topic Re: Identity Awareness Agents SK with direct links - published! in General Topics

Identity Awareness Agents SK with direct links - published!

Royi_Priov — Wed, 17 Oct 2018 06:57:12 GMT

Hi CheckMates,

I have published a new SK for Identity Awareness agents with direct links and list of resolved issues for your use.

The SK is sk134312.

It includes the following agents:

Identity Collector
Identity Agent – Full
Identity Agent – light
Identity Agent for MAC
Terminal Server Agent.

We will update this SK from time to time with new versions after they will be QAed.

In case you have remarks or any clarification is needed - I'm here to answer.

Thanks,

Royi Priov

Team Leader, Identity Awareness R&D.

Re: Identity Awareness Agents SK with direct links - published!

Sven_Glock — Wed, 17 Oct 2018 08:21:19 GMT

Nice! This was an outstanding SK! Thanks!

Re: Identity Awareness Agents SK with direct links - published!

Royi_Priov — Thu, 18 Oct 2018 12:01:31 GMT

With pleasure!

Re: Identity Awareness Agents SK with direct links - published!

Sean_Van_Loon — Wed, 23 Jan 2019 16:00:49 GMT

Hi Royi,

Question, what is recommended for deployment of Identity Agents?

There are packages available on the UserCenter (thank you for the URL/SK btw!) and on the Security Gateway under the folder: /opt/CPNacPortal/htdocs/nac/nacclients/ ?

Is there a difference between those packages?

Thank you in advance!

Kind regards,

Sean

Re: Identity Awareness Agents SK with direct links - published!

Royi_Priov — Wed, 23 Jan 2019 19:06:12 GMT

Hi Sean Van Loon‌,

That's a good question.

sk134312will be updated from time to time with a newer version of our agents.

Every time a gateway version is released (e.g. R80.20) the newest version of each version will be included in it (the latest one from the SK).

It means that if you want to get the most updated agent it will be available on sk134312

Since the agents are backward compatible, you can upgrade the agent even without upgrading the gateway.

I hope this is clear.

Royi Priov

Identity Awareness R&D.

Re: Identity Awareness Agents SK with direct links - published!

Royi_Priov — Tue, 05 Feb 2019 09:13:51 GMT

An update - a new version was uploaded to the SK.

Thanks,

Royi.

Re: Identity Awareness Agents SK with direct links - published!

phlrnnr — Mon, 15 Apr 2019 20:21:55 GMT

I have a few follow up questions related to Identity Collector:

1. Is this the same agent that can be downloaded from the GW at https://<IP_of_Security Gateway>/_IA_IDC/download/CPIdentityCollector.msi ?

2. What is the recommended versioning? Does the IDC version have to be greater than or equal to the highest version GW that has identity awareness enabled and tied to IDC? For example, in an environment with R80.20 Mgmt, and mixed GWs of R80.10, and R77.30, would the IDC agent need to be R80.10 or greater?

3. Does the version of the IDC agent only tie to the version of the GWs of running IA? Or does Security Management version matter? Hypothetically, if my entire environment were R80.10, and I wanted to upgrade management to R80.20, would I have upgrade IDC to R80.20 at the same time management is upgraded? Or only before we start upgrading GWs?

4. What is upgrade process for the IDC on the servers? As long as there are redundant IDC servers, is it simply uninstall/reinstall of the .msi?

Thanks for your help!

Phil

Re: Identity Awareness Agents SK with direct links - published!

Royi_Priov — Mon, 22 Apr 2019 11:07:22 GMT

@phlrnnr wrote:

I have a few follow up questions related to Identity Collector:

1. Is this the same agent that can be downloaded from the GW at https://<IP_of_Security Gateway>/_IA_IDC/download/CPIdentityCollector.msi ?

2. What is the recommended versioning? Does the IDC version have to be greater than or equal to the highest version GW that has identity awareness enabled and tied to IDC? For example, in an environment with R80.20 Mgmt, and mixed GWs of R80.10, and R77.30, would the IDC agent need to be R80.10 or greater?

3. Does the version of the IDC agent only tie to the version of the GWs of running IA? Or does Security Management version matter? Hypothetically, if my entire environment were R80.10, and I wanted to upgrade management to R80.20, would I have upgrade IDC to R80.20 at the same time management is upgraded? Or only before we start upgrading GWs?

4. What is upgrade process for the IDC on the servers? As long as there are redundant IDC servers, is it simply uninstall/reinstall of the .msi?

Thanks for your help!

Phil

1. The one on the SK is the most updated.

The IDC exists on the GW is the newest one available when the version (R80.10 / R80.20, etc) was released.

