topic Identity sharing in a split R77/R80 environment in General Topics

Identity sharing in a split R77/R80 environment

Gary_Partner — Mon, 12 Nov 2018 17:04:19 GMT

Approximately halfway complete with migration to R80.10 from R77.30. Have encountered errors related to identity awareness, and what appears to be identity sharing that's failing between gateways running R77.30 vs R80.10. This is causing one segment of my users to be unable to connect to the Internet. From what I've found so far it looks to be due to the fact that identity sharing services are not implied between the 2 versions, therefore tcp/15105 and tcp/28581 are blocked by the R80.10 gateways. We are using the identity collector for the R80.10 gateways, AD Query in R77.30 with a distributed environment with PEPs and PDPs. Can anyone speak to a recommended workaround until I'm able to migrate the remaining gateways to R80.10?

Re: Identity sharing in a split R77/R80 environment

PhoneBoy — Fri, 16 Nov 2018 19:58:26 GMT

The underlying identity sharing mechanism between R77.30 and R80.10 isn't different.

This SK might be worth looking at, though: In a Cluster environment, Identity propagation does not occur between an Identity Server (PDP) and Identity Gateway (PEP…

Re: Identity sharing in a split R77/R80 environment

PhoneBoy — Wed, 05 Dec 2018 01:18:37 GMT

I didn't realize this message was under one of the private user groups.

Mind if I move this to a more general area like General Product Topics‌ so others can comment?

Re: Identity sharing in a split R77/R80 environment

Gary_Partner — Wed, 05 Dec 2018 01:26:00 GMT

Not at all. I didn't realize it was set to private either. Rookie move on my part

Re: Identity sharing in a split R77/R80 environment

PhoneBoy — Wed, 05 Dec 2018 02:43:42 GMT

No worries, it's out in the public now.

Re: Identity sharing in a split R77/R80 environment

Mark_Mitchell — Mon, 04 Mar 2019 07:26:36 GMT

Hi Gary,

Would I be correct in assuming that you may have resolved this now?

Cheers

Mark

Re: Identity sharing in a split R77/R80 environment

Gary_Partner — Mon, 04 Mar 2019 12:36:18 GMT

Hi Mark,

Until I hear otherwise from my users, I'm going with yes I did modify my R80 policies to allow identity sharing with the R77 gateways. Also pushing to complete these upgrades sooner rather than later, and some of our domain controllers are moving which will require more changes to our configuration. Never boring here.

Thanks,

Gary

Re: Identity sharing in a split R77/R80 environment

Mark_Mitchell — Mon, 04 Mar 2019 21:01:05 GMT

Hi Gary,

Good to hear. Sounds like all fun there, it'll keep you busy.

If you need any further assistance, just shout.

Regards

Mark