topic Re: changing AD password with RA client in SASE and Remote Access

changing AD password with RA client

konix78 — Tue, 12 Apr 2022 14:13:31 GMT

I am trying to configure possibility for changing AD password with VPN RA client and it is working fine in my lab but is not working on production. I use SMS 81.10 in lab and 80.40 in production, both are configure in the same way, the only difference that I see is on the screenshots. In the lab I don't have option "Use User Directory for security gateways (license required) . What license is required and why do I see this only in one global properties if I run the same blades on both? also can I tick this option without any negative consequences to check if it starts working ?

thanks

Re: changing AD password with RA client

Chris_Atkinson — Tue, 12 Apr 2022 15:52:04 GMT

To confirm is LDAPS TCP/636 configured & used in both environments?

Do you see CPSB-UDIR in the output of "cplic print" on your Prod management?

Re: changing AD password with RA client

Wolfgang — Tue, 12 Apr 2022 16:25:33 GMT

@konix78 you have to configure everything exactly following How to configure password change after expiration (LDAP) for Mobile Access and Remote Access clients check twice your ldap account unit settings and the changes done via GUIdbedit.

Re: changing AD password with RA client

konix78 — Wed, 20 Apr 2022 09:38:01 GMT

Hi Chris

I apologize for delay , that's information that I collected

1) license CPSB-UDIR exists on LAB Mgmt srv but doesn't exist on Prodo MGMT

2) cpopenssl s_client -connect IP:636
both FW show obtained certificate and show status connected

3) on both MGMT srvs I CAN'T fetch fingerprints

4 test_ad_connectivity

LAB
[Expert@Checkpoint-GW-1:0]# cat $FWDIR/tmp/test3.txt
(
:status (SUCCESS_LDAP_WMI)
:err_msg ("ADLOG_SUCCESS;LDAP_SUCCESS")
:ldap_status (LDAP_SUCCESS)
:wmi_status (ADLOG_SUCCESS)

Prodo
[Expert@b-fw01:0]# cat $FWDIR/tmp/test2.txt
(
:status (SUCCESS_WMI)
:err_msg ("ADLOG_SUCCESS;LDAP_PROTOCOL_ERROR")
:ldap_status (LDAP_PROTOCOL_ERROR)
:wmi_status (ADLOG_SUCCESS)

Re: changing AD password with RA client

G_W_Albrecht — Wed, 20 Apr 2022 12:40:06 GMT

So that is the issue - the CPSB-UDIR license is missing. You should check the license using cplic print for CPSB-UDIR feature, old licenses (>5years) may not contain the CPSB-UDIR - for this reason, the customers can still order a CPSB-UDIR license only to upgrade his legacy license.