topic Re: Check Point Identity Collector - Windows Server firewall Permisoins in Firewall and Security Management

Check Point Identity Collector - Windows Server firewall Permisoins

freeman91 — Fri, 28 Feb 2025 10:11:55 GMT

Hi all,

I looked at all the threads related to Identity Collector, as well as the documentation for deploing Identity Collector and like other, I also have had a problem until I turned off firewall on windows server.

This is enough for me just to check if there is a connection issue to DC other then firewall. Now I want to turn on the firewall and allow only what is necessary.
Are anyone here is willing to share setup of its windows firewall in case where its firewall is turned on, and connection with IC is green 🙂

Far now, I allowed only those 7 DCOM 135 rules but it is not enough.

Re: Check Point Identity Collector - Windows Server firewall Permisoins

Chris_Atkinson — Fri, 28 Feb 2025 11:36:32 GMT

HTTPS, DCOM, RPC, LDAP, DNS are needed depending on the server role. https://sc1.checkpoint.com/documents/Identity_Awareness_Clients_Admin_Guide/Content/Topics-IA-Clients-AG/Identity-Collector-Requirements.htm?tocpath=Identity%20Collector%7C_____1

Re: Check Point Identity Collector - Windows Server firewall Permisoins

freeman91 — Fri, 28 Feb 2025 13:10:54 GMT

Can you assist me how does this rule looks like in firewall policy:

Add "Allow" rule
Remote Event Log Management > Remote Event Log Management (RPC)

Re: Check Point Identity Collector - Windows Server firewall Permisoins

the_rock — Fri, 28 Feb 2025 13:35:27 GMT

I just add a rule that says from fw to IC (bi-directionally), allow on any port, thats it.

Andy

Re: Check Point Identity Collector - Windows Server firewall Permisoins

freeman91 — Fri, 28 Feb 2025 13:59:27 GMT

Ok, I can accept that as a good workaround solution.

Thank you!

Re: Check Point Identity Collector - Windows Server firewall Permisoins

the_rock — Fri, 28 Feb 2025 14:01:51 GMT

Glad we can help. Btw, since we all do IT security here, goes without saying ports should always be indicated whenever possible, but at the end of the day, this is just internal communication, so I dont find it would be a huge deal...just my 2 cents.

Andy

Re: Check Point Identity Collector - Windows Server firewall Permisoins

freeman91 — Fri, 28 Feb 2025 14:05:06 GMT

I can agree. Just bc it is internal communication between DC and IC, any any policy with specified source and destination will do a job.

Re: Check Point Identity Collector - Windows Server firewall Permisoins

the_rock — Fri, 28 Feb 2025 14:08:19 GMT

Though you can always follow what Chris gave, its an official reference.

Andy