Authentication Sequence not working

Reply
Highlighted
L4 Transporter

Authentication Sequence not working

Hi All,

 

I have successfully tested Authentication policy using LDAP, MFA (Okta API), SAML and RADIUS (Okta). I am working on the redundancy scenarios wherein if Okta fails, the fallback would be LDAP. I am using RADIUS (Okta) and LDAP in the Authentication Sequence. I am however unable to get the LDAP (Active Directory) fallback working. I am simulating RADIUS(OKTA) failure by configuring the service route to use the firewall traffic interface and then a security policy to block the RADIUS traffic. I can see that the firewall is successfully blocking RADIUS traffic. I however, want it to proceed to LDAP auth and authenticate considering RADIUS unavailability. I am using default-web-form in the auth policy and CP is set to use the authentication sequence. The authentication logs only show Authentication Failure with the RADIUS server events. What am I missing? Will this config ever work?

Cyber Elite

@Sly_Cooper,

Just to verify, your security rule is set to drop the traffic and not send a reset correct? 

Highlighted
L7 Applicator

i dont think this works on a total failure of the first auth in the sequence, it only seems to work if the first auth returns a "no".

if no response at all then it just times out the entire sequence.

 

the above happens to me on V8.14 GP portal.

 

I don't even think it was intended for use with multiple user accounts, it was more designed for a single user account on multiple auth servers with different passwords.

Having said that it still does not work for me if first auth server is down, or in your case... blocked!

 

 

Highlighted
L4 Transporter

@BPry- Security rule is set to Deny and not Drop or Reset.

 

@MickBall- Yes, the documentations suggests lookup feature rather than failure.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!