Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
dan
Contributor

LDAP queries not forwarded via IPSec VPN, why?

Might be a simple one for you. Any hint is appreciated.

I have a FGT-60F cluster that has an active LDAP server pointing to an AD server that is located on a local "internal1" interface. This connection works fine. If I do "Test Connectivity", I can see in the packet capture (on internal1) some LDAP bindrequests on port 389. LDAP works perfectly.

 

I want now to add another LDAP Server that is located behind an IPSec VPN. However, the packet capture on the VPN interface does not show any LDAP traffic at all when I do "Test Connectivity". 

 

Routing is correct. Traffic beween local interface and remote network via VPN tunnel is working fine. 

I suspect a policy issue, but I have to admit I am puzzled. Since the fortigate is the originator of the LDAP requests, what do I have to choose for the originating interface in the policy setup?

And why do I not have to setup a policy for the LDAP Server on the internal1 interface?

 

In any case, how would I, step by step, troubleshoot the issue and how would I make it work?

At the end, the LDAP server behind the VPN tunnel should be reachable. 

Am I missing something?

 

Thanks

Dan

 

Networking and such...
Networking and such...
1 Solution
hbac

Hi @dan,

 

Yes, you need to specify the source-ip and that IP must be included in the phase2 selectors. Please refer to https://community.fortinet.com/t5/FortiGate/Technical-Tip-Authentication-with-remote-LDAP-via-site-t...

 

Regards, 

View solution in original post

7 REPLIES 7
dan
Contributor

I might have found the solution, I think...

config user ldap
edit my_ldap_server_2
set source-ip IP_of_internal1_interface

end

 

Am I on the right track?

 

Networking and such...
Networking and such...
AEK

That means the firewall policy on remote FG allows LDAP queries from internal network.

Your solution works even if I prefer changing the policy.

AEK
AEK
dan
Contributor

If I do not set the source-ip, what IP does the LDAP query come from?

 

Networking and such...
Networking and such...
AEK

It depends on the routing table. In your case probably tunnel interface, or you can confirm when you check traffic logs on remote FG.

AEK
AEK
hbac

Hi @dan,

 

Yes, you need to specify the source-ip and that IP must be included in the phase2 selectors. Please refer to https://community.fortinet.com/t5/FortiGate/Technical-Tip-Authentication-with-remote-LDAP-via-site-t...

 

Regards, 

AEK
SuperUser
SuperUser

Check if the traffic generated from FG 60F is blocked by the remote FG. You can see that in remote FG traffic log.

AEK
AEK
dan
Contributor

The remote FG does not see any packets. Well, the local VPN interface does not see any packets either. That's why I suspected a routing issue (nope, it's not= or a policy missing.

For the policy I would need a source address, but i do not know which one. So I give the LDAP setting a source-ip and the standard policy allowing traffic from internal1 to the remote network via the VPN applies..

 

 

Networking and such...
Networking and such...
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors