synchronize Identity sharing between the active and passive node

MiniNinja — Thu, 03 Jul 2025 09:41:16 GMT

I have a dedicated VPN gateway for remote users and a main cluster of two nodes.
Identity sharing is enabled on the cluster and gateway, but when switching occurs on the active/passive node cluster, remote access users lose access.

There is no IPsec between the VPN gateway for remote users and the cluster.

How can I synchronize the data obtained by Identity sharing between the active and passive node of the R81.20 cluster?

I looked at it https://support.checkpoint.com/results/sk/sk183274 but this is not exactly the case, and the value for the cluster is already empty in the database.

I found that caching can be enabled in 81.20 take 70 and higher, but I'm not sure if it will help in this case:

1. Prerequisites

Ensure your cluster is running R81.20 with Jumbo Hotfix Accumulator Take 70 or higher.
You must configure all cluster members in the same way.

2. Enable Identity Cache Mode

On each cluster member, run the following command in Expert mode:

pdp identity_cache_mode enable

This command enables the Identity Cache Mode, allowing both cluster members to store and synchronize identity data.

3. (Optional) Enable Extended Info Storage for Debugging

If you need to store extended identity information for debugging, you can enable it with:

pep extended_info_storage enable

To disable, usepep extended_info_storage disable.

4. Important Notes

Always configure both (all) cluster members identically.
For VSX environments, run the commands in the context of the relevant Virtual System (usingvsenv <VSID>).
For Maestro or Chassis platforms, run the commands in Expert mode on the relevant Security Group.

Re: synchronize Identity sharing between the active and passive node

Chris_Atkinson — Thu, 03 Jul 2025 12:28:09 GMT

Are you investigating this issue with TAC?

What version and JHF is the cluster & Gateway?

For the cluster was sk60701 followed at all and if yes was the cluster VIP correctly used?

Re: synchronize Identity sharing between the active and passive node

MiniNinja — Thu, 03 Jul 2025 15:07:40 GMT

Thanks for your reply.

I haven't contacted TAC yet, but I'm trying to figure out if there is such a possibility.

R81.20 take 99

I haven't tried this sk60701 yet.

I'll review the solution, try to apply it, and let you know.

topic Re: synchronize Identity sharing between the active and passive node in General Topics

synchronize Identity sharing between the active and passive node

1. Prerequisites

2. Enable Identity Cache Mode

3. (Optional) Enable Extended Info Storage for Debugging

4. Important Notes

Re: synchronize Identity sharing between the active and passive node

Re: synchronize Identity sharing between the active and passive node