DEPLOYMENT GUIDE Version 1.2. Deploying F5 with Microsoft Exchange Server 2007

Transcription

1 DEPLOYMENT GUIDE Version 1.2 Deploying F5 with Microsoft Exchange Server 2007

2 Table of Contents Table of Contents Deploying F5 devices with Microsoft Exchange Server 2007 Client Access Servers Prerequisites and configuration notes Product versions and revision history Configuration example Configuring the BIG-IP LTM for the OWA component of Client Access Connecting to the BIG-IP device Importing keys and certificates Creating the HTTP health monitor Creating the pool Creating profiles Creating the irules Creating the virtual servers Optional: Using X-Forwarded-For to log the client IP address in IIS 7.0 and Adding the X-Forwarded-For log field to IIS Configuring the WebAccelerator with Exchange 2007 OWA Prerequisites and configuration notes Configuring the WebAccelerator module for Outlook Web Access Connecting to the BIG-IP device Creating an HTTP Class profile Modifying the Virtual Server to use the Class profile Downloading and importing the WebAccelerator policy Creating an Application Configuring the BIG-IP LTM for Outlook Anywhere Importing keys and certificates Creating the HTTP health monitor Creating the pool Creating the irule Creating profiles Creating the virtual server Configuring the BIG-IP LTM for ActiveSync Importing keys and certificates Creating the HTTP health monitor Creating the pool Creating profiles Creating the virtual server Configuring the BIG-IP LTM to support Outlook Web Access, Outlook Anywhere, and Active Sync using a single virtual server Using one pool for all three services with no WebAccelerator Using different pools for each service and using the WebAccelerator Configuring the BIG-IP LTM for POP3 and IMAP Configuring the BIG-IP system for IMAP Creating the virtual server Configuring the BIG-IP system for POP Creating the virtual server Synchronizing the BIG-IP configuration if using a redundant system Configuring the FirePass controller for Exchange Server Prerequisites and configuration notes Configuration scenario Connecting to the FirePass controller Creating groups on the FirePass controller Configuring auto-logon Configuring Outlook Web Access through the FirePass device F5 Deployment Guide for Microsoft Exchange Server 2007 i

3 Table of Contents Configuring Mobile for HTML-based access to Configuring Network Access to the Exchange server Configuring Endpoint security Conclusion Appendix A: Backing up and restoring the BIG-IP LTM system configuration Saving and restoring the BIG-IP configuration Deploying F5 and Microsoft Exchange Server 2007 Edge Transport Servers Prerequisites and configuration notes Configuration example Configuring the BIG-IP LTM with Edge Transport Servers Connecting to the BIG-IP device Creating the health monitor Creating the pool Creating a tcp profile Creating the virtual server Synchronizing the BIG-IP configuration if using a redundant system Configuring the Message Security Module with Edge Transport Servers Prerequisites and configuration notes Accessing the Configuration utility Configuring MSM to manage traffic to your Edge Transport Servers Creating the pools Modifying the names of variables in the MSM_config data group Modifying the virtual server Configuring the BIG-IP GTM with Edge Transport Servers Configuring a self IP address on the BIG-IP LTM Creating a Listener on the GTM Creating data centers on the GTM system Creating the monitor Creating Servers for the data center Creating a GTM pool Creating a wide IP on the GTM Configuring the Wide IP as an MX record using ZoneRunner Appendix A: Backing up and restoring the BIG-IP LTM system configuration Saving and restoring the BIG-IP configuration Deploying F5 and Microsoft Exchange Server 2007 Mailbox Servers with CCR Prerequisites and configuration notes Configuring the WAN optimization module Creating the isession profile Creating the WAN Optimization policy Deploying F5 and Microsoft Exchange Server 2007 Hub Transport Servers Prerequisites and configuration notes Configuring the WAN optimization module with Hub Transport Servers Creating the isession profile Creating the WAN Optimization policy ii

4 1 Deploying F5 Devices with Microsoft Exchange Server 2007 Client Access Servers Configuring the BIG-IP LTM system for the Outlook Web Access component of Client Access Configuring the F5 WebAccelerator module with Exchange 2007 Outlook Web Access Configuring the BIG-IP LTM system for the Outlook Anywhere component of Client Access Configuring the BIG-IP LTM system for the ActiveSync component of Client Access Configuring the BIG-IP LTM to support Outlook Web Access, Outlook Anywhere, and Active Sync using a single virtual server Configuring the BIG-IP LTM system for the POP3 and IMAP4 components of Client Access Configuring the FirePass controller for Exchange Server 2007

