Product Documentation
ADC
14.1 - Current Release 13.1 13.0 12.1
View PDF

SSL service monitoring

October 10, 2023
Contributed by: 
C S

The NetScaler appliance has built-in secure monitors, TCPS, and HTTPS. You can use the secure monitors to monitor HTTP and non-HTTP traffic. To configure a secure HTTP monitor, select the monitor type as HTTP, and set the secure flag. To configure a secure TCP monitor, select the monitor type as TCP, and set the secure flag. The secure monitors work as follows:

  • Secure TCP monitoring. The NetScaler appliance establishes a TCP connection. After the connection is established, the appliance performs an SSL handshake with the server. After the handshake is over, the appliance closes the connection.
  • Secure HTTP monitoring. The NetScaler appliance establishes a TCP connection. After the connection is established, the appliance performs an SSL handshake with the server. When the SSL connection is established, the appliance sends HTTP requests over the encrypted channel and checks the response codes.

The following table describes the available built-in monitors for monitoring SSL services.

Monitor type Probe Success criteria (Direct condition)
TCP TCP connection; SSL handshake Successful TCP connection established and successful SSL handshake.
HTTP TCP connection; SSL handshake; Encrypted HTTP request Successful TCP connection is established, successful SSL handshake is performed, and expected HTTP response code in server HTTP response is encrypted.
TCP-ECV TCP connection. SSL handshake (Data sent to a server is encrypted.) Successful TCP connection is established, successful SSL handshake is performed, and expected TCP data is received from the server.
HTTP-ECV TCP connection; SSL handshake (Encrypted HTTP request) Successful TCP connection is established, successful SSL handshake is performed, and expected HTTP data is received from the server.

Sample configuration for HTTP-ECV health check monitor

HTTP services have predefined monitors capable of Extended Content Verification (ECV). These monitors are used when a validation is required beyond a successful TCP connection. These monitors validate the service as UP, when all the following criteria are met:

  • A successful TCP connection.
  • A particular type of request must be generated.
  • A specific message is expected in reply from the Receive String.

For these monitors, a request string is configured along with a reply string. If the reply string received by the NetScaler monitor matches the configured string, then the service is marked UP.

Bind a monitor to a service by using the GUI

  1. Navigate to Traffic Management > Load Balancing > Services, create a service, and specify the protocol as SSL. Click OK.
  2. Click in the Service to Load Balancing Monitor Binding pane, and click Add Binding.
  3. Choose the monitor type as HTTP-ECV and click Edit.
  4. In the Configure Monitor pane under Basic Parameters tab, enter values for the following parameters:
    • Send String – The string that the monitor must send to the service.
    • Receive String – The string that the monitor must receive to mark the service as UP.
  5. Click OK to complete the monitor configuration.
  6. Click Select.
  7. Click Bind to bind the HTTP-ECV monitor to the service.
  8. Click Close.

Create and bind a monitor to a service by using the CLI

At the command prompt, type:

add lb monitor <monitor-name> http-ecv
bind service <servicename> -monitorName <monitor-name>
<!--NeedCopy-->

Example:

add lb monitor monitor-1 http-ecv
bind service services1 -monitorName monitor-1
<!--NeedCopy-->
SSL service monitoring
October 10, 2023
Contributed by: 
C S
October 10, 2023
Contributed by: 
C S

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.