Explorer III

Solved

Querying the same remote LDAP servers via FortiGate and FortiAuthenticator (FAC)

Forum|Forum|27 days ago
July 14, 2026
5 replies
89 views

Hi everyone,
On my FortiGate running v7.4.9, I have a specific VDOM configured for one of my clients.

Currently, this VDOM is integrated with a FortiAuthenticator (FAC), which in turn queries two remote LDAP servers to handle MFA for client VPNs.

I now need to configure these same two remote LDAP servers directly on the FortiGate (under User & Authentication -> LDAP Servers) so I can use Active Directory groups in our firewall policies.

I would like to know if there are any specific best practices to follow, and I have a couple of questions:

LDAP Query Load: Are these two remote LDAP servers at risk of being overloaded with too many queries due to this dual integration (FAC for VPN + FortiGate direct for security policies) ?

Cache Management: Would you recommend enabling and tuning the cache on the FortiGate (increasing `set cache-ttl` to 300 or higher) ?
If so, what is your recommended value for a production environment ?

Thanks in advance to everyone for any advice or insights !

Best answer by sjoshi

Hi @Mandalorian

When creating LDAP server objects on the FortiGate under User & Authentication > LDAP Servers, configure a separate, least-privilege service account (bind DN) rather than reusing the credentials that FortiAuthenticator (FAC) uses. This provides audit separation in Active Directory logs.

After creating the LDAP server objects, build Firewall user groups under User & Authentication > User Groups. Add the LDAP server as a Remote Group member, optionally limited to specific AD groups by their distinguished name (DN)

If you need redundancy for the two LDAP servers, do not create two separate LDAP entries and add both to the same user group.

config user ldap  
edit "<ldap-server-name>"  
set server "10.0.0.10"  
set secondary-server "10.0.0.11"  
set cnid "sAMAccountName"  
set dn "dc=yourdomain,dc=local"  
set type regular  
set username "yourdomain\\serviceaccount"  
set password <password>  
next  
end

sjoshiAnswer

Staff

Hi @Mandalorian

When creating LDAP server objects on the FortiGate under User & Authentication > LDAP Servers, configure a separate, least-privilege service account (bind DN) rather than reusing the credentials that FortiAuthenticator (FAC) uses. This provides audit separation in Active Directory logs.

After creating the LDAP server objects, build Firewall user groups under User & Authentication > User Groups. Add the LDAP server as a Remote Group member, optionally limited to specific AD groups by their distinguished name (DN)

If you need redundancy for the two LDAP servers, do not create two separate LDAP entries and add both to the same user group.

config user ldap  
edit "<ldap-server-name>"  
set server "10.0.0.10"  
set secondary-server "10.0.0.11"  
set cnid "sAMAccountName"  
set dn "dc=yourdomain,dc=local"  
set type regular  
set username "yourdomain\\serviceaccount"  
set password <password>  
next  
end

Thanks, Salon

MandalorianAuthor

Explorer III

Hi sjoshi,
Thanks for your reply !

We followed your suggestions. Below are some questions.

To clarify, the two LDAP servers refer to two distinct domains.
Therefore, under User & Authentication -> LDAP Servers, we created the two separate objects and, as you suggested, created two Firewall Groups containing the domain group objects.

The only remaining question regarding the VPN user policies (Firewall Policy) is whether we can use the Firewall Group with LDAP member as the object instead of FortiAuthenticator (see screenshot below).

Finally, in my situation, is it useful to modify the cache of the respective LDAP servers ?
Would you recommend enabling and tuning the cache on the FortiGate, increasing `set cache-ttl` to 300 or higher ?

Best Regards,
This is the way...

"This is the way"

sjoshi

Staff

yes you can use the ldap user group instead of fac group

for cache, I do not recommend changing the default value

Thanks, Salon

henry-collins

Visitor III

Running the LDAP servers on both the FortiAuthenticator and FortiGate is a pretty common setup, and in most environments the extra LDAP traffic is minimal unless you're dealing with a very large number of users or frequent policy lookups. Leave the cache settings at their defaults unless you actually see performance issues. If you do need to tune it, a cache TTL around 300 seconds is a reasonable starting point.

Full-Stack Developer | SEO Strategist | Helping users with software & troubleshooting solutions.

MandalorianAuthor

Explorer III

Hi @henry-collins,

Thanks for the reply.
For the moment, we are keeping the default cache value at 300 seconds.

Best Regards,
This is the way...

"This is the way"

Sign up

Login with SSO

Login to the community

Login with SSO