Forum Discussion
NimbostratusIPHTTPS with DirectAccess Not working with F5
I am helping a client implement DirectAccess 2012 using IPHTTPS as the Protocol. The setup is
ISP Firewall----Client Firewall------F5 (Big IP) ----DA Servers---Internal Network.
The ISP is doing 1-1 NAT for the Public IP Addresses to the Client’s Firewall to an internal range. Then the traffic is forwarded to the F5 and then DA. The setup works fine when using DA with a single Server configuration. I can connect and access internal resources but when I enable External Load Balancer with a standard SSL Forwarding to the DA, the setup never works. I am NOT terminating the SSL on F5.
The Servers are pointing to the internal IP of F5 as DG. Also, one thing that I am confused about is where to use the VIP which is created at the time of DA ELB Wizard. I have four Servers with 10.20.4.41, 42,43,44 and when I run the Load Balancing Wizard, it upgrades the 41 IP as VIP and I have to use 45 as the DIP but since F5 only requires the Self IP but no VIP. Where exactly do I use this IP which is on the same Network as the DA Server’s external Interface? I am using Performance L4 profile on the F5.
True Mac spoofing is not needed.
I see two strange things. 1. Teredo interfaces are being enabled. Setup 2 interfaces behind edge device normally skips this step as Teredo only works with Public IPv4 addresses on the DA servers. 2. The pseudo network adapter is not getting an address assigned.
What is the output of the powershell command "get-NetDnsTransitionConfiguration" ?
Martijn
12 Replies
Amit_Bhatnagar_I was at the client site till 12:00 AM but got the setup working. Thanks a ton!! for pointing me to the right direction with the Pseudo Interface information. It seems the Hotfix did the trick.
Martijn_65080Cirrus
The wizard will ask you if you have static v6 configured on the nics. Don't know about NLB though. I always use F5 and the external LB scenario.
- Amit_Bhatnagar_
Ok...so Loopback Pseudo-Interface 1 is the problem...It is not getting the IP now in the third server. Two are working within NLB so that is the good news. Windows8-RT-KB2859347-x64 is the key here which is a Hotfix for this issue although, is there a way by which I can fix this issue without breaking NLB? I mean reset the adapters and then let the configuration Policy assign the correct IPs and all?
If not then I will have to break the NLB anyways which I am keeping as the last option?
- Amit_Bhatnagar_
In the wizard, it only requests for IPv4 Address and not IPv6 so even if I can assign it in the TCP/IP Properties, I cannot set the VIP.
- Martijn_65080
Configure the ::1 as the DIP on the first server (static IPv6 on the NIC). Then when running the LB wizard you will be asked to specify the new DIP. The ::1 will then automatically become the VIP. So as a DIP set ::2 while running the LB wizard, this address will be set on the NIC while the ::1 will automatically becomes the VIP and if everything goes right also the IP address for the 6to4 DNS server.
The IPHTTPS prefix is set in the DA config part in the remote access server part under prefixes and then IPv6 prefixes assigned to DA clients.
- Amit_Bhatnagar_
I understand all but this part "Configure fd80:aea0:34a6:3333::1 as the VIP and set the dip to fd80:aea0:34a6:3333::2 Make sure you define the IPHTTPS prefix to fd80:aea0:34a6:1000::/59 prefix in the config". How do I do it manually?
I can put the DIP but how about VIP? Also, the IPHTTPS prefix?
Thanks a ton for your help !:)
- Martijn_65080
Right,
So please break the Loadbalancing. Then run GPupdate /force on the DA servers
Then set the first server IPv6 adress on the internal interface to fd80:aea0:34a6:3333::1 the second server to fd80:aea0:34a6:3333::3 third and fourth to ::4 and ::5
Run the enable loadbalancing again on the server you assigned ::1 to.
Configure fd80:aea0:34a6:3333::1 as the VIP and set the dip to fd80:aea0:34a6:3333::2 Make sure you define the IPHTTPS prefix to fd80:aea0:34a6:1000::/59 prefix in the config.
Run Gpupdate /force again on all servers.
Check afterwards if the output the netsh int ipv6 dump now sets the fd80:aea0:34a6:3333::1 as the address on the Loopback Pseudo-Interface 1. Also check the local firewall rules on all servers to make sure the DNS rule allows traffic to fd80:aea0:34a6:3333::1
Do not forget to run gpupdate /force on the DA servers after disabling the LB and again after enabling LB.
- Amit_Bhatnagar_
This is the Output. I also noticed one more thing...The following error on the second server in the NLB.
"The system detected an address conflict for IP address fd80:aea0:34a6:3333::1 with the system having network hardware address 00-15-5D-08-33-0B. Network operations on this system may be disrupted as a result."
State : Enabled AcceptInterface : {Loopback Pseudo-Interface 1} SendInterface : {BE-PROD (DMZ-L3)} OnlySendAQuery : True LatencyMilliseconds : 300 AlwaysSynthesize : False ExclusionList : {0:0:0:0:0:ffff::/96} PrefixMapping : {fd80:aea0:34a6:7777::/96,0.0.0.0/0}
- Martijn_65080
True Mac spoofing is not needed.
I see two strange things. 1. Teredo interfaces are being enabled. Setup 2 interfaces behind edge device normally skips this step as Teredo only works with Public IPv4 addresses on the DA servers. 2. The pseudo network adapter is not getting an address assigned.
What is the output of the powershell command "get-NetDnsTransitionConfiguration" ?
Martijn
- Amit_Bhatnagar_
One more thing...I am using Hyper-V Setup here. Do I need to enable MAC Spoofing? I was under the impression that it is only required if we are using Windows NLB.
