topic Re: Connect Smart-1 Cloud to local Active Directory in Firewall and Security Management

Connect Smart-1 Cloud to local Active Directory

H2-F1 — Sat, 07 Nov 2020 07:38:01 GMT

Hi Guys,

I'm not able to connect my Smart-1 Cloud to local active directory. I followed the steps in

https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/Check-Point-SmartCloud-Admin-Guide/Topics-Smart-1-Cloud/Advanced-Configuration.htm?TocPath=Smart-1%20Cloud%20Advanced%20Configuration%7C_____3

under the "How to Connect a Local Active Directory to Smart-1 Cloud".

I have confirmed that the gateway can reach the DC. The Maas tunnel state is up (I can push policies to the gateway), I also have another local management server and this can successfully connect to the DC using the same credentials as the LDAP account unit configured in smart-1 Cloud.

A packet capture on the DC shows no traffic from the Gateway when I try to fetch the branches from Smart-1 Cloud. I'm not sure if I need to turn on http/https Proxy on the gateway itself or if I'm missing some other configuration.

Re: Connect Smart-1 Cloud to local Active Directory

PhoneBoy — Sat, 07 Nov 2020 21:13:40 GMT

What version/JHF of gateway?

Re: Connect Smart-1 Cloud to local Active Directory

H2-F1 — Sat, 07 Nov 2020 23:58:58 GMT

software version R80.40 - Build 106 - HOTFIX_R80_40_JUMBO_HF_MAIN Take: 83

Re: Connect Smart-1 Cloud to local Active Directory

Amiad_Stern — Sun, 08 Nov 2020 07:37:58 GMT

Hi,

The fact that you fail to fetch branches shouldn't prevent you from creating Access Role and access your AD. As far as I know, the 'Gateway as a Proxy' feature was developed for 'Access Roles' only. Please try to create an Access Role and access your AD, if you fail to do that as well, please let me know and I will address the relevant owner.

Regards,

Amiad.

Re: Connect Smart-1 Cloud to local Active Directory

H2-F1 — Tue, 10 Nov 2020 09:26:34 GMT

Thanks Amiad,

That is indeed correct, I was able to create an Access Role and browse through AD. Also for anyone else that is facing the same issue, I also enabled Identity Awareness and while I wasn't able to also connect to AD during blade activation, I ignored it and continued, I manually added my AD in the for Active Directory Query - settings section. when testing, I was able to see the machine hostname and user full name.

Thanks again.

Re: Connect Smart-1 Cloud to local Active Directory

Fatihah — Tue, 13 Dec 2022 08:18:06 GMT

Hi @Amiad_Stern ,

I did follow as you mentioned.

However when I trying to create the Access Role, I unable to access the AD as below:

Is there anything that I'm missing?

Regards,

Fatihah

Re: Connect Smart-1 Cloud to local Active Directory

Amiad_Stern — Wed, 14 Dec 2022 10:16:05 GMT

Hi @Fatihah ,

I'm no longer the owner of Smart-1 Cloud. I'll refer this thread to the relevant owners for them to address your issue.

Regards,

Amiad.

Re: Connect Smart-1 Cloud to local Active Directory

Fatihah — Thu, 15 Dec 2022 05:30:24 GMT

Hi @Amiad_Stern,

Oh I see. Sure and thanks for your help.

Hopefuly, they able to assist me on this issue.

Regards,

Fatihah

Re: Connect Smart-1 Cloud to local Active Directory

Stas_M — Thu, 22 Dec 2022 15:52:51 GMT

Hi @Fatihah,
Apologies for delay. Did you solved the above issue? Is it still relevant?

Re: Connect Smart-1 Cloud to local Active Directory

dzianiss — Tue, 27 Dec 2022 08:43:55 GMT

Hi,

Please note that fetching branch is not supported

https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/Check-Point-SmartCloud-Admin-Guide/Topics-Smart-1-Cloud/Advanced-Configuration.htm?Highlight=connect%20local%20ad#How_to_Connect_a_Local_Active_Directory_to_Smart-1_Cloud

You should manually add branch, after it you should be able to create access role.

Re: Connect Smart-1 Cloud to local Active Directory

Kevin_Morris — Thu, 12 Jan 2023 14:15:38 GMT

Hi @dzianiss ,

According to the admin guide you linked the cloud server will use the gateway as a proxy, but it doesn't give me any options for a proxy on the LDAP account unit. Is there a setting that should make my gateway available as a proxy?

Re: Connect Smart-1 Cloud to local Active Directory

dzianiss — Thu, 12 Jan 2023 15:14:00 GMT

Hi @Kevin_Morris ,

Which gateway platform/version are you using?

Also please check version of management and smartconsole build.

Re: Connect Smart-1 Cloud to local Active Directory

Kevin_Morris — Thu, 12 Jan 2023 16:29:40 GMT

Quantum Spark 1600 on R81.10

Re: Connect Smart-1 Cloud to local Active Directory

dzianiss — Thu, 12 Jan 2023 16:36:58 GMT

And which smartconsole build and smart-1 cloud version?

Re: Connect Smart-1 Cloud to local Active Directory

Kevin_Morris — Thu, 12 Jan 2023 17:11:43 GMT

SmartConsole 81.20.9700.451 / Smart-1 Cloud R81.20.

Re: Connect Smart-1 Cloud to local Active Directory

PhoneBoy — Thu, 12 Jan 2023 17:16:34 GMT

You can only select gateways running R80.20 and above as the proxy.
This does not currently include Quantum Spark devices.

Re: Connect Smart-1 Cloud to local Active Directory

Kevin_Morris — Thu, 12 Jan 2023 17:26:54 GMT

Actually it looks like you can select them if SmartConsole version is 81.20.9700.631. I was using .451 before. Now the question becomes does it actually work. So far I still can't get users and groups from AD.

Re: Connect Smart-1 Cloud to local Active Directory

dzianiss — Thu, 12 Jan 2023 19:53:47 GMT

Quantum Spark 1500 1600 1800 were added to support AD proxy feature with R81.20 security management.
Please check if you accurately configured:

Host for AD DC Server
ldap account unit, all required tabs:
1. General - Profile: Micrsoft_AD, Domain, User Management and Enable unicode support checked
2. Servers - added your AD DC Server and all required fields filled in LDAP Server Properties
3. Objects Management - Manually added Branch, proxy through: your GW selected

Re: Connect Smart-1 Cloud to local Active Directory

PhoneBoy — Thu, 12 Jan 2023 21:55:38 GMT

I'm curious when this was added since it's still listed as a known limitation in the relevant SK for R81.10.00: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk159772
The bug ID is SMB-16255.
It's possible this may have been added to R81.10.05 (currently in EA), though I didn't see it mentioned in the feature list.

Re: Connect Smart-1 Cloud to local Active Directory

dzianiss — Mon, 16 Jan 2023 06:59:14 GMT

Hi, AFAIK it was added in R80.20.50. I've tested this version and R81.00. Probably it was not announced in SMB project before R81.20 GA. From my side I can open bug for SMB to include it in resolved issues. I already opened bug for Management Guide - TP-10270.