Hot answers tagged

4

My Googlefu was failing me today. In the Server Proxy Settings pane of IIS Manager, I needed to uncheck "Reverse rewrite host in response headers".


3

Your Action is set to Rewrite so it is rewriting the URL. In IIS Manager: Right-click Server Farms, click "Create Server Farm". Give it some name. Put the fully-qualified domain name to your Tomcat instance in the "Server name or address" field Click "Advanced settings...", expand "applicationRequestRouting" and change httpPort to 8087 Click "Yes" when ...


3

We had typo'd HTTP/srvarr and HTTP/srvweb as http://srvarr and http://srvweb. Make sure you do it as the protocol instead of the url! Also settings that might help others: Remove both NTLM and Negotiate and add Negotiate:Kerberos and turn on UseAppPoolCredentials and off useKernelMode Make sure all of the servers are using your domain web service account ...


3

After some months since I asked this question, I should probably write an answer myself... We've been working with the setup as described in the question, and it actually works as expected. The only problem is, that the cache hit statistics just show some arbitrary information. I haven't been able to find out what it tries to show, but in my experience, it ...


3

You can use a custom rewrite provider. A provider is C# code that turns one string into another string. You can then use it in a similar way to how you'd use rewrite map: You can pick a separator which is not valid in a url at all. (Maybe use space or something like that. I'll use | so it's visible in this post, but you should pick some other string.) You'...


3

Assuming your server farm is named myWebFarm and the server you're trying to set to drain is myNode1, the following PowerShell code will do the trick Import-Module WebAdministration $arr = Get-WebConfiguration -PSPath 'MACHINE/WEBROOT/APPHOST' -Filter "webFarms/webFarm[@name='myWebFarm']/server[@address='myNode1']/applicationRequestRouting" $setState = $...


3

I got this problem on Server 2012 R2, I usually start IIS Manager form the command line It turned out when using: %windir%\System32\inetsrv\iis.msc the ARR icons are missing, but when using %windir%\system32\inetsrv\InetMgr.exe they show up just fine. On Server 2012 R2, both Administrative tools and Server Manager use InetMgr.exe, so both should work, ...


3

This will change the OS defaults in a way to allow all TLS versions (or even SSL if you choose). I tested this on ARR Windows 2008 R2. Windows Easy Fix Patch


3

I'm struggling with the same problem. I have a solution I don't like (and I bet you won't like it either), but it does work. If you enable preserveHostHeaders, you can then add outbound URL Rewrite rules to remap all the cases when you do want to replace host headers.


2

Get a network packet capture of the failed requests and check the Http request header for the kerberos authentication token. If you are expecting a kerberos token and it isn't present, the issue probably isn't your servers. I'm assuming you are expecting kerberos because of the SPN checklist. Refer to the following for more information: https://...


2

On the ARR server you will want to configure a single farm that contains both web servers. Keep the default rewrite rule that ARR creates automatically. On the web servers you will create a website in IIS for each application you are wanting to serve. Each site in IIS will need its bindings set to all IPs (*) with the hostname that matches the site you ...


2

Answering my own question after using Wireshark to determine the answer. Yes, AAR will utilize SSL sessions and those sessions can service multiple clients. Using Wireshark I observed the following: Client1 -> AAR GET /foo AAR -> ContentServer Client Hello ContentServer -> AAR Server Hello, Certificate, Server Hello Done AAR -> ...


2

First of all, I don't know the answer but am guessing it does at least use session id. Second I would go about finding out not by looking at documentation which may or may not be trustworthy on such a detail, but by sniffing the traffic and in such a way ensuring a 100% correct answer. I find this the easiest way when it comes to proxies which can ...


2

I am running ARR 2.5 on a Windows 2008 R2 Datacenter SP1, and have experienced the same problem when transitioning a farm server by selecting either "Disallow New Connections" or "Make Server Unavailable Immediately". The controller will eventually revert the farm server to available. I checked the access logs on the affected server and in one case, it ...


2

Typically you would have ARR on the NLB level, directing traffic to the 2nd level Content servers in the farm who serve the same/shared IIS config (same applications). See Achieving High Availability and Scalability - ARR and NLB In your scenario, you don't really need ARR - you just want to NLB between 2 content servers, which will allow for 1 server to ...


