topic Re: Identity collector in Firewall & Security Management

Identity collector

Moudar — Tue, 05 Mar 2024 15:53:40 GMT

I am using IDC to collect identities from AD, but it works only on port 389:

If we try to use port 636 on the LDAP-AU then we get this when trying to show the AD on an Access role:

The certificate on AD servers have a purpose of "Server Authentication" (OID 1.3.6.1.5.5.7.3.1) and Client Authentication, but still get the same result.

any ideas?!

Re: Identity collector

Lesley — Tue, 05 Mar 2024 16:11:53 GMT

How does your LDAP account unit config looks like? Have you enabled LDAPS there? Able to retreive fingerprints?

Re: Identity collector

Moudar — Wed, 06 Mar 2024 08:17:54 GMT

We are able to retrieve fingerprints.

Re: Identity collector

Lesley — Wed, 06 Mar 2024 13:12:30 GMT

Config looks good.

2 things:

Can you fetch branches?

Do you see drops from the machine where you are running Smartconsole? I recall that this search is done from the Smartconsole software itself. Maybe compare the allowed 389 traffic with 636 traffic.

So check traffic from:

Smartcenter itself (fwmgt)

And machine on what the Smartconsole software is placed

Re: Identity collector

the_rock — Wed, 06 Mar 2024 13:45:35 GMT

As @Lesley asked, can you fetch the branches? Thats super important, mind you would not work in S1C instance, but if its on prem mgmt, 100% has to work.

Best,

Andy

Re: Identity collector

Moudar — Wed, 06 Mar 2024 14:38:30 GMT

The fetching process seems to be working correctly. Once it's finished, I receive a long MD5 hash

when running this command:

[Expert@fw01:0]# cpopenssl s_client -connect 10.8.0.12:636 2>&1 </dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' | cpopenssl x509 -noout -md5 -fingerprint

I get the same MD5 hash that shows on the LDAP-AU

Re: Identity collector

Moudar — Wed, 06 Mar 2024 14:57:51 GMT

The fetching process seems to be working correctly. Once it's finished, I receive a long MD5 hash.

I cannot see any drop between these machines!

Re: Identity collector

the_rock — Wed, 06 Mar 2024 15:01:41 GMT

If thats the case, may need some more debugging...I would open TAC case if you have not done so already.

Best,

Andy

Re: Identity collector

Moudar — Wed, 06 Mar 2024 15:16:19 GMT

If I run this on Wireshark:

ip.addr == 192.168.12.12 and tcp.port == 636

where 192.168.12.12 is AD, Wireshark is running on Windows machine that runs SmartConsole and IDC.

Should that show any packets? Because it does not show anything now!

How and where should I run Wireshark to see if 636 traffic is flowing ?

Re: Identity collector

Lesley — Wed, 06 Mar 2024 15:29:14 GMT

can you check:

https://support.checkpoint.com/results/sk/sk167159

Re: Identity collector

Lesley — Wed, 06 Mar 2024 15:29:37 GMT

Not needed anymore has been changed:

https://support.checkpoint.com/results/sk/sk115677

Re: Identity collector

Moudar — Wed, 06 Mar 2024 20:59:05 GMT

My certificates are signed with sha256RSA!

Re: Identity collector

Moudar — Wed, 06 Mar 2024 21:33:19 GMT

checking the logs $FWDIR/log/cpm.elg

some Error is happening, any ideas