- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Authentication Manager replica appliance random LDAP errors
We have 2 authentication manager appliances configured. One in our production data center, the other in our DR data center. This has worked well for years.
A couple of months back the replica started sending the following alert via email: Attention! The following critical system event occurred: Failed to connect to LDAP Identity Source (domain controller name)
This is a sporadic event happening throughout the day. I cannot pin it down to a specific time nor anticipate it. It does occasionally cause users to have trouble logging in if they are being serviced by the replica instance and it is having these issues. We receive 2 copies of the email with the error in it each time it happens then it starts working again.
The appliance is installed on a vSphere cluster. I've positioned both the appliance and our domain controller on the same host and still see this issue. I contacted support and they insist it is a network issue but I'm not sure how to troubleshoot this further. They were not helpful at all.
Can we run packet captures on the appliance to the domain controller?
Looking for any advice here. There's no firewalls between the servers. Again running on the same hardware host. The only thing I can think of is that maybe packets are getting dropped when the traffic traverses the switch?
- Tags:
- always DNS
- DC
- dns
- domain controller
- Failed to connect to LDAP Identity Source
- identity source
- network issue
Accepted Solutions
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try reversing the LDAP servers Directory URL with the Directory Failover URL in the Operations Console Identity Source Properties page. Do you still see the error? If so, it is most likely an issue with the domain controller, DNS* or another network issue. Also try switching from the URL to IP address if the issue presents again. If you are still seeing the error, please open a case with support for more detailed troubleshooting.
*It is always DNS 💀
Best regards,
Erica
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try reversing the LDAP servers Directory URL with the Directory Failover URL in the Operations Console Identity Source Properties page. Do you still see the error? If so, it is most likely an issue with the domain controller, DNS* or another network issue. Also try switching from the URL to IP address if the issue presents again. If you are still seeing the error, please open a case with support for more detailed troubleshooting.
*It is always DNS 💀
Best regards,
Erica
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We were getting the error from both DNS servers before and I had removed the secondary as it was pointed at our production site. So I wasn't sure if it was something over the WAN causing an issue. Keep in mind we've had this working for years without issue so I didn't think to try to use the IP instead of the FQDN for the domain controller. So last night I switched to the IP address of the domain controller for LDAP and not a single error message since. I'll take that as a win and thank you for the suggestion!
No idea why DNS would suddenly start giving us issues with this. And yes, it's usually DNS!
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
One other thing to check is connectivity at the replica itself. When you go to the Primary Ops Console and validate the connection config, it only tests from the Primary, even when you click on the replica config button. If you go to the OC of the replica, you can't configure AD but you can test it.
And for the very reasons mentioned above, I always use IP addresses instead of hostnames for AD, because if you lose DNS you lose everything.
