Skip to main content
dan
dan
Explorer II
February 7, 2024
Solved

LDAP queries not forwarded via IPSec VPN, why?

  • February 7, 2024
  • 2 replies
  • 3145 views

Might be a simple one for you. Any hint is appreciated.

I have a FGT-60F cluster that has an active LDAP server pointing to an AD server that is located on a local "internal1" interface. This connection works fine. If I do "Test Connectivity", I can see in the packet capture (on internal1) some LDAP bindrequests on port 389. LDAP works perfectly.

 

I want now to add another LDAP Server that is located behind an IPSec VPN. However, the packet capture on the VPN interface does not show any LDAP traffic at all when I do "Test Connectivity". 

 

Routing is correct. Traffic beween local interface and remote network via VPN tunnel is working fine. 

I suspect a policy issue, but I have to admit I am puzzled. Since the fortigate is the originator of the LDAP requests, what do I have to choose for the originating interface in the policy setup?

And why do I not have to setup a policy for the LDAP Server on the internal1 interface?

 

In any case, how would I, step by step, troubleshoot the issue and how would I make it work?

At the end, the LDAP server behind the VPN tunnel should be reachable. 

Am I missing something?

 

Thanks

Dan

 

Best answer by hbac

Hi @dan,

 

Yes, you need to specify the source-ip and that IP must be included in the phase2 selectors. Please refer to https://community.fortinet.com/t5/FortiGate/Technical-Tip-Authentication-with-remote-LDAP-via-site-to-site/ta-p/195199

 

Regards, 

2 replies

dan
danAuthor
Explorer II
February 7, 2024

I might have found the solution, I think...

config user ldap
edit my_ldap_server_2
set source-ip IP_of_internal1_interface

end

 

Am I on the right track?

 

AEK
SuperUser
AEK
SuperUser
February 7, 2024

That means the firewall policy on remote FG allows LDAP queries from internal network.

Your solution works even if I prefer changing the policy.

AEK
dan
danAuthor
Explorer II
February 7, 2024

If I do not set the source-ip, what IP does the LDAP query come from?

 

AEK
SuperUser
AEK
SuperUser
February 7, 2024

Check if the traffic generated from FG 60F is blocked by the remote FG. You can see that in remote FG traffic log.

AEK
dan
danAuthor
Explorer II
February 7, 2024

The remote FG does not see any packets. Well, the local VPN interface does not see any packets either. That's why I suspected a routing issue (nope, it's not= or a policy missing.

For the policy I would need a source address, but i do not know which one. So I give the LDAP setting a source-ip and the standard policy allowing traffic from internal1 to the remote network via the VPN applies..

 

 

Terms & ConditionsAccessibility statement