Forum Discussion

Rosario_Gambar1's avatar
Rosario_Gambar1
Icon for Nimbostratus rankNimbostratus
Jul 28, 2015

Problems setting up mutliple ADFS Servers using LTM

Setting up new ADFS load balancing scheme using LTM. I have 3 ADFS servers configured in a Farm with no Microsoft NLB enabled. I've been using the F5 Implementation Guide and Dev Central configuration article and running into the following issues:

 

  1. I created three individual Monitors one for each ADFS server. The first ADFS server is ok with the monitor but the other two does not like the 200 OK sting. It's ok using the https monitor.

     

  2. I cannot enable and bring online all three ADFS members. If I do, users do not get the ADFS login and receive an error message. If I bring the first server (Primary) online only, everything works through the VIP.

     

Thoughts?

 

application delivery
LTM
microsoft

6 Replies

Sort By
  • mikeshimkus_111's avatar
    mikeshimkus_111
    Historic F5 Account
    Jul 28, 2015

    Hi Rosario, did you deploy use the ADFS iApp template, or manually? If it's the iApp, which version did you use? You should only need to create one monitor that gets applied to all of the servers at the pool level.

     

  • Rosario_Gambar1's avatar
    Rosario_Gambar1
    Icon for Nimbostratus rankNimbostratus
    Jul 28, 2015

    Deployed it manually. As to using the same monitor for all three, then I have a question for clarity. As part of the process in creating the monitor you need to configure the send string as outlined in the implementation guide. Below is the send string of the member which is working: GET /adfs/fs/federationserverservice.asmx HTTP/1.1\r\nHost:adfs.henrico.k12.va.us\r\nConnection:Close\r\n

     

    I have three servers with the following host names adfs, adfs2 and adfs3. How would I configure the monitor send string on the one monitor to support all three servers? Do I add three separate lines each containing it's own nHost value in the send string section?

     

  • Rosario_Gambar1's avatar
    Rosario_Gambar1
    Icon for Nimbostratus rankNimbostratus
    Jul 28, 2015

    Mike,

    I should of mentioned that the adfs server host names are .internal.  The FQDN for the Federation service is adfs.henrico.k12.va.us as included in the string.  When I try to apply the same monitor to the other two server it comes back with a red triangle.  If I try a different monitor such as https or ICMP, it likes it and turns green but the adfs authentication site stops working.  The only way to restore it is disabling the other servers.