Last Modified: Sep 13, 2023
Affected Product(s):
BIG-IP APM
Known Affected Versions:
11.6.1, 11.6.2, 11.6.3, 11.6.3.1, 11.6.3.2, 11.6.3.3, 11.6.3.4, 11.6.4, 11.6.5, 11.6.5.1, 11.6.5.2, 11.6.5.3, 12.0.0, 12.0.0 HF1, 12.1.0 HF1, 12.0.0 HF2, 12.1.0 HF2, 12.0.0 HF3, 12.0.0 HF4, 12.1.1 HF1, 12.1.1 HF2, 12.1.2 HF1, 12.1.2 HF2, 12.1.0, 12.1.1, 12.1.2, 12.1.3, 12.1.3.1, 12.1.3.2, 12.1.3.3, 12.1.3.4, 12.1.3.5, 12.1.3.6, 12.1.3.7, 12.1.4, 13.0.0, 13.0.0 HF1, 13.0.0 HF2, 13.0.0 HF3, 13.0.1, 13.1.0, 13.1.0.1, 13.1.0.2, 13.1.0.3, 13.1.0.4, 13.1.0.5, 13.1.0.6, 13.1.0.7, 13.1.0.8, 13.1.1, 13.1.1.2, 13.1.1.3, 13.1.1.4
Fixed In:
14.0.0, 13.1.1.5, 12.1.4.1
Opened: Apr 07, 2017 Severity: 3-Major Related Article:
K98510679
After upgrading to Windows 10 Creators Update (version 1703), when attempting to connect to a remote desktop through APM with the Remote Desktop Gateway (RDG) feature, the remote desktop client is not able to authenticate and connect. Windows 10 Version 1703 RDP client is using Negotiate HTTP authentication scheme, while APM requires NTLM scheme for RD Gateway.
Remote desktop client is not able to authenticate and connect to the desktop.
- You are accessing Microsoft Remote Desktop through BIG-IP APM using Remote Desktop Gateway (RDG) feature. - You upgrade to Windows 10 Creators Update (version 1703).
Use either of the following workarounds: -- Force the Windows RDP client to use NTLM authentication scheme (instead of Negotiate) by setting Group Policy 'User Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\RD Gateway\Set RD Gateway authentication method' to 'Ask for credentials, use NTLM protocol'. -- Use the following iRule to convert Negotiate to NTLM: when HTTP_REQUEST { set is_rdg_request [expr { [HTTP::method] starts_with "RDG_" }] if {!$is_rdg_request} { return; } set auth [HTTP::header Authorization] set is_nego_auth [expr { $auth contains "Negotiate" }] if { $is_nego_auth } { set auth [string map {"Negotiate" "NTLM"} $auth] HTTP::header replace Authorization $auth } } when HTTP_RESPONSE_RELEASE { if {!$is_rdg_request || !$is_nego_auth} { return; } catch { set auth [HTTP::header WWW-Authenticate] if { $auth contains "NTLM" } { set auth [string map {"NTLM" "Negotiate"} $auth] HTTP::header replace WWW-Authenticate $auth } } }
After upgrading to Windows 10 Creators Update (version 1703), the RDP client can still authenticate and connect via APM used as RD Gateway.