- 3 minutes to read

TCP and UDP Ports (Nodinite LDAP Adapter)

Use this troubleshooting page when an LDAP connection from the LDAP Web API or the BizTalk LDAP Adapter fails and you suspect a firewall. It tells you where the TCP ports and UDP ports of both products are documented, and how to test each port from the server that runs the product.

✅ Find the one page that lists every LDAP port per hop
✅ Test LDAP, LDAPS, DNS, Kerberos, and Global Catalog ports with PowerShell
✅ Match common connection errors to the port that is blocked

Where the Ports Are Documented

Both LDAP products open the same connections to your directory, so the firewall rules are documented once, per hop, in the LDAP Web API firewall settings: the diagram of every host, and the ports between the client and the API, the API and the LDAP Catalog Server, the API and the domain controller, and, for App Service hosting, Azure. The BizTalk LDAP Adapter firewall settings show the same hops from the BizTalk Server nodes.

graph LR subgraph "Client/API Host" roAPI["fa:fa-cloud LDAP Web API or BizTalk Server"] end subgraph "LDAP Catalog Server" roLDAP["fa:fa-address-book LDAP Server"] end subgraph "Domain Controller" roDC["fa:fa-server DNS, Kerberos, Global Catalog"] end roAPI -->|"389 or 636"| roLDAP roAPI -->|"53, 88, 3268 or 3269"| roDC

Diagram: the connections to test from the host that runs the LDAP Web API or the BizTalk LDAP Adapter.

Test the Ports

Run these commands on the server that runs the LDAP Web API or the BizTalk LDAP Adapter, with the names your configuration uses.

LDAP and LDAPS 

Test-NetConnection -ComputerName dc01.contoso.com -Port 389
Test-NetConnection -ComputerName dc01.contoso.com -Port 636

Expected result: TcpTestSucceeded : True. If 636 succeeds but LDAPS calls still fail, the directory's certificate is the problem, not the firewall; see SSL-LDAPS for Active Directory.

Global Catalog 

Test-NetConnection -ComputerName dc01.contoso.com -Port 3268
Test-NetConnection -ComputerName dc01.contoso.com -Port 3269

DNS and Kerberos 

Resolve-DnsName dc01.contoso.com
Test-NetConnection -ComputerName dc01.contoso.com -Port 88

Note

Test-NetConnection tests TCP only. DNS and Kerberos also use UDP; when Resolve-DnsName works, UDP 53 is open.

Common Errors and the Blocked Port

Symptom Likely blocked port What to check
The LDAP server is unavailable TCP 389 or 636 to the LDAP Catalog Server Firewall between the API host and the directory; the port in the connection settings
LDAPS fails, LDAP works TCP 636, or the certificate Run the 636 test above, then the certificate checks in SSL-LDAPS for Active Directory
Searches across domains return nothing TCP 3268 or 3269 to a Global Catalog server Global Catalog ports on the domain controller
The server cannot be found or slow first calls TCP/UDP 53 DNS server reachable and the directory name resolvable
Sign-in with the App Pool or host instance account fails TCP/UDP 88 Kerberos to the domain controller; clocks within 5 minutes
REST calls to the LDAP Web API time out The API site port (443 or your IIS binding) Inbound rule on the API host; see HTTPS Hardening

For ports that Windows and Active Directory need between domain controllers, which the LDAP products don't use, see Microsoft's Service overview and network port requirements.

Next Steps