topic Is it possible to create an alert when the MAC address associated to an AD user changes? in SASE and Remote Access

Is it possible to create an alert when the MAC address associated to an AD user changes?

kamilazat — Fri, 15 Dec 2023 08:53:42 GMT

Greetings everyone!

I want to know if it is possible to get a notification when the MAC address associated to an AD user changes. We're dealing with R81.10 with Remote Access.

https://community.checkpoint.com/t5/Management/Identity-awareness-Access-role-based-on-MAC-address/td-p/7725

In the conversation above @Timothy_Hall mentions that L2 header gets stripped off by the time the packet reaches the INSPECT engine. However, in the same conversation there is a mention of an RFE for an External Tag. I tried to google about this, but to no avail so far.

I thought about a script that will read pep and pdp logs and make a notification when MAC of a user changes, but it looks like it would be quite resource heavy as our network activity is very high. On the other hand, I'm completely open to using 3rd party resources to gather that kind of information.

Thank you!

Re: Is it possible to create an alert when the MAC address associated to an AD user changes?

PhoneBoy — Fri, 15 Dec 2023 18:30:34 GMT

The feature mentioned in the thread is called Identity Tags: https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_IdentityAwareness_AdminGuide/Content/Topics-IDAG/Configuring-Identity-Awareness-Using-Identity-Tags-in-Access-Role-Matching.htm
The tags are assigned by Cisco ISE or a SAML provider.

In any case, Identity Awareness does not track Layer 2 information, at least not in a way that would be easy to query.
Therefore, you'd have to use an external system (the identity provider itself) to get this information.

Re: Is it possible to create an alert when the MAC address associated to an AD user changes?

kamilazat — Sun, 17 Dec 2023 09:56:39 GMT

Thank you @PhoneBoy. It was really helpful clarifying the possibilities within Identity Awareness.

Though I was reading about SmartEvent and started wondering if it can help me in this context. Apparently it can provide a wide variety of information, but I'm not sure if MAC changes of AD users is within its scope.

Edit: I will, of course, resort to Cisco ISE or a SAML if need be. But, I want to be able to solve this without using any service other than CheckPoint if possible.

Re: Is it possible to create an alert when the MAC address associated to an AD user changes?

PhoneBoy — Mon, 18 Dec 2023 13:35:09 GMT

We don't use MAC addresses in policy decisions, so there's not really a mechanism designed to track this in the product.