Hi Team, I'm having issues getting LDAP group membership checking working with multiple LDAP servers. Here's my config: ldap { server = "${ldap.2} ${ldap.1}" # server = "${ldap.1}" server = "${ldap.3}" server = "${ldap.4}" base_dn = 'DC=thing,DC=local' identity = ${eduroamLDAPAccount.username} password = ${eduroamLDAPAccount.password} user { base_dn = "${..base_dn}" scope = sub filter = "(&(objectclass=user)(sAMAccountName=%{Stripped-User-Name}))" } group { base_dn = "${..base_dn}" filter = "(objectclass=group)" membership_filter = "(member=%{control:Ldap-UserDn})" cacheable_name ='yes' cacheable_dn = 'no' cache_attribute = 'LDAP-Cached-Membership' } options { # ldap_debug = 0x0028 chase_referrals = yes rebind = yes res_timeout = 2 srv_timelimit = 5 net_timeout = 2 } } The issue - we have been having network wobbles + FreeRad crashes out if it can't talk to a LDAP server (we previously only had 1 LDAP server listed), so I'd like it to either round robin LDAP servers or fail over smoothly. All ldap.X server variables are resolvable hostnames (final one is domain, so RR-s round all domain controllers) and the servers work individually (/if I put them at the top of the list). To emulate a network failure I'm using iptables -I INPUT -s <ldap.1 IP> -j DROP (also tried blocking output). With this in place I see netstat -np | grep 389 shows fleeting connections to other LDAP Servers: Working/pre iptables: * tcp 0 91 10.1.18.32:43066 10.1.12.201:389 ESTABLISHED 285161/radiusd blocked/iptables blocking 10.1.12.201 only: * tcp 0 109 10.1.18.32:39856 192.168.7.250:389 ESTABLISHED 285161/radiusd * tcp 0 99 10.1.18.32:43066 10.1.12.201:389 FIN_WAIT1 - * tcp 0 109 10.1.18.32:44864 172.16.2.124:389 ESTABLISHED 285161/radiusd * tcp 0 108 10.1.18.32:39868 192.168.7.250:389 ESTABLISHED 285161/radiusd * tcp 0 0 10.1.18.32:43856 10.1.12.200:389 ESTABLISHED 285161/radiusd (but auths fail/blocked, connections drop, freerad crashes moments later) radiusd -X -C shows: ldap { server = "uks-adds-02.thing.local uks-adds-01.thing.local" identity = edu.check@thing.local<mailto:edu.check@thing.local> password = <<< secret >>> sasl { (So only first server listed?) Choice bits from log file: At startup: Mon May 13 11:59:50 2024 : Warning: - server = 'uks-adds-02.thing.local uks-adds-01.thing.local' Mon May 13 11:59:50 2024 : Warning: + server = 'uks-adds-02.thing.local' Mon May 13 11:59:50 2024 : Warning: + server = 'uks-adds-01.thing.local' (one way or another it knows about multiple servers?) At failure: Mon May 13 11:59:45 2024 : Mon May 13 11:59:39 2024 : Error: (379) Ignoring duplicate packet from client bra-wlc-p01 port 63991 - ID: 15 due to unfinished request in component authenticate module eap_peap (guess this is clients getting impatient?) Error: rlm_ldap (ldap): Bind with edu.check@thing.local<mailto:edu.check@thing.local> to ldap://uks-adds-02.thing.local:389 ldap://uks-adds-01.thing.local:389 ldap://ukw-adds-01.thing.local:389 ldap://thing.local:389 ldap://uks-adds-01.thing.local:389 failed: Timed out while waiting for server to respond (but I know it can talk to all but the first LDAP server) Hope that explains it all adequately... Any ideas what I'm missing here? Thanks, Jim Potter Jisc