Solved

Exchange 2010 + HLB + Kerberos

Posted on 2010-11-22
2
1,146 Views
Last Modified: 2013-03-11
Hi ALL,

I have a question concerning HLB and kerberos. I saw in article http://www.msexchange.org/articles_tutorials/exchange-server-2010/high-availability-recovery/load-balancing-exchange-2010-client-access-servers-using-hardware-load-balancer-solution-part2.html
that we can't use HLB URL for internal OWA URL.
In article Henrik Walther say this is because kerberos is used when accessing a mailbox
Can someone tell me more about that? I would like to understant completly
0
Comment
Question by:makanzore
2 Comments
 
LVL 49

Accepted Solution

by:
Akhater earned 500 total points
Comment Utility
the issue has nothing to do with exchange but with kerberos authentication.

Kerberos is the authentication method AD works and, by default, it cannot be used unless you are accessing the server with its real name.

Let me give you an example, assuming your server name is server1 and you try to access \\server1 from the network then kerberos will be used to authenticate you as a user and will allow you to access it.

However assuming you add a dns record or change your host file in a way that server2 is resolved to the same ip as server1 and try to access the server using \\server2 you will notice that you will not be able to access it using this name from a computer that is joined to your domain since the name you are trying to use is not registered in AD.

for the same reason accessing the owa website using https:\\mail.domain.com will take you to the NLB IP and then redirected to say server1 and try to use Kerberos authentication so you will be trying to access server1 with the name mail and kerberos will refuse it.

all this been said you have 2 workarounds for this "problem"

1. just enable basic authentication on the owa instead of kerberos authentication
2.Disable Strict Name Checking on the CAS servers
http://serverfault.com/questions/23823/how-to-configure-windows-machine-to-allow-file-sharing-with-dns-alias
0
 

Expert Comment

by:klacol
Comment Utility
Hello,

we are using Kerberos with Delegation to authenticate at an Exchange-CAS-server. Since we have a web application there is the double-hop-problem and the hop from our web-application-server (IIS) to the CAS is allready the second hop.

One of our customers has a LB-Enviroment.

Does this articel mean, that the traffic cannot be routed through the LB-balancer?

Thanks
Klaus
0

Featured Post

How to improve team productivity

Quip adds documents, spreadsheets, and tasklists to your Slack experience
- Elevate ideas to Quip docs
- Share Quip docs in Slack
- Get notified of changes to your docs
- Available on iOS/Android/Desktop/Web
- Online/Offline

Join & Write a Comment

Disabling the Directory Sync Service Account in Office 365 will stop directory synchronization from working.
This article explains in simple steps how to renew expiring Exchange Server Internal Transport Certificate.
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …
This video discusses moving either the default database or any database to a new volume.

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now