NSX ESG Load Balancer fails to forward responses from the backend server

Products

• VMware NSX

Issue/Introduction

Symptoms:

• NSX Edge Services Gateway (ESG) Load Balancer fails to forward responses from the backend server.
• You see the error similar to:
  
  2017-02-22T15:58:36+00:00 ESG-799-EXT-LB-1 loadbalancer[14599]: [default]: [local0.info] 172.16.62.5 - - [22/Feb/2017:15:58:36 +0000] "POST /PublicCaseAccess/Traffic/Search HTTP/1.1" 502 8964 "" "" 60605 585 " services-webserver~" " services-webserver
  " "webxyz01" 5 0 0 -1 398 PHEN 0 0 0 0 0 0 0 "" ""
  2017-02-22T16:43:52+00:00 ESG-799-EXT-LB-1 loadbalancer[14599]: [default]: [local0.info] 172.16.62.5 - - [22/Feb/2017:16:43:52 +0000] "POST /PublicCaseAccess/Traffic/Search HTTP/1.1" 502 8964 "" "" 60974 395 " services-webserver~" " services-webserver
  " "webxyz01" 86 0 1 -1 374 PHEN 0 0 0 0 0 0 0 "" ""
  
  Note: The preceding log excerpts are only examples. Date, time, and environmental variables may vary depending on your environment.

Cause

This issue occurs because the HAProxy application being used only allows up to 101 headers in the response.

Resolution

To resolve this issue, increase the number of headers in the response.

Note: VMware NSX for vSphere 6.4.0 exposed a REST API to edit these values which allows you increase the number of headers in the response.

For example:

PUT https://<NSXMGR_IP>/api/4.0/edges/<edgeId>/systemcontrol/config
<systemControl>
   <property>lb.global.tune.http.maxhdr=1024</property>
</systemControl>

Return 204

GET https://<NSXMGR_IP>/api/4.0/edges/<edgeId>/systemcontrol/config
    Status Code: 200 OK
    Cache-Control: private, no-cache
    Content-Type: application/xhtml+xml
    Date: Fri, 03 Mar 2017 15:03:58 GMT
    Expires: Thu, 01 Jan 1970 00:00:00 GMT
    Strict-Transport-Security: max-age=31536000; includeSubDomains
    Transfer-Encoding: chunked
    X-Frame-Options: SAMEORIGIN

<?xml version="1.0" encoding="UTF-8"?>
<systemControl>
   <property>lb.global.tune.http.maxhdr=1024</property>
</systemControl>

Workaround:
If you do not want to upgrade, contact Broadcom support.