topic How to use multiple interfaces for same ldap server in aaa-server in Network Access Control

How to use multiple interfaces for same ldap server in aaa-server

Departamento TI — Sat, 22 Feb 2020 07:40:56 GMT

Hello, all!

I'm currently using DUO to authenticate VPN users, using LDAP connector.

DUO just provides 1 hostname to access their LDAP server, and I want to use redundant internet interfaces to access this.

I already have a setup with SLA and track to enable/disable routes based on network availability, but in aaa-server configuration, I need to specify an interface, and all my redundancy is gone for authentication.

I tried to set another aaa-server entry with same hostname and another interface, but ASA just ignores...

Any ideas on how to use

See configuration example below:

aaa-server Duo-LDAP (outside) host api-XXXXXXXXXXX.duosecurity.com
timeout 180
server-port 636
ldap-base-dn dc=XXXXXXXXXXX,dc=duosecurity,dc=com
ldap-naming-attribute cn
ldap-login-password XXXXXXXXXXX
ldap-login-dn dc=XXXXXXXXXXX,dc=duosecurity,dc=com
ldap-over-ssl enable
server-type auto-detect

Re: How to use multiple interfaces for same ldap server in aaa-server

c.registration — Wed, 28 Mar 2018 13:58:03 GMT

Did you come up with a fix for this?

Re: How to use multiple interfaces for same ldap server in aaa-server

Octavian Szolga — Wed, 28 Mar 2018 19:34:22 GMT

Hi,

If configuring a seconary LDAP for the same server doesn't work, I think that your last option would be to use EEM. Watch for LDAP unavailable log to configure a new LDAP server connection 🙂

Thanks,

Octavian

Re: How to use multiple interfaces for same ldap server in aaa-server

j.a.m.e.s — Mon, 24 Oct 2022 09:08:21 GMT

This isn't a direct solution, but it may be an alternative strategy. I found this in the v9.18 release notes:

Loopback interface support for BGP and management traffic

You could potentially create a BGP peering with your network, configure a loopback (with a name) on the ASA and redistribute it into BGP. Then bind the aaa-server group to the loopback.

I haven't tested this, but it looks like a feasible option for using the same LDAP servers via multiple physical interfaces.