Why ControlUp Uses LDAP (Port 389) Instead of LDAPS for Active Directory Queries and Firewall Configuration Guidance

ControlUp’s Realtime DX Console and Monitor components currently use LDAP (Lightweight Directory Access Protocol) on port 389 to communicate with Active Directory for essential functions such as reading the domain’s organizational structure, discovering computers, and retrieving user and group information. This communication method is explicitly documented in ControlUp’s support materials. While security teams often prefer LDAPS (LDAP over SSL/TLS) on port 636 to secure directory queries, ControlUp’s product does not automatically fall back from LDAP to LDAPS if port 389 is closed or blocked.

The reliance on LDAP instead of LDAPS is outlined in ControlUp’s official documentation, including the Communication Ports for VDI environments, particularly for the EU region. These documents confirm the use of LDAP on port 389 as a mandatory communication channel for the Console and Monitor to function correctly. Attempting to restrict access by only allowing LDAPS traffic on port 636 without open access on port 389 will disrupt domain querying operations and break functionality.

There is currently no straightforward option within ControlUp to switch these queries from LDAP to LDAPS. The documentation and community experts note that closing port 389 and permitting only port 636 is not supported and will result in operational issues. This limitation is important for network and firewall teams to understand when reviewing and tightening rules related to ControlUp’s network communication.

For detailed information on required ports and communication flows, ControlUp provides a dedicated documentation page at https://support.controlup.com/docs/communication-ports-used-by-controlup-hybrid-cloud-eu-customers, which includes tables and descriptions of mandatory ports for the Console and Monitor roles. Users seeking secure directory communication should be aware of this existing protocol limitation and plan network configurations accordingly to avoid disruptions.

Read the entire ‘Why ControlUp Uses LDAP (Port 389) Instead of LDAPS for Active Directory Queries and Firewall Configuration Guidance’ thread below:

Q: CU RealtimeDX (Console) and CU Monitors using LDAP instead of LDAPs?

Hi,
i thought I will checking in with the same question had three years ago:

Because the firewall guys at a customer are reviewing the firewall rules and tasked the Citrix guys to ask why ControlUp still uses LDAP instead of LDAPs…
The kb article clearly states LDAP… Is there a “easy” way to switch to LDAPs?

(I hope the fw guys will not see the random high-ports range)

The firewall rule they are looking at is correct. Console and Monitor machines query Active Directory over LDAP on port 389. That is how the product reads the domain for the organization tree, computer discovery, users, and groups. Closing 389 and opening only 636 will break that. It will not fall over to LDAPS.

The article they linked matches the product. In, both mandatory-port tables say the same thing:

Continue reading and comment on the thread ‘Why ControlUp Uses LDAP (Port 389) Instead of LDAPS for Active Directory Queries and Firewall Configuration Guidance’.  Not a member? Join Here!