topic Re: Identity awareness and AD logs in General Topics

Identity awareness and AD logs

Oussama_Kadim1 — Fri, 23 Feb 2018 12:39:47 GMT

Bonjour,

Je souhaiterai implémenter l'ID Awareness sur checkpoint basé sur une authentification AD.

Le problème qui se pose est que le client ne souhaite pas que l'AD envoi les events logs au checkpoint.

Pouvez vous me dire si il y a une possibilité de faire de l'ID awareness avec une authentification AD sans que le Firewall ne recupère les events Logs AD ( Genre le client envoi un ticket Kerberos directement au Checkpoint).

Cordialement.

---------------------------------------------------------------------------------------------------------------------------------------------------------

Hello,

I would like to implement ID Awareness on checkpoint based on AD authentication.

The problem is that the client does not want that the AD sends the events logs to the checkpoint.

Could you please tell me if there is an option to make the ID awareness based on AD authentication on the checkpoint without AD event logs?

Regards.

Re: Identity awareness and AD logs

PhoneBoy — Fri, 23 Feb 2018 18:48:10 GMT

You have at least two other options:

Browser-based authentication (Captive Portal)
Identity Collector (which doesn't use AD logs), see here for a technical overview: Identity Collector - Technical Overview

Re: Identity awareness and AD logs

Oussama_Kadim1 — Sun, 25 Feb 2018 00:35:09 GMT

Thank you for your answer.

Re: Identity awareness and AD logs

Carsten_Pfitzer — Mon, 09 Jul 2018 11:00:56 GMT

Dameon Welch Abernathy‌

I am currently facing the same problem, and according to your link the Identity Collector does also need the security logs from the DCs:

Technical Description

The Identity Collector is using the Windows Event Log API for fetching the DC's security logs.
Windows Event Log is included in the operating system beginning with Windows Vista and Windows Server 2008 (client and server).

Re: Identity awareness and AD logs

PhoneBoy — Mon, 09 Jul 2018 11:16:26 GMT

Yes, you're right, I missed that.

The main difference between AD Query and Identity Collector is the API used to acquire the information.

The reason we need to read the security logs is to automatically associate IP addresses to usernames and machine names.

LDAP is used to get groups, which are also relevant for Access Roles.

Identity Agent can also get the information, but this requires installing agents on the local PCs.

There is also an agent for Terminal Servers.

And of course Captive Portal, as I mentioned earlier (but this is not necessarily automatic).