Fortinet black logo

Handbook

Health check

Health check

In Global Server Load Balance (GSLB) deployments, the system uses health checks to poll the virtual servers to test whether or not the virtual server is available. In this profile, you can include results from multiple health checks. For example, you can configure an HTTP health check test and a TCP health check test.

Predefined health check configuration objects describe the predefined health checks. You can get started with these or create custom objects.

Predefined health check configuration objects

Predefined

Description

LB_HLTHCK_HTTP

Sends a HEAD request to the server port 80. Expects the server to return an

HTTP 200.

LB_HLTHCK_HTTPS

Sends a HEAD request to the server port 443. Expects the server to return an HTTP 200.

LB_HLTHCK_ICMP

Pings the server.

LB_HLTHCK_TCP_ECHO

Sends a TCP echo to server port 7. Expects the server to respond with the corresponding TCP echo.

Before you begin
  • You must have a good understanding of TCP/IP and knowledge of global load balance.
  • You must know the IP address, port, and configuration details for the local load balance servers.
  • For some protocol checks, you must specify user credentials.
  • You must have Read-Write permission for Load Balance settings.
  • After you have configured a health check, you can select it in virtual server configuration.
To configure a health check
  1. Go to Health Check, click Create New to display the configuration editor.
  2. Select one of the following options:
  • ICMP
  • TCP Echo
  • TCP
  • HTTP
  • HTTPS
  • UDP
  • DNS
  • Complete the configuration as described in Health check configuration.
  • Save the configuration.
  • Setting

    Guidelines

    Name

    Configuration name. Valid characters are A-Z, a-z, 0-9, _, and -. No spaces. After you initially save the configuration, you cannot edit the name.

    Type

    Select a type of health check.

    General

    Destination Address Type

    IPv4

    IPv4 Address

    The IPv4 address to send health check traffic. If you do not specify an IPv4 address, the virtual server IPv4 address is used.

    Interval

    Seconds between each health check. Should be more than the timeout to prevent overlapping health checks. The default is 30.

    Timeout

    Seconds to wait for a reply before assuming that the health check has failed. The default is 10.

    Up Retry

    Attempts to retry the health check to see if a down server has become available. The default is 1.

    Down Retry

    Attempts to retry the health check to see if an up server has become unavailable. The default is 3.

    Specifics

    TCP / UDP

    Port

    Listening port number of the virtual server.

    HTTP / HTTPS

    Port

    Listening port number of the virtual server. Usually HTTP is 80, HTTPS is 443. If testing an HTTP proxy server, specify the proxy port.

    SSL Ciphers

    For HTTPS only. Default selections are recommended.

    Local Cert

    For HTTPS only. Paste the local SSL Health Check Client certificate into the blank.

    HTTP CONNECT

    Specify an HTTP CONNECT option:

    • Local CONNECT—Use HTTP CONNECT to test the tunnel connection through the proxy to the remote server. The virtual server is deemed available if the request returns status code 200 (OK).
    • Remote CONNECT—Use HTTP CONNECT to test both the proxy server response and remote server application availability. If you select this option, you can configure an HTTP request within the tunnel. For example, you can configure an HTTP GET/HEAD request to the specified URL and the expected response.
    • No CONNECT—Do not use the HTTP CONNECT method. This option is the default.

    The HTTP CONNECT option is useful to test the availability of proxy servers only.

    Remote Host

    If you use HTTP CONNECT to test proxy servers, specify the remote server IP address.

    Remote Port

    If you use HTTP CONNECT to test proxy servers, specify the remote server port.

    Method Type

    HTTP method for the test traffic:

    • HTTP GET—Send an HTTP GET request to the server. A response to an HTTP GET request includes HTTP headers and HTTP body.
    • HTTP HEAD—Send an HTTP HEAD request. A response to an HTTP HEAD request includes HTTP headers only.

    Send String

    The request URL, such as /contact.php.

    Receive String

    A string expected in return when the HTTP GET request is successful.

    Status Code

    The health check sends an HTTP request to the server. Specify the HTTP status code in the server reply that indicates a successful test. Typically, you use status code 200 (OK). Other status codes indicate errors.

    Match Type

    What determines a failed health check?

    • Match String
    • Match Status
    • Match All (match both string and status)

    Not applicable when using HTTP HEAD. HTTP HEAD requests test status code only.

    DNS

    Domain Name

    The FQDN, such as www.example.com, to use in the DNS A/AAAA record health check.

    Address Type

    IPv4

    Host Address

    IP address that matches the FQDN, indicating a successful health check.

