topic Checking LDAPS connections in General Topics

Checking LDAPS connections

Hugo_vd_Kooij — Mon, 06 Nov 2017 15:48:43 GMT

I have a challenge of finding LDAPS traffic from 2 IP ranges and see if anything pops up on the firwall. Like a stale session or ......

We have some undetermined authentication issues and I am not sure if the firewall is to blame of the hoster (being the LDAPS client) or the Domain server.

I know I am stuck to TCP analyses only as it is is SSL traffic.

Re: Checking LDAPS connections

Vladimir — Tue, 07 Nov 2017 01:18:04 GMT

Have you looked at this?

https://support.microsoft.com/en-us/help/938703/how-to-troubleshoot-ldap-over-ssl-connection-problems

Re: Checking LDAPS connections

Timothy_Hall — Tue, 07 Nov 2017 02:52:49 GMT

Try turning on TCP state logging which will show you how the LDAPS connections are ending (gracefully/FIN, non-gracefully/RST, or timed out by firewall):

sk101221: TCP state logging

Can be easily enabled from the SmartConsole for R80+, on R77.30 or earlier it has to be done from the gateway command line.

--
My book "Max Power: Check Point Firewall Performance Optimization"
now available via http://maxpowerfirewalls.com.