Skip to main content
dethangel
New Member
July 26, 2013
Question

Query failed when querying distinguished name

Hi guys, Facing the following problem: Server / AD is running on Windows 2012. Test connection to AD is successful when I click Test. But clicking on " Query Distinguished Name" button results in a query failed. Below is the code i' m getting:
MIDSTARSG-80C # diag test authserver ldap " Midstar LDAP"  fortinet fortinetuser  authenticate ' fortinet'  against ' Midstar LDAP'  failed!    MIDSTARSG-80C # fnbamd_fsm.c[1274] handle_req-Rcvd auth req 55902214 for fortinet in Midstar LDAP opt=27 prot=0  fnbamd_ldap.c[759] resolve_ldap_FQDN-Resolved address 192.168.100.12, result 192.168.100.12  fnbamd_ldap.c[1451] fnbamd_ldap_get_result-Error in ldap_result: 8 (Strong(er) authentication required)  fnbamd_ldap.c[1738] fnbamd_ldap_get_result-Auth denied  fnbamd_auth.c[2074] fnbamd_auth_poll_ldap-Result for ldap svr 192.168.100.12 is denied  fnbamd_comm.c[116] fnbamd_comm_send_result-Sending result 1 for req 55902214
Any idea what is wrong on my LDAP / AD end since i' ve already tested on a machine on the same local network as the AD to query the LDAP without issue.

    3 replies

    dethangel
    dethangelAuthor
    New Member
    July 26, 2013
    Seems the above test by fortinet is using simple bind - and not regular bind. Is there any command that we can use to initiate a test using regular bind as i' m using another server to connect to the LDAP/AD using regular bind without issues.
    Dave_Hall
    New Member
    July 26, 2013
    ORIGINAL: dethangel Is there any command that we can use to initiate a test using regular bind as i' m using another server to connect to the LDAP/AD using regular bind without issues.
    You should be able to set it via the CLI.
    dethangel
    dethangelAuthor
    New Member
    July 28, 2013
    Thanks Dave! That' s already been set via CLI. What I meant was a diagnostic test using regular bind not simple bind. Anyhow, we' ve managed to get it working but Windows 2012 is spewing errors on DNS and AD, due to this " mod/hack" , Windows is now reflecting that it is insecure and fortinet support is refusing to help - claiming its third party - kinda silly since its only Fortinet & Windows 2012 talking to one another. Will post the error messages abit later to see whether anyone is able to help on this issue.
    Thought Leadership. Security Summit. Thursday, November 12th, PGA National Resort, Palm Beach Gardens, FL.
    Thought Leadership. Security Summit. Thursday, October 8th. Disney's Grand Californian Hotel & SPA, Anaheim, CA.
    Security Operations Summit: Modernize SecOps. Operate AI-Native.AMER: November 4 | 9:00 AM PST. India and SAARC: November 5 | 10:00 AM IST. EMEA: November 5 | 10:30 AM CET. APAC: November 5 | 11:00 AM SGT