Avi Load Balancer Not Forwarding 'Connection: keep-alive' HTTP Header to Backend Servers

Products

• VMware Avi Load Balancer

Issue/Introduction

• Customers may observe that the Avi Load Balancer (ALB) is not forwarding the Connection: keep-alive HTTP header from the client to the backend servers, even when the client explicitly sends it. 

Environment

• Avi Load Balancer running Virtual Services configured with Layer 7 Application Profiles
• Clients communicating using HTTP/1.1 version

Cause

• This behavior is expected and by design for Virtual Service with L7 Application Profile type HTTP when handling HTTP/1.1 traffic. In HTTP/1.1, keep-alive is enabled by default; there is no need for the client to explicitly send a Connection: keep-alive header.
• With L7 Proxy, it manages and reuses connections to the backend servers independently of the client-side connection. When a client sends an HTTP/1.1 request, the ALB's L7 Proxy handles the opening and closing of backend connections to optimize resource usage and reduce latency. It abstracts away the client's Connection: keep-alive header because its own management of backend connections makes that header redundant for HTTP/1.1.
• The Connection: keep-alive header is only explicitly added and forwarded by the Avi L7 Proxy if the client request is HTTP/1.0. For HTTP/1.0, keep-alive is not enabled by default, requiring the explicit header for persistent connections.

Resolution

If explicit Connection: keep-alive header forwarding to the backend is a strict requirement, consider the following:

1. Client Uses HTTP/1.0: Configure the client to send requests using HTTP/1.0 along with the Connection: keep-alive header. In this scenario, the Avi L7 Proxy will explicitly forward the Connection: keep-alive header to the backend server. This is generally not recommended for modern applications due to performance implications of HTTP/1.0.
   
   
2. Use an L4 Application Profile: If the intention is to simply pass traffic through without L7 proxying (App Profile) and full HTTP header inspection/modification by Avi, consider using an L4 Profile (System-L4 or System-SSL) instead of an L7 Application Profile (like System-Secure-HTTP) for the Virtual Service. An L4 profile will forward TCP connections directly, preserving all headers as-is, but will lose advanced L7 features such as content switching, HTTP policies, and URL-based load balancing.