Source Interface and VRF Support in LDAP

The Source Interface and VRF Support in LDAP feature allows you to configure a dedicated LDAP source interface IP address and virtual routing and forwarding (VRF) details on Cisco Integrated Services Routers (ISR) Generation 2. The source interface address (the address can be an IPv4 or IPv6 address) and VRF details are populated while creating a TCP connection between the Cisco ISR Generation 2 and the LDAP server. This module describes how to configure this feature.

Information About Source Interface and VRF Support in LDAP

Source Interface and VRF Support in LDAP Overview

Prior to the introduction of the Source Interface and VRF Support in LDAP feature, the source interface address cannot be specified in the source IP field of the Lightweight Directory Access Protocol (LDAP) query; instead the tunnel interface IP address was used in the source IP field.

The Source Interface and VRF Support in LDAP feature helps you configure a dedicated LDAP source interface address on a Cisco device. The source interface address is configured on the Cisco device, and the device uses this interface address to originate all LDAP packets it sends to the LDAP server. The source interface address is also used for polling the end-server to ensure the reachability of the end-server.

The source interface IP (either an IPv4 or IPv6 address) address and virtual routing and forwarding (VRF) details are populated in the LDAP query while creating a TCP connection between the Cisco device (client) and the LDAP server.

The VRF instance is configured on the Cisco device and VRF table ID details are set in the socket option before creating a TCP connection to allow multiple instances of a routing table to coexist on the same device at the same time. Because routing instances are independent of each other, the same or overlapping IP address can be used without conflict.

How to Configure Source Interface and VRF Support in LDAP

Configuring LDAP Source Interface and VRF

If you have configured the source interface address and virtual routing and forwarding (VRF) instance under the aaa group server ldap command and in global configuration mode, the configuration under the aaa group server ldap command has the highest priority.

Procedure

  Command or Action Purpose

Step 1

enable

Example:

Device> enable

Enables privileged EXEC mode.

  • Enter your password if prompted.

Step 2

configure terminal

Example:

Device(config)# configure terminal

Enters global configuration mode.

Step 3

aaa new-model

Example:

Device(config)# aaa new-model

Enables the authentication, authorization, and accounting (AAA) access control model.

Step 4

aaa group server ldap group-name

Example:

Device(config)# aaa group server ldap ldap-server-group

Groups different Lightweight Directory Access Protocol (LDAP) servers into distinct lists and methods and enters LDAP server-group configuration mode.

Step 5

{ip | ipv6} ldap source-interface interface-type interface-number

Example:

Device(config-ldap-sg)# ip ldap source-interface gigabitethernet 0/0/0

Specifies the source interface IP address in the LDAP packets.

Step 6

{ip | ipv6} vrf forwarding vrf-name

Example:

Device(config-ldap-sg)# ip vrf forwarding cws-vrf

Configures a VRF reference of a AAA LDAP server group.

Step 7

server name

Example:

Device(config-ldap-sg)# server ldap-server

Specifies the LDAP server.

Step 8

exit

Example:

Device(config-ldap-sg)# exit

Exits LDAP server-group configuration mode and returns to global configuration mode.

Step 9

{ip | ipv6} ldap source-interface interface-type interface-number [vrf vrf-name]

Example:

Device(config)# ip ldap source-interface gigabitethernet 0/1/0 vrf cws-vrf-1

Specifies the source interface IP address in the LDAP packets.

Step 10

end

Example:

Device(config)# end

Exits global configuration mode and returns to privileged EXEC mode.

Configuration Examples for Source Interface and VRF Support in LDAP

Example: Configuring LDAP Source Interface and VRF

Device> enable 
Device(config)# configure terminal
Device(config)# aaa new-model
Device(config)# aaa group server ldap ldap-server-group
Device(config-ldap-sg)# ip ldap source-interface gigabitethernet 0/0/0
Device(config-ldap-sg)# ip vrf forwarding cws-vrf
Device(config-ldap-sg)# server ldap-server
Device(config-ldap-sg)# exit
Device(config)# ip ldap source-interface gigabitethernet 0/1/0 vrf cws-vrf-1
Device(config)# end

Feature History for Source Interface and VRF Support in LDAP

This table provides release and related information for features explained in this module.

These features are available on all releases subsequent to the one they were introduced in, unless noted otherwise.

Release

Feature

Feature Information

Cisco IOS XE Gibraltar 16.11.1

Source Interface and VRF Support in LDAP

The source interface, which can be an IPv4 or IPv6 interface, and virtual routing and forwarding (VRF) details are populated while creating a TCP connection between a Cisco device and the LDAP server.

Use Cisco Feature Navigator to find information about platform and software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn.