topic LDAP not work if management interface IP address cannot reach Windows AD in General Topics

LDAP not work if management interface IP address cannot reach Windows AD

jeremylo — Thu, 12 Jul 2018 03:10:59 GMT

Configuration as below

1. Mangement interface with IP 192.168.1.2 (non-PA device as gateway)

2. Windows AD with IP 172.16.1.2 (PA device layer3 interface as gateway)

3. Subnet 192.168.1.0/24 and 172.16.1.0/24 cannot reach each other

With correct LDAP config (LDAP IP, Port, Base DN, etc.). Go to "Device > User Identification > Group Mapping Settings > Group Include List". When expand the AD Users and Computers list always show failed to connect to the AD server.

After I change the management interface IP to the same subnet of Windows AD or set route to allow communication between the 2 subnet. The problem gone.

Is this the product restriction or did I miss something?

Re: LDAP not work if management interface IP address cannot reach Windows AD

Mick_Ball — Thu, 12 Jul 2018 06:19:04 GMT

By default ldap service is on management interface. Go to device, setup, services and change the default to an interface that can route to your AD network.

Re: LDAP not work if management interface IP address cannot reach Windows AD

jeremylo — Thu, 12 Jul 2018 06:36:44 GMT

Thanks MickBall. Customize service route configuration solve the probem.