Otdfbt

I have an issue with Linux clients trying to AD authentication by targeting a DNS name (corp.example.com). I have 2 Domain Controller servers DC1(10.0.0.3/24), DC2(10.1.0.3/24) both domain controllers for corp.example.com. Before starting this each Linux client had 1 of the 2 AD servers IP addresses explicitly defined on it. I went through and replaced the IP address with the Domain name (corp.example.com) as shown below in the configs. Tested it and it works great. However, testing failover by turning off one of the Dome Controller servers renders some Linux clients unable to authenticate and times out. See DC/DNS failover with global/common DNS roundrobin for my originally post when I thought it was an network issue.
On the Linux clients:

/etc/openldap/ldap.conf

 uri ldap://DC1 ldap://DC2
 base dc=corp,dc=example,dc=com

/etc/krb5.conf

[libdefaults]
 default_realm = corp.example.com
 clockskew = 300
 dns_lookup_kdc
# default_realm = EXAMPLE.COM

[realms]
corp.example.com= 
 kdc = corp.example.com
 default_domain = corp.example.com
 kpasswd_server = corp.example.com
 admin_server = corp.example.com

# EXAMPLE.COM = 
# kdc = kerberos.example.com
# admin_server = kerberos.example.com
# 

[logging]
 kdc = FILE:/var/log/krb5/krb5kdc.log
 admin_server = FILE:/var/log/krb5/kadmind.log
 default = SYSLOG:NOTICE:DAEMON
[domain_realm]
 .corp.example.com = corp.example.com
 .corp = corp.example.com
[appdefaults]
pam = 
 ticket_lifetime = 1d
 renew_lifetime = 1d
 forwardable = true
 proxiable = false
 minimum_uid = 1
 external = sshd
 use_shmem = sshd
 clockskew = 300
 retain_after_close = false

/etc/resolve.conf

search corp.example.com
nameserver 10.0.0.3
nameserver 10.1.0.3

This is what I see in the syslog-ng

Nov 30 09:04:56 linux_client nscd: nss_ldap: failed to bind to LDAP server ldap://ad3: Can't contact LDAP server
Nov 30 09:04:59 linux_client sshd[15585]: nss_ldap: failed to bind to LDAP server ldap://ad3: Can't contact LDAP server
Nov 30 08:50:19 linux_client sshd[15242]: Accepted keyboard-interactive/pam for jim from 10.0.0.231 port 61288 ssh2
Nov 30 08:52:02 linux_client sshd[15284]: nss_ldap: could not search LDAP server - Server is unavailable
Nov 30 08:53:09 linux_client sshd[15284]: pam_unix2(sshd:auth): conversation failed
Nov 30 08:53:16 linux_client sshd[15284]: error: ssh_msg_send: write
Nov 30 08:53:26 linux_client sshd[15284]: pam_krb5[15284]: authentication fails for 'jim' (jim@corp.example.com): Authentication failure (Cannot read password)
Nov 30 08:53:26 linux_client sshd[15284]: error: ssh_msg_send: write
Nov 30 08:56:02 linux_client sshd[15289]: nss_ldap: could not search LDAP server - Server is unavailable
Nov 30 08:56:27 linux_client sshd[15289]: pam_krb5[15289]: authentication succeeds for 'jim' (jim@corp.example.com)
Nov 30 08:57:12 linux_client sshd[15289]: nss_ldap: could not search LDAP server - Server is unavailable
Nov 30 08:57:18 linux_client sshd[15289]: _rebind_proc
Nov 30 08:57:31 linux_client sshd[15289]: _rebind_proc
Nov 30 08:57:34 linux_client sshd[15289]: _rebind_proc
Nov 30 08:57:34 linux_client sshd[15289]: pam_ldap: ldap_result Timed out
Nov 30 08:57:34 linux_client sshd[15289]: error: ssh_msg_send: write

I looks like it is not trying the other DCs?

Instead of using DNS to fail-over your domain controllers, /etc/openldap/ldap.conf allows you to use a space separated list of ldap servers. You can still use host names instead of actual IP addresses as well.

For example: URI ldap://dc01.corp.example.com ldap://dc02.corp.example.com

For more information see: http://linux.die.net/man/5/ldap.conf

I also noticed your 2 IP addresses from above are in separate subnets. Make sure your clients have comms to both. You have already looked into network issues so you are probably fine but I wanted to mention it just in case.