Forum Discussion

avnishvyas_1974's avatar
avnishvyas_1974
Icon for Nimbostratus rankNimbostratus
Aug 31, 2017

APM Redirecting to my.policy and Kerberos Authentication Failing

Hello All really need some help with setting up an APM profile to authenticate Kerberos users for AD. The F5 LTM BIG-IP 7000 Version 12.0.0 Build 0.0 606 Final I have a VIP address on aa.bb.71.151 on TCP Port 8080 The VIP uses a dedicated SNAT Pool address cc.dd.72.4 for return traffic and the health monitors are simply doing a health check against with a GET request to a URL and and Request with a receive string WSUP which passes the health monitors to 6 proxy servers in the pool. The VIP has been set up as an explicit forwarding proxy VIP I believe the LTM set up for this is fine as connectivity has been proven from the VIP to the pool members. For the APM configuration i have used the following resources to build the APM policy https://support.f5.com/kb/en-us/products/big-ip_apm/manuals/product/apm-secure-web-gateway-implementations-11-6-0/9.html https://support.f5.com/kb/en-us/products/big-ip_apm/manuals/product/apm-secure-web-gateway-implementations-11-5-0/8.html https://support.f5.com/kb/en-us/products/big-ip_apm/manuals/product/apm-secure-web-gateway-implementations-11-6-0/5.html https://devcentral.f5.com/questions/kerberos-and-ntlm-authentication-using-apm

 

So the APM policy is defined as such

 

I have then requested a SPNUSR account as a test and ran the following command on CLI of the LTM klist -ke WRFILE:/config/filestore/files_d/Common_d/kerberos_keytab_file_d/:Common\SVC_APM_USer_key_file_75902_1

 

I then ran the Kinit command using the SPNUSR Accounts credentials kinit HTTP/SVC_APM_USer.Live.Internal@Live.Internal

 

I also ran a TCPDUMP at this time and can see that a connection is being made and Kerberos traffic is also occuring but the kerberos authenication is not occuring and also when an internal user browses to any of the URL they are immediately redirected to the my.policy page with no further progress? I would appreciate some Tips and Pointers as to where to start t-shooting this scenario? I have opened a TAC case with F5 and this was forwareded to their professional services team who quoted us a years salary for 2 days consultation? I want to avoid the cost by any means necessary so please help me!

 

1 Reply

  • Hi,

    If understand,

    SPNUSR
    user is defined with servicePrincipalName
    HTTP/SVC_APM_USer.Live.Internal@Live.Internal

    Did you configure DNS PTR record of your virtual server IP address with value

    SVC_APM_USer.Live.Internal

    Are F5 appliances configured with NTP on AD (or same NTP server than AD)?