How to add the Global Catalog configuration to an LDAP SSO configuration on the LoadMaster
When authenticating to a large forest spanning tens/hundreds of domains, there could be some issues with authenticating users. Some LDAP queries may take too long for the LoadMaster, or there could be a referral sent back to the LoadMaster that must be chased which can cause complexity as well. To get around this issue, there is the option of configuring a Global Catalog (GC) query instead of a standard LDAP query for authentication. Every Global Catalog server has cached entries of every single Active Directory (AD) object in the entire forest, so querying the GC should be a sufficient method of authentication for all users in the forest.
To set this up, you must specify the port for GC queries inside of the Client Side Single Sign On (SSO) Configuration. The port you must specify is 3268. Your LDAP servers should be specified by ip:port, so it would look something like 10.11.12.13:3268. This will do a standard LDAP query but it will query the GC cache instead. LDAP requests will be answered much quicker as well. Below is an example of how this is configured on the LoadMaster:
Certificates and Security > LDAP Configuration > LDAP NAME > Modify
Related KB
How to Configure an LDAP Endpoint