9

I have come across a situation that I cannot understand. We have a Fortigate firewall that we have enabled to do load-balancing across two back-end Apache web servers. A DNS name is then mapped to the virtual IP on the Load Balancer.

As expected, when you browse to the DNS name/URL (e.g. www.something.com), the Load Balancer serves up a page from one of the back-end Apache web servers. The URL in the browser stays www.something.com. From what I understand, the Load Balancer in this case is simply forwarding packets between the browser and Apache while always staying in-path.

However, if I browse to the IP address that the DNS is mapped to, then the Load Balancer returns a HTTP 302 Found, with the Location header set to the DNS URL of one of the Apaches. The URL in the browser changes to the back-end server DNS.

Why is the Load Balancer redirecting when queried via IP, but correctly forwarding in-path when queried via DNS name.

10

I haven't used a Fortigate FW for load balancing, so I will answer some of the questions more generally.

First, as to your problem, the load balancer is doing exactly as it is supposed to do and I think your servers may not be configured correctly to respond to a request on their IP address. If you were to test this behind the load balancing, you could set the domain name in a local client's hosts file, behind the firewall with the server and access it both with domain name and internal IP. You will probably get the same result you are seeing now.

My guess is that you have virtual hosting turned on (to support multiple domains on a single server) and the "default" is not serving the same pages as your domain. You are getting a web page back from the server in both cases. If you need help with configuring your web server, you may want to try on ServerFault.

Second, to get into a bit more detail. A load balancer typically operates at L7 for at least HTTP and HTTPS clusters. This means that they don't just look at the IP address and forward it, nor do they "redirect" the page.

When they receive a request, they actually parse the request and forward it to a server after processing the request. There are many things that they can do at this point, such as rewriting the headers in both directions, potentially adding cookies (for persistence) into the data going back to the client, terminating SSL sessions, matching based on the URL, etc.

I recommend you spend some time fully reading the vendor documents to get a better understanding of how load balancing works (with Fortigate you can read both theirs and Coyote Point - another load balancing company Fortigate acquired). Understanding what it is doing will help you in cases like this and will allow you to unlock capabilities that you didn't realize existed.

  • The issue was a configuration on the back-end Apache webserver. The new DNS name needed to be added as an Alias. – Yusuf Oct 3 '13 at 6:14
3

After reading the HTTP host-based load balancing in the Fortigate Load Balancing doc, I can see how you can have an atypical load-balancing configuration that could result in what you describe. However, without part of your config, we cannot be certain if this is the case for you.

Fortigate FortiOS allows a Virtual Server to be created that is tied to Real Servers that each have a different host header configuration. Should any requests match the VIP of your Virtual Server, the load balanced requests will only go to Real Servers that match that host header. The most important part which nicely explains your symptoms, is that one of the Real Servers can omit the host header so it matches on any host header.

The Real Server without a host header might have been configured as a sort of "catch-all" that lands on a site that does the redirect.

Using the example below, only the 1st and 2nd rservers handle traffic matching your preferred DNS name via the host header, but the 3rd rserver takes anything matching all other host headers which includes the DNS VIP itself and sends to a site that could do a redirect.

config firewall vip
 edit "http-host-ldb"
  set type server-load-balance
  set extip 192.0.2.1
  set extintf "lan"
  set server-type http
  set ldb-method http-host
  set extport 80
  config realservers
    edit 1
      set http-host "www.example.com"
      set ip 192.168.2.1
      set port 80
      next
    edit 2
      set http-host "www.example.com"
      set ip 192.168.2.2
      set port 80
      next
    edit 3
      set ip 192.168.2.3
      set port 80
      next
    end
 end

I suppose the firewall load-balancing could be doing the redirect itself, but we cannot tell with the limited info provided.

  • In this configuration, it's being set to name based matching. And that's the issue. If you go to the VIP by address, it won't know what to do with it. (normal NAT rules will then apply) – Ricky Beam Sep 3 '13 at 21:59
  • The main reason I didn't believe this to be the answer is that no FW/load balancer that I know of will return a 302 with the location set to the hostname/domain of the internal resource (at least without specifically configuring it to do so, which didn't sound to be the case based on the question). – YLearn Sep 4 '13 at 2:59
  • @RickyBeam, only the first to rservers do host name matching. The last rserver would match the VIP address as the host. – generalnetworkerror Sep 5 '13 at 7:30
  • @YLearn, I agree that this would be odd; I was saying the rserver, not the LB, would have done the 302 and would have bee configured to do so. I know of no LB either that would have done that. – generalnetworkerror Sep 5 '13 at 7:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.