Description
This article describes the ideal settings to fix a communication issue from FortiGate to a remote LDAP server when the two are connected through an IPsec VPN.
Scope
FortiGate with LDAP servers.
Solution
This article assumes the following scenario:
[172.31.128.0/20] ----172.31.128.1 (LAN) 81E-----ipsec vpn --------600C-------[LDAP: 172.31.144.2]
IPsec VPN is configured in both FortiGate-81E and FortiGate-600C.
LDAP server is deployed in the remote network and is reachable to FortiGate-81E via IPsec.
After configuring the LDAP server 172.31.144.2 in FortiGate-81E, the status of the LDAP server connection status shows 'Can't contact LDAP server'.
To fix the issue, edit the LDAP configuration from CLI and set the source IP for the LDAP communication.
# config user ldap
(ldap)edit LDAP
(LDAP)set source-ip 172.31.128.1 <----- The IP used here is the IPsec VPN local interface IP.
(LDAP)end
(ldap)edit LDAP
(LDAP)set source-ip 172.31.128.1 <----- The IP used here is the IPsec VPN local interface IP.
(LDAP)end
Note: Make sure the phase2 selector has a LAN IP address.
