Coyote Point Systems Equalizer GX Series, Administration Manual

Page: 321 / 866

Cluster Connection Timeouts
Layer 7 clusters (HTTP / HTTPS) and Layer 4 clusters (TCP / UDP) each use a different set of
timeout parameters as described below.
Note - Setting cluster timeouts to arbitrarily high values can have an adverse effect on cluster performance, and can
result in the cluster no longer processing traffic. We recommend that you start with default timeout values and adjust
the timeouts one by one, in small increments, until you get the timeout behavior that you desire.
HTTP and HTTPS Connection Timeouts
Connections to HTTP and HTTPS clusters are managed closely by Equalizer from the client request
to the response from the server. Equalizer needs to manage two connections for every Layer 7
connection request: the client connection from which the request originates, and the connection to
the server that is the final destination of the request (as determined by the load balancing policy).
1. Equalizer has an idle timer for the established client connection, a connect timer to establish
a server connection, and an idle timer for the established server connection. Only one
timeout is in use at any given time. This is a summary of how timeouts are used when a cli-
ent connects to Equalizer:
2. When a client successfully connects to a Virtual Cluster IP, the client timeout applies from
the time the connection is established until the client request headers are completely trans-
mitted. Equalizer parses the client's request, and verifies that the request is a valid HTTP
request and that the information needed for load balancing is obtained. In general, this hap-
pens at the time that the client headers are completed -- which is indicated by the client
sending two blank lines for HTTP 1.0 or 1.1; one blank line for HTTP 0.9. Once the headers
are completely transmitted to Equalizer, the client timeout is no longer used.
3. As soon as the Equalizer is done examining the header data, it makes a connection to a
server, as determined by the load balancing policy, persistence, or a match rule hit. The
amount of time that the Equalizer tries to establish a connection to the server is the connect
timeout. Once the server connection is established, the connect timeout is no longer used.
4. After Equalizer establishes a connection with a server, the server timeout is the amount of
time Equalizer waits for the next bit of data from the server. Any response from the server
restarts the server timeout.
The important distinction between the client timeout and the server timeout is that the client
timeout is a “hard” timeout -- the client has the number of seconds specified to transmit all of its
headers to Equalizer before Equalizer times out. This is done mainly for security considerations to
prevent malicious clients from creating a large number of partial connections and leaking data
slowly over the connection, possibly causing resource exhaustion or other undesirable effects on
Equalizer.
The
server timeout
by contrast is a “soft” timeout -- the server has the number of seconds specified
to send the next piece of information (e.g., the next packet in the sequence). Whenever the client
or the server sends a piece of data on the connection, the server timeout is reset. This allows the
server to send large data streams in small pieces without timing out, and then close the
connection once all the data is sent.
Copyright © 2014 Coyote Point Systems, A Subsidiary of Fortinet, Inc.
All Rights Reserved. 321
Equalizer Administration Guide