sent to it, and some requests still go to the secondary server.
My question:
If I want all requests to go to the primary server except in the event it is unavailable, should I configure the secondary server as a Sorry server, and not as a load balanced peer? I would effectively be using the Sorry server as a secondary content server.
Is this workable? Am I missing something?
Thanks,
JM

JM,
yes you need the sorryserver option if you don't want traffic to go to your backup.
Whatever weight option you configure, there will always be a fraction of the traffic going to the backup.
Gilles.

Sorry Server Config for 11503

I have added a service for the sorr server and I have added the name of the server SorryServer1 to the content rule. However when I suspend the content rule I get a Page Not diplayed instead of the redirect to the Sorry Server.
The config has mulitple Content rules, I am currently only testing on one.
Thanks

Hi,
if you suspend the whole content rule the sorry server can not do it's action as the rule is "down" you need do suspend all services except the sorry server.
Kind Regards,
Joerg
PS
For a HowTo and recommendations refer to http://www.cisco.com/en/US/partner/products/hw/contnetw/ps792/products_configuration_guide_chapter09186a00801579f2.html#1038009

CSS Sorry Server for HTTPS

How to configure Sorry server for HTTPS (443) port. Sorry server works fine with HTTP, But not with 443
In the following config if server1 and server2 are down, the HTTP requests goes to the Sorry Server, but for HTTPS nothing is displayed. I am running the sorry server on port 81
Please suggest
!************************** SERVICE **************************
service prisorry
ip address 10.100.11.11
keepalive type http
keepalive port 81
port 81
active
service secsorry
ip address 10.100.11.12
keepalive port 81
keepalive type http
port 81
active
service server1
ip address 10.100.11.11
keepalive type http
keepalive port 80
active
service server2
ip address 10.100.11.12
keepalive type http
keepalive port 80
active
!*************************** OWNER ***************************
owner Loadbalancing
content L4Rule1
protocol tcp
add service server2
add service server1
port 80
url "/*"
vip address 10.100.11.4
advanced-balance sticky-srcip-dstport
primarySorryServer prisorry
secondarySorryServer secsorry
active
content L4Rule2
protocol tcp
add service server2
port 443
add service server1
vip address 10.100.11.4
advanced-balance sticky-srcip-dstport
primarySorryServer prisorry
secondarySorryServer secsorry
application ssl
active
content L4Rule3
add service server2
protocol tcp
port 1443
add service server1
vip address 10.100.11.4
advanced-balance sticky-srcip-dstport
primarySorryServer prisorry
secondarySorryServer secsorry
active
Thanks

I just deployed a couple 11050's the other day so my experience is limited, but I'd guess your problem is that, when using the Primary Sorry Server, you end up with clients sending HTTPS requests to an HTTP port. Having HTTPS requests redirected to HTTP ports is one thing because the client then makes an HTTP request to that port, but the way you have it above, it appears to me that the client will be talking HTTPS to port 81 on the Sorry Server, which is listening for HTTP.

Https serverfarm with http sorry server

Hello all,
I am having difficulty configuring a sorry server for an existing https serverfarm. The sorry (backup) server is failing all connections and I think it's because I can not determine a way to differentiate ssl connections for the production serverfarm and non-ssl connections for the sorry server. Here is the load balance policy:
policy-map type loadbalance http first-match WWW-HTTPS-LBP
class class-default
    serverfarm WWW-HTTPS backup WWW-OUTAGE
    action https-rewrite
    ssl-proxy client CLIENT-SSL-PROXY
The WWW-HTTPS serverfarm is comprised of HTTPS real servers, hence the necessity of the ssl-proxy client; however, when the WWW-HTTPS serverfarm is offline, the ssl-proxy can't connect to the WWW-OUTAGE serverfarm as the real server in that farm is HTTP only.
Has anyone run into this scenario before?

The ssl-proxy client forces the connection on the backend (to the real server to be https).
You should instead create a redirect serverfarm and use it to redirect the user to an http vserver where you can use your http serverfarm without the ssl-proxy client.
Gilles.

Sorry server - different replies

We have CSS 11000 that provides load balancing between several servers with configured max-session .
How to configure that sorry server sends different reply:
1) if all servers are down, it has redirect to page "sorry, server is down"
2) in case of overload, it it has to redirect to page "sorry, server is bussy, try later"
Can you advise how it possible to configue this?
thanks in advance,
Natalia

there is no direct way of doing this.
However, my solution is to do this :
service sorry_down
service sorry_overloaded
keepalive type script check_service_down use-output
owner mycompany
content www
vip ...
add service ...
primarysorryserver sorry_overloaded
secondarysorryserver sorry_down
active
The script check_service_down, will do a 'show service ' grep -u Alive to detect if a service is alive or just not used because down.
Or you could also simply do ap-kal-pinglist and ping the services.
Anyway, the idea for the kal for the service sorry_overloaded is to check the status of the other services and detect if they are down or just overloaded.
Gilles.

CSS Sorry server requirements

Folks,
The documentation says that the sorry server concept will only work if the loadbalancing is done at layer 7. My question is why, why can't i see the sorry server redirect if all services are down when doing load balancing at Layer 3 or Layer 4?

