Hi  Experts,

I have two ARR machines to webfarm serving my domain site and mobile site ex: www.abc.com , www.abc.com/mobile

For SSL cert, I have purchased one wildcard ssl cert. can I use the same ssl cert on two ARR machines.

Please advice, can i configure the same ssl cert on all the machines, as management rules out the purchase of additional ssl cert.

Regards,

Arun

So I'm trying to set up ARR to redirect certain incomming http connections to internal servers. The problem I keep having is whenever I set up a reverse proxy it keeps breaking http connections to the server. I'm not sure if I'm just applying the wrong filters or if something is configured wrong. I've followed several "How to's" without success, including the "Reverse Proxy with URL Rewrite v2 and Application Request Routing" tutorial. Ideally I would like connections towww.example.com/home be directed to the ARR server's local home page and requests towww.example.com/server1 be redirected tohttp://server1/home. I'm using IIS 7.5.7600.16385 with the latest version of ARR on a server running Windows Server 2008 R2.

Dear Team,

Please I need your support for the following scenario:

- I have two ARR 3.0 Servers configured with NLB for the front-end tier in Shared Config mode.

- I have two web content servers with two Web Sites, one site is listening on Port 67 and the second website is listening on Port 68, and both IIS Servers are in Shared Config mode as well.

- MS SQL DB as the back end tier.

In order to browse both websites, without Load Balancing: 

Site1: http://IIS01.domain.com:68/Student/Login.aspx

Site2: http//IIS01.domain.com:67/Pages/Login.aspx

Site1: http://IIS02.domain.com:68/Student/Login.aspx

Site2: http//IIS02.domain.com:67/Pages/Login.aspx

I created two Server Farms on the ARR (NLB) Servers, one Farm with HTTP Port 67 and the second Farm with HTTP Port 68.

I am having issues with setting the URL Rules to load balance the incoming request through the ARR servers.

Your help is highly appreciated.

Thank you,

/Charbel

Hi.

 For the Health Test I only use the URL Test. The interval is 5 seconds. The strange thing is that according to the IIS logs, I have 2 simultaneous requests for each period. I removed the IPs. Can someone explain?

2011-05-24 18:33:33 xx.xx.xx.xx GET /health.html - 80 - yy.yy.yy.yy - 200 0 0 202
2011-05-24 18:33:34 xx.xx.xx.xx GET /health.html - 80 - yy.yy.yy.yy - 200 0 0 218
2011-05-24 18:33:39 xx.xx.xx.xx GET /health.html - 80 - yy.yy.yy.yy - 200 0 0 218
2011-05-24 18:33:39 xx.xx.xx.xx GET /health.html - 80 - yy.yy.yy.yy - 200 0 0 218
2011-05-24 18:33:44 xx.xx.xx.xx GET /health.html - 80 - yy.yy.yy.yy - 200 0 0 234
2011-05-24 18:33:44 xx.xx.xx.xx GET /health.html - 80 - yy.yy.yy.yy - 200 0 0 218
2011-05-24 18:33:49 xx.xx.xx.xx GET /health.html - 80 - yy.yy.yy.yy - 200 0 0 218
2011-05-24 18:33:49 xx.xx.xx.xx GET /health.html - 80 - yy.yy.yy.yy - 200 0 0 202

edit: s/heath/health

We have two sharepoint farms (one 2010 and other 2013) and would like to retain the same URL.  POST migration to SP2013 we would like the URL to be redirected to the SP2013 farm for this site collection.

EG., https://contoso.com/sites/abc -> currently point to 1.1.1.1 (SP2010 farm).  POST migration of this site collection this URL should point to the new farm (2.2.2.2), while other site collections (which are NOT migrated) still point to 1.1.1.1

We have a IIS 7.5 Web project that acts as a reverse proxy for different versions of another Web project. It uses Application Request Routing for rewriting. Recently we found out that the cache-control HTTP response header is modified in this proxy. E.g. the real web application sends a no-cache header but the proxy response is private. This leads to problems in the frontend (it's a shop system and the response should not be cached e.g. basket counts).

