Deploying F5 with Microsoft Exchange 2016 Mailbox Servers

Welcome to the F5 and Microsoft

Exchange

2016 deployment guide. Use this document for guidance on conﬁguring the BIG-IP

system version 11 and later to provide additional security, performance and availability for Exchange Server 2016 Mailbox servers.

When conﬁgured according to the instructions in this guide, whether using an iApp template or manually, the BIG-IP system performs

as a reverse proxy for Exchange Mailbox servers, and also performs functions such as load balancing, compression, encryption,

caching, and pre-authentication.

Why F5?

F5 offers a complete suite of application delivery technologies designed to provide a highly scalable, secure, and responsive Exchange

deployment.

• The BIG-IP LTM can balance load and ensure high-availability across multiple Mailbox servers using a variety of load

balancing methods and priority rules.

• Terminating HTTPS connections at the BIG-IP LTM reduces CPU and memory load on Mailbox Servers, and simpliﬁes TLS/

SSL certiﬁcate management for Exchange 2016.

• The BIG-IP Access Policy Manager (APM), F5's high-performance access and security solution, can provide pre-

authentication, single sign-on, and secure remote access to Exchange HTTP-based client access services.

• The BIG-IP Advanced Firewall Manager (AFM), F5's high-performance, stateful, full-proxy network ﬁrewall designed to guard

data centers against incoming threats that enter the network can help secure and protect your Exchange deployment.

• The BIG-IP LTM TCP Express feature set ensures optimal network performance for all clients and servers, regardless of

operating system and version.

• The LTM provides content compression features which improve client performance.

Products and versions

Product Version

Microsoft Exchange Server

2016 (for previous versions of Exchange, see https://f5.com/solutions/deployment-guides)

BIG-IP system

Manual conﬁguration: 11.0 - 13.1

iApp template: 11.4.1 - 13.1

BIG-IP iApp template f5.microsoft_exchange_2016.v1.0.2 and v1.0.3rc6

Deployment Guide version

Last updated

3.9 See Document Revision History on page 128 for revision details

10-24-2019

Important:

Make sure you are using the most recent version of this deployment guide, available at

http://f5.com/pdf/deployment-guides/microsoft-exchange-2016-dg.pdf

For previous versions of this and other guides, see the Deployment guide Archive tab on f5.com:

https://f5.com/solutions/deployment-guides/archive-608

IMPORTANT: This guide has been archived. While the content in this guide is still valid for the

products and version listed in the document, it is no longer being updated and may

refer to F5 or 3rd party products or versions that have reached end-of-life or

end-of-support. See https://support.f5.com/csp/article/K11163 for more information.

Archived

F5 Deployment Guide

Microsoft Exchange Server 2016

Contents

Introduction 3

What is F5 iApp? 3

Prerequisites and conﬁguration notes 4

Conguring the iApp for Exchange Hybrid deployments 7

iApp Deployment Scenarios 8

Local BIG-IP system load balances and optimizes trafc 8

Local LTM receives HTTP-based trafc forwarded by a remote APM 9

Local APM secures and forwards trafc to a remote LTM 10

Preparation worksheets 11

Conﬁguring the BIG-IP system for Microsoft Exchange using the iApp template 13

Downloading and importing the new iApp 13

Upgrading an Application Service from previous version of the iApp template 13

Getting started with the Exchange iApp template 13

Conguring the local LTM to receive HTTP-based trafc forwarded by a remote APM 39

Conguring a local APM to secure and forward trafc to a remote LTM 55

Modifying the iApp conﬁguration 65

Next steps 66

Troubleshooting 68

Appendix A: Conﬁguring additional BIG-IP settings 78

Appendix B: Using X-Forwarded-For to log the client IP address 79

Appendix C: Manual conﬁguration tables 81

Conguration table if using a combined virtual server for Exchange HTTP-based services 81

Conguration table if using separate virtual servers for Exchange HTTP-based services 84

BIG-IP APM manual conguration 98

Optional: Securing Access to the Exchange Administration Center with BIG-IP APM 109

Optional: Conguring the APM for Outlook Anywhere with NTLM Authentication - BIG-IP v11.3 or later only 113

Manually conguring the BIG-IP Advanced Firewall Module to secure your Exchange deployment 118

Appendix D: Technical Notes 123

Appendix E: Active Directory and Exchange Server conﬁguration for NTLM 125

BIG-IP APM/LTM without DNS lookups 127

Document Revision History 128

Archived

F5 Deployment Guide

Microsoft Exchange Server 2016

Introduction

This document provides guidance for using the updated, downloadable BIG-IP iApp Template to conﬁgure the Mailbox server

role of Microsoft Exchange Server, as well as instructions on how to conﬁgure the BIG-IP system manually. This iApp template was

developed for use with Exchange Server 2016.

You can conﬁgure the BIG-IP system to support any combination of the following services supported by Mailbox servers: Outlook

Web App (which includes the HTTP resources for Exchange Control Panel), Exchange Web Services, Outlook Anywhere (RPC over

HTTP, including the Ofﬂine Address Book), ActiveSync, Autodiscover, POP3, IMAP4, and MAPI over HTTP.

For more information on the Exchange 2016 see: https://technet.microsoft.com/en-us/library/jj150491(v=exchg.160).aspx

For more information on the F5 devices in this guide, see http://f5.com/products/big-ip/.

You can also see the BIG-IP deployment guide for SMTP services at: http://f5.com/pdf/deployment-guides/f5-smtp-dg.pdf.

You can also visit the Microsoft page of F5’s online developer community, DevCentral, for Microsoft forums, solutions, blogs and more:

http://devcentral.f5.com/Microsoft/.

To provide feedback on this deployment guide or other F5 solution documents, contact us at [email protected].

What is F5 iApp?

F5 iApp is a powerful set of features in the BIG-IP system that provides a new way to architect application delivery in the data center.

iApp includes a holistic, application-centric view of how applications are managed and delivered inside, outside, and beyond the data

center. The iApp template for Microsoft Exchange Server acts as the single-point interface for building, managing, and monitoring the

Exchange 2016 client access role.

For more information on iApp, see the White Paper F5 iApp: Moving Application Delivery Beyond the Network:

http://f5.com/pdf/white-papers/f5-iapp-wp.pdf.

Skip ahead

Advanced

If you are already familiar with the Exchange iApp, you can skip directly to the relevant section after reading the prerequisites:

• Conﬁguring the BIG-IP system for Microsoft Exchange using the iApp template on page 13 if using the iApp template, or

• Appendix C: Manual conﬁguration tables on page 81 if conﬁguring the BIG-IP system manually.

Archived

F5 Deployment Guide

Microsoft Exchange Server 2016

Prerequisites and conﬁguration notes

Use this section for important items you need to know about and plan for before you begin this deployment. Not all items will apply in

all implementations, but we strongly recommend you read all of these items carefully.

General BIG-IP system prerequisites

h The conﬁguration described in this deployment guide is supported by F5 Networks. F5 Technical support can help validate

the conﬁguration described in this guide if necessary, but your environment may have other factors which may complicate the

conﬁguration.

If you need additional guidance or help with deployment scenarios or conﬁgurations that are not included in this guide, we

recommend you consult your F5 FSE, check DevCentral (https://devcentral.f5.com/) and AskF5 (https://support.f5.com/), or

contact F5 Professional Services (https://f5.com/support/professional-services) to discuss a consulting engagement. If you

believe you have found an error in this guide, contact us at [email protected].

h For this deployment guide, the BIG-IP system must be running version 11.4.1 or later. If you are using a previous version of

the BIG-IP system, see the Deployment Guide index on F5.com. This guide does not apply to previous versions.

h Most of the conﬁguration guidance in this document is performed on F5 devices. We provide a summary of Exchange

conﬁguration steps for reference only; for complete information on how to deploy or conﬁgure the components of Microsoft

Exchange Server, consult the appropriate Microsoft documentation. F5 cannot provide support for Microsoft products.

h If deploying BIG-IP APM features, you must fully license and provision APM before starting the iApp template.

h This document provides guidance on using the Exchange iApp template. Additionally, for users familiar with the BIG-IP

system, there are manual conﬁguration tables at the end of this guide. Because of the complexity of this conﬁguration, we

strongly recommend using the iApp to conﬁgure the BIG-IP system.

iApp template prerequisites and notes

h This document provides guidance on using the F5 supplied downloadable iApp template for Microsoft Exchange 2016

available via downloads.f5.com, with detailed information and download instructions on AskF5:

https://support.f5.com/kb/en-us/solutions/public/k/11/sol11100442.html.

You must use a downloadable iApp for BIG-IP versions 11.0 and later. For the iApp template, you must be

using version 11.4.1 or later as it contains a number of ﬁxes and enhancements not found in the default iApp, or other

downloadable versions.

Warning To run the Microsoft Exchange iApp template, you must be logged into the BIG-IP system as a user that

is assigned the admin role. For more information on roles on the BIG-IP system, see the BIG-IP User

Accounts chapter of the BIG-IP TMOS: Concepts guide.

h BIG-IP APM v12.0 and later now supports the MAPI over HTTP transport protocol (introduced in Exchange 2013 SP1 and

included in 2016 http://technet.microsoft.com/en-us/library/dn635177(v=exchg.150).aspx).

If you are using BIG-IP APM v11.x, the iApp template does not support this new protocol. See Manually conﬁguring MAPI

over HTTP in Exchange on page 92 for manual instructions on conﬁguring the BIG-IP system for MAPI over HTTP for

the 11.x versions.

h If you have existing, manually created Node objects on the BIG-IP system and given these nodes a name, you cannot use

the IP addresses for those nodes when conﬁguring the iApp. You must ﬁrst manually delete those nodes and re-add them

without a name, or delete the nodes and let the iApp automatically create them.

h For some conﬁguration objects, such as proﬁles, the iApp allows you to import custom objects you created outside the

template. This enables greater customization and ﬂexibility. If you have already started the iApp template conﬁguration and

then decide to you want to create a custom proﬁle, you can complete the rest of the template as appropriate and then re-

enter the template at a later time to select the custom object. Otherwise you can exit the iApp immediately, create the proﬁle,

and then restart the iApp template from the beginning.

h Be sure to see Troubleshooting on page 68 for troubleshooting tips and important conﬁguration changes for speciﬁc

situations.

SSL certiﬁcate and key prerequisites and notes

h If you are using the BIG-IP system to ofﬂoad SSL or for SSL Bridging, we assume you have already obtained an SSL

certiﬁcate and key, and it is installed on the BIG-IP LTM system. To conﬁgure your Mailbox servers to support SSL

ofﬂoading, you must ﬁrst follow the most recent Microsoft documentation.

Archived

F5 Deployment Guide

Microsoft Exchange Server 2016

h We generally recommend that you do not re-encrypt trafﬁc between your BIG-IP APM and BIG-IP LTM because both BIG-

IP systems must process the SSL transactions. However, if you choose to re-encrypt, we strongly recommend you use a

valid certiﬁcate (usually SAN-enabled) rather than the default, self-signed certiﬁcate for the Client SSL proﬁle on your BIG-IP

LTM system. If not re-encrypting trafﬁc, you do not need a certiﬁcate on your BIG-IP LTM.

h This template currently only supports the use of a single DNS name and corresponding certiﬁcate and key for all services,

or multiple DNS names using a SAN-enabled certiﬁcate and key.

h If using a single virtual server for all HTTP-based client access services as recommended, you must obtain the Subject

Alternative Name (SAN) certiﬁcate (or wildcard certiﬁcate, see the next paragraph) and key from a 3rd party certiﬁcate

authority that supports SAN certiﬁcates, and then import it onto the BIG-IP system.

While the BIG-IP system supports using a wildcard certiﬁcate to secure Exchange deployments using multiple FQDNs, for

increased security, F5 recommends using SAN certiﬁcate(s) where possible. Additionally, some older mobile devices are

incompatible with wildcard certiﬁcates. Consult your issuing Certiﬁcate Authority for compatibility information.



Note: For more information on SAN certiﬁcates, see Subject Alternative Name (SAN) SSL Certiﬁcates on page 123.

BIG-IP Access Policy Manager prerequisites and notes

New

For BIG-IP APM, the iApp template v1.0.2 and later supports Exchange hybrid deployments. See Conﬁguring the

iApp for Exchange Hybrid deployments on page 7.

If you are on a previous version of the iApp we recommend you upgrade to v1.0.2 or later. If you can't upgrade, see

Exchange Hybrid Autodiscover, free/busy lookups, and remote mailbox moves/migrations fail when APM is deployed

on page 71.

h If you want to display the computer type (public/shared vs private) and light version (Use the light version of Outlook

Web App) options for OWA on the APM logon page via the BIG-IP APM, you must run the following PowerShell

command on one of your Mailbox Servers (only one): Get-OwaVirtualDirectory | Set-OwaVirtualDirectory

-LogonPageLightSelectionEnabled $true -LogonPagePublicPrivateSelectionEnabled $true

h If you are deploying the iApp template for APM and smart card authentication for Outlook Web App, you must be using

Kerberos authentication. This only applies to Outlook Web App (OWA).

h If you are using BIG-IP APM, the following table shows the Exchange Server (Mailbox Server) settings:

Role Out-of-the-box setting Your Setting Notes

SSL Ofﬂoad for all HTTP services

Not enabled Enabled Optional but strongly recommended

OWA Authentication

Forms

Forms (default)

NTLM, or

Kerberos authentication

(smart card)

Required

Autodiscover Authentication

Negotiate Negotiate (default) Required

ActiveSync Authentication

Basic Basic (default) Required

Outlook Anywhere Authentication

1,3

Negotiate

Basic (default)

or NTLM

Required

MAPI-over-HTTP

Negotiate

Basic (default)

or NTLM

Required

Exchange Server 2010 and 2013 SP1 and later only. See the following link for more information on default authentication methods for Exchange Server 2010:

http://technet.microsoft.com/en-us/library/bb331973.aspx

You must change the default Forms logon format from Domain\username to just username. More information is available later in this guide.

Outlook Anywhere is disabled by default in Exchange 2010; you must enable it before you can use it. You can optionally conﬁgure BIG-IP APM v11.3 and

later for NTLM authentication for Outlook Anywhere. See page 50.

MAPI-over-HTTP requires BIG-IP v12.0 or later for APM

When deploying APM, server authentication settings for the OWA and Outlook protocols are determined by client-side

authentication selections made in the iApp. For example, selecting Basic client authentication for Outlook clients causes

NTLM SSO to be applied to server-side requests, while selecting NTLM client authentication results in Kerberos single

sign-on.

Archived

F5 Deployment Guide

Microsoft Exchange Server 2016

Important The values in the following table are only examples, use the values appropriate for your conﬁguration.

In our example, we use the following conventions.

Role FQDNs DNS Records

External URL/

Host name

Notes

Autodiscover

Combined virtual server

If the external DNS SRV

record listed is not used, and

you don’t want to use SCP

internally, you must also have

at least one of these, set to the

same IP as your OWA FQDN:

example.com

autodiscover.example.com

mail.example.com

A: mail.example.com

SRV: _autodiscover._tcp.example.com: port

443, Host ‘mail.example.com.’

https://mail.example.com/

autodiscover/autodiscover.xml

Separate virtual servers

autodiscover.example.com

A: autodiscover.example.com

SRV: _autodiscover._tcp.example.com: port

443, Host ‘autodiscover.example.com.’

https://autodiscover.example.com/

autodiscover/autodiscover.xml

Outlook Web App

Combined virtual server

mail.example.com A: mail.example.com https://mail.example.com/owa

Separate virtual servers

owa.example.com A: owa.example.com https://owa.example.com/owa

ActiveSync

Combined virtual server

mail.example.com A: mail.example.com

https://mail.example.com/

Microsoft-Server-ActiveSync

Separate virtual servers

mobile.example.com A: mobile.example.com

https://mobile.example.com/

Microsoft-Server-ActiveSync

Outlook Anywhere

(RPC over HTTP)

Combined virtual server

To prevent internal users from

receiving a password prompt,

your internal DNS must not

have an A record for the FQDN

for Outlook Anywhere. This

only applies if you are using

Exchange 2010, using RPC

MAPI internally and Outlook

Anywhere externally, and your

internal clients do not have a

route to the external Outlook

Anywhere/EWS virtual server(s).

mail.example.com A: mail.example.com mail.example.com

Separate virtual servers

oa.example.com A: oa.example.com oa.example.com

Outlook Anywhere

(MAPI over HTTP)

Combined virtual server

mail.example.com A: mail.example.com https://mail.example.com/mapi

Separate virtual servers

mapi.example.com A: mapi.example.com https://mapi.example.com/mapi

For more information, see:

• Summary of SRV records on Wikipedia: http://en.wikipedia.org/wiki/SRV_record

• Speciﬁcation for SRV records (RFC2782): http://tools.ietf.org/html/rfc2782

• Microsoft KB article on SRV records and the Autodiscover service: http://support.microsoft.com/kb/940881

• Understanding the Autodiscover Service (including SCP information): http://technet.microsoft.com/en-us/library/bb124251.aspx

Archived

F5 Deployment Guide

Microsoft Exchange Server 2016

Conﬁguring the iApp for Exchange Hybrid deployments

This solution supports using BIG-IP APM for secure access to hybrid deployment of Exchange 2016. A hybrid deployment means

an environment that has deployed Exchange on-premise and Ofﬁce 365, and those two components have been conﬁgured to

communicate with each other (as described in https://technet.microsoft.com/en-us/library/jj200581(v=exchg.150).aspx).

