topic Re: Is there a way to allow LDAP StartTLS While blocking normal unencrypted LDAP? in Next-Generation Firewall Discussions

Is there a way to allow LDAP StartTLS While blocking normal unencrypted LDAP?

Ankit1Singh — Wed, 15 Nov 2023 13:12:43 GMT

Is there a way to allow LDAP StartTLS While blocking normal unencrypted LDAP?

Re: Is there a way to allow LDAP StartTLS While blocking normal unencrypted LDAP?

PavelK — Thu, 16 Nov 2023 02:51:11 GMT

LDAPS is using by default port TCP 636 while LDAP is using TCP 389. You could allow in policy only ports TCP 636 / 3269 used by LDAPS to filter out unsecured LDAP.

Kind Regards

Pavel

Re: Is there a way to allow LDAP StartTLS While blocking normal unencrypted LDAP?

rmfalconer — Thu, 16 Nov 2023 17:15:30 GMT

You could create a custom app for it. I've never done a capture to see what it looks like but you can use wireshark on an endpoint or use the native capture tools to inspect the traffic and create an app.