Forum Discussion

DannyG_34437's avatar
DannyG_34437
Icon for Cirrus rankCirrus
Dec 18, 2013

F5 SSL Offload and Sharepoint AAM's.

Hi, I have been working on a F5 APM application for some time now. I used the latest Sharepoint iAPP to create a connection to my inside sharepoint servers. I am using SSL offloading by the F5 and most things seem to be working. However, my SP Admin had to modify the sharepoint AAM's in order to get everything working correctly. Below is what he had to do:

 

  • Internal URL --------------------------Zone ----------Public URL for Zone
  • https://app.ourcompany.com ----Default ---------https://app.ourcompany.com
  • http://app.ourcompany.com ------Default --------https://app.ourcompany.com

While this seemed to fix the SP app coming through the F5, the inside users can no longer access the site using the same name. Keep in mind that there is no cert on the server itself. This seemed to be the recommended way of setting up the AAM's from the F5 deployment guides and seems to be only way to get the SP app working correctly.

 

Something else we tried was to set the AAM's like the following:

 

  • Internal URL ----------------------------Zone ----------Public URL for Zone
  • https://app.ourcompany.com -------Default -------https://app.ourcompany.com
  • http://app.ourcompany.com ---------intranet ------http://app.ourcompany.com

While this did fix the inside access, issues (drop down menus not working and such) returned to users coming in through the F5.

 

As best we can tell, since the F5 is doing the SSL offload, all access to the internal server from the F5 is done over HTTP and the AAM settings seem to affect this traffic. This appears to be some sort of SP thing..

 

Anyone doing SSL offload on the F5 for Sharepoint access and using the same URL internal and external? If so, how did you resolve this particular issue? Did you use an irule? different URL for inside users? ???

 

Thanks in advance for any help on this issue, Thanks, Danny

 

application delivery
design
devops
iApps
iRules

9 Replies

Sort By
  • mikeshimkus_111's avatar
    mikeshimkus_111
    Historic F5 Account
    Dec 18, 2013

    Hi Danny, I do have this working in my lab. The external and internal users are hitting different virtual servers on their respective networks. Both virtuals were deployed with the same settings (offloading SSL, etc). My AAMs are set the same as what you have in your first example.

     

    Are your internal users going through the BIG-IP, or are they trying to hit the SharePoint servers directly?

     

    thanks

     

    Mike

     

  • DannyG_34437's avatar
    DannyG_34437
    Icon for Cirrus rankCirrus
    Dec 18, 2013

    Hi Mike, my internal users are trying to hit the servers directly.

     

    Thanks, danny

     

    • DannyG_34437's avatar
      DannyG_34437
      Icon for Cirrus rankCirrus
      Dec 18, 2013
      Mike, just to clarify, my internal users are hitting the SP server directly and I am not currently using a VS internally. If that is something I need to do to make this happen, then I am open to suggestions on how to set this up.. Thanks, Danny
  • mikeshimkus_111's avatar
    mikeshimkus_111
    Historic F5 Account
    Dec 18, 2013

    The servers would definitely need https bindings and a cert assigned to them for you to connect encrypted to them directly. I assume you are doing DNS load balancing for these internal clients.

     

    Are you running SharePoint 2010 or 2013?

     

  • DannyG_34437's avatar
    DannyG_34437
    Icon for Cirrus rankCirrus
    Dec 18, 2013

    Running 2010 and am only running single servers so no load balancing. Currently really only using the F5/APM to provide external access to internal resources.

     

    dg

     

  • DannyG_34437's avatar
    DannyG_34437
    Icon for Cirrus rankCirrus
    Dec 19, 2013

    Mike, The more I thought about what you said the more it started to make since to me :) I have since setup an inside VS for my test environment and it appears to have solved the issues I was seeing for inside users. Many thanks...

     

    dg

     

  • kurt_eichler_26's avatar
    kurt_eichler_26
    Icon for Nimbostratus rankNimbostratus
    May 17, 2016

    I realize this article is a few years old, but I have a question that appears related. I'm a SharePoint Admin testing out SSL offloading with the F5. The load balancing appears to be working as expected. However, for testing/troubleshooting purposes, I set the host file on each server to the IP of the server. Also, I want to be able to set my host file to the IP of the server so I can connect directly to the server. In doing so, both client and server side, I am seeing mixed results when connecting via http (I don't want to manage the certificates on each server). On 1 server, the start.aspx page loads while I get "SCRIPT7002: XMLHttpRequest: Network Error 0x2efd, Could not complete the operation due to error 00002efd" when hitting /_layouts/15/viewlsts.aspx or /_layouts/15/settings.aspx. On server 2, /_layouts/15/settings.aspx loads fine, but I get the same SCRIPT7002 error when trying to access start.aspx or /_layouts/15/viewlsts.aspx. When I add the SSL binding in to each server and access each server directly, I don't experience any issues. My AAM's are setup as F5 recommends....Internal http/Public https and Internal http/Public https. Is this expected behavior when accessing http or should I have the same experience as I would through SSL?

     

    • mikeshimkus_111's avatar
      mikeshimkus_111
      Historic F5 Account
      May 17, 2016
      Hi Kurt, if you don't use the host file in this way, you don't see the errors either, correct? I'm pretty sure that pointing the server to itself like that is going to give you weird results. I'd expect that going directly to any one server would be fine, though.
    • kurt_eichler_26's avatar
      kurt_eichler_26
      Icon for Nimbostratus rankNimbostratus
      May 17, 2016
      Yes, I only see this weird behavior when I am trying to hit the server directly from the server or from my client. Going through the F5 or hitting the server directly with the SSL binding added in doesn't seem to be an issue. I haven't found much documentation on whether or not you should have a full http experience when accessing the server directly. Although traffic will be going through the F5, I still need to be able know I'm accessing each server in the event of any issues.