View persistence table data
Is there a command available to view the data held in the persistence table for LTM v11.2.1? I have recently switched from using a persistence profile that affected all traffic to the VIP to an irule that only sets persistence if the URI matches a key word. After this change it appears that not all connections are getting persistence set.Solved6.5KViews0likes9CommentsMS Print servers
Hi all, I am planning to use my new F5 LTM to load balance Windows Server 2003 print servers. For the moment, it doesn't work for me: I can see the shared printer but I can't map it. Has anayone already "played" with LTM & MS print servers ? Thanks, VincentSolved3.4KViews0likes42CommentsRemote Desktop Web Access and Remote Desktop Gateway SSO Through APM
I'm a relatively new BIG-IP admin (we purchased BIG-IP to replace our TMG 2010 solution). I'm attempting to configure Remote Desktop Web Access and Remote Desktop Gateway services (2008 R2) utilizing APM. The pre-sales engineer we spoke to indicated this should be a "simple" configuration, but it's certainly kicked me in the rear. I've created what I assumed would be a good configuration: 1: Virtual server with a pool for the RD web access and gateway server services, and an iRule to bypass APM for /rpc/rpcproxy.dll (see below, similar to rules I've seen for Exchange clients connecting using RPC over HTTPS). 2: APM configuration with forms-based SSO to the Web Access (which works perfectly), which allows us to integrate authentication to the web access page from our primary web portal. Now, normally using RD Web Access you login to the RD Web Access page, and it automatically connects your client to the RD Gateway, so launching a RemoteApp published application is seamless. When we apply an APM configuration to the virtual server, however, even with the rpcproxy.dll APM bypass in place, the automatic login to the RD Gateway doesn't happen. If we remove the APM config from the virtual server and publish directly without APM, it works fine, so I'm pretty sure the problem is with APM. In short, what should happen is: 1: Client lands on BIG-IP APM login page (works) 2: Client logs into BIG-IP APM login page, which passes credentials to RD Web Access form (works) 3: On login to RD Web Access, the client should automatically login to RD Gateway using same credentials used to login to RD Web Access (does NOT work) I haven't found anything on configuring APM SSO for RPC over HTTPS, so I'm finally at a loss and asking here. Any suggestions? Pointers? when HTTP_REQUEST { if {[string tolower [HTTP::uri]] contains "/rpc/rpcproxy.dll"} { COMPRESS::disable CACHE::disable ACCESS::disable pool } }Solved3.4KViews0likes28CommentsClient SSL Profile Cipher...Disable DES-CBC3-SHA.
One of my sites has just be penetration tested and a low risk was identified. The following weak ciphers were supported Testing SSL server mysite.fqdn on port 443 Supported Server Cipher(s): Accepted TLSv1 256 bits AES256-SHA Accepted TLSv1 128 bits AES128-SHA **Accepted TLSv1 168 bits DES-CBC3-SHA** Prefered Server Cipher(s): TLSv1 256 bits AES256-SHA It is the TLSv1 168 bits DES-CBC3-SHA that they are not happy about, but I am not sure how to disable it in the SSL Client profile. They also suggest disabling any ciphers using 128 bit keys - so I guess TLSv1 128 bits AES128-SH needs to go as well. The current setting is TLSv1_1:TLSv1_2:ECDHE+AES-GCM:NATIVE:!ADH:!MD5:!EXPORT:!DES:!DHE:!EDH:!RC4:!SSLv3:!SSLv2:@STRENGTH Is there a document that clearly shows how to achieve both - I struggle with these LTM's at the best of times. 😞 I am running BIG-IP v11.6.0 (Build 5.0.429) if that has a bearing. Any help offered will be appreciated. Thanks, Martin3.2KViews0likes18CommentsHOW-TO disable Microsoft-HTTPAPI /2.0
To the Microsoft Experts out there This is my (GTM) scenario... There are two Data Centers Each Data Center with its own GTM and its own IIS server ( hosted on Windows 2012 server) ( each IIS server hosting the same website or in other words configure with the same application pool) At the DNS resolution level, GTM works flawlessly.. I have constructed an http monitor validating the host header of the application pool, so when i stop one of the application pool ( in either data center) GTM is capable of detecting the site as "down" and providing DNS response the the one application pool remaining as "up" in the other Data Center. If I do an HTTP capture I can see the "Server" response header with the expected value of "Microsoft IIS 8.5" up until here all good! My problem arises at the Browser/user session level When I go and stop one of the application pool, GTM ( as i said) is capable of detecting the app went down and provides a DNS response to the remaining available site, HOWEVER at the Browser level the user is getting a 503 ERROR message "Service Unavailable". Analyzing the HTTP captures I see the "server" response header with the value of "Microsoft-HTTPAPI / 2.0" as if the IIS is still listening on port 80 for incoming user request Does anyone knows is this API is related to my problem? If so, how to disable it I have attached an screenshot for better clarification Thanks in advanced!3.2KViews0likes2CommentsF5 to load balance MS Sql Servers
