We have a HAproxy as a replacement for the old NLB, but we are facing an issue.
We have scripts running on the nodes themselves that check if the NLB is working properly.
Now we are seeing some weird behaviour. When we connect from Node1 to our HAproxy to a frontend with ACLs to connect to the correct backend. In this case an API call that exists on both Node1 and Node2. The API call requires Windows Authentication, when we connect the first time it will usually connect to the other node (No issues there). But when we connect with our application it will switch to the other Node (Itself) and then the Authentication popup keeps reappearing and results in authentication failed.
Here are the relevant parts of our config file.
global
log /dev/log local0
log /dev/log local1 notice
chroot /var/lib/haproxy
stats socket /run/haproxy/admin.sock mode 660 level admin
stats timeout 30s
user haproxy
group haproxy
daemon
# Default SSL material locations
ca-base /etc/ssl/certs
crt-base /etc/ssl/private
# See: https://ssl-config.mozilla.org/#server=haproxy&server-version=2.0.3&config=intermediate
ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA38>
ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets
defaults
log global
mode http
option httplog
option dontlognull
option http-keep-alive
option prefer-last-server
timeout connect 5000
timeout client 50000
timeout server 50000
errorfile 400 /etc/haproxy/errors/400.http
errorfile 403 /etc/haproxy/errors/403.http
errorfile 408 /etc/haproxy/errors/408.http
errorfile 500 /etc/haproxy/errors/500.http
errorfile 502 /etc/haproxy/errors/502.http
errorfile 503 /etc/haproxy/errors/503.http
errorfile 504 /etc/haproxy/errors/504.http
frontend HAproxy80
bind x.x.x.x:80
mode http
...
acl url_Api path_beg /Api
use_backend Api80 if url_Api
...
default_backend app80
backend Api80
option httpchk
balance roundrobin
cookie SERVERID insert indirect nocache
http-check connect
http-check send meth GET uri /Api
http-check expect ! status 503
server node01 x.x.x.y:80 check cookie node01
server node02 x.x.x.z:80 check cookie node02
backend app80
balance source
http-check send uri /Test
http-check expect ! rstatus ^5
server node01 x.x.x.y:80 check inter 10s rise 2 fall 2
server node02 x.x.x.z:80 check inter 10s rise 2 fall 2