topic Checkpoint Identity Agent: UserName Identification Problem on specific Users in Firewall and Security Management

Checkpoint Identity Agent: UserName Identification Problem on specific Users

Us4r — Fri, 03 Dec 2021 08:18:34 GMT

Hello,

currently we deploy checkpoint identity Agent in our enviroment.

On most Users it's working like expected but on some users only Machine Information will be set after user login but the user account won't be detected:

If I logon on the same computer with another ActiveDirectory User Account then this user account will be detected from the agent.

What can be the problem there and how can I debug this issue?

Regards

Florian

Re: Checkpoint Identity Agent: UserName Identification Problem on specific Users

G_W_Albrecht — Fri, 03 Dec 2021 10:16:16 GMT

This issue looks like in sk120838: Sometimes, output of "pep show user all" command does not show username in the "Username@Machine" column

Further info:

sk86441: ATRG: Identity Awareness

sk113232: Identity Awareness Agent: Network Communication and Process Summary

Re: Checkpoint Identity Agent: UserName Identification Problem on specific Users

Us4r — Mon, 06 Dec 2021 10:16:55 GMT

Hello,

it looks like it's really a specific Problem of the active directory UserAccount. If this useraccount tries to logon on another compuer also the user won't be authenticated using kerberos.

Anything else how I can debug this issue? Can this be something like a permission problem on the user Account in the active directory?

Re: Checkpoint Identity Agent: UserName Identification Problem on specific Users

David_M_Almas — Tue, 19 Apr 2022 16:43:50 GMT

Hi!

I'm deploying Identity Agent in our environment (VSX HA cluster in R81.10) and we're having exactly the same issue.

Did you managed to have a closure for this?

thanx!

Re: Checkpoint Identity Agent: UserName Identification Problem on specific Users

dehaasm — Mon, 05 Dec 2022 16:57:00 GMT

We had same issues has probably something to do with Kerberos ticket size for some users, in the pdp logs you might see PDPD (TD::Critical)] pdp::NACUrlProtocol::DataReceived: data length: 48578 ,exceeds the maximum of: 40974, try adjusting ccc_max_msg_size with DBedit tool, follow sk66087 https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk66087&partition=Advanced&product=Identity

Re: Checkpoint Identity Agent: UserName Identification Problem on specific Users

David_M_Almas — Fri, 06 Jan 2023 14:11:29 GMT

For future reference.

-----------------------------------------------------------------------

After reporting this issue to TAC, they noticed this error in the IA Agent logs:

[PDPD (TD::Critical)] pdp::NACUrlProtocol::DataReceived: data length: 9923 ,exceeds the maximum of: 8196

We then proceeded to increase the value ccc_max_msg_size using the following procedure (as always, please don't forget to perform a backup):

Connect with SmartConsole to the Security Management Server / Domain Management Server.
In the top left corner, click Menu > Database Revision Control > create a revision snapshot.

Note: Database Revision Control is not supported for VSX objects (sk65420) and Endpoint Security Servers. Instead, if running SMS/DMS in a virtual machine perform a snapshot prior to the following procedure.

In addition, refer to:

Close all SmartConsole windows.

Verify by running the "cpstat mg" command on Security Management Server / in the context of each Domain Management Server.

Connect with GuiDBedit Tool to the Security Management Server / Domain Management Server.
In the upper left pane, go to Table > Network Objects > network_objects.
In the upper right pane, select the relevant Gateway or Cluster object.
Press CTRL+F (or go to Search menu > Find) > paste ccc_max_msg_size > click Find Next.
In the lower pane, right-click on the ccc_max_msg_size > select Edit > select "65535" > click OK.
Save the changes: go to the File menu > click Save All.
Close the GuiDBedit Tool.
Connect with SmartConsole to the Security Management Server / Domain Management Server.
Install the Security Policy onto the applicable Security Gateway / Cluster / VSX Virtual System object.