5 Deploying F5 devices with Microsoft Exchange Server 2007 Client Access Servers Welcome to the F5 Deployment Guide for Microsoft Exchange Server This chapter covers the Exchange 2007 Client Access Server role, and gives you step-by-step procedures for configuring F5 products for deployment with the Client Access Server component of Microsoft Exchange Server 2007, including Microsoft Outlook Web Access. The Client Access server role supports the Microsoft Office Outlook Web Access and Microsoft Exchange ActiveSync client applications, the Post Office Protocol version 3 (POP3) and Internet Message Access Protocol version 4rev1 (IMAP4) protocols, and the new Outlook Anywhere feature. For more information on planning for the Client Access Server role, see 29.aspx. For more information on the F5 devices included in this guide, see You can also visit the Microsoft page of F5 s online developer community, DevCentral, for Microsoft forums, solutions, blogs and more: This chapter of the Exchange 2007 Deployment Guide contains procedures for configuring the BIG-IP LTM system, the WebAccelerator module, and the FirePass controller. While we recommend using all of these products together with Exchange Server 2007 Client Access Servers, it is not required. Simply use the sections for the products you have. This guide is broken up into the following sections: Configuring the BIG-IP LTM system for the Outlook Web Access component of Client Access, on page 4 Configuring the F5 WebAccelerator module with Exchange 2007 Outlook Web Access, on page 22 Configuring the BIG-IP LTM system for the Outlook Anywhere component of Client Access, on page 28 Configuring the BIG-IP LTM system for the ActiveSync component of Client Access, on page 36 Configuring the BIG-IP LTM to support Outlook Web Access, Outlook Anywhere, and Active Sync using a single virtual server, on page 1-42 Configuring the BIG-IP LTM system for the POP3 and IMAP4 components of Client Access, on page 49 Configuring the FirePass controller for Exchange Server 2007, on page

6 Deploying F5 Devices with Microsoft Exchange Server 2007 Client Access Servers Prerequisites and configuration notes The following are general prerequisites for this deployment; each section contains specific prerequisites: This guide is written for the Client Access Server component of Microsoft Exchange Server 2007, which includes Outlook Web Access. All of the configuration procedures in this document are performed on F5 devices. For information on how to deploy or configure Microsoft Exchange Server 2007, consult the appropriate Microsoft documentation. Note This document is written with the assumption that you are familiar with both the BIG-IP LTM system and Microsoft Exchange and Outlook Web Access. For more information on configuring these products, consult the appropriate documentation. Product versions and revision history Product and versions tested for this deployment guide: Product Tested BIG-IP LTM Version Tested v9.4, v10.0.1, v10.1 (applies to v9.4 and later) Microsoft Exchange Server 2007 Revision history: Document Version Description 1.0 New deployment guide 1.1 Added support for BIG-IP v10.1. Replaced previous guidance with BIG-IP WOM configuration for CCR and Hub Transport. 1.2 Added optional procedure for enabling X-Forwarded-For on the BIG-IP LTM, and the section Optional: Using X-Forwarded-For to log the client IP address in IIS 7.0 and 7.5, on page 1-20 for instructions on configuring IIS to log the client IP address. Configuration example In the following diagram, we show connectivity options for several types of clients to the same Exchange Server 2007 Client Access servers. Users may connect via a Firepass SSL VPN device to access to the internal networks, and from there to an F5 BIG-IP LTM system that load-balances the client access servers. Alternately, users who are not using the Firepass VPN may F5 Deployment Guide 1-2

7 connect directly to the LTM systems via secure connections (HTTPS, POP3S, or IMAPS, depending on choice of web browser or client). In all cases, the LTM offloads all SSL processing from the Exchange Client Access servers. Figure 1.1 BIG-IP Client Access Server configuration example The example in Figure 1.1 is a logical representation of this deployment. Your configuration may be dramatically different than the one shown. 1-3

8 Deploying F5 Devices with Microsoft Exchange Server 2007 Client Access Servers Configuring the BIG-IP LTM system for the Outlook Web Access component of Client Access First, we configure the BIG-IP LTM system for directing traffic to the Outlook Web Access component of the Client Access server. This includes using the BIG-IP LTM system to offload SSL traffic from the servers. Outlook Web Access allows authorized users to securely access their Exchange mailboxes through a web browser. By using BIG-IP LTM in front of an Outlook Web Access server, you gain the following benefits: Terminating HTTPS connections at the BIG-IP LTM reduces CPU and memory load on Outlook Web Access servers. Terminating HTTPS connections at the BIG-IP LTM simplifies TLS/SSL certificate management. The BIG-IP LTM can balance load and ensure high-availability across multiple Outlook Web Access servers using a variety of load-balancing methods and priority rules. The BIG-IP LTM's TCP Express feature set ensures optimal network performance for all clients and servers, regardless of operating system and version. The BIG-IP LTM provides content compression features which improve client performance. To configure the Outlook Web Access servers to support SSL offloading, you must first follow Microsoft's instructions at Once you have completed the steps outlined in that document on each Outlook Web Access, servers, you must complete the following procedures on the BIG-IP-LTM: Connecting to the BIG-IP device Importing keys and certificates Creating the HTTP health monitor Creating the pool Creating profiles Creating the irules Creating the virtual servers Synchronizing the BIG-IP configuration if using a redundant system Tip We recommend you save your existing BIG-IP LTM configuration before you begin. To save your BIG-IP configuration, see Appendix A: Backing up and restoring the BIG-IP LTM system configuration, on page 70. F5 Deployment Guide 1-4

