Forum Discussion
NimbostratusLoad balance_RDP
Hello team,
I create rdp VS:192.168.3.143:3389 and access it through APM-VPN.
I added 4 servers to the pool
(10.5.13.122 / 10.5.13.123 /10.5.13.124 / 10.5.13.125) I used the Least session(member) and I tried using round robbin but the same behavior
if the first user is connected to 10.5.13.122 all users will come to this server and the session will be terminated
I used the default Persistence Type: Microsoft® Remote Desktop.
Fallback Persistence Profile used : source address
I expect this to happen because of the persistence profile I removed it, and I received the below issues:
The Connection Has Been Terminated Because An Unexpected Server Authentication Certificate Was Received From The Remote Computer
I used cli ti see the connection to check the user name and I found all users come with different names:
tmsh show /ltm persistence persist-records mode msrdp
msrdp kamc-jd\a 192.168.3.143:3389 10.5.13.122:3389 (tmm: 3)
msrdp KAMC-JD\z 192.168.3.143:3389 10.5.13.122:3389 (tmm: 2)
msrdp KAMC-JD\A 192.168.3.143:3389 10.5.13.122:3389 (tmm: 2)
msrdp kamc-rd\M 192.168.3.143:3389 10.5.13.122:3389 (tmm: 0)
1 Reply
- Lucas_Thompson
Employee
This type of LB configuration is typically solved using Microsoft's RD Connection Broker. It handles the persistence and user-redirection itself.
I can't think of why a persistence profile would make any difference as to what certificate is transmitted, or even what a certificate over the proprietary MSRDP protocol would look like. This Microsoft article has some information that might be helpful:
One thing I have seen is that untrusted-certificate error WILL pop-up if you use the Remote Desktop client to access an RD Gateway server that presents an untrusted TLS certificate, but that's over HTTPS (443), not RDP (3389). Hopefully in your tests you are 100% using good certificates that are trusted on your client PCs.
You can read more about the RDP-to-HTTP translation functionality of RD Gateway here:
Finally, APM does implement RD Gateway-like functionality itself, so you don't need to use Microsoft's. You can read about how that works here:
https://my.f5.com/manage/s/article/K08943176
