Forum Discussion
Nimbostratussccm 2012 internet based client management & LTM...
I have a question regarding the configuration of client and server authentication on the BIG-IP LTM from sccm 2012 clients that are internet based. The ports SCCM 2012 uses for client authentication are on port: 443 and there is an external URL that points to the internal SCCM server. The client has a PKI certificate that uses workstation authentication and the server has IIS with the PKI web server certificate that has the FQDNs of the external and internal server names. How would you go about setting up rules for both the server and workstation that all use the port 443? If anyone has any information on this at all I would greatly appreciate the help. If you need anymore information please let me know and I will provide it.
Thank you for your time.
6 Replies
- In most cases you would just make port 443 (and 8531 for SUP) available without any special rules to the internet to allow traffic between the server and client. Are you hoping to have the LTM do something else above this?
Tony_126671Our SCCM server and all of the rolls are internal, we dont want to expose the SCCM server directly to the internet so we want to have the F5 do a CRL check on the client cert then allow traffic to the sccm server any traffic that does not have a valid cert would be block and would never pass the LTM. If you need more information please let me know. Thanks
- Trevor_Jones_16Tony, I could use some more info. Do we need to load any of the certs? My test client is getting the following error: WINHTTP_CALLBACK_STATUS_SECURE_FAILURE
DavidS_24861Any findings on this? Had these same thoughts for our external SCCM client as well. Thanks.
scidevops_31381I know this is an old post but I"m trying to implement the same thing, is this possible for remote base users?
Bill_BerryAm trying to do the same thing, In the attempt to do SSL Bridging, Simply placing the (internally trusted) certificate with the proper externally facing CRL on the outside 443 vip, then passing it on to the inside does not work. Has anyone solved this problem. It seems a bit more complicated than described.
