Identity Awareness Agent connectivity Issues.

George_Sas — Fri, 21 Aug 2026 07:07:49 GMT

Hi guys.

For almost an year now we had an issue with our Checkpoint cluster , 2 x 6600.
Since we enabled Identity Awareness Agents as identity provider , our firewalls started to experience high CPU load.
After almost an year Checkpoint said we encounter the issue because the identity awareness is configured to only listen "Trough internal Interfaces" only , and we were instructed to change the setting so the gateway listens on all interfaces.
cp1.png

Now since we did this, my clients experience connectivity issues mostly when they are connecting to the network trough VPN.
I can see the Agent trying to connect and connect and connect and when finally connected , there is still no access to internal network resources.
If I disconnect the Identity Agent and then connect again , everything works.
Also I see some clients get the popup with "Username / Password" request.

We NEVER had this problems while the gateway was configured to only listen trough the Internal Interfaces.

On the MSI installation package I distributed to clients I specified Connect to Server , and manually added CLUSTER FQDN name.
Should I change this to IP or what is the best practice ?

cp2.png

I have also configured Identity Agent Distributed Configuration and Active Directory if a client defaults to automatic.
The DEFAULT rule puts the SAME Identity server list with both Internal and External DNS name.

Then I have made rules for different satellite offices to try and connect first to the local gateway as priority 1 then to the central gateway as priority 2.

Also , WHEN does the agent use the AD Configuration ? Because according to guide, when configured for automatic discovery , it will sue DNS ?

Does anyone else that uses Identity Agents as identity providers experienced something similar ?
Or any idea where to start debugging ?

Thanks in advance.

Re: Identity Awareness Agent connectivity Issues.

PhoneBoy — Fri, 21 Aug 2026 23:23:44 GMT

FDQN is best practice, I believe, though it should be to an internal interface, not external.
The servers necessary to use for Active Directory are disclosed in the DNS records.

topic Identity Awareness Agent connectivity Issues. in General Topics

Identity Awareness Agent connectivity Issues.

Re: Identity Awareness Agent connectivity Issues.