For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Kris_01_158159's avatar
Kris_01_158159
Icon for Nimbostratus rankNimbostratus
Jun 16, 2014

Hi Mike,

 

Performed some captures of the apm and sso logs (these were both enabled in system/config/options) and ran some tail queries as suggested.

 

See below output on gist for the username "domainuser"

 

https://gist.github.com/anonymous/b18dcd0195bae355ce32

 

  • Kevin_Davies_40's avatar
    Kevin_Davies_40
    Icon for Nacreous rankNacreous
    Jun 16, 2014
    Kris, Goto to gist.github.com, paste it there, past link here :-) Might be better formatted that way.
  • Kris_01_158159's avatar
    Kris_01_158159
    Icon for Nimbostratus rankNimbostratus
    Jun 16, 2014
    HI Kevin/Mike, https://gist.github.com/anonymous/b18dcd0195bae355ce32 Thanks
  • mikeshimkus_111's avatar
    mikeshimkus_111
    Historic F5 Account
    Jun 16, 2014
    It looks like you're using a Basic SSO for auth to the Client Access servers. This should be NTLM. You definitely need to upgrade to v1.3.0 of the iApp. It uses the APM Exchange profile that was introduced in v11.4, which is getting updated on a regular basis, unlike the _sys_APM iRule that we used in previous versions.