Created on 12-21-2017 04:50 AM
I don't want this behavior! There does not seem to be any configuration option that relates to the behavior when a server connection limit is met.
I'm doing "server load balancing", from a TCP virtual server to three real servers in a pool. The real servers must have either connection limits or rate limits, due to the application nature. I have observed that when connection limits are reached, the action taken by the ADC device is to send back an ICMP "port unreachable" message to the client attempting to connect to the virtual server. Because of the volume of traffic that is exceeding these limits, a high volume of these ICMP messages are actually causing problems in the environment!
In TCP land, there are generally three actions to be taken by a server when it cannot take another new connection (a SYN packet):
[ul]The later two choices are considered "fast fail" approaches, because such reply packets are generated immediately, and the client very quickly knows it failed. The first approach will cause the client to stall, as it retries the initial SYN packet again, for some number of retries, and with a progressively longer time between attempts.
My application needs the first approach, and was working just fine before, using a Coyote Point load balancer. The Coyote allowed for some configuration details in this area, while our new ADC device apparently does not.
ANY clues/thoughts greatly appreciated!
Product: FortiADC 100F with 4.7.0 software.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1517 | |
1013 | |
749 | |
443 | |
209 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.