9 Connecting to the BIG-IP device Use the following procedure to access the BIG-IP web-based Configuration utility using a web browser. To connect to the BIG-IP LTM system using the Configuration utility 1. In a browser, type the following URL: IP address of the BIG-IP device> A Security Alert dialog box appears, click Yes. 2. Type your user name and password, and click OK. The Welcome screen opens. Once you are logged onto the BIG-IP LTM system, the Welcome screen of the new Configuration utility opens. From the Configuration utility, you can configure and monitor the BIG-IP LTM system, as well as access online help, download SNMP MIBs and Plug-ins, and even search for specific objects. Importing keys and certificates Before you can enable the BIG-IP LTM system to offload SSL traffic from Outlook Web Access, you must install a SSL certificate and key on the BIG-IP LTM system. For this Deployment Guide, we assume that you already have obtained an SSL certificate, but it is not yet installed on the BIG-IP LTM system. For information on generating certificates, or using the BIG-IP LTM system to generate a request for a new certificate and key from a certificate authority, see the Managing SSL Traffic chapter in the Configuration Guide for Local Traffic Management. Once you have obtained a certificate, you can import this certificate into the BIG-IP LTM system using the Configuration utility. You can use the Import SSL Certificates and Keys screen only when the certificate you are importing is in Privacy Enhanced Mail (PEM) format. To import a key or certificate 1. On the Main tab, expand Local Traffic. 2. Click SSL Certificates. This displays the list of existing certificates. 3. In the upper right corner of the screen, click Import. 4. From the Import Type list, select the type of import (Certificate or Key). 5. In the Certificate (or Key) Name box, type a unique name for the certificate or key. 6. In the Certificate (or Key) Source box, choose to either upload the file or paste the text. 7. Click Import. 1-5

10 Deploying F5 Devices with Microsoft Exchange Server 2007 Client Access Servers If you imported the certificate, repeat this procedure for the key. Creating the HTTP health monitor The next task is to create a health monitor for the Microsoft Outlook Web Access devices. This procedure is optional, but very strongly recommended. For this configuration, we use an HTTP monitor, which checks nodes (IP address and port combinations), and can be configured to use send and recv statements in an attempt to retrieve explicit content from nodes, to not only verify that the server is up, but providing the proper content. To configure a health monitor 1. On the Main tab, expand Local Traffic, and then click Monitors. The Monitors screen opens. 2. Click the Create button. The New Monitor screen opens. 3. In the Name box, type a name for the Monitor. In our example, we type exch_owa_http. 4. From the Type list, select http The HTTP Monitor configuration options appear. 5. In the Configuration section, in the Interval and Timeout boxes, type an Interval and Timeout. We recommend at least a 1:3 +1 ratio between the interval and the timeout. In our example, we use a Interval of 30 and a Timeout of 91 (see Figure 1.2). 6. Optional: In the Send String and Receive Rule sections, you can add a Send String and Receive Rule specific to the device being checked. In our example, we are using the default IIS configuration, so we use a Send String of iisstart.htm, and expect the Under Construction page to be returned. If you have modified the IIS configuration on the OWA servers, type a Send String and Receive Rule appropriate for your configuration. If the page you are requesting in the Send String requires authentication, type a user name and password in the appropriate boxes. F5 Deployment Guide 1-6

11 7. Click the Finished button. The new monitor is added to the Monitor list. Figure 1.2 Creating the HTTP monitor Creating the pool The next step in this configuration is to create a pool on the BIG-IP LTM system for the Outlook Web Access service. A BIG-IP pool is a set of devices grouped together to receive traffic according to a load balancing method. To create the OWA pool 1. On the Main tab, expand Local Traffic, and then click Pools. 2. Click the Create button. The New Pool screen opens. Note: For more (optional) pool configuration settings, from the Configuration list, select Advanced. Configure these settings as applicable for your network. 3. In the Name box, enter a name for your pool. In our example, we use exch_owa_pool. 4. In the Health Monitors section, select the name of the monitor you created in the Creating the HTTP health monitor section, and click the Add (<<) button. In our example, we select exch_owa_http. 1-7

12 Deploying F5 Devices with Microsoft Exchange Server 2007 Client Access Servers 5. From the Load Balancing Method list, choose your preferred load balancing method (different load balancing methods may yield optimal results for a particular network). In our example, we select Least Connections (node). 6. For this pool, we leave the Priority Group Activation Disabled. 7. In the New Members section, make sure the New Address option button is selected. 8. In the Address box, add the first server to the pool. In our example, we type In the Service Port box, type the service number you want to use for this device, or specify a service by choosing a service name from the list. In our example, we type Click the Add button to add the member to the list. 11. Repeat steps 8-10 for each server you want to add to the pool. In our example, we repeat these steps once for the remaining server, Click the Finished button (see Figure 1.3). Figure 1.3 Creating the OWA pool F5 Deployment Guide 1-8

13 Creating profiles BIG-IP version 9.0 and later uses profiles. A profile is an object that contains user-configurable settings, with default values, for controlling the behavior of a particular type of network traffic, such as HTTP connections. Using profiles enhances your control over managing network traffic, and makes traffic-management tasks easier and more efficient. Although it is possible to use the default profiles, we strongly recommend you create new profiles based on the default parent profiles. Creating new profiles allows you to easily modify the profile settings specific to this deployment, and ensures you do not accidentally overwrite the default profile. For more information on creating or modifying profiles, or applying profiles in general, see the BIG-IP LTM system documentation. Creating a cookie persistence profile The first profile we create is a persistence profile. For this configuration, we create a new cookie persistence profile, based off of the default cookie persistence profile. We use cookie persistence because users must maintain a connection to the same Outlook Web Access device. To create a new cookie persistence profile 1. On the Main tab, expand Local Traffic, and then click Profiles. The HTTP Profiles screen opens. 2. On the Menu bar, click Persistence. 3. Click the Create button. 4. In the Name box, type a name for this profile. In our example, we type exch_owa_cookie. 5. From the Persistence Type list, select Cookie. The configuration options for Cookie persistence appear. 6. Modify any of the settings as applicable for your network. See the online help for more information on the configuration options. 7. Click the Finished button. 1-9