I setup this minimal working example to show the problem. Create an empty Web project called ProxyHeaderExample with a local IIS Web Server and Project URL http://localhost/ProxyHeaderExample

 in the Web.config paste

<configuration><system.webServer><rewrite><rules><!-- proxy all request  --><rule name="Proxy" enabled="true" stopProcessing="true"><match url="(.*)" /><conditions /><action type="Rewrite" url="https://twitter.com/{R:1}" /></rule></rules></rewrite></system.webServer></configuration>

Internally the requests are rewritten to twitter (just for example because they use a no-cache header - replace this with a host of your choice that uses no-cache). So if you request e.g.http://localhost/ProxyHeaderExample/inetsrv/ it is proxied to https://twitter.com/inetsrv (the twitter account of IIS). Now you can compare the cache-control HTTP header of the real response and the proxy response (using your browsers development console).

Is there a way to prevent this? I always want to keep the original header value.

We are getting rid of our ISA server since it and Server 2003 are end of life.

We are testing IIS 8.5 with the ARR module installed.

We will be proxying two different internal web servers. 

The first one was pretty straight forward. External https on port 443 to an internal server using 443. It is working fine.

The second site is bound to a different IP address and listening on 8443. It is routing to an internal server listening on https port 52101.

I have verified that the firewall is setup correctly. I can browse to https://internalserver:52101 from the IIS server fine.

When I try to browse using the external address, I get a blank page.  I used the Reverse Proxy template, just like the first site. I am not sure what I am doing wrong. See the web.config below:

<?xml version="1.0" encoding="UTF-8"?><configuration><system.webServer><rewrite><outboundRules><rule name="ReverseProxyOutboundRule1" preCondition="ResponseIsHtml1"><match filterByTags="A, Form, Img" pattern="^http(s)?://internalwebserver:52101/(.*)" /><action type="Rewrite" value="http{R:1}://www.company.com:8443/{R:2}" /></rule><preConditions><preCondition name="ResponseIsHtml1"><add input="{RESPONSE_CONTENT_TYPE}" pattern="^text/html" /></preCondition></preConditions></outboundRules><rules><rule name="ReverseProxyInboundRule1" stopProcessing="true"><match url="(.*)" /><conditions><add input="{CACHE_URL}" pattern="^(https?)://" /></conditions><action type="Rewrite" url="{C:1}://internalwebserver:52101/{R:1}" /></rule></rules></rewrite></system.webServer></configuration>

Guys I am putting together a solution with two ARR servers that will be using NLB. The web application is a stateful app I know that ARR will do the load balancing and persistece however I do have a question about the NLB config.  So do I need to configure NLB to be persistent? I think that it should not matter because NLB is just providing redundancy for the AAR servers. It seems that all of my load balancing and persistence will be handle on the back end by ARR. Anyway let me know what you all think.

Having an issue with ARR where a large request, made up of a long querystring ~7400 chars, and headers accounting for ~1600 chars is failing with the following error displayed in the failed request trace:

The error presented to the client is:

Bad Request - Request Too Long HTTP Error 400. The size of the request headers is too long.

---

Accessing the site (being proxied) directly, the same request has no problems, this is only an issue when ARR is being used as a reverse proxy.  ARR seems to be imposing a limit on the size of the request.  I can slowly remove characters from the querystring (or headers) and a few below this point the request will start to work.

I've tried modifying the following, putting very high values in with no success:

<httpRuntime maxUrlLength="2097151" maxQueryStringLength="2097151" …

and 

<requestLimits maxUrl="2097151" maxQueryString="2097151" maxAllowedContentLength="2097151000" />

I can see that these values have no effect until I reduce them below whatever limit ARR is imposing. 

I also tried changing registry settings MaxFieldLength and MaxRequestBytes, setting them to their maximum values, with no success (this was not required on the destination server so cannot see why these would be required anyway).

Any help appreciated.

Hello,

I install ARR 3.0 to server 2012 r2 as described in following link with WebPI.

http://blogs.technet.com/b/erezs_iis_blog/archive/2013/09/16/new-features-in-arr-application-request-routing-3-0.aspx

Release date of arr 3.0 seems 27/05/2015 . Is hostname affinity with hostnamememory provider is feature removed? There exists no option except Microsoft.Web.Arr.HostnameRoundRobin provider...

Somebody can help me?

Currently our ARR correctly handles traffic to farm websites bound on Port 80/443 without issue.   We're moving some legacy web sites and applications to these farm - IIS servers which have traditionally operated on non-standard ports.  We've bound the sites using host headers on 80, (they work) but would also like to retain the "old" Port number and bind to that as well.  (Saves large contingent of users changing links to apps..) The sites with non-standard ports work on the individual farm servers, but the ARR sever only responds to Ports 80 and 443.  "No connection could be made because the target machine actively refused it" is the response from the server. whenhttp://website:9022 non-standard port added instead ofhttp://website.domain.comWhen we added the server farm we did keep the 80 and 443 settings in Advanced, but would like to ALSO have non-standard Port routing.  Is there anyway to add additional Ports to the configuration/routing to the farm servers?

