topic Re: Identity awareness and ADS machine identity propagation in Firewall and Security Management

Identity awareness and ADS machine identity propagation

Niels_van_Sluis — Wed, 31 Mar 2021 08:05:33 GMT

Hi,

In our setup we are using the Identity Awareness blade on a R80.40 Security Gateway, which receives identities from an Identity Collector. The Identity Collector itself collects the identities from a pool of Microsoft Active Directory servers.

Everything seems to be working fine for some time now, but I've noticed that for the Active Directory servers themselfs the Security Gateway isn't receiving Machine Identity Propagation login or updates. Is this by design?

Kind regards,

--Niels

Re: Identity awareness and ADS machine identity propagation

PhoneBoy — Wed, 31 Mar 2021 15:35:37 GMT

You mean when someone logs into the AD server itself?
Note only AD users are acquired, no local users will be acquired.

Re: Identity awareness and ADS machine identity propagation

Niels_van_Sluis — Wed, 31 Mar 2021 16:04:49 GMT

Hi Phoneboy,

No, it is for the AD server itself. For other non-AD-servers I see log entries like shown below.

Id: 0a6000f1-b607-a64b-6064-724300000001
Marker: @A@@B@1617193489@C@911804
Log Server Origin: x.x.x.x
Time: 2021-03-31T12:59:47Z
Id Generated By Indexer:false
First: true
Sequencenum: 87
Domain Name: example.com
Source: y.y.y.y
Endpoint IP: y.y.y.y
Authentication Status: Successful Login
Identity Source: Identity Collector (Active Directory)
Session ID: 66d6b3c5
Source Machine Name: servername
Source Machine Group: All Machines; ad_group_my_servers;
Authentication Method: Machine Identity Propagation
Identity Type: machine
Authentication Trial: this is a reauthentication for session xxxxxx
Roles: My_Servers
Action: Update
Type: Log
Blade: Identity Awareness
Origin: FW-A
Product Family: Network
Logid: 131073
Description: Successful Login

Updates like these are not being received for the AD servers themself.

Re: Identity awareness and ADS machine identity propagation

PhoneBoy — Thu, 01 Apr 2021 00:46:48 GMT

But you're using an actual AD account to log in, correct?
Maybe @Adi_Babai or @Royi_Priov know here.

Re: Identity awareness and ADS machine identity propagation

Niels_van_Sluis — Thu, 01 Apr 2021 10:58:31 GMT

Well as far as I know, it is the AD server itself. I think the 'Machine Identity Propagation' update is send when a system itself is domain joined en authenticates itself to the AD server or domain. Maybe the AD represents the domain itself, and therefore doesn't join the domain like non-ADS servers do. That could be the reason that I don't see updates on the Security Gateway.

Re: Identity awareness and ADS machine identity propagation

PhoneBoy — Thu, 01 Apr 2021 20:19:37 GMT

Your explanation seems reasonable to me, at least.

Re: Identity awareness and ADS machine identity propagation

alexander_ae — Thu, 20 May 2021 14:33:19 GMT

Hi Niels,

summary: it appears only the AD Servers , selected as an identity source that appear to be affected.

long:

We have the same behaviour in our environment. (1st time posting on checkpoint.... hooray.)
> other domain controllers, NOT in the Identity Collector as sources are registering just fine here.

It's only those that are enlisted as "Identity Collector Sources" that are not registering as "machine identity". Exactly what you described.

Was this fixed for you somehow recently? or still an open question? Wondering if we should open a case @ CP for this or not.
Honestly we don't know if it has always been like this - but considering the Ruleset we stumbled upon a couple issues - and narrowed it down to the fact those specific Domain Controllers are not having their machine identity updated towards our Security Gateway.

Re: Identity awareness and ADS machine identity propagation

Daniel_Kavan — Fri, 29 Apr 2022 13:00:18 GMT

I'm wondering if machine identity propagation can be turned off when it's not being used. We're just using network and user authentication to validate access not machine identity.

Also, the domain controllers its trying to get to are not configured in our LDAP account unit by design. We are only using domain controllers in domain A, not B or C to validate users. Those domain controllers exist for off site customers.

In the case I did want to use those other domain controllers from other domains, I assume I would have to use MDS for management (multiple domains). IOW, if someone LDAP used a domain from domain B, a DC in domain A wouldn't find it even if I had it listed as a DC. You can't control which DC is used for each rule. Maybe, that will change in R81.20?

Re: Identity awareness and ADS machine identity propagation

Daniel_Kavan — Wed, 08 Nov 2023 19:31:09 GMT

No, I'm still seeing all these messages.

Failed to get users groups for the domain.
Verify that this domain name is configured in your LDAP Account Unit.
Domain: somegroup.local

the answer maybe to add these domains to the IDC, there's a few differentusers who log in.

After adding the new domain to IDC and adding an account unit for the new domain, I'm still seeing these in R81.20

Machine Identity propagation Failed Login Failed to get users groups for the domain.
Verify that this domain name is configured in your LDAP Account Unit. (Yes, it is so ?)

Re: Identity awareness and ADS machine identity propagation

Phil_Pasquier — Wed, 03 Jan 2024 14:51:39 GMT

Getting the same error here, actually a lot of them... ? Propagation deactivation option would be helpful

Any other leads ?

Re: Identity awareness and ADS machine identity propagation

JacWev — Fri, 21 Feb 2025 09:53:26 GMT

We also see this in our environment. Is there a solution for this.

Re: Identity awareness and ADS machine identity propagation

Phil_Pasquier — Fri, 21 Feb 2025 10:02:49 GMT

Hi. Checked the SR history I had and we fixed it with:

Re: Identity awareness and ADS machine identity propagation

JacWev — Fri, 21 Feb 2025 10:11:07 GMT

Ah Great.... ( and fast answer )

I will look a solution for a terminal server.