topic Re: R80.30 - Identity Awareness failure in Firewall and Security Management

R80.30 - Identity Awareness failure

Howard_Gyton — Mon, 21 Feb 2022 11:25:27 GMT

Hi,

Occasionally some of our users report they can no long access resources they normally can, and it appears that Identity Awareness has failed.

What we notice is the following output from "adlog a dc":

adlog a dc
Domain controllers:
Domain Name IP Address Events (last hour) Connection state
============================================================================================================
<domain> <ip> 39519 has connection
<domain> <ip> 5939 has connection
<domain> <ip> 0 has connection - warning: 0 events in the last minute

Ignored domain controllers on this gateway:
No ignored domain controllers found.

In the above output, I have rebooted the top two DC's, and only the third has the original problem. I have left that machine in that state so that we can hopefully found out what is going on. The only thing we have found that "fixes" it is to reboot all three DC's in sequence. Then its okay again for a number of months.

I have also tried restarting a number of likely services, such as that below, but that nothing that has made a difference so far. I have also checked for the following events in the "Security" log, and they are there: 4624, 4768, 4769 and 4770

Has anyone else come across this?

We already have a ticket open with our support partner, I'm just looking for some feedback from the community.

Re: R80.30 - Identity Awareness failure

Chris_Atkinson — Mon, 21 Feb 2022 11:50:35 GMT

As a side note please look at moving to Identity Collector in place of AD query.

Re: R80.30 - Identity Awareness failure

Howard_Gyton — Mon, 21 Feb 2022 11:55:17 GMT

Yes, I've just been reading up on that. It seems pretty straightforward to install. We already have the MUH agents installed on our Terminal Servers, and the setup seems very similar.

Migration doesn't seem too difficult either. It can be configured on the firewalls, then run some connection tests on the clients, and if those pass, untick "AD Query", and push policy.

https://community.checkpoint.com/t5/General-Topics/Move-from-Identity-Awareness-AD-Query-to-ID-Collector-now/td-p/141483