get-ldap-data-failure - LDAP Failover doesn't work

[dramchandani]

-I had two LDAP servers configured with a firewall, the primary LDAP server had an issue with high CPU and memory due to which the firewall lost the group membership though the firewall has L3 reachability.

During the log analysis found that  get-ldap-data-failure from Primary LDAP. 

We manually failed over the LDAP to a secondary one and this resolved the issue but the primary concern is how do we trigger a failover LDAP based on information being missing rather than just L3 reachability. 

In this case, Firewall was not losing any pings to Primary LDAP, it was just not getting the data at the right time.

[PavelK]

Hello @dramchandani

to be honest I do not think that PA Firewall is built for this kind of health check. To address this use case, I would be looking into pointing Firewall to virtual IP address of load balancer and have load balancer to perform health LDAP check queries against LDAP servers. In this case load balancer could take out of service unhealthy server from the server pool.

Kind Regards

Pavel  

[dramchandani]

Hello @PavelK 

Thanks for responding, yes LB makes sense in this case.

The other question I have is, why firewall will lose cached entry? The firewall has LDAP query timer configured as 60 minutes and after 60 min FW will fetch delta configuration from LDAP but in this case, the Firewall lost the complete group membership and there was not a single group entry, why would firewall lose all of the cached/learned entries?

[PavelK]

Hello @dramchandani

thank you for reply.

I see what you mean. Based on my past experience default LDAP query timer never failed me. I do not have answer for this. From your post it looks like you went pretty deep into troubleshooting, but just in case did you have a chance to review logs: tail mp-log authd.log to see what exactly happened?

Kind Regards

Pavel