topic Re: LDAP to LDAPs Authentication in Network Security

LDAP to LDAPs Authentication

latenaite2011 — Fri, 21 Feb 2020 15:36:54 GMT

Good afternoon,

I am just trying to figure out what the steps are for enabling LDAP to LDAPs authentication and specifically what needs to be done on the server. I saw that a certificate needs to be installed and the steps weren't too intuitive.

They are running on version 9.x.

Does anyone have a newer update to the steps required to get this done?

Thank you!

Re: LDAP to LDAPs Authentication

Rahul Govindan — Tue, 10 Apr 2018 01:11:29 GMT

The only changes I can think of to make on the ASA are:

1) change port from 389 to 636

2) Install the CA certificate of your servers HTTPS certificate on the ASA. So if your LDAP server has an AD issued HTTPS certificate, export the sub-CA or Root CA and import the .cer or .crt file into a new trustpoint as a CA certificate.

3) Make sure your SSL settings have the right protocols supported by your LDAP server. Do a "show run all ssl" and "show crypto ssl" to see whats supported on the ASA.

4) Preferably use the name of the server instead of the ip address.

Re: LDAP to LDAPs Authentication

latenaite2011 — Tue, 10 Apr 2018 01:14:42 GMT

Thank you Rahul for responding.

Are are good steps for installing certificate on the servers and the https
certificate on the ASA?

Thank you!

Re: LDAP to LDAPs Authentication

Rahul Govindan — Tue, 10 Apr 2018 17:15:18 GMT

ASA CA cert installation: https://www.cisco.com/c/en/us/support/docs/security-vpn/public-key-infrastructure-pki/200339-Configure-ASA-SSL-Digital-Certificate-I.html#anc12

Steps 1-3 under section "1.1 Installation of the Identity Certificate in PEM Format with ASDM"

Configuring LDAP over SSL: I don't think there is Cisco documentation for this. Here are a third party one: https://www.petri.com/enable-secure-ldap-windows-server-2008-2012-dc

Re: LDAP to LDAPs Authentication

Yordan1 — Tue, 13 Apr 2021 14:14:13 GMT

Hi Rahul,

after i added the CA Certificate, do i need to install it on Identity Certificates?

i am not able to see it in the field

Yordan