Default Edge SWG forwarder host health check does not represent Menlo RBI appliance status correctly

Products

• ISG Proxy
• ProxySG Software - SGOS

Issue/Introduction

Administrators may notice that default Edge SWG forwarder host health check created for a Menlo RBI proxy appliance does not represent correct status sometimes. Health check may stay in healthy status even though the Menlo service is off or unavailable. 

Environment

Edge SWG is configured to forward traffic to a Menlo RBI proxy appliance 

Cause

Menlo RBI is a distributed service and consist of multiple servers with different roles. In some cases unavailability or failure of a non-proxy node leads to service interruption which is not recorded by the default Edge SWG forwarder health check which is tracking status of proxy node it is forwarding traffic to. 

 

Resolution

Default Edge SWG forwarder host health check may be re-configured to account overall Menlo RBI service status.

Administrators need to change forwarder host health check type to HTTPS and use https://<Menlo_IP_or_FQDN>/healthcheck/?status=1 endpoint for tracking responses:

• 200 is healthy state
• 400 is unhealthy state