Forum Discussion

scorpa_121336's avatar
scorpa_121336
Icon for Nimbostratus rankNimbostratus
Mar 25, 2014

Outlook password promt when CAS Exchange failover

Hello!   We have two Exchange 2010 CAS servers which is load balanced via F5. F5 has been configured with iApp exchange2010_Cas2012_06_08 without any changes and all working fine except outlook in...
application delivery
availability
BIG-IP Access Policy Manager (APM)
devops
iApps
iRules
security
  • mikeshimkus_111's avatar
    mikeshimkus_111
    Mar 25, 2014

    Hi scorpa, this is a known issue and there's no way to completely solve it, other than to migrate your users to Outlook Anywhere. We recommend that in general since RPC Client Access has been deprecated for Exchange 2013.

     

    If you have Outlook clients that are left open, those clients will send keep alives that will prevent the TCP idle timeout setting from tearing down the connections. When you reboot the CAS they are connected to, or take it down for maintenance, they will be prompted for authentication.

     

    You can drain-stop the pool member by disabing it and waiting until the TCP idle timeout period has passed (by default it's 2 hours), but your clients will still need to authenticate when they connect to the other CAS.

     

    thanks

     

    Mike

     

Olusola_Ayoade_'s avatar
Olusola_Ayoade_
Icon for Nimbostratus rankNimbostratus

Hi Mike, Thanks for your support, can you point me to a material that shows how to export certificate and key from CAS. Also which command will i use to confirm if my certificate contains the correct domain names for outlook anywhere, here is the error prompt i get when trying to register to outlook (There is a problem with the proxy servers security certificate, the security certificate is not a trusted certifying authority.) Thanks for the assistance.

 

mikeshimkus_111's avatar
mikeshimkus_111
Historic F5 Account
Mar 05, 2015
Hi Olusola, you should be able to export the cert and key using the Certificate Manager MMC snap-in from your CAS. On BIG-IP, once you have imported the .pfx file, you can go to System ›› File Management : SSL Certificate List, click on the cert you imported, and look at the Subject Alternative Name field to see what names are in your cert.