Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
New Contributor

LDAP authentification on HA-Cluster fails

Hi Guys,


i configured LDAP on all our Firewall and it works prefect! We're using 3040B Fortis with Firmware v5.2.13,build762.

The Cluster is  Active-Passive. 


config system ha
    set group-name "fw-CUST"
    set mode a-p
    set password ENC
    set hbdev "wan1" 50 "wan2" 25
    set session-pickup enable
    set ha-mgmt-status enable
    set ha-mgmt-interface "mgmt2"
    set ha-mgmt-interface-gateway
    set override enable
    set override-wait-time 600
    set monitor "mgmt1" "port13" "port24"


config system interface
    edit "mgmt1"
        set vdom "root"
        set ip
        set allowaccess ping https ssh snmp
        set vlanforward enable
        set type physical
        set alias "mgmt-cluster"
        set snmp-index 1
    edit "mgmt2"
        set ip
        set allowaccess ping https ssh snmp
        set vlanforward enable
        set type physical
        set alias "mgmt-CUSA"
        set snmp-index 2

And now my problem, when i hit each Firewall by the common ip, , then i can log in with the LDAP User


BUT when i use the cluster IP... it fails on the Firewall! 


What can i do?


Need help! Cheers Raffa

thanks in advanced Rafael


How about to start with fnbamd debug, packet sniffer to be sure that you are using right LDAP and that LDAP packets flow to and from LDAP server as expected. Also that LDAP responds as expected, as it might limit access from certain subnets/IPs and so maybe cluster IP is not allowed in.

Also, how/where are you trying to login .. SSLVPN , admin GUI etc. ?

Tomas Stribrny - NASDAQ:FTNT - Fortinet stuff - TAC L3 Escalations engineer


thanks tomas,


as i wrote, the LDAP authentification works! the problem is that when i try to login to the firewall through the global cluster address it doesn't work! 


when i connect direkt to the fwA it works! when i connect to FwB it works...when i try to login via the cluster IP --> it doesnt work and i cant see any debug!


i try to connect via the inband managment direct local admin gui, there are no limits...its the admin network!



regards rafael

thanks in advanced Rafael