topic Re: Identity Collector in Firewall and Security Management

Identity Collector

GigaYang — Mon, 21 Aug 2023 12:31:47 GMT

Hi All,

We tried to set up an Identity Collector host to replace the original AD Query function of the firewall.

After the erection is complete. We found it in the log column of "Source user name". No user account information appears. In the IA-related Log, we saw the following error message:
"Failed to get user groups for the domain.
Verify that this domain name is configured in your LDAP Account Unit."

We have closed the local firewall of the AD and Identity Collector hosts, but still cannot collect user information.

Our AD version is Windows Server 2019. Can someone who has encountered the same problem give guidance.

Thanks

Re: Identity Collector

the_rock — Mon, 21 Aug 2023 13:19:28 GMT

When you open IC software, does gateway show as connected status? Also, did you make sure AD query is fully off?

Andy

Re: Identity Collector

PhoneBoy — Mon, 21 Aug 2023 15:09:49 GMT

Identity Collector changes how the gateways acquire users (using Security Logs instead of WMI).
The actual groups are still pulled the same way as with ADQuery: via LDAP queries from the relevant gateways.
Which means you should verify the information needed to perform these lookups is correct: https://support.checkpoint.com/results/sk/sk180392

Re: Identity Collector

GigaYang — Mon, 21 Aug 2023 16:05:43 GMT

After I add a LDAP account unit object. The problem has been solved.

Re: Identity Collector

the_rock — Mon, 21 Aug 2023 16:10:15 GMT

Good job!

Re: Identity Collector

GigaYang — Tue, 22 Aug 2023 14:46:31 GMT

We made some architectural adjustments today. The Identity Collector host is placed on a different network segment from the Gateway management interface. As a result, the Identity Collector cannot establish a connection with the Gateway, but the Allow Log is displayed. Has anyone encountered such a situation?

Re: Identity Collector

the_rock — Tue, 22 Aug 2023 14:52:23 GMT

Do you have proper rules configured? Does ping work back and forth?

Andy

Re: Identity Collector

GigaYang — Tue, 22 Aug 2023 15:07:06 GMT

Yes,

We have set the firewall rule from IC to gateway over TCP 443. And ping is work well.

Re: Identity Collector

the_rock — Tue, 22 Aug 2023 15:08:55 GMT

Does gateway show as green in IC software? Also, can you pull identity source on the software itself? I will send screenshots later of what Im referring to.

Andy

Re: Identity Collector

the_rock — Tue, 22 Aug 2023 15:44:34 GMT

K, as promised, I attached document of what I was referring to.

Andy

Re: Identity Collector

GigaYang — Tue, 22 Aug 2023 15:58:00 GMT

Hi Rock,

When IC Server and Gateway are in the same subnet. IC can function normally. But when we re-set up the IC in another subnet, the two cannot be connected. But I'm sure the IC can connect to the Gateway via TCP 443.

When unable to connect, the Gateway status on the IC is red. I'll provide footage later.

Re: Identity Collector

the_rock — Tue, 22 Aug 2023 16:07:46 GMT

That sort of makes sense, since as we all know, when hosts are on the same subnet, all that needs to happen is they know about one another's ARP, no routing needed, so its logical it works.

If it fails on different subnets, confirm the routing, as well as access policy. Do basic zdebug, as well as fw up_execute as well

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_CLI_ReferenceGuide/Topics-CLIG/FWG/fw-up_execute.htm

Andy

Re: Identity Collector

GigaYang — Tue, 22 Aug 2023 16:10:28 GMT

Hi Rock, attach file is my setting.

Re: Identity Collector

the_rock — Tue, 22 Aug 2023 16:13:19 GMT

Right, so we need to find out WHY it fails, so only way to know is by running basic captures, simple debugs and see where its "stuck"

Andy

Re: Identity Collector

GigaYang — Tue, 22 Aug 2023 16:33:07 GMT

Attach file is fw monitor and zdebug result. I think the connection between the Gateway and the IC host is normal.

Re: Identity Collector

the_rock — Tue, 22 Aug 2023 16:34:48 GMT

I think quick remote session with TAC would probably solve your issue, I feel like its something basic thats missing.

Andy

Re: Identity Collector

GigaYang — Mon, 11 Sep 2023 04:32:29 GMT

Finally we found two problems:
1. PDP Problem: After we disable the AD Query function, the Monitor's device status will never change.
2. The VPN certificate has expired.

After weReboot the device and re-sign the certificate. The problem is solved.

Re: Identity Collector

the_rock — Mon, 11 Sep 2023 11:58:03 GMT

Good job!