topic Re: Can I implement Identity Awareness without using a PDP/PEP Broker? in General Topics

Can I implement Identity Awareness without using a PDP/PEP Broker?

RemoteUser — Fri, 24 Oct 2025 06:57:39 GMT

Hi everyone,

I’m working on an Identity Awareness deployment on Check Point and I’d like some clarification.

I understand that in large or complex environments, the PDP/PEP Broker is used to centralize identities and share them across multiple gateways. What I’m not sure about is:

Is it possible to configure Identity Awareness directly on the gateway without relying on a Broker?
In which scenarios is it sufficient to enable IA using methods like AD Query, Identity Collector, or Captive Portal directly on the firewall?
When is an Identity Broker actually required (e.g. multi-gateway environments, distributed clusters, or multiple AD domains)?

I’d like to confirm whether, in a relatively simple setup (a single cluster and one AD domain), everything can be done without a Broker, or if there are hidden limitations I should be aware of.

Thanks in advance.

Re: Can I implement Identity Awareness without using a PDP/PEP Broker?

Alex- — Fri, 24 Oct 2025 07:29:43 GMT

For a simple deployment with just a cluster and a single domain, you can use the Identity Collector and you don't need brokers or identity sharing. The Identity Collector doesn't require domain admin rights which is preferred. From there you can use other methods like Captive Portal for instance.

Re: Can I implement Identity Awareness without using a PDP/PEP Broker?

Alex- — Fri, 24 Oct 2025 10:05:13 GMT

Interesting sources:

sk86441 ATRG: Identity Awareness

Tech Talk Identity Awareness Best Practices

Re: Can I implement Identity Awareness without using a PDP/PEP Broker?

the_rock — Fri, 24 Oct 2025 12:08:04 GMT

Hey bro,

Yes, 100% you can use simple setup without a broker, works fine, no limitations at all.

What @Alex- gave are great references.

Re: Can I implement Identity Awareness without using a PDP/PEP Broker?

the_rock — Fri, 24 Oct 2025 18:27:40 GMT

One more reference.

https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_IdentityAwareness_AdminGuide/CP_R82_IdentityAwareness_AdminGuide.pdf

Re: Can I implement Identity Awareness without using a PDP/PEP Broker?

PhoneBoy — Fri, 24 Oct 2025 22:14:33 GMT

Identity Broker is used to achieve better scalability reasons in larger environments.
It also enables certain use cases like one-way sharing of identity data as well as cross-SIC domain sharing.
For simple deployments with on-prem AD, Identity Collector is your best bet.
ADQuery is not recommended any longer due to security and scalability issues with WMI.