> Source: [sk182952](https://support.checkpoint.com/results/sk/sk182952)

# sk182952 - Error: "Couldn't create connection (err=5): Cannot assign requested address"  LDAP leak disrupts authentication and ldapsearch

| Property | Value |
|----------|-------|
| Solution ID | sk182952 |
| Date Created | 2024-12-23 |
| Last Modified | 2026-03-17 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R81.20, R81.10 (EOS) |
| Platform | Maestro Orchestrator |

## Symptoms

- * **LDAP Authentication Failure**

  Authentication through LDAP fails.

  Netcat or Telnet output for the LDAP server and port shows:
  > `"Error: Couldn't create connection (err=5): Cannot assign requested address."`

  Explanation: The system cannot allocate a new connection due to ephemeral port exhaustion.
* **Excessive LDAP Handles in Logs**

  IKED logs show active LDAP handles repeatedly sending keep-alive requests:
  > `
  > [iked0] send_keepalive: LDAP handle 0x4 msgId 715 
  > [iked0] send_keepalive: LDAP handle 0x5 msgId 700 
  > [iked0] send_keepalive: LDAP handle 0x6 msgId 647
  > `

  Explanation: These logs indicate a buildup of active LDAP connections that are not being released.
* **`ldapsearch` Command Fails**

  BT traces reveal connection attempts to the LDAP server fail:
  > `
  > server = SRV_Srvdc2, Connect result = Failed to open connection 
  > Set SRV_Srvdc2 to down
  > `

  Explanation: The server marks the LDAP instance as unavailable due to the inability to open new connections.
* **Ephemeral Port Exhaustion**

  HCP reports show the ephemeral port table is full, with LDAP consuming over half the available ports.

  Explanation: The port table exhaustion blocks new connections, halting LDAP functionality.
* **High volume of connections between the pdpd process and the domain controller**

  Running "netstat -nap" command on the security gateway reveals an unusually large number of ESTABLISHED TCP sessions between pdpd process and the domain controller on ports 389 and 636.

## Cause

A leak in LDAP connections occurs during the `cpldapcl reconf` flow. Each reconf opens new connections while old connections remain active. Typically, only one LDAP handle is needed for eacg server and port combination.   

However, the system generates multiple connections without releasing the old ones, causing a buildup of connections. This leads to the exhaustion of ephemeral ports on the system due to the excessive number of LDAP connections.

## Solution

[Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.

A Support Engineer will make sure the Hotfix is compatible with your environment before providing it.  
For faster resolution and verification, collect these files:

1. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Management Server involved in the case.
2. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Security Gateway / each Cluster Member / Security Group involved in the case.

**Hotfix installation instructions:**   
Refer to [sk168597 - How to install a Hotfix](https://support.checkpoint.com/results/sk/sk168597).

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content