Web traffic traversing an NSX-T Data Center Load balancer may hang when using Firefox web browser

Products

• VMware NSX

Issue/Introduction

 

• Connections to backend pool members may hang when using Firefox web browser.
• These connection are successful if the load balancer is by-passed.
• These connection are successful when using another web browser.
• In the NSX-T Edge log /var/log/syslog.log, you see a 400 response from the backend pool member.

2021-10-13T13:55:15.138043+00:00 PL610235.example.local NSX 25536 LOAD-BALANCER [nsx@6876 comp="nsx-edge" subcomp="lb" s2comp="access" level="INFO"] [########-####-####-####-########ec53][########-####-####-####-########c55f] Operation.Category: Status: '400', HttpResponse.StatusCategory: '4xx', HttpResponse.Size: '1024', HttpResponse.ServerTime: '0.005', HttpResponse.TotalTime: '0.005', Error.Reason: 'Pool member returned 400'

• Using the web browser developer tool, we see the Connection request from Firefox contains two entries: keep-alive, Upgrade:

GET /cassis/endpoint?service=datacache HTTP/1.1
Host: example.local
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Sec-WebSocket-Version: 13
Origin: http://example.local
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: bLvK+8k/dUrkxtxHs5PogA==
DNT: 1
Connection: keep-alive, Upgrade <-------
Cookie: example
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

Environment

VMware NSX-T Data Center

Cause

The Connection Header can be set to: close, keepalive, and Upgrade.
These are handled in order, in the case of: Connection: keep-alive, Upgrade
The keep-alive will be matched first and therefore Upgrade option is not executed.
This results in HttpResponse. Status: '400'

Resolution

This issue is resolved in NSX-T Data Center 3.2.

Workaround:
Please use an alternative web browser.