IIS - IIS Site still responding when stopped - Asked By Sebastien on 02-Nov-10 09:47 AM

Hello,
First, here's my setup

- IIS7 / Windows Server 2008 / 1 NIC
- 2 Sites with 2 different IP addresses
- Both sites are on port 443

When I stop "site1" and "site2" is still running, I'm still able to telnet the "site1" IP/Port.

This is causing trouble with our load balancer that doesn't see the site as "down" and doesn't redirect to the other server as it's supposed to.

Any ideas ?
Thanks

Kishore Kumar replied to Sebastien on 11-Nov-10 05:37 AM

Hi,

Stopping the site doesn't make the IP address inactive.
You can ping/telnet the IP address of site 1 eventhough it is stopped.

Sebastien replied to Kishore Kumar on 15-Nov-10 03:39 PM

Thanks for your reply.

Do you have any ideas how I can make it totally unavailable ? If we are doing a maintenance of Site1, we'll want it stopped and we need the load balancer to redirect the traffic to the 2 other sites instead.

Thank you,

Sebastien

Sebastien replied to Kishore Kumar on 16-Nov-10 10:43 AM

I just did the test and when I stop both sites in IIS, I no longer can telnet the IP/port.

So this is happening only when 1 of the 2 IIS sites is stopped. And that is my issue.

Phillip replied to Sebastien on 16-Nov-10 07:10 PM

I'm having the same issue. Check your httperr.log in system32\logfiles\httperr and you'll see it sending a 404 when you hit the stopped website. Looks like http.sys is responding with a 404 even though the website is stopped. I'm having the same issue and it's causing problems with our load balancer as well. No load balancer is going to failover on a 404.

Unfortunately, no solution yet.

Sebastien replied to Phillip on 17-Nov-10 10:19 AM

Thanks for your answer.

I finally have something concrete to work with. I'll open a ticket with Microsoft Premier Support and see if they can help me out with this.

I'll do an update once I receive an answer.

Seb

Phillip replied to Sebastien on 17-Nov-10 11:30 AM

Another clue we just found: if you bind to port 80 and try it, it should give you the correct message. It's just when you use SSL/443 that it's responding with a 404. I've noticed it's also loading up the certificate bound to the website even though that website is off(!)

Phil.

Phillip replied to Phillip on 22-Nov-10 05:33 PM

I did some further testing and as you mentioned in your environment, it only happens with 2 or more sites and at least one site is still running. If I turn off site1 and leave site2 running, I get the 404. If I delete site2, I get the proper 'cannot display' message. If both are off or IIS is off, I get the proper message. Deleting, starting or stopping one site really shouldn't affect another site in any way so there's definitely something strange going on here.

It's pretty much if ANY site is listening for port 443, it will always respond whether to you got the correct site or not. I tested with a bare bones IIS 7.5 box so it's definitely the default behaviour and not an addon module or anything.

Phillip replied to Sebastien on 22-Nov-10 05:54 PM

And a bit more:

If both sites are stopped, netstat -ano doesn't show anything listening on port 443.

If I start one site (I've done an netsh http add iplisten ipaddress=192.168.1.2:443 for each of the sites to split them), I get the following with the netstat -ano:

TCP 192.168.1.1:443 0.0.0.0:0 LISTENING 4

TCP 192.168.1.2:443 0.0.0.0:0 LISTENING 4

So starting just one site makes all sites start listening.

Sebastien replied to Phillip on 23-Nov-10 09:21 AM

Thank you for all your updates Phillip.

I didn't had time last week to open a ticket with Microsoft so I did it this morning. I usually get a reply within 2 hours. I hope they'll be able to give us a quick fix soon.

Seb

Phillip replied to Sebastien on 09-Dec-10 10:45 AM

Hi Seb,

Any luck with MS? Hopefully they gave you more than 'it's by design' :)

Thanks,

Phil

Sebastien replied to Phillip on 09-Dec-10 10:58 AM

Hi,

What a coincidence that you've replied cause I was currently testing what MS suggest me.

They've refered me to that site: http://www.iis.net/ConfigReference/system.applicationHost/applicationPools/add/failure

There are some options in IIS to configure the Failover behavior with either HTTPLevel and TCPLevel. By default, it is configured to use the HTTPLevel. I've tried to set it to TCPLevel on my side without any luck. Maybe it'll work for you.

She also told me that there's supposed to be a setting in the load balancer to be "HTTP aware" which should solve our issue.

Also, I just saw that I never mentioned that we currently have a workaround for that issue. It is working but it's not good enough for us on our side.

We have copied html pages at the root of each sites containing a single line of text (ex: LOAD BALANCING PAGE). We then configured new monitors on the load balancer to "SEND STRING : GET /htmlfilelocation/htmlpage.html" and "RECEIVE STRING: LOAD BALANCING PAGE". This way, when the site is stopped, the load balancer is unable to read the html page.

Maybe that could be enough for you. On my side, I've contacted our Load Balancing team to see if they can find that "HTTP Aware" option on our LB.

I'll get back to you when I have more details.

Phillip replied to Sebastien on 09-Dec-10 12:44 PM

Hi Seb,

Thanks for the details. I doubt the Failover stuff will work because it's an app pool setting which would imply the app pool is responding to the request. But in the case of the site stopped, it's the HTTP.sys that's responding and it wouldn't be related to a specific app pool. The app pool wouldn't 'fail to start' because that website isn't responding to the request anyway.

I have my suspicions about the HTTP aware thing as well. I'm not sure what it is but the load balancer is receiving a valid 404 and won't switch over on that.

But I appreciate you looking into it and I'll definitely try the fix you have in place. I have a similar set up in my Application Request Routers (ARR) when looking at an application server. I'm looking for a specific response in a specific file and when the site is offline, it successfully removes it from the farm. The problem is, I have a hardware load balancer balancing the ARR servers and it's just looking at generic responses from ARR. I'll see if that load balancer can also get a file response check.

Thanks!

Phil.