14 Deploying F5 Devices with Microsoft Exchange Server 2007 Client Access Servers Figure 1.4 Configuring Cookie persistence Creating an HTTP profile The next profile we create is an HTTP profile. In the following example, we base our HTTP profile off of a new profile included with BIG-IP LTM version 9.4, called http-wan-optimized-compression-caching, with a few additional modifications. This profile includes some default optimization settings that increase the performance of Outlook Web Access over the WAN. There are a couple of caveats for using this profile: You must have Compression and RAM Cache licensed on your BIG-IP LTM system. Contact your Sales Representative for more information. This profile is only available in BIG-IP LTM version 9.4 and later. If you plan on using the WebAccelerator module for Outlook Web Access (as shown later in this Deployment Guide) you should not use the http-wan-optimized-compression-caching HTTP profile, as the WebAccelerator module performs the compression and caching duties in addition to its other optimizations. If you are using the WebAccelerator module, we recommend you configure an HTTP profile based off of the default HTTP profile, and only change the Redirect Rewrite option to Match. Any other settings in this case are optional. To create a new HTTP profile 1. On the Main tab, expand Local Traffic. 2. Click Profiles. The HTTP Profiles screen opens. 3. Click the Create button. 4. In the Name box, type a name for this profile. In our example, we type exch_owa_http_opt. 5. From the Parent Profile list, select http-wan-optimized-compression-caching. F5 Deployment Guide 1-10

15 6. In the Settings section, check the Custom box for Redirect Rewrite, and from the Redirect Rewrite list, select Match (see Figure 1.5). Figure 1.5 The General settings section of the HTTP profile 7. Optional: If you want to enable the X-Forwarded-For header for accurate logging, check the Custom box for Insert X-Forwarded-For, and from the list, select Enabled. See Optional: Using X-Forwarded-For to log the client IP address in IIS 7.0 and 7.5, on page 1-11 for detailed information, including modifications to IIS to accurately log the client IP address. 8. In the Compression section, check the Custom box for Compression, and from the Compression list, select Enabled. 9. Check the Custom box for Content Compression, and leave Content List selected. 10. In the Content List section, add the following entries to the Content Type box one at a time, each followed by clicking the Include button: application/pdf application/vnd.ms-powerpoint application/vnd.ms-excel application/msword application/vnd.ms-publisher 1-11

16 Deploying F5 Devices with Microsoft Exchange Server 2007 Client Access Servers 11. Check the Custom box for Keep Accept Encoding, and check the box to enable Keep Accept Encoding (see Figure 1.6). Figure 1.6 Configuring the compression settings in the HTTP profile 12. Modify any of the other options as applicable for your configuration. See the online help for more information on the configuration options. F5 Deployment Guide 1-12

17 Creating the TCP profile 13. Click the Finished button. Note Some browsers and operating systems may have difficulty downloading or displaying certain compressed files. F5 suggests testing compression of each of these object types against the full range of web browsers and client operating systems in use at your organization to ensure full compatibility. Next, we create a TCP profile. In our example, we base the TCP profile off of the default TCP profile, and leave all the options at their default settings. You can configure these options as appropriate for your network. Tip If your configuration uses various WAN links and your userbase is widely distributed, you may want to experiment with using tcp-wan-optimized as the Parent Profile. This profile (available only in BIG-IP LTM version 9.4 and later) contains preconfigured WAN optimization settings. To create a new TCP profile 1. On the Main tab, expand Local Traffic. 2. Click Profiles. The HTTP Profiles screen opens. 3. On the Menu bar, from the Protocol menu, select TCP. 4. In the upper right portion of the screen, click the Create button. The New TCP Profile screen opens. 5. In the Name box, type a name for this profile. In our example, we type exch_owa_tcp. 6. Modify any of the settings as applicable for your network. See the online help for more information on the configuration options. In our example, we leave the settings at their default levels. 7. Click the Finished button. Creating a Client SSL profile The next step in this configuration is to create an SSL profile. This profile contains the SSL certificate and Key information for offloading the SSL traffic. To create a new Client SSL profile 1. On the Main tab, expand Local Traffic. 2. Click Profiles. The HTTP Profiles screen opens. 1-13

