Forum Discussion

jwittenmyer's avatar
jwittenmyer
Icon for Nimbostratus rankNimbostratus
Apr 05, 2022

HSTS for ADFS Load Balancer

I'm using BIGIP LTM as a load balancer for two ADFS servers as part of a hybrid Exchange deployment.  I need to enable HSTS on the load balancer virtual server.  Enabling HSTS requires an SSL profile, however the load balancer is currently configured as "Type: Performance (Layer 4)" which uses SSL pass-through and does not support SSL profiles.  Is it possible to change the server type, enable an SSL profle, and enable HSTS without breaking my ADFS deployment?

security
  • Daniel_Wolf's avatar
    Daniel_Wolf
    Icon for MVP rankMVP
    Apr 10, 2022

    Hi jwittenmyer,

    even though the iApp for ADFS is deprecated, you can still follow the archived deployment guide. The config parameters and values described in Appendix A: Manual Configuration tables are still applicable.
    Your use case is described in the chapter named Configuring the BIG-IP LTM for load balancing AD FS or AD FS proxy servers: SSL Bridging.

    From my memory - pay attention to the server name in the serverssl profile. ADFS requires SNI.

    KR
    Daniel

  • Ruby69's avatar
    Ruby69
    Icon for Nimbostratus rankNimbostratus
    Apr 12, 2022

    Why is the header not always delivered indepentent of the entpoint? Basicly the URL adfs.domain.de delivers a webpage with status code 200.

    My Merrill