Is IIS ARR end of life?

Question

Hello all,

The documentation of IIS ARR is now getting really old:
https://learn.microsoft.com/en-us/iis/extensions/planning-for-arr/application-request-routing-version-2-overview

The ARR 3.0 have been released in 2013 and everything documented on learn is still only speaking of ARR version 2 and above (version 2 is long dead)

There is no update since ages, and we are no really confident about its security and maintenance.

In addition, you have to use compatibility mode/registry tweak on Windows 2022 to install it.

Should we consider this product as abandonned?

What are the replacements? (We use URL Rewriting and farm load balancing mainly)

Answer 1

Hi @Adrien Maugard,
I understand your concern that the IIS Application Request Routing documentation is out of date. For now, ARR may be considered a legacy product by Microsoft. However, without official confirmation from Microsoft, it is difficult to say whether the product has been abandoned.

If you need the ARR module, just download it from: Application Request Routing. This module still has the functionality described in the documentation.

Considering that you are using Windows 2022 and IIS, there is no particularly suitable solution for replacing ARR.

HAProxy is another open source load balancer and reverse proxy software that provides URL rewriting and load balancing capabilities. HAProxy is primarily designed for Linux environments, but can also be used on Windows with some additional configuration.

Alternatively, NGINX is a popular open source web server and reverse proxy solution that offers powerful load balancing and URL rewriting capabilities, and NGINX can be used in both Windows and Linux environments.

But before adopting any alternative solution, you must evaluate your specific requirements, infrastructure, and deployment scenarios to ensure that the selected alternative meets your needs.

---

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the email notification for this thread.

Best regards,

Yurong Dai

Answer 2

OOB IIS modules are under the same lifecycle of the IIS releases they are targeting. So, whatever for IIS 10 today remains supported until one day IIS 10 reaches end of life. You might read https://halfblood.pro/status-of-iis-out-of-band-modules-80a3af57c489 to learn more. BTW, never use release date or documentation date as evidence. Keep in mind that classic ASP and VB6 are still fully supported, and probably you won't find their release date and documentation very easy today.

"you have to use compatibility mode/registry tweak" indicates that you were using a very old installer. The latest from https://www.iis.net/downloads/microsoft/application-request-routing should install without any extra requirement on any IIS 10 machine, including Windows Server 2022.

Tiny modules like such rarely have security issues so they don't require periodically patches.