18 Deploying F5 Devices with Microsoft Exchange Server 2007 Client Access Servers 3. On the Menu bar, from the SSL menu, select Client. The Client SSL Profiles screen opens. 4. In the upper right portion of the screen, click the Create button. The New Client SSL Profile screen opens. 5. In the Name box, type a name for this profile. In our example, we type exch_owa_https. 6. In the Configuration section, click a check in the Certificate and Key Custom boxes. 7. From the Certificate list, select the name of the Certificate you imported in the Importing keys and certificates section. 8. From the Key list, select the key you imported in the Importing keys and certificates section. 9. Click the Finished button. Creating the irules In the following procedures, we create two irules on the BIG-IP LTM system. These irules are designed to transparently assist users in accessing Outlook Web Access if they do not properly type the correct URI. While these irules are optional, we recommend using them as they can greatly improve end user experience. Note Creating the Redirect irule The following irules may not be appropriate for all installations. Both irules assume that only Exchange Server 2007 (and not previous versions) is accessible through the configured virtual server. Exchange Server 2007 Client Access Role servers can provide front-end services to both Exchange 2007 Mailbox servers and existing Exchange Server 2003 or Exchange Server 2000 back-end servers. In that case, the URIs will differ; for instance, the URI will provide Exchange Server 2007 services, and might provide services for those users still on Exchange Server For this reason, F5 recommends using a unique virtual server for each Exchange Server version being supported, in order to be able to customize each to take into account differences in the product versions. Consult the Microsoft product documentation at for more information about configuring Outlook Web Access to accommodate multiple versions of Exchange Server. For more information on advanced irules, see The Redirect irule takes incoming HTTP requests (non-secure) and redirects them to the correct HTTPS (secure) virtual server, without user interaction. For example, this allows end users to simply type F5 Deployment Guide 1-14

19 webmail.domain.com or without having to remember that they are going to an HTTPS URI. The rule also appends the required /owa/ to the host portion of the URI. To create the Redirect irule 1. On the Main tab, expand Local Traffic, and then click irules. The irule screen opens. 2. In the upper right portion of the screen, click the Create button. The New irule screen opens. 3. In the Name box, enter a name for your irule. In our example, we use exch_owa_httptohttps. 4. In the Definition section, copy and paste the following irule: when HTTP_REQUEST { } 5. Click the Finished button. Figure 1.7 Creating the irule Creating the appending irule This irule, which will be applied to the HTTPS virtual server, is another precautionary measure to cover the case where a user types the URI for OWA (i.e. but forgets to add the required /owa/ at the end. If the user did not include /owa/, they would likely get an Under Construction page, or another page other than their mailbox login. This irule takes the original URI, checks to see if it has the /owa/ portion. If it does not, the irule adds /owa/ automatically, transparently sending users to the correct page. 1-15

20 Deploying F5 Devices with Microsoft Exchange Server 2007 Client Access Servers To create the appending irule 1. On the Main tab, expand Local Traffic, and then click irules. The irule screen opens. 2. In the upper right portion of the screen, click the Create button. The New irule screen opens. 3. In the Name box, enter a name for your irule. In our example, we use exch_owa_append. 4. In the Definition section, copy and paste the following irule: when HTTP_REQUEST { if { not ([ starts_with "/owa") } { /owa[ } } 5. Click the Finished button. Creating the virtual servers Next, we configure two virtual servers on the BIG-IP LTM system. The first virtual server is solely to intercept incoming HTTP traffic and redirect it to HTTPS using the irule you just created. The second virtual server terminates the SSL (HTTPS) connections and sends traffic via HTTP to the pool of OWA servers. To create the HTTP virtual server 1. On the Main tab, expand Local Traffic, and then click Virtual Servers. The Virtual Servers screen opens. 2. In the upper right portion of the screen, click the Create button. The New Virtual Server screen opens. 3. In the Name box, type a name for this virtual server. In our example, we type exch_owa_virtual_http. 4. In the Destination section, select the Host option button. 5. In the Address box, type the IP address of this virtual server. In our example, we use In the Service Port box, type 80, or select HTTP from the list. F5 Deployment Guide 1-16

21 Figure 1.8 Adding the Outlook Web Access virtual server 7. In the Configuration section, select Advanced from the list. The Advanced configuration options appear. 8. From the Protocol Profile (Client) list, select the name of the profile you created in the Creating the TCP profile section. In our example, we select exch_owa_tcp. 9. From the HTTP Profile list, select the name of the profile you created in the Creating an HTTP profile section. In our example, we select exch_owa_http_opt. 10. In the Resources section, from the irules Available list, select the irule you created for redirection in the Creating the irules section. In our example, we select exch_owa_httptohttps. 11. From the Default Persistence Profile list, select the persistence profile you created in the Creating a cookie persistence profile section. In our example, we select exch_owa_cookie. 12. Click the Finished button. 1-17

22 Deploying F5 Devices with Microsoft Exchange Server 2007 Client Access Servers Figure 1.9 Resources section of the Add Virtual Server page Now we create the virtual server for HTTPS. To create the HTTPS virtual server 1. On the Main tab, expand Local Traffic, and then click Virtual Servers. The Virtual Servers screen opens. 2. In the upper right portion of the screen, click the Create button. The New Virtual Server screen opens. 3. In the Name box, type a name for this virtual server. In our example, we type exch_owa_virtual_https. 4. In the Destination section, select the Host option button. 5. In the Address box, type the IP address of this virtual server. In our example, we use In the Service Port box, type 443, or select HTTPS from the list. 7. From the Configuration list, select Advanced. The Advanced configuration options appear. 8. In the Configuration section, from the HTTP Profile list, select the profile you created in the Creating an HTTP profile section. In our example, we select exch_owa_http_opt. F5 Deployment Guide 1-18

