LDAP queries not forwarded via IPSec VPN, why?

[dan]

Might be a simple one for you. Any hint is appreciated.

I have a FGT-60F cluster that has an active LDAP server pointing to an AD server that is located on a local "internal1" interface. This connection works fine. If I do "Test Connectivity", I can see in the packet capture (on internal1) some LDAP bindrequests on port 389. LDAP works perfectly.

I want now to add another LDAP Server that is located behind an IPSec VPN. However, the packet capture on the VPN interface does not show any LDAP traffic at all when I do "Test Connectivity". 

Routing is correct. Traffic beween local interface and remote network via VPN tunnel is working fine. 

I suspect a policy issue, but I have to admit I am puzzled. Since the fortigate is the originator of the LDAP requests, what do I have to choose for the originating interface in the policy setup?

And why do I not have to setup a policy for the LDAP Server on the internal1 interface?

In any case, how would I, step by step, troubleshoot the issue and how would I make it work?

At the end, the LDAP server behind the VPN tunnel should be reachable. 

Am I missing something?

Thanks

Dan

[dan]

I might have found the solution, I think...

config user ldap
edit my_ldap_server_2
set source-ip IP_of_internal1_interface

end

Am I on the right track?

[AEK]

That means the firewall policy on remote FG allows LDAP queries from internal network.

Your solution works even if I prefer changing the policy.

[dan]

If I do not set the source-ip, what IP does the LDAP query come from?

[AEK]

It depends on the routing table. In your case probably tunnel interface, or you can confirm when you check traffic logs on remote FG.

[hbac · Accepted solution]

Hi @dan,

Yes, you need to specify the source-ip and that IP must be included in the phase2 selectors. Please refer to https://community.fortinet.com/t5/FortiGate/Technical-Tip-Authentication-with-remote-LDAP-via-site-t...

Regards, 

[AEK]

Check if the traffic generated from FG 60F is blocked by the remote FG. You can see that in remote FG traffic log.

[dan]

The remote FG does not see any packets. Well, the local VPN interface does not see any packets either. That's why I suspected a routing issue (nope, it's not= or a policy missing.

For the policy I would need a source address, but i do not know which one. So I give the LDAP setting a source-ip and the standard policy allowing traffic from internal1 to the remote network via the VPN applies..