Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Palova
New Contributor II

Fortinet LDAP SSLVPN authentication fails

Hi everyone, 

I have just connected an LDAP server to a fortigate (nothing new) so I can make the customer use the same credentials for connecting to the VPN and RDP. 

Everything works fine, i set the vpn portal, added the VPN LDAP group in the firewall, made the firewall rule and tested the credentials. 

When i try to log in to Forticlient it gives me the usual message where the credentials are wrong. 

I am about to give up and make local firewall users that have same username and password as domain users as a workaround, but it baffles me that i did this many times and never had this problem with other firewalls/Domain controllers. 

The pre exisiting rule that uses local users authenticates just fine. I also tried to include the ldap group in the existing rule, but the problem is the same. 

Any ideas for troubleshooting?

Is there anything i must do on the DC?

Can the Anti-Virus Sentinel One on the DC be the problem (i would not be surprised)? 

7 REPLIES 7
ozkanaltas
Valued Contributor III

Hello @Palova ,

 

If you do test credentials in the LDAP configuration menu, what is the result that is successful or not? 

 

Also, some AD schemes are different than others. Because of that sometimes you need to change for example CN or DN. AD admin needs to tell that. Is there any recommendation from the AD admin?

 

Also, you can review this document for AD authentication troubleshooting.

 

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-FortiGate-LDAP/ta-p/196280

 

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-FortiGate-LDAP-authentication-errors...

 

 

 

If you have found a solution, please like and accept it to make it easily accessible to others.
NSE 4-5-6-7 OT Sec - ENT FW
If you have found a solution, please like and accept it to make it easily accessible to others.NSE 4-5-6-7 OT Sec - ENT FW
Palova
New Contributor II

Hi @ozkanaltas , 

The authentication method is sAMAccountName, but i also tried cn and the result is the same. 

When I test credentials in the firewall web UI, the message is "successful".

I am the domain admin, so if there are things to check in the DC I can do it. 

Thanks for the quick reply. 

ozkanaltas
Valued Contributor III

Hi @Palova ,

 

Can you run these debug commands on FortiGate and share the output with us? While running these commands you need to try to login ssl-vpn with FortiClient.

 

diagnose debug disable
diagnose debug reset
diagnose debug application sslvpn -1
diagnose debug application fnbamd -1
diagnose debug enable

 

 

If you have found a solution, please like and accept it to make it easily accessible to others.
NSE 4-5-6-7 OT Sec - ENT FW
If you have found a solution, please like and accept it to make it easily accessible to others.NSE 4-5-6-7 OT Sec - ENT FW
Palova
New Contributor II

Ok, I run the commands and connected to SSLVPN, then disabled debug again and downloaded the debug log file from system settings. I did not really find anything in the thousands of lines in the file. When I went in to the settings I noticed the time zone was wrong (I thought maybe ldap auth needs the times to be the same, like when you try RDP, but it did not make a difference). What I noticed from the system events is a lot of intrusion attempts with different usernames, from who knows who with different public IPs, but that is something i see in almost all firewalls, so i got used to it.

So how can I find these debug lines for sslvpn?

ozkanaltas
Valued Contributor III

Hi @Palova ,

 

You just run previous commands and stay on the CLI page. These commands produce output on the CLI screen. After that, you can copy output from the CLI screen.

 

You are right, the time difference is an important thing for LDAP authentication. If FortiGate and AD time are different than each other this will cause failed to ldap authentication. 

 

If you have found a solution, please like and accept it to make it easily accessible to others.
NSE 4-5-6-7 OT Sec - ENT FW
If you have found a solution, please like and accept it to make it easily accessible to others.NSE 4-5-6-7 OT Sec - ENT FW
Palova
New Contributor II

Here are the logs, i could not see them on the CLI before because i am connected myself with ssl vpn so every test i had to disconnect my user and connect the one who does not work, losing connetion to the firewall. I opened RDP on the server so the firewall session stays alive. I pasted the output on notepad and saw that in looks for the domain with /22 character before and after the CN of the domain, so i removed the " from the connetion to LDAP and tried again. Sadly it did not solve the problem. Anyway I have about 900 lines of debug to send, so how can i send it? Plus i see some informations about the name of the firewall and DC may be sensitive data to show here. How can i send this to you with a certain degree of privacy? 

ozkanaltas
Valued Contributor III

Hi @Palova ,

 

You can mask all sensitive information. Also, I think we don't need all log lines you can send the first 200 lines on the first step. 

If you have found a solution, please like and accept it to make it easily accessible to others.
NSE 4-5-6-7 OT Sec - ENT FW
If you have found a solution, please like and accept it to make it easily accessible to others.NSE 4-5-6-7 OT Sec - ENT FW
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors