Edge Security Acceleration:Configure an origin server

Usage notes

• When DCDN retrieves resources from an origin server, the owner of the origin server is charged for data transfer. For example, if the origin server is a data center, the owner of the data center is charged for data transfer and bandwidth resources. If the origin server is an OSS bucket, the owner of the OSS bucket is charged for data transfer.

• DCDN supports switchover between primary and secondary origin servers. If you configure multiple origin servers, DCDN preferentially redirects requests to the origin server whose Priority is Primary. If the primary origin server fails three consecutive health checks, DCDN redirects requests to the origin server whose Priority is Secondary. If the primary origin server passes the health check, the system marks the origin server as available and restores the priority of the origin server to primary. If you specify the same priority for all origin servers, DCDN redirects requests to the origin servers based on round-robin scheduling.

  Note

  DCDN performs Layer 4 health checks on origin servers. Ports 80 and 443 and all custom ports that you specify are probed. Probes are sent every 2.5 seconds. If an origin server fails 3 consecutive probes, the system marks the origin server as unavailable.

Add an origin server or modify the information about an origin server

1. Log on to the DCDN console.

2. In the left-side navigation pane, click Domain Names.

3. On the Domain Names page, find the domain name that you want to manage and click Configure in the Actions column.

4. On the Basic Settings tab, find the Origin Information section.

5. In the Origin Information section, click Add Origin Sever, or click Modify in the Actions column.

   • To add an origin server, click Add Origin Server in the upper-left corner of the origin server list.

   • To modify the information about an origin server, click Modify in the Actions column.

   

   Parameter	Description
   Type	Select the type of the origin server and enter the address of the origin server. The address of an origin server cannot exceed 67 characters in length. You can add a maximum of 20 origin server addresses for each domain name. OSS Domain If you use an Object Storage Service (OSS) bucket as the origin server, you can enter the public domain name of the OSS bucket, such as ***.oss-cn-hangzhou.aliyundoc.com. You can obtain the public domain name of an OSS bucket in the OSS console. You can also select the domain name of an OSS bucket that belongs to the current Alibaba Cloud account from the Domain Name drop-down list. IP: You can configure one or more IP addresses for an origin server. Internal IP addresses are not supported. IPv4 addresses and IPv6 addresses are supported. At least one of the IP addresses must be an IPv4 address. If you use a public IP address of an Alibaba Cloud Elastic Compute Service (ECS) instance as the address of the origin server, the IP address is exempt from manual review. Site Domain: You can configure one or more origin domain names. Configuration rules for origin domains (click to expand rule details) The origin domain cannot be the same as the accelerated domain name. Otherwise, a back-to-origin error occurs due to loop resolution. The format of the origin domain name: The domain name must be 1 to 67 characters in length, and can contain lowercase letters, digits, and hyphens (-). Example: example.com. The domain name cannot contain Chinese characters, uppercase letters, or special characters other than hyphens (-). The domain name cannot be only a hyphen (-). A hyphen (-) in a domain name cannot be followed by another hyphen (-). The domain name cannot start or end with a hyphen (-). If the domain name contains Chinese characters, such as 阿里云.网址, you must apply for an ICP number for the domain name in Chinese characters and use the Punycode tool to convert the Chinese characters into English letters, such as xn--fiq****.xn--eq****. Then, you can specify the converted domain name as the domain name that you want to accelerate. You can add the domain name of an Alibaba Cloud Application Load Balancer (ALB) instance, such as example.hangzhou.alb.aliyuncs.com, as the address of an origin server.
   Priority	You can configure priorities to specify primary and secondary origin servers. The primary origin server has a higher priority than the secondary origin server. DCDN preferentially redirects requests to the primary origin server. If a fault occurs on the primary origin server, requests are redirected to the secondary origin server. The priority ranges from 0 to 127. A smaller value indicates a higher priority. By default, the priority of the primary origin server is 20, and the priority of the secondary origin server is 30. If you want to specify other values, submit a ticket. For example, you specify Origin Server A as the primary origin server and Origin Server B as the secondary origin server. In this case, DCDN preferentially redirects requests to Origin Server A. If Origin Server A fails, Alibaba Cloud CDN redirects user requests to Origin Server B. After Origin Server A recovers, Alibaba Cloud CDN fails back to Origin Server A.
   Weight	If origin servers have the same priority, DCDN redirects requests to the origin servers based on the weights of the origin servers. This way, loads are balanced among the origin servers. You can specify a weight based on your business requirements. The weight of an origin server ranges from 1 to 100. An origin server that has a higher weight receives more requests. Default value: 10. For example, you specify Origin Server A and Origin Server B as primary origin servers. If the weight of Origin Server A is 80 and the weight of Origin Server B is 20, Alibaba Cloud CDN redirects 80% of requests to Origin Server A and 20% of requests to Origin Server B. Note By default, weight-based redirection takes effect only for requests for static content. To enable weight-based redirection for requests for dynamic content, you must enable load balancing. For more information, see Configure back-to-origin routing to retrieve dynamic content. In the following scenarios, the proportion of requests that are redirected to an origin server may not be the same as the weight of the origin server that you specified: If few requests are redirected to origin servers within a period of time, such as less than 10 requests per second, request distribution across origin servers is uneven. All requests are from a specific IP address or a limited number of IP addresses. Requests from the same IP address are sent to the same POP, and a TCP session is maintained between the POP and an origin server. If you want to verify whether the actual proportion of requests that are redirected to an origin server is approximately the same as the weight that you configured for the origin server, you can use a third-party synthetic monitoring tool to initiate a probe task. You can probe clients that are distributed across locations and are served by Internet service providers (ISPs) based on your business requirements. The probe task requires a long period of time to collect sufficient and valid data.
   Port	Select a port based on the protocol that is supported by the origin server. Port 80: Requests are redirected to the origin server over port 80. Port 443: Requests are redirected to the origin server over port 443. Make sure that the origin server supports HTTPS. Note By default, only ports 80 and 443 are supported. To configure custom ports, submit a ticket.

