This article describes the issue of the TLS connection to LDAP server not working, when traversing through SRX

• The LDAP, which is between the client on the trust side and the server on the untrust side, works normally.
• When TLS is used with LDAP, the client is unable to reach the server. The connection hangs.

IDP was enabled on the policy, which was allowing LDAP with TLS.

When LDAP with TLS is used, the packet will appear as encrypted. This packet was unable to be decoded and, as a result, IDP interpreted this as a possible anomaly.  The resolution for this issue is to delete IDP from the application-services policy.

For example, assume that you have the following policy:

[edit security policies from-zone trust to-zone untrust]
root# show
policy LDAP-TLS {
    match {
        source-address any;
        destination-address any;
        application junos-ldap;
    }
    then {
        permit {
            application-services {
                idp;
            }
        }
    }
}

The resolution is to delete IDP from this policy:

delete security policies from-zone trust to-zone untrust policy LDAP-TLS then permit application-services idp
commit