Forum Discussion
mengler_136249
Nimbostratus
NimbostratusF5 NTLM Machine Account/Kerberos Constrained Delegation
We have successfully deployed the exchange 2013 iApp using Kerberos constrained delegation. We followed the template version 1.6.0.
We have a firewall between our F5's that sit on the edge, and ...
ActiveSync clients use NTLM credential authentication for some protocols. In order to support this, APM uses "Passthrough Authentication" which requires SMB, which requires port 445. Unfortunately it's technically not feasible to support all ActiveSync clients without it.
mengler_136249Whats odd, is that we had this iApp deployed 2 years ago with only OWA and Async flowing through it. Now we spun up another instance on a new VIP which will include all three (adding Outlook Anywhere). With the old deployment, we haven't allowed 445 to our AD environment.
Either way, this is some good info and ill take this our our systems guys and IT security.