Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
dethangel
New Contributor

Query failed when querying distinguished name

Hi guys, Facing the following problem: Server / AD is running on Windows 2012. Test connection to AD is successful when I click Test. But clicking on " Query Distinguished Name" button results in a query failed. Below is the code i' m getting:
MIDSTARSG-80C # diag test authserver ldap " Midstar LDAP"  fortinet fortinetuser
 authenticate ' fortinet'  against ' Midstar LDAP'  failed!
 
 MIDSTARSG-80C # fnbamd_fsm.c[1274] handle_req-Rcvd auth req 55902214 for fortinet in Midstar LDAP opt=27 prot=0
 fnbamd_ldap.c[759] resolve_ldap_FQDN-Resolved address 192.168.100.12, result 192.168.100.12
 fnbamd_ldap.c[1451] fnbamd_ldap_get_result-Error in ldap_result: 8 (Strong(er) authentication required)
 fnbamd_ldap.c[1738] fnbamd_ldap_get_result-Auth denied
 fnbamd_auth.c[2074] fnbamd_auth_poll_ldap-Result for ldap svr 192.168.100.12 is denied
 fnbamd_comm.c[116] fnbamd_comm_send_result-Sending result 1 for req 55902214
Any idea what is wrong on my LDAP / AD end since i' ve already tested on a machine on the same local network as the AD to query the LDAP without issue.
3 REPLIES 3
dethangel
New Contributor

Seems the above test by fortinet is using simple bind - and not regular bind. Is there any command that we can use to initiate a test using regular bind as i' m using another server to connect to the LDAP/AD using regular bind without issues.
Dave_Hall
Honored Contributor

ORIGINAL: dethangel Is there any command that we can use to initiate a test using regular bind as i' m using another server to connect to the LDAP/AD using regular bind without issues.
You should be able to set it via the CLI.

NSE4/FMG-VM64/FortiAnalyzer-VM/6.0 (FWF30E/FW92D/FGT200D/FGT101E/FGT81E)/ FAP220B/221C

NSE4/FMG-VM64/FortiAnalyzer-VM/6.0 (FWF30E/FW92D/FGT200D/FGT101E/FGT81E)/ FAP220B/221C
dethangel
New Contributor

Thanks Dave! That' s already been set via CLI. What I meant was a diagnostic test using regular bind not simple bind. Anyhow, we' ve managed to get it working but Windows 2012 is spewing errors on DNS and AD, due to this " mod/hack" , Windows is now reflecting that it is insecure and fortinet support is refusing to help - claiming its third party - kinda silly since its only Fortinet & Windows 2012 talking to one another. Will post the error messages abit later to see whether anyone is able to help on this issue.
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors