A FortiGate LDAP request fails even though the employee LAN-to-WAN policy allows LDAP. Why is checking only that policy insufficient?

Choose the single best answer.

A.The LDAP request is local-out traffic with service-specific source/path considerations
B.The LAN-to-WAN rule must be moved first because it controls all FortiGate-generated traffic
C.A reverse DMZ-to-LAN rule alone provides the missing LDAP local-out path
D.Attaching the LDAP user group to the LAN rule fixes every LDAP server connection failure

Show the answer and explanation

✓ Correct answer

The LDAP request is local-out traffic with service-specific source/path considerations

FortiGate-generated requests use local-out handling and require appropriate source/interface settings and reachability. Reordering a client transit rule, adding a reverse client rule or changing a user group does not establish that generated request path.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material, independently created and unaffiliated with Fortinet. Questions are original practice items, not recalled exam content. Published-topic coverage does not guarantee examination success. FortiOS baseline is 7.6.0; independently versioned FortiSASE and CNF references are qualified where relevant.