Skip to main content
lecarbajal
lecarbajal
New Member
April 26, 2017
Question

Invalid LDAP server: Timed out |and | Invalid LDAP server: Can't contact LDAP server

  • April 26, 2017
  • 2 replies
  • 14121 views

Hi,

 

We have a fortigate 100C running 5.4 code, we want to setup a secondary ldap server  ( backup) for ssl users, when we try to connect the ldap ( over a vpn tunnel) we for the below error message

 

Invalid LDAP server: Timed out |and | Invalid LDAP server: Can't contact LDAP server

 

We are not blocking the traffic ( all permit ports/ips)  what could be the problem? I tried to reach the server from the firewall but need to specify a source ip otherwise the ping is not working. 

 

thank you,

    2 replies

    Jeff_FTNT
    Staff
    Jeff_FTNT
    Staff
    May 4, 2017

    You may to increase ldap timeout.  Default value is 500 milliseconds

    config system global

    set ldapconntimeout xxx

    end

    andmag
    andmag
    New Member
    May 11, 2017

    Hi!

     

    The FG uses public ip for your WAN-Interface so you need to put that in crypto for the VPN-Tunnel. Don´t forget host/sunbnet for the LDAP-Server on the remote side :)

     

    emnoc
    emnoc
    New Member
    May 12, 2017

    Negative, you don't have to do that. Just  apply the source ip address that's allowed over the vpn-tunnel

     

    e.g

    config user ldap

        edit "TESTAD"

            set server "10.12.1.1"

            set secondary-server ''

            set tertiary-server ''

            set source-ip 10.10.10.1

            set cnid "cn"

            set dn ''

            set type simple

            set group-member-check user-attr

            set secure disable

            set port 389

            set password-expiry-warning disable

            set password-renewal disable

            set member-attr "memberOf"

            unset search-type

        next

    end

     

     

    in this case 10.0.10.1 would be my  fortigate inside lan address, loop,etc....

     

    Ken

    akatzkac
    akatzkac
    New Member
    June 26, 2017

    Emnoc's source-ip assignment did the trick for me.

    Terms & ConditionsAccessibility statement