LDAPS Fingerprints and Proxy

[John_Richards]

Our client has a SMS server in Azure in it's own segregated network. It manages both on-site and Azure GW's with no issue (communicates via the Azure public IP). They were using LDAPS for VPN authentication which was working fine. It appears that the fingerprints changed on the AD servers and we need to update them on the SMS. Normally the SMS does not need to communicate with AD, just the GW's, but apparently the SMS does have to communicate when updating the Fingerprints. We tried to enable "Management Server needs proxy to reach AD server" but this did not help with the Fingerprints. Does anyone know how you can update the Fingerprints if the SMS cannot talk to AD directly? We turned off LDAPS, pushed policy, and the users could authenticate using AD. Turn on LDAPS and it fails.

[PhoneBoy]

I would think you could update the fingerprint manually with the correct value.
Might be worth a TAC case to ask if there's a way to do that.

[Tobias_Moritz]

Yes, you can update it manually. What Check Point expects here, is the MD5 fingerprint of the LDAP server cert. You can query it manually from a client which can reach the LDAP server using openssl. When running from the gateway (Gaia Expert Shell), use cpopenssl instead of openssl:

LDAP with Start-TLS:

echo | openssl s_client -connect servername:389 -starttls ldap | openssl x509 -noout -fingerprint -md5

LDAPS:

echo | openssl s_client -connect servername:636 | openssl x509 -noout -fingerprint -md5

In case you don't want/need certificate pinning and let the gateways just accept any LDAP server cert, you can leave the fingerprint string input field empty. Never tried it myself, but another CheckMate recently confirmed this is working.

[JozkoMrkvicka]

If the fingerprint is empty (blank) the firewall will accept all fingerprints. It is like "any" in rule 😄 and works perfectly. You dont need to fetch new fingerprint once cert on LDAP is changed.

[John_Richards]

I have attached a screen shot of the configuration for LDAPS. So to be clear, you are saying the I do not need anything in the Fingerprints area? I would enable "Use Encryption (SSL), clear the information in the Fingerprints box, save and push policy?

[Piet_vd_Maas]

You can leave the Fingerprint blank even using SSL

[Matt_Taber]

Thank you for this.   We had written a script to check LDAPS cert fingerprints in policy to what the servers were presenting and then alert when there's a mismatch.  Before we knew this was happening, we were down to 1 DC (out of 6) that didn't have a fingerprint mismatch.   IA was on the brink of disaster.   Good to know we can just *NOT* have a fingerprint in there.

[JozkoMrkvicka]

Yes.

[John_Richards]

So I was able to clear the fingerprint field and enabled ldap-ssl. Users can now change their passwords using VPN. The odd thing is I see a few ldap-ssl connections using port 636 from the FW to the DC in the logs. Then I see users authenticating to VPN and the port is 389 (not 636). Is this normal or is there a way to force the authentication to use ldap-ssl? Thanks

[JozkoMrkvicka]

How many LDAP servers are you using for redundancy ? You can configure many LDAP servers and every LDAP server can use different LDAP port (636 or 389). Check your LDAP Account Units for this one.

If LDAP with highest priority is not answering, second one in priority list is contacted.

[John_Richards]

All servers are set to use ldap-ssl and there are only 2 servers. I am meeting with CP on Monday to discuss and get more information. Will provide an update.

[John_Richards]

I finally met with an Identity Awareness expert on this. Basically using LDAP-SSL creates a tunnel back to AD and all auth goes over this tunnel. You will still see regular LDAP traffic. MS does claim that the fingerprint should rarely, if ever change. This is not what we see with our customers who use LDAP-SSL and Identity Awareness. Would be nice if Check Point would document "NOT" needing the fingerprint along with a good explanation as to why.