Forum Discussion
me_60113
Nimbostratus
Nimbostratusmultiple 401 authorization iis 7.5 page load
Hello all
Hoping someone may have had similar experience to an issue I am having with CRM 4.
On page load i get the first prompt for user login and the resultant 401 code. User logs in and initially this seems fine. However monitoring the page loads and for each 200 ok code I get multiple 401 codes depending on whether am using negotiate or ntlm, or even both reults in an increase.
The issue is causing seconds delay to the users environment and results in quite a high number of 401. For example in one morning session of 49000 total connections, 29000 are 200 codes and 20000 are 401 codes .
The development team are keen to resolve this as you can imagine and wondered if anyone one had any thoughts?
Have tried multiple things to resolve but happy for any back to basics suggesions anyone might have.
Thank you in advance.
3 Replies
Michael_YatesWhat is the persistence method that you have configured on the Virtual Server?
Sounds like the User might not be persisted to the same Node in the Pool.
What_Lies_Bene1Cirrostratus
I'd agree with Michael that my first feeling is that this is a persistence issue. I've had to try and improve performance with NTLM in the past and a few other things spring to mind too;
1) Turn off authentication for images and (if you're allowed) css files.
2) Use compression!
3) Reduce the minimum compression size to 900B if bandwidth is an issue anywhere.
4) Ensure client caching and related HTTP headers and server cache settings are correct (ETags used to be an issue with IIS and IE).
5) Now that you can, use OneConnect with NTLM Connection Pooling (if available with your version).
6) If IPsec is used anywhere between client and Virtual Server, reduce the external VLAN MTU to a value that will avoid fragmentation.7) Use an iRule to respond to If-Modified-Since client requests with a 304 (if images and css, js etc are reasonably static), this will avoid a shed load of 401's.
hoolioSee this SOL for a few possible workarounds as well:
sol11110: The BIG-IP NTLM profile does not support IIS authentication negotiation using the WWW-Authenticate: Negotiate header
https://support.f5.com/kb/en-us/solutions/public/11000/100/sol11110.html
Aaron
