topic Re: Identity Awareness Sk113021 in General Topics

Identity Awareness Sk113021

Ihenock1011 — Fri, 06 Dec 2024 08:56:00 GMT

Hi All,

We have Check Point R81.10 security gateways with Identity Awareness configured. We installed the agent on a separate server to fetch logs from the Active Directory, displaying machine names and source usernames accurately. However, on one of the security gateways, it shows 'failed' and refers to SK113021. I attempted to address this issue following the guidance in the document, but it did not resolve the problem. Please any help

Thanks

Re: Identity Awareness Sk113021

AkosBakos — Fri, 06 Dec 2024 12:10:57 GMT

Hi,

Do you mean that, when you want to link (SIC) the gateway to the IA Collector?
The IA collectos is the latest version?
That interface whicf in use for this connection is a Cluster interface?

Akos

Re: Identity Awareness Sk113021

Ihenock1011 — Fri, 06 Dec 2024 12:58:49 GMT

Do you mean that, when you want to link (SIC) the gateway to the IA Collector?
Yes when I add the gateway on the IA Collector
The IA collectors is the latest version?
Yea downloaded from the SMS and working fine for the other gateways
That interface which in use for this connection is a Cluster interface?
not the cluster the private IP of the VS

Re: Identity Awareness Sk113021

the_rock — Fri, 06 Dec 2024 13:31:13 GMT

Hey bro,

How you been? Can you please send a screenshot of it? Just blur out any sensitive data.

Andy

Re: Identity Awareness Sk113021

AkosBakos — Fri, 06 Dec 2024 14:22:43 GMT

Hi,

Are we talking about a VS on a VSX cluster?

If yes, the IA is communicating on one of the interfaces of the VS. Can the VS reach the IA colletctor somehow. The ping, telnet of 443 works?

Akos

Re: Identity Awareness Sk113021

Ihenock1011 — Fri, 06 Dec 2024 14:29:05 GMT

Yes VS in vsx member the other two VS are okay only one of the vs has an issue. Connectivity is okay

Re: Identity Awareness Sk113021

the_rock — Fri, 06 Dec 2024 14:31:22 GMT

If you run a capture from say one that works and one that does not to the IC ip address, what do you see as far as difference?

Andy

Re: Identity Awareness Sk113021

the_rock — Fri, 06 Dec 2024 15:02:52 GMT

Interestingly enough, I just did some testing in the lab and realized 2 of my gateways were complaining about shared secret, though absolutely nothing was changed. When I rebooted machine where IC is installed, all worked fine.

Have you tried that?

Andy