LDAP User Auth Issue

[Jai_Kishore]

Dear Friends, We have issue with LDAP user authantication. We are using Fortigate 620B in this we gone to " User" tab --> " Remote" -->LDAP. We created a new name with ldap_server Server IP - 111.111.111.111 Port - 389 CN - Manager DN - ou=People,dc=example,dc=com using Openldap (Linux) sever we can see all user list from People OU The client system had popup with authantication and we provided username and password. We are reciving message " Firewall Authanticaion Failed." Can any one help me.

[billp]

Jai, What version is your firmware? You need to tell FortiOS the group name that it should use for authentication. I believe in 4.2.x and above, it' s set in the GUI or CLI. In 4.1.x and earlier, it' s only in the CLI and defaults to the container name used for Active Directory. Here' s a code snippet from a KB article:

config user ldap
     edit ldaptest
         set server 10.151.0.35
         set cnid cn
         set dn cn=Users,dc=get,dc=local
         set group cn=Test Users,cn=Builtin,dc=get,dc=local
     next
 end

Let us know if that helps.

[Jai_Kishore]

Dear Billp, FortiOS is 4.0 (MR2 Patch7) I' ve fallowed the same code as KB site.When I enabled the debug it showing error message " event_error[LDAP]: error occurred in read: Connection refused" . Regards, Jai

[ede_pfau]

Could it be that in the LDAP server definition you have set ' Bind Type=Simple' and your LDAP server does not allow anonymous queries? Or you might have configured ' Regular' and not specified a valid LDAP user which is used to connect for querying.

[billp]

FortiOS is 4.0 (MR2 Patch7) I' ve fallowed the same code as KB site.When I enabled the debug it showing error message " event_error[LDAP]: error occurred in read: Connection refused" .

Jai, Judging by the error message, your LDAP server isn' t allowing the connection from the Fortigate. You should download the Softerra LDAP browser and use that to figure out the credentials needed to login to your LDAP server per Ede' s suggestions. That' s the simplest way I' ve found to debug things like this. Once you' ve figured that out and successfully logged into your LDAP tree with Softerra, it will give you the info you need to set up the Fortigate. Softerra has saved me many hours of troubleshooting LDAP connectivity. http://www.ldapbrowser.com/download.htm Download the free LDAP Browser 4.5.

[rwpatterson]

Check the below article. See if it helps: http://support.fortinet.com/forum/tm.asp?m=81337&p=3&tmode=1&smode=1