Hi,
Can you point me to those docs. I believe sorry server should work regardless of which layer is the content rule configured to check.
Actually this doc's example is layer 3:
http://www.cisco.com/en/US/products/hw/contnetw/ps789/products_configuration_example09186a0080093de8.shtml
I will build a working config at layer 3 for you soon.

Sorry server request

Hi,
we have two CSS11503 to load balance http and https traffic, we have to know the source IP packet of request to a Sorry Server when all the services on the content are down.
I mean, when all services into the content are down a request from a client i forwarded to the primary sorry server, is the source IP of the request the load balancer IP address, or is the client IP address wherefrom the request starts?!
Thanks
Cinzia

By default we do not source nat the client ip address.
But if the sorry server is at a remote location, you will NEED to do source nat for the connection to work, otherwise the sorry server will respond directly to the client bypassing the CSS and the client will not appreciate seeing a response from a different ip than the vip.
You could use a redirect sorry server, so that a redirect response is sent to the client which does open a new connection directly with the sorry server.
Gilles.

Sorry Server for CSS 11500

Hi,
I have a question regarding sorry server configuration on the CSS 11500 series.
Is there a way for the sorry server to ignore the URL path and always send the user traffic to the "root" page (e.g. index.html) of the sorry server web server?
The problem I have is the redirection of the "root" page (url "/") that is configured for the normal traffic is causing the sorry page not to work since the URL path ("/psp/CUSTOMER1/?cmd=login") does not exist on the sorry page web server:
service Sorry-Server
protocol tcp
port 8000
keepalive type tcp
ip address 192.168.2.254
active
service server1
ip address 192.168.2.101
protocol tcp
keepalive type tcp
port 8080
active
service server2
ip address 192.168.2.102
protocol tcp
keepalive type tcp
port 8080
active
owner Customer1
content Content1
    vip address 192.168.1.101
    port 80
    protocol tcp
    url "/*"
    balance aca
    advanced-balance arrowpoint-cookie
    flow-timeout-multiplier 6
    add service server1
    add service server2
    primarySorryServer Sorry-Server
    active
content Content1-Redirect
    redirect "/psp/CUSTOMER1/?cmd=login"
    vip address 192.168.1.101
    port 80
    protocol tcp
    url "/"
    active
Thanks in advance for your help!
Best regards,
Harry

Hi again,
During a maintenance window I made the following change and that made things a bit better:
service Sorry-Server
type redirect
keepalive type none
redirect-string "192.168.2.254:8000"
active
However, since the redirect string points to a private address, Internet users are not able to access the URL.
As a work-around I sent the redirect to a new content rule with a public address and then configured a second sorry page server:
service Sorry-Server
type redirect
keepalive type none
redirect-string "sorry.example.com:8000"
active
service Sorry-Server-2
ip address 192.168.2.254
protocol tcp
port 8000
keepalive type tcp
active
owner Customer1
content Content2
    vip address x.x.x.x
    add service Sorry-Server-2
    port 8000
    protocol tcp
    active
Is there a better way to do this?
Best regards,
Harry

CSM : Sorry server and Stickyness when reals are overloaded

Hi,
I have a portal of eight real servers and one sorry server, which should redirect new user to another portal, in case of an overload condition of all eight real servers. Server load is measured on each real server using a custom developed agent, which basically measures the real CPU load. If a real server experiences an overload, the local agent uses the CSM XML interface to set the maxcons value in the CSM to stop accepting new connections. However, I want to continue accepting sticky connections (request with a valid cookie). The experience shows that the CSM does accept to create new connections to real server reaching maxcons, even if a cookie exist.
This causes a problem if we want to redirect NEW users to another portal in case of overload, but to keep EXISTING users in the server farm, even if the number of connections could increase slightly above maxconns...
How can I solve the problem ?
Thank you
Yves Haemmerli

Hi Thomas,
Thank you for your comment. I also understand this behaviour like you, however this can have a devastating effect in a global portal environment. Imagine, you have three portals distributed over the world, each having let say 8 real servers. In the real life, it is seldom to replicate data in real time between data centers, due to the distance. However, the user roles and customized bookmarks and other user-specific settings are replicated. This allows to provide a global portal to users. But if a user connects to one particular regional portal, he has to stay on this portal for the duration of the whole browser session, do you follow me ? OK, now imagine that all 8 real servers in a portal reach the maxconns, because 10'000 users are connected to the portal. For new users (users with no sticky cookie), we want to send them to another regional portal. This is achieved with the global site selection provided by the GSS for example. But for existing user already connected to the overloaded portal, we want to KEEP them on the portal ! else, as the user browser continuously opens and closes TCP sessions, all 10'000 users will be immediately transferred to the other regional portal! This means the the other regional portal will becom overloaded as well, while the first portal load will be droped to zero very quickly ! Then, we not only create a situation where users loose their data by being transferred to another portal, but we also create a oscillations in the portal load !
I really don't know if there is a mean to solve this problem...Do you have any idea ?
Regards,
Yves Haemmerli

ACE - Sorry Server

Similar Messages

Maybe you are looking for