Hello All: I am presented with a tricky situation by the business users here at my company. After seeing the performance and manageability with all the Web Servers and App Servers with F5 LTM, now they want to see if we can do the same for Database Servers. Right off my head, I said its doable but took time to get back with more details and here am. Is there a solutions guide or something that gives more insight on setting up Database servers behind LTM. I am not sure if anyone ever did this before, at least I never saw any company using F5 to load balance DB. I am not sure even this is possible. Please advice. Appreciate you help. Thanks, Chenna3KViews0likes21Commentsif http uri starts with
Good morning all, by no means an iRule expert, but I spend a good bit of time on google before posting. the situation here is that I have this irule, which I am building upon at this point, but right now it reacts based on what the uri starts with. in most cases this works great without any issues, except this case there's a little twist, which is mid portion of the irul with the /string3. the problem is that string3 is being used as a way for the irule to identify the uri and work with it, but it's really not part of the actual url. I know you're then why are you using it, Right? the url is configured within the web.config, which has few of those and I am working with them one by one. the reason it's been working with the other ones is that they actually have something after / that I can work with while this one doesn't so I had to make something up. so is there a way to make this irule work as is but make it remove /string3 before sending it to the browser? when HTTP_REQUEST { if { [HTTP::uri] starts_with "/String1" or [HTTP::uri] starts_with "/String2" } { HTTP::header replace Host "host.domain.com" pool Pool1 } if { [HTTP::uri] starts_with "/string3" } { HTTP::header replace Host "host.domain.com" pool Pool2 } else { pool Pool3 } }Solved2.8KViews0likes5CommentsHow to create health monitor for IIS pool on web server
Hello All, I have to create health monitor which can detect member down if IIS pool is down on webserver. Currently i have created normal http monitor which monitor IIS service. But I need monitor which will detect IIS pool failure even if IIS service is running2.6KViews0likes4CommentsIssues with Exchange 2013 owa
I've got the Big IP F5 virtual load balancer set up in my exchange 2013 lab getting ready for our migration in a few months and am having an issue. I've got an exchange 2007 environment set up to mimic what we have in production with multiple cas servers behind a VIP. Everything works fine. I've also got our exchange 2013 lab environment set up to run in coexistence with multiple CAS servers behind another VIP. If I log in a test account into exchange 2013 owa (through the VIP) that is an exchange 2007 mailbox, it redirects to the legacy owa (not using APM but letting exchange handle the redirection)and they can log in and get to their legacy mailbox. If I move that same users mailbox to exchange 2013 and then have them log in to owa it does nothing. Just acts like its about to load something then takes you right back to logon screen. If I open the account in outlook its fine. If I bypass the F5 and go to owa directly off one of the CAS servers then its fine, logs them right into owa mail. I've got the latest Exch 2013 template and have re-done it multiple times with different settings but nothing seems to change. My cert is valid but even not using ssl still the same thing. I'm kind of stuck here and I dont have a solid background with F5 BigIP so any help in troubleshooting this is greatly appreciated. Thank you.2.4KViews0likes25CommentsIs it possible to connect to VPN from a Windows client command line without user interaction?
I am trying to get our F5 11.4 APM set up to work with remote Windows clients that need to connect and then disconnect from the VPN without any user interaction. To briefly summarize, this is for a remote password self-service application, so I need for the client machines to be able to do a remote command line access using "f5fpc -start /c "C:\Program Files\F5 VPN\client.f5c /t /q" so the users don't get any prompts or pop-ups, the client.f5c file has to provide the username and password and server to connect to, then the password self service app does its thing, and finally issues the command "f5fpc -stop" at the end to close the VPN session out. This needs to be done in the background as it is using straight username and password authentication and we don't want the users to see that. I keep getting authentication failures, and when I check the client.f5c, I see that it has not saved my password. I went back and checked my F5 settings, and sure enough the save password on exit setting is set to false. Even if I edit the file and save it, it just ignores the password I put in there and removes it afterwards. I guess I would need to set the connectivity profile to allow password caching and save it to disk, but can I make that change, download the package with those options, and then change it back as we generally don't want the passwords to be cached? How would I need to configure the access policy for this to work? I tried with and without a logon page, but I don't seem to be getting a username and/or password passed through from the client, none of the session variables show the values from the edge client config file. Is there a way to do this without a logon page so it is completely transparent and silent to the users?Solved2.2KViews0likes8Comments