23 9. From the SSL Profile (Client) list, select the SSL profile you created in the Creating a Client SSL profile section. In our example, we select exch_owa_https. 10. In the Resources section, from the irules Available list, select the irule you created for appending /owa/ to the URI in the Creating the irules section. In our example, we select exch_owa_append. 11. From the Default Pool list, select the pool you created in the Creating the pool section. In our example, we select exch_owa_pool. 12. From the Default Persistence Profile list, select the persistence profile you created in the Creating a cookie persistence profile section. In our example, we select exch_owa_cookie. 13. Click the Finished button. 1-19

24 Deploying F5 Devices with Microsoft Exchange Server 2007 Client Access Servers Optional: Using X-Forwarded-For to log the client IP address in IIS 7.0 and 7.5 When you configure BIG-IP LTM to use SNAT, the BIG-IP system replaces the source IP address of an incoming connection with its local self IP address (in the case of SNAT Automap), or an address you have configured in a SNAT pool. As a result, Microsoft IIS logs each connection with its assigned SNAT address, rather than the address of the client. By configuring an HTTP profile on the BIG-IP to insert an X-Forwarded-For header, the original client IP address is sent as well; however, in default IIS configuration, this information is not logged. Beginning with IIS 7, Microsoft provides an optional Advanced Logging Feature for IIS that allows you to define custom log definitions that can capture additional information such as the client IP address included in the X-Forwarded-For header. You must first enable X-Forwarded-For in the BIG-IP HTTP profile (as described in the optional step in that procedure), and then add the log field to IIS. Adding the X-Forwarded-For log field to IIS Before beginning the following procedure, you must have installed IIS Advanced Logging. For installation instructions, see Note If you are using IIS version 6, F5 has a downloadable ISAPI filter that performs a similar function to the Advanced Logging Feature discussed here. For information on that solution, see the DevCentral post at _log_filter_for_windows_servers.aspx To add the X-Forwarded-For log field to IIS 1. From your Windows Server 2008 or Windows Server 2008 R2 device, open the Internet Information Services (IIS) Manager. 2. From the Connections navigation pane, click the appropriate server, web site, or directory on which you are configuring Advanced Logging. The Home page appears in the main panel. 3. From the Home page, under IIS, double-click Advanced Logging. 4. From the Actions pane on the right, click Edit Logging Fields. 5. From the Edit Logging Fields dialog box, click the Add Field button, and then complete the following: a) In the Field ID box, type X-Forwarded-For. b) From the Category list, select Default. F5 Deployment Guide 1-20

25 c) From the Source Type list, select Request Header. d) In the Source Name box, type X-Forwarded-For. e) Click the OK button. Figure 1.10 Adding the X-Forwarded-For logging field 6. On the Connections navigation pane, return to the Computer level. 7. From the Home page, under IIS, double-click Advanced Logging. 8. In the Actions panel, click Disable Advanced Logging. 9. Click Enable Advanced Logging. Now, when you look at the logs, the client IP address is included. 1-21

26 Deploying F5 Devices with Microsoft Exchange Server 2007 Client Access Servers Configuring the F5 WebAccelerator module with Exchange 2007 Outlook Web Access In this section, we configure the WebAccelerator module for Exchange 2007 Outlook Web Access to increase performance for end users. The F5 WebAccelerator is an advanced web application delivery solution that provides a series of intelligent technologies designed to overcome problems with browsers, web application platforms and WAN latency issues which impact user performance. For more information on the F5 WebAccelerator, see Important If you have not purchased the WebAccelerator module, you cannot complete this section of the Deployment Guide. Continue with Configuring the BIG-IP LTM system for the Outlook Anywhere component of Client Access, on page Contact your F5 Sales Representative for more information about purchasing this module. Prerequisites and configuration notes The following are prerequisites for this section: We assume that you have already configured the BIG-IP LTM system for directing traffic to the Outlook Web Access portion of Client Access, as described in this Deployment Guide. If you are using the WebAccelerator module, we recommend you do not configure the BIG-IP LTM system for compression or caching. You must have purchased and licensed the WebAccelerator module on the BIG-IP LTM system, version 9.4 or later. For BIG-IP version 9.4.0, you need to follow the simple procedure to download and import the policy for Outlook Web Access Later versions will include this policy. Configuring the WebAccelerator module for Outlook Web Access Configuring the WebAccelerator module requires creating an HTTP class profile, creating an Application, and modifying the virtual server you created for Outlook Web Access. The WebAccelerator device has a large number of other features and options for fine tuning performance gains, see the WebAccelerator Administrator Guide for more information. F5 Deployment Guide 1-22

27 Connecting to the BIG-IP device Use the following procedure to access the BIG-IP system s web-based Configuration utility using a web browser. To connect to the BIG-IP system using the Configuration utility 1. In a browser, type the following URL: IP address of the BIG-IP device> A Security Alert dialog box appears, click Yes. The authorization dialog box appears. 2. Type your user name and password, and click OK. The Welcome screen opens. Creating an HTTP Class profile The first procedure is to create an HTTP class profile. When incoming HTTP traffic matches the criteria you specify in the WebAccelerator class, the system diverts the traffic through this class. In the following example, we create a new HTTP class profile, based on the default profile. To create a new HTTP class profile 1. On the Main tab, expand WebAccelerator, and then click Classes. The HTTP Class Profiles screen opens. 2. In the upper right portion of the screen, click the Create button. The New HTTP Class Profile screen opens. 3. In the Name box, type a name for this Class. In our example, we type exch07_class. 4. From the Parent Profile list, make sure httpclass is selected. 5. In the Configuration section, from the WebAccelerator row, make sure Enabled is selected. 6. In the Hosts row, from the list select Match Only. The Host List options appear. a) In the Host box, type the host name that your end users use to access Outlook Web Access. In our example, we type owa.f5.com (see Figure 1.11). b) Leave the Entry Type at Pattern String. c) Click the Add button. d) Repeat these sub-steps for any other host names users might use to access Outlook Web Access. 7. The rest of the settings are optional, configure them as applicable for your deployment. 1-23

