Troubleshooting Tip: Status of LDAP server connected via IPsec VPN shows 'Can't contact LDAP server'

[nithincs]

Description

This article describes the ideal settings to fix a communication issue from FortiGate to a remote LDAP server when the two are connected through an IPsec VPN.

Scope

FortiGate with LDAP servers.

Solution

This article assumes the following scenario:
                                                          
[172.31.128.0/20] ----172.31.128.1 (LAN) 81E-----ipsec vpn --------600C-------[LDAP: 172.31.144.2]

IPsec VPN is configured in both FortiGate-81E and FortiGate-600C.
LDAP server is deployed in the remote network and is reachable to FortiGate-81E via IPsec.

After configuring the LDAP server 172.31.144.2 in FortiGate-81E, the status of the LDAP server connection status shows 'Can't contact LDAP server'.

To fix the issue, edit the LDAP configuration from CLI and set the source IP for the LDAP communication.

# config  user ldap
(ldap)edit  LDAP
(LDAP)set source-ip 172.31.128.1      <----- The IP used here is the IPsec VPN local interface IP.
(LDAP)end

Note: Make sure the phase2 selector has a LAN IP address.