<![CDATA[Redundant LDAP servers]]>I'm running pfSense 2.2.1 in a couple different locations with AD environments. All of these environments, of course, have multiple DCs. What I'd like to do is to be able to specify multiple servers for login auth, etc. That way, if the DC that I've pointed pfSense at goes down or is unavailable, then pfSense is still available for login. As it stands right now, when I reboot the DC that pfSense LDAPs against, I cannot login to the firewall.

Additionally, this would be nice for OpenVPN too… :)

If this is a current feature, please let me know how to do it. :) If not, maybe move this to feature requests.

Thanks!

]]>https://forum.netgate.com/topic/82002/redundant-ldap-serversRSS for NodeWed, 22 Apr 2026 17:03:53 GMTSat, 28 Mar 2015 14:06:01 GMT60<![CDATA[Reply to Redundant LDAP servers on Sat, 02 May 2015 06:55:30 GMT]]>Yes, you could. You don't by default and that's all that matters, pretty much. Good luck convincing those unfortunate guys that need to mess with AD CA to mess with the templates.

]]>https://forum.netgate.com/post/541478https://forum.netgate.com/post/541478Sat, 02 May 2015 06:55:30 GMT<![CDATA[Reply to Redundant LDAP servers on Sat, 02 May 2015 00:40:10 GMT]]>i didn't know the LDAP client was smart enough to try multiple servers if it got more than one A record from DNS.

Couldn't you get SSL Certificates with the DC FQDN plus the AD domain name as a SAN in each server?

]]>https://forum.netgate.com/post/541461https://forum.netgate.com/post/541461Sat, 02 May 2015 00:40:10 GMT<![CDATA[Reply to Redundant LDAP servers on Fri, 01 May 2015 22:09:11 GMT]]>@pan_2:

You already have all necessary redundancy built-in. Provide AD domain name in "LDAP Server name", not some DCs FQDN.

Well that actually completely fails at least when SSL is involved.

]]>https://forum.netgate.com/post/541440https://forum.netgate.com/post/541440Fri, 01 May 2015 22:09:11 GMT<![CDATA[Reply to Redundant LDAP servers on Fri, 01 May 2015 21:10:52 GMT]]>You already have all necessary redundancy built-in. Provide AD domain name in "LDAP Server name", not some DCs FQDN.

]]>https://forum.netgate.com/post/541433https://forum.netgate.com/post/541433Fri, 01 May 2015 21:10:52 GMT<![CDATA[Reply to Redundant LDAP servers on Wed, 01 Apr 2015 14:03:08 GMT]]>No such thing for WebGUI. For OpenVPN, you are able to select multiple LDAP servers for auth, using the CTRL key. Whether it works or not, no idea.

]]>https://forum.netgate.com/post/532982https://forum.netgate.com/post/532982Wed, 01 Apr 2015 14:03:08 GMT<![CDATA[Reply to Redundant LDAP servers on Wed, 01 Apr 2015 13:44:33 GMT]]>Bump?

]]>https://forum.netgate.com/post/532975https://forum.netgate.com/post/532975Wed, 01 Apr 2015 13:44:33 GMT