Load Balancing the Password Portal RRS feed

  • Question

  • All,

    We are planning to load balance three password registration and reset portals that will be used by network and non-network users.  I haven’t found an official guide from Microsoft on how to do this so I wanted to run the scenario by the group to see if anyone could suggest best practices.  I used this document for part of my design solution.

    Business Case:

    Allow end users on the internal network, as well as external remote users not on the network, to register for and reset their network passwords without calling the company help desk.

    Standard Set Up:

    1. We already have connectivity to FIMService so all needed ports are open between portal machines, FIM Service and FIM Sync.
    2. There are three VMs:,,
    3. These machines are available for internal users on the company network as well as external non-network users via reverse proxy
    4. IIS 7.5 installed on the password portal servers and SharePoint is not present
    5. Password and registration portal installed on each machine
    6. Single network adapter and IP  per machine
    7. Single password service account (FIMPassword)
    8. There are three DNS entries for password registration that point to each server, passwordregistration, passwordregistration
    9. There are three DNS entries for password reset  that point to each server, passwordreset, passwordreset
    10. We will have a NLB with the main addresses as passwordreset and passwordregistration in front of the DNS entries
    11. We will set SPNS on FIMPassword passwordregistration1-3  and passwordreset1-3  along with the main passwordreset and passwordregistration addresses
    12. We plan to set up IIS to use the appPool per the document instructions


    1. Based on the game plan above, is this a valid approach to load balance three servers available to both internal and external users?
    2. Are there any other settings that we need to update to make the sites accessible to both network and non-network users?
    3. Any other recommendations for items we might have missed?


    Wednesday, July 24, 2013 2:13 PM

All replies

  • I think you should be fine if you follow these steps. Only thing I might add that it might be safe to configure your NLB for "sticky IP". Meaning once a client is load balanced to a server it will stick to the server. I'm not sure the web browser or FIM client need this, but better safe than sorry. Or do thourough testing with regards to this.

    Personally I'm not a fan of "registering" the serverX names. It only complexifies stuff. Your FIM will ask in various places for "the" URLS. E.g. passwordreset and passwordregistration. YOu might see weird effects if you use a direct URL whilst everything might be just fine.

    If i want to "bypass" the load balancer I prefer modifying MY hosts file so that the "virtual url" points to a dedicated node.

    Wednesday, July 24, 2013 9:43 PM
  • Thanks for the tips Thomas, I will report back if we have any problems otherwise I hope that this post is useful for others.  
    Thursday, July 25, 2013 12:37 PM