2. There is full BC of IDC version. However, the newest one is the most recommended.

3. Security MGMT is not relevant to this flow. The communication is IDC <-> GW.

4. Yes.

Good luck 🙂

Royi Priov

Re: Identity Awareness Agents SK with direct links - published!

phlrnnr — Mon, 22 Apr 2019 14:18:20 GMT

I tested uninstall/reinstall in our lab and the configuration was wiped in the process. Is there any way to preserve the IDC configuration from one version to the next?

Re: Identity Awareness Agents SK with direct links - published!

Royi_Priov — Tue, 23 Apr 2019 07:12:44 GMT

@phlrnnr wrote:
I tested uninstall/reinstall in our lab and the configuration was wiped in the process. Is there any way to preserve the IDC configuration from one version to the next?

Sorry, I forgot about the database wipe.

There are 2 options to save the config while upgrading:

perform in-place upgrade: install the newer version without uninstalling the current IDC. This will save everything.
perform "export" before removing the old IDC and "import" in the new IDC. the main issue with this method is that all passwords (AD password and shared secrets with GWs) are not saved due to security concerns.

I do recommend the first method. you can always export the configuration before staring the procedure to be on the safe side.

Thanks,

Royi Priov

Re: Identity Awareness Agents SK with direct links - published!

Sean_Van_Loon — Fri, 17 May 2019 08:21:12 GMT

Hi Royi,

I see that there is currently no agent for linux/unix. Is there a plan to create one?

Or is there an alternative for linux/unix users to authenticate with the Check Point?

Thanks in advance!

Kind regards,

Sean

Re: Identity Awareness Agents SK with direct links - published!

Royi_Priov — Sun, 26 May 2019 08:57:13 GMT

@Sean_Van_Loon wrote:

Hi Royi,

I see that there is currently no agent for linux/unix. Is there a plan to create one?

Or is there an alternative for linux/unix users to authenticate with the Check Point?

Thanks in advance!

Kind regards,

Sean

Hi @Sean_Van_Loon ,

Indeed, there is no linux based agent and currently there is no plan to crewate one.

You can use captive portal for linux machines.

Thanks,

Royi.

Re: Identity Awareness Agents SK with direct links - published!

jk7 — Fri, 16 Aug 2019 19:42:02 GMT

if there are a mixed networks with R77.xx and R80.xx GWs, we can download IDC from the link you posted instead of from the GWs and installed on the windows, which could feed identities to either R77.xx and R80.xx PDPs, correct? thanks in advance!

Re: Identity Awareness Agents SK with direct links - published!

remi0403 — Thu, 08 Oct 2020 18:45:32 GMT

Hello Royi

Is there a way to make upgrade of identity agent , without any action of user, I can see in the administration guide 80.40, identity agent upgrades, but does it works and how ?

If agent is no longer compatible, pc client can download and install automaticly since gateway ?

Thanks

Re: Identity Awareness Agents SK with direct links - published!

Royi_Priov — Sun, 11 Oct 2020 10:43:20 GMT

Hi @remi0403 ,

Our agents are backward compatible. Therefore, there is no situation where the clients are not compatible with the gw version. They might not support new features, but they will keep the current functionality.

My personal recommendation is to use GPO, with a prepackaged msi. Please use sk134312 for the latest version.

Re: Identity Awareness Agents SK with direct links - published!

Juan_ — Wed, 27 Jan 2021 12:06:48 GMT

Hi Royi!

May i ask what's the difference between light and full?

Also, the MSI seems to be the same for (mostly) everything now but the different versions point to different download links?

Many thanks

Re: Identity Awareness Agents SK with direct links - published!

Vincent_Bacher — Wed, 27 Jan 2021 12:43:11 GMT

br
Vincent

Re: Identity Awareness Agents SK with direct links - published!

Juan_ — Wed, 27 Jan 2021 12:54:46 GMT

Many Thanks!
Silly me, wasn't finding it in the admin guide 🙂

Re: Identity Awareness Agents SK with direct links - published!

nordom — Wed, 24 Jan 2024 15:26:21 GMT

Thanks for your answer, how do we identify the linux server without browser? As soon as I activate the user awerness and remove the gest login, linux servers no more has access update.

Best regards, Brieuc.

Re: Identity Awareness Agents SK with direct links - published!

leonarit — Sun, 29 Jun 2025 10:40:07 GMT

Hello!

I need to test the integration with Cisco ISE 3.3 in my lab by the end of the day. There is no direct link available for the latest version because the current IDC version has some issues according to sk134312 and a copy of the installer should be provided by support.

I did a fresh install of R82 with JHF19 on a vm but unfortunately it comes with version R81.035.0000 and Cisco ISE support was only introduced in version R82.002.0000.

I would like to know if anyone has a copy of the idc installer R82.002.0000 or R82.120.0000 and would be able to share it?

Regards.