For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Prohead_73562's avatar
Prohead_73562
Icon for Nimbostratus rankNimbostratus
Sep 11, 2012

Cas array problems

Hello!

 

We have 4 Cas servers in a Casaray that we are load blancing using our F5. We did the configuration using the Iapp template. Now when we done some testing it seems like it does not work as expected.

 

I can connect to the VIP using outlook. But when I disable the rpc access service on the CAS server that I know I'm connect to I see that Outlook starts to display "trying to reconnect", but it only stays in that state for a long time before I get the disconnected message. If I close outlook and restart it I get the same error message. It never connects to another cas server. When I start the service again on the CAS server Outlook reconnects.

 

We have a static port for rpc mapi and I can see that the node is down for the service.

 

What is the expected result when we disable the service in exchange?

 

 

Regards

 

microsoft
partner

8 Replies

  • mikeshimkus_111's avatar
    mikeshimkus_111
    Historic F5 Account
    Sep 11, 2012
    hi Prohead,

     

    On the LTM pools that are used by the VIP, can you check that the "Action on Service Down" setting is set to "Reject"?

     

     

    Which version of BIG-IP are you running? You will need to disable strictess on the iApp before changing this setting, but there are some caveats to that if you are running a version earlier than 11.2.

     

    thanks

     

    Mike
  • Prohead_73562's avatar
    Prohead_73562
    Icon for Nimbostratus rankNimbostratus
    Sep 11, 2012
    Hi Mike!

     

    I don't have access to the LTM since the guys who runs it already lleft for today :) I dont't know what version we are runnin but it's one of the newer, I think the iapp is from april.

     

    However, I already checked that "action on Service down" is set to reject.

     

  • Prohead_73562's avatar
    Prohead_73562
    Icon for Nimbostratus rankNimbostratus
    Sep 11, 2012
    No when i disable the rpc Mapi port only the virtual server for this is affected. The rpc virtual server for port 135 is still online.
  • mikeshimkus_111's avatar
    mikeshimkus_111
    Historic F5 Account
    Sep 11, 2012
    Check pages 76-77 in the iApp deployment guide: http://www.f5.com/pdf/deployment-guides/microsoft-exchange2010-iapp-dg.pdf

     

     

    If you create additional monitors for the static ports, and apply them to the 135 pool, it will mark down any pool member where one or both of the static ports has stopped responding.

     

     

    We are going to be adding this as default behavior in an upcoming release of the Exchange iApp. Can you tell me which version of the iApp template you are using?
  • Prohead_73562's avatar
    Prohead_73562
    Icon for Nimbostratus rankNimbostratus
    Sep 12, 2012
    Thanks! Reading the manual did the trick :) When we created the additional monitors the outlook clients moved to another server in the array. With the defaut value it can take up to 1.5 minutes before the server is marked as down. Is the recommendation to keep the default values or changing them to a smaller value for faster failovers?

     

     

    We are running iApp template version 2012_04_06 on LTM 11.1 hotfix 1
  • mikeshimkus_111's avatar
    mikeshimkus_111
    Historic F5 Account
    Sep 12, 2012
    You can certainly decrease the monitor timeout without causing problems, it just means you'll see more monitor traffic in packet captures which can add noise when you're troubleshooting.

     

     

    We recommend downloading the latest version of the iApp from downloads.f5.com. It's dated 2012_06_08 and has a few bug fixes for the version you're using.