For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Amit_Bhatnagar_'s avatar
Amit_Bhatnagar_
Icon for Nimbostratus rankNimbostratus
Aug 19, 2013
Solved

IPHTTPS with DirectAccess Not working with F5

I am helping a client implement DirectAccess 2012 using IPHTTPS as the Protocol. The setup is   ISP Firewall----Client Firewall------F5 (Big IP) ----DA Servers---Internal Network.   The ISP...
availability
BIG-IP Access Policy Manager (APM)
deployment
directaccess
security
  • Martijn_65080's avatar
    Martijn_65080
    Aug 19, 2013

    True Mac spoofing is not needed.

     

    I see two strange things. 1. Teredo interfaces are being enabled. Setup 2 interfaces behind edge device normally skips this step as Teredo only works with Public IPv4 addresses on the DA servers. 2. The pseudo network adapter is not getting an address assigned.

     

    What is the output of the powershell command "get-NetDnsTransitionConfiguration" ?

     

    Martijn

     

Martijn_65080's avatar
Martijn_65080
Icon for Cirrus rankCirrus
Aug 19, 2013

Hi Amit,

 

I have encountered some problems when switching from single server to loadbalancing and back. Please check the follwing setting and make sure the DNS 64 setup is complete after running the loadbalncing wizard.

 

run the following in the command prompt; netsh int ipv6 dump. Take note of the IPv6 address in the "Loopback Pseudo-Interface 1" This should be the IPv6 internal VIP configured during setup.

 

Run the following powershell command; get-NetDnsTransitionConfiguration Make sure the output contains the follwing; AcceptInterface : {Loopback Pseudo-Interface 1}

 

Check the local firewall on the server and make sure that DNS requests are allowed to the internal IPv6 VIP address that you got from the netsh dump under the Loopback Pseudo-Interface 1

 

F5 only needs to host the VIP that you configure clients to connect to. (External DNS name you configure during DA setup or config).

 

I presume the DA servers have their external interface configured with the DG to the F5 ? Do you use SNAT on the virtual server ?

 

Kind regards,

 

Martijn