6. Click OK.

View the running status of the origin server

DCDN probes your origin server by establishing TCP connections with it and displays its health status. If your origin server is unreachable, it is considered abnormal. After you configure an origin server, you can click the domain name to view the Origin Server Status in the Origin Information section.

The following table describes possible statuses of an origin server.

Origin fetch retry, origin fetch timeout, and origin probing

• Retry order:

  • The retry is performed based on the priority of origin addresses in descending order. You can view the origin addresses in the Alibaba Cloud CDN console.

  • If two addresses have the same priority, the retry order is based on the weight ratio.

• Retry granularity:

  • Retries are performed for each IP address. If a domain name is specified as an origin address, Alibaba Cloud CDN retries all IP addresses resolved from the domain name and accesses other available origin servers only if all the IP addresses that belong to the domain name are unavailable.

  • Probes automatically skip origin servers that are in the dead table.

• Retry status code:

  • A DCDN POP sends a retry request when it receives an HTTP 5xx status code from the origin server.

• Origin fetch timeout: The DCDN POP sends a retry request after it receives a retry status code from the origin server. If no retry status code is received from the origin server, the timeout processing logic is followed. After the timeout period is reached, the DCDN POP is triggered to retry.

  • By default, the timeout period that is required to establish a TCP connection between POPs and an origin server is 10 seconds. To adjust the timeout period, submit a ticket

  • The origin write timeout is the amount of time allocated for data write after the TCP connection is established. By default, the origin write timeout is 30 seconds.

  • The origin read timeout is the amount of time that is required by the origin server to return all content requested by a DCDN POP after the TCP connection is established. By default, the origin read timeout is 30 seconds.

  • You can adjust the values of the origin read timeout and origin write timeout by configuring a timeout period for origin fetch HTTP requests.

• Origin probing:

  • Abnormal TCP connection: If the TCP connection between a DCDN POP and an origin server fails or times out two times in a row, DCDN removes the IP address of the origin server from the list of available origin IP addresses and adds the IP address to the dead table. In this case, subsequent origin fetch requests are no longer sent to the IP address. Then the DCDN POP connects to the origin server over TCP to probe the IP address every 5 minutes. If the TCP connection is established, Alibaba Cloud CDN restores the IP address to the list of available origin IP addresses.

  • Normal TCP connection: If the TCP connection between a DCDN POP and an origin server is normal, but the POP receives a retry status code such as the 5xx status code from the origin server, the IP address of the origin server is not removed from the list of available origin IP addresses. In this case, a retry is triggered and subsequent requests are still sent to the origin server based on the weight ratio. If HTTP request errors occur at Layer 7 when the TCP connection is normal, the IP address of the origin server is not automatically removed from the list of available origin IP addresses. If you want Alibaba Cloud CDN to automatically remove the IP address from the list of available origin IP addresses, submit a ticket

References

• For information about origin servers, see origin server.

• If you use multiple origin servers for acceleration, you can specify different origin hosts. This way, points of presence (POPs) use the origin hosts to retrieve resources from different origin servers. For more information, see Configure an origin host.

• For information about how to specify the HTTP or HTTPS protocol for origin fetch, see Configure the static origin protocol policy.

• If your website contains dynamic content, make sure that the dynamic acceleration feature of DCDN is enabled. This way, dynamic resources are retrieved from origin servers over optimal routes. Static resources are served from POPs for acceleration. For more information, see Overview.

• You can configure cache rules and time-to-live (TTL) for static content based on your business requirements and content types to maximize the utilization of POPs and reduce the number of origin requests. For more information, see Create a cache rule for resources.

• If your origin server is a private OSS bucket, you need to grant DCDN access permissions on the private OSS bucket. For more information, see Configure access to private OSS buckets.

• If multiple domain names are hosted on your origin server with the same IP address and POPs access your origin server over HTTPS, you need to configure Server Name Indication (SNI). For more information, see Configure SNI.