F5 ARX-VE, Planning Manual

Page: 42 / 64

Chapter 1
Site Planning
1 - 36
Figure 1.12 ARX® as a resource proxy between clients and servers
Kerberos authentication simplifies security management: all ACLs on all
servers can remain the same, and all clients retain the same rights and
restrictions that they had before inserting the ARX. This proxy mechanism,
called
delegation in Windows terminology, is possible with Kerberos but
not with NTLM.
Required Administrative Privileges
Special administrative privileges are required to join an F5 front-end CIFS
server (
F5 server ) to an AD domain. The domain-join operation has two
major steps: add the F5 server to the AD domain and raise the “Trusted for
Delegation” flag for the server. Each of these steps requires a distinct
administrative privilege:
• “Add workstations to domain” (where the “workstation” is the F5
server), and
• “Enable computer and user accounts to be trusted for delegation.”
An administrator in the Domain Admins group has both of these privileges.
You need the username and password of one of these administrators to join
an F5 server to an AD domain.
Note
Trusting an F5 server for delegation poses no security threat to your
network. Kerberos authentication was designed with delegation in mind to
provide a clean way of carrying identity through n-tiered application
systems. For more information, refer to IETF RFC 1510 or the Microsoft
servers
DC
clients