SSL VPN Connection Error with LDAP

[RolandBaumgaertner72]

Hi,

last week we updated our FG cluster to FG200F with 7.4.5.

We had some problems but in general it seems quite OK. Only with SSL VPN we still have problems and we cnat get it functioning.

1. Connecting with Local User it works fine, I get the certificate window and I can login, no prob!
2. User from LDAP, connection to LDAP works fine, I can even test my credentials and OK but than connecting to the SSL VPN I dont geht the ceretificate pop up and after 48% I get Permission denied and -455

We did the same as in all other FGs. We imported the same remote certificate and everywhere it works. We checked groups and everything and it should be OK.

In System Events VPN I get:
Action ssl-login-fail
Reason sslvpn_login_unknown_user

What else can we try? It seems like the FG is not checking the certificate and we try with "Require Client certificate" and without and no change 

Thanks!

[RyanGunn]

https://community.fortinet.com/t5/FortiGate/Technical-Tip-LDAPS-STARTTLS-certificate-issuer-enforcem...

This was the answer for our firewall. Had to import the root CA for the domain.

[RolandBaumgaertner72]

Hi,

we still have some strange behavior but now on all our FGs. We got support via remote from Fortinet and connecting and testing it worked just fine. We didnt change anything from our side but it is possible that our main headquarter changed something on the DCs. So after that we suddenly had problems (we use the same cert in all FGs) on other FGs who suddenly could not connect to the LDAP.

Today, all of them work fine. Why? I dont know....

Thanks

[RolandBaumgaertner72 · Accepted solution]

Hi,

we had a remote session with the TAC and trying out it worked. We checked all the configuration and it was and it is fine....so not really knowing what happened.

Thanks

[mr_vaughn]

I had the same issue on 7.4.7. Changed the LDAP from LDAPS/636 back to LDAP/389 and now it works!

[mr_vaughn]

This is not a solution.
We have the same issue on 7.4.7 on 70F.
LDAP works fine.
just enabling LDAPS fails ONLY on ssl VPN auth. Tests on the LDAPS for server connection and user tests work perfectly.

We found this in the logs

2025-02-27 09:12:51 [1371] __ldap_tcps_connect-tcps_connect(10.0.20.167) failed: ssl_connect() failed: 167772294 (error:0A000086:SSL routines::certificate verify failed).

2025-02-27 09:12:51 [1677] __ldap_error-Ret 5, st = 0.
2025-02-27 09:12:51 [1714] __ldap_error-
2025-02-27 09:12:51 [1518] __ldap_tcps_close-closed.
2025-02-27 09:12:51 [1602] __ldap_conn_stop-Stop ldap conn timer.
2025-02-27 09:12:51 [2633] fnbamd_ldap_result-Error (5) for req 1052331671556

Seems there is an enforcement on the cert only when using SSL VPN auth.

We have also imported the public cert of the self signed to the FGT and it still fails.

We cannot select the import DC Self cert to verify or have the option to set server-identity-check enabled. BUT I have confirmed the set server-identity-check disable is in place.