Which traffic does LDAP use.?

[Aznaz_Reflectio]

Hi Checkmates,

I would like to ask about the status for this 1470 firewall.

Regarding the LDAP traffic which is about 40MB.

Does it mean it is using the site to site traffic or some internet connection got ldap protocol?

Thank you.

[HeikoAnkenbrand]

Hi Aznaz,

see Ports Used for Communication by Various Check Point Modules (new version).

Regards

Heiko

[Aznaz_Reflectio]

Thanks for the information sharing..

[Pedro_Espindola]

Hello Aznaz,

I believe this graphic shows statistics for all the traffic, not only from the internet, so this could be ldap from the site-to-site traffic.

[Aznaz_Reflectio]

is there any way for me to verify this.?

[G_W_Albrecht]

That should be possible by checking the LDAP server IP and the VPN community settings. All traffic to the remote site on SMBs goes thru the VPN tunnel, in WebGUI we only can exclude admin access traffic to the gateway by the Advanced Setting > VPN Site to Site global settings - Override 'Route all traffic to remote VPN site' configuration for admin access to the device. Or, you can use a special configuration file, see Locally managed SMBs vpn_table.def file.

Strange is that you are using this 1470 like a 770 - using central management would make it easy to exclude services from VPN, also enable the second processor core and even give you logs with names ...

[Pedro_Espindola]

Do you have accept logs enabled? Hosts using LDAP service usually make connections every few minutes. So checking the logs with the filter "service:ldap" should show you where the traffic is going.

If you see ldap traffic going both to the internet and to VPN sites, then you will not be able to check how much of the 40MB went to each destination. This would only be possible on a central management with SmartEvent.