For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Amit_Bhatnagar_'s avatar
Amit_Bhatnagar_
Icon for Nimbostratus rankNimbostratus
Aug 19, 2013
Solved

IPHTTPS with DirectAccess Not working with F5

I am helping a client implement DirectAccess 2012 using IPHTTPS as the Protocol. The setup is   ISP Firewall----Client Firewall------F5 (Big IP) ----DA Servers---Internal Network.   The ISP...
availability
BIG-IP Access Policy Manager (APM)
deployment
directaccess
security
  • Martijn_65080's avatar
    Martijn_65080
    Aug 19, 2013

    True Mac spoofing is not needed.

     

    I see two strange things. 1. Teredo interfaces are being enabled. Setup 2 interfaces behind edge device normally skips this step as Teredo only works with Public IPv4 addresses on the DA servers. 2. The pseudo network adapter is not getting an address assigned.

     

    What is the output of the powershell command "get-NetDnsTransitionConfiguration" ?

     

    Martijn

     

Amit_Bhatnagar_'s avatar
Amit_Bhatnagar_
Icon for Nimbostratus rankNimbostratus
Aug 19, 2013

Thank you for the response! Here is the Output...I could not find out what is mentioned in your Post. Can you please check?

 

---------------------------------- IPv6 Configuration ----------------------------------

pushd interface ipv6 reset set global groupforwardedfragments=disabled add route prefix=fd37:3bf2:a48c:1::/64 interface="isatap.{74A133D5-B0FC-4D28-A5E9-D847384C2E58}" nexthop=:: publish=Yes add route prefix=fd80:aea0:34a6:1::/64 interface="isatap.{CF3F733D-4E37-4E79-A80D-12041AA27A41}" nexthop=:: publish=Yes add route prefix=fd80:aea0:34a6:1000::/64 interface="IPHTTPSInterface" nexthop=:: publish=Yes add route prefix=fd80:aea0:34a6::/48 interface="BE-PROD (DMZ-L3)" nexthop=:: publish=Yes add route prefix=fd80:aea0:34a6:7777::/96 interface="BE-PROD (DMZ-L3)" nexthop=:: publish=Yes set interface interface="Local Area Connection* 9" forwarding=enabled advertise=enabled nud=enabled ignoredefaultroutes=disabled set interface interface="isatap.{74A133D5-B0FC-4D28-A5E9-D847384C2E58}" forwarding=enabled advertise=enabled nud=enabled ignoredefaultroutes=disabled advertisedefaultroute=enabled set interface interface="Teredo Tunneling Pseudo-Interface" forwarding=enabled advertise=enabled mtu=1280 nud=enabled ignoredefaultroutes=disabled set interface interface="BE-PROD (DMZ-L3)" forwarding=enabled advertise=enabled nud=enabled ignoredefaultroutes=disabled set interface interface="isatap.{CF3F733D-4E37-4E79-A80D-12041AA27A41}" forwarding=enabled advertise=enabled nud=enabled ignoredefaultroutes=disabled advertisedefaultroute=enabled set interface interface="DMZ-L2" forwarding=disabled advertise=enabled nud=enabled ignoredefaultroutes=disabled set interface interface="Loopback Pseudo-Interface 1" forwarding=enabled advertise=disabled metric=0 siteprefixlength=0 nud=disabled routerdiscovery=disabled managedaddress=disabled otherstateful=disabled weakhostsend=disabled weakhostreceive=disabled ignoredefaultroutes=disabled advertisedrouterlifetime=0 advertisedefaultroute=disabled currenthoplimit=0 forcearpndwolpattern=disabled enabledirectedmacwolpattern=disabled ecncapability=ecndisabled set interface interface="6TO4 Adapter" forwarding=enabled advertise=disabled metric=0 siteprefixlength=0 nud=disabled routerdiscovery=disabled managedaddress=disabled otherstateful=disabled weakhostsend=disabled weakhostreceive=disabled ignoredefaultroutes=disabled advertisedrouterlifetime=0 advertisedefaultroute=disabled currenthoplimit=0 forcearpndwolpattern=disabled enabledirectedmacwolpattern=disabled ecncapability=ecndisabled set interface interface="IPHTTPSInterface" forwarding=enabled advertise=enabled nud=enabled ignoredefaultroutes=disabled advertisedefaultroute=disabled add address interface="BE-PROD (DMZ-L3)" address=fd80:aea0:34a6:3333::1/128 add address interface="IPHTTPSInterface" address=fd80:aea0:34a6:1000::1/128 add address interface="IPHTTPSInterface" address=fd80:aea0:34a6:1000::2/128 popd

 

End of IPv6 configuration ---------------------------------- 6to4 Configuration ----------------------------------

pushd interface 6to4

 

reset set state state=enabled popd

 

End of 6to4 configuration