Troubleshooting Tip: Status of LDAP server connected via IPsec VPN shows 'Can't contact LDAP server'

[nithincs]

Description

This article describes the ideal settings to fix a communication issue from FortiGate to a remote LDAP server when the two are connected through an IPsec VPN.

Scope

FortiGate with LDAP servers.

Solution

This article assumes the following scenario:
                                                          
[172.31.128.0/20] ----172.31.128.1 (LAN) 81E-----ipsec vpn --------600C-------[LDAP: 172.31.144.2]

IPsec VPN is configured in both FortiGate-81E and FortiGate-600C.
LDAP server is deployed in the remote network and is reachable to FortiGate-81E via IPsec.

After configuring the LDAP server 172.31.144.2 in FortiGate-81E, the status of the LDAP server connection shows 'Can't contact LDAP server'.

To fix the issue, edit the LDAP configuration from the CLI and set the source IP for the LDAP communication.

config  user ldap
(ldap)edit  LDAP
(LDAP)set source-ip 172.31.128.1      <----- The IP used here is the IPsec VPN local interface IP.
(LDAP)end

Note:

Make sure the phase2 selector has a LAN IP address.

Related articles:

Technical Tip: How to configure FortiGate to use an LDAP server

Troubleshooting Tip: FortiGate LDAP troubleshooting and debug logs created by fnbamd

Technical Tip: FortiGate is unable to contact to LDAPS server, receives error message 'Can't contact... 

Technical Tip : Cannot contact LDAP server message when enabled the LDAP over SSL configurations