Backend Connectivity

This guide will assist you in troubleshooting ADC Backends that are not connecting to their origin servers.

Status Per Node

Each ADC is actually attached to one or more Nodes. The best test is to go down to the Node level and check the health of your Backends.

Often a Node may not be able to connect to a Backend, even though you can, due to a firewall or something similar.

Select your ADC, and then select one of the Nodes it's deployed to. You will see a breakdown as shown below:

Screenshot

There is a large amount of information available here that is useful, but lets step the two major items.

  1. The UP or DOWN status of each backend. Hovering over the UP or DOWN label will show you the reason and last change.
  2. The HTTP Responses columns, and the number of 5xx server errors they are returning.

As you can see, the Backends are up and connected and we can send requests. If they were DOWN though there could be many reasons:

  1. You may have HTTP Health Checking enabled, and it's not returning a valid page without a host header. Try to disable HTTP health checks to verify.
  2. It may not be able to connect to the backend. Use telnet from the Node to debug, for example, telnet 1.2.3.4 443.

Screenshot

You can see in this example the UI is telling us we have a Layer 4 timeout, so we cannot connect to the backend on that IP and port.

Possible status codes

Below are all the possible status codes you could see for a Backend's health:

CodeMeaning
L4OKcheck passed on layer 4, no upper layers testing enabled
L4TOUTlayer 1-4 timeout
L4CONlayer 1-4 connection problem, for example "Connection refused" (tcp rst) or "No route to host" (icmp)
L6OKcheck passed on layer 6
L6TOUTlayer 6 (SSL) timeout
L6RSPlayer 6 invalid response - protocol error
L7OKcheck passed on layer 7
L7OKCcheck conditionally passed on layer 7, for example 404 with disable-on-404 enabled
L7TOUTlayer 7 (HTTP/SMTP) timeout
L7RSPlayer 7 invalid response - protocol error
L7STSlayer 7 response error, for example HTTP 5xx