topic Re: AD Query to Identity Collector in Firewall and Security Management

AD Query to Identity Collector

AleLovaz82 — Tue, 17 Jun 2025 14:50:46 GMT

we actually have a 80.40 Load Sharing Cluster that use adquery for IA rules.
We have an issue , only one member can run adlog and run adquery ,so CP suggested us to use Identity Collector.

Our idea is to deploy two IC that will be used by the cluster using an F5 load balancer.

Anyone see any issue with our idea?

Soon this cluster will be replaced by an 81.20 Virtual System, there are any limitation with IC and VSX ?

Thx

Re: AD Query to Identity Collector

PhoneBoy — Tue, 17 Jun 2025 15:05:28 GMT

As far as I know, there are no limitations with Identity Collector and VSX.

What exact purpose does the F5 Load Balancer serve in your proposed architecture?
Also, a diagram with the location and connectivity of the relevant elements (including the AD servers) will help answer the question more accurately.

Re: AD Query to Identity Collector

Lesley — Tue, 17 Jun 2025 18:25:53 GMT

Hi,

Skip the idea of a F5 load balancer. If you use 2 IDC systems and both connect them to the gateway they run active / active.

If you reboot one, the other one is not aware or anything like that it just keeps doing it's job.

With all my customers I deploy 2 IDC systems. So if you upgrade one you sure you have the other one still running.

F5 is not needed. GW can connect directly to IDC and IDC direct to AD.

Re: AD Query to Identity Collector

the_rock — Tue, 17 Jun 2025 23:27:05 GMT

I totally get what @Lesley is saying, I also know few customers that followed the same logic and all works fine, no issues.

Andy