Overview:

Application Request Routing (ARR) v3.0.1952 is an incremental release that enhances and improves Version 3.

Download:

ARR 3.0.1952 is available from the Microsoft Download Center:

x86: http://www.microsoft.com/en-us/download/details.aspx?id=47334

x64: http://www.microsoft.com/en-us/download/details.aspx?id=47333

Hi,

let me introduce myself first by saying that i am a Professional Developer, not an IT guy even if i consider having some networking knowledge.

That being said, i am facing a situation where i have a LAN network, composed of multiples devices that have access to the LAN but not internet and within the LAN there is a computer with IIS 7 that has access to the internet.

Now, i need to access an external website from the devices that do not have internet but have access to the IIS machine. So i figured that i could create a Reverse Proxy with the IIS server, however i don't have much information or knowledge about how to accomplish that so i installed the URL Rewrite and ARR modules.

My questions here are:

- Will my devices be able to access an external internet website if they query the IIS Reverse Proxy with a matching patterns?(ex: device => IIS => website => return response to IIS => return response to device)

- How to create a pattern to access a resource path of a REST API for exemple:http://localiis/1 => http://external/1
(where 1 is a dynamic value passed when querying the local IIS), how to accomplish that?

- How to deal with the fact that an external internet website require https SSL?

- Really, how to configure a basic reverse proxy to access an internet website? I did played around with adding some rules.

I am lost and would greatly appreciate any help from the community!

Thanks in advance!

Dear Expert,

I want to build Streaming Media server on windows 2012 R2. We have 3 sites in 3 different cities. They are connected via MPLS.

There are 3 servers in 3 sites which is used for the Media server

A site        s1.domain.test.com   

B Site        s2.domian.test.com

C Site        s3.domian.test.com

For saving the WAN resources, I want to internal users only access local media server. like:

user1 now is in A site, he/she access s1 when he/she open the video link.

When user1 travel to B Site, he/she access s2 when he/she open the video link.

I want to publish only one url, like videos.test.com to internal users. How could implement the idea?

ARR cache can do this, and how. 

Hi,

i have two ARR servers (arr1 and arr2) in NLB with NLB cluster name nlb.local. And both ARR servers i have created server farm with two IIS 8 servers named "webfarm".

I would like to redirect request https://nlb.local/service/service.svc to webfarm using https, All other request should be forwarded to server farm with http.

i have created two rules:

<rule name="ServiceRequestOverHTTPS" enabled="true" patternSyntax="Wildcard" stopProcessing="true">
<match url="*" />
<conditions logicalGrouping="MatchAll" trackAllCaptures="false">
<add input="{REQUEST_URI}" pattern="service/" />
</conditions>
<action type="Rewrite" url="https://webfarm/{R:0}" />
</rule>

<rule name="AllOtherWebRequestsOverHTTP" patternSyntax="Wildcard" stopProcessing="true">
<match url="*" />
<conditions logicalGrouping="MatchAll" trackAllCaptures="false" />
<action type="Rewrite" url="http://webfarm/{R:1}" />
</rule>

With this setup i have 403 - Forbidden: Access is denied. when accessing https://nlb/service/service.svc.

when i change Rewrite from http to https (bold line below)

<rule name="AllOtherWebRequestsOverHTTP" patternSyntax="Wildcard" stopProcessing="true">
<match url="*" />
<conditions logicalGrouping="MatchAll" trackAllCaptures="false" />
<action type="Rewrite" url="https://webfarm/{R:1}" />
</rule>

service https://nlb/service/service.svc returns 200 OK, but also all other sites are forwarded (rewrited) to https.

How can i enable https only for https://nlb/service/service.svc and http for all other request using ARR and URL rewrite modules?

Thank you.

Hi everyone,

I'm running Win 2008 R2, IIS 7.5. AJP 1.3 and Tomcat 7.  I am successfully using IIS Windows Integrated Authentication with my Tomcat application.  User authentication is seamless.  Now, I'm trying to add ARR to perform reverse-proxying of URLs.  For example, today I have:

http://myserver/myTomcatApp

I am trying to setup ARR so that I can use:

http://myserver/myFakeURL

and have it route to /myTomcatApp.

