For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Misty_Spillers_'s avatar
Misty_Spillers_
Icon for Nimbostratus rankNimbostratus
Feb 14, 2013
Solved

Exchange iapp for multiple Exchange servers (different customers)

I'm on version 11.2.1 and using f5.microsoft_exchange_2010_cas.2012_06_08.     I created an "APM will provided secure remote access" iapp for one of our customers and it worked for the most p...
automation
devops
iApps
management
TMSH
  • mikeshimkus_111's avatar
    mikeshimkus_111
    Jun 19, 2013
    Misty,

     

    This morning I successfully tested deploying two separate Exchange environments behind a single BIG-IP running APM. I can think of at least two features required by this solution that are only available in BIG-IP v11.3 and above, which are the AAA server pool and client-initiated forms SSO.

     

     

    You will also want to use the latest version of the iApp, RC3, which we expect to release in the next day or so. Can you send me a private message on DevCentral with your email contact info? I can let you know as soon as that RC has been declared.

     

    Mike
speedbird_86757's avatar
speedbird_86757
Icon for Nimbostratus rankNimbostratus
Jul 24, 2013

We're running LTM 11.2.0 HF7 and see a similar issue, except that we do not use APM. The client connections terminate directly on the LTM's virtual server.

 

We have 2 sets of Exchange 2010 CAS servers in two separate RDs. One pair of CAS servers were deployed last year with the iApp f5.microsoft_exchange_2010_cas.2012_06_08 and had been working fine.

 

Yesterday, we added a new instance to operate against a new pair of CAS servers in a different RD. The moment its added, the older iApp stops working (ActiveSync, Outlook Anywhere and OWA). Each iApp uses one FQDN for all Exchange services, but they are different for each iApp instance.

 

During the problem, it looks like the SNAT pool was not being currently chosen and/or the RDs were not being honored. The older iApp's CAS servers (RD X) were seeing inbound connections from IPs belonging to the newer iApp's SNAT pool (RD Y)

 

We've opened a case with F5 support.

 

Mike - is there an updated iApp template you mentioned?

 

Thanks.