In a hybrid scenario, the BIG-IP is located between the Exchange Web Services and the Ofﬁce 365 infrastructure, and F5 provides

seamless access to the on-premise Exchange components in a secure fashion without causing failures for the hybrid-related trafﬁc.

The iApp template (v1.0.2 and later) now includes the question Would you like to bypass APM for hybrid services? on page 18.

Select Yes for hybrid deployments. This will prevent failures in federated requests for Autodiscover and free/busy information, as well

as remote moves and migrations between your Exchange organization and Exchange Online.

Archived

F5 Deployment Guide

Microsoft Exchange Server 2016

iApp Deployment Scenarios

The iApp greatly simpliﬁes conﬁguring the BIG-IP system for Microsoft Exchange 2016 client access roles. Before beginning the

Application template, you must make a decision about the scenario in which you are using BIG-IP system for this deployment. The

iApp presents the following three deployment options. You choose one of these options when you begin conﬁguring the iApp.

• Local BIG-IP system load balances and optimizes trafﬁc, on this page

• Local LTM receives HTTP-based trafﬁc forwarded by a remote APM on page 9

• Local APM secures and forwards trafﬁc to a remote LTM on page 10

Local BIG-IP system load balances and optimizes traﬃc

You can select this scenario to manage, secure, and optimize client-generated mailbox trafﬁc using the BIG-IP system. This is the

traditional role of the BIG-IP LTM and should be used in scenarios where you are not deploying BIG-IP Access Policy Manager (APM)

on a separate BIG-IP system. In this scenario, you can optionally the BIG-IP APM to secure HTTP-based virtual servers on this

system.

You would not select this option if you intend to deploy a separate APM that provides secure remote access to HTTP-based services.

Clients

BIG-IP Platform

AFMAPM

LTM

mail.example.com

autodiscover.example.com

OWA

ECP

EWS

EAS

OAB

RPC

MAPI

Autodiscover

Client Access Services

1 2

Figure 1: Logical conﬁguration example showing the BIG-IP system directing trafﬁc to client access Services

The trafﬁc ﬂow for this scenario is:

1. All Exchange Mailbox trafﬁc goes to the BIG-IP system.

2. You can use the following optional modules if they are licensed and provisioned on you BIG-IP system:

• BIG-IP Access Policy Manager (APM)

The BIG-IP APM module provides secure access and proxied authentication (pre-authentication) for HTTP-based Mailbox

services: Outlook Web App, Outlook Anywhere, ActiveSync, and Autodiscover). The BIG-IP APM presents a login page

to end users that takes the place of the forms-based login page normally presented by Outlook Web App. Users provide

credentials through the BIG-IP APM form; the BIG-IP APM then authenticates the user to Active Directory.

• BIG-IP Advanced Firewall Manager (AFM)

The BIG-IP Advanced Firewall Manager (AFM) is a high-performance, stateful, full-proxy network ﬁrewall designed to guard

data centers against incoming threats that enter the network on the most widely deployed protocols.

3. The BIG-IP LTM load balances and optimizes the Exchange client trafﬁc to the Mailbox servers, including the services which are

not HTTP-based: POP3, and IMAP4.

Archived

F5 Deployment Guide

Microsoft Exchange Server 2016

Local LTM receives HTTP-based traﬃc forwarded by a remote APM

You can select this scenario to conﬁgure BIG-IP LTM with a single virtual server that receives Exchange HTTP-based trafﬁc that has

been forwarded by a separate BIG-IP APM. The virtual server can also accommodate direct Exchange client trafﬁc, e.g. internal clients

that do not use the BIG-IP APM, and non-HTTP trafﬁc that is not handled by BIG-IP APM such as POP3 and IMAP4.

This scenario would be used together with the following scenario, in which you conﬁgure a separate BIG-IP APM to send trafﬁc to this

BIG-IP LTM device.

Clients

mail.example.com

autodiscover.example.com

OWA

ECP

EWS

EAS

OAB

RPC

MAPI

Autodiscover

Client Access Services

Internal

Clients

AFMLTM

AFMAPM

Figure 2: Logical conﬁguration example showing the BIG-IP system receiving trafﬁc from a BIG-IP APM

1. Trafﬁc comes in from the BIG-IP APM as described in the next scenario.

2. The BIG-IP LTM receives HTTP-based Exchange client trafﬁc from a separate BIG-IP APM, or directly received the non HTTP-

based trafﬁc.

3. If you have internal Exchange clients, all Mailbox trafﬁc from the internal clients goes directly to the BIG-IP LTM.

4. The BIG-IP LTM load balances and optimizes the trafﬁc to the Mailbox servers, including the services which are not

HTTP-based: POP3, and IMAP4.



Note: While this scenario can accommodate internal clients, we do not recommend using this virtual server in that way. We

strongly recommend creating a second instance of the iApp on this BIG-IP LTM for the direct trafﬁc/internal users.

You must use a unique virtual server IP address; all of the other settings can be identical. Once both iApps have been

created, you would conﬁgure Split DNS (use the same domain name, but different zones and IP addresses for internal

and external clients). For more information about Split DNS, refer to your DNS documentation.

Archived

F5 Deployment Guide

Microsoft Exchange Server 2016

Local APM secures and forwards traﬃc to a remote LTM

You can select this scenario to conﬁgure the BIG-IP system as a BIG-IP APM that will use a single virtual server to provide proxy

authentication (pre-authentication) and secure remote access to Exchange 2016 HTTP-based services without requiring the use of an

F5 Edge Client. When you select this deployment scenario, the BIG-IP APM presents a login page to end users that takes the place

of the forms-based login page normally presented by Outlook Web App. Users provide credentials through the BIG-IP APM form;

the BIG-IP APM then authenticates the user to Active Directory. The BIG-IP system will only forward connections after a user has

authenticated successfully. The trafﬁc is then sent to another BIG-IP running LTM which provides advanced load balancing, monitoring

and optimizations for HTTP-based client access services.

This scenario would be used together with the previous scenario, in which you conﬁgure a separate BIG-IP LTM to receive trafﬁc from

this BIG-IP APM device.

Clients

mail.example.com

autodiscover.example.com

OWA

ECP

EWS

EAS

OAB

RPC

MAPI

Autodiscover

Client Access Services

Internal

Clients

AFMLTM

AFMAPM

Figure 3: Logical conﬁguration example showing the BIG-IP APM providing proxy authentication and secure remote access

1. HTTP-based Mailbox trafﬁc goes to the BIG-IP APM, which provides proxy authentication and secure remote access.



Note: While this scenario can accommodate internal clients, we do not recommend using this virtual server in that

way. We strongly recommend creating a second instance of the iApp on this BIG-IP LTM for the direct trafﬁc/

internal users. You must use a unique virtual server IP address; all of the other settings can be identical. Once

both iApps have been created, you would conﬁgure Split DNS (use the same domain name, but different zones

and IP addresses for internal and external clients). For more information about Split DNS, refer to your DNS

documentation.

2. After authentication, the BIG-IP APM sends the trafﬁc to a separate BIG-IP LTM for intelligent trafﬁc management.

Guidance speciﬁc to each deployment scenario is contained later in this document.

Archived

F5 Deployment Guide

Microsoft Exchange Server 2016

Preparation worksheets

For each section of the iApp Template, you need to gather some information, such as Mailbox server IP addresses and domain

information. The worksheets do not contain every question in the template, but rather include the information that is helpful to have in

advance. Use the worksheet(s) applicable to your conﬁguration. More information on speciﬁc template questions can be found on the

individual pages. You might ﬁnd it useful to print these tables and then enter the information.

BIG-IP LTM Preparation worksheet

Traffic arriving to this BIG-IP

system is:

Encrypted Unencrypted

SSL Certiﬁcate:

Key:

If re-encrypting trafﬁc to the Mailbox servers and not using the

BIG-IP default certiﬁcate and key for the Server SSL proﬁle:

Certiﬁcate:

Key:

If encrypting trafﬁc to the Mailbox servers and not using the

BIG-IP default certiﬁcate and key:

Certiﬁcate:

Key:

BIG-IP virtual servers and

Mailbox Servers will be on:

Same Subnet Different Subnets

If the maximum number of expected concurrent users per

Mailbox server is more than 6,000, you need one SNAT IP

address for each 6,000 users or fraction thereof:

1: 4:

2: 5:

3: 6:

If the Mailbox servers are a different subnet from the BIG-IP

virtual servers, and do not use the BIG-IP as their default

gateway, and if the maximum number of expected concurrent

users per Mailbox server is more than 6,000, you need one

SNAT IP address for each 6,000 users or fraction thereof:

1: 4:

2: 5:

3: 6:

Single virtual IP address for all

Mailbox services or multiple

addresses

Single virtual IP address Different virtual IP addresses for different services

IP address for the BIG-IP virtual server:

You need a unique IP address for each of the Exchange

services you are deploying:

Outlook Web App:

Outlook Anywhere:

ActiveSync:

Autodiscover:

EWS:

POP3:

IMAP4:

Are all Mailbox services

handled by the same set of

servers, or different Servers

for different services?

Same set of Mailbox servers for all services Different Mailbox servers for different services

IP addresses of the Mailbox servers:

1: 6:

2: 7:

3: 8:

4: 9:

5: 10:

IP addresses for Mailbox servers for each service:

Outlook Web App:

Outlook Anywhere:

ActiveSync:

Autodiscover:

EWS:

POP3:

IMAP4:

Archived

F5 Deployment Guide

Microsoft Exchange Server 2016

BIG-IP LTM Preparation worksheet

External monitor configuration If you want the iApp to conﬁgure external health monitors, complete the SNMP community string information. If you want to

use external monitors for POP3/IMAP4 which perform logins, you need additional information:

SNMP community string for your Mailbox servers:

Mailbox account name in AD for the POP/IMAP monitors:

Associated password:

Domain name (can be FQDN or NETBIOS) of the user account

used for monitors:

Second mailbox for monitoring (recommended):

mailbox account name in AD for the POP/IMAP monitors:

Associated password for this account:

domain name (can be FQDN or NetBIOS) of the user

account used for monitors:

Outlook Web App

authentication method

If deploying Outlook Web App, which authentication method have you configured:

Forms-Based Authentication (default)

Basic or Windows Integrated authentication

Same FQDN for all HTTP-

based client access services

or different FQDNs

Same FQDN Different FQDNs

FQDN for all HTTP-based client access services:

You need a FQDN for each HTTP-based service you are

deploying:

Outlook Web App:

EWS:

Outlook Anywhere:

ActiveSync:

Autodiscover:

BIG-IP Access Policy Manager Preparation Worksheet

Outlook Web App FQDN

If you are deploying APM and OWA, you need the FQDN this is used to access OWA (such as owa.example.com):

Domain Controller FQDNs

and IP addresses that the

BIG-iP system can contact

What are the Domain Controller FQDNs and IP address this BIG-IP system can contact (use FQDN and not NETBIOS name)

1: 4:

2: 5:

3: 6:

Active Directory Domain

name for Exchange users

What is the Active Directory Domain name (must be in FQDN format):

Active Directory

Anonymous binding

If Anonymous Binding is not allowed in your Active Directory implementation, you need an Active Directory account with

administrative permissions:

User name:

Password:

If deploying the "Local APM secures and forwards traffic to a remote LTM" scenario

BIG-IP APM virtual server What is the IP address you want to use for your BIG-IP APM virtual server:

SSL Certificate and Key

SSL Certificate:

Key:

Re-encrypt the traffic to the

BIG-IP virtual server

You must know if the remote BIG-IP LTM that will receive traffic from this BIG-IP APM is using a self-signed/default certificate

and key or a certificate signed by a Certificate Authority.

Remote LTM virtual server

What is the virtual server address on the remote BIG-IP LTM to which this BIG-IP APM will forward traffic:

BIG-IP Advanced Firewall Manager Preparation Worksheet

Subnets/Networks

Which networks or subnets should be allowed to access the Exchange deployment:

Archived

F5 Deployment Guide

Microsoft Exchange Server 2016

Conﬁguring the BIG-IP system for Microsoft Exchange using the iApp template

Use this section for guidance on conﬁguring the BIG-IP system using the iApp template. If you plan to conﬁgure the system manually,

see Appendix C: Manual conﬁguration tables on page 81.

Downloading and importing the new iApp

The ﬁrst task is to download and import the new Exchange Server 2016 iApp template.

To download and import the iApp

1. Open a web browser and go to https://support.f5.com/kb/en-us/solutions/public/k/11/sol11100442.html.

2. Follow the instructions to download the Microsoft Exchange iApp to a location accessible from your BIG-IP system.

3. Extract (unzip) the f5.microsoft_exchange_2016<latest version>.tmpl ﬁle.

4. Log on to the BIG-IP system web-based Conﬁguration utility.

5. On the Main tab, expand iApp, and then click Templates.

6. Click the Import button on the right side of the screen.

7. Click a check in the Overwrite Existing Templates box.

8. Click the Browse button, and then browse to the location you saved the iApp ﬁle.

9. Click the Upload button. The iApp is now available for use.

Upgrading an Application Service from previous version of the iApp template

If you conﬁgured your BIG-IP using a previous version of the Microsoft Exchange 2016 iApp template, we strongly recommend you

upgrade the iApp template to the most recent version. Check https://support.f5.com/kb/en-us/solutions/public/k/11/sol11100442.html.

When you upgrade to the current template version, the iApp retains all of your settings for use in the new template. In some new

versions, you may notice additional questions, or existing questions asked in different ways, but your initial settings are always saved.

To upgrade an Application Service to the current version of the template

1. From the Main tab of the BIG-IP Conﬁguration utility, expand iApp and then click Application Services.

2. Click the name of your existing f5.microsoft_exchange_2016 application service from the list.

3. On the Menu bar, click Reconfigure.

4. At the top of the page, in the Template row, click the Change button to the right of the list.

5. From the Template list, select f5.microsoft_exchange_2016.<latest version>.

6. Review the questions in the new template, making any necessary modiﬁcations. Use the iApp walkthrough section of this guide

for information on speciﬁc questions.

7. Click Finished.

Geing started with the Exchange iApp template

To begin the Exchange iApp Template, use the following procedure.

To start the iApp template

1. Log on to the BIG-IP system.

2. On the Main tab, expand iApp, and then click Application Services.

3. Click Create. The Template Selection page opens.

4. In the Name box, type a name. In our example, we use Exchange-2016_.

5. From the Template list, select f5.microsoft_exchange_2016.<latest version>.

The new Microsoft Exchange template opens.

Archived

F5 Deployment Guide

Microsoft Exchange Server 2016

Advanced options

If you select Advanced from the Template Selection list at the very top of the template, you see Device and Trafﬁc Group options

for the application. This feature is a part of the Device Management conﬁguration. This functionality extends the existing High

Availability infrastructure and allows for clustering, granular control of conﬁguration synchronization and granular control of failover. To

use the Device and Trafﬁc Group features, you must have already conﬁgured Device and Trafﬁc Groups before running the iApp. For

more information on Device Management, see the product documentation.

