User LDAP Authentication

[prashanth_rnm]

Hi There,

  I'm pretty new to Fortigate Firewall. I have a requirement to integrate the firewall for LDAP authentication.

Initially I have tried to add the LDAP server and perform the test connectivity and it failed. Later when I checked the firewall I noticed that the LDAP server is not reachable when I use the execute ping command. I have below questions.

[ol]

While trying to reach out to the LDAP server does the firewall by default use the Management interface or will it refer to the routing table and use the traffic interface as per the routing?

I was also trying to perform the test from the Firewall by executing the ping command with the management interface IP address as the source IP address also I noticed that the ping is enabled for the management interface. But the ping command failed from the firewall. I went on to check the switch connected to the management interface and from there I was able to reach the LDAP server by setting the source address to management VLAN interface. In the firewall I received the ping command output as sendto failed. How can I move further on this case.[/ol]

Thanks in Advance

Prashanth

[Fullmoon]

few things to check.

Routing if your FG and AD servers resides on diff vlan/segment

firewall policy

AD windows firewall settings.

[prashanth_rnm]

Thanks for the reply.

Just to confirm incase if I'm adding adding a route to reach the LDAP server via the management interface, still the firewall policy is required to reach the AD server?

Thanks

[Yurisk]

If you mean by Management interface the hardware interface named "mgmt" in the Fortigate, then it is not intended for such a usage - connecting to LDAP, it is meant for out of band access to manage your Fortigate. 

Fortigate will use IP address of the interface which it uses to reach LDAP server according to the routing table. So answer to 1. is "not dedicated Management but regular routing table and interface"

Outbound ping is enabled by default so it will work even without security rules in place. Inbound to Fortigate ping will work when 2 conditions are met:

[ol]

Ping is enabled on the interface you want to ping as administrative protocol

In Trusted Hosts under Admin users the network from which you are trying to ping is allowed (no matter for which user)[/ol]

And lastly - no, you don't need to add security rule for the Fortigate to reach LDAP server. But you do need proper route to reach LDAP. 

[timwardlaw · Accepted solution]

To better control the interface the traffic is coming from I always specify the source IP. 

config user ldap

edit (your server)

set source-ip (interface ip you want the traffic to come out of)

Now as long as that interface has access to where  it is supposed to go you should be able to authenticate.  Also, make sure you know if your ldap server requires secure ldap and that the account you are using to poll that server has the correct access to authenticate other users.

[prashanth_rnm]

Thanks All for your kind help