Hi!
I'm working on a lab with a Windows 2012R2 and a Fortigate VM64-KVM (trial version) running version 6 (tried 5.6 as well).
When adding the LDAP server to the Fortigate, I always get error LDAP_-5 in red. And I can't get to query against it.
When I debug, I can authenticate against it:
FortiGate-VM64-KVM # diagnose test authserver ldap "LDAP DC-01" user1 testpassword authenticate 'user1' against 'LDAP DC-01' succeeded! Group membership(s) - CN=Domain Admins,CN=Users,DC=fgtad,DC=local CN=Domain Users,CN=Users,DC=fgtad,DC=local
Config:
config user ldap edit "LDAP DC-01" set server "10.10.10.11" set cnid "cn" set dn "dc=fgtad,dc=local" set type regular set username "LDAPconnect" set password ENC ceUtrzALEk7sWZhJjrw1JElXiACZiRxwHScw9Spf2i2Fmr/FGSis8dpC0JyAuuAya/kZ91ECVenukLlLy8xfFyfJZ6hGqheLG5PCIhjVF8aLQxaeWlb8XnPJvR/ZBSIArzHDq+bD34X9fuUO0oraXOJbhOZfshPzCpZzvgJT04fVKhvWtZ3A56yCmgS2VjSVmMh45g== next end
Any ideas?
Thanks!
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
A linux or Windows host :)
e.g
curl.exe -k -v -u "kfelix@example.com" "ldaps://1.1.1.1:636/DC=example,DC=com?cn,objectClass?sub?"
Place your credentials and make sure it pass, make sure a list of DNs are given
PCNSE
NSE
StrongSwan
Can you run a ldapsearch from the ldp-server ( ldp.exe or ldpexplorer or via ldapserach tool )?
Since you can authenticate that means the bind and baseDN are correct.
Also did you run the diagnose commands on the fgt
diagnose debug application fnbamd 255
diag enable
diag test autherver ldap-direct
diag disable
curl -k --tlsv1.2 --verbose -u "mydomain\kfelix" ldaps://10.1.1.2/DC=example,DC=com
PCNSE
NSE
StrongSwan
FortiGate-VM64-KVM # diagnose test authserver ldap-direct 10.10.10.11 LDAP server '10.10.10.11' status is OK
Where do you run curl from ?
A linux or Windows host :)
e.g
curl.exe -k -v -u "kfelix@example.com" "ldaps://1.1.1.1:636/DC=example,DC=com?cn,objectClass?sub?"
Place your credentials and make sure it pass, make sure a list of DNs are given
PCNSE
NSE
StrongSwan
if your windows server is running in VM and its network adapter is bridged to physical adapter( getting ip address from your router DHCP pool) and your FGT-VM is also having ip from the same DHCP.
Here i think the problem is, some ports are blocked by your Router and you can not contact your ldap server.
If you want to practice with it try to use GNS3 VM by installing Wind12or16 and FGT KVM and use lan interface between Wind and FGT.
you can also try to use in field of userid "username@domain.adds"
Kindly try the ff changes.
jfgagnon@synovatec.com wrote:
config user ldap
edit "LDAP DC-01" set server "10.10.10.11" set cnid "sAMAccountName" set dn "dc=fgtad,dc=local" set type regular set username "LDAPconnect@fgtad.local"-----ldapconnect is a username having admin rights? set password ENC ceUtrzALEk7sWZhJjrw1JElXiACZiRxwHScw9Spf2i2Fmr/FGSis8dpC0JyAuuAya/kZ91ECVenukLlLy8xfFyfJZ6hGqheLG5PCIhjVF8aLQxaeWlb8XnPJvR/ZBSIArzHDq+bD34X9fuUO0oraXOJbhOZfshPzCpZzvgJT04fVKhvWtZ3A56yCmgS2VjSVmMh45g== next end
Fortigate Newbie
I'm having the same problem with the ldap_-5. And this happens after an upgrade of a 90D from 5.2.x to 5.6.4.
First the existing ldap gives "Invalid credentials", then after I added a new Ldap, the ldap_-5 shows.
Does anyone else experience this? Is this a bug of 5.6.4 (FGT-90D)?
Thanks!
Try to re-setup ldap password. FOS52 and FOS5.6 use different encryption to save config files.
We're are experiencing the same issue. We upgraded from 5.6 to 6.0 and are now receiving the ldap_-5 error. Did anyone resolve this issue?
Hi
I have Fortinet 90D and last OS version 6.0.4 installed. After update from 6.0.3 my sync LDAP is not working from GUI. What is even more strange everything is working fine from CLI.
This is list of test I run from CLI:
1. execute ping ldap.server OK
2. execute telenet ldap.server 389 OK
3. diagnose test authserver ldap ..... OK
4. Set connection time out to 5000 (default 500) Done
5. diag sniffer packet any "port 636 or 389" .... OK
Config example:
Name: sync Server IP: x.x.x.x Server port: 389 Common Name Identifier: sAMAccountName Distinguished Name: DC=yo,DC=local Bind Type: Regular Username: yoyoyo Password: yoyoyo Secure Connection: no Connection Status: ldap_-5
But when i run connection test from GUI, I get same error like other users said in more then one topic on this forum. Are you going to fix this issue and when?
Thanks
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1712 | |
1093 | |
752 | |
447 | |
231 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.