topic Re: LDAPS Falling back to LDAP in General Topics

LDAPS Falling back to LDAP

LeeSeeman — Tue, 29 Mar 2022 21:11:14 GMT

Our firewalls are configured for LDAPS on port 636 to our Windows DC. We have the require SSL/TLS option checked in the LDAP settings window. The useridd log shows:

2022-03-22 14:42:09.136 -0700 connecting to ldap://[dcserver]:636 with StartTLS...
2022-03-22 14:42:09.140 -0700 connecting to ldaps://[dcserver]:636 ...
2022-03-22 14:42:09.164 -0700 ldap cfg domain - LDAP connected to dcserver:636( index 0)

----

However, the DC server acting as LDAPS server is showing event ID: 2085 in Directory Service log with data: "the client and server cannot communicate, because they do not possess a common algorithm."

=======

The firewall appears to working as expected, but the LDAPS server is throwing these warnings. How can I address the event ID warnings on the LDAPS server?

Re: LDAPS Falling back to LDAP

rmfalconer — Tue, 29 Mar 2022 23:13:06 GMT

Have you run a packet capture on the DC to see what cipher suites are being offered from the PA?

Re: LDAPS Falling back to LDAP

aleksandar.astardzhiev — Thu, 31 Mar 2022 18:44:59 GMT

Hey @LeeSeeman ,

It is strange to see "do not possess a common algorithm" with modern PanOS and Win Server versions.

What version of PanOS and DC are you running?

I don't believe there would be any difference, but have you tried to use port 389 in LDAP server profile in addition to "require TLS/SSL" enabled. As you can see from documentation it seems that 389 + require SSL/TLS should use StartTLS

I am surprised to see in your logs "2022-03-22 14:42:09.136 -0700 connecting to ldap://[dcserver]:636 with StartTLS.."

Anyway again it doesn't make a lot of sense to have a difference, but way want to try.