topic Re: Which traffic does LDAP use.? in Spark Firewall (SMB)

Which traffic does LDAP use.?

Aznaz_Reflectio — Wed, 11 Apr 2018 04:56:27 GMT

Hi Checkmates,

I would like to ask about the status for this 1470 firewall.

Regarding the LDAP traffic which is about 40MB.

Does it mean it is using the site to site traffic or some internet connection got ldap protocol?

Thank you.

Re: Which traffic does LDAP use.?

HeikoAnkenbrand — Wed, 11 Apr 2018 05:27:31 GMT

Hi Aznaz,

see Ports Used for Communication by Various Check Point Modules (new version).

Regards

Heiko

Re: Which traffic does LDAP use.?

Pedro_Espindola — Wed, 11 Apr 2018 14:27:23 GMT

Hello Aznaz,

I believe this graphic shows statistics for all the traffic, not only from the internet, so this could be ldap from the site-to-site traffic.

Re: Which traffic does LDAP use.?

Aznaz_Reflectio — Thu, 12 Apr 2018 02:43:26 GMT

Thanks for the information sharing..

Re: Which traffic does LDAP use.?

Aznaz_Reflectio — Thu, 12 Apr 2018 02:44:16 GMT

is there any way for me to verify this.?

Re: Which traffic does LDAP use.?

G_W_Albrecht — Thu, 12 Apr 2018 08:38:10 GMT

That should be possible by checking the LDAP server IP and the VPN community settings. All traffic to the remote site on SMBs goes thru the VPN tunnel, in WebGUI we only can exclude admin access traffic to the gateway by the Advanced Setting > VPN Site to Site global settings - Override 'Route all traffic to remote VPN site' configuration for admin access to the device. Or, you can use a special configuration file, see Locally managed SMBs vpn_table.def file.

Strange is that you are using this 1470 like a 770 - using central management would make it easy to exclude services from VPN, also enable the second processor core and even give you logs with names ...

Re: Which traffic does LDAP use.?

Pedro_Espindola — Thu, 12 Apr 2018 13:43:26 GMT

Do you have accept logs enabled? Hosts using LDAP service usually make connections every few minutes. So checking the logs with the filter "service:ldap" should show you where the traffic is going.

If you see ldap traffic going both to the internet and to VPN sites, then you will not be able to check how much of the 40MB went to each destination. This would only be possible on a central management with SmartEvent.