topic Microsoft DirectAccess, Proxy & Identity Awareness in General Topics

Microsoft DirectAccess, Proxy & Identity Awareness

Matt_Parfitt — Fri, 23 Feb 2018 10:41:56 GMT

We are using Microsoft DirectAccess and we are trying to implement CheckPoint Proxy with HTTPS Inspection. We have managed to get Proxy & URL Filtering working via DirectAccess, however the logs do not show the originating computer/user, it just shows the VPN Server as the source.

This is obviously a problem when troubleshooting a specific user's problem or when we need to generate reports based on usage etc.

Does anyone have any ideas?

Re: Microsoft DirectAccess, Proxy & Identity Awareness

PhoneBoy — Fri, 23 Feb 2018 18:54:48 GMT

Have you enabled this option, by chance?

Re: Microsoft DirectAccess, Proxy & Identity Awareness

Matt_Parfitt — Mon, 26 Feb 2018 08:58:22 GMT

I have the first two checkboxes enabled on that Proxy Settings page.

Re: Microsoft DirectAccess, Proxy & Identity Awareness

David_GOURANTON — Mon, 26 Feb 2018 15:07:08 GMT

Unfortunately, you won't be able to identify your users when they are connected behind a Direct Access server. Indeed, the remote machines IP address is NATed by the DA server. As Checkpoint Identity Awareness maps a user to an IP address it won't work. Moreover, installing an IA agent doesn't help, as it cannot work through a DA server.

The only solution is to do NTLM/Kerberos authentication with an web proxy. This way, the user identity is carried by the browser request and not impacted by the IP address translation, allowing the proxy to identity the users.

Re: Microsoft DirectAccess, Proxy & Identity Awareness

Matt_Parfitt — Tue, 27 Feb 2018 09:10:51 GMT

Thanks David. That sounds like a viable solution, is it possible to only apply the browser request on computers that are accessing the Internet via DirectAccess?