WAF Exchange 2016 Load Balancing causes Login problems

Are we really the only ones who have the problem? / More than one Exchange 2016 server?

Or does nobody have an idea?

Hi,

if you have multiple real webservers, the load is distributed between all webservers. This means, you authenticate at webserverA and the next request goes to webserverB and webserverB asks for your credentials again.

To prevent this, there is the option 'Enable sticky session cookie' on the advanced tab in the site path route edit form.
If you enable this option "each (client) session will be bound to one real webserver. If enabled, a cookie is passed to the user's browser, which provokes the UTM to route all requests from this browser to the same real webserver. If the server is not available, the cookie will be updated, and the session will switch to another webserver." (cited from the Sophos UTM Online Help).

Edit: When sticky session cookie is enabled the load is still balanced between the webservers. But each client sticks to one webserver.

Best,
Sabine

Hi,

if you have multiple real webservers, the load is distributed between all webservers. This means, you authenticate at webserverA and the next request goes to webserverB and webserverB asks for your credentials again.

To prevent this, there is the option 'Enable sticky session cookie' on the advanced tab in the site path route edit form.
If you enable this option "each (client) session will be bound to one real webserver. If enabled, a cookie is passed to the user's browser, which provokes the UTM to route all requests from this browser to the same real webserver. If the server is not available, the cookie will be updated, and the session will switch to another webserver." (cited from the Sophos UTM Online Help).

Edit: When sticky session cookie is enabled the load is still balanced between the webservers. But each client sticks to one webserver.

Best,
Sabine

Hi Sabine,

thx for your reply but this isn't the fault.

I've already enabled the "sticky session cookie" in the site path route and OWA work's fine.

Our Outlook clients on Windows computers are the problem. The users will always be asked for the credentials, even if you select the "remember me" box.

Only if i remove 3 of our 4 Real Servers, Outlook works.

Greetings

This just doesn't seem like a configuration issue that's well-known.  What if you enable reverse auth so that WAF knows the credentials?

I wonder if there isn't something that can be configured in Exchange that enables the servers to share credentials in a distributed environment.

What does Sophos Support say about this?

Cheers - Bob

Hi Bob,

no i've doesn't tried the reverse auth. We don't want to use this feature. We want to use the WAF for loadbalancing and virus / hacker / etc. protection

The Sophos support isn't especially helpful (Sry, about that), the say the same thing as Evianne / Sabine. The thing with the sicky session cookie.

As i said, the sticky session cookie works on OWA / browsers. The are able to save these. But Outlook not.

I think this is the problem and we need another Scheduling/Balancing Method.

I'm wondering, that we are the only one with this problem.

Greetings

Hello Logan,

you are not alone! :D

I have exactly the same issue with two Exhange 2016 mailbox server behind SOPHOS WAF. Outlook prompt indefinitely credentials..

When we use WAF with one Exhange 2016 mailbox server, Outlook anywhere works again..

Have you find a solution of this issue?

I'm going to continue to search on my side

Have a good day!

Hey,

I'm sorry, but we haven't found a solution to get this working over the waf.

Sophos support wasn't able to name a date when this is working, so that we're using the server load balancing function in the utm. (Network protection -> server load balancing. It's not thats what we wanted but it works)

Regards

Hi everybody,

did you find a solution or another workaround in order to use WAF with several Exchange 2016 real webserver ?

Thanks for your help!

Hi YvainBARON,

no sry. I have'nt found a nother solution to use the waf with more than one exchange 2016 server.

At the moment we still use the simple server load balancing function

I read the changelog at each up2date release, but I honestly do not have much hope anymore.
The utm development seems to be dead, too bad for an actually really good product.

Exchange 2019 will be released by the end of 2018, maybe it'll work again with this version

same for me with UTM 9.603-1 - any news on this?

Loadbalancing should be possible with WAF enabled.

Hallo,

What does Sophos Support say about this issue now?

Cheers - Bob

nothing really helpful. Answer: Exchange 2016 is not completely supported!

... but advertising as Forefront Replacement? Bad.