FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
Article Id 195558


This article describes the ideal settings to fix a communication issue from FortiGate to a remote LDAP server when the two are connected through an IPsec VPN.




FortiGate with LDAP servers.



This article assumes the following scenario:
[] ---- (LAN) 81E-----ipsec vpn --------600C-------[LDAP:]

IPsec VPN is configured in both FortiGate-81E and FortiGate-600C.
LDAP server is deployed in the remote network and is reachable to
FortiGate-81E via IPsec.

After configuring the LDAP server in
FortiGate-81E, the status of the LDAP server connection status shows 'Can't contact LDAP server'.

To fix the issue, edit the LDAP configuration from CLI and set the source IP for the LDAP communication.
# config  user ldap
(ldap)edit  LDAP
(LDAP)set source-ip      <----- The IP used here is the IPsec VPN local interface IP.

Note: Make sure the phase2 selector has a LAN IP address.