How to Configure the Zyxel AD Server and Join a Windows Server 2025 Active Directory Domain on USG FLEX H Series Firewalls

The USG FLEX H Series provides two different methods for integrating with a directory service for user authentication.

• AD Server – A Zyxel feature designed specifically for Microsoft Active Directory. The firewall joins the Active Directory domain as a domain member (similar to a Windows computer) and communicates directly with the domain.
• LDAP/LDAPS Server – A standard LDAP client that can authenticate users against Microsoft Active Directory as well as other LDAP-compatible directory services, such as OpenLDAP. Unlike the AD Server feature, the firewall does not join the domain and authenticates users through LDAP or LDAPS queries.

This article explains how to configure the Zyxel AD Server feature on a USG FLEX H Series Firewall with Windows Server 2025 Active Directory.

Note: If you prefer to authenticate users using a standard LDAP/LDAPS connection instead of joining the firewall to an Active Directory domain, please refer to the following article:

How to Configure Secure LDAP (LDAPS) Authentication with Windows Server 2025 Active Directory on Zyxel Firewalls (uOS)

Prerequisites

Before starting, ensure that the following requirements are met:

• Zyxel Firewall running uOS 1.39 or later
• Windows Server 2025 with Active Directory Domain Services (AD DS) installed
• DNS is correctly configured, allowing the firewall to resolve the AD domain and Domain Controller
• Network connectivity between the firewall and the Domain Controller
• A Domain Administrator account (or an account with sufficient permissions to join PC to the domain)
• Administrator access to both the firewall and the Windows Server

Why use the Zyxel AD Server feature?

The AD Server feature provides native integration between the Zyxel Firewall and Microsoft Active Directory by allowing the firewall to join the Active Directory domain as a domain member. This simplifies user authentication and enables the firewall to communicate directly with the domain.

After joining the domain, the firewall can use Active Directory users and groups in Security Policy rules, eliminating the need to manage local user accounts and simplifying access control.

Step 1 – Prepare the Active Directory Environment

Before configuring the Zyxel Firewall, ensure that your Active Directory environment is ready for domain integration.

The firewall requires:

• An existing Active Directory domain.
• A Domain Controller that is reachable from the firewall.
• DNS configured so that the firewall can resolve the Active Directory domain and Domain Controller.
• A domain account with permission to join devices to the Active Directory domain (for example, a Domain Administrator account).

Verify that the Domain Controller is accessible from the firewall and note the following information, which will be required during the configuration:

Step 2 – Configure the AD Server

After preparing your Active Directory environment, configure the AD Server on the Zyxel Firewall.

1. Navigate to User & Authentication > User Authentication.
2. Under the AD Server section, click Add.
3. Configure the AD Server using the following settings.

Click Apply to save the configuration.

Note: The Bind DN Base field was introduced in uOS 1.35 and allows the firewall to locate authentication accounts stored in custom Organizational Units (OUs). If the account is located in the default CN=Users container, this field is not required.

Step 3 – Join the Firewall to the Active Directory Domain

After configuring the AD Server, you can join the firewall to the Active Directory domain.

1. Navigate to User & Authentication > User Authentication.
2. Select the configured AD Server entry.
3. Click Join Domain.
4. Verify the displayed domain information.
5. Enter the credentials of a domain account with permission to join devices to the Active Directory domain (for example, a Domain Administrator account).

Click Apply.

The firewall will attempt to join the Active Directory domain using the specified credentials.

If the operation is successful, the Join Domain column displays a green status icon, indicating that the firewall has successfully joined the Active Directory domain.

Note: The account used to join the firewall to the domain must have permission to add devices to the Active Directory domain. A Domain Administrator account can be used by default.

Step 4 – Verify the Firewall in Active Directory

After the firewall successfully joins the Active Directory domain, a computer object is automatically created in Active Directory.

To verify that the firewall has been added successfully:

1. Open Active Directory Users and Computers.
2. Expand your Active Directory domain.
3. Open the Computers container (or the Organizational Unit where new computer objects are created).
4. Verify that the firewall appears as a Computer object.

You can also open the object's Properties to verify details such as the computer name and DNS name.

The presence of the computer object confirms that the firewall has successfully joined the Active Directory domain.

Note: By default, new computer objects are created in the Computers container unless your Active Directory environment is configured to redirect them to a different Organizational Unit (OU)

Step 5 – Validate the AD Server Configuration

After the firewall has successfully joined the Active Directory domain, validate the AD Server configuration to ensure that communication with Active Directory is working correctly.

1. Navigate to User & Authentication > User Authentication.
2. Edit the previously configured AD Server.
3. Scroll down to the Configuration Validation section.
4. Enter the username of an existing Active Directory user.
5. Click Test.

If the validation is successful, the Test Status displays OK, and the Returned User Attributes section lists the LDAP attributes retrieved from Active Directory.

Successful validation confirms that:

• The firewall can communicate with the Domain Controller.
• The firewall can authenticate to Active Directory.
• Active Directory user information can be successfully retrieved.

Note: If the validation fails, verify the Domain Controller connectivity, DNS configuration, domain credentials, and ensure that the specified user exists in Active Directory.

Step 6 – Verify Active Directory Authentication

To verify the AD Server configuration, configure the Remote Access VPN to use the AD Server for authentication and test the connection.

1. Navigate to VPN > IPSec VPN > Remote Access VPN.
2. Select the configured AD Server as the Primary Server.
3. Click Download to download the VPN configuration script.
4. Import the configuration into the SecuExtender VPN Client.
5. Connect to the VPN using an Active Directory user account.

Best Practice for Multi-site Active Directory Deployments

In environments with multiple Active Directory sites or multiple Domain Controllers, configure a Domain Zone Forwarder so that the firewall resolves the Active Directory domain using the local Domain Controller. This helps improve authentication performance and reliability, as the firewall does not automatically follow Active Directory DNS referrals or replication topology.