topic Re: Access role is not working with Identity collector when network roaming in Firewall and Security Management

Access role is not working with Identity collector when network roaming

Wyl — Fri, 23 Jun 2023 18:19:30 GMT

Hello guys,

I need some help about identity awareness. We are currently using R81.10 take 87 in VSX environment.

I used identity collector as a identity source. This source is fine when we first authenticate to the AD.

But during working hours, users have to changed different IPs and have to do network roaming.

When the IP is changed for that user, security gateways do not have the updated IP information and the connections are being blocked without hitting the access role policy. Other vendors' firewalls are working fine with that kind of situation.

Is there anything I missed to configure? Do I need another identity sources to work with that kind of situations.

Thanks

Re: Access role is not working with Identity collector when network roaming

PhoneBoy — Sat, 24 Jun 2023 16:50:53 GMT

We recommend acquiring the identity of the user as close as possible to the source.
In some cases, we recommend installing an Identity Agent.
This is required in the case of Multi-User hosts and highly recommended for users who roam.
See: https://support.checkpoint.com/results/sk/sk134312

Re: Access role is not working with Identity collector when network roaming

JoSec — Sun, 25 Jun 2023 06:03:45 GMT

Be sure you add of your DCs to the Identity collector which I assume you did since the initial IP is working as you indicated but Identity Agent is the way to go IMHO as Phoneboy indicated.

Re: Access role is not working with Identity collector when network roaming

Wyl — Mon, 26 Jun 2023 02:50:30 GMT

I am planning to use identity agents and terminal servers agents. Is it work with identity sharing feature since Identity agents can only connect to one VSX? Thanks for your advice.

Re: Access role is not working with Identity collector when network roaming

PhoneBoy — Mon, 26 Jun 2023 17:15:47 GMT

Yes, you can leverage Identity Sharing.