{"id":1358,"date":"2026-09-09T16:11:28","date_gmt":"2026-09-09T10:41:28","guid":{"rendered":"https:\/\/networkfix.in\/uncategorized\/fortigate-ldap-authentication-with-active-directory-configuration-and\/"},"modified":"2026-09-14T04:34:42","modified_gmt":"2026-09-13T23:04:42","slug":"fortigate-ldap-authentication-with-active-directory-configuration-and","status":"publish","type":"post","link":"https:\/\/networkfix.in\/en\/tutorials\/fortinet\/fortigate-ldap-authentication-with-active-directory-configuration-and\/","title":{"rendered":"FortiGate LDAP Authentication with Active Directory: Configuration and Testing"},"content":{"rendered":"

Centralized identity management is critical for modern enterprise network security. Managing local user accounts across multiple firewalls introduces administrative overhead and security risks. Integrating your FortiGate firewall with Active Directory (AD) using the Lightweight Directory Access Protocol (LDAP) resolves this issue. It allows you to enforce centralized access policies, SSL VPN authentication, and administrative controls.<\/p>\n

This guide walks you through a complete FortiGate LDAP Active Directory configuration<\/strong>. You will learn how to design, configure, test, and troubleshoot secure LDAP authentication (LDAPS) using both the FortiGate GUI and CLI.<\/p>\n

Real-Life Scenario<\/h2>\n

An enterprise organization wants to eliminate local user database management on its edge FortiGate firewalls. The security team mandates that all remote SSL VPN users and internal corporate access policies authenticate against Microsoft Active Directory.<\/p>\n

To comply with internal audit guidelines, cleartext LDAP traffic over TCP port 389 is strictly prohibited. The configuration must use Secure LDAP (LDAPS) over TCP port 636. Furthermore, FortiGate must validate the domain controller’s SSL certificate using an internal Enterprise Root Certificate Authority (CA).<\/p>\n

Lab Topology<\/h2>\n

The diagram below illustrates the communication path between the user endpoint, the FortiGate firewall, and the redundant Microsoft Active Directory Domain Controllers.<\/p>\n

\n+---------------------+\n| Remote \/ LAN Client |\n+----------+----------+\n           |\n           | Authenticates (SSL VPN \/ Firewall Policy)\n           v\n+-------------------------------------------------+\n| FortiGate Firewall (lab-fw01)                   |\n| Internal Interface: 10.0.1.254                  |\n+--------------------+----------------------------+\n                     |\n                     | LDAPS Queries (TCP Port 636)\n                     | Encrypted TLS Tunnel\n                     v\n  +------------------+------------------+\n  |                                     |\n  v                                     v\n+-----------------------+     +-----------------------+\n| Primary AD DC         |     | Secondary AD DC       |\n| (lab-dc01.lab.local)  |     | (lab-dc02.lab.local)  |\n| IP: 10.0.1.10         |     | IP: 10.0.1.11         |\n+-----------------------+     +-----------------------+\n<\/pre>\n
Example Addressing and Objects<\/h2>\n
The table below details the LAB\/EXAMPLE network parameters, directory paths, and service accounts used throughout this technical tutorial. You must adapt these values to match your production environment.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Object \/ Device<\/th>\nIdentifier \/ IP Address<\/th>\nDescription \/ Role<\/th>\n<\/tr>\n<\/thead>\n
FortiGate Hostname<\/strong><\/td>\nlab-fw01<\/td>\nSecurity Gateway \/ Authentication Broker<\/td>\n<\/tr>\n
FortiGate LAN IP<\/strong><\/td>\n10.0.1.254\/24<\/td>\nSource interface for LDAP requests<\/td>\n<\/tr>\n
Primary Domain Controller<\/strong><\/td>\n10.0.1.10 (lab-dc01.lab.local)<\/td>\nPrimary Active Directory LDAP Server<\/td>\n<\/tr>\n
Secondary Domain Controller<\/strong><\/td>\n10.0.1.11 (lab-dc02.lab.local)<\/td>\nBackup Active Directory LDAP Server<\/td>\n<\/tr>\n
LDAP Server Object Name<\/strong><\/td>\nlab-ad-ldaps<\/td>\nFortiOS LDAP Server Configuration Object<\/td>\n<\/tr>\n
Active Directory Base DN<\/strong><\/td>\nDC=lab,DC=local<\/td>\nSearch root for directory queries<\/td>\n<\/tr>\n
Bind Service Account DN<\/strong><\/td>\nCN=svc-fortigate,OU=ServiceAccounts,DC=lab,DC=local<\/td>\nDedicated service account for directory searches<\/td>\n<\/tr>\n
Target AD Security Group DN<\/strong><\/td>\nCN=VPN-Users,OU=Groups,DC=lab,DC=local<\/td>\nActive Directory group granted access<\/td>\n<\/tr>\n
FortiGate User Group<\/strong><\/td>\nAD-VPN-Users<\/td>\nMapped user group used in FortiGate policies<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
Prerequisites<\/h2>\n
Before starting the configuration, ensure the following requirements are met:<\/p>\n