Forum Discussion

scorpa_121336's avatar
scorpa_121336
Icon for Nimbostratus rankNimbostratus
Mar 25, 2014

Outlook password promt when CAS Exchange failover

Hello!   We have two Exchange 2010 CAS servers which is load balanced via F5. F5 has been configured with iApp exchange2010_Cas2012_06_08 without any changes and all working fine except outlook in...
application delivery
availability
BIG-IP Access Policy Manager (APM)
devops
iApps
iRules
security
  • mikeshimkus_111's avatar
    mikeshimkus_111
    Mar 25, 2014

    Hi scorpa, this is a known issue and there's no way to completely solve it, other than to migrate your users to Outlook Anywhere. We recommend that in general since RPC Client Access has been deprecated for Exchange 2013.

     

    If you have Outlook clients that are left open, those clients will send keep alives that will prevent the TCP idle timeout setting from tearing down the connections. When you reboot the CAS they are connected to, or take it down for maintenance, they will be prompted for authentication.

     

    You can drain-stop the pool member by disabing it and waiting until the TCP idle timeout period has passed (by default it's 2 hours), but your clients will still need to authenticate when they connect to the other CAS.

     

    thanks

     

    Mike

     

Olusola_Ayoade_'s avatar
Olusola_Ayoade_
Icon for Nimbostratus rankNimbostratus
Mar 05, 2015

Hi Mike,

 

I use f5.microsoft_exchange_2010_2013_cas.v1.4.0.tmpl template and i use firmware 11.6, i am trying to loadbalance exchange 2013, OWA is effectively loadbalanced, but outlook prompts for password and does not connect, it seems f5 is not handling the certificate properly, what could be the challenge , kindly assist, i am on site.i used the import type PKCS 12 (IIS) while importing certificate to F5 box

 

  • mikeshimkus_111's avatar
    mikeshimkus_111
    Historic F5 Account
    Mar 05, 2015
    Does your certificate contain the correct domain names for Outlook Anywhere, EWS, and OAB? I would try taking a packet capture on both sides of the BIG-IP to see what's happening. If you are getting immediate resets during the ssl handshake, then it sounds like a cert issue. If you are seeing 401s from Exchange, that is something else.