Forum Discussion

Pete_L_112517's avatar
Pete_L_112517
Icon for Nimbostratus rankNimbostratus
Jul 29, 2014

Lync 2013 Devices using F5 as Reverse Proxy can't connect

We've just deployed an on premise Lync 2013 environment (upgrade from 2010) using F5 BIG-IP LTM as the Reverse Proxy. This was deployed using the updated Lync 2013 iApp template. I cannot get an iO...
application delivery
deployment
devops
iApps
iRules
LTM
microsoft
  • mimlo_61970's avatar
    mimlo_61970
    Jul 29, 2014

    I have not checked the latest version of the template, but in 1.2.1 it did ask about the chain in the setup, and left me with an ssl profile that had no chain.

     

    You can try and manually set it. Go into the Application Services, click your Lync deployment and go to the Properties tab. Uncheck Strict updates and click update.

     

    From there go to the Client SSL Profile(mine is named Lync2013_edge_external_ip_reverse_proxy_client_ssl) and set the chain(you'll have to have imported it first as a certificate)

     

    If that solves your problem, just be aware that if you modify the iApp config it may overwrite this change and you have to set it back manually.

     

mimlo_61970's avatar
mimlo_61970
Icon for Cumulonimbus rankCumulonimbus

I have not checked the latest version of the template, but in 1.2.1 it did ask about the chain in the setup, and left me with an ssl profile that had no chain.

 

You can try and manually set it. Go into the Application Services, click your Lync deployment and go to the Properties tab. Uncheck Strict updates and click update.

 

From there go to the Client SSL Profile(mine is named Lync2013_edge_external_ip_reverse_proxy_client_ssl) and set the chain(you'll have to have imported it first as a certificate)

 

If that solves your problem, just be aware that if you modify the iApp config it may overwrite this change and you have to set it back manually.

 

mikeshimkus_111's avatar
mikeshimkus_111
Historic F5 Account
Aug 06, 2014
Hi there, I'm one of the maintainers of the Lync iApp template. There should be no question about intermediate cert in the v1.2.1 template (you can add it by disabling strictness, as you pointed out). This has been added in the v1.3.0 RC-1 version of the template that's up on DevCentral right now, and it does apply the chain cert in my testing. However, it looks like the chain cert is not visible in the web GUI. You can verify this by looking at the properties of the clientssl profile in tmsh. Can you confirm that you didn't see the chain cert in tmsh? thanks