topic Re: Firepower 1120 LDAPS not working but LDAP is. in Network Security

Firepower 1120 LDAPS not working but LDAP is.

TommyNilsson0342 — Wed, 18 Mar 2020 14:43:37 GMT

I am able to login through our firepower 1120 through VPN if i run LDAP through our AD.

If I run LDAPS instead it does not work.
See the attachment.

Re: Firepower 1120 LDAPS not working but LDAP is.

Cristian Matei — Wed, 18 Mar 2020 15:00:18 GMT

Hi,

Your problem is either the remote LDAP server does NOT run LDAPS (the service is not available/open, thus the error message), or port 636 is filtered someway along the path and the packets near reach the LDAPS server.

Regards,

Cristian Matei.

Re: Firepower 1120 LDAPS not working but LDAP is.

Rahul Govindan — Wed, 18 Mar 2020 15:43:05 GMT

What version of FTD is this? Starting from 6.5, the FTD needs to trust the certificate presented by LDAPS server. 6.4 and below, this trust was not enforced. If you are on 6.5 and above, you need to install the CA certificate of the LDAPS server on the FTD as a cert enrollment object.

Re: Firepower 1120 LDAPS not working but LDAP is.

Jewgeni Uschegow — Wed, 08 Apr 2020 22:43:45 GMT

Hi Rahul,

do I understand correct, that I have to install the Root CA certificate of ldaps server in objects/pki/cert enrollment and add to devices/certificate on ftd device?

Regards,

Re: Firepower 1120 LDAPS not working but LDAP is.

Rahul Govindan — Fri, 17 Apr 2020 14:17:50 GMT

That is correct. Unfortunately, this is not obvious from the FMC configuration.

Re: Firepower 1120 LDAPS not working but LDAP is.

superadmin9 — Thu, 30 Apr 2020 00:23:52 GMT

Looks like you’re running 6.5.x from the screenshot, so you can make sure the cert is added if that is the case.
You can also use the windows LDAPS tool to verify connection to your server with 636

Re: Firepower 1120 LDAPS not working but LDAP is.

Imm — Mon, 31 Jan 2022 08:31:16 GMT

Did you resolve this issue?

Re: Firepower 1120 LDAPS not working but LDAP is.

Imm — Mon, 31 Jan 2022 08:32:30 GMT

Hello,

How I can install Root CA of LDAPS into Cert Enrollment? Do you have some manuals?

Thanks

Re: Firepower 1120 LDAPS not working but LDAP is.

Rob Ingram — Mon, 31 Jan 2022 08:40:02 GMT

@Imm here is the cisco guide for installation or renewal of certificates using the FMC

https://www.cisco.com/c/en/us/support/docs/security-vpn/public-key-infrastructure-pki/215849-certificate-installation-and-renewal-on.html