topic Re: Forescout NAC Identity Awareness API in Firewall and Security Management

Forescout NAC Identity Awareness API

Jonathan_Langle — Mon, 28 Jun 2021 20:46:49 GMT

We have the Check Point intergration to Forescout so we can add users to Access Roles in our security Policy. This is mostly working outside of one piece, the IP To User Mapping. It would appear Forescout is sending the EXAMPLE\Username instead of what our LDAP Account Unit is configured for which would be EXAMPLE.Domain.com as an example.

Has anyone else used this integration and run into this? I tried changing the UserLoginAttr on the gateway object to UserPrincipalName but no dice. The error i am seeing is the following:Failed to get users groups for the domain. Verify that this domain name is configured in your LDAP Account Unit. Domain: EXAMPLE

Re: Forescout NAC Identity Awareness API

PhoneBoy — Wed, 30 Jun 2021 21:17:48 GMT

Have you approached Forescout related to this?
Can you include a (redacted) log card as well as version/JHF level?

Re: Forescout NAC Identity Awareness API

Jonathan_Langle — Thu, 01 Jul 2021 16:49:05 GMT

Not yet, i have a ticket open with Support now and sent them PDP and PEP logs. Here i dont have much of a log to go off of, but this is in smart console:

Failed to get users groups for the domain.
Verify that this domain name is configured in your LDAP Account Unit.
Domain: DOMAIN

Our Domain in the ldap account unit is DOMAIN.EXMAPLE.COM and the domain on the forescout side is sending just DOMAIN.

Re: Forescout NAC Identity Awareness API

Kirupa_Shankar_ — Fri, 01 Sep 2023 02:52:33 GMT

Hello @Jonathan_Langle where you able to implement this successfully?

we are trying the integration to send forescout identified device classifications to checkpoint access roles to be used in the policy. Your insight will be helpful.