1. Device Group

To select a Device Group, clear the Device Group check box and then select the appropriate Device Group from the list.

2. Trafﬁc Group

To select a Trafﬁc Group, clear the Traffic Group check box and then select the appropriate Trafﬁc Group from the list.

Inline help

At the bottom of the Welcome section, the iApp template asks about inline help text.

1. Do you want to see inline help?

Select whether you want to see informational and help messages inline throughout the template, or if you would rather hide this

inline help. If you are unsure, we recommend having the iApp display all inline help.

Important and critical notes are always shown, no matter which selection you make.

• Yes, show inline help text

Select this option to see all available inline help text.

• No, do not show inline help

If you are familiar with this template, or with the BIG-IP system in general, select this option to hide the inline help text.

Deployment Scenario

Choose the option that best describes how you plan to use the BIG-IP system you are currently conﬁguring. The scenario you select

determines the questions that appear in the iApp. The scenarios were described in iApp Deployment Scenarios on page 8.

1. Which scenario describes how you will use the BIG-IP system?

Choose the scenario that best describes the way you plan to use this BIG-IP system. Guidance for each scenario is contained in a

separate section of this document. Click the link to go to the relevant section of the guide for the scenario you plan to deploy.

• Local BIG-IP system load balances and optimizes trafﬁc

Select this scenario to manage, secure, and optimize client-generated Exchange Mailbox trafﬁc using the BIG-IP system. This

is the traditional role of the LTM and should be used when you are not deploying APM on a separate BIG-IP system. In this

scenario, if you have fully licensed and provisioned BIG-IP APM you have the option of using it to provide proxy authentication

for HTTP-based services on this system.

Do not select this option if you intend to deploy a separate BIG-IP APM that will provide secure remote access to Exchange

HTTP-based services.

For this role, go to Conﬁguring the BIG-IP LTM to load balance and optimize Mailbox trafﬁc on page 15.

• Local LTM receives HTTP-based trafﬁc forwarded by remote BIG-IP APM

Select this scenario to conﬁgure BIG-IP LTM with a single virtual server that receives Exchange HTTP-based trafﬁc that has

been forwarded by an BIG-IP APM. The virtual server can also accommodate direct trafﬁc, for example internal clients that do

not use the BIG-IP APM, and non-HTTP trafﬁc that is not handled by BIG-IP APM such as POP3 and IMAP4.

For this role, go to Conﬁguring the local LTM to receive HTTP-based trafﬁc forwarded by a remote APM on page 39.

• Local APM secures and forwards trafﬁc to a remote LTM

Select this role to conﬁgure the BIG-IP system as a BIG-IP APM that will use a single HTTPS (port 443) virtual server to provide

proxy authentication and secure remote access to Exchange HTTP-based services without requiring the use of an F5 Edge

Client. The trafﬁc will be forwarded to another BIG-IP running LTM which provides advanced load balancing, monitoring and

optimizations for those services.

For this role, go to Conﬁguring a local APM to secure and forward trafﬁc to a remote LTM on page 55.

Archived

F5 Deployment Guide

Microsoft Exchange Server 2016

Conﬁguring the BIG-IP LTM to load balance and optimize Mailbox traﬃc

If you chose the ﬁrst scenario, Local BIG-IP system load balances and optimizes trafﬁc, use this section for guidance on conﬁguring

the iApp. Again, do not chose this option if you will deploy a separate BIG-IP APM to provide secure remote access to HTTP-based

services.

Analytics

This section of the template asks questions about Analytics. The Application Visibility Reporting (AVR) module allows you to view

statistics speciﬁc to your Microsoft Exchange implementation. AVR is available on all BIG-IP systems v11 and later, however you must

have the AVR provisioned for this option to appear. Note that this is only for application visibility reporting, you can view object-level

statistics from the BIG-IP without provisioning AVR.

Important Enabling Analytics may adversely affect overall system performance. If you choose to enable Analytics, we

recommend gathering statistics for a set time period, such as one week, and then re-entering this template and

disabling Analytics while you process the data.

If you plan on using AVR for analytics, we recommend creating a custom Analytics proﬁle. To create a new proﬁle, from the Main

tab, select Profiles and then click Analytics. Click New and then conﬁgure the proﬁle as applicable for your conﬁguration. See the

online help or product documentation for speciﬁc instructions. To select the new proﬁle, you need to restart or reconﬁgure the iApp

template.

1. Do you want to enable Analytics for application statistics?

Select whether you want to enable AVR for Analytics for HTTP-based services. Note that Analytics does not always properly

report the HTTP methods of Outlook Anywhere.

• No, do not enable Analytics

Select this option if you do not want to use Analytics, and then continue with BIG-IP Access Policy Manager.

• Yes, enable Analytics using AVR

If you choose to enable Analytics, select Yes from the list, and then answer the following questions.

a. Use the default Analytics proﬁle or select a custom proﬁle?

If you decide to use AVR, you must decide whether to use the default Analytics proﬁle, or create a new one. As mentioned

previously, we recommend creating a new proﬁle to get the most ﬂexibility and functionality out of AVR. If you have already

started the iApp template conﬁguration and then decide to create a new Analytics proﬁle, you must exit the iApp, create the

proﬁle, and then restart the iApp template.

• Select a custom Analytics proﬁle

Select this option if you have already created a custom Analytics proﬁle for Exchange Server.

a. Which Analytics proﬁle do you want to use?

From the list, select the appropriate Analytics proﬁle.

• Use default proﬁle

Select this option if you have not yet created a custom Analytics proﬁle for Microsoft Exchange. We do not recommend

using the default proﬁle.

Archived

F5 Deployment Guide

Microsoft Exchange Server 2016

BIG-IP Access Policy Manager

This section in this scenario asks about BIG-IP APM. To use APM, it must be fully licensed and provisioned before starting the

template. If you are not deploying BIG-IP APM, continue with the next section. As mentioned in the prerequisites, if you are deploying

APM, you must have conﬁgured the BIG-IP system for DNS and NTP; see Conﬁguring DNS and NTP settings on page 78 for

instructions.

1. Provide secure authentication to HTTP-based client access services with BIG-IP APM?

Specify whether you want to deploy BIG-IP APM to provide proxy authentication and secure remote access for HTTP-based client

Access services.

• No, do not provide secure authentication using BIG-IP APM

Select this option if you do not want to use the BIG-IP APM at this time. You can always reconﬁgure the iApp template at a

later date should you decide to add BIG-IP APM functionality.

• Yes, provide secure authentication using BIG-IP APM

Select this option if you want to use the BIG-IP APM to provide proxy authentication and secure remote access for your

Exchange deployment.

a. Would you like to create a new Access Proﬁle, or use an existing Access Proﬁle?

Choose whether you want the system to create a new BIG-IP APM Access Proﬁle, or if you have already created a custom

Access Proﬁle outside the template. If you are unsure, select Create a new Access Profile.

• Select the Access proﬁle you created from the list

If you have previously created an Access proﬁle for your Exchange implementation, select the existing proﬁle you

created from the list. Continue with the next section.

• Create a new Access proﬁle

Select this option if you have not created a custom Access proﬁle, and want the system to create one.

a. Would you like to create a new AAA server, or use an existing AAA server?

Choose whether you want the system to create a new BIG-IP APM AAA Server object, or if you have already

created a custom AAA Server outside the template. The AAA server contains information about your Active

Directory implementation. If you are unsure, select Create a new AAA Server.

• Select the AAA Server you created from the list

If you have previously created an AAA Server for your Exchange implementation, select the existing object you

created from the list. Because additional information about the AAA Server is used elsewhere in this template,

only AAA Servers conﬁgured to use a pool of Domain Controllers appear in the list.

a. What is the FQDN of your Active Directory domain for your Exchange users?

Specify the FQDN of the Active Directory deployment for your Exchange users. This is the FQDN for your

entire domain, such as example.com, rather than the FQDN for any speciﬁc host. Continue with the What

text should appear in the user access logon prompt question on the following page.

• Create a new AAA Server

Select this option if you have not created a custom AAA Server, and want the system to create one.

a. What is the FQDN of your Active Directory domain for your Exchange users?

Specify the FQDN of the Active Directory deployment for your Exchange users. This is the FQDN for your

entire domain, such as example.com, rather than the FQDN for any speciﬁc host.

b. Which Active Directory servers in your domain can this BIG-IP system contact?

Specify both the FQDN and IP address of each Active Directory server you want the BIG-IP APM to use for

servicing authentication requests. Click Add to include additional servers.

c. Does your Active Directory domain allow anonymous binding?

Select whether anonymous binding is allowed in your Active Directory environment.

• Yes, anonymous binding is allowed

Select this option if anonymous binding is allowed. No further information is required. For details, on

allowing anonymous binding, see https://technet.microsoft.com/en-us/library/cc816788(v=ws.10).aspx.

Archived

F5 Deployment Guide

Microsoft Exchange Server 2016

• No, credentials are required for binding

If credentials are required for binding, you must specify an Active Directory user name and password for

use in the AAA Server.

a. Which Active Directory user with administrative permissions do you want to use?

Type a user name with administrative permissions.

b. What is the password associated with that account?

Type the associated password.

d. How do you want to handle health monitoring for this pool?

Specify whether you want the template to create a new LDAP monitor or a new ICMP monitor, or if you

select an existing monitor. For more accurate monitoring, we recommend using an LDAP monitor.

• Select an existing monitor for the Active Directory pool

Select this option if you have already created a health monitor (only monitors with a Type of LDAP or

External can be used) for the Active Directory pool that will be created by the template. If you want to

create a health monitor, but have not already done so, you must exit the template and create the object

before it becomes available from the list.

The iApp allows you to select monitors that are a part of another iApp Application Service. If you select

a monitor that is a part of another Application Service, be aware that any changes you make to the

monitor in the other Application Service will apply to this Application Service as well.

a. Which monitor do you want to use?

From the list, select the LDAP or External monitor you created to perform health checks for the

Active Directory pool created by the template. Only monitors that have a Type value of LDAP or

External appear in this list. Continue with the "What text should appear in the user access logon

prompt" question on this page.

• Use a simple ICMP monitor for the Active Directory pool

Select this option if you only want a simple ICMP monitor for the Active Directory pool. This monitor

sends a ping to the servers and marks the server UP if the ping is successful. Continue with the "What

text should appear in the user access logon prompt" question on this page.

• Create a new LDAP monitor for the Active Directory pool

Select this option if you want the template to create a new LDAP monitor for the Active Directory pool.

You must answer the following questions:

a. What is the Common Name of a user account that can search Active Directory?

Specify the Common Name of an Active Directory user name for the monitor to use when

attempting to log on as a part of the health check. This should be a user account created speciﬁcally

for this health monitor, and must be set to never expire. ADSI editor, an administration tool for Active

Directory LDAP administration, is useful for determining the correct Common Name (cn). You can

also use the Get-ADUser command in PowerShell to display the properties of the user account.

Do not include cn= in this ﬁeld.

b. What is the associated password?

Specify the password associated with the Active Directory user name.

c. What is the LDAP tree for this user account?

Specify the LDAP tree for the user account. As noted in the inline help, ADSI editor, an tool for

Active Directory LDAP administration, is useful for determining the correct LDAP tree value. For

example, if the user name is ‘user1’ which is in the organizational unit ‘Exchange Users’ and is in

the domain ‘exchange.example.com’, the LDAP tree would be: ou=Exchange Users, dc=Exchange,

dc=example, dc=com.

d. Does your Active Directory domain require a secure protocol for communication?

Specify whether your Active Directory implementation requires SSL or TLS for communication, or

does not require a secure protocol. This determines the port the health monitor uses.

• No, a secure protocol is not required

Select this option if your Active Directory domain does not require a secure protocol.

• Yes, SSL communication is required

Select this option if your Active Directory domain requires SSL communication. The health check

uses port 636 as the Alias Service Port.

Archived

F5 Deployment Guide

Microsoft Exchange Server 2016

• Yes, TLS communication is required

Select this option if your Active Directory domain requires TLS communication. The health check

uses port 389 as the Alias Service Port.

e. How many seconds between Active Directory health checks?

Specify how many seconds the system should use as the health check Interval for the Active

Directory servers. We recommend the default of 10 seconds.

b. What text should appear in the user access logon prompt?

Type the text you want users to see above the user name and password prompts when logging on to the

BIG-IP APM. By default, this includes the HTML <br> tag to insert a line break between 'Secure Logon' and 'for

F5 Networks'.

Warning If the text you want to appear includes the characters &, ", or ', you must use proper encoding:

& for &, &quote; for ", and ' for '.

c. Would you like to bypass APM for hybrid services?

Choose whether you want to bypass BIG-IP APM for hybrid services. Select Yes if your Exchange environment

is federated with Exchange Online, and you have deployed BIG-IP APM in front of your on-premise Exchange

servers. This will prevent failures in federated requests for Autodiscover and free/busy information, as well as

remote moves and migrations between your Exchange organization and Exchange Online.

• No, do not bypass APM for Hybrid services

Select this option if you do not need to bypass APM for hybrid services. Continue with the next question.

• Yes, bypass APM for Hybrid services

Select this option to bypass APM for hybrid services. This prevents federated requests for Autodiscover and

free/busy information, and remote moves and migrations between Exchange and Exchange online from failing.

d. Which APM logging proﬁle do you want to use?

This question only appears if you are using BIG-IP version 12.0 or later

BIG-IP version 12.0 allows you to attach a logging proﬁle to your BIG-IP APM conﬁguration. If you created an

APM logging proﬁle for this conﬁguration, you can select it from the list. The default proﬁle is named

default-log-setting. For more information on APM logging, see the APM documentation for v12.0 and later.

Continue with Application Firewall Manager (BIG-IP AFM) on page 19.

Archived

F5 Deployment Guide

Microsoft Exchange Server 2016

Application Firewall Manager (BIG-IP AFM)

This entire section only appears if you have licensed and provisioned BIG-IP AFM

This section gathers information about BIG-IP Advanced Firewall Manager, if you want to use it to protect the Exchange deployment.

For more information on BIG-IP AFM, see http://support.f5.com/kb/en-us/products/big-ip-afm.html, and then select your version.

1. Do you want to use AFM network ﬁrewall and IP Intelligence to protect your application?

Choose whether you want to use BIG-IP AFM, F5's network ﬁrewall with IP intelligence, to secure this Exchange deployment. If

you choose to use BIG-IP AFM, you can restrict access to the Exchange virtual server(s) to a speciﬁc network or IP address. See

the BIG-IP AFM documentation for speciﬁc details on conﬁguring AFM.

• No, do not use network ﬁrewall and IP Intelligence

Select this option if you do not want to enable BIG-IP AFM at this time. You can always re-enter the template at a later date to

enable BIG-IP AFM. Continue with the next section.

• Select an existing AFM policy from the list

If you already created a BIG-IP AFM policy for this implementation, select it from the list. Continue with c.

• Yes, use network ﬁrewall and IP Intelligence

Select this option if you want to enable BIG-IP AFM using F5's recommended conﬁguration.

a. Do you want to forbid access to your application from speciﬁc networks or IP addresses?

Choose whether you want to restrict access to the Exchange implementation via the BIG-IP virtual server.

• No, do not forbid client addresses (allow all)

By default, the iApp conﬁgures the AFM to accept trafﬁc destined for the Exchange virtual server(s) from all sources. If

you do not have a need to restrict access to the virtual server, leave this option selected and then continue with b.

• Yes, forbid speciﬁc client addresses

Select this option if you want to restrict access to the Exchange virtual server(s) by IP address or network address.

a. What IP or network addresses should be allowed to access your application?

Specify the IP address or network access that should be allowed access to the Exchange virtual server(s). You

can specify a single IP address, a list of IP addresses separated by spaces (not commas or other punctuation), a

range of IP addresses separated by a dash (for example 192.0.2.10-192.0.2.100), or a single network address,

such as 192.0.2.200/24.

b. How should the system control connections from networks suspected of malicious activity?

The BIG-IP AFM uses an IP intelligence database to categorize IP addresses coming into the system. Choose what you

want the system to do for sources that are attempting to access the Exchange virtual server(s) with a low reputation score.

