Forum Discussion

Greg_112502's avatar
Greg_112502
Icon for Nimbostratus rankNimbostratus
Jun 10, 2015

Exchange and APM

We migrated from Novell Groupwise to Exchange 2013 1.5yrs ago. At the time we employed the professional services teams of Microsoft and F5. MS was adamant that we deploy APM. We spent the money and installed APM on our BigIPs. F5 professional services showed up and spent an entire week here. They could not get APM working correctly. We spent the next 3 months or so talking to lots of folks at F5. Eventually we got APM in a working state. It worked ok for about a year. A couple of months ago we had an issue where APM stopped authenticating. Contacted F5 and they worked for hours on the issue. Finally it was determined that I needed to turn on the OneConnect profile and the ntlm profile. I explained to the engineer that those profiles had been turned off since they fixed the APM problem originally. I turned them on and poof, just like magic everyone could authenticate again. Ever since then we've been having random disconnects from Exchange. After some trial and error we figured out that if you switched from using your email to using your UPN(ad/username) that it would let them authenticate. And vice versa. We also found out that sometimes killing their session on the F5 would allow them to authenticate again. Has anyone else ran into the issue? If so, what was your solution and was it an F5 issue or an Exchange issue? At this point I'm ready to just turn off APM. It has been nothing but a headache!

 

APM
application delivery
LTM
microsoft
security

5 Replies

Sort By
  • amolari's avatar
    amolari
    Icon for Cirrus rankCirrus
    Jun 11, 2015
    which version of BIGIP are you running? Are you using an iApp for the Exchange configuration? if yes, which version of the iApp template?
  • Greg_112502's avatar
    Greg_112502
    Icon for Nimbostratus rankNimbostratus
    Jun 11, 2015
    11.6 HF4 and yes, we used the template at first, but so much has been changed that it doesn't even matter anymore...
  • mikeshimkus_111's avatar
    mikeshimkus_111
    Historic F5 Account
    Jun 11, 2015
    If this was working OK for a year, what changed to make things stop working? Was there a BIG-IP upgrade, Exchange CU, APM policy change, etc? The iApp is designed around the most basic, common use cases, but implementing the necessary customizations shouldn't be that problematic.
  • Greg_112502's avatar
    Greg_112502
    Icon for Nimbostratus rankNimbostratus
    Jun 11, 2015
    Again, nothing had changed. Nobody had even logged into the F5 in over a week when it decided to stop doing any authentications a couple of months ago. Putting the OneConnect profile back fixed that issue. Since then we've had the random disconnects and unable to login.
  • Algebraic_Mirror's avatar
    Algebraic_Mirror
    Icon for Cirrostratus rankCirrostratus
    Jun 12, 2015
    I haven't observed these problems with APM and Exchange 2013 personally, but here are some questions that might help us help you: 1. How many Windows domains are you dealing with? Just one, or more than one? 2. On your policy, if you look in the Visual Policy editor, can you check the logon page settings for your OWA branch? Within the logon page object, there is a "split username from domain" option near the top. I find that that should generally be set to true, but if it isn't that can cause issues where "username" behaves differently than "domain\username", which I think you said was one of your issues. 3. With regards to OneConnect/NTLM, I'm really surprised that was recommended to fix your issue. That's generally a performance boosting feature, not one that should ever fix things. Not using those is typically the simpler, albeit less performant, configuration so not having them is usually more realiable (unless you are possibly using an iRule that turns oneconnect on and off, which some F5 provided iRules may do; and in that case you would certainly want a profile so that the iRule works). All that aside, when it comes to random disconnects, how long of a time period are you seeing? Are people leaving OWA open for hours or days and then it disconnects? 4. You mentioned you sometimes have to kill a user's APM session. What are the symptoms you see when you have to do that? 5. What changes have been done recently to your device or your environment? There must have been some, because you stated that you are on 11.6 HF4, and that only been out since March, so you must have done at least some upgrades in the last year and a half, and I'd be curious when they happened and if they correspond to your issues. Also, external changes to AD servers could also cause issues. Most people only enter in one or two into their AAA Active Directory server object that they authenticate against, so if one of them is changed or having a problem it can cause these kinds of issues. 6. 11.6 HF4 itself may be part of the issue. In my experience it's still a pretty buggy branch of code that is very bleeding edge. 11.5.3 is the most recent truly stable branch at this point. So it is possible you may be hitting a bug in the software as well, but it would be impossible to say for sure at this point.