Cisco 9800 WLC and LDAP communication failure

[Nirqa suport]

Good afternoon or evening everyone, I have a problem to integrate a cisco 9800 wlc with LDAP.
In the cisco WLC I have configured the LDAP profile and it has been associated with an SSID.

During the authentication tests with a user it was detected that when the cisco wlc makes a bind request to the LDAP it does not accept it because it considers it an unsecured connection.

ip of the WLC : 10.159.72.2 ip of the ldap : 10.190.128.4
The tests were performed using port 389 on the wlc side.

A simulation has also been performed with a laptop by installing a program so that it can make a bind request to the ldap, but in this simulation the LDAP does allow the laptop to complete this bind request.

test from the laptop to the ldap

Attached two images of the packet capture made from wlc.

for the configuration we have used this link

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/216744-configuring-catalyst-9800-wlc-with-ldap.html#toc-hId--1085503207

[Flavio Miranda]

@Nirqa suport 

 Are you using secure mode?

[Nirqa suport]

Hi Flavio

We have tried testing with port 636 and installing a trusted certificate for the ldap, but the TCP session is not established.
A reset of the tcp session is received from the LDAP.
The client indicates that part of the firewall the path is clear to the LDAP.
In addition, the client tells us that they are always using port 389 for LDAP communications.

[Flavio Miranda]

I asked because on the wireshark log you shared, we can see the information about TLS. 

[MHM Cisco World]

from same link you share 
did you enable secure mode 

[Nirqa suport]

Hello @MHM Cisco World 

When using port 389 we do not activate the secure mode as it is a default port.
When we use port 636 we activate the secure mode and place the trustpoint associated to the certificate that we uploaded to the wlc 9800 cisco.
In the traces we can see that the tcp session that is established from the wlc 9800 is closed or reset by the LDAP.
Attached an image.

[Daniel Ordóñez Flores]

Hello @Nirqa suport 

AFAIK windows server does not allow anonymus authentication.

What versión of windows server are you running?