Forum Discussion

satish_txt_2254's avatar
satish_txt_2254
Icon for Cirrus rankCirrus
Aug 14, 2017

Kerberos behind F5 load-balancer

We have two kerberos server (freeipa), they are on private address and now we want to expend service to public so planning to put them behind F5 so i get high availability and protection too, But having hard time to make kerberos happy behind F5 because now client talking to F5 VIP with different hostname and later it's getting NATed down to server, I have added f5 vip SPN in kerberos so it will trust VIP but still no luck i am getting following error in logs now

GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (KDC has no support for encryption type)

i have added krb5.conf

allow_weak_crypto = yes

but still client not authenticating.

BIG-IP
devops
LTM
security
  • Stanislas_Piro2's avatar
    Stanislas_Piro2
    Icon for Cumulonimbus rankCumulonimbus
    Aug 17, 2017

    Hi,

     

    you can create a DNS PTR record. if VIP is 10.20.30.40 and application SPN is HTTP/myapp.company.com, create the following DNS record:

     

    40.30.20.10.in-addr.arpa.INPTR myapp.company.com