fh1bw (fh1bw) asked a question.
Hello,
We had an issue the other day where one of two of our internal DNS severs became unavailable. The Okta RADIUS Agent was then failing to get to okta.com in order to process MFA requests. The server the radius agent is on was using the unavailable DNS server as its preferred, but it also had a working alternate DNS server specified.
The radius agent wasn't ever using the alternate DNS server so lookup to okta.com would fail and the MFA request would never get sent, and the login attempt would time out with invalid credentials. Is there any way around this or would it rely on internal code changes to the radius agent itself to basically capture and monitor all DNS servers configured on a server?
EDIT: I found in our logs...
2023-06-17 09:24:15 UTC [CHLOKI01, pool-2-thread-12] : ERROR - HTTP exception raised. Message: This is usually a temporary error during hostname resolution and means that the local server did not receive a response from an authoritative server (insertoktainstancenamehere.okta.com), use proxy: false
java.net.UnknownHostException: This is usually a temporary error during hostname resolution and means that the local server did not receive a response from an authoritative server (insertoktainstancenamehere.okta.com)
...proving the DNS issue, and I hadn't realised that the Okta radius agent is Java based... so where is the built in JRE getting DNS server info from and why isn't it failing back to use the secondary server?
Cheers,
Mark.
Hello @fh1bw (fh1bw) Thank you for reacting out to our Community!
In these cases we recommend to have a failover and deploy the Radius agent on a second server.
For additional info on this please see our article on best practices on deployment:
https://help.okta.com/oie/en-us/Content/Topics/integrations/radius-best-pract-deploy-arch.htm
https://help.okta.com/oie/en-us/Content/Topics/integrations/radius-best-pract.htm
Community members help others by clicking Like or Select as Best on responses. Try it today.
Coming soon: Get tips from community managers during Okta Community's first Ask Me Anything event on 6/22
Best answer? It's not even an answer unfortunately.
The problem is that the Java based Okta Radius Agent is selecting a single DNS server to use from the 2 available on the system. When that DNS server fails, as it did in this case, the agent has no capability to fall back to the alternate DNS server set at a system level. This should be fixed.
I would recommend to reach out to Support to see if there are any other failovers or workarounds on this matter beside the Best practices or maybe would be a Feature Request for the Radius agent, they should be able to provide additional assistance on this matter.
Yes but the 2nd server would have the same 2 DNS servers configured as the 1st