For more information, see the BIG-IP AFM documentation.

Important:

You must have an active IP Intelligence license for this feature to function. See

https://f5.com/products/modules/ip-intelligence-services for information.

• Accept all connections and log nothing

Select this option to allow all sources, without taking into consideration the reputation score or logging anything.

• Reject connections from IP addresses with poor reputations

Select this option to reject access to the Exchange virtual server(s) from any source with a low reputation score.

• Accept all connections but log those from suspicious networks

Select this option to allow access to the Exchange virtual server(s) from sources with a low reputation score, but add an

entry for it in the logs. By default, IP Intelligence events are logged to Security > Event Logs >

Network > IP Intelligence. We recommend creating a remote logging proﬁle for IP Intelligence events.

c. Would you like to stage a policy for testing purposes?

Choose whether you want to stage a ﬁrewall policy for testing purposes. A staged policy allows you to evaluate the effect

a policy has on trafﬁc by analyzing the system logs, without actually modifying trafﬁc based on the ﬁrewall rules. You must

already have a policy on the system in order to select it.

Archived

F5 Deployment Guide

Microsoft Exchange Server 2016

• Do not apply a staging policy

Select this option if you do not want to apply a logging proﬁle at this time. You can always re-enter the template at a

later date to add a logging proﬁle. Continue with the next question.

• Select an existing policy from the list

If you have already created a ﬁrewall policy for this implementation, select it from the list. Only policies that already

exist on the system appear in the list. To create a new policy, on the Main tab, click Security > Network Firewall >

Policies. Speciﬁc instructions for creating a ﬁrewall policy is outside the scope of this iApp and deployment guide.

d. Which logging proﬁle would you like to use?

Choose whether you or not you want to use a logging proﬁle for this AFM implementation. You can conﬁgure the BIG-IP

system to log detailed information about BIG-IP system Network Firewall events and store those logs on the BIG-IP system

or a remote logging server (supports servers like syslog and Splunk). If you want to use a logging proﬁle, we recommend

creating one outside this template. The list only contains proﬁles with Network Firewall enabled.

• Do not use a logging proﬁle

Select this option if you do not want to use a logging proﬁle at this time. You can always re-enter the template at a later

date to add a logging proﬁle. Continue with the next question.

• Select an existing logging proﬁle from the list

If you have already created a logging proﬁle for this implementation, select it from the list. You must create a proﬁle

before it is available in the list. To create a logging proﬁle, on the Main tab, click Security > Event Logs > Logging

Profiles. Speciﬁc instructions for creating a logging proﬁle is outside the scope of this iApp and deployment guide. See

the online help or the About Local Logging with the Network Firewall chapter of the

BIG-IP Network Firewall: Policies and Implementations guide for more information.

Continue with Tell us about your deployment on page 21.

Archived

F5 Deployment Guide

Microsoft Exchange Server 2016

Tell us about your deployment

In this section, the iApp gathers general information about your Mailbox Server deployment. Remember, you must import an SSL

certiﬁcate and key that correspond to all fully-qualiﬁed DNS names that you are using for OWA, Outlook Anywhere, Autodiscover,

ActiveSync, POP3, or IMAP4 trafﬁc. Any certiﬁcate that you obtain with multiple names must be in SAN (Subject Alternative Name) or

wildcard format, not SNI (Server Name Indication) format.

1. Will incoming trafﬁc arrive at this BIG-IP system encrypted or unencrypted?

This question does not appear if you chose to deploy APM in the previous section.

If you selected to deploy APM, continue with the re-encrypt question (a) under Encrypted.

Select whether any of the HTTP-based, POP3 and IMAP4 trafﬁc will be encrypted or not when it arrives on this system. In nearly

all cases for this deployment scenario, it will be encrypted (it would not be encrypted, for example, if you selected one of the other

scenarios/roles for this iApp, and elected to ofﬂoad SSL/TLS trafﬁc at a separate BIG-IP APM).

Note that the BIG-IP system does not ofﬂoad the encryption used for RPC; the answer to this question should be based on the

other client access protocols you intend to deploy.

• Encrypted

If you chose Encrypted in the previous question, additional questions appear.

a. Do you want to re-encrypt this trafﬁc to your Mailbox Servers?

If want the BIG-IP system to ofﬂoad SSL processing from the Mailbox servers, select Do not re-encrypt (SSL Offload)

from the list. Ofﬂoading SSL on the BIG-IP system can extend Exchange Server server capacity.

• Do not re-encrypt (SSL Ofﬂoad)

Select this option if you want to ofﬂoad SSL processing onto the BIG-IP system. If you choose SSL Ofﬂoad, you must

have followed the instructions from Microsoft for conﬁguring the Mailbox servers for ofﬂoad.

a. Which Client SSL proﬁle do you want to use?

The iApp can create a new Client SSL proﬁle, or if you have created a Client SSL proﬁle which contains the

appropriate SSL certiﬁcate and key for your Exchange implementation, you can select it from the list.

• Select the Client SSL proﬁle you created from the list

If you manually created a Client SSL proﬁle, select it from the list, and then continue with #2.

• Create a new Client SSL proﬁle

Select this option if you want the iApp to create a new Client SSL proﬁle.

a. Which SSL certiﬁcate do you want to use?

Select the SSL certiﬁcate you imported onto the BIG-IP system for decrypting client connections.

If you have not yet imported a certiﬁcate, you can leave the default selections and reconﬁgure this iApp

after obtaining the certiﬁcates. The deployment will not function correctly until you have selected the

correct certiﬁcates here.



Note: Any certiﬁcate that you obtain with multiple names must be in SAN (Subject Alternative Name)

format, not SNI (Server Name Indication) format. For more information on SAN certiﬁcates,

see Subject Alternative Name (SAN) SSL Certiﬁcates on page 123.

b. Which SSL key do you want to use?

Select the associated key from the list.

• Re-encrypt (SSL Bridging)

Select this option if your implementation requires encrypted trafﬁc to the Mailbox servers. The BIG-IP system

unencrypts, then re-encrypts the trafﬁc headed for the Mailbox servers.

a. Which Client SSL proﬁle do you want to use?

The iApp can create a new Client SSL proﬁle, or if you have created a Client SSL proﬁle which contains the

appropriate SSL certiﬁcate and key for your Exchange implementation, you can select it from the list.

• Select the Client SSL proﬁle you created from the list

If you manually created a Client SSL proﬁle, select it from the list, and then continue with #2.

Archived

F5 Deployment Guide

Microsoft Exchange Server 2016

• Create a new Client SSL proﬁle

Select this option if you want the iApp to create a new Client SSL proﬁle.

a. Which SSL certiﬁcate do you want to use?

Select the SSL certiﬁcate you imported onto the BIG-IP system for decrypting client connections.

If you have not yet imported a certiﬁcate, you can leave the default selections and reconﬁgure this iApp

after obtaining the certiﬁcates. The deployment will not function correctly until you have selected the

correct certiﬁcates here.



Note: Any certiﬁcate that you obtain with multiple names must be in SAN (Subject Alternative Name)

format, not SNI (Server Name Indication) format. For more information on SAN certiﬁcates,

see Subject Alternative Name (SAN) SSL Certiﬁcates on page 123.

b. Which SSL key do you want to use?

Select the associated key from the list.

b. Which Server SSL proﬁle do you want to use?

Select whether you want the iApp to create an F5 recommended Server SSL proﬁle, or if you want to choose a

Server SSL proﬁle you already created.

Important If you are conﬁguring SSL Bridging and using BIG-IP version 11.4.x, you must see When

using SSL Bridging and BIG-IP version 11.4.x, pool members may be marked down or you may

experience connection resets and TLS errors logged to the Mailbox servers on page 73.

• Select the Server SSL proﬁle you created from the list

If you have previously created a Server SSL proﬁle for your Exchange implementation, from the list, select the

existing Server SSL proﬁle you created.

• Create a new Server SSL proﬁle

Select this option if you want the iApp to create a new Server SSL proﬁle. The F5 recommended Server SSL

proﬁle uses the serverssl parent proﬁle. For information about the ciphers used in the Server SSL proﬁle, see

http://support.f5.com/kb/en-us/solutions/public/8000/800/sol8802.html.

Continue with #2 on the next page.

• Unencrypted

Select this option if Mailbox trafﬁc is arriving at this BIG-IP system unencrypted (typically because you conﬁgured to ofﬂoad

SSL/TLS trafﬁc at the BIG-IP APM that is sending trafﬁc to this device).

a. Do you want to encrypt the trafﬁc to your Mailbox Servers?

If you want the BIG-IP system to ofﬂoad SSL processing from the Mailbox servers, select Do not encrypt (SSL Offload)

from the list. Ofﬂoading SSL on the BIG-IP system can extend Exchange Server server capacity.

• Do not encrypt (SSL Offload)

Select this option if you do not want the BIG-IP system to encrypt the trafﬁc destined for the Mailbox servers. The

BIG-IP system does not modify the trafﬁc, and you can continue with the next question.

• Encrypt (SSL Bridging)

Select this option if your implementation requires encrypted trafﬁc to the Mailbox servers. If you choose this option, the

BIG-IP system encrypts the trafﬁc headed for the Mailbox servers.

a. Which Server SSL proﬁle do you want to use?

Select whether you want the iApp to create an F5 recommended Server SSL proﬁle, or if you want to choose a

Server SSL proﬁle you already created.

Important If you are conﬁguring SSL Bridging and using BIG-IP version 11.4.x, you must see When

using SSL Bridging and BIG-IP version 11.4.x, pool members may be marked down or you may

experience connection resets and TLS errors logged to the Mailbox servers on page 73.

• Select the Server SSL proﬁle you created from the list

If you have previously created a Server SSL proﬁle for your Exchange implementation, select the existing

Server SSL proﬁle you created from the list.

• Create a new Server SSL proﬁle

Select this option if you want the iApp to create a new Server SSL proﬁle.

Archived

F5 Deployment Guide

Microsoft Exchange Server 2016

The default, F5 recommended Server SSL proﬁle uses the serverssl parent proﬁle. For information about the

ciphers used in the Server SSL proﬁle, see

http://support.f5.com/kb/en-us/solutions/public/8000/800/sol8802.html.

2. Which intermediate certiﬁcate do you want to use?

Choose whether or not you want to use an intermediate certiﬁcate (also called intermediate certiﬁcate chains or chain certiﬁcates)

in this deployment. These certiﬁcates are used to help systems which depend on SSL certiﬁcates for peer identiﬁcation. These

certiﬁcates are intended to create a chain of trust between the CA that signed the certiﬁcate and the CA that is already trusted by

the recipient of the certiﬁcate. This allows the recipient to verify the validity of the certiﬁcates presented, even when the signing CA

is unknown.

In order to use an intermediate certiﬁcate in this deployment, you must have manually imported it onto the BIG-IP system.

• Do not use an intermediate certiﬁcate

Select this option if you do not want to use an intermediate certiﬁcate in this deployment, or have not yet imported the

certiﬁcate onto the system but want to exit the template to import it and then restart the template.

• Select the intermediate certiﬁcate you imported from the list

If you imported an intermediate certiﬁcate for this Exchange implementation, select the certiﬁcate you imported from the list.

3. How should the system optimize client-side TCP connections to the BIG-IP LTM?

Select how the system should optimize client-side TCP connections. The iApp uses your selection to conﬁgure the proper TCP

optimization settings on the TCP proﬁle.

• Optimize TCP connections for WAN clients

Select this option if most Exchange server clients are coming into your Exchange environment over a Wide Area Network.

• Optimize TCP connections for LAN clients

Select this option if most Exchange server clients are coming into your Exchange environment over a Local Area Network.

4. Where will your BIG-IP virtual servers be in relation to your Mailbox Servers?

Select whether your BIG-IP virtual servers are on the same subnet as your Mailbox servers, or on different subnets. This setting is

used to determine the SNAT (secure NAT) and routing conﬁguration.

• Same subnet for BIG-IP virtual servers and Mailbox Servers

Select this option if the BIG-IP virtual servers and the Mailbox servers are on the same subnet. In this case SNAT is conﬁgured

on the BIG-IP virtual server and you must specify the number of concurrent connections.

a. What is the maximum number of concurrent users you expect per Mailbox Server?

Select whether you expect more or fewer than 6,000 concurrent users to each Mailbox server. This answer is used to

determine what type of SNAT (secure network address translation) that system uses. A SNAT is an object that maps the

source client IP address in a request to a translation address deﬁned on the BIG-IP device.



Note: For speciﬁc information on SNAT Pools, including why we chose 6,000 concurrent users per server, see

Maximum number of concurrent users: SNAT Pool guidance on page 123.

• Fewer than 6000

Select this option if you expect fewer than 6,000 concurrent users per Mailbox server. With this option, the system

applies SNAT Auto Map, which doesn’t require any additional IP addresses, as the system uses an existing self IP

address for translation.

• More than 6000

Select this option if you expect more than 6,000 users at one time to each server. With this option, the iApp creates a

SNAT Pool (or you can choose one you created), for which you need one IP address for each 6,000 users you expect.

a. Create a new SNAT pool or use an existing one?

Select whether you want the system to create a new SNAT Pool, or if you have already created a SNAT pool for

this implementation.

• Select the SNAT pool you created from the list

If you have previously created a SNAT Pool for your Exchange implementation, select it from the list.

Archived

F5 Deployment Guide

Microsoft Exchange Server 2016

• Create a new SNAT pool

If you have not created a custom SNAT pool, select this option for the iApp to create a new one.

a. Which IP addresses do you want to use for the SNAT pool?

Specify one otherwise unused IP address for every 6,000 concurrent connections, or fraction thereof. Click

Add for more rows.

Important If you choose more than 6,000 users, but do not specify enough SNAT pool addresses,

after the maximum connection limit of 6,000 concurrent users per server is reached, new

requests fail.

• Different subnet for BIG-IP virtual servers and Mailbox Servers

If the BIG-IP virtual servers and Web Interface servers are on different subnets, the following question appears asking how

routing is conﬁgured.

a. How have you conﬁgured routing on your Mailbox Servers?

Select whether the Mailbox servers use this BIG-IP system’s Self IP address as their default gateway.

• Mailbox Servers do NOT use BIG-IP as their default gateway

Select this option if the Mailbox servers do not use the BIG-IP system as their default gateway. If the servers do not use

the BIG-IP as their default gateway, SNAT is conﬁgured on the BIG-IP virtual server and you must select the expected

number of concurrent users in the next question.

a. What is the maximum number of concurrent users you expect per Mailbox server?

Select whether you expect more or fewer than 6,000 concurrent users to each server. This answer is used to

determine what type of SNAT that system uses. A SNAT is an object that maps the source client IP address in a

request to a translation address deﬁned on the BIG-IP device.



Note: For speciﬁc information on SNAT Pools, including why we chose 6,000 concurrent users per server,

see Maximum number of concurrent users: SNAT Pool guidance on page 123.

• Fewer than 6000

Select this option if you expect fewer than 6,000 concurrent users per Mailbox server. With this option, the

system applies SNAT Auto Map, which doesn’t require any additional IP addresses, as the system uses an

existing self IP address for translation.

• More than 6000

Select this option if you expect more than 6,000 users at one time to each server. With this option, the iApp

creates a SNAT Pool (or you can choose one you created), for which you need one IP address for each 6,000

users you expect.

a. Create a new SNAT pool or use an existing one?

Select whether you want the system to create a new SNAT Pool, or if you have already created a SNAT

pool for this implementation.

• Select the SNAT pool you created from the list

If you have previously created a SNAT Pool for your Exchange implementation, select it from the list.

• Create a new SNAT pool

If you have not created a custom SNAT pool, select this option for the iApp to create a new one.

a. Which IP addresses do you want to use for the SNAT pool?

Specify one otherwise unused IP address for every 6,000 concurrent connections, or fraction

thereof. Click Add for additional rows.

Important If you choose more than 6,000 users, but do not specify enough SNAT pool

addresses, after the maximum connection limit of 6,000 concurrent users per

server is reached, new requests fail.

• Mailbox Servers use the BIG-IP as their default gateway

Select this option if the Mailbox servers use the BIG-IP system as their default gateway. In this scenario, no additional

conﬁguration is necessary to ensure correct server response handling.

