Active Directory Cannot fetch groups Locally Managed Gateway

[orion_son30]

Hi,

I'm running 82.00 in a Quantum Spark 2560 and I'm not being able to fetch the Groups of the Active Directory Auth Server. 

I already confirmed that the user credentials are correct, since it's the same user that is configured on the Identity Collector. 

The error is pretty generic if I don't specify the Branch. It just says "An error occurred while reading groups from Active Directory". I've already followed some SK, but I was not able to solve the issue. 

Any recommendation on this?

Kind regards

[orion_son30]

[the_rock]

Any other relevant logs/errors or thats the only one?

[orion_son30]

No. Just this. 

[Vincent_Bacher]

Is it about creating a LDAP account unit and section "object management"?
I always add a branch. Not sure what the issue is.
Would be good for the mates to have mor details.

[orion_son30]

Hi,

This is a locally managed Firewall.

I would like to have more details, but the error is just this one. 

Kind Regards. 

[Vincent_Bacher]

Please specify exactly what you configured and where. The more details, the better. Screenshots always help as well. The information you shared is far too limited to assist.

[orion_son30]

I understand your point. I would like to give you a lot of detail, but I've literally just configured the Active Directory and then when I do the OK, the error appears. I'm sharing the screenshot of the config. 

[the_rock]

If you do basic tests/capture from the fw, do you see communication to the AD? Can it ping back and forth? Do port 389,445 and 53 show open?

[orion_son30]

Hi, 

Yes. I can ping the server from the Firewall and I can telnet ports 389,445 and 53. 

Kind regards.

[the_rock]

Just an idea...maybe try turn windows fw off?

[orion_son30]

😁

Yes, I've checked and it's disabled. 

Thanks.

[the_rock]

If so, I suggest TAC case.

[Dafna]

Hi,

What is the version of the AD server?

[orion_son30]

Hi,

It's a Win Server2012.

[the_rock]

Do you have any newer version you can test? ie windows server 2019, 2022 or 2025?

[orion_son30]

Nops. 

This is an environment from an end customer, so it's pretty old and out of my control. Right now, after removing the old Sophos and put in place the new Check Point 2560, I'm just trying to help the customer to authenticate Remote Access VPN Users with the AD server. 

Thanks. 

[Dafna]

Please open a task and attach:

cpinfo after you replicates the issue + tcpdump