Forum Discussion
NimbostratusExchange 2013 Pool
I have asked this question once before but after doing the software update on my BIG IP LTM I'm back to the same scenario and can't get it figured out. Using the latest template I have created an iApp for my Exchange 2013 CAS servers. I chose encrypted traffic, ssl offloading, and have imported the certificate and created a client side ssl on the BIG IP. I'm back at the same issue I had previously. When both CAS servers are in the pool OWA loops the login screen continuously. When I take one of the CAS servers out of the pool OWA works correctly.
6 Replies
So it was working before your upgrade, but not now? Did you redeploy the iApp post-ugrade, or was it present before?
ewest111I was still in the testing phase and yes it was working. After the upgrade it stopped and I removed and re-created using the template.
Henrik_GyllkranThis sounds like a persistence issue, the reason why you see the logon page again and again is that you log on to one server and is then loadbalanced to the other CAS which doesn't recognize the session from the first server so it presents the logon page. You log on and is then loadbalanced to the first server which doesn't recognize the session from server 2 and so on...
Now, I know that Exchange 2013 shouldn't need persistence but I've seen a whole bunch of Exchange implementations that needed Persistence to work just the same. Now in regards to why it stopped working after the upgrade that's a mystery.
Which version of BIG-IP did you upgrade from and to? And which version of the iApp are you running?
The only consistent cause of this issue I've seen is IIS cert mismatch on the CAS servers. Exchange uses the cert to generate a session cookie (even when offloading SSL). If the next request after the logon POST sends the cookie to a CAS that can't unhash the cookie because its cert is different, you get the logon page again as if you were starting a new session.
Can you confirm that your second request is going to the other CAS, and that the IIS certs are the same on both?
- ewest111
I went from 11.3 to 11.6. The iApp version is 1.5.1. I have the same wildcard cert on all the servers MBX and CAS.
- You should open a support case with F5. Seems like the only factor that's changed here is BIG-IP version, although we've tested extensively with 11.6 and didn't see this issue.
