300-710 · Question #230
A network administrator has converted a Cisco FTD from using LDAP to LDAPS for VPN authentication. The Cisco FMC can connect to the LDAPS server, but the Cisco FTD is not connecting. Which…
The correct answer is C. DNS servers must be defined for name resolution. LDAPS (LDAP over SSL/TLS) uses the server's hostname in its certificate for validation. The Cisco FTD must resolve the LDAPS server's fully qualified domain name (FQDN) to establish the TLS handshake successfully. If DNS servers are not configured on the FTD, it cannot resolve…
Question
A network administrator has converted a Cisco FTD from using LDAP to LDAPS for VPN authentication. The Cisco FMC can connect to the LDAPS server, but the Cisco FTD is not connecting. Which configuration must be enabled on the Cisco FTD?
Options
- ASSL must be set to a use TLSv1.2 or lower.
- BThe LDAPS must be allowed through the access control policy.
- CDNS servers must be defined for name resolution.
- DThe RADIUS server must be defined.
How the community answered
(40 responses)- A10% (4)
- B15% (6)
- C73% (29)
- D3% (1)
Explanation
LDAPS (LDAP over SSL/TLS) uses the server's hostname in its certificate for validation. The Cisco FTD must resolve the LDAPS server's fully qualified domain name (FQDN) to establish the TLS handshake successfully. If DNS servers are not configured on the FTD, it cannot resolve the LDAPS server hostname, causing the connection to fail even though FMC (which has its own DNS settings) can connect fine. SSL version settings (A) address protocol negotiation, not resolution failures. Access control policy (B) would affect traffic passing through the firewall, not the device's own management-plane LDAP connection. RADIUS (D) is a different authentication protocol entirely and is not relevant here.
Topics
Community Discussion
No community discussion yet for this question.