Is there a way to allow LDAP StartTLS While blocking normal unencrypted LDAP?

[Ankit1Singh]

Is there a way to allow LDAP StartTLS While blocking normal unencrypted LDAP?

[PavelK]

Hello @Ankit1Singh

LDAPS is using by default port TCP 636 while LDAP is using TCP 389. You could allow in policy only ports TCP 636 / 3269 used by LDAPS to filter out unsecured LDAP.

Kind Regards

Pavel

[rmfalconer]

You could create a custom app for it. I've never done a capture to see what it looks like but you can use wireshark on an endpoint or use the native capture tools to inspect the traffic and create an app.