For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Roo_150490's avatar
Roo_150490
Icon for Nimbostratus rankNimbostratus
Apr 15, 2014

Hi,

 

So I couldnt get the first command to work to get log-level to debug. I'm still learning this stuff, from a windows background, so thank you for your patience.

 

Here is what I have managed to capture:

 

[root@BigIPF5:Active:Standalone] / tail /var/log/apm Apr 15 09:21:19 BigIPF5 notice tmm1[10040]: 01490506:5: 9095a2f6: Received User-Agent header: Mozilla%2f5.0%20(Windows%20NT%206.1)%20AppleWebKit%2f537.36%20(KHTML%2c%20like%20Gecko)%20Chrome%2f34.0.1847.116%20Safari%2f537.36. Apr 15 09:21:19 BigIPF5 notice tmm1[10040]: 01490544:5: 9095a2f6: Received client info - Type: Mozilla Version: 5 Platform: Win7 CPU: unknown UI Mode: Fu ll Javascript Support: 1 ActiveX Support: 0 Plugin Support: 1 Apr 15 09:21:19 BigIPF5 notice tmm1[10040]: 01490500:5: 9095a2f6: New session from client IP x.x.x.x at VIP 10.10.10.100 Listener /Common/SSL-Portal_vs (Reputation=Unknown) Apr 15 09:21:38 BigIPF5 notice apd[5882]: 01490010:5: 9095a2f6: Usernam 'test' Apr 15 09:21:38 BigIPF5 notice apd[5882]: 01490008:5: 9095a2f6: Connectivity resource '/Common/RDP' assigned Apr 15 09:21:38 BigIPF5 notice apd[5882]: 01490128:5: 9095a2f6: Webtop '/Common/SSL-Portal_webtop' assigned Apr 15 09:21:38 BigIPF5 notice apd[5882]: 01490005:5: 9095a2f6: Followingrule 'fallback' from item 'All SSL Portal Apps' to ending 'Allow' Apr 15 09:21:38 BigIPF5 notice apd[5882]: 01490102:5: 9095a2f6: Access policy result: Full Apr 15 09:22:14 BigIPF5 warning tmm[10040]: 014d0002:4: 9095a2f6: SSOv2 Logon failed, config /Common/OWA form tform

 

[root@BigIPF5:Active:Standalone] / tmsh list apm sso form-basedv2 apm sso form-basedv2 OWA { forms { tform { controls { password { secure true value "%{session.sso.token.last.password}" } username { value "%{session.sso.token.last.username}" } } request-value "/owa/auth/logon.aspx\?replaceCurrent=1&url= /owa/auth/logon.aspx\?url=" submit-javascript clkLgn() submit-javascript-type extra success-match-type cookie success-match-value sessionid } } } [root@BigIPF5:Active:Standalone] / tmsh show apm sso form-basedv2

 

Apm::SSO Form Based V2 Configuration: OWA

HTTP requests 54 HTTP responses 33 HTML pages scanned 21 Logon forms found 12 Total SSO logons 12 Successful logons 0 Failed logons 12 Logons ignored due to size 0 Errors 0