2

In my case I resolved the problem by changing the proxy time-out Go to IIS manager Application requests routing Under "actions" go to server proxy settings Change the time-out to your desired value. These steps are for IIS v7


2

Let me answer my own question... I disabled "Require Server Name Indication" and suddenly everything worked. This is weird because SNI was enabled on all servers in the farm for the same site but for one of them, unchecking it made it all work. My theory is this: Even with shared config, SSL binding information doesn't really transfer from one server to ...


2

Even with IIS setup on a shared config with all the nodes, each node's Operating system is able to set SSL binds outside of IIS, which wouldnt be shared between the nodes. So what I believe the issue is an SSL binding on the OS side (not IIS) on the one node and thereby not allowing the match that IIS was asking it to do. To fix that look at the OS SSL ...


2

UPDATE Microsoft has released a patch and associated workaround steps since this answer was submitted. Please see newer answers and comments for details. It turns out that the answer is no, it is not possible. The following response from Microsoft IIS/ASP.NET Developer Support clarifies the technical details. Upon further investigation we have found ...


2

Yes this is possible. https://support.microsoft.com/en-us/help/3140245/update-to-enable-tls-1.1-and-tls-1.2-as-a-default-secure-protocols-in-winhttp-in-windows I deployed the registry keys via GPO to all my Windows 7 2008 r2 The above answer from Microsoft IIS/ASP.NET Developer Support is incorrect. I cant comment yet due to reputation. This does work. ...


2

According to this comment on Scott Forsyth's blog, this can happen when you have a web farm on a server with multiple app pools: The problem is that ARR doesn't have a dedicated worker process to do the health testing with, so it just uses ALL of the w3wp.exe worker processes. What that means is that if you have multiple app pools, or a web garden, then ...


2

X-ARR-ClientCert is sent if there was a mutual SSL handshake with ARR. Sending a request via https with the X-ARR-ClientCert header won't be enough as there really wasn't a mutual SSL handshake in that scenario. By a mutual SSL handshake, It means that the browser or client gets prompted for a client certificate and the client provides one. If you want your ...


2

I just ran into a very similar issue using IIS as a reverse proxy to another HTTP server I had locally. I had to go to the "Application Request Routing Cache" module. On the right-hand pane there's a "Server proxy settings" link. In that settings dialog there's a "Reverse rewrite host in response headers" checkbox. Unchecking this box fixed my problem.


2

Did you ever figure this out? I am having the exact same issue. I cannot get both situations to behave correctly. It's either I check the box, and 302 redirects get the response location header overwritten and never work, or I uncheck the box and the HOST header is localhost so the application doesn't fully work. It's like that checkbox needs to be a ...


2

The best way I've seen to accomplish this is by mixing powershell with the appcmd.exe command. Microsoft has released some sample code for setting up a farm in a docker container here. Here's an example: ForEach($farm in $farms) { # Create the farm .\appcmd.exe set config -section:webFarms /+"[name='$($farm.name)']" /commit:apphost ...


2

With NLB you need to enable MAC Address Spoofing on the virtual NIC of each NLB member.


2

The regular expression in the condition in your first rule is not a valid regex for IIS. If you want the first rule to be hit when the user agent contains Baidu and the second when it does not then you can just do something like below. Note the negate in the condition in the second rule: <?xml version="1.0" encoding="UTF-8"?> <...


1

After much struggling, we found no way to make Kerberos authentication work through ARR; as a workaround, we simply removed the ARR server from the domain: this forced it to skip Kerberos authentication altogether, and everything started working instantly. I'm accepting this answer because it fixed the problem and let us use ARR to load balance Lync's ...


1

I finally found a solution for us: Since we don't have the requirement for "multi-hop" authentication (=kerberos) I was able to force NTLM. On the web server under auhtentication (site) I changed the providers for Windows Authentication and removed everything but NTLM. So NTLM is the only available way for authentication. On the ARR I changed everything ...


1

Found the answer after a lot of playing about <serverVariables> <set name="HTTP_Accept-Encoding" value="" /> </serverVariables>


Only top voted, non community-wiki answers of a minimum length are eligible