Application Control "Active Directory" not matching

[PaddyCP]

Hello,

We have a new setup (migration from another vendor) and I am segmenting AD traffic into "Client" and "Server" VLAN's. I have created a simple Inline Layer and added "Active Directory" application group but I get no match on LDAP UDP 389 - so basically as soon as a machine tries to join the domain it fails. I then explicitly added the UDP 389 Service and it matches immediately within the same Inline Layer rule.

I have "Applications and URL Filtering" enabled on the Layers but just will not match for me. This is a fairly clean new R80.40 setup and first rule we have used an Application definition in.

No Identity checking etc - just a simple group of Networks for Source and 3 x AD Servers for Destination. 

My fix has been to just add all the required Services explicitly to the Inline Layer rule and had to take out the "Active Directory" group. 

Any ideas or suggestions would be really helpful.

Thanks a mil

Hugh

[PhoneBoy]

That might be worth a TAC case since UDP 389 should be included in the "Active Directory" application definition.

[the_rock]

As phoneboy said, maybe TAC case would be a good idea. Did you confirm if indeed udp 389 is part of the group you added?

Andy

[PaddyCP]

Thanks All.. Yes, double checked all as I just couldn't figure it out and thought I must be missing something or that the Inline Rule wasn't working as expected. Initially I had the "Active Directory" Application Group in the Parent rule so moved that to the Inline rule then but same occurred. As soon as I added the UDP 389 Explicitly it worked. I ended up just adding all the Active Directory Services Explicitly rather than testing to see if it was just an issue with UDP 389 - at that stage I had a colleague on the Domain side testing so many times that I just wanted it working. 

Appreciate the replies. Will let you know how it goes.

Thanks, Hugh

[Marcovb]

Hi, did you happen to talk to TAC about this? I have the exact same thing now (R81.10), UDP/389 traffic is not hitting my "Active Directory" application, while TCP/389 is working fine, among others.