UAG 2.9 takes 300 seconds timeout before shows login-page via IE

[ALEX_TSM]

Hello,

After updated Horizon 7.03 to 7.1 and Access point from 2.8 to 2.9 I have a problem with outside HTML-ACCESS connection.

When I try to connect using a VIP External IP (F5) it takes exactly 300 seconds timeout before the login page appears (welcome page - 300 seconds - login page)

Direct connection via AP works fine. 

But, I have the timeout if only I use IE.Everything forks fine only via Safari. 

I would appreciate if someone can help to understand why the timeout exist and where can I decrease it?

[markbenson]

Well, this is interesting. Just want to confirm a few things. Are you saying:

It's fast when you use IE and bypass the F5.

It's fast when you use Safari via F5 or direct to UAG.

It's only slow with IE and via F5.

If that's the case, can you tell me more about the F5 config. Do you have more than one UAG appliance?

Thanks.

[ALEX_TSM]

Hello markbenson,

thanks for your reply

It's always faster when I use IE or Safari and bypass the F5 - direct to UAG(no timeout, at all)

It's a little bit slower when I use Safary via F5 (10 seconds timeout)

It's takes 300 seconds when I use IE and via F5

It's like forever timeout with Chrome and via F5

I have tested the connections on lot of devices and OS - the result is always the same

Our F5 is configured using Network Address Translation/NAT Configuration

We have two isolated sites (without cloud pod schema deployed) which are using the same F5 (hyperion) and with the same config

One site (A) is working on Horizon 7.0.3 and UAG 2.8 - everything is fine

Another site (B) has been updated to 7.1 and 2.9 - we have had the timeout issue since that (there was no problem with the timeout before the update)

BTW, UAG version 2.8.1 also has the same timeout issue in our case but only with brocker version  7.1 (see below)

Each site has two brokers and two UAG appliances.

UAG has deployed with two nics configuration

On SITE B I have disabled one broker and one UAG to exclude any possible problems with wrong routing on F5

When I put the proxy url of broker from SITE A (7.0.3) into the UAG from SITE B (2.8.1 or 2.9) and trying to connect via F5 SITE B - i have no the timeout issue

That’s why, in my opinion, there is something wrong with brokers on SITE B

[markbenson]

>>It's always faster when I use IE or Safari and bypass the F5 - direct to UAG(no timeout, at all)

Good detail, but I can't answer for F5. I think UAG is fine.

[ALEX_TSM]

Are there any ideas?

I am totally convinced, that there are no any problems on F5 and UAG.

There is something wrong with a new version of the broker - 7.1.

Because, I haven't the same problem when I use the UAG 2.9 and the F5 to connect to the brocker version 7.0.3

[chrisbons02]

var ldapClient = null;

ldapClient = host.getLdapClient();

/* You can use custom base in form 'ou=someuo,dc=somedomain,dc=com' to further limit the search*/

searchBase = host.getHostConfiguration().getLdapBase();

// Find user by login name

// and resolve users mail.

var loginName = Server.getCurrentLdapUser().loginName

    try {

        var username = Server.getCurrentLdapUser().loginName

        System.log(" == Search for user based on userPrincipalName  " +  username );

        entry = ldapClient.searchForEntry(searchBase , LdapSearchScope.SUB, 10000, "(userPrincipalName=" + username + ")");

        if (entry != null ) {

          email = entry.getAttributeValue("mail");

        }

    } catch (e) {

        System.error(e);   

    }

hope this plan of execution could help you!!

[vNEX]

Hi Alex,

can you share with us how you resolve this issue, we are facing exactly the same issue with Horizon 7.2 and UAG 3.3.1 with F5 on the way.

Thanks

[BenFB]

Are you using the F5 Horizon View iApp for the UAG configuration?