For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

SamuelB's avatar
SamuelB
Icon for Nimbostratus rankNimbostratus
Mar 07, 2014

vSphere Web Client Portal Access in APM

Has anyone successfully implemented the vSphere Web Client (v5.5) within APM (v11.4) as a portal access resource?

 

Getting the vSphere Web Client itself working is no problem. However, the problem occurs when a user attempts to "Launch Console". This typically launches a new tab and utilizes a browser plugin that gives the user the ability to access a VM console. I have confirmed that it works with a browser directly while on the local LAN or using a VPN tunnel. The problem appears to be with the configuration of APM.

 

Does anyone have any ideas?

 

BIG-IP Access Policy Manager (APM)
deployment
security
virtualization

4 Replies

  • Niclas_Korsgård's avatar
    Niclas_Korsgård
    Icon for Nimbostratus rankNimbostratus
    Mar 10, 2016
    I solved this, in 12.0 For testing just run the wizard and create a portal with a portal resource. Make sure that PATH: is /* Full path with "host" is entered in the application URI. Then I managed to get this to work.
  • jdelaroque_4190's avatar
    jdelaroque_4190
    Icon for Nimbostratus rankNimbostratus
    Oct 26, 2016

    Hi, I have the same problem! and no change wheb i test your solution with the path in /*

     

    regards

     

  • DorianB_318208's avatar
    DorianB_318208
    Icon for Nimbostratus rankNimbostratus
    Apr 21, 2017

    Hi,

     

    I doubt there is an easy solution for this. When you start a browser console session it launches the console application in a new tab and fowards the following information through a URL like this:

     

    https://vcenter.com:7343/console/?vmId=vm-18194&vmName =VMtest01&host=vcenter.com:443&sessionTicket =cst-VCT-512340c4-bbf1-e1a8-f1d6-912348000d712--22-02-11-2A-90-14-04-F9-82-CF-11-03-BC-6D-27-07-59-11-6E-A3-E2&thumbprint=02:2A:2A:90:14:11:F9:82:CF:12:03:BC:6D:27:07:33:B5:6E:33:E2

     

    The console application tries to connect to host=vcenter.com:443.

     

    The same URL rewritten by APM looks like this:

     

    https://apm.portal.com/f5-w-68747470733a2f2f7663656e7465722e6361732e636f6d3a37333433$$/console/?vmId=vm-18194&vmName =VMtest01&host=vcenter.com:443&sessionTicket =cst-VCT-512340c4-bbf1-e1a8-f1d6-912348000d712--22-02-11-2A-90-14-04-F9-82-CF-11-03-BC-6D-27-07-59-11-6E-A3-E2&thumbprint=02:2A:2A:90:14:11:F9:82:CF:12:03:BC:6D:27:07:33:B5:6E:33:E2

     

    As you can see the host part is still the same, which means the client will try to connect directly to vcenter.com and completely bypasses APM. Even if there was a way to rewrite this host part to point to a portal access, I assume the thumbprint wouldn't match anymore.