LDAP Auth not working on SSL VPN after upgrade to 5.6.6

[m0j0]

I don't know if this is an LDAP issue or an SSL VPN configuration issue but I'll start by posting it here.  This thing has been giving me a headache for a couple of days so it's time to seek help.

I've got three 80C's in three offices around the world.  All are configured identically as far as SSL VPN goes and all were working in the past.  They all authenticate against the same LDAP server where users who are members of the "VPN Users" group are allowed to log in.  I recently upgraded the firmware on one firewall from 5.4.4 to 5.4.6 and it appears it's been since this time that I can no longer log in to that firewall while the other two still work fine.  When I try on this firewall, I get a "Permission denied" error and the logs on the firewall also show the permission is denied with a "SSL user failed to log in" message.

If I run a tcpdump on the directory server, I see some initial back and forth which I assume is the handshake, then I see a couple of packets from the firewall that get responded to via the directory server as ICMP host unreachable - admin prohibited packets.  However, if go into the LDAP server config on the firewall and click Test Connectivity it all works fine and the tcpdump looks normal.  I've checked my iptables on the directory server and the firewall is definitely allowed - besides, if that was the problem then the connectivity test would fail. Also, I can browse the directory fine from the firewall.

I've got no idea what to look at.  Everything looks the same on both firewalls.  I have noticed that there's an SSL-VPN Realms page on the 5.6.6 that doesn't exist on 5.6.4 interface.  I don't have anything configured under there, not sure if I need to.  I'm almost tempted to role back to 5.6.4 but I'd rather fix the issue.

[hnmr]

Hello,

we have experienced a similar issue wih LDAP authentication after update from 5.6.5 to 5.6.6. The LDAP based authentication stopped working. The issue seems to have to do with search through or extraction of group membership information. A ticket at Fortinet support is open but unfortunately it takes time for them to response. 

Best regards

Hermann

[m0j0]

Hi Hermann,

Thanks for the reply.  I expect we'll probably see a 5.6.7 release in the near future.  Fortunately I only rolled out the upgrade to our least utilized office so I can live with workarounds until there's a resolution.

Regards,

Mark

[hnmr · Accepted solution]

I guess I better would have answered to your post under "User and authentication" :)

[m0j0]

My fault for posting it twice.  I just wasn't sure where the issue was.

[Handoz56]

Hello, same problem here. Upgrade a 60D cluster from 5.6.2 to 5.6.6 in uk : no problem, upgrade a 60d cluster from 5.6.2 to 5.6.6 in shanghai (to correct a cpu problem with vpnssl) and since i can no longer log in the cluster with ldap and can't connect with vpnssl anymore (authentification error). I checked everything and the connexion test in user ldap is working...

[m0j0]

To anyone looking for a solution (at least one the worked for me), Handoz56 answered this in my other post of this in the Authentication section. 

The solution was to increase the LDAP connection timeout.  As suggested, I changed the default of 500ms to 1000ms and everything started working again.

config system global

    set ldapconntimeout 1000

    end