For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Amit_Bhatnagar_'s avatar
Amit_Bhatnagar_
Icon for Nimbostratus rankNimbostratus
Aug 19, 2013
Solved

IPHTTPS with DirectAccess Not working with F5

I am helping a client implement DirectAccess 2012 using IPHTTPS as the Protocol. The setup is   ISP Firewall----Client Firewall------F5 (Big IP) ----DA Servers---Internal Network.   The ISP...
availability
BIG-IP Access Policy Manager (APM)
deployment
directaccess
security
  • Martijn_65080's avatar
    Martijn_65080
    Aug 19, 2013

    True Mac spoofing is not needed.

     

    I see two strange things. 1. Teredo interfaces are being enabled. Setup 2 interfaces behind edge device normally skips this step as Teredo only works with Public IPv4 addresses on the DA servers. 2. The pseudo network adapter is not getting an address assigned.

     

    What is the output of the powershell command "get-NetDnsTransitionConfiguration" ?

     

    Martijn

     

Martijn_65080's avatar
Martijn_65080
Icon for Cirrus rankCirrus
Aug 19, 2013

Right,

 

So please break the Loadbalancing. Then run GPupdate /force on the DA servers

 

Then set the first server IPv6 adress on the internal interface to fd80:aea0:34a6:3333::1 the second server to fd80:aea0:34a6:3333::3 third and fourth to ::4 and ::5

 

Run the enable loadbalancing again on the server you assigned ::1 to.

 

Configure fd80:aea0:34a6:3333::1 as the VIP and set the dip to fd80:aea0:34a6:3333::2 Make sure you define the IPHTTPS prefix to fd80:aea0:34a6:1000::/59 prefix in the config.

 

Run Gpupdate /force again on all servers.

 

Check afterwards if the output the netsh int ipv6 dump now sets the fd80:aea0:34a6:3333::1 as the address on the Loopback Pseudo-Interface 1. Also check the local firewall rules on all servers to make sure the DNS rule allows traffic to fd80:aea0:34a6:3333::1

 

Do not forget to run gpupdate /force on the DA servers after disabling the LB and again after enabling LB.