topic Re: Some of Terminal Agent Users are not authenticated in Firewall and Security Management

Some of Terminal Agent Users are not authenticated

Wyl — Tue, 27 Jun 2023 02:28:41 GMT

Hello Guys,

I am having troubles with deploying terminal server agents. The problem is some of the users are authenticated and some are showing not authenticated. Do I need some user permission from AD for that unauthenticated users or do I need to add additional config on smartconsole or gateways? I am currently using for R81.10 JHF take87 on VSX envrionment.

Thank you all!!!

Re: Some of Terminal Agent Users are not authenticated

PhoneBoy — Tue, 27 Jun 2023 14:08:20 GMT

Not sure where you are seeing this "unauthenticated" message.
Can you provide relevant screenshot(s) with sensitive details redacted?

Re: Some of Terminal Agent Users are not authenticated

Wyl — Wed, 28 Jun 2023 04:35:03 GMT

This is the screenshot from Terminal Server Agent (muh2)

When I try to check logs, I found the following lines.

[24 Mar 10:19:57] Added user domain/user with ID range <19969,20224>
[24 Mar 10:19:57] Client is connected to PDP: xxx.xxx.xxx.xxx
[24 Mar 10:19:57] User domain/user failed to authenticate
[24 Mar 15:07:14] Session change event occured. Event type: WTS_REMOTE_CONNECT, session id: 5
[24 Mar 15:07:17] Session change event occured. Event type: WTS_REMOTE_CONNECT, session id: 3
[24 Mar 15:31:46] Session change event occured. Event type: WTS_REMOTE_CONNECT, session id: 5
[24 Mar 15:31:54] Session change event occured. Event type: WTS_REMOTE_CONNECT, session id: 3

Re: Some of Terminal Agent Users are not authenticated

PhoneBoy — Thu, 29 Jun 2023 11:53:24 GMT

Are users authenticating against on-prem Active Directory here?
What version of gateway is used here?
MUHv2 requires R80.40 and above.

You may need to involve the TAC here: https://help.checkpoint.com

Re: Some of Terminal Agent Users are not authenticated

Wyl — Thu, 29 Jun 2023 12:26:59 GMT

Yes I am using r81.10 with take 87. It is the VSX environment. Some terminal servers are working fine with all users authenticated but some are not.

Re: Some of Terminal Agent Users are not authenticated

PhoneBoy — Thu, 29 Jun 2023 13:58:19 GMT

So it's users who are connecting via SNX who are showing up as unauthenticated?
You realize Remote Access clients ARE an Identity Source, correct?
Of course, that doesn't help when you connect to a terminal server, which requires MUHv2.
I suspect you'll need a TAC case here: https://help.checkpoint.com