NTLM message on F5

Question

Hi,&nbsp;
I am configuring NTLM authentication on the F5 following this guide: https://devcentral.f5.com/articles/configuring-apm-client-side-ntlm-authentication&nbsp;
I have admin rights to create the machine account on AD, and once created, I can renew the password with no errors.&nbsp;
But the F5 is reporting the following messages constantly on /var/log/apm:&nbsp;
May 10 10:31:58  err nlad[5376]: 01620000:3: &lt;0x2b323ffd0700&gt; nlclnt[31750020a] init: Error [0xc0000011,NT_STATUS_END_OF_FILE] connecting to DC [ip address]&nbsp;
Any idea Why?&nbsp;

simon_blakely · Answer

K55889450: BIG-IP APM NTLM authentication for RDP client gateway and Microsoft Exchange Proxy are incompatible with the Microsoft workaround for MS17-010 (WannaCry / EternalBlue)&nbsp;

Microsoft has released security bulletin MS17-010 announcing a recommended software security patch to fix multiple vulnerabilities in SMBv1. A procedure to disable SMBv1 is listed as a workaround. When this workaround is implemented, NTLM authentication in BIG-IP APM fails for RDP client gateway deployments, and Microsoft Exchange ActiveSync proxy deployments.  
&nbsp;
As a result of this issue, you may encounter one or more of the following symptoms:&nbsp;
Users are unable to authenticate when accessing RDP or Exchange services using the BIG-IP APM system.
The BIG-IP APM system generates messages to the /var/log/apm file that appear similar to the following example:
01620000:3: &lt;0x55abeb70&gt; nlclnt[129010a0a] init: Error [0xc0000011,NT_STATUS_END_OF_FILE] connecting to DC 10.10.10.10&nbsp;

Forum Discussion

NTLM message on F5

1 Reply

Recent Discussions

Disk space full - what files, folders are safe to delete?

ASM instance creation

BIG-IP DNS: Check Status Of Multiple Monitors Against Pool Member

Open Redirection Mitigation

F5Access | MacOS Sonoma

Related Content

NTLM

FIX Message Response

Configuring APM Client Side NTLM Authentication

NTLM Error message on F5

Persist connection based on NTLM username