topic Re: Identity Awareness - IDC Problems in Firewall and Security Management

Identity Awareness - IDC Problems

rkucera — Wed, 18 Dec 2019 10:35:29 GMT

Hi,

we have been using Identity Awareness for a long time now. In the past we always used Identy Agents and had different problems with them ( most likely rather client based problems). A while ago we started using Identity Collectors on our AD servers. Basically this works quite well for us, but we have the situation several times a week that different users are not authenticated. Often I see that the ID Collector at the AD recognizes the user but this information does not reach the gateways. Only when I restart the pepd and pdpd service at the gateway will it work again.

Has anyone had a similar problem and knows why they occure?

Our Infrastructure:

2 Checkpoint GWs (Version: R80.30 Take 76)

2 AD Servers with IDC Version: 80.87.0000

Both IDC report Identities to both Gateways and the GWs are configured to share the identities between them

Best Regards

Rene

Re: Identity Awareness - IDC Problems

PhoneBoy — Sun, 22 Dec 2019 07:41:16 GMT

Probably best to get the TAC involved.
Also tagging @Royi_Priov

Re: Identity Awareness - IDC Problems

Royi_Priov — Sun, 22 Dec 2019 08:31:32 GMT

Hi Rene,

It will indeed require further investigation.

However, as a first step, I would recommend checking where the issue resides and provide this extra info to TAC.

Type the following commands on both PDP and PEP to see where the identity is known:

# pdp m u <PROBLEMATIC USERNAME>

or alternatively:

# pdp m ip <PROBLEMATIC IP>

and on the PEP side:

# pep sh u q cid <PROBLEMATIC IP>

or alternatively:

# pep sh u q usr <PROBLEMATIC USERNAME>

In addition to the above outputs, please provide TAC:

1. cpinfo from both PDP and PEP (if these are different machines)

2. log files:

$FWDIR/log/pdpd.elg*

$FWDIR/log/pepd.elg*

Thanks,

Royi Priov.

Re: Identity Awareness - IDC Problems

Alex_Sykes — Tue, 07 Jan 2020 10:54:11 GMT

Hi Rene,

Did you get a fix from TAC for this as we're experiencing similar issues?

Many thanks
Alex

Re: Identity Awareness - IDC Problems

MartinTzvetanov — Wed, 29 Jul 2020 20:56:04 GMT

Hello,

Any updates here?