Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

Exchange 2010 + HLB + Kerberos

Posted on 2010-11-22
2
Medium Priority
?
1,166 Views
Last Modified: 2013-03-11
Hi ALL,

I have a question concerning HLB and kerberos. I saw in article http://www.msexchange.org/articles_tutorials/exchange-server-2010/high-availability-recovery/load-balancing-exchange-2010-client-access-servers-using-hardware-load-balancer-solution-part2.html 
that we can't use HLB URL for internal OWA URL.
In article Henrik Walther say this is because kerberos is used when accessing a mailbox
Can someone tell me more about that? I would like to understant completly
0
Comment
Question by:makanzore
2 Comments
 
LVL 49

Accepted Solution

by:
Akhater earned 2000 total points
ID: 34200948
the issue has nothing to do with exchange but with kerberos authentication.

Kerberos is the authentication method AD works and, by default, it cannot be used unless you are accessing the server with its real name.

Let me give you an example, assuming your server name is server1 and you try to access \\server1 from the network then kerberos will be used to authenticate you as a user and will allow you to access it.

However assuming you add a dns record or change your host file in a way that server2 is resolved to the same ip as server1 and try to access the server using \\server2 you will notice that you will not be able to access it using this name from a computer that is joined to your domain since the name you are trying to use is not registered in AD.

for the same reason accessing the owa website using https:\\mail.domain.com will take you to the NLB IP and then redirected to say server1 and try to use Kerberos authentication so you will be trying to access server1 with the name mail and kerberos will refuse it.

all this been said you have 2 workarounds for this "problem"

1. just enable basic authentication on the owa instead of kerberos authentication
2.Disable Strict Name Checking on the CAS servers
http://serverfault.com/questions/23823/how-to-configure-windows-machine-to-allow-file-sharing-with-dns-alias
0
 

Expert Comment

by:klacol
ID: 38974427
Hello,

we are using Kerberos with Delegation to authenticate at an Exchange-CAS-server. Since we have a web application there is the double-hop-problem and the hop from our web-application-server (IIS) to the CAS is allready the second hop.

One of our customers has a LB-Enviroment.

Does this articel mean, that the traffic cannot be routed through the LB-balancer?

Thanks
Klaus
0

Featured Post

[Webinar] Cloud and Mobile-First Strategy

Maybe you’ve fully adopted the cloud since the beginning. Or maybe you started with on-prem resources but are pursuing a “cloud and mobile first” strategy. Getting to that end state has its challenges. Discover how to build out a 100% cloud and mobile IT strategy in this webinar.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This month, Experts Exchange sat down with resident SQL expert, Jim Horn, for an in-depth look into the makings of a successful career in SQL.
In this post, I will showcase the steps for how to create groups in Office 365. Office 365 groups allow for ease of flexibility and collaboration between staff members.
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.
This video shows how to use Hyena, from SystemTools Software, to update 100 user accounts from an external text file. View in 1080p for best video quality.
Suggested Courses

885 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question