BillCan's Place

Using an F5 Load Balancer as an NLS server for DirectAccess

MUTiger86 — Fri, 26 Apr 2013 14:21:00 GMT

I was working on a deployment of DirectAccess for a company and of course how to deploy NLS came up. Obviously it is important that the NLS servers always be available, so the plan was to create two virtual IIS servers and put them behind their internal F5 load balancers. This would allow them to take down one of the NLS servers for patching while the other stayed up, and provided the high-availability that they needed.

However, this got me thinking about what a waste it was to have to provision and operate these two servers that basically did nothing but respond to HTTPS requests once in a while for DA. We considered using other servers that were already in place but we were concerned that overloading them with NLS functionality was risky, especially if the web team needed to do major upgrades on the apps on those servers and took a full outage.

Then it struck me that the ultimate solution would be to have the F5 load balancers themselves provide the NLS service. This had many advantages:

The F5s were already in a high-availability pair
As networking gear, there were monitored very closely
There was almost no situation where both load balancers would need to be taken down at the same time
They have the ability to terminate SSL sessions

Having worked for a while on the Xbox Live team, I called one of my buddies on the networking team and explained the situation and what I was trying to do. He suggested that it would be easy with an irule. An irule is a bit of customization that you can apply to a VIP on an F5. I'm sure that irules can do many different things, but one of the things they can do is respond to HTTP or HTTPS requests. I believe this is primarily used to allow the F5s to redirect users to a maintenance page with the servers behind them are down for maintenance. Whatever irules were intended to do, I was pretty sure that they would be able to do what I needed them to, so it was just a matter of getting the configuration right and testing it.

I grabbed an evaluation copy of the F5 virtual load balancer and went to work. At the time, the hardest part was getting the certificate deployed onto the load balancer, but after a little wrangling I got it to work. (BTW, I believe that this has gotten a lot easier in new version of the software.) After that, I set up the VIP, configured it to use the certificate and terminate SSL on the load balancers, whipped up an irule that responded with a tiny bit of HTML and a 200 response code and applied the irule to the VIP.

To test things, I first hit the VIP with a request from IE and viola! it responded just as expected. Hooray! So then, feeling cocky, I updated my HOSTS file to use the new VIP as my NLS server on my DA client and of course it didn't work. I was very puzzled since IE thought it was great but DA didn't. After a little back and forth with one of the DA gurus at Microsoft, we got to the bottom of the problem: the content type tag in my HTTP response was not exactly correct. I had not put in a hyphen between Content and Type. Apparently, the DA client used a much less forgiving HTTP library than IE, so while IE would ignore this problem and assume the proper content type, the DA client was choking on what it saw as a malformed HTTP response. Anyway, we fixed the irule by changing a space to a hyphen and it all started working.

For those of you wondering, here is the irule in all its glory:

when HTTP_REQUEST {

log local0. "Request for NLS service"
HTTP::respond 200 content "<html><head><title>Network Locator Service</title></head><body><h2>You are connected to the intranet.</h2></body></html>" "Content-Type" "text/html"
}

Anyway, this arrangement met the needs of the client, saved them two Windows license (sorry, Microsoft!) and left them with two less servers to worry about. In the end I'd say it was a win!

Me and my Verizon Jetpack 4G LTE access point

MUTiger86 — Wed, 03 Apr 2013 16:11:00 GMT

Recently, I got rid of my Sprint 3G/4G Overdrive access point and replaced it with a Verizon Jetpack 4G LTE access point. This thing is really fast and seems to get great coverage in a lot of place. However, the other day I started to have problems with it disconnecting and reconnecting repeatedly (on the order of 2 to 3 times per minute). Each time it disconnected, my VPN connection (if I was using it) would drop and in general the device was unusable.

I did some poking around and noticed that the device enables IPv6 by default. Since my machine is configured for DirectAccess (which uses IPv6 transition technologies) I wondered if turning off IPv6 on the device might help. I figured that it couldn't break anything since nothing on my machine would expect IPv6 to be available, so I went into the configuration and disabled it.

Sure enough, since I made that change, my connection has been rock solid and the disconnections are gone. I am not sure what exactly was happening, but now I can connect to the Internet, DirectAccess comes up as expected and life on the road is good again.

Holy moly, I'm back!!!

MUTiger86 — Wed, 19 Dec 2012 19:13:57 GMT

After taking a two year hiatus during which I moved (back) to the Phoenix area and worked for a Big 4 accounting firm, I've returned to Microsoft. I'm working in Microsoft Consulting Services now, focusing on security and identity management. I'm glad to be back as Microsoft is the company I've enjoyed working for most (and I've worked at a few companies, let me tell you!)

Anyway, I will be posting here sporadically going forward. I will be focusing on security and identity topics, with a bit of miscellany thrown just to keep things interesting.

