ProCurve 800, Configuration Manual, Page: 345 / 406

7-9
Redundancy and Backup for RADIUS Services
Redundancy
First move to the “modules” section and add ldap < server_name > as a module,
specifying the following parameters for the server:
Add another module for the second server. See Figure 7-4.
In this example configuration,
vmsuse
is the name of the primary LDAP server,
and suse is the name of the secondary LDAP server. The example base
Distinguished Name (DN) is
netidm.net
.
Figure 7-4. radiusd.conf File for Multiple LDAP Servers—Modules Section
Note that, in order to protect users’ credentials, you should require the NAC
800 to negotiate a Transport Layer Security (TLS) connection with the LDAP
servers. Include this parameter in the module for both LDAP servers:
tls_mode = "yes"
Syntax: ldap < server_name > {
server = “< LDAP server’s FQDN >”
identity = “ <administrator’s DN >”
password = “< administrator’s password >”
basedn = “< tree’s base DN >”
filter = “< user login filter >”
base_filter = “< base filter >”
}
modules {
ldap vmsuse {
server = "vmsuse.netidm.net"
identity = "cn=Manager,dc=netidm,dc=net"
password = secret
basedn = "dc=netidm,dc=net"
filter = "(uid=%{Stripped-User-Name:-%{User-Name}})"
base_filter = "(objectclass=radiusprofile)"
tls_mode = "yes"
}
ldap suse {
server = "suse.netidm.net"
identity = "cn=Manager,dc=netidm,dc=net"
password = secret
basedn = "dc=netidm,dc=net"
filter = "(uid=%{Stripped-User-Name:-%{User-Name}})"
base_filter = "(objectclass=radiusprofile)"
tls_mode = "yes"
}