Troubleshooting Tip: Status of LDAP server connected via IPsec VPN shows 'Can't contact LDAP server'
Description
This article describes the ideal settings to fix a communication issue from FortiGate to a remote LDAP server when the two are connected through an IPsec VPN.
Scope
FortiGate with LDAP servers.
Solution
This article assumes the following scenario:
[172.31.128.0/20] ----172.31.128.1 (LAN) 81E-----ipsec vpn --------600C-------[LDAP: 172.31.144.2]
IPsec VPN is configured in both FortiGate-81E and FortiGate-600C.
LDAP server is deployed in the remote network and is reachable to FortiGate-81E via IPsec.
After configuring the LDAP server 172.31.144.2 in FortiGate-81E, the status of the LDAP server connection shows 'Can't contact LDAP server'.
(ldap)edit LDAP
(LDAP)set source-ip 172.31.128.1 <----- The IP used here is the IPsec VPN local interface IP.
(LDAP)end
Note:
Make sure the phase2 selector has a LAN IP address.
Related articles:
Technical Tip: How to configure FortiGate to use an LDAP server
Troubleshooting Tip: FortiGate LDAP troubleshooting and debug logs created by fnbamd
Technical Tip : Cannot contact LDAP server message when enabled the LDAP over SSL configurations