Forum Discussion

Aviv's avatar
Aviv
Icon for Cirrus rankCirrus
Sep 24, 2016

Disable Apm on EWS uri

Hi!

 

After no one answer my question https://devcentral.f5.com/questions/exchange-ews-www-authenticate-48998

 

i'm trying a different approach all i need is that the bigip will respond to the client with WWW-Authenticate: Negotiate.

 

i want to disable apm on uri contains "/ews" i'm using exchange 2010 with iapp 1.6. i tried an irule but it didn't worked.

 

please help, Aviv Hassidim

 

7 Replies

  • after "start" --> add iRule event "name it as EWScheck", in that iRule check if the uri "contains" EWS, if yes set a custom apm session variable "session.custom.ews" = 1 then in the iRule box branches; check if "session.custom.ews = 1" ->> if yes add 401 response box on the APM policy flow make it as "Basic + NTLM" reorder the branches so Negotiate become first then NTLM.

     

    finally remove the "exchange application" settings of EWS "select none".

     

    hope this will help

     

  • Thanks Yazan! thats what i did. what am i missing (meybe irule access_policy_agant_event) i have attched screenshots and the irule.

    1.vpe 2.vpe-irule_event 3.401 4.virtual server 5.irule

    when HTTP_REQUEST { if { ( [string tolower [HTTP::uri]] contains "/EWS/" ) } { ACCESS::session data set "session.custom.ews" = 1 log local0. "ews service" } else {

    } 
    

    }

    • Nelgin_Nepolean's avatar
      Nelgin_Nepolean
      Icon for Nimbostratus rankNimbostratus

      Hi Aviv,

       

      Above mentioned solution really helped me to resolve my Exchange 2016 Outlook Anywhere issue. I have used above method in vpe for uri "/rpc/rpcproxy.dll" along with an iRule to diable APM.

       

      Thank you very much for your contribution.

       

      Regards

       

      Nelgin

       

  • Hi!

     

    now it works. there is no need in the irule.do that 1. add a Landing URI box before logon page and add in it this: expr { [mcget {session.server.landinguri}] == "/ews/" || [mcget {session.server.landinguri}] == "/ews/mrsproxy.svc" || [mcget {session.server.landinguri}] == "/autodiscover.svc/WSSecurity" || [mcget {session.server.landinguri}] == "/autodiscover/" }

     

    2.add an http 401 response after landing uri with basic+negotiate 3.remove /ews/* from the exchange profile. 4.the vpe look like this:

     

    Thanks, Aviv Hassidim

     

    • Chase_Abbott's avatar
      Chase_Abbott
      Icon for Employee rankEmployee

      Hi Aviv. I converted your discussion into a question so I could mark your solution as working. We're happy you finally got a resolution to this issue from our community!

       

  • Hi Nelgin,

     

    I have utilized the iRule posted abobe by George@USL. How did you configure the vpe for uri "rpc/rpcproxy.dll? I am unable to get this working and I desperately need to bypass the APM for Outlook anywhere.

     

    Thanks, D

     

  • Did anyone find a iRule to bypass APM on RPC URI's? We cannot use this method since our OWA uses BASIC, however RPC and other URL's use NTLM. Tried the iRule unsuccessfully. Without APM on it works ok.