> Source: [sk179989](https://support.checkpoint.com/results/sk/sk179989)

# sk179989 - LDAP Authentication fails after upgrading to R80.40 or higher

| Property | Value |
|----------|-------|
| Solution ID | sk179989 |
| Date Created | 2022-10-06 |
| Last Modified | 2025-12-22 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82, R81.20, R81.10 (EOS), R81 (EOS) |
| OS | Gaia |

## Symptoms

- * LDAP authentication fails for Remote Access VPN after an upgrade of the Security Gateway to R80.40 or higher.

* Same configuration works on Security Gateway versions R80.30 or lower without any issues.

* Multiple branches are configured in the LDAP Account unit under the section "Branches in use".

## Cause

Code optimization done in R80.40 Security Gateway optimizes the way LDAP lookups are performed based on the configured branches. In versions R80.30 and lower, the Gateway performs a different LDAP query for each configured branch when authenticating a user, which can lead to the performance issue documented in [sk134092 - VPND consumes high CPU during policy installation of R80.10 and higher.](https://support.checkpoint.com/results/sk/sk134092)

In R80.40 and higher versions, the Security Gateway performs one LDAP query based on the common path calculated between all configured branches, which lowers resource usage for both the firewall and the domain controller. For example, you can have these branches configured:

`DC=alpha,DC=example,DC=com`  
`DC=beta,DC=example,DC=com`

Since `DC=example,DC=com` is the common path between these two branches, the Security Gateway queries only this branch in order to optimize our LDAP searches.

What can happen with this optimization is that if two very different branches are configured, it can lead to the use of an incorrect "common" path for queries. For example:

`DC=alpha,DC=example,DC=com`  
`DC=beta,DC=cp,DC=com`

Since DC=com is the only common path, it is used for queries and causes the LDAP search to fail. This scenario does not cause problem in previous versions because they would query the branches separately.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content