F5 DNS external monitor

Hi,

Have you tried to create a monitor for each FQDN with a simple monitor string?

e.g.

GET /checkService HTTP/1.1\r\nHost: dns-name\r\nConnection: close\r\n\r\n

See this article:

https://support.f5.com/csp/article/K13397

Regards

yes , but the platform is openshift an works based on https with TLS SNI . I don't know all te internals but it's accepted on what they call "router" but there is no SSL done there , so they are also forwarding to application .So when we introduce the hostname in http header , it's not accepted and we get an http error rather than the expected 200 ok.

Using curl & working with the FQDN works fine . But i don't see possibility to define a node based on FQDN in F5 DNS .

Hi, sorry the delay.

OK, the issue is probably the SNI.

Could you try with this external monitor?

I use to have this one on my setup.

Regards

#!/bin/sh
# These arguments supplied automatically for all external monitors:
# $1 = IP (nnn.nnn.nnn.nnn notation)
# $2 = port (decimal, host byte order)
#
# This script expects the following Name/Value pairs:
# HOST = the host name of the SNI-enabled site
# URI  = the URI to request
# RECV = the expected response
#
# Remove IPv6/IPv4 compatibility prefix (LTM passes addresses in IPv6 format)
 
NODE=`echo ${1} | sed 's/::ffff://'`
if [[ $NODE =~ ^[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}$ ]]; then
    NODE=${NODE}
else
    NODE=[${NODE}]
fi
PORT=${2}
 
PIDFILE="/var/run/`basename ${0}`.sni_monitor_${HOST}_${PORT}_${NODE}.pid"
if [ -f $PIDFILE ]
then
    echo "EAV exceeded runtime needed to kill ${HOST}:${PORT}:${NODE}" | logger -p local0.error
    kill -9 `cat $PIDFILE` > /dev/null 2>&1
fi
echo "$$" > $PIDFILE
curl-apd -k -i --silent --resolve ${HOST}:${PORT}:${NODE} https://${HOST}:${PORT}${URI} | grep -i "${RECV}" > /dev/null 2>&1
STATUS=$?
# Remove the pidfile before the script echoes anything to stdout and is killed by bigd  
rm -f $PIDFILE
if [ $STATUS -eq 0 ]
then
    echo "UP"
fi
exit

i uploaded this script on both our DNS (GTM) unit via system - file managament - external monitor files . As we use 2 F5 DNS in a sync group , did this seperate on both units .

I than created the monitor based on this script, with parameters HOST - URI - RECV.

The server equiped with this monitor is put down . But the weird thing is that when i try to check via tcpdump , i don't even see a query going out of the box ?? i even did tcpump -i 0.0 for checking all interfaces on the box .

I'm puzzled to see an external file monitor being present & linked to server . But tcpdump showing me nothing is send out , but still monitor is being put to down.

I worked before on LTM units with external monitors and had no issues there . But this is not an LTM unit , but only a DNS unit (no LTM enabled on it ) . I presume external monitors would work also on F5 DNS ??

Yes, it should work to DNS as in LTM unit.

Did you add the DNS units to data center server list as you did to the openshift generic hosts?

Did you try to run script on bash to know if paramaters and script are OK?

If possible, please share your setup here.

i'm using 2 F5 DNS units in a sync group . (version 12.1.2)

we have 2 datacenters (DC1 & DC2) . In each datacenter we deployed an F5 DNS .

hereunder is the config like it was created (I changed DNS names & IP's but nothing else) :

gtm datacenter /Common/DC1 {

   description "Datacenter DC1"

}

gtm datacenter /Common/DC2 {

   description "Datacenter DC2"

}

gtm prober-pool /Common/GTM-Probers-DC1 {

   members {

       /Common/unit-dc1 {

           order 0

       }

       /Common/unit-dc2 {

           order 1

       }

   }

}

gtm prober-pool /Common/GTM-Probers-DC2 {

   members {

       /Common/unit-dc1{

           order 1

       }

       /Common/unit-dc2 {

           order 0

       }

   }

}

gtm server /Common/DC1-Openshift-virtual-ip {

   addresses {

       10.100.100.100 {

           device-name /Common/DC1-Openshift-virtual-ip

       }

   }

   datacenter /Common/DC1

   prober-pool /Common/GTM-Probers-DC1

   product generic-host

   virtual-servers {

       testname.domain {

           destination 10.100.100.100:443

           monitor /Common/Test

       }

   }

}

gtm monitor external /Common/Test {

   defaults-from /Common/external

   destination *:*

   interval 30

   probe-timeout 5

   run /Common/https-sni-monitor-v1

   timeout 120

   user-defined HOST testname.domain

   user-defined RECV 200

   user-defined URI /checkService

}

so we are creating a generic host without monitor . ANd than define a virtual server on F5 DNS based on that host on port 443 .Monitor "Test" is associated with this vs , and this is an EAV monitior pointing to file "https-sni-monitor-v1" . Which is the file with script mentioned earlier here .

This script was uploaded as a file , via "System" - "File management" - "external monitor" as is normal procedure described by F5.

When monitor is enabled on host , we see host being put "down" after the monitoring interval .

however when doing an tcpdump , we do not see anything going out to IP address of the host where monitor is defined .

sorry to say . but this was a stupid mistake from my side .

a #-character was missing in the beginning of the script . Which made that that line wasn't commented out & did make script fail . Hence normal we didn't see anything in tcpdump as script wasn't being executed correctly.