Configuring ASA5510 for LDAP & Mimecast

[swjmckay1]

We have been moving our email filtering and archiving over to Mimecast and while the configuration for smtp has been easy, I have been struggling to get an LDAP connection to work.

I created a network object group to cover the IP ranges for Mimecast's European data centers and allow for smtp traffic.

access-list acl_out extended permit tcp object-group Mimecast_email host 193.***.***.*** eq smtp 

static (inside,outside) tcp 193.***.***.*** smtp 192.168.***.*** smtp netmask 255.255.255.255 

static (inside,outside) tcp 193.***.***.*** pop3 192.168.***.*** pop3 netmask 255.255.255.255 

I have a NAT rule set up to convert the internal IP of the AD domain controller in the same way as for Exchange

static (inside,outside) tcp 193.***.***.*** ldap 192.168.***.*** ldap netmask 255.255.255.255 

and obviously a corresponding ACL entry

access-list acl_out extended permit tcp object-group Mimecast_email eq ldap host 193.***.***.*** eq ldap

Anyway, when I try and synchronise from Mimecast I get the following error - 

ERROR|Connection Error - Active Directory login failed

There is a Mimecast login setup within our AD and it is in the correct format but when I try the synchronisation I don't even get any traffic showing on the log of the ASA

Any help or advice would be appreciated.

Many thanks,

Stuart

[Jennifer Halim]

I would suggest that you check to see if you are seeing any hit count on acl_out access-list for the ldap synchronization specifically. If there is no hitcount, that means that the traffic is not even coming in towards the firewall.

You might want to check if it's probably using LDAPS instead of plain LDAP which is on a different port.

Lastly, you might want to run a packet capture on the outside interface of the ASA with ACL between the AD public ip address towards any, and the reverse to see if any packets are coming inbound towards the AD.

Hope that helps to start the troubleshooting.

[swjmckay1]

Thanks for the pointers, this is where I have now got to.

Hit count is zero but our ISP had been blocking port 389 so that has now been opened up although the hit count hasn't changed.

The Mimecast config is definitely set to use port 389 and we now get the following error

4

Aug 26 2010

09:03:12

106023

94.185.240.26

193.130.102.99

Deny tcp src outside:94.185.240.26/45514 dst inside:193.130.102.99/389 by access-group "acl_out" [0x0, 0x0]

It looks to me as though the NAT isn't functioning properly for this IP address but the exact same set up works fine for connections from Mimecast to port 25 on a different external IP.

Many thanks, Stuart