Leveraging BIG-IP APM for seamless client NTLM Authentication

Many customers express interest to use F5 Access Policy Manager for transparent seamless authentication for their users.  There are a couple of leading use cases that drive that desired behavior: ...
Published Jul 22, 2014
Version 1.0
BIG-IP Access Policy Manager (APM)
microsoft
ntlm
security
Marvin's avatar
Marvin
Icon for Cirrocumulus rankCirrocumulus
Apr 17, 2019

A client is requiring exactly the same setup for internal users. If I understand correctly this will mean the F5 to be able to poll all internal clients using NTLM and also verify the result with the AD server?

 

So firewall rule would be F5 Self IP --> all internal clients using UDP/TCP 137/138? Isn't this a security risk allowing a DMZ device to contact internal client on this port number?