Archived

F5 Deployment Guide

Microsoft Exchange Server 2016

5. Do you want to use a single IP address for all Mailbox Server connections?

Select whether you want to use a single IP address for all Mailbox server connections, or separate IP addresses for the different

services. If you chose a single IP address, the iApp creates a single virtual server for all of the Mailbox services. If you choose

different addresses, the BIG-IP creates individual virtual servers for each service. There are advantages to each method:

• Single IP address

With a single IP address, you can combine multiple functions on the same virtual server; for instance, you may wish to have a

single fully-qualiﬁed domain name (FQDN) and associated SSL certiﬁcate for all HTTP-based Mailbox methods. You only need

to provision a single IP address for the virtual server. If you want the services to have unique DNS names despite sharing an IP

address, you need to obtain an SSL certiﬁcate that supports Subject Alternative Names or a wildcard certiﬁcate. For detailed

information on SAN certiﬁcates, see Subject Alternative Name (SAN) SSL Certiﬁcates on page 123.

• Different IP addresses for different services

By maintaining a separate virtual server for each component, you can manage each service independently from one another.

For instance, you may wish to have different pool membership, load balancing methods, or custom monitors for Outlook

Web App and Outlook Anywhere. If each of those services are associated with a different virtual server, granular management

becomes easier. You need to provision an available IP address for each virtual server, and obtain a valid SSL certiﬁcate with a

unique subject name for each service.

6. How are you distributing the client access service protocols between servers?

Select whether all your Mailbox services are handled by the same servers, or if each service is handled by a unique set of servers.

This iApp creates separate pools and monitors for each service regardless of this setting. However, if you use the same set of

servers for all services, you only have to specify the server IP addresses once.

• All services will be handled by the same set of Mailbox Servers

Choose this option if you are using the same servers for all of your Exchange client access services.

• Each service will be handled by a unique set of Mailbox Servers

Choose this option if you are using different sets of Mailbox servers for each client access service.

Continue with Tell us about which services you are deploying on page 26.

Archived

F5 Deployment Guide

Microsoft Exchange Server 2016

Tell us about which services you are deploying

In this section, the iApp gathers information about which client access services you are deploying. Some questions only appear

depending on your answers to previous questions. These contingencies are noted at the beginning of the question description.

1. Do you want to customize the server pool settings?

Select whether you want to customize the BIG-IP load balancing pools for Mailbox services, or use the F5 recommended settings.

• Use settings recommended by F5

If you don't have a speciﬁc reason to customize the pool settings, leave this question set to this setting and continue with #2.

• Customize pool settings

If you need to modify individual pool options, select Customize pool settings and answer the following options that appear:

a. Which load balancing method do you want to use?

Select the load balancing method you want to use. We recommend the default, Least Connections (member). See the

BIG-IP documentation for a description of each method. If you chose a node-based load balancing method, such as Ratio

(Node), and use a Ratio or Connection Limit (both optional), you must see Adding Ratio or Connection Limit information to

the nodes if using a node-based load balancing method on page 67 after completing the template.

b. Do you want to give priority to speciﬁc groups of servers?

Select whether you want to enable Priority Group Activation to send trafﬁc ﬁrst to groups of servers you specify. The BIG-IP

system load balances trafﬁc according to the priority number you assign to each server.

• Do not use Priority Group Activation

Select this option if you do not want to enable Priority Group Activation.

• Use Priority Group Activation

Select this option if you want to enable Priority Group Activation. You will need to add a priority number in the Priority

box to each server . A higher number indicates higher priority. Trafﬁc is only sent to the servers with the highest priority,

unless the number of available servers in that priority group falls below the value you specify as the minimum in the

following question. The BIG-IP system then sends trafﬁc to the group of servers with the next highest priority, and so on.

See the BIG-IP documentation for more details.

a. What is the minimum number of active members in a group?

Specify the minimum number of servers that must be active to continue sending trafﬁc to the priority group. If the

number of active servers falls below this minimum, trafﬁc will be sent to the group of servers with the next highest

priority group number.

c. Do you want the BIG-IP system to queue TCP requests?

Select whether you want the BIG-IP system to queue TCP requests. TCP request queuing provides the ability to

queue connection requests that exceed the capacity of connections for a pool, as determined by the connection limit.

Consequently, instead of dropping connection requests that exceed the capacity of a pool, TCP request queuing enables

those connection requests to reside within a queue according to deﬁned conditions until capacity becomes available. For

more information on TCP Request Queuing, see the Preventing TCP Connection Requests From Being Dropped chapter in

the BIG-IP Local Traffic Manager: Implementations guide, available on AskF5.

Important TCP Request Queuing is an advanced feature and should be used only if you understand how it will

affect your deployment, including application behavior and BIG-IP performance.

If you enable TCP Request Queuing, you must have a Connection Limit set on at least one of the

nodes when conﬁguring the Address/Port for the Mailbox Server nodes.

• Do not queue TCP requests

Select this option if you do not want the BIG-IP system to queue TCP requests.

• Queue TCP requests

Select this option if you want to enable TCP request queuing on the BIG-IP system.

a. What is the maximum number of TCP requests for the queue?

Type the maximum number of requests you want to queue. We do not recommend using 0, which means

unlimited and is only constrained by available memory.

Archived

F5 Deployment Guide

Microsoft Exchange Server 2016

b. How many milliseconds should requests remain in the queue?

Type a number of milliseconds for the TCP request timeout value.

2. What IP address do you want to use for your virtual servers?

This question appears only if you selected Single IP address for all connections in the previous section.

Specify a valid IP address to use for the BIG-IP virtual server. This virtual server address is used for all client access services. The

BIG-IP system intelligently directs trafﬁc to the appropriate service using an iRule created by the template.

3. Do you want to add any iRules to this combined virtual server?

If you chose to customize pool settings, you have the option of adding existing iRules to the virtual server. iRules allow an

administrator to instruct the system to intercept, inspect, transform, direct and track inbound or outbound application trafﬁc. For

more information on iRules, see https://devcentral.f5.com/HotTopics/iRules/tabid/1082202/Default.aspx.

Important Improper use or misconﬁguration of an iRule can result in unwanted application behavior and poor

performance of your BIG-IP system. We recommended you verify the impact of an iRule prior to deployment

in a production environment.

If you want to add iRules, from the Options box, select the iRule(s) you want to include, and then click the Add (<<) button.

4. Are you deploying Outlook Web App (includes ECP)?

Select whether you are deploying Outlook Web App at this time. This includes the Exchange Control Panel (ECP).

• No

Select this option if you are not deploying OWA at this time. You can always reconﬁgure the template later to add OWA.

• Yes

Select this option if you are deploying OWA at this time.

a. Which type of authentication do Outlook Web App clients use?

This question only appears if you selected to use BIG-IP APM and for the iApp to create a new Access proﬁle

Choose whether your outlook Web App clients are using Forms-based authentication or Smart Card authentication. You

must be using BIG-IP APM version 11.3 or later for Smart Card authentication support for OWA.

• Outlook Web App clients use Forms-based authentication

Select this option if your Outlook Web App clients are using Forms-based authentication.

a. Which type of authentication have you conﬁgured on the Outlook Web App virtual directory?

Select whether you have conﬁgured Outlook Web App to use Windows authentication or Forms-based

authentication. Note that this selection is only for OWA, and not for Outlook clients. If you choose Windows

authentication, the question asking about showing the OWA logon options do not appear. Showing the OWA

logon options is only supported when doing server-side Forms authentication.

• Outlook Web App is conﬁgured for Forms-based authentication

Select this option if your OWA implementation uses forms-based authentication. You must answer the

following question.

a. Would you like to display the OWA computer type and light version options on the APM logon page?

Choose whether you want to display the computer type (public/shared vs private) and light version (Use the

light version of Outlook Web App) options for OWA on the APM logon page.

• No, do not display the OWA logon options

Select this option if you do not want to display the OWA logon options on the APM logon page.

• Yes, display the OWA logon options

Select this option if you want users to see the OWA logon options on the BIG-IP APM logon page.

Note that in Exchange 2016, you must enable the logon page options by running a speciﬁc PowerShell

command in the Exchange Management Shell prior to logging into OWA. See Powershell command for

enabling the OWA logon options on page 99.



Note: For the blind and low vision experience to function correctly when accessing OWA with

Internet Explorer 11, the OWA site must be added to the Compatibility View websites list.

Consult Microsoft documentation for more information.

Archived

F5 Deployment Guide

Microsoft Exchange Server 2016

• Outlook Web App is conﬁgured for Windows authentication

Select this option if your Outlook Web App implementation uses Windows authentication. You must answer

the following question.

a. What should the timeout be for inactive OWA sessions (in minutes)?

Type the number of minutes you want to pass before idle Outlook Web App sessions timeout. The default

is 480 minutes (8 hours).

b. Would you like to use CAPTCHA to validate OWA users?

Choose if you want to use CAPTCHA to validate OWA users. To use this feature, you must have an existing

BIG-IP APM CAPTCHA Conﬁguration object. Conﬁguring this object is outside the scope of this document; see

the BIG-IP APM documentation for instructions.

• Do not use CAPTCHA

Leave this default option if you do not want to use CAPTCHA to validate OWA users, or if you have not yet

created a CAPTCHA conﬁguration object in BIG-IP APM. You can re-enter the template at a later time to

enable this feature.

• Select the CAPTCHA Conﬁguration object you created from the list

If you created an APM CAPTCHA Conﬁguration object, you can select it from the list.

• Outlook Web App clients use Smart Card authentication

Select this option if your OWA clients use Smart Card authentication and you are using BIG-IP APM v11.3 or later.

a. Which certiﬁcate from a CA trusted by this BIG-IP system for client-side processing of smart card

authentication do you want to use?

This question does not appear if you are using an existing Client SSL proﬁle and iApp v1.0.2rc1

Select the certiﬁcate you imported onto the BIG-IP system that is from a Certiﬁcate Authority and is trusted by the

BIG-IP system for client-side processing of smart card authentication. This certiﬁcate must already be imported

onto the system before you can select it.

b. What should the timeout be for inactive OWA sessions (in minutes)?

Type the number of minutes you want to pass before idle Outlook Web App sessions timeout. The default is 480

minutes (8 hours).

b. Should BIG-IP APM restrict EAC access to members of the Exchange Organization Management Security Group?

This question only appears if you selected to provide secure authentication with BIG-IP APM.

Select whether you want the BIG-IP APM to restrict Exchange Administration Center (EAC) access to members of

Exchange 2016's Organizational Management group. The BIG-IP APM module queries Active Directory group membership

for the user making the request to EAC. If the user is not a member of the Organization Management group, the BIG-IP

APM policy denies access.

• No, do not restrict EAC access by group membership

Select this option and the BIG-IP APM will not restrict access to the EAC by group membership.

• Yes, restrict EAC access by group membership

Select this option if you want to restrict EAC access to the Organization Management group. This adds an additional

layer of security to your Exchange deployment, as the system denies access to the EAC from anyone who is not a

member of the Organization Management group.

c. What IP address do you want to use for the OWA virtual server?

This question only appears if you selected Different IP addresses for different services in the previous section.

Specify the IP address the system will use for the Outlook Web App virtual server. Clients will use this IP address to access

Outlook Web App.

d. Do you want to add custom iRules to this virtual server?

This question only appears if you selected Customize pool settings as well as Different IP addresses for different

services in the previous section.

If you chose to customize pool settings, you have the option of adding existing iRules to this OWA virtual server. iRules allow

an administrator to instruct the system to intercept, inspect, transform, direct and track inbound or outbound application

trafﬁc. For more information on iRules, see https://devcentral.f5.com/HotTopics/iRules/tabid/1082202/Default.aspx.

Archived

F5 Deployment Guide

Microsoft Exchange Server 2016

If you want to add iRules, from the Options box, select the iRule(s) you want to include, and then click the Add (<<) button.

Improper use or misconﬁguration of an iRule can result in unwanted application behavior and poor performance of your

BIG-IP system. We recommended you verify the impact of an iRule prior to deployment in a production environment.

e. What are the IP addresses of your OWA servers?

This question only appears if you selected Each service will be handled by a unique set of Mailbox Servers in the

previous section.

Specify the IP addresses of your Outlook Web App servers. Click Add to include additional servers. If you chose to have

the BIG-IP system queue TCP requests, you must specify a Connection Limit. If you chose to enable Priority Group

Activation, you must specify a Priority.

5. Are you deploying Microsoft Outlook, including EWS and OAB?

Select whether you are deploying Microsoft Outlook (including EWS and OAB) as a part of your Exchange 2016 deployment. If you

are, you must answer the following question about the protocol Outlook uses to connect to Exchange.

• No, not deploying Microsoft Outlook or EWS

Select this option if you are not deploying Microsoft Outlook or EWS at this time. You can always reconﬁgure the template at

another time to add Outlook or EWS to the conﬁguration.

• Yes, deploying EWS only

Select this option if you are only deploying Exchange Web Services at this time, and not Outlook Anywhere or Ofﬂine Address

Book. In this case, the BIG-IP system sends any Ofﬂine Address Book trafﬁc to the Exchange Web Services pool.

If you are not using OWA/ECP or are using OWA but did not specify that OWA clients use Smart Card authentication, start with

step f. If you are deploying for a single IP address for all connections and the same set of Client Access servers, there is no

further information required, continue with step 6.

a. What is the Kerberos Key Distribution Center IP or FQDN?

Specify the IP address or fully qualiﬁed domain name of the Kerberos Key Distribution Center (KDC). If you type an FQDN,

the BIG-IP system must be able to resolve the address. Otherwise, use the IP address.

b. What is the name of the Kerberos Realm?

Specify the name of the Kerberos Realm. While this name should be in all capital letters, the iApp automatically turns any

lower case letters to capital.

c. What is the user name for the Active Directory delegation account you created?

Specify the user name for the Active Directory delegation account you created. This account must be correctly conﬁgured

in Active Directory for Kerberos delegation. See Appendix E: Active Directory and Exchange Server conﬁguration for NTLM

on page 125 details.

d. What is the associated password?

Specify the password associated with the account.

e. How do you want to construct the Kerberos ticket request?

Select whether you want to use DNS reverse lookups or the Outlook Anywhere Host header to construct the ticket request.

• Use DNS reverse lookups

Select this option to use DNS reverse lookups to build the Kerberos ticket request. Note that you must conﬁgure a

reverse lookup zone containing a PTR record for each Client Access Server on a DNS server that is accessible from this

BIG-IP system. Consult your DNS documentation for speciﬁc instructions.

• Use the Outlook Anywhere host header

Select this option to use the Outlook Anywhere Host header to construct the ticket request. To use the host header

value, you must conﬁgure IIS Application Pools for Outlook Anywhere, Autodiscover, and Exchange Web Services to run

using the previously created Active Directory user account for Kerberos delegation. See Appendix E: Active Directory

and Exchange Server conﬁguration for NTLM on page 125.

f. What IP address do you want to use for the Exchange Web Services virtual server?

This question only appears if you selected Different IP addresses for different services in the previous section.

Specify the IP address the system will use for the Exchange Web Services virtual server.

Archived

F5 Deployment Guide

Microsoft Exchange Server 2016

g. Do you want to add custom iRules to this virtual server?

This question only appears if you selected Customize pool settings as well as Different IP addresses for different

services in the previous section.

If you chose to customize pool settings, you have the option of adding existing iRules to this Exchange Web Services virtual

server. iRules allow an administrator to instruct the system to intercept, inspect, transform, direct and track inbound or

outbound application trafﬁc. For more information on iRules, see

https://devcentral.f5.com/HotTopics/iRules/tabid/1082202/Default.aspx.

If you want to add iRules, from the Options box, select the iRule(s) you want to include, and then click the Add (<<) button.

Improper use or misconﬁguration of an iRule can result in unwanted application behavior and poor performance of your

BIG-IP system. We recommended you verify the impact of an iRule prior to deployment in a production environment.

h. What are the IP addresses of your EWS servers?

This question only appears if you selected Each service will be handled by a unique set of Mailbox Servers in the

previous section.

Specify the IP addresses of your Exchange Web Services servers. Click Add to include additional servers. If you chose to

have the BIG-IP system queue TCP requests, you must specify a Connection Limit. If you chose to enable Priority Group

Activation, you must specify a Priority.

