FG not trying to contact LDAP

[andmag]

Hi!

Running Fortigate 1200D cluster in Vdom mode.

I have configured an LDAP Server and it is no problem browsing the AD from the settings in GUI and Success with the testing function in GUI. Logs in AD see the user login in and do some credential lookup. All good!

But testing with AD-user in CLI totally fails and I see no attempts for FG to log in to AD at all.

Telnet from CLI on port tcp 389 is also successful. I have opened a ticket at Fortinet but it is sloooooow, probably the time difference to Sweden :)

Could we solve this before the official support? :D

-- Debug

## diagnose test authserver ldap ENVDC01 amagnusson XXXXXXXX

[1938] handle_req-Rcvd auth req 1356397311 for amagnusson in ENVDC01 opt=0000001b prot=0 [345] __compose_group_list_from_req-Group 'ENVDC01' [694] fnbamd_pop3_start-amagnusson [976] __fnbamd_cfg_get_ldap_list_by_server-Loading LDAP server 'ENVDC01' [984] resolve_ldap_FQDN-Resolved address 172.16.9.50, result 172.16.9.50 [1352] fnbamd_ldap_init-search filter is: sAMAccountName=amagnusson

[1355] fnbamd_ldap_init-search base is: dc=envirotainer,dc=com

[1495] fnbamd_ldap_start-Error in ldap_sasl_bind [441] ldap_start-Failed to start ldap request for 172.16.9.50 [456] create_auth_session-Error starting authentication [1957] handle_req-Error creating session [180] fnbamd_comm_send_result-Sending result 3 (error 0) for req 1356397311 authenticate 'amagnusson' against 'ENVDC01' failed!

-- Config

config user ldap edit "ENVDC01" set server "172.16.9.50" set cnid "sAMAccountName" set dn "dc=envirotainer,dc=com" set type regular set username "CN=SER081,OU=Service Accounts,OU=Accounts,OU=Envirotainer,DC=envirotainer,DC=com" set password XXXXXXXXXXXXXXXXXXXXXXXXXXX

[emnoc]

I seen this error before "[441] ldap_start-Failed to start ldap request for" when you have a route missing to the target LDAP server or binding to the wrong interface source?

suggestions:

Can you ping the object? Can you confirm your source-ip? Can you set the source-ip ?

NOTE: keep in mind the  diag test command does NOT always follow the set source-ip . I hate this and wish FTNT would fix it. Maybe in v5.10.x FortiOS they will add  switch to select the source address.

I still would suggest when running diag test authserver to have 2 ssh console open and in  one you would run the

diag sniffer packet any "port 389 or 636 "  while running the  diag test cmd .

Ken

[xsilver_FTNT]

I think andmag stated that GUI test button stuff works and LDAP browse via built-in LDAP browser also works from FGT. So it did not seemed to me like connectivity or port issue.

What caught my attention is :  [1495] fnbamd_ldap_start-Error in ldap_sasl_bind

That's why it seemed to me like timeout issue.

More could be seen from fnbamd with timestamps (diag debug console timestamp enable).

And I also guess that LDAP (non-S!) should work smoothly.

[andmag]

Ok, Problem solved.

We run Fortigate in HA and under Global "config system ha", We had configure set ha-direct enable.

This made the LDAP querys from the VDOM to be sent out on the Mgmt1 Interface in the Global VDOM.

[emnoc]

Okay great news, I was not aware of that but now you know where it's originate from.