Firewall is doing ldap query even if identity awareness is disabled

[Gaurav_Pandya]

Hi,

We are getting unnecessary ldap queries to DC from firewall even if we have not enabled identity awareness on that firewall. ldap queries are initiated from firewall and passing through implied rule.

Is there any setting through which we can stop these queries?

[the_rock]

Can you share a screenshot of one of those examples?

[PhoneBoy]

LDAP has been supported by the gateway long before Identity Awareness was a thing.
Legacy authentication schemes (including with Remote Access) can use it.

[Gaurav_Pandya]

Thanks PhoneBoy. 

Is there any way we can stop these queries?

[Wolfgang]

Delete your LDAP account unit if not using.

Wolfgang

[PhoneBoy]

Depends on what is responsible for it.
What precisely is this gateway used for and enforcing access to?
What blades are active?
Maybe check if pdpd and pepd are running on these gateways? 

[Gaurav_Pandya]

We cannot delete LDAP account unit as other firewalls are using it. This firewall is for access control only. No any other blades are active.

[Gaurav_Pandya]

[PhoneBoy]

Even firewall can use LDAP if there are legacy User Auth rules.
Regardless, I recommend engaging with the TAC.

[the_rock]

@PhoneBoy made a good point Gaurav. Can you confirm if pdp and/or pep are running on this gateway? Try ps -auxw | grep pep or pdp and see what shows up. You can even type top from expert mode and see what you get.