Continue with #6 Are you deploying ActiveSync?

• Yes, deploying Microsoft Outlook with EWS and OAB

Select this option if you are deploying Outlook Anywhere, EWS, and OAB at this time.

a. Which protocol(s) will Microsoft Outlook use to connect to Exchange?

Choose which protocols your Microsoft Outlook users are using to connect to the Exchange servers.

• Outlook clients will use MAPI-over-HTTP

Select this option if your Outlook clients will use MAPI-over-HTTP only to connect to Exchange.

a. What IP address do you want to use for the MAPI virtual server?

This question only appears if you selected Different IP addresses for different services in the previous section.

Type the IP address you want the system to use for the virtual server for MAPI-over-HTTP.

b. Do you want to add custom iRules to this virtual server?

This question only appears if you selected Customize pool settings as well as Different IP addresses for

different services in the previous section.

If you chose to customize pool settings, you have the option of adding existing iRules to this MAPI virtual server.

iRules allow an administrator to instruct the system to intercept, inspect, transform, direct and track inbound or

outbound application trafﬁc. For more information on iRules, see

https://devcentral.f5.com/HotTopics/iRules/tabid/1082202/Default.aspx.

If you want to add iRules, from the Options box, select the iRule(s) you want to include, and then click the Add

(<<) button. Improper use or misconﬁguration of an iRule can result in unwanted application behavior and poor

performance of your BIG-IP system. We recommended you verify the impact of an iRule prior to deployment in a

production environment.

c. What are the IP addresses of your MAPI servers?

This question only appears if you selected Each service will be handled by a unique set of Mailbox Servers

Specify the IP addresses of your MAPI servers. Click Add to include additional servers. If you chose to have the

BIG-IP system queue TCP requests, you must specify a Connection Limit. If you chose to enable Priority Group

Activation, you must specify a Priority.

• Outlook clients will use RPC-over-HTTP

Select this option if your Outlook clients will use RPC over HTTP, and will not use MAPI over HTTP.

a. What IP address do you want to use for the Outlook Anywhere virtual server?

This question only appears if you selected Different IP addresses for different services in the previous section.

Specify the IP address the system will use for the Outlook Anywhere virtual server.

Archived

F5 Deployment Guide

Microsoft Exchange Server 2016

• Outlook clients will use both MAPI-over-HTTP and RPC-over-HTTP

Select this option if your Outlook clients will use both the RPC-over-HTTP and MAPI-over-HTTP protocols.

a. What IP address do you want to use for the MAPI virtual server?

This question only appears if you selected Different IP addresses for different services

Type the IP address you want the system to use for the virtual server for MAPI-over-HTTP.

b. Do you want to add custom iRules to this virtual server?

This question only appears if you selected Customize pool settings as well as Different IP addresses for

different services

If you chose to customize pool settings, you have the option of adding existing iRules to this MAPI virtual server.

iRules allow an administrator to instruct the system to intercept, inspect, transform, direct and track inbound or

outbound application trafﬁc. For more information on iRules, see

https://devcentral.f5.com/HotTopics/iRules/tabid/1082202/Default.aspx.

If you want to add iRules, from the Options box, select the iRule(s) you want to include, and then click the Add

(<<) button. Improper use or misconﬁguration of an iRule can result in unwanted application behavior and poor

performance of your BIG-IP system. We recommended you verify the impact of an iRule prior to deployment in a

production environment.

c. What are the IP addresses of your MAPI servers?

This question only appears if you selected Each service will be handled by a unique set of Mailbox Servers

Specify the IP addresses of your MAPI servers. Click Add to include additional servers. If you chose to have the

BIG-IP system queue TCP requests, you must specify a Connection Limit. If you chose to enable Priority Group

Activation, you must specify a Priority.

d. What IP address do you want to use for the Outlook Anywhere virtual server?

This question only appears if you selected Different IP addresses for different services in the previous section.

Type the IP address you want the system to use for the virtual server for Outlook Anywhere.

e. Do you want to add custom iRules to this virtual server?

This question only appears if you selected Customize pool settings as well as Different IP addresses for

different services

If you chose to customize pool settings, you have the option of adding existing iRules to this Outlook Anywhere

virtual server. iRules allow an administrator to instruct the system to intercept, inspect, transform, direct and track

inbound or outbound application trafﬁc. For more information on iRules, see

https://devcentral.f5.com/HotTopics/iRules/tabid/1082202/Default.aspx.

If you want to add iRules, from the Options box, select the iRule(s) you want to include, and then click the Add

(<<) button. Improper use or misconﬁguration of an iRule can result in unwanted application behavior and poor

performance of your BIG-IP system. We recommended you verify the impact of an iRule prior to deployment in a

production environment.

f. What are the IP addresses of your Outlook Anywhere servers?

This question only appears if you selected Each service will be handled by a unique set of Mailbox Servers

Specify the IP addresses of your Outlook Anywhere servers. Click Add to include additional servers. If you chose

to have the BIG-IP system queue TCP requests, you must specify a Connection Limit. If you chose to enable

Priority Group Activation, you must specify a Priority.

b. Which type of authentication do Outlook clients use?

This question only appears if you chose to deploy BIG-IP APM version 11.3 or later AND if you chose to deploy Microsoft

Outlook with EWS and OAB

Choose whether your Outlook Anywhere clients use Basic or NTLM authentication. Beginning in BIG-IP version 11.3, the

iApp supports using NTLM authentication for Outlook Anywhere.

• Outlook Anywhere clients use Basic Authentication

Select this option if your Outlook Anywhere clients use Basic Authentication.

NOTE

: If you speciﬁed Outlook Web App clients use Smart Card authentication, you must answer the questions in steps

b-f under Outlook clients use NTLM authentication below.

Archived

F5 Deployment Guide

Microsoft Exchange Server 2016

• Outlook Anywhere clients use NTLM authentication

Select this option if your Outlook Anywhere clients use NTLM information. You must answer the following questions

about your Active Directory implementation. Also see Appendix E: Active Directory and Exchange Server conﬁguration

for NTLM on page 125 for important information and modiﬁcations for NTLM.

Important Before completing this section, you must create a user account in the same domain that has been

properly conﬁgured for Kerberos delegation. You must also create an NTLM Machine Account

object on the BIG-IP system to join this system to the Active Directory domain. See Creating an

NTLM Machine Account on page 77.

Note that the Kerberos SSO method is the only SSO method that can be used when the

authentication method of the access policy is NTLM.

a. Which NTLM machine account should be used for Kerberos delegation?

Select the NTLM Machine Account you created to join the BIG-IP system to the Active Directory domain. If you

have not already created an NTLM Machine Account on the BIG-IP system, see Creating an NTLM Machine

Account on page 77. You must either exit the template now and start over once you have created the NTLM

Machine Account, or choose Outlook Anywhere Clients use Basic Authentication from the previous question, and

then re-enter the template at a later time.

b. What is the Kerberos Key Distribution Center IP or FQDN?

Specify the IP address or fully qualiﬁed domain name of the Kerberos Key Distribution Center (KDC). If you type an

FQDN, the BIG-IP system must be able to resolve the address. Otherwise, use the IP address.

c. What is the name of the Kerberos Realm?

Specify the name of the Kerberos Realm. While this name should be in all capital letters, the iApp automatically

turns any lower case letters to capital.

d. What is the user name for the Active Directory delegation account you created?

Specify the user name for the Active Directory delegation account you created. This account must be correctly

conﬁgured in Active Directory for Kerberos delegation. See Appendix E: Active Directory and Exchange Server

conﬁguration for NTLM on page 125 details.

e. What is the associated password?

Specify the password associated with the account.

f. How do you want to construct the Kerberos ticket request?

Select whether you want to use DNS reverse lookups or the Outlook Anywhere Host header to construct the

ticket request.

• Use DNS reverse lookups

Select this option to use DNS reverse lookups to build the Kerberos ticket request. Note that you must

conﬁgure a reverse lookup zone containing a PTR record for each Mailbox Server on a DNS server that is

accessible from this BIG-IP system. Consult your DNS documentation for speciﬁc instructions.

• Use the Outlook Anywhere host header

Select this option to use the Outlook Anywhere Host header to construct the ticket request. To use the host

header value, you must conﬁgure IIS Application Pools for Outlook Anywhere, Autodiscover, and Exchange

Web Services to run using the previously created Active Directory user account for Kerberos delegation. See

Appendix E: Active Directory and Exchange Server conﬁguration for NTLM on page 125.

c. What IP address do you want to use for the Exchange Web Services virtual server?

This question only appears if you selected Different IP addresses for different services in the previous section.

Type the IP address you want the system to use for the virtual server for Outlook Anywhere.

d. Do you want to add custom iRules to this virtual server?

This question only appears if you selected Customize pool settings and Different IP addresses for different services

If you chose to customize pool settings, you have the option of adding existing iRules to this EWS virtual server. iRules allow

an administrator to instruct the system to intercept, inspect, transform, direct and track inbound or outbound application

trafﬁc. For more information on iRules, see https://devcentral.f5.com/HotTopics/iRules/tabid/1082202/Default.aspx.

If you want to add iRules, from the Options box, select the iRule(s) you want to include, and then click the Add (<<) button.

Improper use or misconﬁguration of an iRule can result in unwanted application behavior and poor performance of your

BIG-IP system. We recommended you verify the impact of an iRule prior to deployment in a production environment.

Archived

F5 Deployment Guide

Microsoft Exchange Server 2016

e. What are the IP addresses of your EWS servers?

This question only appears if you selected Each service will be handled by a unique set of Mailbox Servers

Specify the IP addresses of your EWS servers. Click Add to include additional servers. If you chose to have the BIG-IP

system queue TCP requests, you must specify a Connection Limit. If you chose to enable Priority Group Activation, you

must specify a Priority.

6. Are you deploying ActiveSync?

Select whether you are deploying ActiveSync at this time.

• No

Select this option if you are not deploying ActiveSync at this time. You can always reconﬁgure the template at another time to

add ActiveSync to the conﬁguration.

• Yes

Select this option if you are deploying ActiveSync at this time. See iPhones and other iOS devices are displaying invalid

certiﬁcate messages after deploying the iApp for ActiveSync on page 73 for important information.

a. What IP address do you want to use for the ActiveSync virtual server?

This question only appears if you selected Different IP addresses for different services in the previous section.

Specify the IP address the system will use for the ActiveSync virtual server.

b. Do you want to add custom iRules to this virtual server?

This question only appears if you selected Customize pool settings and Different IP addresses for different services

If you chose to customize pool settings, you have the option of adding existing iRules to this ActiveSync virtual server.

iRules allow an administrator to instruct the system to intercept, inspect, transform, direct and track inbound or outbound

application trafﬁc. For information on iRules, see https://devcentral.f5.com/HotTopics/iRules/tabid/1082202/Default.aspx.

If you want to add iRules, from the Options box, select the iRule(s) you want to include, and then click the Add (<<) button.

Improper use or misconﬁguration of an iRule can result in unwanted application behavior and poor performance of your

BIG-IP system. We recommended you verify the impact of an iRule prior to deployment in a production environment.

c. What are the IP addresses of your ActiveSync servers?

This question only appears if you selected Each service will be handled by a unique set of Mailbox Servers

Specify the IP addresses of your Outlook Anywhere servers. Click Add to include additional servers. If you chose to

have the BIG-IP system queue TCP requests, you must specify a Connection Limit. If you chose to enable Priority Group

Activation, you must specify a Priority.

7. Are you deploying Autodiscover?

Select whether you are deploying Autodiscover at this time.

• No

Select this option if you are not deploying Autodiscover at this time. You can always reconﬁgure the template at another time to

add Autodiscover to the conﬁguration.

• Yes

Select this option if you are deploying Autodiscover at this time.

Warning To deploy Autodiscover, you must either create an 'SRV' record in DNS or create 'A' records in order for

external clients to be able to make use of Autodiscover. If you do not want to use an 'SRV' record, then you

must have 'A' records for either 'autodiscover.<yourdomain>' or '<yourdomain>' that resolve to the IP address

you have designated for your Autodiscover virtual server.

a. What IP address do you want to use for the Autodiscover virtual server?

This question only appears if you selected Different IP addresses for different services in the previous section.

Specify the IP address the system will use for the Autodiscover virtual server.

Archived

F5 Deployment Guide

Microsoft Exchange Server 2016

b. Do you want to add custom iRules to this virtual server?

This question only appears if you selected Customize pool settings as well as Different IP addresses for different

services in the previous section.

If you chose to customize pool settings, you have the option of adding existing iRules to this Autodiscover virtual server.

iRules allow an administrator to instruct the system to intercept, inspect, transform, direct and track inbound or outbound

application trafﬁc. For iRule information, see https://devcentral.f5.com/HotTopics/iRules/tabid/1082202/Default.aspx.

If you want to add iRules, from the Options box, select the iRule(s) you want to include, and then click the Add (<<) button.

Improper use or misconﬁguration of an iRule can result in unwanted application behavior and poor performance of your

BIG-IP system. We recommended you verify the impact of an iRule prior to deployment in a production environment.

c. What are the IP addresses of your Autodiscover servers?

This question only appears if you selected Each service will be handled by a unique set of Mailbox Servers in the

previous section.

Specify the IP addresses of your Autodiscover servers. Click Add to include additional servers. If you chose to have the

BIG-IP system queue TCP requests, you must specify a Connection Limit. If you chose to enable Priority Group Activation,

you must specify a Priority.

8. What version of NTLM authentication does your deployment require?

This question appears depending on your other selections in the template

Choose the version of NTLM your Microsoft Exchange deployment requires. Your selection determines the type of BIG-IP APM

SSO Conﬁguration object.

• NTLMv1 authentication

Select this option if your Exchange implementation is using NTLMv1.

• NTLMv2 authentication

Select this option if your Exchange implementation is using NTLMv2.

9. Are you deploying POP3?

Select whether you are deploying POP3 at this time.

• No

Select this option if you are not deploying POP3 at this time. You can always reconﬁgure the template at another time to add

POP3 to the conﬁguration.

• Yes

Select this option if you are deploying POP3 at this time.

Important You must enable POP3 on each of your Exchange Mailbox Servers before that service will be available.

POP3 is not enabled by default on Exchange Mailbox Servers.

If you are ofﬂoading SSL, you must conﬁgure the Authentication properties for POP3 on each of your

Exchange Mailbox Servers to allow logins using plain text. By default, POP3 is conﬁgured to only allow

secure (encrypted) logins.

a. What IP address do you want to use for the POP3 virtual server?

This question only appears if you selected Different IP addresses for different services in the previous section.

Specify the IP address the system will use for the POP3 virtual server.

b. What are the IP addresses of your POP3 servers?

This question only appears if you selected Each service will be handled by a unique set of Mailbox Servers in the

previous section.

Specify the IP addresses of your POP3 servers. Click Add to include additional servers. If you chose to have the BIG-IP

system queue TCP requests, you must specify a Connection Limit. If you chose to enable Priority Group Activation, you

must specify a Priority.

Archived

F5 Deployment Guide

Microsoft Exchange Server 2016

10. Are you deploying IMAP4?

Select whether you are deploying IMAP4 at this time.

• No

Select this option if you are not deploying IMAP4 at this time. You can always reconﬁgure the template at another time to add

IMAP4 to the conﬁguration.

• Yes

Select this option if you are deploying IMAP4 at this time.

Important You must enable IMAP4 on each of your Exchange Mailbox Servers before that service will be available.

IMAP4 is not enabled by default on Exchange Mailbox Servers.

If you are ofﬂoading SSL, you must conﬁgure the Authentication properties for IMAP4 on each of your

Exchange Mailbox Servers to allow logins using plain text. By default, IMAP4 is conﬁgured to only allow

secure (encrypted) logins.

a. What IP address do you want to use for the IMAP4 virtual server?

This question only appears if you selected Different IP addresses for different services in the previous section.

Specify the IP address the system will use for the IMAP4 virtual server.

b. What are the IP addresses of your IMAP4 servers?