28 Deploying F5 Devices with Microsoft Exchange Server 2007 Client Access Servers 8. Click the Finished button. The new HTTP class is added to the list. Figure 1.11 Creating a new HTTP Class profile Modifying the Virtual Server to use the Class profile The next step is to modify the HTTPS virtual server you created in Creating the virtual servers, on page 16, to use the HTTP Class profile you just created. The HTTP profile associated with this virtual server should not have compression or RAM cache enabled, as the WebAccelerator module performs these tasks in addition to its other optimizations. To modify the Virtual Server to use the Class profile 1. On the Main tab, expand Local Traffic, and then click Virtual Servers. The Virtual Servers screen opens. 2. From the Virtual Server list, click the name of the virtual server you created for your Outlook Web Access devices. In our example, we click exch_owa_virtual_https. The General Properties screen for the Virtual Server opens. F5 Deployment Guide 1-24

29 3. On the Menu bar, click Resources. The Resources screen for the Virtual Server opens. 4. In the HTTP Class Profiles section, click the Manage button. 5. From the Available list, select the name of the HTTP Class Profile you created in the preceding procedure, and click the Add (<<) button to move it to the Enabled box. In our example, we select exch_class (see Figure 1.12) 6. Click the Finished button. The HTTP Class Profile is now associated with the Virtual Server. Figure 1.12 Adding the HTTP Class Profile to the Virtual Server Downloading and importing the WebAccelerator policy For the WebAccelerator module version 9.4.0, you need to download and import the custom policy for Exchange 2007 Outlook Web Access. Later versions of the module will include this policy by default. Downloading and importing the policy is a simple two-part procedure. Note You must be a member of DevCentral (requires a free registration) in order to download the policy. To download and import the WebAccelerator policy 1. Open a web browser, and copy and paste the following URL: 2. Save the Exchange.xml file in a place that is accessible from the WebAccelerator. 3. Return to the BIG-IP LTM system (see Connecting to the BIG-IP device, on page 23 for instructions). On the Main tab, expand WebAccelerator, and then click Policies. The Policy list opens. 4. At the bottom of the page, click Import Policies. 1-25

30 Deploying F5 Devices with Microsoft Exchange Server 2007 Client Access Servers 5. Click the Browse button, and navigate to the location where you saved the Exchange.xml file. 6. Click the Import button. The Policy is added to the list. You choose the new policy in the next procedure. Creating an Application The next procedure is to create a WebAccelerator Application. The Application provides key information to the WebAccelerator so that it can handle requests to your application appropriately. To create a new Application 1. On the Main tab, expand WebAccelerator, and then click Applications. The Application screen of the WebAccelerator UI opens in a new window. 2. Click the New Application button. 3. In the Application Name box, type a name for your application. In our example, we type OWA In the Description box, you can optionally type a description. 5. From the Local Policies list, select Microsoft Outlook Web Access (OWA) This is a pre-defined policy created specifically for Outlook Web Access In the Requested Host box, type the host name that your end users use to access Outlook Web Access. This should be the same host name you used in Step 6a in the preceding procedure. In our example, we type owa.f5.com If you have additional host names, click the Add Host button and enter the host name(s). 7. Click the Save button (see Figure 1.13). F5 Deployment Guide 1-26

31 Figure 1.13 Configuring an Application on the WebAccelerator The rest of the configuration options on the WebAccelerator are optional, configure these as applicable for your network. With this base configuration, your end users will notice an marked improvement in performance after their first visit. 1-27

32 Deploying F5 Devices with Microsoft Exchange Server 2007 Client Access Servers Configuring the BIG-IP LTM system for the Outlook Anywhere component of Client Access Outlook Anywhere for Exchange 2007 allows you to use Outlook 2007 and Outlook 2003 clients to connect to your Exchange server over the Internet, using HTTPS to encapsulate RPC traffic. By using BIG-IP LTM in front of an Outlook Anywhere-enabled Client Access Server, you can offload TLS/SSL processing from the servers to reduce their CPU and memory load and simplify certificate management. You can also select from a number of intelligent load balancing methods to distribute traffic to the servers. In Exchange 2007, simply use the Outlook Anywhere setup wizard on an Exchange 2007 computer with the Client Access server role installed. All users with mailboxes on Exchange 2007 are automatically enabled for Outlook Anywhere access. For more information on Outlook Anywhere, see the Microsoft documentation at To configure the BIG-IP LTM system for Outlook Anywhere, you need to complete the following tasks: Importing keys and certificates Creating the HTTP health monitor Creating the pool Creating the irule Creating profiles Creating the virtual server Importing keys and certificates The first step is to import a certificate and key for Outlook Anywhere. To import the certificate and key, follow the procedure Importing keys and certificates, on page 5, using the certificate and key for Outlook Anywhere. Important Note about Certificates for Outlook Anywhere: To enable and require SSL for all communications between the Client Access server and the Outlook clients, you must obtain and publish a certificate at the default Web site level. We recommend that you purchase your certificate from a third-party certification authority whose certificates are trusted by a wide variety of Web browsers. By default, applications and Web browsers do not trust your root certification authority when you install your own certification authority, such as a BIG-IP self-signed certificate. When a user tries to connect in Microsoft Office Outlook 2007 or Outlook 2003 by using Outlook Anywhere, that user loses the connection to Microsoft Exchange without any notification. For more information on this topic, see the following Microsoft TechNet article: F5 Deployment Guide 1-28

