Using LDAPS 636 for AD query Identity Awareness

[Salom_Idhogela]

Hi All,

I want to enable LDAPS port 636 for Identity Awareness for may gateways in a cluster, current it works with LDAP. Is it possible in Checkpoint?

Regards,

Salom

[M_Soler]

Yes you can, go to Object Catégories>Users/identities> LDAP Account Units chose your LDAP server and go to Servers (like in the screenshot) chose your host server and configure the Encryption.

Note: you need to have LDAPS activated in your LDAP server.

Regards,
M_Soler

[Salom_Idhogela]

A cert might be required on the CP, how do I do that?

Regards,

Salom

[M_Soler]

No certificate needed, Check Point firewall validates the certificate of Microsoft DCs using the fingerprint.

Regards,
M_Soler

[Salom_Idhogela]

Thanks, I managed to fetch the fingerprints however If I removed LDAP 389, leaving 636 I am getting the attached error. Do I need to have all the protocol allowed on the FW rule?

Regards,

Salom

[Salom_Idhogela · Accepted solution]

I have found out that for LDAPS to work, LDAP 389 should also be allowed on the FW rule.

Follow this article to understand how it works.

https://www.tec-bite.ch/the-pain-with-check-point-and-ldaps-and-some-medicine-against-it/

Regards,

Salom

[Chris_Atkinson]

Yes LDAPS is supported.

Start by reviewing SSL Encryption options in the LDAP Account unit.

Select 'Manage -> Servers and OPSEC Applications -> LDAP Account Unit'.

Under the Servers tab for your DC object, select Encryption tab.

See the setting "Use Encryption (SSL)". Port will be 636.