Issue registering LDAP server

[SiacloudNetsec]

We're having trouble registering a new LDAP server in our ePO Console (version 5.9.1 Build 251).

We have tested communications from the ePO server to the LDAP server via command console successfully. 

Then, we configured the server in the ePO console and the following error pops up:

Does anyone know why could this be happening?

Thank you.

[cdinet]

What if you disable use ssl?  Does it succeed then?  Also, be careful posting company info on a public forum.  

[SiacloudNetsec]

If we try to add the server while disabling the use of SSL it still gives an error message.

It says that it's not able to authenticate with the LDAP server.

Also, the info in the screenshot is a placeholder for the actual company login credentials and IPs, we tried to register the server with correct data.

Thank you.

[uday-]

Hello SiacloudNetsec,

Reviewing from the screenshot,

1. Is the domain name in The credentials used which is "dominio\usuario" correct or should it be "kioskos\usuario". Input the correct username "domain\username". (Also verify if the username is a domain admin and is in the active state)

2. Also try unchecking the SSL option, If you have not enabled SSL on active directory.

Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

[SiacloudNetsec]

1. The credentials in the screenshot are just placeholders, we tried to register the server with the actual company credentials and IPs.

2. Unchecking the SSL option just changes the error message to "Unable to authenticate with the LDAP server. Verify that the username and password are correct.". The username and password are indeed correct.

By the way, are there any previous requirements that a server must fulfill in order to be able to be registered as a LDAP server in McAfee ePO? Like having connectivity to the ePO server in the 636 port?

I'm asking this because the root of the problem may not even be in the way we're trying to register it, but in the server config itself.

Thank you.

[cdinet]

If there are any firewalls in the way, the port would need to be open from epo to ldap server.  Is the epo server on the same domain?  Did you use domain name, IP or NetBIOS name of the ldap server?  Does orion log show anything?  Does the event log on the domain controller show any errors?

[SiacloudNetsec]

We attach evidence that this is not a connectivity problem between the servers. 

Nslookup, ping and even Telnet connections in the 636 port are successful (both via IP and via server name). I believe we can discard connectivity between servers as the main issue in this case. 

Could you tell us where the Orion logs are located? Checking them might be useful.

Do you have any other ideas to why this might be happening?

Thank you.

[cdinet]

Orion logs are located in the epo install directory under server\logs.  Is the epo server on the same domain as the domain controller or is either in a sub domain or different domain?

[cdinet]

You can also try this to see if it returns the correct domain controller that epo is authenticating with.

Please run the following commands from a "run as administrator" command shell (For the second and third commands, replace DOMAIN with the name of the domain the server belongs to.)

SET > c:\%computername%_set.txt
nltest /dsgetdc:DOMAIN > c:\%computername%_getdc.txt
nltest /dclist:DOMAIN > c:\%computername%_dclist.txt