Remove Web Application Proxy Server From Cluster [WORKING ✧]

| Pitfall | Symptom | Solution | | :--- | :--- | :--- | | | Clients intermittently fail to reach the site; ping works sometimes. | Clear neighbor cache: arp -d <removed_node_ip> on routers. | | Orphaned ADFS Proxy Trust | Event ID 102 on internal ADFS: "The proxy was unreachable." | Run Get-AdfsProxy | Remove-AdfsProxy on ADFS server. | | SSL Session Resumption | Some browsers connect fine; others (older) hang. | Remaining nodes must share the same SSL session cache (Redis/Memcached). Reconfigure after removal. | | Sticky Sessions (Persistence) | Users suddenly see "Your session has expired." | The removed node held memory-based session data. Migrate to distributed cache (Redis) before removal. | Part 7: Automating the Removal (Ansible Playbook Example) For enterprises, manual removal is a liability. Here is an Ansible snippet to idempotently remove a WAP node.

# For Windows WAP Get-WebApplicationProxyApplication | Select-Object ExternalURL, BackendServerURL, ExternalCertificateThumbprint If your cluster sits behind a hardware or software load balancer (F5, AWS NLB, HAProxy), verify the health probe settings. Does the balancer use a simple TCP handshake, or does it probe a specific URL ( /wap/health )? Removing the node before updating the LB will cause traffic to route to a black hole. Part 2: Graceful Quiescing – Draining the Traffic A hard shutdown is the enemy of production stability. You must "drain" the node. 2.1 Stop New Sessions (The "Drain" Step) Instruct the load balancer or the proxy itself to stop accepting new connections while finishing existing ones.

- name: Clean ADFS trust (run on ADFS server) win_shell: | Remove-WebApplicationProxyEndpoint -TargetProxyFQDN " ansible_fqdn " delegate_to: adfs_internal_server Removing a web application proxy server from a cluster is not merely a matter of turning off a switch. It is a process of quiescing, disconnecting, cleaning, and validating . The difference between a professional team and an amateur one is visible in the post-removal state. remove web application proxy server from cluster

- name: Gracefully remove WAP node from cluster hosts: wap_removal_target become: yes tasks: - name: Stop web application proxy service service: name: W3SVC state: stopped ignore_errors: yes - name: Remove server from load balancer pool via API (F5 example) uri: url: "https://lb-manager/mgmt/tm/ltm/pool/wap_pool/members" method: DELETE body: '"name":" ansible_default_ipv4.address :443"' headers: Authorization: "Bearer f5_token " delegate_to: localhost

# On the node being removed systemctl stop keepalived systemctl disable keepalived Before physically decommissioning, block port 443 on the node to ensure zero stray traffic:

$proxy = Get-AdfsProxy -Name "wap-node-01.contoso.com" Remove-AdfsProxy -TargetProxy $proxy If you skip Step 2, the ADFS server will still attempt to send "relying party trust" updates to the removed proxy, causing event ID 364 and proxy sync timeouts in the event log. Scenario B: NGINX Reverse Proxy Cluster Assuming you have an active-passive or active-active cluster managed via a configuration management tool (Ansible, Puppet) or shared storage. | | SSL Session Resumption | Some browsers

Introduction: The Art of Surgical Infrastructure Removal