NSX Layer 7 Load Balancer does not support the HTTP CONNECT method

Products

• VMware NSX

Issue/Introduction

• Layer 7 Load Balancer working as the HTTP forward proxy will fail with 400 Bad Request when the request uses the HTTP CONNECT method.
• The 405 Method Not Allowed could also be returned after the NGINX is upgraded to 1.22 in NSX.
• In the error.log file, you see entries similar to:

var/log/lb/<lb-id>/logs/error.log

yyyy/mm/dd hh:mm:ss [info] * client sent invalid request while reading client request line, client: <IP address>, server: , request: "CONNECT <Destination>:443 HTTP/1.1"

yyyy/mm/dd hh:mm:ss [debug] * http finalize request: 400, "?" a:1, c:1

...

yyyy/mm/dd hh:mm:ss [debug] * HTTP/1.1 400 Bad Request

Server: NSX LB

Date: <Date>

Content-Type: text/html

Content-Length: <length>

Connection: close

Environment

VMware NSX

Cause

Nginx does not support the HTTP CONNECT method. The NSX Load Balancer is based on the Nginx, therefore such requests cannot be handled by the Layer 7 Load Balancer.

Resolution

Workaround:

If the HTTP CONNECT requests in the traffic are required, the Layer 4 Load Balancer can be used to avoid 400 Bad Request response codes.