This question only appears if you selected Each service will be handled by a unique set of Mailbox Servers

Specify the IP addresses of your IMAP4 servers. Click Add to include additional servers. If you chose to have the BIG-IP

system queue TCP requests, you must specify a Connection Limit. If you chose to enable Priority Group Activation, you

must specify a Priority.

11. What are the IP Addresses of your Mailbox Servers?

This question only appears if you selected All services will be handled by a unique set of Mailbox Servers

If you chose that each client access service will be handled by the same Mailbox Servers, the iApp asks for the IP addresses of the

Mailbox Servers. Type the IP addresses. Click the Add button to include additional servers.

If you chose to have the BIG-IP system queue TCP requests, you must specify a Connection Limit. If you chose to enable Priority

Group Activation, you must specify a Priority.

Continue with Server Health Monitors on page 36.

Archived

F5 Deployment Guide

Microsoft Exchange Server 2016

Server Health Monitors

The last section of the template asks for information about the health checks the iApp will conﬁgure for the Mailbox Servers.

1. Do you want to create external monitors for client access services?

Choose whether you want to use external or standard health monitors to check the availability of the client access services on your

Mailbox Servers. External monitors require a mailbox account and password and perform logins to POP3 and IMAP4 services (if

you are using them).

• No, do not create external monitors (use standard monitors)

Select this option if you want to use standard monitors for checking the availability of the client access services. Standard

monitors check network connectivity but do not perform actual logins.

• Yes, create external monitors

If you choose external monitors, the iApp uses a script to look for the Windows service status of ﬁve critical client access

services.

If you are deploying the iApp for POP3 and/or IMAP4 services, the monitors attempt to login to the service and checks for valid

content in the response. Because these monitors attempt to access a speciﬁc mailbox, account maintenance and Mailbox

status must become a part of your monitoring strategy. For example, if an account used for monitoring is locked or deleted, the

monitor will mark the services down for all users.

We strongly recommend creating a mailbox account(s) speciﬁcally for use in the monitor(s). The accounts for those mailboxes

should have no other privileges in the domain and should be conﬁgured with passwords that do not expire.

a. What is the SNMP community string for your Client Access servers?

Type the SNMP community string for your Client Access servers. Because Microsoft only supports SNMP v2 in their default

SNMP service, you must use an SNMP v2 community string.

If you require SNMP v3 support, and have conﬁgured that using a custom solution on your Exchange servers then you can

manually modify the external monitor script created by the iApp. See Modifying the external monitor script ﬁle to support

SNMP v3 on page 67.

b. Which mailbox account should be used for the monitors?

This question only appears if you are deploying the iApp for POP3 and/or IMAP4

Type a mailbox account for use in the external monitors. This name corresponds to the account name ﬁeld in Active

Directory (rather than the email address).

c. What is the password for that mailbox account?

This question only appears if you are deploying the iApp for POP3 and/or IMAP4

Type the associated password.

d. What is the domain name of the user account for the monitors?

This question only appears if you are deploying the iApp for POP3 and/or IMAP4

Type the Domain name for the user account. This domain can be entered in either FQDN (mydomain.example.com) or

NetBIOS (MYDOMAIN) format.

e. Do you want to monitor a second mailbox?

Choose whether you want to monitor a second mailbox. We strongly recommend conﬁguring a second mailbox account to

be used by a second set of monitors, using a mailbox that is conﬁgured to reside on a different Mailbox server. The BIG-IP

LTM will only mark a client access service on a speciﬁc server down if both sets of credentials fail. This provides resiliency to

accommodate conﬁguration errors with a single account, mailbox, or Mailbox server.

• Monitor only one mailbox

Select this option if you do not want the BIG-IP system to monitor a second mailbox. Continue with #3.

• Monitor a second mailbox (recommended)

Select this option if you want the BIG-IP system to monitor a second mailbox. You must answer the following:

Archived

F5 Deployment Guide

Microsoft Exchange Server 2016

a. Which email address do you want to use for the second set of advanced monitors?

This question only appears if you speciﬁed you are deploying Autodiscover and/or Exchange Web Services

Type the email address associated with the account you are going to monitor (and that you specify below).

b. Which mailbox account should be used for the second set of monitors?

This question only appears if you are deploying the iApp for POP3 and/or IMAP4

Type a mailbox account for use in the second monitors. Again, this name corresponds to the account name ﬁeld

in Active Directory (rather than the email address).

c. What is the password for that mailbox account?

This question only appears if you are deploying the iApp for POP3 and/or IMAP4

Type the associated password.

d. What is the domain name of the user account for the second set of monitors?

This question only appears if you are deploying the iApp for POP3 and/or IMAP4

Type the Domain name for the second user account. This domain can be entered in either FQDN (mydomain.

example.com) or NetBIOS (MYDOMAIN) format.

2. Which authentication method have you conﬁgured for OWA?

This question only appears if you speciﬁed you are deploying Outlook Web App.

If you conﬁgured the iApp to deploy Outlook Web App at this time, choose the authentication method you have conﬁgured for

Outlook Web App. The health monitors will be customized to accommodate the authentication method you are using.

Important If you are using APM in this scenario, you must choose Forms-Based. If you are using Forms-Based

authentication for OWA, you must change the credential format required for OWA on each Exchange Mailbox

Server from the default domain\username format to just username.

• OWA uses the default Forms-Based authentication

Select this option if you are using Forms-based authentication.

If you chose Forms-based authentication, the BIG-IP system does not perform an actual login to the service, but checks the

availability of the forms-based authentication page.

• OWA uses Basic or Windows Integrated authentication

Select this option if you are using Basic/Windows Integrated authentication.

3. How many seconds should pass between health checks?

This question does not appear if you chose not to create external monitors

Speciﬁes how often the system checks the health of the servers. We recommend the default of 30 seconds. The maximum value

for the interval is 28,799 seconds.

4. Are you using the same FQDN for all HTTP-based services?

This question only appears if you speciﬁed you are using a single IP address for all connections. If you selected Different IP

addresses for different services, continue with #5.

Select whether you are using one FQDN for all HTTP-based services or separate FQDNs for each service. These values are used

for HTTP 1.1-based health monitors.

• One FQDN for all HTTP services

Select this option if you are using a single FQDN for all HTTP-based client access services.

a. What is the FQDN that you use for your HTTP-based client access services?

Specify the fully qualiﬁed domain name you are using for all of the HTTP-based client access services.

• Different FQDNs for each HTTP service

Select this option if you are using separate FQDNs for each HTTP-based client access service. Additional questions appear.

When you are ﬁnished adding the FQDNs, continue with

Additional Steps.

Archived

F5 Deployment Guide

Microsoft Exchange Server 2016

a. What FQDN do you use for the OWA service?

This question only appears if you speciﬁed you are deploying Outlook Web App.

Specify the fully qualiﬁed domain name you use for your Outlook Web App service.

b. What FQDN do you use for the Outlook Anywhere service?

This question only appears if you speciﬁed you are deploying Outlook Anywhere.

Specify the fully qualiﬁed domain name you use for your Outlook Anywhere service.

c. What FQDN do you use for the ActiveSync service?

This question only appears if you speciﬁed you are deploying ActiveSync.

Specify the fully qualiﬁed domain name you use for your ActiveSync service.

d. What FQDN do you use for the Autodiscover service?

This question only appears if you speciﬁed you are deploying Autodiscover.

Specify the fully qualiﬁed domain name you use for your Autodiscover service.

5. What is the FQDN for your OWA service?

This question only appears if you speciﬁed you are using different IP addresses for different services and you are deploying OWA

Specify the fully qualiﬁed domain name you use for your Outlook Web App service.

6. What is the FQDN for your MAPI service?

This question only appears if you speciﬁed you are using different IP addresses for different services and you are deploying MAPI-

over HTTP

Specify the fully qualiﬁed domain name you use for your MAPI service.

7. What is the FQDN for your Outlook Anywhere service?

This question only appears if you speciﬁed you are using different IP addresses for different services and you are deploying

Outlook Anywhere

Specify the fully qualiﬁed domain name you use for your Outlook Anywhere service.

8. What is the FQDN for your ActiveSync service?

This question only appears if you speciﬁed you are using different IP addresses for different services and are deploying ActiveSync

Specify the fully qualiﬁed domain name you use for your ActiveSync service.

9. What is the FQDN for your Autodiscover service?

This question only appears if you speciﬁed you are using different IP addresses for different services and you are deploying

Autodiscover

Specify the fully qualiﬁed domain name you use for your Autodiscover service.

Additional Steps

Review the information in the Additional steps section, and take appropriate action if necessary. All of the notes in Additional Steps are

found in the relevant section of this deployment guide.

Finished

Review your answers to the questions. When you are satisﬁed, click the Finished button. The BIG-IP system creates the relevant

objects.

Continue with Next steps on page 66.

Archived

F5 Deployment Guide

Microsoft Exchange Server 2016

Conﬁguring the local LTM to receive HTTP-based traﬃc forwarded by a remote APM

If you chose the second scenario, Local LTM receives HTTP-based trafﬁc forwarded by remote BIG-IP APM, use this section for

guidance on conﬁguring the iApp. This selection conﬁgures BIG-IP LTM with a single virtual server that receives Exchange HTTP-

based trafﬁc that has been forwarded by a separate BIG-IP APM. The BIG-IP system can also accommodate non-HTTP trafﬁc that is

not handled by BIG-IP APM such as POP3 and IMAP4.

While this virtual server can be used for direct trafﬁc (for example, internal clients that do not use the BIG-IP APM), we do not

recommend using this virtual server in that way. For direct trafﬁc, we strongly recommend creating a second instance of the iApp on

this BIG-IP LTM for the direct trafﬁc/internal users. You must use a unique virtual server IP address, all of the other settings can be

identical. Once both iApps have been created, you would conﬁgure Split DNS (use the same domain name, but different zones and IP

addresses for internal and external clients). For more information about Split DNS, refer to your DNS documentation.

Analytics

This section of the template asks questions about Analytics. The Application Visibility Reporting (AVR) module allows you to view

statistics speciﬁc to your Microsoft Exchange implementation. AVR is available on all BIG-IP systems v11 and later, however you must

have the AVR provisioned for this option to appear. Note that this is only for application visibility reporting, you can view object-level

statistics from the BIG-IP without provisioning AVR.

Important Enabling Analytics may adversely affect overall system performance. If you choose to enable Analytics, we

recommend gathering statistics for a set time period, such as one week, and then re-entering this template and

disabling Analytics while you process the data.

If you plan on using AVR for analytics, we recommend creating a custom Analytics proﬁle. To create a new proﬁle, from the Main tab,

select Profiles and then click Analytics. Click New and then conﬁgure the proﬁle as applicable for your conﬁguration. See the online

help or product documentation for speciﬁc instructions. To select the new proﬁle, you need to restart or reconﬁgure the iApp.

1. Do you want to enable Analytics for application statistics?

Choose whether you want to enable AVR for Analytics.

• No, do not enable Analytics

If you do not want to enable Analytics, leave this list set to No, and continue with the next section.

• Yes, enable Analytics using AVR

If you choose to enable Analytics, select Yes from the list, and then answer the following questions.

a. Use the default Analytics proﬁle or select a custom proﬁle?

If you decide to use AVR, you must decide whether to use the default Analytics proﬁle, or create a new one. As mentioned

previously, we recommend creating a new proﬁle to get the most ﬂexibility and functionality out of AVR. If you have already

started the iApp template conﬁguration and then decide to create a new Analytics proﬁle, you must exit the iApp, create the

proﬁle, and then restart the iApp template.

• Select a custom Analytics proﬁle

Select this option if you have already created a custom Analytics proﬁle for Exchange Server.

a. Which Analytics proﬁle do you want to use?

From the list, select the appropriate Analytics proﬁle.

• Use default proﬁle

Select this option if you have not yet created a custom Analytics proﬁle for Microsoft Exchange. We do not recommend

using the default proﬁle.

Archived

F5 Deployment Guide

Microsoft Exchange Server 2016

Application Firewall Manager (BIG-IP AFM)

This entire section only appears if you have licensed and provisioned BIG-IP AFM

This section gathers information about BIG-IP Advanced Firewall Manager, if you want to use it to protect the Exchange deployment.

For more information on BIG-IP AFM, see http://support.f5.com/kb/en-us/products/big-ip-afm.html, and then select your version.

1. Do you want to use AFM network ﬁrewall and IP Intelligence to protect your application?

Choose whether you want to use BIG-IP AFM, F5's network ﬁrewall with IP intelligence, to secure this Exchange deployment. If

you choose to use BIG-IP AFM, you can restrict access to the Exchange virtual server(s) to a speciﬁc network or IP address. See

the BIG-IP AFM documentation for speciﬁc details on conﬁguring AFM.

• No, do not use network ﬁrewall and IP Intelligence

Select this option if you do not want to enable BIG-IP AFM at this time. You can always re-enter the template at a later date to

enable BIG-IP AFM. Continue with the next section.

• Select an existing AFM policy from the list

If you already created a BIG-IP AFM policy for this implementation, select it from the list. Continue with c.

• Yes, use network ﬁrewall and IP Intelligence

Select this option if you want to enable BIG-IP AFM using F5's recommended conﬁguration.

a. Do you want to forbid access to your application from speciﬁc networks or IP addresses?

Choose whether you want to restrict access to the Exchange implementation via the BIG-IP virtual server.

• No, do not forbid client addresses (allow all)

By default, the iApp conﬁgures the AFM to accept trafﬁc destined for the Exchange virtual server(s) from all sources. If

you do not have a need to restrict access to the virtual server, leave this option selected and then continue with b.

• Yes, forbid speciﬁc client addresses

Select this option if you want to restrict access to the Exchange virtual server(s) by IP address or network address.

a. What IP or network addresses should be allowed to access your application?

Specify the IP address or network access that should be allowed access to the Exchange virtual server(s). You

can specify a single IP address, a list of IP addresses separated by spaces (not commas or other punctuation), a

range of IP addresses separated by a dash (for example 192.0.2.10-192.0.2.100), or a single network address,

such as 192.0.2.200/24.

b. How should the system control connections from networks suspected of malicious activity?

The BIG-IP AFM uses an IP intelligence database to categorize IP addresses coming into the system. Choose what you

want the system to do for sources that are attempting to access the Exchange virtual server(s) with a low reputation score.

For more information, see the BIG-IP AFM documentation.

Important:

You must have an active IP Intelligence license for this feature to function. See

https://f5.com/products/modules/ip-intelligence-services for information.

• Accept all connections and log nothing

Select this option to allow all sources, without taking into consideration the reputation score or logging anything.

• Reject connections from IP addresses with poor reputations

Select this option to reject access to the Exchange virtual server(s) from any source with a low reputation score.

• Accept all connections but log those from suspicious networks

Select this option to allow access to the Exchange virtual server(s) from sources with a low reputation score, but add an

entry for it in the logs. By default, IP Intelligence events are logged to Security > Event Logs >

Network > IP Intelligence. We recommend creating a remote logging proﬁle for IP Intelligence events.

c. Would you like to stage a policy for testing purposes?

Choose whether you want to stage a ﬁrewall policy for testing purposes. A staged policy allows you to evaluate the effect

a policy has on trafﬁc by analyzing the system logs, without actually modifying trafﬁc based on the ﬁrewall rules. You must

already have a policy on the system in order to select it.

Archived

F5 Deployment Guide

Microsoft Exchange Server 2016

• Do not apply a staging policy

Select this option if you do not want to apply a logging proﬁle at this time. You can always re-enter the template at a

later date to add a logging proﬁle. Continue with the next question.

• Select an existing policy from the list

If you have already created a ﬁrewall policy for this implementation, select it from the list. Only policies that already

exist on the system appear in the list. To create a new policy, on the Main tab, click Security > Network Firewall >

Policies. Speciﬁc instructions for creating a ﬁrewall policy is outside the scope of this iApp and deployment guide.

d. Which logging proﬁle would you like to use?

Choose whether you or not you want to use a logging proﬁle for this AFM implementation. You can conﬁgure the BIG-IP

system to log detailed information about BIG-IP system Network Firewall events and store those logs on the BIG-IP system

or a remote logging server (supports servers like syslog and Splunk). If you want to use a logging proﬁle, we recommend

creating one outside this template. The list only contains proﬁles with Network Firewall enabled.

