wrong username in category denial

[mulhollandm]

folks

i'm getting occasional errors from my wsa 670

my i try to access a url i get denied but the notification contains a differents users username

i have access to the category but even if i refresh my browser (ctrl-f5) i get the same result (denied)

if run a packet capture on the client pc i can see the http 403 from the wsa but there is no ntlm exchange

thanks to anyone taking the time to reply

[Vance Kwan]

Hi there,

You are probably using IP address surrogates.  This is only ideal for environments where users do not share computers.  Once a user authenticates, the WSA will remember that User X is logged on to this IP address for 1 hour by default.  Once the 1 hour expires, then the WSA will ask the client for authentication again.

If you are in an environment where users share computers, you may want to change the surrogate to Session Cookie so that each socket will need authentication.

Hint:  You can clear the authentication cache using the 'authcache' command in the CLI.

Based on your other posts, it sounds like all your users will be authenticated using the F5 Load Balancer's IP address.  IP address surrogates are not an option for you with this type of deployment since most (if not all) of your users will be coming from the F5's IP address.

-Vance

[mulhollandm]

vance

many thanks for your reply

we are indeed using ip surrogates but we're not using shared computers

i have 6 wsas and a large user base spread over the 6 appliances, is there a way to prevent this behaviour rather than react to it?

thanks for your help

[Vance Kwan]

What value is the F5 load balancer adding for you besides load-balancing to the WSA's?

You can consider changing the F5 to use layer 2 to deliver traffic to the WSA's so that the client IP will stay the same.

-Vance

[mulhollandm]

vance

my f5s are'nt inline to the wsas so i need to use nat other the traffic isn't routed back to the original host

i've x forwarding enabled and the wsa can see this in policy

do you think layer 2 would resolve this?

[Vance Kwan]

I think it will since your users do not share computers.  But when going through the F5, every user will be coming from the same IP address so that is the same as sharing in the WSA's perspective.

But since you said your F5 is not in line, there may be challenges.  Depending on what the F5 does to the packet, the client may reject it if the WSA responds directly to the client without passing through the F5 first.