Fail connect External Connector Active Diretory on Samba 4

[cleytonluis09]

Hi guys,

We have a problem of communication between External Connectors and Active Directory installed on server Samba4.

The configuration in menu LDAP Server is ok. But the status of External Connectors remains disconnected.

[Kush_Patel]

You can follow this article and run the debug commands on CLI to see what error you are getting :

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-FortiGate-cannot-connect-to-Active-D...

[chauhans]

Hello @cleytonluis09 

In FSSO agentless polling mode, FGT will poll the AD-DC on TCP/445 to collect user login events.
One disadvantage of agentless polling is that SMBv1 needs to be allowed for polling on the AD server. Confirm if SMBv1 is enabled:
>> https://learn.microsoft.com/en-US/windows-server/storage/file-server/troubleshoot/detect-enable-and-...)

>>Please check the admin credentials and admin privileges on FGT and on the domain, if possible please try to re-enter the credentials with appropriate admin credentials

>>Also run the commands below and attach the output.

# diag debug application fssod -1
# diag debug application smbcd -1
# diag debug en
To stop:
#diag de dis

Thanks,
Shaleni

[qasimbashir6242]

It seems like you're experiencing issues with connecting External Connectors to your Active Directory on a Samba 4 server. To troubleshoot this problem, consider the following steps:

Check Network Configuration: Ensure that there are no network connectivity issues between the External Connectors and the Samba 4 server. Verify that the necessary ports are open and accessible.

Authentication: Double-check the authentication settings for the External Connectors. Ensure that the credentials being used to connect to the Active Directory are correct and have the necessary permissions.
Firewall Settings: Verify that the firewall on both the Samba 4 server and the machine running the External Connectors is not blocking the communication.
Error Messages: Review any error messages or logs that are generated when attempting to establish the connection. They might provide insights into the root cause of the issue.
Testing Tools: Utilize tools like ldapsearch or ldapclient to manually test the connection to the Active Directory from the External Connectors. This can help identify any specific connectivity problems.
Configuration Consistency: Ensure that the configuration settings for the External Connectors are consistent with the Active Directory setup in terms of domains, users, and groups.
External Connector Configuration: Double-check the configuration settings within the External Connectors themselves. Ensure that they are pointed to the correct server, port, and protocol.
Software Updates: Ensure that both the Samba 4 server and the External Connectors are running the latest versions and updates
Seek Documentation: Consult the documentation for both the External Connectors and Samba 4 for troubleshooting guidance specific to your setup.
Engage Support: If the issue persists, consider reaching out to technical support for both the External Connector software and Samba 4. They may be able to provide further assistance and guidance.

By systematically going through these steps, you can pinpoint the source of the communication problem and work toward a resolution. Remember to document any changes you make and the results of each step for better tracking and analysis.

[asengar]

Hi @cleytonluis09 

Thanks for posting your query

Kindly check are you having the valid route to your AD as the connectivity is not up.

Do verify with the sniffer that traffic is bi-directional or not

Run the below command and share the output

dia sniffer packet any 'host x.x.x.x' 4 0 a    >>> where x.x.x.x is the AD server IP

If you are seeing the traffic flow is bi-directional then kindly collect the below logs

# diag debug reset

# diag debug console timestamp enable
# diag debug application fssod -1

# diag debug app smbcd -1

# diag debug enable

to disable the debugs give command

dia debug disable