Alert LDAP

[Guillermo Hurtado]

Hi Team.

We have received some alerts like this:

"The query x.accept failed with result inquiry timed out". 

Please let me know if we can make any correction in ESA or this timed out is caused by the client network or server.

Best Regards

[Mathew Huynh]

Hello Guillermo,

Generally i would request during the time-frames when you may be seeing this.

Please go to GUI > System Admin > LDAP

Test connection to your LDAP servers

Then test the LDAP accept queries as well.

Possibly there was a slight network interruption causing the LDAP queries to not get a response within 20 seconds and thus generated these app faults during this time frame.

If all connection are fine, then alerts should be safe to ignore, however it happens frequently during specific time frames, I would strong suggest to consult your network team or run the tests to see what may be interrupting the LDAP queries.

Regards,

Matthew

[Guillermo Hurtado]

Hi Matthew.

I run the test and appear successful in GUI (System Administrations - LDAP). But logs in CLI appear these info:

Thu Jan 21 15:23:39 2016 Debug: LDAP: chachoindependiente:10.101.98.44(10.101.98.44:3268) (60) Connection interrupted (writer)
Thu Jan 21 15:23:39 2016 Debug: LDAP: chachoindependiente:10.101.98.44(10.101.98.44:3268) (71) connecting to server
Thu Jan 21 15:23:39 2016 Debug: LDAP: chachoindependiente:10.101.98.44(10.101.98.44:3268) (71) connected to server
Thu Jan 21 15:23:39 2016 Debug: LDAP: chachoindependiente:10.101.98.44(10.101.98.44:3268) (72) connecting to server
Thu Jan 21 15:23:39 2016 Debug: LDAP: chachoindependiente:10.101.98.44(10.101.98.44:3268) (72) connected to server
Thu Jan 21 15:24:09 2016 Debug: LDAP: chachoindependiente:10.101.98.44(10.101.98.44:3268) (63) read timeout
Thu Jan 21 15:24:09 2016 Debug: LDAP: chachoindependiente:10.101.98.44(10.101.98.44:3268) (63) Connection interrupted (writer)
Thu Jan 21 15:24:09 2016 Debug: LDAP: chachoindependiente:10.101.98.44(10.101.98.44:3268) (73) connecting to server
Thu Jan 21 15:24:09 2016 Debug: LDAP: chachoindependiente:10.101.98.44(10.101.98.44:3268) (73) connected to server

Do not appear any query user to LDAP. Cold you tell me if this interruptions are caused by the firewall. I made a telnet and the connections is established too.

Thanks and Regards

[Mathew Huynh · Accepted solution]

Hello Guillermo,

The connection interrupted (writer) would generally be the connection cut as inactivity more often than not.

The concern here is the read timeout.

It looks like there is a connection issue to the LDAP servers you have configured on port 3268.

Please note that the ESA is set to allow a connection to remain open for up to 10,000
queries or 6 hours before it closes the connection.  Based on this, if the AD server is
not configured to match or exceed this, then these errors can be seen.  You may also want
to check to ensure that any firewalls are configured for the same settings as firewalls
have been known to exhibit the same symptoms by limiting the timeouts on the connection. 
This will often be seen as an out of sequence communication and the query request will be
silently dropped.

Regards,

Matthew

[Guillermo Hurtado]

Hi Matthew.

One last question.

Wich ports we need have to open in the firewall for the god communication with LDAP Server.

Thanks a lot for you help.

Best Regards

[Robert Sherwin · Accepted solution]

Check the user guide -- we post the recommended firewall ports for all services supported through ESA there --- Appendix D:

http://www.cisco.com/c/dam/en/us/td/docs/security/esa/esa9-7/ESA_9-7_User_Guide.pdf

-Robert

[Guillermo Hurtado]

Robert , Matthew.

Thanks a lot for your help.

Regards