- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
02-25-2020 12:55 PM
Hi All,
I have successfully tested Authentication policy using LDAP, MFA (Okta API), SAML and RADIUS (Okta). I am working on the redundancy scenarios wherein if Okta fails, the fallback would be LDAP. I am using RADIUS (Okta) and LDAP in the Authentication Sequence. I am however unable to get the LDAP (Active Directory) fallback working. I am simulating RADIUS(OKTA) failure by configuring the service route to use the firewall traffic interface and then a security policy to block the RADIUS traffic. I can see that the firewall is successfully blocking RADIUS traffic. I however, want it to proceed to LDAP auth and authenticate considering RADIUS unavailability. I am using default-web-form in the auth policy and CP is set to use the authentication sequence. The authentication logs only show Authentication Failure with the RADIUS server events. What am I missing? Will this config ever work?
02-25-2020 07:37 PM
Just to verify, your security rule is set to drop the traffic and not send a reset correct?
02-26-2020 07:23 AM
i dont think this works on a total failure of the first auth in the sequence, it only seems to work if the first auth returns a "no".
if no response at all then it just times out the entire sequence.
the above happens to me on V8.14 GP portal.
I don't even think it was intended for use with multiple user accounts, it was more designed for a single user account on multiple auth servers with different passwords.
Having said that it still does not work for me if first auth server is down, or in your case... blocked!
02-26-2020 09:13 AM - edited 02-26-2020 09:15 AM
@BPry- Security rule is set to Deny and not Drop or Reset.
@Mick_Ball- Yes, the documentations suggests lookup feature rather than failure.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!