Zyxel USG FLEX H Series — Configure Search Base DN and Bind DN Base for Active Directory Authentication

When a Zyxel firewall uses Active Directory (AD) for user authentication, the firewall must connect to the AD server and find user accounts correctly.

Two important settings are used for this connection:

• Search Base DN — defines where the firewall searches for user accounts.
• Bind DN Base — defines where the authentication account is located in Active Directory.

This article explains how these settings work and shows two common configuration examples:

1. The user account for Active Directory authentication is located in the default “Users” OU.
2. The user account for Active Directory authentication is not located in the default “Users” OU. In this case, you must configure the optional Bind DN Base setting in Advanced Settings.

Scenario 1 — User Located in the Default “Users” OU

If the user account for Active Directory authentication is located in the default “Users” OU, you do not need to configure the optional Bind DN Base parameter.

In this example, the bind account zyxel_test is stored in the default Users container in Active Directory.

Example:

CN=zyxel_test,OU=IT,DC=example,DC=local

On the Active Directory server:

1. Open:
   • Active Directory Users and Computers
2. Locate the LDAP service account
3. Open:
   • Properties → Attribute Editor
4. Find the attribute:
   • distinguishedName

Configure AAA Server on the Firewall

After verifying the LDAP service account on the Active Directory server, configure the AAA Server profile on the firewall.

1. Go to:

   User & Authentication > User Authentication > AAA Server

2. Click Add to create a new AAA Server profile.
3. Configure the following settings:

4. Click Advanced Settings.
5. Leave the Bind DN Base field empty because the account is located in the default Users container.
6. In the Configuration Validation section:
   • Enter a domain user account
   • Click Test

If the configuration is correct, the firewall will display:

Test Status: OK

The Returned User Attributes section will display the LDAP user information retrieved from the Active Directory server.

Scenario 2 — User Not Located in the Default “Users” OU

If the user account for Active Directory authentication is not located in the default “Users” OU, you must configure the optional Bind DN Base parameter.

In this example, the bind account zyxel_test is stored inside the IT Organizational Unit (OU) in Active Directory.

Example:

CN=zyxel_test,OU=IT,DC=example,DC=local

On the Active Directory Server

1. Open:

   Active Directory Users and Computers

2. Locate the LDAP service account.

3. Open:

   Properties → Attribute Editor

4. Find the attribute:

   distinguishedName

5. Verify that the DN contains the required OU path.

Configure AAA Server on the Firewall

After verifying the Distinguished Name (DN) on the Active Directory server, configure the AAA Server profile on the firewall.

1. Go to:

   User & Authentication > User Authentication > AAA Server

2. Click Add to create a new AAA Server profile.
3. Configure the following settings:

Because the LDAP service account is located outside the default Users container, the firewall cannot automatically determine the correct LDAP search path.

During the configuration validation, the firewall may return the following error:

Test Status: Invalid DN syntax

In this case, you must manually configure the Bind DN Base parameter with the correct Organizational Unit (OU) path.