For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

MikeIs_61713's avatar
MikeIs_61713
Icon for Nimbostratus rankNimbostratus
Aug 03, 2011

Active Directory AAA server failing when just specify the domain name

Hi,     I am trying to setup an Active Directory AAA server on a BIG-IP Edge gateway to use when connecting to a web application. In defining the AAA server, I would just like to give the doma...
app sec
BIG-IP Access Policy Manager (APM)
security
MikeIs_61713's avatar
MikeIs_61713
Icon for Nimbostratus rankNimbostratus
Aug 09, 2011
Solution: The following seemed to fix the problems

1. Allow LDAP UDP through firewall

2. Update /etc/krb5.conf on the BIG-IP to enable dns lookup for the realm and kdc 

 [libdefaults]
           default_realm = EXAMPLE.COM
           dns_lookup_realm = false
           dns_lookup_kdc = false
           ticket_lifetime = 24h
           forwardable = yes

This then impacted AD Queries for authorisation, and we had to ensure that DNS could resolve both
    _kerberos-master._udp
    _kerberos._udp