topic Re: Firewall is doing ldap query even if identity awareness is disabled in General Topics

Firewall is doing ldap query even if identity awareness is disabled

Gaurav_Pandya — Wed, 12 May 2021 16:26:04 GMT

Hi,

We are getting unnecessary ldap queries to DC from firewall even if we have not enabled identity awareness on that firewall. ldap queries are initiated from firewall and passing through implied rule.

Is there any setting through which we can stop these queries?

Re: Firewall is doing ldap query even if identity awareness is disabled

the_rock — Thu, 13 May 2021 01:44:22 GMT

Can you share a screenshot of one of those examples?

Re: Firewall is doing ldap query even if identity awareness is disabled

PhoneBoy — Thu, 13 May 2021 05:34:35 GMT

LDAP has been supported by the gateway long before Identity Awareness was a thing.
Legacy authentication schemes (including with Remote Access) can use it.

Re: Firewall is doing ldap query even if identity awareness is disabled

Gaurav_Pandya — Thu, 13 May 2021 08:06:04 GMT

Thanks PhoneBoy.

Is there any way we can stop these queries?

Re: Firewall is doing ldap query even if identity awareness is disabled

Wolfgang — Thu, 13 May 2021 20:27:11 GMT

Delete your LDAP account unit if not using.

Wolfgang

Re: Firewall is doing ldap query even if identity awareness is disabled

PhoneBoy — Thu, 13 May 2021 20:30:15 GMT

Depends on what is responsible for it.
What precisely is this gateway used for and enforcing access to?
What blades are active?
Maybe check if pdpd and pepd are running on these gateways?

Re: Firewall is doing ldap query even if identity awareness is disabled

Gaurav_Pandya — Fri, 14 May 2021 08:37:59 GMT

We cannot delete LDAP account unit as other firewalls are using it. This firewall is for access control only. No any other blades are active.

Re: Firewall is doing ldap query even if identity awareness is disabled

Gaurav_Pandya — Fri, 14 May 2021 08:40:28 GMT

Re: Firewall is doing ldap query even if identity awareness is disabled

PhoneBoy — Fri, 14 May 2021 22:12:11 GMT

Even firewall can use LDAP if there are legacy User Auth rules.
Regardless, I recommend engaging with the TAC.

Re: Firewall is doing ldap query even if identity awareness is disabled

the_rock — Fri, 14 May 2021 22:16:35 GMT

@PhoneBoy made a good point Gaurav. Can you confirm if pdp and/or pep are running on this gateway? Try ps -auxw | grep pep or pdp and see what shows up. You can even type top from expert mode and see what you get.