Forum Discussion
kimhenriksen
Cirrostratus
CirrostratusGetting basic auth prompt before apm logon page event
Hi I´ve setup a basic login policy. Check if client subnet is RFC1918, if yes do ntlm auth, if not go to logon page and do MFA login. But.. when i access the VIP external i get a basic a...
A quick update.
Latest rule is not correct, pasted the wrong one from the clipboard.
Here the latest.
when HTTP_REQUEST {
if { [IP::addr [IP::client_addr] equals "10.0.0.0/8"] or [IP::addr [IP::client_addr] equals "192.168.0.0/16"] or [IP::addr [IP::client_addr] equals "172.16.0.0/12"] } {
if { [ACCESS::session data get session.ntlm.last.result] eq 1 } {
ECA::disable
} else {
ECA::enable
ECA::select select_ntlm:/Common/ntlm_profile
#log local0. "eca enabled"
}
} else {
ECA::disable
#log local0. "RFC1918 ECA disable"
}
}
Daniel_Wolf
MVP
MVPCan you share the config / iRule(s) you are using?
Usually, when something seems off with iRules, I try to add logging and take a look at this reference:
It shows iRules HTTP and ACCESS event order.
kimhenriksenwhen HTTP_REQUEST {
if { [ACCESS::session data get session.ntlm.last.result] eq 1 } {
ECA::disable
} else {
ECA::enable
ECA::select select_ntlm:/Common/ntlm_config
}
}
This the one used now, but want to try and change it to this instead.
when HTTP_REQUEST {
if { [IP::addr [IP::client_addr] equals 10.0.0.0/8] or [IP::addr [IP::client_addr] equals 192.168.0.0/16] or [IP::addr [IP::client_addr] equals 172.16.0.0/12] } {
ECA::disable
}
elseif { [ACCESS::session data get session.ntlm.last.result] eq 1 } {
ECA::disable
}
else {
ECA::enable
ECA::select select_ntlm:/Common/ntlm_config
}
}