topic Re: Captive Portal LDAP Authentication redundancy in General Topics

Captive Portal LDAP Authentication redundancy

JuanAn — Tue, 28 Jan 2020 16:13:10 GMT

Hello.

I have a Captive Portal that uses next Authentication Profile:

CP_Auth

Where:

Authentication Sequence:

CP_Auth - Auth_Mode_1, Auth_Mode_2

Authentication Profile:

Auth_Mode_1 - LDAP_1
Auth_Mode_2 - LDAP_2

LDAP Server Profile:

LDAP_1: 10.10.1.101, 10.10.1.102
LDAP_2: 10.10.2.103, 10.10.2.104

Base on our monitor logs, we noticed that all our authentications are using LDAP Server 10.10.1.101.

A few days ago we detected that server 10.10.1.101 had an issue and we decided to power off the machine.

After that, we were still seeing PA trying to reach this server and not trying to use the second LDAP server (10.10.1.102).

Why was this happending? Shouldn't the firewall have to change to 10.10.1.102 as soon it detects timeout connections?
Is there any way to configure redundancy in case of issue?

Kr.

Re: Captive Portal LDAP Authentication redundancy

fjwcash — Tue, 28 Jan 2020 17:14:04 GMT

Create 4 separate LDAP Server Profiles.

Assign them to 4 separate Authentication Profiles.

List all 4 in the Authentication Sequence.

The LDAP Server Profiles don't fail-through to the next one. It tries the first one, and only if it gets a specific response from it will it try the second one.

The Authentication Sequence is where you list all the servers you want it to try, and the order to try them in. The first one to respond with "allowed" ends the sequence. If none of them return an "allowed" response, then the authentication fails.

Re: Captive Portal LDAP Authentication redundancy

JuanAn — Wed, 29 Jan 2020 16:22:26 GMT

Many thanks for your response.

I don't understand... base on this document

"Configure at least two LDAP servers to provide redundancy"

What kind of redundancy are they referring in the previous document?

What is the condition that triggers the event of using the secondary LDAP?

Is timeout event not enough to triggers that?

Kr.

Re: Captive Portal LDAP Authentication redundancy

fjwcash — Wed, 29 Jan 2020 16:28:24 GMT

The way it was explained to us in the 8.1 training course was along the lines of "the first server in the list to respond after boot is the only one it will use" or something along those lines. The instructor actually questioned why they allow multiple servers to be listed in a single Server Profile when it doesn't actually work the way you expect, but was never able to get a straight answer about it.

If you actually want it to failover to another LDAP server, then you need to use a single server per LDAP Server Profile, and list all of those in an Authentication Sequence.

Re: Captive Portal LDAP Authentication redundancy

JuanAn — Wed, 12 Feb 2020 18:26:32 GMT

Actually, you are wrong.

I recommend you to check this:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClXnCAK

Thanks anyway.