33 Creating the HTTP health monitor The next task is to create a health monitor for the devices running Outlook Anywhere. To configure a health monitor 1. On the Main tab, expand Local Traffic, and then click Monitors. The Monitors screen opens. 2. Click the Create button. The New Monitor screen opens. 3. In the Name box, type a name for the Monitor. In our example, we type exch_oa_http. 4. From the Type list, select http The HTTP Monitor configuration options appear. 5. In the Configuration section, in the Interval and Timeout boxes, type an Interval and Timeout. We recommend at least a 1:3 +1 ratio between the interval and the timeout. In our example, we use a Interval of 30 and a Timeout of 91. The rest of the configuration settings are optional. 6. Click the Finished button. The new monitor is added to the Monitor list. Creating the pool The next step in this configuration is to create a pool on the BIG-IP LTM system for the devices running Outlook Anywhere. To create the Outlook Anywhere pool 1. On the Main tab, expand Local Traffic, and then click Pools. The Pool screen opens. 2. In the upper right portion of the screen, click the Create button. The New Pool screen opens. 3. In the Name box, enter a name for your pool. In our example, we use exch_oa_pool. 4. In the Health Monitors section, select the name of the monitor you created in the Creating the HTTP health monitor section, and click the Add (<<) button. In our example, we select exch_oa_http. 5. From the Load Balancing Method list, choose your preferred load balancing method (different load balancing methods may yield optimal results for a particular network). In our example, we select Least Connections (node). 6. In the New Members section, make sure the New Address option button is selected. 1-29

34 Deploying F5 Devices with Microsoft Exchange Server 2007 Client Access Servers 7. In the Address box, add the first server to the pool. In our example, we type In the Service Port box, type the service number you want to use for this device, or specify a service by choosing a service name from the list. In our example, we type Click the Add button to add the member to the list. 10. Repeat steps 8-10 for each server you want to add to the pool. In our example, we repeat these steps twice for the remaining servers, and Click the Finished button. Creating the irule The next object we configure is an irule that is used for persistence. This irule is necessary because the Microsoft Outlook client does not support HTTP cookies, so the BIG-IP LTM persists based on this rule. In some cases you may be able to use other persistence methods such as Source Address Affinity, which bases persistence on the IP address of the client. However, because proxy servers or NAT (network address translation) devices may aggregate clients behind a single IP address, such methods are not always effective. To ensure reliable persistence, we recommend using the following irule and associated persistence profile. To create the irule 1. On the Main tab, expand Local Traffic, and then click irules. The Virtual Servers screen opens. 2. In the upper right portion of the screen, click the Create button. The New irule screen opens. 3. In the Name box, type a name for this irule. In our example, we type OutlookAnywherePersistRule. 4. In the Definition box, copy and paste the following irule: when HTTP_REQUEST { if { [ "User-Agent"] contains "MSRPC" } { persist uie [ "Authorization"] 3600 } } 5. Click the Finished button. F5 Deployment Guide 1-30

35 Creating profiles For Outlook Anywhere, we create five profiles: persistence, HTTP, TCP, SSL, and an optional OneConnect profile. As previously mentioned, you can use the default profiles if you are not changing any of the settings; however we strongly recommend creating new profiles. Outlook Anywhere uses Basic Authentication by default. If you use Basic Authentication, you are able to take advantage of the OneConnect profile which provides additional performance enhancements. Specifically, OneConnect dramatically reduces the overhead of maintaining TCP connections between the BIG-IP LTM and the Client Access servers. Although the BIG-IP LTM system can accommodate NTLM authentication, if you choose NTLM as the authentication type, the OneConnect profile can not be used. Creating the persistence profile The first profile we create is a persistence profile that uses the irule you created. To create a new cookie persistence profile 1. On the Main tab, expand Local Traffic, and then click Profiles. The HTTP Profiles screen opens. 2. On the Menu bar, click Persistence. The Persistence Profiles screen opens. 3. In the upper right portion of the screen, click the Create button. The New Persistence Profile screen opens. 4. In the Name box, type a name for this profile. In our example, we type exch_oa_persist. 5. From the Persistence Type list, select Universal. The configuration options for universal persistence appear. 6. Click the Custom boxes for irule and Timeout. 7. From the irule list, select the name of the irule you created in Creating the irule, on page In our example, we select OutlookAnywherePersistRule. 8. In the Timeout box, type 3600 seconds (one hour). 9. Click the Finished button (see Figure 1.14). 1-31