• Do not use a logging proﬁle

Select this option if you do not want to use a logging proﬁle at this time. You can always re-enter the template at a later

date to add a logging proﬁle. Continue with the next question.

• Select an existing logging proﬁle from the list

If you have already created a logging proﬁle for this implementation, select it from the list. You must create a proﬁle

before it is available in the list. To create a logging proﬁle, on the Main tab, click Security > Event Logs > Logging

Profiles. Speciﬁc instructions for creating a logging proﬁle is outside the scope of this iApp and deployment guide. See

the online help or the About Local Logging with the Network Firewall chapter of the

BIG-IP Network Firewall: Policies and Implementations guide for more information.

Continue with Tell us about your deployment on page 42.

Archived

F5 Deployment Guide

Microsoft Exchange Server 2016

Tell us about your deployment

In this section, the iApp gathers general information about your Mailbox Server deployment. Remember, you must import an SSL

certiﬁcate and key that correspond to all fully-qualiﬁed DNS names that you are using for OWA, Outlook Anywhere, Autodiscover,

ActiveSync, POP3, or IMAP4 trafﬁc. Any certiﬁcate that you obtain with multiple names must be in SAN (Subject Alternative Name) or

wildcard format, not SNI (Server Name Indication) format.

1. Will incoming trafﬁc arrive at this BIG-IP system encrypted or unencrypted?

Select whether any of the HTTP-based, POP3 and IMAP4 trafﬁc will be encrypted or not when it arrives on this system. In nearly

all cases for this deployment scenario, it will be encrypted (it would not be encrypted, for example, if you selected one of the other

scenarios/roles for this iApp, and elected to ofﬂoad SSL/TLS trafﬁc at a separate BIG-IP APM).

Note that the BIG-IP system does not ofﬂoad the encryption used for RPC; the answer to this question should be based on the

other client access protocols you intend to deploy.

• Encrypted

If you chose Encrypted in the previous question, additional questions appear.

a. Do you want to re-encrypt this trafﬁc to your Mailbox Servers?

If want the BIG-IP system to ofﬂoad SSL processing from the Mailbox servers, select Do not re-encrypt (SSL Offload)

from the list. Ofﬂoading SSL on the BIG-IP system can extend Exchange Server server capacity.

• Do not re-encrypt (SSL Ofﬂoad)

Select this option if you want to ofﬂoad SSL processing onto the BIG-IP system. If you choose SSL Ofﬂoad, you must

have followed the Microsoft instructions for conﬁguring the Exchange Server.

a. Which Client SSL proﬁle do you want to use?

The iApp can create a new Client SSL proﬁle, or if you have created a Client SSL proﬁle which contains the

appropriate SSL certiﬁcate and key for your Exchange implementation, you can select it from the list.

• Select the Client SSL proﬁle you created from the list

If you manually created a Client SSL proﬁle, select it from the list, and then continue with #2.

• Create a new Client SSL proﬁle

Select this option if you want the iApp to create a new Client SSL proﬁle.

a. Which SSL certiﬁcate do you want to use?

Select the SSL certiﬁcate you imported onto the BIG-IP system for decrypting client connections.

If you have not yet imported a certiﬁcate, you can leave the default selections and reconﬁgure this iApp

after obtaining the certiﬁcates. The deployment will not function correctly until you have selected the

correct certiﬁcates here.



Note: Any certiﬁcate that you obtain with multiple names must be in SAN (Subject Alternative Name)

format, not SNI (Server Name Indication) format. For more information on SAN certiﬁcates,

see Subject Alternative Name (SAN) SSL Certiﬁcates on page 123.

b. Which SSL key do you want to use?

Select the associated key from the list.

c. Which intermediate certiﬁcate do you want to use?

Choose whether or not you want to use an intermediate certiﬁcate (also called intermediate certiﬁcate

chains or chain certiﬁcates) in this deployment. These certiﬁcates are used to help systems which depend

on SSL certiﬁcates for peer identiﬁcation. These certiﬁcates are intended to create a chain of trust between

the CA that signed the certiﬁcate and the CA that is already trusted by the recipient of the certiﬁcate. This

allows the recipient to verify the validity of the certiﬁcates presented, even when the signing CA is unknown.

In order to use an intermediate certiﬁcate in this deployment, you must have manually imported it onto the

BIG-IP system.

• Do not use an intermediate certiﬁcate

Select this option if you do not want to use an intermediate certiﬁcate in this deployment, or have not

yet imported the certiﬁcate onto the system but want to exit the template to import it and then restart

the template.

Archived

F5 Deployment Guide

Microsoft Exchange Server 2016

• Select the intermediate certiﬁcate you imported from the list

If you imported an intermediate certiﬁcate for this Exchange implementation, select the certiﬁcate you

imported from the list.

• Re-encrypt (SSL Bridging)

Select this option if your implementation requires encrypted trafﬁc to the Mailbox servers. The BIG-IP system

unencrypts, then re-encrypts the trafﬁc headed for the Mailbox servers.

a. Which Client SSL proﬁle do you want to use?

The iApp can create a new Client SSL proﬁle, or if you have created a Client SSL proﬁle which contains the

appropriate SSL certiﬁcate and key for your Exchange implementation, you can select it from the list.

• Select the Client SSL proﬁle you created from the list

If you manually created a Client SSL proﬁle, select it from the list, and then continue with #2.

• Create a new Client SSL proﬁle

Select this option if you want the iApp to create a new Client SSL proﬁle.

a. Which SSL certiﬁcate do you want to use?

Select the SSL certiﬁcate you imported onto the BIG-IP system for decrypting client connections.

If you have not yet imported a certiﬁcate, you can leave the default selections and reconﬁgure this iApp

after obtaining the certiﬁcates. The deployment will not function correctly until you have selected the

correct certiﬁcates here.



Note: Any certiﬁcate that you obtain with multiple names must be in SAN (Subject Alternative Name)

format, not SNI (Server Name Indication) format. For more information on SAN certiﬁcates,

see Subject Alternative Name (SAN) SSL Certiﬁcates on page 123.

b. Which SSL key do you want to use?

Select the associated key from the list.

b. Which intermediate certiﬁcate do you want to use?

Choose whether or not you want to use an intermediate certiﬁcate (also called intermediate certiﬁcate chains

or chain certiﬁcates) in this deployment. These certiﬁcates are used to help systems which depend on SSL

certiﬁcates for peer identiﬁcation. These certiﬁcates are intended to create a chain of trust between the CA that

signed the certiﬁcate and the CA that is already trusted by the recipient of the certiﬁcate. This allows the recipient

to verify the validity of the certiﬁcates presented, even when the signing CA is unknown.

In order to use an intermediate certiﬁcate in this deployment, you must have manually imported it onto the BIG-IP

system.

• Do not use an intermediate certiﬁcate

Select this option if you do not want to use an intermediate certiﬁcate in this deployment, or have not yet

imported the certiﬁcate onto the system but want to exit the template to import it and then restart the

template.

• Select the intermediate certiﬁcate you imported from the list

If you imported an intermediate certiﬁcate for this Exchange implementation, select the certiﬁcate you imported

from the list.

c. Which Server SSL proﬁle do you want to use?

Select whether you want the iApp to create an F5 recommended Server SSL proﬁle, or if you want to choose a

Server SSL proﬁle you already created.

Important If you are conﬁguring SSL Bridging and using BIG-IP version 11.4.x, you must see When

using SSL Bridging and BIG-IP version 11.4.x, pool members may be marked down or you may

experience connection resets and TLS errors logged to the Mailbox servers on page 73.

• Select the Server SSL proﬁle you created from the list

If you have previously created a Server SSL proﬁle for your Exchange implementation, from the list, select the

existing Server SSL proﬁle you created.

• Create a new Server SSL proﬁle

Select this option if you want the iApp to create a new Server SSL proﬁle.

Archived

F5 Deployment Guide

Microsoft Exchange Server 2016

The F5 recommended Server SSL proﬁle uses the serverssl parent proﬁle. For information about the ciphers

used in the Server SSL proﬁle, see http://support.f5.com/kb/en-us/solutions/public/8000/800/sol8802.html.

Continue with #2.

• Unencrypted

Select this option if Mailbox trafﬁc is arriving at this BIG-IP system unencrypted (typically because you conﬁgured to ofﬂoad

SSL/TLS trafﬁc at the BIG-IP APM that is sending trafﬁc to this device).

a. Do you want to encrypt the trafﬁc to your Mailbox Servers?

If you want the BIG-IP system to ofﬂoad SSL processing from the Mailbox servers, select Do not encrypt (SSL Offload)

from the list. Ofﬂoading SSL on the BIG-IP system can extend Exchange Server server capacity.

• Do not encrypt (SSL Offload)

Select this option if you do not want the BIG-IP system to encrypt the trafﬁc destined for the Mailbox servers. The

BIG-IP system does not modify the trafﬁc, and you can continue with the next question.

• Encrypt (SSL Bridging)

Select this option if your implementation requires encrypted trafﬁc to the Mailbox servers. If you choose this option, the

BIG-IP system encrypts the trafﬁc headed for the Mailbox servers.

a. Which Server SSL proﬁle do you want to use?

Select whether you want the iApp to create an F5 recommended Server SSL proﬁle, or if you want to choose a

Server SSL proﬁle you already created.

Important If you are conﬁguring SSL Bridging and using BIG-IP version 11.4.x, you must see When

using SSL Bridging and BIG-IP version 11.4.x, pool members may be marked down or you may

experience connection resets and TLS errors logged to the Mailbox servers on page 73.

• Select the Server SSL proﬁle you created from the list

If you have previously created a Server SSL proﬁle for your Exchange implementation, select the existing

Server SSL proﬁle you created from the list.

• Create a new Server SSL proﬁle

Select this option if you want the iApp to create a new Server SSL proﬁle.

The default, F5 recommended Server SSL proﬁle uses the serverssl parent proﬁle. For information about the

ciphers used in the Server SSL proﬁle, see

http://support.f5.com/kb/en-us/solutions/public/8000/800/sol8802.html.

2. Which intermediate certiﬁcate do you want to use?

Choose whether or not you want to use an intermediate certiﬁcate (also called intermediate certiﬁcate chains or chain certiﬁcates)

in this deployment. These certiﬁcates are used to help systems which depend on SSL certiﬁcates for peer identiﬁcation. These

certiﬁcates are intended to create a chain of trust between the CA that signed the certiﬁcate and the CA that is already trusted by

the recipient of the certiﬁcate. This allows the recipient to verify the validity of the certiﬁcates presented, even when the signing CA

is unknown.

In order to use an intermediate certiﬁcate in this deployment, you must have manually imported it onto the BIG-IP system.

• Do not use an intermediate certiﬁcate

Select this option if you do not want to use an intermediate certiﬁcate in this deployment, or have not yet imported the

certiﬁcate onto the system but want to exit the template to import it and then restart the template.

• Select the intermediate certiﬁcate you imported from the list

If you imported an intermediate certiﬁcate for this Exchange implementation, select the certiﬁcate you imported from the list.

3. Where will your BIG-IP virtual servers be in relation to your Mailbox Servers?

Select whether your BIG-IP virtual servers are on the same subnet as your Mailbox servers, or on different subnets. This setting is

used to determine the SNAT (secure NAT) and routing conﬁguration.

• Same subnet for BIG-IP virtual servers and Mailbox Servers

Select this option if the BIG-IP virtual servers and the Mailbox servers are on the same subnet. In this case SNAT is conﬁgured

on the BIG-IP virtual server and you must specify the number of concurrent connections.

Archived

F5 Deployment Guide

Microsoft Exchange Server 2016

a. What is the maximum number of concurrent users you expect per Mailbox Server?

Select whether you expect more or fewer than 6,000 concurrent users to each Mailbox server. This answer is used to

determine what type of SNAT (secure network address translation) that system uses. A SNAT is an object that maps the

source client IP address in a request to a translation address deﬁned on the BIG-IP device.



Note: For speciﬁc information on SNAT Pools, including why we chose 6,000 concurrent users per server, see

Maximum number of concurrent users: SNAT Pool guidance on page 123.

• Fewer than 6000

Select this option if you expect fewer than 6,000 concurrent users per Mailbox server. With this option, the system

applies SNAT Auto Map, which doesn’t require any additional IP addresses, as the system uses an existing self IP

address for translation.

• More than 6000

Select this option if you expect more than 6,000 users at one time to each server. With this option, the iApp creates a

SNAT Pool (or you can choose one you created), for which you need one IP address for each 6,000 users you expect.

a. Create a new SNAT pool or use an existing one?

Select whether you want the system to create a new SNAT Pool, or if you have already created a SNAT pool for

this implementation.

• Select the SNAT pool you created from the list

If you have previously created a SNAT Pool for your Exchange implementation, select it from the list.

• Create a new SNAT pool

If you have not created a custom SNAT pool, select this option for the iApp to create a new one.

a. Which IP addresses do you want to use for the SNAT pool?

Specify one otherwise unused IP address for every 6,000 concurrent connections, or fraction thereof. Click

Add for additional rows.

Important If you choose more than 6,000 users, but do not specify enough SNAT pool addresses,

after the maximum connection limit of 6,000 concurrent users per server is reached, new

requests fail.

• Different subnet for BIG-IP virtual servers and Mailbox Servers

If the BIG-IP virtual servers and Web Interface servers are on different subnets, the following question appears asking how

routing is conﬁgured.

a. How have you conﬁgured routing on your Mailbox Servers?

Select whether the Mailbox servers use this BIG-IP system’s Self IP address as their default gateway.

• Mailbox Servers do NOT use BIG-IP as their default gateway

Select this option if the Mailbox servers do not use the BIG-IP system as their default gateway. If the servers do not use

the BIG-IP as their default gateway, SNAT is conﬁgured on the BIG-IP virtual server and you must select the expected

number of concurrent users in the next question.

a. What is the maximum number of concurrent users you expect per Mailbox server?

Select whether you expect more or fewer than 6,000 concurrent users to each server. This answer is used to

determine what type of SNAT that system uses. A SNAT is an object that maps the source client IP address in a

request to a translation address deﬁned on the BIG-IP device.



Note: For speciﬁc information on SNAT Pools, including why we chose 6,000 concurrent users per server,

see Maximum number of concurrent users: SNAT Pool guidance on page 123.

• Fewer than 6000

Select this option if you expect fewer than 6,000 concurrent users per Mailbox server. With this option, the

system applies SNAT Auto Map, which doesn’t require any additional IP addresses, as the system uses an

existing self IP address for translation.

• More than 6000

Select this option if you expect more than 6,000 users at one time to each server. With this option, the iApp

creates a SNAT Pool (or you can choose one you created), for which you need one IP address for each 6,000

users you expect.

Archived

F5 Deployment Guide

Microsoft Exchange Server 2016

a. Create a new SNAT pool or use an existing one?

Select whether you want the system to create a new SNAT Pool, or if you have already created a SNAT

pool for this implementation.

• Select the SNAT pool you created from the list

If you have previously created a SNAT Pool for your Exchange implementation, select it from the list.

• Create a new SNAT pool

If you have not created a custom SNAT pool, select this option for the iApp to create a new one.

a. Which IP addresses do you want to use for the SNAT pool?

Specify one otherwise unused IP address for every 6,000 concurrent connections, or fraction

thereof. Click Add for additional rows.

Important If you choose more than 6,000 users, but do not specify enough SNAT pool

addresses, after the maximum connection limit of 6,000 concurrent users per

server is reached, new requests fail.

• Mailbox Servers use the BIG-IP as their default gateway

Select this option if the Mailbox servers use the BIG-IP system as their default gateway. In this scenario, no additional

conﬁguration is necessary to ensure correct server response handling.

4. How are you distributing the client access service protocols between servers?

Select whether all your Mailbox services are handled by the same Mailbox servers, or if each service is handled by a unique set of

servers.

This iApp creates separate pools and monitors for each service regardless of this setting. However, if you use the same set of

servers for all services, you only have to specify the server IP addresses once.

• All services will be handled by the same set of Mailbox Servers

Choose this option if you are using the same servers for all of your Exchange client access services.

• Each service will be handled by a unique set of Mailbox Servers

Choose this option if you are using different sets of Mailbox servers for each client access service.

Continue with Tell us about which services you are deploying on page 47.

Archived