topic ipassignment.conf = nested groups & computer account support in SASE and Remote Access

ipassignment.conf = nested groups & computer account support

Vinz129 — Tue, 31 Oct 2023 11:00:35 GMT

Hello,

I have some questions about the 'ipassignment.conf' ip address assignment functionality in Office Mode in R81.20.

Are nested AD groups supported for the IP-per-user assignment via the 'ipassignment.conf' method ?
If so, up until which level of nesting would this be possible ?

Also we would like to understand if we can use AD groups by using computer accounts (andin stead of user accounts) and based on the group membership get the proper IP address assigned ?

Thanks

Re: ipassignment.conf = nested groups & computer account support

PhoneBoy — Tue, 31 Oct 2023 23:05:35 GMT

I presume nested groups are supported, but it might require a TAC case to confirm: https://help.checkpoint.com
Pretty sure you cannot use machine groups in ipassignment.conf since the authentication is user-based.
If (only) Machine Authentication is used for the user, you can perform assignment based on the machine name.
I don't believe this supports groups per: https://support.checkpoint.com/results/sk/sk33422