Converting an NSX Load Balancer Virtual Server from Layer 7 to Layer 4 without dropping existing connections

Products

• VMware NSX

Issue/Introduction

Symptoms:

The NSX Load Balancer, by default, will use layer 7 for the virtual servers that are created. For better performance, we may use "Enable Acceleration" for the virtual server, which means the Virtual Server will be converted to Layer 4 load balancing.

To perform this change without causing a system outage, ensure there are no settings that will force the engine into Layer 7 mode. if there are L7 settings, such as http cookie persistence, url algorithm, ssl termination etc, LB will use L7 engine only. For more information, see SOL-6421.

In the case of other Layer 7 Virtual Server on the Load Balancer,:
The existing connections will stay active and continue to work.

NOTE: existing Layer 7 connections will not longer display in the "show service loadbalancer session" command after acceleration is enabled but the connections will continue to run normally. When the connections reset normally, they will reconnect on the Layer 4 engine and will show up in the "show service loadbalancer session" command. Having both a Layer 7 Virtual Server and a Layer 4 Virtual Server running will result in two haproxy engines to be running. This can be confirmed by running 'show process list' on the load balancer and finding two haproxy processes.

Example:

edge> show process list
0.0 0.0 20508 712 Ss+ 09:51:49 00:00:00 /sbin/agetty --noclear tty1 9600
91.0 0.1 22880 1440 Rs 10:16:26 00:05:58 /usr/local/sbin/haproxy -f /var/db/vmware/vshield/haproxy.conf -p /var/run/haproxy/haproxy.pid -D -L lb-0 -sf 23663
0.0 0.1 22856 1260 Ss 10:22:26 00:00:00 /usr/local/sbin/haproxy -f /var/db/vmware/vshield/haproxy.conf -p /var/run/haproxy/haproxy.pid -D -L lb-0 -sf 24290

If no other Layer 7 Virtual Server on the Load Balancer: All the existing connections will be dropped and new connections will be established on the new Layer 4 engine. This occurs because the Layer 7 engine is stopped and the Layer 4 engine is started.

Environment

VMware NSX for vSphere 6.2.x
VMware NSX for vSphere 6.3.x

Resolution

To work around the issue when there is no other Layer 7 Virtual Server on the load balancer:

1. Create a Dummy Virtual Server.
   • Assign an IP to the Virtual Server
   • No pool members need to be created or any other settings.
2. Follow Solution SOL-6421 to enable acceleration on the original Virtual Server
3. run "show process list" and verify there are two haproxy processes (engines).
4. Once all the existing Layer 7 connections have reset normally, then the Layer 7 engine will disappear and "show process list" will show only one haproxy process
5. When there is only one haproxy engine left, it is safe to delete the Dummy Virtual Server

NOTE: existing Layer 7 connections will not longer display in the "show service loadbalancer session" command after acceleration is enabled but the connections will continue to run normally. When the connections reset normally, they will reconnect on the Layer 4 engine and will show up in the "show service loadbalancer session" command.