Bug ID 656784: Windows 10 Creators Update breaks RD Gateway functionality in BIG-IP APM

Last Modified: Jan 29, 2019

Bug Tracker

Affected Product:  See more info
BIG-IP APM(all modules)

Known Affected Versions:
11.6.0, 11.6.0 HF1, 11.6.0 HF2, 11.6.0 HF3, 11.6.0 HF4, 11.6.0 HF5, 11.6.0 HF6, 11.6.0 HF7, 11.6.0 HF8, 11.6.1, 11.6.1 HF1, 11.6.1 HF2, 11.6.2, 11.6.2 HF1, 11.6.3, 11.6.3.1, 11.6.3.2, 11.6.3.3, 11.6.3.4, 12.0.0, 12.0.0 HF1, 12.0.0 HF2, 12.0.0 HF3, 12.0.0 HF4, 12.1.0, 12.1.0 HF1, 12.1.0 HF2, 12.1.1, 12.1.1 HF1, 12.1.1 HF2, 12.1.2, 12.1.2 HF1, 12.1.2 HF2, 12.1.3, 12.1.3.1, 12.1.3.2, 12.1.3.3, 12.1.3.4, 12.1.3.5, 12.1.3.6, 12.1.3.7, 12.1.4, 13.0.0, 13.0.0 HF1, 13.0.0 HF2, 13.0.0 HF3, 13.0.1, 13.1.0, 13.1.0.1, 13.1.0.2, 13.1.0.3, 13.1.0.4, 13.1.0.5, 13.1.0.6, 13.1.0.7, 13.1.0.8, 13.1.1, 13.1.1.1, 13.1.1.2, 13.1.1.3, 13.1.1.4

Fixed In:
14.0.0

Opened: Apr 07, 2017
Severity: 3-Major
Related AskF5 Article:
K98510679

Symptoms

After upgrading to Windows 10 Creators Update (version 1703), when attempting to connect to a remote desktop through APM with the Remote Desktop Gateway (RDG) feature, the remote desktop client is not able to authenticate and connect. Windows 10 Version 1703 RDP client is using Negotiate HTTP authentication scheme, while APM requires NTLM scheme for RD Gateway.

Impact

Remote desktop client is not able to authenticate and connect to the desktop.

Conditions

- You are accessing Microsoft Remote Desktop through BIG-IP APM using Remote Desktop Gateway (RDG) feature. - You upgrade to Windows 10 Creators Update (version 1703).

Workaround

Use either of the following workarounds: -- Force the Windows RDP client to use NTLM authentication scheme (instead of Negotiate) by setting Group Policy 'User Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\RD Gateway\Set RD Gateway authentication method' to 'Ask for credentials, use NTLM protocol'. -- Use the following iRule to convert Negotiate to NTLM: when HTTP_REQUEST { set is_rdg_request [expr { [HTTP::method] starts_with "RDG_" }] if {!$is_rdg_request} { return; } set auth [HTTP::header Authorization] set is_nego_auth [expr { $auth contains "Negotiate" }] if { $is_nego_auth } { set auth [string map {"Negotiate" "NTLM"} $auth] HTTP::header replace Authorization $auth } } when HTTP_RESPONSE_RELEASE { if {!$is_rdg_request || !$is_nego_auth} { return; } catch { set auth [HTTP::header WWW-Authenticate] if { $auth contains "NTLM" } { set auth [string map {"NTLM" "Negotiate"} $auth] HTTP::header replace WWW-Authenticate $auth } } }

Fix Information

After upgrading to Windows 10 Creators Update (version 1703), the RDP client can still authenticate and connect via APM used as RD Gateway.

Behavior Change