    Health check

    In Global Server Load Balance (GSLB) deployments, the system uses health checks to poll the virtual servers to test whether or not the virtual server is available. In this profile, you can include results from multiple health checks. For example, you can configure an HTTP health check test and a TCP health check test.

    Predefined health check configuration objects describe the predefined health checks. You can get started with these or create custom objects.

    Predefined health check configuration objects

    Predefined

    Description

    LB_HLTHCK_HTTP

    Sends a HEAD request to the server port 80. Expects the server to return an

    HTTP 200.

    LB_HLTHCK_HTTPS

    Sends a HEAD request to the server port 443. Expects the server to return an HTTP 200.

    LB_HLTHCK_ICMP

    Pings the server.

    LB_HLTHCK_TCP_ECHO

    Sends a TCP echo to server port 7. Expects the server to respond with the corresponding TCP echo.

    Before you begin
    • You must have a good understanding of TCP/IP and knowledge of global load balance.
    • You must know the IP address, port, and configuration details for the local load balance servers.
    • For some protocol checks, you must specify user credentials.
    • You must have Read-Write permission for Load Balance settings.
    • After you have configured a health check, you can select it in virtual server configuration.
    To configure a health check
    1. Go to Health Check, click Create New to display the configuration editor.
    2. Select one of the following options:
    • ICMP
    • TCP Echo
    • TCP
    • HTTP
    • HTTPS
    • UDP
    • DNS
  • Complete the configuration as described in Health check configuration.
  • Save the configuration.
  • Setting

    Guidelines

    Name

    Configuration name. Valid characters are A-Z, a-z, 0-9, _, and -. No spaces. After you initially save the configuration, you cannot edit the name.

    Type

    Select a type of health check.

    General

    Destination Address Type

    IPv4

    IPv4 Address

    The IPv4 address to send health check traffic. If you do not specify an IPv4 address, the virtual server IPv4 address is used.

    Interval

    Seconds between each health check. Should be more than the timeout to prevent overlapping health checks. The default is 30.

    Timeout

    Seconds to wait for a reply before assuming that the health check has failed. The default is 10.

    Up Retry

    Attempts to retry the health check to see if a down server has become available. The default is 1.

    Down Retry

    Attempts to retry the health check to see if an up server has become unavailable. The default is 3.

    Specifics

    TCP / UDP

    Port

    Listening port number of the virtual server.

    HTTP / HTTPS

    Port

    Listening port number of the virtual server. Usually HTTP is 80, HTTPS is 443. If testing an HTTP proxy server, specify the proxy port.

    SSL Ciphers

    For HTTPS only. Default selections are recommended.

    Local Cert

    For HTTPS only. Paste the local SSL Health Check Client certificate into the blank.

    HTTP CONNECT

    Specify an HTTP CONNECT option:

    • Local CONNECT—Use HTTP CONNECT to test the tunnel connection through the proxy to the remote server. The virtual server is deemed available if the request returns status code 200 (OK).
    • Remote CONNECT—Use HTTP CONNECT to test both the proxy server response and remote server application availability. If you select this option, you can configure an HTTP request within the tunnel. For example, you can configure an HTTP GET/HEAD request to the specified URL and the expected response.
    • No CONNECT—Do not use the HTTP CONNECT method. This option is the default.

    The HTTP CONNECT option is useful to test the availability of proxy servers only.

    Remote Host

    If you use HTTP CONNECT to test proxy servers, specify the remote server IP address.

    Remote Port

    If you use HTTP CONNECT to test proxy servers, specify the remote server port.

    Method Type

    HTTP method for the test traffic:

    • HTTP GET—Send an HTTP GET request to the server. A response to an HTTP GET request includes HTTP headers and HTTP body.
    • HTTP HEAD—Send an HTTP HEAD request. A response to an HTTP HEAD request includes HTTP headers only.

    Send String

    The request URL, such as /contact.php.

    Receive String

    A string expected in return when the HTTP GET request is successful.

    Status Code

    The health check sends an HTTP request to the server. Specify the HTTP status code in the server reply that indicates a successful test. Typically, you use status code 200 (OK). Other status codes indicate errors.

    Match Type

    What determines a failed health check?

    • Match String
    • Match Status
    • Match All (match both string and status)

    Not applicable when using HTTP HEAD. HTTP HEAD requests test status code only.

    DNS

    Domain Name

    The FQDN, such as www.example.com, to use in the DNS A/AAAA record health check.

    Address Type

    IPv4

    Host Address

    IP address that matches the FQDN, indicating a successful health check.