Technical Tip: Dual Domain Controller for Kerberos Authentication on FortiProxy

1. For a Secondary Domain Controller joined in the domain, the SRV should be replicated on the Secondary Domain Controller or more.
   

   1. Go to Server Manager -> DNS -> HostName.rootdomain -> Forward Lookup Zones -> Root Domain -> TCP -> Look for the file with _kerberos with data [0][100][88].
      
      

2. Double-check on the endpoint that it can see the SRV for the Kerberos on the domain controllers by using the following command:

nslookup -type=SRV _kerberos._tcp.domain.com

It should reflect the IP address of the Domain Controllers.

3. On the secondary Domain Controller, make sure to generate another keytab.

4. In FortiProxy, create another LDAP Server for the secondary Domain Controller.

5. On the Kerberos Tab, replicate the configuration on the first Kerberos configuration for the primary Domain Controller to the secondary Domain Controller to point to the LDAP Server config for the secondary Domain Controller, and upload the keytab generated from step 3.

6. Edit the User Group to include the OUs or Groups from the secondary Domain Controller. The object group on the security policies will be auto-updated.

7. (Optional) Create Domain Controllers for NTLM fallback.

8. On the Policy & Objects -> Authentication Rules -> Authentication Schemes, create an entry for the secondary Domain Controller with the Negotiate Method. (Optional) Again, enable Negotiate NTLM for NTLM fallback and reference the Domain Controller config on Step 8.

9. On the Policy & Objects -> Authentication Rules -> Authentication Rules, create an Authentication Rule for the Secondary Domain Controller.

10. Test Failover and Verify Configuration.

1. Shut down a primary domain controller: Temporarily disable/shut down the Primary Domain Controller to simulate a failure.

2. Test Authentication:

   1. Verify that:

      • Windows and macOS endpoints can still authenticate and access the internet through FortiProxy.

      • FortiProxy recognizes Kerberos tickets issued by the Secondary Domain Controller.
        
        

Note:

Upon testing, the Kerberos ticket is not automatically changed to the Secondary Domain Controller in the scenario that the Primary Domain Controller goes down while the ticket is still active. Once the ticket is expire and the Primary Domain Controller is still down, it will request another ticket from the Secondary Domain Controller.