Security Gateway to encrypt LDAP communication for Identity Awareness, port 389 vs 636

[checkpointer]

Hello Gents,

Just seeking an opinion on how risky it would be to stick with port 389 over 636 for communication with domain controller.

Cheers,

CPter

[Chris_Atkinson]

Suggest researching the relevant Microsoft recommendations and what they're enforcing, for example:

https://support.microsoft.com/en-us/topic/2020-ldap-channel-binding-and-ldap-signing-requirements-fo...

[Lesley · Accepted solution]

Hello,

Make a packet capture while running on encrypted on port 389. You will see everything. This makes it vulnerable for men in the middle attacks. Attackers could steal or change data in the AD. I would strongly recommend to use 636 with fingerprint Check Point. The only downside for 636 in combination with Check Point is the random fingerprint changes. Please refer to this SK to get better understanding: 

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

https://community.checkpoint.com/t5/Security-Gateways/Check-Point-LDAPS-connection-breaks-everytime-...