This article describes the ideal settings to fix a communication issue from FortiGate to a remote LDAP server when the two are connected through an IPsec VPN.
FortiGate with LDAP servers.
This article assumes the following scenario:
[172.31.128.0/20] ----172.31.128.1 (LAN) 81E-----ipsec vpn --------600C-------[LDAP: 172.31.144.2]
IPsec VPN is configured in both FortiGate-81E and FortiGate-600C.
LDAP server is deployed in the remote network and is reachable to FortiGate-81E via IPsec.
After configuring the LDAP server 172.31.144.2 in FortiGate-81E, the status of the LDAP server connection status shows 'Can't contact LDAP server'.
To fix the issue, edit the LDAP configuration from CLI and set the source IP for the LDAP communication.
# config user ldap
(LDAP)set source-ip 172.31.128.1 <----- The IP used here is the IPsec VPN local interface IP.
Note: Make sure the phase2 selector has a LAN IP address.