Description
This article describes the ideal settings to fix a communication issue from FortiGate to a remote LDAP server when the two are connected through an IPsec VPN.
Scope
FortiGate with LDAP servers.
Solution
This article assumes the following scenario:
[172.31.128.0/20] ----172.31.128.1 (LAN) 81E-----ipsec vpn --------600C-------[LDAP: 172.31.144.2]
IPsec VPN is configured in both FortiGate-81E and FortiGate-600C.
LDAP server is deployed in the remote network and is reachable to FortiGate-81E via IPsec.
After configuring the LDAP server 172.31.144.2 in FortiGate-81E, the status of the LDAP server connection status shows 'Can't contact LDAP server'.

(ldap)edit LDAP
(LDAP)set source-ip 172.31.128.1 <----- The IP used here is the IPsec VPN local interface IP.
(LDAP)end
Note: Make sure the phase2 selector has a LAN IP address.