Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
jfgagnon
New Contributor II

LDAP Lab - Error ldap_-5

Hi!

 

I'm working on a lab with a Windows 2012R2 and a Fortigate VM64-KVM (trial version) running version 6 (tried 5.6 as well).

When adding the LDAP server to the Fortigate, I always get error LDAP_-5 in red. And I can't get to query against it.

 

When I debug, I can authenticate against it:

FortiGate-VM64-KVM # diagnose test authserver ldap "LDAP DC-01" user1 testpassword authenticate 'user1' against 'LDAP DC-01' succeeded! Group membership(s) - CN=Domain Admins,CN=Users,DC=fgtad,DC=local CN=Domain Users,CN=Users,DC=fgtad,DC=local

 

Config:

 

config user ldap edit "LDAP DC-01" set server "10.10.10.11" set cnid "cn" set dn "dc=fgtad,dc=local" set type regular set username "LDAPconnect" set password ENC ceUtrzALEk7sWZhJjrw1JElXiACZiRxwHScw9Spf2i2Fmr/FGSis8dpC0JyAuuAya/kZ91ECVenukLlLy8xfFyfJZ6hGqheLG5PCIhjVF8aLQxaeWlb8XnPJvR/ZBSIArzHDq+bD34X9fuUO0oraXOJbhOZfshPzCpZzvgJT04fVKhvWtZ3A56yCmgS2VjSVmMh45g== next end

 

Any ideas?

 

Thanks!

 

1 Solution
emnoc
Esteemed Contributor III

A linux or  Windows host :)

 

e.g

 

curl.exe  -k -v -u  "kfelix@example.com"  "ldaps://1.1.1.1:636/DC=example,DC=com?cn,objectClass?sub?"

 

Place your credentials and make sure it pass, make sure a list of  DNs are given

PCNSE 

NSE 

StrongSwan  

View solution in original post

PCNSE NSE StrongSwan
13 REPLIES 13
emnoc
Esteemed Contributor III

Can you run a  ldapsearch from the  ldp-server ( ldp.exe or ldpexplorer  or via  ldapserach  tool )?

 

Since you  can authenticate that means the bind and baseDN are correct. 

 

Also did you run the  diagnose commands on the  fgt

 

  diagnose debug application fnbamd 255

  diag enable

  diag test autherver ldap-direct

  diag disable

  curl -k --tlsv1.2  --verbose -u "mydomain\kfelix" ldaps://10.1.1.2/DC=example,DC=com

 

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
jfgagnon
New Contributor II

FortiGate-VM64-KVM # diagnose test authserver ldap-direct 10.10.10.11 LDAP server '10.10.10.11' status is OK

 

Where do you run curl from ?

emnoc
Esteemed Contributor III

A linux or  Windows host :)

 

e.g

 

curl.exe  -k -v -u  "kfelix@example.com"  "ldaps://1.1.1.1:636/DC=example,DC=com?cn,objectClass?sub?"

 

Place your credentials and make sure it pass, make sure a list of  DNs are given

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
Adam789
New Contributor II

if your windows server is running in VM and its network adapter is bridged to physical adapter( getting ip address from your router DHCP pool) and your FGT-VM is also having ip from the same DHCP. 

Here i think the problem is, some ports are blocked by your Router and you can not contact your ldap server.

 

If you want to practice with it try to use GNS3 VM by installing Wind12or16 and FGT KVM and use lan interface between Wind and FGT.

 

you can also try to use in field  of  userid "username@domain.adds"

 

 

 

Fullmoon
Contributor III

Kindly try the ff changes.

 

jfgagnon@synovatec.com wrote:

 

config user ldap

edit "LDAP DC-01" set server "10.10.10.11" set cnid "sAMAccountName" set dn "dc=fgtad,dc=local" set type regular set username "LDAPconnect@fgtad.local"-----ldapconnect is a username having admin rights? set password ENC ceUtrzALEk7sWZhJjrw1JElXiACZiRxwHScw9Spf2i2Fmr/FGSis8dpC0JyAuuAya/kZ91ECVenukLlLy8xfFyfJZ6hGqheLG5PCIhjVF8aLQxaeWlb8XnPJvR/ZBSIArzHDq+bD34X9fuUO0oraXOJbhOZfshPzCpZzvgJT04fVKhvWtZ3A56yCmgS2VjSVmMh45g== next end

 

Fortigate Newbie

Fortigate Newbie
Pham_Phu_Cuong

I'm having the same problem with the ldap_-5. And this happens after an upgrade of a 90D from 5.2.x to 5.6.4.

First the existing ldap gives "Invalid credentials", then after I added a new Ldap, the ldap_-5 shows.

 

Does anyone else experience this? Is this a bug of 5.6.4 (FGT-90D)?

 

Thanks!

Jeff_FTNT

Try to re-setup ldap password. FOS52 and FOS5.6 use different encryption to save config files.

mseyda
New Contributor

We're are experiencing the same issue. We upgraded from 5.6 to 6.0 and are now receiving the ldap_-5 error. Did anyone resolve this issue?

Harmonikas
New Contributor

Hi

 

I have Fortinet 90D and last OS version 6.0.4 installed. After update from 6.0.3 my sync LDAP is not working from GUI. What is even more strange everything is working fine from CLI.

 

This is list of test I run from CLI:

 

1. execute ping ldap.server OK

2. execute telenet ldap.server 389 OK

3. diagnose test authserver ldap ..... OK

4. Set connection time out to 5000 (default 500) Done

5. diag sniffer packet any "port 636 or 389" .... OK

 

Config example:

 

Name: sync Server IP: x.x.x.x Server port: 389 Common Name Identifier: sAMAccountName Distinguished Name: DC=yo,DC=local Bind Type: Regular Username: yoyoyo Password: yoyoyo Secure Connection: no Connection Status: ldap_-5

 

But when i run connection test from GUI, I get same error like other users said in more then one topic on this forum. Are you going to fix this issue and when?

 

Thanks

 

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors