Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,7 @@ If you know that your endpoint is healthy but load balancing is reporting it as
* If your endpoint responds with a `301` or `302` status code, make sure **Follow Redirects** is selected.
* Try increasing the **Timeout** value.
* Review the **Host Header** for the health monitor.
* If you are using [Authenticated Origin Pulls](/ssl/origin-configuration/authenticated-origin-pull/), [Argo Smart Routing](/argo-smart-routing/), make sure that you entered a zone value for **Simulate Zone**.
* If you are using [Authenticated Origin Pulls (mTLS)](/ssl/origin-configuration/authenticated-origin-pull/), [Argo Smart Routing](/argo-smart-routing/), [Bring your own CA (mTLS)](/ssl/client-certificates/byo-ca/), [Dedicated CDN Egress IPs](/smart-shield/configuration/dedicated-egress-ips/), or require [HTTP/2 to Origin](/speed/optimization/protocol/http2-to-origin/), make sure that you entered a zone value for **Simulate Zone** corresponding to the zone with these features configured.

***

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -376,9 +376,9 @@ A health monitor determines the health of endpoints once they are configured ins

By default, health monitor probes are sent directly to the endpoint address, bypassing the entire layer 7 stack. This means that actual traffic to the endpoint through the load balancer will receive different treatment than the health monitor probe. Depending on the configuration, this could result in a health monitor reporting an endpoint as healthy, even if actual connections or requests are failing.

The Simulate Zone feature ensures that health monitor probes follow the same path as actual requests, passing through the entire layer 7 stack. This ensures health monitors take the exact same path through the network and through other layer 7 processes to reach the endpoint.
The Simulate Zone feature ensures that health monitor probes follow the same path as layer 7 HTTP/HTTPS requests for the given zone, passing through the same Cloudflare software-defined routing for egress to origin. This ensures health monitors take the same path through the Cloudflare network and other layer 7 processes to reach the origin endpoint.

The Simulate Zone feature is required for health monitors when certain features are enabled, such as [Authenticated Origin Pulls (AOP)](/ssl/origin-configuration/authenticated-origin-pull/), where probes would fail if they weren’t being provided with the proper mTLS certificate for authentication on the origin. Simulate Zone also ensures health monitor probes use the same path provided by [Argo Smart Routing](/argo-smart-routing/) and the same [Dedicated CDN Egress IPs](/smart-shield/configuration/dedicated-egress-ips/) when organizations leverage [Smart Shield Advanced](/smart-shield/get-started/#packages-and-availability) to restrict the edge IP addresses that Cloudflare uses to reach their endpoints.
The Simulate Zone feature is required for health monitors when certain features are enabled at the zone level, such as [Authenticated Origin Pulls](/ssl/origin-configuration/authenticated-origin-pull/) or [Bring your own CA](/ssl/client-certificates/byo-ca/), where probes would fail if they weren’t being provided with the proper mTLS certificate or authority for authentication with the origin server. Simulate Zone also ensures health monitor probes use the same path provided by [Argo Smart Routing](/argo-smart-routing/) and the same [Dedicated CDN Egress IPs](/smart-shield/configuration/dedicated-egress-ips/) when organizations leverage [Smart Shield Advanced](/smart-shield/get-started/#packages-and-availability) to restrict the edge IP addresses that Cloudflare uses to reach their endpoints.

![HTTPS health monitor to monitor the status of an endpoint](~/assets/images/reference-architecture/load-balancing-reference-architecture-images/lb-ref-arch-16.png "Figure 16: HTTPS health monitor configuration")

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@
- Make sure that the value is relatively static and within the first 10 KB of the HTML page.
- **Simulate Zone**:
- It is recommended to use the same zone in which the Load Balancer exists.
- Changes the egress zone settings of a health monitor request to ensure compatibility with features like [authenticated origin pulls](/ssl/origin-configuration/authenticated-origin-pull/), [Argo Smart Routing](/argo-smart-routing/), and [Dedicated CDN Egress IPs](/smart-shield/configuration/dedicated-egress-ips/).
- Changes the egress zone settings of a health monitor request to ensure compatibility with features like [Authenticated Origin Pulls (mTLS)](/ssl/origin-configuration/authenticated-origin-pull/), [Argo Smart Routing](/argo-smart-routing/), [Bring your own CA (mTLS)](/ssl/client-certificates/byo-ca/), [Dedicated CDN Egress IPs](/smart-shield/configuration/dedicated-egress-ips/), and [HTTP/2 to Origin](/speed/optimization/protocol/http2-to-origin/).
- **Follow Redirects**:
- Instead of reporting a `301` or `302` code as unhealthy, the health monitor request follows redirects to the final endpoint.
- **Configure Request Header(s)**:
Expand Down
Loading