Hello, Xbox Live...

BillCan — Fri, 21 Mar 2008 21:33:00 GMT

Well, I've been in the Xbox Live team for the past 3 days and my head is swimming! I had never thought about all the work that goes into keeping Xbox Live up and operational, but now that I'm here and get to see it, it's pretty remarkable. There is a large team working around the clock to make sure that gamers around the world can get on their Xboxes and have a troublefree experience whenever they want to.

Anyway, I'll have more to post down the road, but right now I'm still focusing on getting my feet underneath me so I can start contributing.

Goodbye, SA-SC!

BillCan — Mon, 17 Mar 2008 05:06:00 GMT

Starting this Tuesday, I will begin a new job at Microsoft: I am joining the Xbox Live Operations team as a Program Manager. I have really enjoyed my nearly 3.5 years on the Solution Accelerators Team, but am looking forward to a new challenge. My job on the Xbox Live team will be to help ensure that the Xbox Live network stays up and operational while we continue to add new features and capabilities.

Anyway, it's been fun and I will probably continue to post, but obviously on different topics!

Released: The External Collaboration Toolkit for SharePoint!

BillCan — Tue, 04 Mar 2008 23:32:00 GMT

I'm happy to announce that the External Collaboration Toolkit for SharePoint has been released and is now available at http://www.microsoft.com/collabkit. This toolkit helps you easily deploy a SharePoint-based external collaboration facility at your organization. Once this facility is in place, end users can quickly create a new collaboration site (using a SharePoint site collection) and add internal and external users to that site. Both these process can be workflow enabled so that an administrator must approve both site and user creation.

The toolkit runs on both MOSS 2007 and Windows SharePoint Services 3.0. It also leverages SQL Server 2005 and ADAM. All external users are created in the ADAM directory so they are segregated from your primary user store.

Please take a look at the External Collaboration Toolkit for SharePoint. If you have any questions, please let me know.

Bill

Windows Server 2008 Security Guide Released!

BillCan — Mon, 03 Mar 2008 21:27:00 GMT

My buddies down the hall recently released the Windows Server 2008 Security Guide the other day. This security guide is targeted at the latest Windows Server release (obviously!) and helps you implement the appropriate security settings based on the server's role.

You can access the Windows Server 2008 Security Guide at http://www.microsoft.com/wssg.

Corrected URL for the Extranet Collaboration Toolkit for SharePoint Beta

BillCan — Wed, 09 Jan 2008 22:47:00 GMT

In my previous post (since corrected), I included an incorrect link to get access to the beta of the Extranet Collaboration Toolkit for SharePoint. The actual URL is https://connect.microsoft.com/SelfNomination.aspx?ProgramID=1657&pageType=1&SiteID=14. Sorry about that!

Please download the beta for the Extranet Collaboration Toolkit for SharePoint

BillCan — Fri, 04 Jan 2008 00:32:00 GMT

I am happy to announce the beta release for the Extranet Collaboration Toolkit for SharePoint. We are making this beta release available in order to get feedback from our customers and partners. With your help, we can ensure that the Extranet Collaboration Toolkit for SharePoint (ECTS) meets your needs.

What is the Extranet Collaboration Toolkit for SharePoint?

The Extranet Collaboration Toolkit for SharePoint provides guidance and tools to deploy a pre-built, customizable SharePoint solution that teams can use to collaborate with those outside the firewall. At the same time, the toolkit helps ensure that sensitive data on these systems is protected.

Using this free toolkit, administrators can set up a secure, SharePoint-based extranet collaboration site in a short time. End users can then use this site to easily create new site collections, posting sharable documents that are centrally located inside the firewall. The toolkit also enables users to invite internal and external partners to collaborate on documents. And the toolkit makes it simple for team leads to assign or revoke access rights for any team member.

Once the ECTS is installed, your users can be up and running with a secure, SharePoint-based team site in minutes. They can easily invite and enable external users to collaborate with them, sharing documents that are centrally located on a SharePoint site inside the firewall. Administrators can require administrative approval for all new sites and users, or can allow precisely control the information outsiders can access, or they can delegate this control to end users and free up time for other tasks.

Where do I access the Beta?

To get started with the beta, please click here, then click the Downloads link. Note that you may have to register to get access to the Connect site. On the list of downloads, click the Extranet Collaboration Toolkit for SharePoint. From this page, download all the beta files. I recommend that you read the Release Notes first to learn about any late breaking information related to the ECTS.

Thinking of using SharePoint for extranet collaboration? Contact me!

BillCan — Wed, 12 Dec 2007 21:52:00 GMT

We are looking for beta participants for my current project, a set of guidance and tools that makes it easier to collaborate with people outside the firewall using SharePoint. If you are thinking about extranet collaboration, please get in touch by using the email link above. I'd love to discuss this with you and give you a chance to participate in our beta program.