topic Re: After Upgrading R81 LDAPS communiction stops working in Firewall and Security Management

After Upgrading R81 LDAPS communiction stops working

Harmesh_Yadav — Sat, 06 Mar 2021 03:55:52 GMT

Dear Team ,

WE have MGMT at HO location (VM) which we have recently upgraded from R80.30 to R81

And some branch location Security Gateways also we have upgraded To r81 from R80.30

HUB and Spoke topology - Star VPN is working properly earlier and after R81 some time we are getting disconnection issue .

Also I want to create User based Policy and want add user group in Access role for which i am getting error .

I am enabling LDAPS and trying to fetch certificate but getting error

"Faild to connect to LDAP server connection failed

Traffic we can see from MGMT to Server till Branch Gateway after we are not getting traffic and in log -VPN encryption showing decryption not showing

Please give us idea if anyone have same issue .

Regards,

Harmesh Yadav

9978440755

Re: After Upgrading R81 LDAPS communiction stops working

Harmesh_Yadav — Thu, 04 Mar 2021 05:10:46 GMT

Dear Team ,

I am waiting for your reply it will be very helpful

Re: After Upgrading R81 LDAPS communiction stops working

Gabe_Flynn — Fri, 04 Jun 2021 18:22:18 GMT

I know this is late, but as I recently ran across the issue after an upgrade I wanted to share what I found to fix my LDAPS issue.

After upgrading to R80.40 from R80.10 I was no longer able to fetch the fingerprints from the LDAPS servers.

Looking in the logs, the connection attempt from the SMS to the remote LDAP servers was not being sent across the site-to-site VPN. Instead, it was being NAT'd out to the public IP address and attempting to reach the private IP address of the remote LDAP server.

It turns out, the LDAP service was hitting the implied rule for routing and never making it to the explicit rule to use the VPN connection. This is by design and can be changed using the SK and references below.

***** The change does not survive a major upgrade. *****

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk26059&partition=Advanced&product=IPSec

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92281