Cisco Cisco Email Security Appliance C170 Guia Do Utilizador
27-17
User Guide for AsyncOS 10.0 for Cisco Email Security Appliances
Chapter 27 LDAP Queries
Working with LDAP Queries
–
Click the User Object ANONYMOUS LOGON, and then click OK.
–
Click the Permission Type tab.
–
Click Inheritance from the Apply onto box.
–
Click to select the Allow check box for the Permission permission.
Step 3
Configure the Cisco Messaging Gateway
Use the System Administration > LDAP page (or
ldapconfig
in the CLI) to create an LDAP server
entry with the following information.
–
Hostname of an Active Directory or Exchange server
–
Port 3268
–
Base DN matching the root naming context of the domain
–
Authentication type passphrase based using
cn=anonymous
as the user with a blank passphrase
Notes for Active Directory Implementations
•
Active Directory servers accept LDAP connections on ports 3268 and 389. The default port for
accessing the global catalog is port 3268.
accessing the global catalog is port 3268.
•
Active Directory servers accept LDAPS connections on ports 636 and 3269. Microsoft supports
LDAPS on Windows Server 2003 and higher.
LDAPS on Windows Server 2003 and higher.
•
The appliance should connect to a domain controller that is also a global catalog so that you can
perform queries to different bases using the same server.
perform queries to different bases using the same server.
•
Within Active Directory, you may need to grant read permissions to the group “Everyone” to
directory objects to yield successful queries. This includes the root of the domain naming context.
directory objects to yield successful queries. This includes the root of the domain naming context.
•
Generally, the value of the
mail
attribute entry in many Active Directory implementations has a
matching value “ProxyAddresses” attribute entry.
•
Microsoft Exchange environments that are aware of each other within the infrastructure can usually
route mail between each other without involving a route back to the originating MTA.
route mail between each other without involving a route back to the originating MTA.
Testing LDAP Queries
Use the Test Query button on the Add/Edit LDAP Server Profile page (or the
test
subcommand in the
CLI) of each query type to test the query to the LDAP server you configured. In addition to displaying
the result, AsyncOS also displays the details on each stage of the query connection test. You can test
each of the query types.
the result, AsyncOS also displays the details on each stage of the query connection test. You can test
each of the query types.
The
ldaptest
command is available as a batch command, for example:
ldaptest LDAP.ldapaccept foo@ironport.com