Hello, I’m very new to haproxy, managed to get a working configuration by combining a week of Googling and surfing the web.
The one issue I have is OA - RPC over HTTPS is not working on L7 configuration.
Outlook 2010 won’t connect. The only error I get is Can’t connect to Exchange, mailbox unavailable (pardon, don’t recall the excact error) , outlook logging stops after autodiscover and nothing in the logs, seems like it won’t connect to the DAG.
haproxy version 2.0.8 on Debian Buster, Exchange 2016 (migrated from 2010), all the namespaces point to mail.domain.com, had a round robin DNS (yeah I know it’s 2019) which worked , won’t say perfectly but decently on the non caching ISPs, the caching ones…
hence haproxy…
snipped config :
ssl-default-bind-options no-sslv3
ssl-default-bind-ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS
ssl-default-server-options no-sslv3
ssl-default-server-ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS
tune.ssl.default-dh-param 2048
defaults
mode http
log global
option httplog
option dontlognull
option forwardfor except 127.0.0.0/8
option redispatch
option contstats
retries 3
timeout http-request 10s
timeout queue 1m
timeout connect 10s
timeout client 15m # this value should be rather high with Exchange
timeout server 15m # this value should be rather high with Exchange
timeout http-keep-alive 10s
timeout check 10s
maxconn 100000
frontend fe_ex2016
http-response set-header X-Frame-Options SAMEORIGIN
http-response set-header X-Content-Type-Options nosniff
mode http
bind 1.2.3.4:80
bind aaa:bbb:cccc:dddd::30:80 transparent
bind 1.2.3.4:443 ssl crt /etc/ssl/certs/exchange.pem
bind aaa:bbbb:cccc:dddd::30:443 transparent ssl crt /etc/ssl/certs/exchange.pem
redirect scheme https code 301 if !{ ssl_fc } # redirect 80 -> 443 (for owa)
acl autodiscover url_beg /Autodiscover
acl autodiscover url_beg /autodiscover
acl mapi url_beg /mapi
acl rpc url_beg /rpc/rpcproxy.dll
acl owa url_beg /owa
acl owa url_beg /OWA
acl eas url_beg /Microsoft-Server-ActiveSync
acl ecp url_beg /ecp
acl ews url_beg /EWS
acl ews url_beg /ews
acl oab url_beg /OAB
use_backend be_ex2016_autodiscover if autodiscover
use_backend be_ex2016_mapi if mapi
use_backend be_ex2016_rpc if rpc
option accept-invalid-http-request
use_backend be_ex2016_owa if owa
use_backend be_ex2016_eas if eas
use_backend be_ex2016_ecp if ecp
use_backend be_ex2016_ews if ews
use_backend be_ex2016_oab if oab
default_backend be_ex2016
backend be_ex2016_rpc
mode http
balance roundrobin
option httpchk GET /rpc/healthcheck.htm
option log-health-checks
http-check expect status 200
server exch1 2.3.4.5:443 check ssl inter 15s verify required ca-file /etc/ssl/certs/ca-certificates.crt
server exch2 2.3.4.5:443 check ssl inter 15s verify required ca-file /etc/ssl/certs/ca-certificates.crt
the things I’ve tried so far:
acl rpc url_beg /rpc/ -> acl rpc url_beg /rpc/rpcproxy.dll
ssl-default-bind-ciphers added ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES
and to the fe
option accept-invalid-http-request
haven’t taken this to production, tests been made offsite with hosts file, on the FW I have opened 443 to the VIP of haproxy.
Any and all help much appreciated, maybe I’ve been just staring at this for too long and can’t see the forest for the trees…
