In my lab environment, I deploye Symantec VIP Enterprise Gateway(EG) and integrated it with a Windows Active Directory domain controller to enable multi-factor authentication (MFA). During the process, I encountered some DNS resolution issues with .local domains on Ubuntu and user lookup issues with LDAP. This article provides the complete steps, from installation to testing login via MyVIP.

1. Prerequisites

• Ubuntu Server 20.04 / 22.04
• Windows Server (Active Directory domain controller with DNS and LDAP enabled)
• A regular AD user account to act as the Bind user, e.g., vip_svc@example.local

2. Install Dependencies

The EG installer requires the following system libraries:

sudo apt update
sudo apt install -y libgcc-s1 libstdc++6 libc6 libnss3 libidn2-0 unzip

Check installation:

dpkg -l | grep -E "libgcc|libstdc|libc6|libnss|libidn2"

3. Install VIP Enterprise Gateway

Log in to VIP Manager → Account → Download Files → Enterprise_Gateway, then download the Linux installer (.tar) for your server.

Extract and run the installer:

tar -xvf VIP_Enterprise_Gateway_9_11_0_LINUX.tar -C /opt/vip-eg
cd /opt/vip-eg
chmod +x *.bin
sudo ./VIP_Enterprise_Gateway_9_11_0.bin -i console

After installation, the EG management console is available at:

https://<EG_IP>:8232/vipui

4. Fix DNS Issues for .local Domains

When the AD domain is example.local, Ubuntu treats .local as mDNS by default, which breaks DNS resolution.

Update Netplan Configuration

Edit /etc/netplan/00-installer-config.yaml:

network:
  version: 2
  ethernets:
    ens192:
      addresses:
        - 172.16.30.121/24
      routes:
        - to: default
          via: 172.16.30.1
      nameservers:
        search: [example.local]
        addresses:
          - 172.16.30.114   # AD DNS
          - 172.16.30.115   # Secondary AD DNS (optional)

Apply changes:

sudo netplan apply

Update systemd-resolved

Edit /etc/systemd/resolved.conf

[Resolve]
DNS=172.16.30.114
Domains=~example.local
LLMNR=no
MulticastDNS=no

Restart service:

sudo systemctl restart systemd-resolved

Verify:

resolvectl query _ldap._tcp.example.local

5. Configure Active Directory

Create a Bind User

On the domain controller:

1. Open Active Directory Users and Computers (ADUC)\
2. Create a user vip_svc
3. Set properties:
   • User logon name: vip_svc@example.local
   • Enable Password never expires

This user only needs read permissions (default for normal users).

Confirm Test User

Example: clientadmin1

• UPN: clientadmin1@example.local
• sAMAccountName: clientadmin1

6. Configure EG User Store

In the EG console:

User Stores → Add

Settings:

• Connection Name: AD01
• Host: 172.16.30.114
• Port: 389\
• User DN: vip_svc@example.local
• Password: Bind user password
• Base DN: DC=example,DC=local

Enable: ✅ Edit Default VIP User Name Attribute → sAMAccountName

User Filter:

(&(&(objectClass=user)(objectCategory=person))(sAMAccountName=%s))

Test user login:

clientadmin1
clientadmin1@example.local

7. Configure Self Service Portal (MyVIP)

Go to:

Identity Providers → Self Service Portal IdP

Key settings:

• My VIP URL: http://<EG_IP>:8233/myvip
• Enable My VIP: Yes
• Redirect SSP to MyVIP: ON

8. Test MyVIP Login

1. Open browser and go to:http://<EG_IP>:8233/myvip
2. Enter AD user credentials:
   • Username: clientadmin1
   • Password: AD password
3. First login → prompted to register a credential (VIP Access App / hardware token)
4. Next logins → require OTP or push approval
5. Once logged in, users can:
   • View/manage their registered credentials
   • Test OTP codes
   • Update MFA settings
   

9. Verifying User Store Synchronization in VIP Manager

Once the User Store is configured in EG and AD authentication works, you can confirm synchronization in VIP Manager:

1. Log in to VIP Manager.
2. Navigate to the Users tab.
3. Search for an AD user that you tested in EG (e.g., clientadmin1).
4. If integration is successful, the user will appear with details such as:
   • Username (from AD)
   • Credential status (e.g., VIP Access app registered or not)