Identity awareness - groups from AD

Tomas_Kolek — Mon, 06 Aug 2018 08:09:25 GMT

Hello,

we have issues with Identity Awareness on Checkpoint firewalls R80.10. We are using Terminal Servers for Citrix users. Users are correctly authenticated on AD but they are not receiving all AD groups.

For example:

I should by in 8 groups on AD but in the output from pdp monitor all on gateway (on active cluster member) I can see only 5 AD groups and thus I don't have access to some systems. It looks like Checkpoint ignores several groups/roles. Configruation on AD is correct.

Could you please help me with this issue? Why Checkpoint ignores some AD groups?

Thank you

Best regards,

Tomas

Re: Identity awareness - groups from AD

Tzvi_Katz — Mon, 06 Aug 2018 08:42:17 GMT

Hello Tomas,

The groups visible in "pdp m a" are the groups which are part of an access role. Does all the groups appear in the access roles?

Additional options are:

1. That some of the groups are nested too deep or the groups are nested but the nesting is disabled.

2. The groups are part of a foreign domain.

If the first option is not the case I suggest to have a TAC ticket to assist in check that all is configured as required.

Regards,

Tzvi Katz - IDA & Access Clients GM

topic Re: Identity awareness - groups from AD in Firewall and Security Management

Identity awareness - groups from AD

Re: Identity awareness - groups from AD