Fetching Crls From An Alternate Ldap Server; Troubleshooting With Ikesnoop; Setting Up An Ldap Server - D-Link NetDefend DFL-210 User Manual

9.4.4. Fetching CRLs from an alternate
LDAP server
IP Validation
NetDefendOS always checks if the source IP address of each packet inside an IPsec tunnel is the
same as the IP address assigned to the IPsec client with IKE Config Mode. If a mismatch is detected
the packet is always dropped and a log message generated with a severity level of Warning. This
message includes the two IP addresses as well as the client identity.
Optionally, the affected SA can be automatically deleted if validation fails by enabling the advanced
setting IPsecDeleteSAOnIPValidationFailure. The default value for this setting is Disabled.

9.4.4. Fetching CRLs from an alternate LDAP server

A Root Certificate usually includes the IP address or hostname of the Certificate Authority to
contact when certificates or CRLs need to be downloaded to the D-Link Firewall. Lightweight
Directory Access Protocol (LDAP) is used for these downloads.
However, in some scenarios, this information is missing, or the administrator wishes to use another
LDAP server. The LDAP configuration section can then be used to manually specify alternate
LDAP servers.
Example 9.9. Setting up an LDAP server
This example shows how to manually setup and specify an LDAP server.
CLI
gw-world:/> add LDAPServer Host=192.168.101.146 Username=myusername
Web Interface
1. Go to Objects > VPN Objects > LDAP > Add > LDAP Server
2. Now enter:
• IP Address: 192.168.101.146
• Username: myusername
• Password: mypassword
• Confirm Password: mypassword
• Port: 389
3. Click OK

9.4.5. Troubleshooting with ikesnoop

VPN Tunnel Negotiation
When setting up IPsec tunnels, problems can arise because the initial negotiation fails when the
devices at either end of a VPN tunnel try but fail to agree on which protocols and encryption
methods will be used. The ikesnoop console command with the verbose option is a tool that can be
used to identify the source of such problems by showing the details of this negotiation.
Using ikesnoop
Password=mypassword Port=389
352
Chapter 9. VPN