Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1171
  • Last Modified:

Exchange 2010 + HLB + Kerberos

Hi ALL,

I have a question concerning HLB and kerberos. I saw in article http://www.msexchange.org/articles_tutorials/exchange-server-2010/high-availability-recovery/load-balancing-exchange-2010-client-access-servers-using-hardware-load-balancer-solution-part2.html 
that we can't use HLB URL for internal OWA URL.
In article Henrik Walther say this is because kerberos is used when accessing a mailbox
Can someone tell me more about that? I would like to understant completly
0
makanzore
Asked:
makanzore
1 Solution
 
AkhaterCommented:
the issue has nothing to do with exchange but with kerberos authentication.

Kerberos is the authentication method AD works and, by default, it cannot be used unless you are accessing the server with its real name.

Let me give you an example, assuming your server name is server1 and you try to access \\server1 from the network then kerberos will be used to authenticate you as a user and will allow you to access it.

However assuming you add a dns record or change your host file in a way that server2 is resolved to the same ip as server1 and try to access the server using \\server2 you will notice that you will not be able to access it using this name from a computer that is joined to your domain since the name you are trying to use is not registered in AD.

for the same reason accessing the owa website using https:\\mail.domain.com will take you to the NLB IP and then redirected to say server1 and try to use Kerberos authentication so you will be trying to access server1 with the name mail and kerberos will refuse it.

all this been said you have 2 workarounds for this "problem"

1. just enable basic authentication on the owa instead of kerberos authentication
2.Disable Strict Name Checking on the CAS servers
http://serverfault.com/questions/23823/how-to-configure-windows-machine-to-allow-file-sharing-with-dns-alias
0
 
klacolCommented:
Hello,

we are using Kerberos with Delegation to authenticate at an Exchange-CAS-server. Since we have a web application there is the double-hop-problem and the hop from our web-application-server (IIS) to the CAS is allready the second hop.

One of our customers has a LB-Enviroment.

Does this articel mean, that the traffic cannot be routed through the LB-balancer?

Thanks
Klaus
0

Featured Post

Free Tool: IP Lookup

Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now