Skip to main content
Solved

F5 Load Balancing Not Working For Windows Event Forwarding

  • January 16, 2026
  • 5 replies
  • 10 views
N
This message originated from Cribl Community Slack.
Click here to view the original link.

I'll preface this by stating that I've searched the community here, and have seen some rumblings but nothing concrete. Has anyone successfully load balanced Windows Event Forwarding with an F5?

Best answer by steven.daniels584

With a NetScaler, using just a dumb SSL bridge (no X-Forwarded-For) and Kerberos auth. LB mission accomplished, though. P.S. - There's a <#C036BDNCKD0|> channel where you'll find some more details.

5 replies

D
  • dbizon539
  • Employee
  • January 16, 2026
https://cribl.io/blog/scaling-window-event-forwarding-with-a-load-balancer/ This is using the NLB from AWS - but should be able to since 4.2
S
With a NetScaler, using just a dumb SSL bridge (no X-Forwarded-For) and Kerberos auth. LB mission accomplished, though. P.S. - There's a <#C036BDNCKD0|> channel where you'll find some more details.
E
  • edix603
  • New Participant
  • January 16, 2026
We did this with Kerberos authentication and HTTP protocol (we did not use HTTPS because Kerberos provides encryption) On the F5 side, we used a Performance Layer 4 virtual server with TCP protocol. We used a pool with two Cribl Stream Worker Nodes that exist in a Worker Group that has the WEF source configured, and we used a tcp monitor and round robin load balancing that load balances each client session. Here is a detailed write up about how we configured the Kerberos authentication: https://cribl-community.slack.com/archives/C036BDNCKD0/p1767929174172699?thread_ts=1758142724.131859&cid=C036BDNCKD0 In this example worker1.contoso.com is the domain you create in DNS to point to your F5 VIP. Worked like a charm when we set it up in a POV with Cribl. Feel free to ask any questions - happy to help!
N
Thank you @user, was not aware of that channel, so I just joined that !
N
Thanks @user, I appreciate the feedback! I'll make sure to make note of that. Hopefully going to begin testing later this week :slightly_smiling_face:
Terms & ConditionsAccessibility statement