Hello again! We use ADFS on W16 on-prems with EntraID as a relying party trust, AD for Claims. I have a split DNS, 1 VIP in DMZ and 1 VIP in LAN. Same conf, different IP. It's SSL with SNI and header x-ms-forwarded-client-IP. It works fine. Until recently, we want to enable the cert authentication as our second factor scoped by AD group (we avoid paying the P1 license). We use the port 49443 (I know we can also use 443), it's accessible but we get a too many redirects, same request over and over and same 307 from backend. I have the redirects you can find in blogs. I tried SSL_Bridge but I think SSL and SNI are fine. Anyhow I tried. Inject the other headers. I didn't try the adfsprofile, and don't want the SSO on NS or maybe it's needed? Any pointer would be appreciated! Thanks guys

Kind of a rumble they way you explain it. Can you show some CLI commands? Otherwise, packet trace while capturing ssl master keys is your friend to know what the redirect is.

Indeed I was rumbling. I've narrow down the issue, it should be easier to articulate. If I access ADFS via the load balancer (internal VIP), the cert authentication as a second factor on port 49443 end up with the too many redirects. My LB is set with SSL_Bridge, same issue with SSL. Very basic conf. Without the cert as second factor, this conf works, SSL Bridge or not. If I bypass my LB to point straight to the ADFS VM, it works so ADFS conf is good, LB conf is not. Also the external VIP (WAP) is not used in this flow, I shut it down to narrow down the issue and I could still authenticate without the cert as a second factor. I have captured the traffic when issue happens, nothing obvious except than the form submitted by client end up with a redirect from the ADFS, client submit form, redirect, etc. In ADFS log I can see eventID 1000 "An error occured during processing of a token request" for my test user. Hopefully I make more sense. thanks for the help.