NTLM Authentication Loss and Constant 401 Errors After Upgrading to v30.2.7

Products

• VMware Avi Load Balancer

Issue/Introduction

NTLM-authenticated applications lose session and require repeated logins due to a 401 Unauthorized error caused by a change in AVI's connection handling behavior when a non-2xx response is received while the client request body is still in transit.

Environment

Affected Avi version: 30.2.7, 31.x, 32.1.2

Cause

This issue is caused by a recent change in AVI's behavior when handling non-2xx responses (Refer KB https://knowledge.broadcom.com/external/article/437430 ):

• When AVI receives a non-2xx response (e.g., 401 Unauthorized) from the backend server while the client request body is still being uploaded (in transit), AVI now explicitly sets Connection: close and discards any remaining upload data to release the connection cleanly.
• Because the connection is closed upon receiving the 401 response, the NTLM handshake is forced to restart from the beginning.
• The NTLM handshake only fails when the request body is still in transit at the moment the server responds with 401 Unauthorized.
• If there is no remaining data left to upload at the time of the 401 response, the handshake completes successfully.

Resolution

Workaround

Enable Request Body Buffering in the HTTP Application Profile to prevent the connection from being closed mid-handshake.

Steps:

1. Navigate to Templates > Profiles > Application.
2. Create a new HTTP Application Profile or edit an existing one.
3. Locate and enable the checkbox for Enable Request Body Buffering.
4. Save the profile.
5. Ensure the updated profile is attached to the relevant Virtual Service.

NOTE: This workaround is applicable to small Post bodies; and may not be suitable for applications, which work with large Post bodies.

Action Plan/Fix

A permanent fix for this issue is released in 30.2.7-2p1 patch and available to download (refer to release notes Release Notes for VMware Avi LB v30.2.7-2p1), and is also scheduled to be released in the following future versions of Avi LB software: 31.2.x, and 32.1.x

• Subscribe to this article to be updated on the fix status; see Subscribe to a Broadcom knowledge article by article or product 

---

Additional Information

• This issue is specific to NTLM authentication flows where the client sends a request body (e.g., POST requests) as part of the authentication handshake.
• Enabling Request Body Buffering ensures AVI buffers the entire request before forwarding it, preventing premature connection closure during the NTLM negotiation.