topic Re: Identity sharing - how to change modes in Firewall and Security Management

Identity sharing - how to change modes

Ryan_Ryan — Tue, 17 Sep 2019 06:12:06 GMT

Hello, as per this document:

https://sc1.checkpoint.com/documents/R80.10/WebAdminGuides/EN/CP_R80.10_IdentityAwareness_AdminGuide/html_frameset.htm?topic=documents/R80.10/WebAdminGuides/EN/CP_R80.10_IdentityAwareness_AdminGuide/150080

there are two methods for a remote PEP gateway to learn identities, Smart-Pull or Push Sharing. Based on the output of "pdp connections pep" command (and the fact we can only see a handful of entries one one the other cluster) it seems we have smart-pull mode.

I want to change this to push method. We have a second site with an identical cluster and I would like the PEP databases to be synchronised on both. I cannot find anything that tells me how to do this?

(We are R80.20)

thanks

Re: Identity sharing - how to change modes

G_W_Albrecht — Tue, 17 Sep 2019 09:21:34 GMT

This has been an old trick in the first days to cope with IA issues - but it is not (or no longer ?) documented in any sk. This is understandable, as that needs a manual GUIDbedit change on SMS, a thing that should never be done without a good reason 😊. Which issues are you experiencing that would justify such a change ?

Also, this change is for AD Query only, and AD Query is today commonly replaced by Identity collector. For more information, see sk44178: IdentityLogging - Frequently Asked Questions, sk86441: ATRG: IdentityAwareness, sk108235: IdentityCollector - Technical Overview and sk88520: Best Practices - IdentityAwareness Large Scale Deployment.

Re: Identity sharing - how to change modes

Ryan_Ryan — Wed, 18 Sep 2019 00:38:48 GMT

Hi thanks for the reply.

Yes I suspected it was a Dbedit under the hood somewhere.

We did have an issue where an ADquery fetched user was showing on one gateway but not on another where an IA rule was used and therefore the users access was not working. It took me a while to understand why so few users where showing on my other shared cluster compared to the cluster doing ADQuery. That issue however has now self resolved.

So really no reason for us to change mode now - other to to simplify troubleshooting a bit, I still don't fully understand how the smart decides what to pull and what not to pull but I can live with that 🙂

Re: Identity sharing - how to change modes

Dor_Marcovitch — Tue, 13 Oct 2020 07:28:21 GMT

from what i understand from TAC, Push method is not supported by R&D that is why the configuration is not open for all users.

Re: Identity sharing - how to change modes

G_W_Albrecht — Tue, 13 Oct 2020 07:38:23 GMT

Unlikely - documentation says:

Push Sharing Method

This method is straight-forward: a PDP publishes each identity when it is acquired to the PEP.

Note - It is the only sharing method for the Identity Awareness Security Gateway that runs both as PDP and PEP.