Check for ActiveSync failed logins using iRules

Are you able to do a tcpdump to see what a failed login looks like, or alternatively use LiveHTTPHeaders, IEHeaders, HTTPWatch or something similar at the browser to inspect what comes back?

 

 

Once we understand what a failure looks like it should be fairly simple to write the iRule.

Packet capture is indeed the right place to start. You might be able to do this really easily just by looking at whether there are two consecutive 401/403s. That'd be more efficient than having to look at the response payload.