F5 & Share point 2010

This information is given by Microsoft about the above issue and they mentioned that the problem is from F5, any comments.

 

 

 

From the IIS LOGS we have the good and the wrong entries:

 

 

Good one:

 

2012.01.02 6:06:17 xxx.xxx.xx.70 POST /_vti_bin/userprofileservice.asmx - 80 - xxx.xxx.xx.253 InfoPathDA 401 2 5 0

 

2012.01.02 6:06:17 xxx.xxx.xx.70 POST /_vti_bin/userprofileservice.asmx - 80 - xxx.xxx.xx.253 InfoPathDA 401 1 2148074254 0

 

2012.01.02 6:06:17 xxx.xxx.xx.70 POST /_vti_bin/userprofileservice.asmx - 80 SHARJAH\201453 xxx.xxx.xx.253 InfoPathDA 200 0 0 124

 

 

Wrong one:

 

 

2012.01.02 8:51:20 xxx.xxx.xx.70 POST /_vti_bin/userprofileservice.asmx - 80 - xxx.xxx.xx.253 InfoPathDA 401 2 5 0

 

2012.01.02 8:51:20 xxx.xxx.xx.70 POST /_vti_bin/userprofileservice.asmx - 80 - xxx.xxx.xx.253 InfoPathDA 401 1 2148074254 0

 

2012.01.02 8:51:20 xxx.xxx.xx.70 POST /_vti_bin/userprofileservice.asmx - 80 - xxx.xxx.xx.253 InfoPathDA 401 1 5 0

 

 

From that it seems that NTLM handshake is not working.

 

 

From the Network trace on booth of the servers we saw that the problem is with the authentication

 

 

The problem with the NTLM authentication in details:

 

 

Good Authentication example:

 

 

No. Time Source Destination Protocol Length Info

 

663 2012-01-05 14:59:50.421606 xxx.xxx.xx.253 xxx.xxx.xx.74 HTTP 736 GET /Style%20Library/Images/index_02.jpg HTTP/1.1 , NTLMSSP_NEGOTIATE

 

666 2012-01-05 14:59:50.423059 xxx.xxx.xx.74 xxx.xxx.xx.253 HTTP 593 HTTP/1.1 401 Unauthorized , NTLMSSP_CHALLENGE

 

684 2012-01-05 14:59:50.428955 xxx.xxx.xx.253 xxx.xxx.xx.74 HTTP 1344 GET /Style%20Library/Images/index_02.jpg HTTP/1.1 , NTLMSSP_AUTH, User: sharjah\20710632

 

 

And the problematic one:

 

 

No. Time Source Destination Protocol Length Info

 

22145 2012-01-05 15:00:16.939837 xxx.xxx.xx.253 xxx.xxx.xx.70 HTTP/XML 567 POST /_vti_bin/userprofileservice.asmx HTTP/1.1

 

22149 2012-01-05 15:00:16.946667 xxx.xxx.xx.253 xxx.xxx.xx.70 HTTP 469 POST /_vti_bin/userprofileservice.asmx HTTP/1.1 , NTLMSSP_NEGOTIATE

 

22156 2012-01-05 15:00:16.952061 xxx.xxx.xx.253 xxx.xxx.xx.70 HTTP/XML 567 POST /_vti_bin/userprofileservice.asmx HTTP/1.1 , NTLMSSP_AUTH, User: \

 

 

Please NOTE there are no DOMAIN and Username is specified in that packet those are missing! It seems that some active device is removing it? Maybe the F5? We need to investigate that.

 

 

 

Thanks and Regarads

 

a.latheef