Forum Discussion

Chatan_Mistry_1's avatar
Chatan_Mistry_1
Icon for Nimbostratus rankNimbostratus
Jan 10, 2007

FirePass 4100 with multple AD authorisation

Hi!

 

 

I am stuck! I currently have a clustered FirePass environment using v5.5. We use RSA authentication, with AD authorisation against a single domain - we use the AD groups to identify waht resources the user has access to.

 

 

However, we want to expand the solution to cover multiple AD domains (in multiple forests). I know thaty v6 support fallback master groups, but I don't think this will work as the time required to cycle through the fallback groups would result in the RSA passcode timing out.

 

 

Does anyone have any suggestions on how to approach this? (please?!)

 

 

Chatan
BIG-IP Access Policy Manager (APM)
remote access
security
  • Matt_60535's avatar
    Matt_60535
    Icon for Nimbostratus rankNimbostratus
    Apr 04, 2007
    I'm in the same boat. I have a failover FirePass environment using v5.5 but about to upgrade to 6.0. Our environment has multiple AD domains and we have a requirement to use dynamic mapping of resource groups that cover those multiple AD domains. Is there any way to dynamically map resource groups to multiple AD domains? If not, is FirePass coming out with a version that supports this in the future?
  • Fuzz_31058's avatar
    Fuzz_31058
    Icon for Nimbostratus rankNimbostratus
    Apr 04, 2007
    I think you are correct that this is not a supported configuration today. You should contact Support and open a CR (Change Request). The more people that call in and have a ticket tied to the CR the more likely it is to get implemented. You can also engage your local sales team to help drive the CR.

     

     

    HTH

     

    Fuzz

     

  • Fuzz_31058's avatar
    Fuzz_31058
    Icon for Nimbostratus rankNimbostratus
    Apr 04, 2007
    Just another thought, If you only have two AD domains you could possibly create a second Master group with NTLM instead of AD and then use that for the dynamic resource group mapping. If you have more then 2 domains you will need to open the CR.

     

     

    HTH

     

    Fuzz

     

  • psilvas's avatar
    psilvas
    Icon for Altostratus rankAltostratus
    Apr 09, 2007
    You are correct. Currently AD forests are not supported but we are working to add this in the next feature (6.02) release.
  • Melvin_Tan_6033's avatar
    Melvin_Tan_6033
    Icon for Nimbostratus rankNimbostratus
    May 13, 2008
    Dear all,

     

     

    I am facing some issues with multiple domain authentication with dynamic group mapping and dynamic resource mapping. With the forest mode enabled in version 6.0.2, my users will be required to login using UPN mode.

     

     

    And i need to point a certain group of user to authenticate using RSA 2-factor authentication.

     

     

    However, the authentication with upn login is not recognized by RSA as it forward the full upn string (username@domain.com) to RSA. As RSA does not remove the realm info, it is unable to authenticate the user, thus returning a failed authentication.

     

     

    Can i check is there any workaround for such setup?

     

     

    Thanks,

     

    Melvin