A LAN client can reach an LDAP server through the firewall, but a FortiGate-originated LDAP authentication request fails because the server only permits a particular client IP. What is the most relevant next check?

Choose the single best answer.

A.The LAN policy used by the working client’s forwarded session.
B.The client browser certificate store.
C.The server VIP external port alone.
D.LDAP local-out source/interface selection and routing.

Show the answer and explanation

✓ Correct answer

LDAP local-out source/interface selection and routing.

FortiGate-originated traffic is local-out and may use a different source/interface from a forwarded client session. A successful LAN policy test does not establish the LDAP request source. Browser trust and an unrelated VIP do not diagnose this source restriction.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material, independently created and unaffiliated with Fortinet. Questions are original practice items, not recalled exam content. Published-topic coverage does not guarantee examination success. FortiOS baseline is 7.6.0; independently versioned FortiSASE and CNF references are qualified where relevant.