Authentication Sequence not working

[Sly_Cooper]

Hi All,

I have successfully tested Authentication policy using LDAP, MFA (Okta API), SAML and RADIUS (Okta). I am working on the redundancy scenarios wherein if Okta fails, the fallback would be LDAP. I am using RADIUS (Okta) and LDAP in the Authentication Sequence. I am however unable to get the LDAP (Active Directory) fallback working. I am simulating RADIUS(OKTA) failure by configuring the service route to use the firewall traffic interface and then a security policy to block the RADIUS traffic. I can see that the firewall is successfully blocking RADIUS traffic. I however, want it to proceed to LDAP auth and authenticate considering RADIUS unavailability. I am using default-web-form in the auth policy and CP is set to use the authentication sequence. The authentication logs only show Authentication Failure with the RADIUS server events. What am I missing? Will this config ever work?

[BPry]

@Sly_Cooper,

Just to verify, your security rule is set to drop the traffic and not send a reset correct? 

[Mick_Ball]

i dont think this works on a total failure of the first auth in the sequence, it only seems to work if the first auth returns a "no".

if no response at all then it just times out the entire sequence.

the above happens to me on V8.14 GP portal.

I don't even think it was intended for use with multiple user accounts, it was more designed for a single user account on multiple auth servers with different passwords.

Having said that it still does not work for me if first auth server is down, or in your case... blocked!

[Sly_Cooper]

@BPry- Security rule is set to Deny and not Drop or Reset.

@Mick_Ball- Yes, the documentations suggests lookup feature rather than failure.