Fortinet LDAP SSLVPN authentication fails

[Palova]

Hi everyone, 

I have just connected an LDAP server to a fortigate (nothing new) so I can make the customer use the same credentials for connecting to the VPN and RDP. 

Everything works fine, i set the vpn portal, added the VPN LDAP group in the firewall, made the firewall rule and tested the credentials. 

When i try to log in to Forticlient it gives me the usual message where the credentials are wrong. 

I am about to give up and make local firewall users that have same username and password as domain users as a workaround, but it baffles me that i did this many times and never had this problem with other firewalls/Domain controllers. 

The pre exisiting rule that uses local users authenticates just fine. I also tried to include the ldap group in the existing rule, but the problem is the same. 

Any ideas for troubleshooting?

Is there anything i must do on the DC?

Can the Anti-Virus Sentinel One on the DC be the problem (i would not be surprised)? 

[ozkanaltas]

Hello @Palova ,

If you do test credentials in the LDAP configuration menu, what is the result that is successful or not? 

Also, some AD schemes are different than others. Because of that sometimes you need to change for example CN or DN. AD admin needs to tell that. Is there any recommendation from the AD admin?

Also, you can review this document for AD authentication troubleshooting.

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-FortiGate-LDAP/ta-p/196280

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-FortiGate-LDAP-authentication-errors...

[Palova]

Hi @ozkanaltas , 

The authentication method is sAMAccountName, but i also tried cn and the result is the same. 

When I test credentials in the firewall web UI, the message is "successful".

I am the domain admin, so if there are things to check in the DC I can do it. 

Thanks for the quick reply. 

[ozkanaltas]

Hi @Palova ,

Can you run these debug commands on FortiGate and share the output with us? While running these commands you need to try to login ssl-vpn with FortiClient.

diagnose debug disable
diagnose debug reset
diagnose debug application sslvpn -1
diagnose debug application fnbamd -1
diagnose debug enable

[Palova]

Ok, I run the commands and connected to SSLVPN, then disabled debug again and downloaded the debug log file from system settings. I did not really find anything in the thousands of lines in the file. When I went in to the settings I noticed the time zone was wrong (I thought maybe ldap auth needs the times to be the same, like when you try RDP, but it did not make a difference). What I noticed from the system events is a lot of intrusion attempts with different usernames, from who knows who with different public IPs, but that is something i see in almost all firewalls, so i got used to it.

So how can I find these debug lines for sslvpn?

[ozkanaltas]

Hi @Palova ,

You just run previous commands and stay on the CLI page. These commands produce output on the CLI screen. After that, you can copy output from the CLI screen.

You are right, the time difference is an important thing for LDAP authentication. If FortiGate and AD time are different than each other this will cause failed to ldap authentication. 

[Palova]

Here are the logs, i could not see them on the CLI before because i am connected myself with ssl vpn so every test i had to disconnect my user and connect the one who does not work, losing connetion to the firewall. I opened RDP on the server so the firewall session stays alive. I pasted the output on notepad and saw that in looks for the domain with /22 character before and after the CN of the domain, so i removed the " from the connetion to LDAP and tried again. Sadly it did not solve the problem. Anyway I have about 900 lines of debug to send, so how can i send it? Plus i see some informations about the name of the firewall and DC may be sensitive data to show here. How can i send this to you with a certain degree of privacy? 

[ozkanaltas]

Hi @Palova ,

You can mask all sensitive information. Also, I think we don't need all log lines you can send the first 200 lines on the first step.