I'm trying to configure it without touching my AJP configuration (e.g. completely switching everything over to ARR).  If I don't use authentication, it works perfectly.  However, if I require WIA on the /jakarta virtual directory and then set tomcatAuthentication='false' on the Tomcat side, I get the following error in FailedRequestTrace:

ModuleName="WindowsAuthenticationModule", Notification="AUTHENTICATE_REQUEST", HttpStatus="401", HttpReason="Unauthorized", HttpSubStatus="1", ErrorCode="The token supplied to the function is invalid
 (0x80090308)", ConfigExceptionInfo=""

I see the following headers getting passed:

Connection: Keep-Alive
Content-Length: 0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.5
Authorization: NTLM<Long NTLM code>
Cookie: cc_ineu=no; JSESSIONID=B1DC353A2BDB53E825176E73D11AF84F.portal1;
X-Original-URL: /myFakeURL
X-Forwarded-For: xxx.xx.xx.x:xxxx
X-ARR-LOG-ID: 46bf9a11-821d-4ab0-b16a-f797ea4c9a89
TOMCATURI0000000180000000: /myTomcatApp
TOMCATWORKER0000000180000000: portalbalancer1
TOMCATWORKERIDX0000000180000000: 78

I've seen some other posts, but they mention SSL and Exchange which do not seem to be applicable here.

If anyone has any suggestions on how to resolve this, that would be great.  Or, if there are some instructions available on configuring ARR, NTLM, AJP and Tomcat altogether, that would be great as well.

Regards,

Eric

Hi,

We are configuring an ARR server with multiple web sites, multiple certs, and most of these sites use forms authentication.

Everything is quite clear on how to implement this, I'm just wondering what would be the best solution regarding SSL offloading.

If SSL offloading is enabled, when a user authenticates the credentials will be sent in clear between the ARR server and the application server. Also, the authentication cookie would be sent in clear.

To mitigate this potential security risk, we can either:

• disable SSL offloading (at least for the login page) and use a wildcard certificate for the communication between ARR and application servers
• enable SSL offloading and create a VLAN for the ARR and application servers

If you have a similar setup, could you share your experience?

Thanks,

Francois Kreutz

In my web farm, with 50 websites +/-, all of them using SSL Offloading, with 1 ARR Server and 2 IIS Nodes.

I have actually one site that don't work with SSL Offload (Classic ASP system), so i disabled SSL Offload, and installed it certificate on IIS Nodes. Works fine when i discover that i can't enable SNI on my IIS Nodes, because the ARR can't find the site, and i have an 502.3 - Bad Gateway error.

To work with it, i disabled "Request Server Name Identification" on my IIS Cluster, and with that the system works great. Until now.

I have to put another system that don't work with SSL Offloading. But on my IIS Cluster, i can't put more that one site using SSL without using SNI.

The website has an variable named "URL". The system OR work 100% HTTPS OR 100% HTTP. With SSL Offloading, we have a "hybrid" schema, as the first part is HTTPS and the second part is HTTP. In theory, i just need to turn off SSL Offloading, and it's allright. But with 2 websites, the ARR not work with SNI, so it can't bind HTTPS://SITE1 and HTTPS://SITE2. 

Why ARR can't work with SNI? I put the Rewrite rule as "Route to Server Farm", but only works with the first site that i bind it with HTTPS. I tried to do some "trick" on IIS Node, to redirect the "internal call" from 80 to 443 or 443 to 80, but all failed.

Any suggestion? Thanks!

We have an internal WebAPI called internalserver/site which we want to expose to the Internet as externalserver/site through a reverse proxy. We have set this up in IIS easily with ARR and Url Rewrite.

Now, the internal server needs to run Windows Authentication (Negotiate, NTLM). This is where we are running into problems. We have tried the following setups:

1. Reverse proxy with Anonymous access enabled, running under ApplicationPoolIdentity, and internal server with Windows auth enabled

2. Reverse proxy with Anonymous access enabled, running under a specific domain account which has access to the internal server, which has Windows auth enabled

3. Same as above, with reverse proxy also running Windows authentication

All of them have failed, with the internal server receiving only an anonymous request from the reverse proxy.

Can anyone help on how to get this setup right? Is this related to a double-hop scenario? 

We are considering having custom code run on reverse proxy to impersonate a domain account, but that sounds like a hassle to deploy and maintain.

ApplicationPoolIdentity