topic Re: Identity Awareness Issues in General Topics

Identity Awareness Issues

ShemHunter — Mon, 17 Aug 2026 12:55:32 GMT

There are two similar SK

https://support.checkpoint.com/results/sk/sk134292
https://support.checkpoint.com/results/sk/sk106964

And I don't understand how exactly they work, I'll explain it with an example:

I have two environments - a test environment (regular GW and cluster), and a production environment (Maestro).

In the test environment, I have AD - indeed.cp
It also has - prod.indeed.cp

In the production environment, I have AD - indeed.cp
It also has about 8-10 ADs. - europa.indeed.cp/europa1.indeed.cp - and so on.

I created a group in the prod.indeed.cp and the user himself is from indeed.cp and using the access role and pdp m u - I see the group for this user

I haven't applied any settings, but I use group nesting settings of 4 or 5 and I see the group. When using setting 2, I don't see the group. If I disable group nesting altogether, I doesn't see the group.

Connecting to the main AD via Port 636 is different from port 389.

In the production environment, everything is configured exactly the same, but at some point, access roles stopped resolving, and PDP MUI doesn't see groups and shows all users. I'll say right away that I didn't apply any settings before the problem occurred.

I use a collector in both environments.

Version 81.20, take 158

Re: Identity Awareness Issues

simonemantovani — Mon, 17 Aug 2026 13:47:10 GMT

Anything has been change on AD side?

Re: Identity Awareness Issues

ShemHunter — Mon, 17 Aug 2026 13:49:32 GMT

There have been no changes on the AD side.

Additionally to my post:

The group that was created—the group's scope is universal—if that helps solve the problem, of course.

Re: Identity Awareness Issues

simonemantovani — Mon, 17 Aug 2026 14:03:28 GMT

I haven't enough experience on Active Directory, but maybe this PDF could be an helpful point to start:

https://www.google.com/url?sa=t&source=web&rct=j&opi=89978449&url=https://community.checkpoint.com/fyrhh23835/attachments/fyrhh23835/appliances-and-gaia/50904/1/IDA%2520Best%2520Practices%2520v2.3%25202025.pdf&ved=2ahUKEwjss5jE56eWAxVUhv0HHZ9ZLbMQFnoECBcQAQ&usg=AOvVaw1rEjxxMPuQbzxuqhk0td4y

In particular take a look from page 14.

Re: Identity Awareness Issues

PhoneBoy — Mon, 17 Aug 2026 14:23:00 GMT

Maybe @Peter_Elmer can help here.