For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

tobin_dax_93013's avatar
tobin_dax_93013
Icon for Nimbostratus rankNimbostratus
Dec 21, 2010

MSSQL Health Checks Supported Authentication Models

Hi All

 

 

My apologies if this not the correct forum to post this question. but since my question is releated to MS SQL i thought this might be a good spot.

 

 

I have been asked to load balance a pair of SQL servers behing an LTM running 10.2.0 which is working quite well. Our DBA has provided me with a SQL query to use as the basis of a custom MSSQL health Monitor he would like me to apply to the Pool members to verify that database is available. we only use intergrated authentication for access to the sql database not native SQL auth. Can the health monitor be configured to use and AD credential and password when it queries the database? when i apply this health monitor it fails and we can see in the sql logs that the authentcation failed, with a AD domain account.

 

 

Regards

 

Andrew

 

microsoft
partner

3 Replies

  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Dec 22, 2010
    Hi Andrew,

     

     

    I did some quick searching and can't find any reference to the authentication methods that the DB_monitor supports (which is what the mssql monitor is aliased to). If you define a SQL server account (not Windows AD), does the monitor work? If you enable debug when it fails, do you see anything interesting in /var/log/DBDaemon.log?

     

     

    Aaron
  • tobin_dax_93013's avatar
    tobin_dax_93013
    Icon for Nimbostratus rankNimbostratus
    Dec 23, 2010
    Hi

     

     

    sorry for the late reply, in order to test that we had to setup an instance which used sql authentication only and that seemed to work quite well, I think the issue that either MSSQL health monitor can't provide an Active Directory Cred as a username or I have the syntax wrong. I don't know if this helps at all, i get the impression that load balancing MS SQL isn't very common.

     

     

    thanks again.
  • hoolio's avatar
    hoolio
    Icon for Cirrostratus rankCirrostratus
    Dec 29, 2010
    Hi Andrew,

     

     

    Thanks for confirming. I suggest opening a case with F5 Support to see if there is a method for doing AD auth.

     

     

    If there isn't support for AD auth with the MSSQL monitor, you could enable SQL auth on the servers (of course, this might not be an option for your environment). Or you might be able to use an external monitor that calls a Linux utility that supports AD auth (not sure what this might be though). Another option might be to check the MSSQL service(s) following Jason's recent article:

     

     

    Monitoring Windows Terminal Services from BIG-IP

     

    http://devcentral.f5.com/Tutorials/TechTips/tabid/63/articleType/ArticleView/articleId/1086419/Monitoring-Windows-Terminal-Services-from-BIG-IP.aspx

     

     

    Aaron