Regression with 7.4.7 over 7.4.3 on Fortigate FGT80F - LDAP no longer works on secondary units

Forum|Forum|1 year ago
January 31, 2025
16 replies
4495 views

Hello!

We just upgraded our FGT80F firewalls from 7.4.3 to 7.4.7 and LDAP no longer works on the secondary units, it only works on the primary units when trying to log on. We have to use the emergency local account if we want to log in the secondary unit.

We have two active passive clusters, and we have the same issue on both clusters, the secondary can only be accessed with the local account.

My teammate found this article, maybe we are hitting this : https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-local-out-traffic-blocked-by-HA-debug-flow/ta-p/198747

But in all cases, I think we should be able to log in using LDAP in the secondary if we need to.

Any ideas to troubleshoot this?

At first sight, we get "local-out traffic, blocked by HA" when trying to do Packet Trace.

Hoping everything is clear, if there's anything, please ask!

Thanks!

Konnan

funkylicious

SuperUser

maybe this, https://community.fortinet.com/t5/FortiGate/Technical-Tip-LDAPS-connections-no-longer-work-after-update-to/ta-p/318021 ?

"jack of all trades, master of none"

KonnanAuthor

Explorer II

I tried it, without success. Thanks for the tip anyway!

KonnanAuthor

Explorer II

Thanks funkylicious! I'll have a look and report back.

What's really curious is that it's working well on both primaries units. I'll double check.

dingjerry_FTNT

Staff

Hi @Konnan ,

If you are using regular LDAP, not LDAPS, you may not have the same issue as the one in that KB.

Please share your HA settings.

KonnanAuthor

Explorer II

Hello @dingjerry_FTNT I tried to share HA settings here with get sys ha stat, maybe my post was lost for some reason. Which settings do you want to look at?

sferoz

Staff

Hi Konnan,
When testing in lab, using LDAP/LDAPS auth for admin users we couldn't able to see an issue on both primary and secondary unit logging after upgrading FGT from 7.4.3 to 7.4.7 in HA A-P. May I confirm the upgrade path had been followed, when upgrading from 7.4.3 to 7.4.7.

Kindly check HA synchronization status and try resetting the LDAPS/LDAP setting’s, for LDAPS once you have CA certificate of the LDAP server imported into the FortiGate, enable the CA cert under conf user ldap settings and verify if the connection status are successful.

If still an issue, please help collect the below logs during LDAP auth login testing:
get sys stat
get sys ha stat
di de config-error-log read
di de crashlog read

Debug:
diagnose debug enable
diagnose debug application fnbamd 255
to stop : diagnose debug application fnbamd 0

Sniffer:
di sniffer packet any "port 389 or port 636" 6 0 l