> Source: [sk114299](https://support.checkpoint.com/results/sk/sk114299)

# sk114299 - ClusterXL Standby member periodically sends LDAP traffic

| Property | Value |
|----------|-------|
| Solution ID | sk114299 |
| Date Created | 2016-11-02 |
| Last Modified | 2022-11-07 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Symptoms

- * Traffic capture on the Standby member shows that it periodically sends LDAP traffic (to TCP port 389).

  Note: The observed TCP port depends on the configuration in SmartDashboard - go to "Servers and OPSEC" view - expand "Servers" - expand "LDAP Account Unit" - open the LDAP Account Unit object - go to "Servers" tab - select the LDAP server object - click on "Edit..." - refer to "Port" field.
* Output of `netstat -nap | grep -E "Foreign|:389 "` command on the Standby member shows that connection to TCP port 389 is established by the CPD daemon.

  *Example* :

  ```
  
  Active Internet connections (servers and established)
  Proto Recv-Q Send-Q Local Address     Foreign Address     State          PID/Program name
  tcp        0      0 X.X.X.X:YYYYY     Z.Z.Z.Z:389         ESTABLISHED    4941/cpd
  ```

* Debug of CPD daemon (per [sk86320](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk86320)) on the Standby member shows:

  ```
  
  [Date Time] ldap_notifier_start_query_server: (0x...)
  [Date Time] ldap_notifier_start_query_server: (1) open connection: 
  AU name: ...
  DN: ...
  Server: <Z.Z.Z.Z,389>
  [Date Time] entered OPSEC_ldap_open_ex
  [Date Time] entered ldap_init
  [Date Time] entered open_ldap_connection_ex
  [Date Time] entered connect_to_host: host = Z.Z.Z.Z:389
  ```

## Cause

When "Monitoring" (SmartView Monitor) blade is enabled on Security Gateway / Cluster, the Security Gateway / Cluster Members will periodically send LDAP traffic (generated by the CPD daemon) to monitor the LDAP Account Units that were defined in the SmartDashboard.

By design, when both members will send this traffic towards the Security Management Server (this connection will be encrypted using SIC).

In certain environments (usually Software-Defined Networks (SDN) - e.g., Cisco ACI / VMware NSX), it is required that no traffic is sent from non-Active cluster member due to the fact that other network components may update their forwarding or translation tables based on the received packets, and not by using ARP protocol.  
LDAP traffic from the Standby member may cause SDN environments to update MAC Addresses/Routes with the MAC address of the Standby member.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content