Troubleshoot Azure Application Gateway session affinity problems

Summary

Learn how to diagnose and resolve session affinity problems with Azure Application Gateway. By keeping users on the same backend server, you can improve application performance.

How cookie-based session affinity works

The cookie-based session affinity feature is useful to keep a user session on the same server. By using gateway-managed cookies, the Application Gateway directs subsequent traffic from a user session to the same server for processing. This feature is important in cases where session state is saved locally on the server for a user session. Session affinity is also known as sticky sessions.

Causes

Problems maintaining cookie-based session affinity can happen for the following reasons:

• You didn't enable Cookie-based Affinity.
• Your application can't handle cookie-based affinity.
• Your application uses cookie-based affinity but requests still bounce between backend servers.

Check whether Cookie-based Affinity is enabled

Session affinity problems can occur if you don't enable the Cookie-based Affinity setting. To check whether you enabled Cookie-based Affinity, check the Backend settings tab in the Azure portal. Follow these steps:

1. Sign in to the Azure portal.

2. In the navigation pane, select All resources. Select the application gateway name in the All resources blade. If the subscription that you selected already has several resources in it, enter the application gateway name in the Filter by name… box to easily access the application gateway.

3. Select the Backend settings tab in Settings.

1. Select the backend setting. On Add Backend setting, check if Cookie-based affinity is enabled.

To check if the value of the CookieBasedAffinity is set to Enabled in the backendHttpSettingsCollection, use one of the following methods:

• Run Get-AzApplicationGatewayBackendHttpSetting in PowerShell.
• Look through the JSON file by using the Azure Resource Manager (ARM) template. Use the following snippet:

"cookieBasedAffinity": "Enabled", 

The application can't handle cookie-based affinity

Cause

The application gateway can only perform session-based affinity by using a cookie.

Workaround

If the application can't handle cookie-based affinity, use an external or internal Azure load balancer or another non-Microsoft solution.

Application uses cookie-based affinity but requests still bounce between backend servers

Symptom

You enable Cookie-based Affinity. When you access the Application Gateway by using a short name URL in a browser, such as http://website, the request still bounces between backend servers.

To identify this problem, follow these instructions:

1. Take a web debugger trace on the client that connects to the application behind the Application Gateway. This example uses Fiddler.

1. Check and analyze the session logs to determine whether the cookies that the client provides include the ApplicationGatewayAffinity details. If you don't find the ApplicationGatewayAffinity details, such as ApplicationGatewayAffinity=ApplicationGatewayAffinityValue within the cookie set, the client isn't replying with the ApplicationGatewayAffinity cookie that the Application Gateway provides.

See the following illustrations for examples.

The application continues to try to set the cookie on each request until it gets a reply.

Cause

This problem occurs because browsers don't store or use the cookie with a short name URL.

Resolution

To fix this problem, access the Application Gateway by using a fully qualified domain name (FQDN). For example, use http://website.com or http://appgw.website.com.

Collect additional logs to troubleshoot session affinity

To troubleshoot problems related to cookie-based session affinity, collect and analyze extra logs. This process includes the following steps:

• Analyze Application Gateway logs
• Use a web debugger to capture and analyze the HTTP or HTTPS traffic

Analyze Application Gateway logs

To collect Application Gateway logs, enable logging by using the Azure portal. Follow these instructions.

1. In the Azure portal, find your resource and then select Diagnostic setting. For Application Gateway, you can access three logs: Access log, Performance log, and Firewall log.
2. Select Add diagnostic setting to start collecting data.

The Diagnostic setting page provides the settings for the diagnostic logs. In this example, Log Analytics stores the logs. You can also use Azure Event Hubs and a storage account to save the diagnostic logs. See the following illustration for an example.

1. Confirm the settings and then select Save.

Use a web debugger to capture and analyze the HTTP or HTTPS traffic

Web debugging tools like Fiddler can help you debug web applications by capturing network traffic between the internet and test computers. These tools enable you to inspect incoming and outgoing data as the browser receives or sends it. In this example, Fiddler has the HTTP replay option that can help you troubleshoot client-side problems with web applications, especially authentication problems.

Use the web debugger of your choice. In this sample, use Fiddler to capture and analyze HTTP or HTTPS traffic. Follow the instructions:

1. Download Fiddler.

1. Right-click the setup executable. Run as admin to install.

1. When you open Fiddler, it automatically starts capturing traffic (notice Capturing). Select F12 to start or stop traffic capture.

1. Enable HTTPS decryption by selecting Tools > Fiddler Options > Decrypt HTTPS traffic.

1. To remove previous unrelated sessions before reproducing the problem, select X > Remove All.

1. When you reproduce the problem, save the file for review by selecting File > Save > All Sessions.

1. Check and analyze the session logs to determine what the problem is. For example:

Example A

You find a session log that the request is sent from the client and then goes to the public IP address of the Application Gateway. Select this log to view the details. The data in the box is what Application Gateway returns to the client. Select the RAW tab and determine whether the client is receiving a Set-Cookie: ApplicationGatewayAffinity=ApplicationGatewayAffinityValue. If there's no cookie, session affinity isn't set, or the Application Gateway isn't applying a cookie back to the client.

Example B

The next session log followed by the previous one is the client responding back to the Application Gateway which sets the ApplicationGatewayAffinity. If the ApplicationGatewayAffinity cookie ID matches, the packet goes to the same backend server that was used previously. Check the next several lines of HTTP communication to see whether the client's ApplicationGatewayAffinity cookie is changing.