Fastly insights

TLS configuration mismatches between Fastly and origin servers create cascading failures including hostname mismatches, certificate chain validation failures, and protocol version incompatibilities. These manifest as persistent connection failures affecting all traffic to affected origins.

When the Next-Gen WAF agent cannot process requests within the configured timeout (default 100ms), the module fails open and applies error response codes (-2, -1, 0). This creates a silent degradation where requests appear successful but are not being inspected for security threats.

Health check traffic can exceed expected volumes by orders of magnitude due to per-site independent checking, multiple backend IPs, and service duplication across environments. A 1-second check interval can generate 37,500 requests/second in worst-case scenarios.

When a backend resolves to multiple IPs and only some are sick, Fastly considers the backend healthy and continues routing traffic. This masks partial origin failures and can degrade user experience as traffic hits failing IPs.

Backends with health checks are marked sick upon service initialization and remain so until threshold successful checks complete. If 'initial' is less than 'threshold', first requests to each site post-deployment encounter unhealthy backends, returning 503 errors.