USG FLEX H & SSL VPN: Multiple Active Directory auth

Options
fedebros
fedebros Posts: 23
First Comment Friend Collector
image  Freshman Member
in Security

Hi, I have configured a USG FLEX H with two Active Directory domains. For the SSL VPN, I configured one domain as the primary authentication server and the other as the secondary authentication server.

However, this configuration cannot be set up through the GUI, because the GUI requires at least one of the two authentication methods to be "local".

If I configure both Active Directory domains through the TUI instead, the configuration is accepted and works correctly.

It would be useful to have the same configuration option available through the GUI. Also, if there are no actual technical limitations, it would be great to be able to configure more than two authentication methods.

What do you think? Would it be possible to add this functionality?

All Replies

  • Zyxel_Tina
    Zyxel_Tina Posts: 1,010
    Zyxel Certified Network Administrator - Security Zyxel Certified Network Administrator - Switch 250 Answers 500 Comments
    image  Zyxel Employee
    Options

    Hi @fedebros,

    Regarding this issue, are you referring to the Authentication settings under SSL VPN, where the Primary Server must be set to "local" before you are able to set the Secondary Server to AD?

    image.png

    Also, if your two Active Directory domains are actually the same AD server, we suggest configuring the Backup Server Address field when creating the AAA Server object. This allows you to specify a backup address for the same AD server, which may meet your requirements.

    image.png

    Zyxel Tina

  • fedebros
    fedebros Posts: 23
    First Comment Friend Collector
    image  Freshman Member
    Options

    Hi Tina, no, I refer to two different Active Directory domains.

    image.png

    Primary and Secondary server appear to be blank in GUI,

    image.png

    but in the config file they are stored correctly and work fine

    / vrf "main" sslvpn-server auth-server "1" "TE……"
    / vrf "main" sslvpn-server auth-server "2" "OL….."

  • Zyxel_Tina
    Zyxel_Tina Posts: 1,010
    Zyxel Certified Network Administrator - Security Zyxel Certified Network Administrator - Switch 250 Answers 500 Comments
    image  Zyxel Employee
    Options

    Hi @fedebros,

    Thank you for your information!

    Regarding the issue where both servers appear blank in the GUI, could you please enable Zyxel Support Access and provide the org/site names so that we can investigate further?

    Zyxel Tina

  • fedebros
    fedebros Posts: 23
    First Comment Friend Collector
    image  Freshman Member
    Options

    Hi @Zyxel_Tina , sure. It's "Tech S.r.l." in the "HQ" site.

    Thank you.

Categories

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）