USG FLEX H & SSL VPN: Multiple Active Directory auth

fedebros

Hi, I have configured a USG FLEX H with two Active Directory domains. For the SSL VPN, I configured one domain as the primary authentication server and the other as the secondary authentication server.

However, this configuration cannot be set up through the GUI, because the GUI requires at least one of the two authentication methods to be "local".

If I configure both Active Directory domains through the TUI instead, the configuration is accepted and works correctly.

It would be useful to have the same configuration option available through the GUI. Also, if there are no actual technical limitations, it would be great to be able to configure more than two authentication methods.

What do you think? Would it be possible to add this functionality?

Zyxel_Tina

Hi @fedebros,

Regarding this issue, are you referring to the Authentication settings under SSL VPN, where the Primary Server must be set to "local" before you are able to set the Secondary Server to AD?

Also, if your two Active Directory domains are actually the same AD server, we suggest configuring the Backup Server Address field when creating the AAA Server object. This allows you to specify a backup address for the same AD server, which may meet your requirements.

fedebros

Hi Tina, no, I refer to two different Active Directory domains.

Primary and Secondary server appear to be blank in GUI,

but in the config file they are stored correctly and work fine

/ vrf "main" sslvpn-server auth-server "1" "TE……"
/ vrf "main" sslvpn-server auth-server "2" "OL….."

Zyxel_Tina

Hi @fedebros,

Thank you for your information!

Regarding the issue where both servers appear blank in the GUI, could you please enable Zyxel Support Access and provide the org/site names so that we can investigate further?

fedebros

Hi @Zyxel_Tina , sure. It's "Tech S.r.l." in the "HQ" site.

Thank you.

Zyxel_Tina

Hi @fedebros ,

Thank you for granting the access!

After checking with our team, we can confirm that, as shown in the GUI and the User's Guide, SSL VPN currently supports up to two authentication servers, and one of them must be local while the other can be a custom-created server.

In addition, due to the spec and technical limitations, the GUI cannot support configuring two AD servers without local, or more than two authentication servers.

We appreciate your patience and understanding.