topic Identity Awareness stopped working after upgrade in Firewall and Security Management

Identity Awareness stopped working after upgrade

Sanjay_S — Mon, 04 Jan 2021 15:57:06 GMT

Hi All,

We upgraded the VSX cluster from R77.30 to R80.30, since then Identity awareness stopped working. I am not able to create a new access role where the AD is reseting the 636 packet. But AD is reachable from firewall. Is this anything to do with TLS version or any SSL setting needs to be checked after upgrading? Please suggest.

Re: Identity Awareness stopped working after upgrade

Royi_Priov — Tue, 05 Jan 2021 07:11:16 GMT

Hi @Sanjay_S ,

It sounds like the communication to the AD server indeed is not working. When creating an access role, the communication is between mgmt server and the AD, while Identity Awareness enforcement requires the GW to communicate with the AD server.

You have mentioned port 636, which points to the fact you are probably using LDAP over SSL.

Have you tried to refetch the fingerprint inside the LDAP account unit object? please do so, and install policy afterwards.

If the issue still exists, I suggest contacting Check Point support.

Re: Identity Awareness stopped working after upgrade

Borut — Tue, 05 Jan 2021 10:26:52 GMT

We sometimes forgot to turn on NTLMv2 support after upgrading and IA was not working. Not sure if the symptoms match.

https://sc1.checkpoint.com/documents/R80.40/WebAdminGuides/EN/CP_R80.40_IdentityAwareness_AdminGuide/Topics-IDAG/Configuring-Identity-Sources-Configuring-AD-Query.htm?Highlight=ntlm