Secure communication between LDAP and Fortigate

[sandeep_fgt]

Hi Guys,

Is anyone using the communication between Fortigate and LDAP over SSL. I would like to move the configuration from default to SSL so that there is secure communication between the components. Please suggest if there will be any downtime in moving the configuration which I want to achieve?

Thanks in advance!

Regards,

Sandeep Jha

[xsilver_FTNT]

Hello,

IF the config is done right then there is NO downtime at all. LDAP server can be set to LDAPs already, communication in both LDAP and LDAPs. And then just set certs and LDAPs on FGT side.

As I said, if done properly it will start to work instantly.

Best regards, Tomas

[sandeep_fgt]

Great! 

Thanks for quick response Tomas!!! Appreciate it 

I will do the configuration..

Regards,

Sandeep Jha

[sandeep_fgt]

Hi Tomas,

I was doing this in my lab but having issues setting it up. Do you have any idea where to import the certificate (downloaded from Fortigate) in LDAP server to make this working?

Please note that I am using Windows 2008 Server as LDAP server.

Thanks,

Sandeep Jha

[sandeep_fgt]

Hello Friends,

Have anyone configured the secure LDAP in Fortigate? If yes, can you please confirm if below procedure is right-

1. Tick the LDAPS option in GUI (over port 636) 

2. Select the Fortinet CA certificate and select OK.

3. Import the Fortinet CA certificate in trusted root certificate at LDAP Server.

4. Test the connection between LDAP server and Fortigate using SSL.

I am not that good at certificate management, so please confirm if this is fine?

Thanks,

Sandeep Jha

[piyanut_FTNT]

Hi, 

You have to make sure your ldap server have enabled ldaps,  normally enabling ldaps requires certificate that mean you must have CA.  In this point very important thing is CA's certificate, you have to export this certificate from your CA some case it built-in on your Ldap server then import this certificate to your FGT  then configure ldaps on FGT with username password  that have permission to query users on your LDAP server. 

step to export CA's Certificate  [link]https://support.microsoft.com/en-us/kb/555252[/link]

Thank you,

Piyanut

[sandeep_fgt]

Thanks for the details. Do you have reference document on how to enable the LDAPS on the server? 

Regards,

Sandeep Jha

[piyanut_FTNT]

Sorry for this. I never done it before on enable ldaps server  but I done success  connect FGT with ldaps server followed step I have posted.   I suggest easy way to try checking  port 636 enabled or not then try to export certificate follow step in below link,

https://support.microsoft.com/en-us/kb/555252

Regards,

Piyanut

[sandeep_fgt]

No problem. Thanks for confirming the steps..I will ask Server managing guy to enable LDAPS and would import CA into Fortigate. :)

Thanks,

Sandeep Jha