topic Re: identity collector - gateway can't see user/machine details in Firewall and Security Management

identity collector - gateway can't see user/machine details

Jonathan — Tue, 15 Nov 2022 19:11:41 GMT

Hi,

Just installed and configured Identity Collector for one of our two domains.

Everything looks fine on the IDC, I can see events and users-machines correlations.

however when running pdp m ip x.x.x.x there are many details missing:

Also in SmartConsole logs I see this:

Anyone familiar with this issue?

Re: identity collector - gateway can't see user/machine details

the_rock — Tue, 15 Nov 2022 20:13:41 GMT

There was a recent post on similar and issue was windows firewall on IC itself, but dont believe thats problem here. Make sure below is checked as per my screenshot.

Andy

Re: identity collector - gateway can't see user/machine details

Jonathan — Tue, 15 Nov 2022 20:19:21 GMT

Hi,

There's no firewall on the IDC.

However, "Ignore machine identities" was not checked.

Sounds like it really should not be checked or else it would ignore the machine identity.

Also, how is this related to users not being propagated?

can you explain please?

Re: identity collector - gateway can't see user/machine details

Jonathan — Tue, 15 Nov 2022 20:23:54 GMT

Anyway, I tried what you suggested and it didn't work.

Only now, I don't see machine details at all:

Re: identity collector - gateway can't see user/machine details

the_rock — Tue, 15 Nov 2022 20:40:46 GMT

Sorry man, my bad, I confused 2 different things. I was thinking of "log out", rather than "log in" events. For what you are after, yes, option should be unchecked, apologies.

I found below links about it, but not sure either one applies 100% to your scenario:

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk106133

https://community.checkpoint.com/t5/Security-Management/Identity-Awareness-We-are-detecting-error-quot-Make-sure-the/td-p/24416

Let me check on my end and see what could be missing.

Re: identity collector - gateway can't see user/machine details

Jonathan — Tue, 15 Nov 2022 20:57:49 GMT

No problem 🙂

Already went through these links, they didn't help unfortunately...

Re: identity collector - gateway can't see user/machine details

PhoneBoy — Wed, 16 Nov 2022 01:25:35 GMT

Have you done any troubleshooting on the LDAP piece of this?
The groups come from an LDAP lookup from the gateway, not from Identity Collector.

Re: identity collector - gateway can't see user/machine details

Jonathan — Wed, 16 Nov 2022 05:27:31 GMT

The LDAP object is working fine when adquery is used. It's only when switching to IDC that it's not working.

After switching to IDC I unchecked the "AD query" option in the LDAP object, that's the only change I've made.

I rechecked the server and credentials in the LDAP and they're OK. What else can I check?

Re: identity collector - gateway can't see user/machine details

the_rock — Wed, 16 Nov 2022 12:35:28 GMT

That made me remember...when you say unchecked "ad query", are you referring to actual setting on the identity awareness tab on the firewall object itself?

Re: identity collector - gateway can't see user/machine details

Jonathan — Wed, 16 Nov 2022 12:48:28 GMT

Both.

I've tried all combinations:

IDC + ADQuery on fiewall object

IDC without ADQuery on firewall object

IDC without ADQuery on fiewall object and on LDAP object.

Re: identity collector - gateway can't see user/machine details

the_rock — Wed, 16 Nov 2022 13:16:53 GMT

So odd...I work with customer who has AD query enabled WITH IC as well and no issues at all. Mind you, I believe TAC recommends to turn off AD query if you use IC (which makes sense), but either way, it should work, 100%. Do you see any logs related to this on your AD server at all?

Below is what TAC gave me once to debug identity awareness issue, so this also might be worth a shot.

(•)•) Identity awareness debugs
# cd $FWDIR/log
# rm pdpd.elg.*
# echo "=debug_start=" >> $FWDIR/log/pdpd.elg
(•) To turn pdp debug on:
# adlog a d on
# pdp debug on
# pep debug on
# pdp debug set all all
(•) Replicate the issue
(•) To turn them off:
# adlog a d off
# pdp debug unset all all
# pdp debug off
# pep debug off
# pdp d reset
# pep d unset all all
Collect debug:
$FWDIR/log/pdpd.elg
# tar zcvf pdpd_debugs.tgz pdpd.elg*
# tar zcvf pepd_debugs.tgz pepd.elg*

Re: identity collector - gateway can't see user/machine details

maad-pul — Fri, 12 Jan 2024 08:55:02 GMT

Hi Jonathan,

Did you get this working?

Regards

Re: identity collector - gateway can't see user/machine details

chethan_m — Tue, 16 Jan 2024 10:07:37 GMT

Is this issue resolved? if yes, can you share the solution here, please?

Re: identity collector - gateway can't see user/machine details

maad-pul — Tue, 16 Jan 2024 11:08:28 GMT

Hi!

I had this issue. I just installed and configured the Identity Collector and missed the LDAP part.
You need to have a "LDAP Account Unit" to map usernames from Identity Collector to the Domain for the Microsoft_AD.

Regards

Re: identity collector - gateway can't see user/machine details

chethan_m — Tue, 16 Jan 2024 15:55:24 GMT

I do have LDAP account unit in place. For me the issue is slightly different.

The individual user authentication works fine but when I use LDAP user groups instead of individual users in Access Roles the network access doesn't work.

When I do "pdp monitor all" I can users populated and but not their associated user groups on AD.