Which source IP are health check packets sent from; can I change it?

Short answer

The Health Check Source IP field is Default by default: the check is sent over the Route Table of the Backend Service, and the source address is the Interface IP, in the same subnet as the server, of the interface from which the traffic to the server exits in this route table (if the server is reached over a gateway, the Interface IP in the same subnet as the gateway); in a cluster, each device uses its own Interface IP. The health check does not use the SNAT setting of the data traffic. The source address is fixed by selecting Device IP in the Health Check Source IP field in the Details section of the Backend Service or the Backend Group; in WEB-CLI it is written with --differentSrcType deviceSrc and --deviceSrc.

Problem: The Server Firewall Expects a Specific Source Address

The firewall in front of the servers or the application access lists often allow only specific source addresses. If the health check comes from an unexpected TR7 IP, it is blocked; the server appears as Error even though it is running and is removed from traffic. For this reason, the source address of the check needs to be known and fixed when necessary.

Determining the source address in Default (separately for each Backend Service):

Access to the server	Source address	Example
The server is in the subnet of an interface in the route table	The Interface IP of that interface in the same subnet as the server	Interface IP 192.0.2.5/24, server 192.0.2.20 → source 192.0.2.5
The server is reached over a route (e.g. the default gateway) in the route table	The Interface IP, in the same subnet as the gateway, of the interface from which the route exits	Gateway 192.0.2.254, interface IP 192.0.2.5/24, server 203.0.113.20 → source 192.0.2.5
More than one IP has been added to the interface in the same subnet	One of these IPs; which one will be used cannot be determined from the order on the interface. If a specific address is required, Device IP is selected	-
Cluster	Each device uses its own Interface IP; the VIP is not used as the source	Device 1 192.0.2.5, device 2 192.0.2.6

If there is a single interface and a single IP in the route table, the source address is always that IP. Which interface and IP are in which route table is seen on the Network → Interfaces screen (Route Tables).

Solution: 2 Methods

The two methods make the same setting from different interfaces.

Your situation	Suitable method
I edit the Backend Service or Backend Group from the interface	Method 1: Device IP
I make the same setting from WEB-CLI	Method 2: WEB-CLI

Method 1: Device IP Recommended

• How it works The selected TR7 IP is used as the source address of the health check requests; the source address of the data traffic does not change.
• Where it is openedLoad Balancer → Backend Services (or Backend Groups) → Edit → Details → Health Check Source IP
• Requirement A TR7 IP defined in the Route Table of the Backend Service; if there is none, it is first added to the relevant interface on the Network → Interfaces screen (Add IP Address)
• vService type All
• In a Backend Group The field is at the group level; the checks of all the servers in the group are made from the same source address

Step-by-Step Configuration

1

Adım 1 Open the form

The Load Balancer → Backend Services path is followed; the Backend Service is right-clicked and Edit is selected. For a Backend Group, the same operation is done on the Load Balancer → Backend Groups screen.

2

Adım 2 Check the route table

It is checked that the route table that reaches the server is selected in the Route Table field; the default is DEFAULT. The Device IP list is limited to the addresses of this route table.

3

Adım 3 Open the Details section

The Details switch at the bottom of the form is turned on.

4

Adım 4 Select Device IP

Device IP is selected in the Health Check Source IP field; the default value of the field is Default.

5

Adım 5 Select the IP

The TR7 IP to be used as the source is selected from the list that opens. In a cluster, an Interface IP is selected; each device uses its own address of this record.

6

Adım 6 Save

The Edit button at the bottom of the form is clicked. In a cluster, the change is transferred to the peer device automatically by default; if Manual Sync Mode is on, it is sent with Synchronize.

7

Adım 7 Allow on the server side

The selected IP is added to the access list of the server or of the firewall in front of it; in a cluster, the addresses of both devices are added (Which IPs should I allow on the server firewall for health checks?).

Verification

1Source address settingBackend Service preview

The Health Check Source IP row in the Details tab of the preview shows the selected address; in a cluster, if the values of the two devices differ, they are shown in two columns with the device names (Details rows).

ExpectedHealth Check Source IP: 192.0.2.5

2Incoming checkServer side

On the server, the source address of the packets coming to the check port is examined (port 80 in the example).

Commandtcpdump -n 'tcp dst port 80 and tcp[tcpflags] & tcp-syn != 0'

Expected192.0.2.5.xxxxx > 192.0.2.20.80: Flags [S]

Method 2: WEB-CLI

• How it works The source address type is written to the Backend Service (or Backend Group) record with --differentSrcType deviceSrc, and the IP record to be used with --deviceSrc.
• Where it is opened WEB-CLI → lb backend update / lb backend-group update (lb backend · The Health Check Fields)
• Requirement WEB-CLI access; the Backend Service ID (lb backend list) and the ID of the IP record (network ip list v-device Host)
• vService type All

Step-by-Step Configuration

1

Adım 1 Find the IP record

The IP records are listed with their IDs; the ID of the IP located in the route table of the Backend Service is taken (--deviceSrc accepts only the IP records in this route table):

network ip list v-device Host

2

Adım 2 Write the source address

--deviceSrc is written only together with --differentSrcType deviceSrc; the value is the ID of the IP record found in step 1:

lb backend update id <backend-id> --differentSrcType deviceSrc --deviceSrc <ip-id>

For a Backend Group, the same fields are written with the lb backend-group update id <group-id> command.

Verification

1RecordWEB-CLI

The Backend Service record is displayed.

Commandlb backend show <backend-id>

ExpecteddifferentSrcType deviceSrc, deviceSrc = the selected IP record

Common Mistakes

• Assuming that the SNAT setting also covers the health check. SNAT (Use Client IP, Use Device IP) is applied only to the data traffic; the source of the health check is the Health Check Source IP field.
• Changing the route table without checking the source address. In Default, the source address is determined according to the route table; the Device IP list also changes according to the route table.
• Allowing the address of only one device in a cluster. Each device makes the check from its own address and shows the result separately; on the server firewall, the addresses of both devices are allowed.
• Confusing it with the different check address. Use Different IP for Health Check changes the target of the check, and Health Check Source IP changes its source (Can I check a different IP/port of the server for the health check (Use Different IP for Health Check)?).

How it is done in the documentation

• Backend Services · Health Check Source IP
• Backend Services · Route Table
• Backend Groups · Health Check Source IP
• WEB-CLI · lb backend · The Health Check Fields

Related questions

• Which IPs should I allow on the server firewall for health checks?
• What does "Default" in the SNAT field mean; can I choose a specific SNAT IP?
• Can I check a different IP/port of the server for the health check (Use Different IP for Health Check)?