topic Re: Identity awareness Access Rules in Firewall and Security Management

Identity awareness Access Rules

Johan_Rudberg — Fri, 07 Feb 2020 08:54:37 GMT

Hello

We are using Identity awareness with identity collector. When we create a access rule within the access policy in order to block a group of computers from accessing the internet, however this does not work, the traffic doesnt even match this rule. Creating a simular rule for users from the AD works just fine but not the computers.

Any ideas?

Running version R80.20 HFA Take 91

//Johan

Re: Identity awareness Access Rules

PhoneBoy — Fri, 07 Feb 2020 11:25:08 GMT

What does the Access Role you’ve configured look like?

Re: Identity awareness Access Rules

abihsot__ — Fri, 07 Feb 2020 12:43:18 GMT

probably there is no match for this access role. When you select specific workstations, which setting you have for "users" section?

Is your workstation exist here?

pep s u q mchn <workstation_name>

Re: Identity awareness Access Rules

Daniel_Taney — Fri, 07 Feb 2020 13:19:32 GMT

Are the computers you are trying to block part of the AD domain? or are they standalone?

Re: Identity awareness Access Rules

Kaspars_Zibarts — Fri, 07 Feb 2020 15:19:16 GMT

I remember I had to split "mixed"roles after upgrade to R80.x as machine IDs stopped working if the same role also had user IDs.

Try using role that has machine IDs / groups only if you have not done that

Re: Identity awareness Access Rules

Johan_Rudberg — Wed, 12 Feb 2020 12:27:45 GMT

We resolved this problem by rebooting the management server, now the rule works!

However from the moment when a computer is added to the AD group it takes X hours before the rule deny the traffic, why is that so?

//Johan

Re: Identity awareness Access Rules

abihsot__ — Wed, 12 Feb 2020 12:35:41 GMT

By default it is 4 hours. You have to change it if you want more frequent active directory fetch for group membership. You can do manually by using following command:

pdp update

Command: root->update

Available options:
all - recalculate all users and machines group membership
specific - recalculate group membership for a user/machine
refetch_interval - LDAP user info refetch interval
update_rate - the max number of sessions updated within a minute

Re: Identity awareness Access Rules

Johan_Rudberg — Thu, 13 Feb 2020 08:34:36 GMT

It is a AD Group configured under Machine in the Access Role