Technical Tip: Configure a virtual server

 

 

In a virtual server, a health check is used to monitor the members' availability in the real server pool. It tests whether an application is accessible by polling the servers. If a server fails the health check and retries also fail, it is considered unavailable, and traffic is disabled to that server. This helps ensure that only healthy servers receive connections, improving overall system performance.

 

4. Go to Policy & Objects -> Firewall Policy and select 'Create New'.

Remember to change the inspection mode to 'proxy-based'. If this step is not taken, it will not be possible to find the 'object virtual_server' in the policy.

Note: If the option to change the inspection mode from flow-based to proxy-based is not visible, refer to the following article: 

Technical Tip: Inspection mode option is not visible under Policy 
Now, the virtual server will be working and will use load balancing for the internal server.

1. Enable Load Balancing:
   
   

config system settings
    set gui-load-balance enable
end

2. Create a virtual server:
   
   

config firewall vip
    edit "Vserver"
        set type server-load-balance
        set extip 172.20.120.121
        set extintf "any"
        set server-type http
        set monitor "Test"
        set ldb-method round-robin
        set persistence http-cookie
        set extport 8080

            config realservers

             edit 1

                 set type ip

                 set ip 10.31.101.30

                 set port 80

            end

end 

Ornstein-kvm40 (Test) # sh full

   config firewall ldb-monitor

    edit "Test"

        set type http

        set interval 10

        set timeout 2

        set retry 3

        set port 0

        set src-ip 0.0.0.0

        set http-get "www.test.com"

        set http-match ''

        set http-max-redirects 2  

end

Note:

If one or more real servers are located outside of the FortiGate network and connected through an IPsec tunnel, use the 'set src-ip' to specify a valid IP address that will be accepted over the tunnel.

3. Add the virtual server to a policy as the destination address: 
   
   

config firewall policy
    edit 2
        set name "Virtual_Server"
        set inspection-mode proxy  <- Inspection needs to be in Proxy mode.
        set srcintf "wan"
        set dstintf "LAN"
        set srcaddr "all"
        set dstaddr "Vserver"
        set action accept
        set schedule "always"
        set service "ALL"
        set utm-status enable
        set ssl-ssh-profile "certificate-inspection"
        set av-profile "default"
        set fsso disable
        set nat enable
end

• ICMP Protocol is often considered better than HTTPS for health checks of virtual servers because it is more resource-efficient, requiring less processing power since it only verifies network reachability.
• It is simpler, focusing solely on network connectivity without the complexities of SSL handshakes or HTTP requests.
• It is faster, avoiding the overhead of establishing secure connections, which makes it suitable for frequent checks.
• ICMP has lower overhead overall, reducing the load on both client and server during continuous monitoring.

Another reason for the block page is the difference in URL used on the browser compared to the configured Real Servers HTTP Host value.