topic AD Query in Remote Access connection in SASE and Remote Access

AD Query in Remote Access connection

saulosouza — Wed, 24 Mar 2021 13:14:28 GMT

We migrate from R80.30 to R80.40. In R80.30 Remote Access uses AD Query information, now the information is not processed.

The AD Query is working fine for the other contexts, but it's not applied to VPN connection.

In PDPd and PEPd logs I can see the AD connection for the machine in the VPN, but I think it's not processed by the identity Awareness.

[25387 4059584320]@CPFW01[24 Mar 9:15:20] [TRACKER]: #40148 -> INCOMING -> ADQUERY_ASSOCIATION ->
Association
ip: 10.18.172.35
user:
machine: d580-55931
domain: interno.trt18.jus.br
reason: 0

In the PDPd log I found this:

[25387 4059584320]@CPFW01[24 Mar 9:15:20] [SESSION_UTILS (TD::Events)] pdp::PDPSessionConciliation::shouldOverrideSuperSessionByPriority: existing super session 6bd521f4 office mode IP score (1) > new association office mode IP score (0) - reject new association

Is there a way for identity awareness to use AD Query Data in Remote Access connection?

Thanks in advance!

Re: AD Query in Remote Access connection

PhoneBoy — Wed, 24 Mar 2021 16:18:10 GMT

Remote Access clients don't require AD Query because we're authenticating the user directly.
However, it needs to be enabled as an identity source on the gateway object (it's not by default).

Re: AD Query in Remote Access connection

saulosouza — Wed, 24 Mar 2021 16:27:00 GMT

Thank you, I have already enabled Remote access as a source. The login is fine, what I want is the information of AD query, when is available.

Re: AD Query in Remote Access connection

PhoneBoy — Thu, 25 Mar 2021 21:49:39 GMT

What’s happening is explained here: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk146835&partition=Basic&product=Identity

Specifically “Some identity sources such as Identity Agent, Terminal Server, Captive Portal, and Remote Access VPN cannot be appended to others. In these cases, the conciliation decision is only override or reject.”
Note this is new behavior as of R80.40.
Not 100% sure you can change this, a TAC case will be required.

Re: AD Query in Remote Access connection

fjulianom — Fri, 06 Sep 2024 12:23:46 GMT

Hi PhoneBoy,

Old post but I am in a similar situation. Then do you mean that Remote Access clients authenticate directly against the AD and not through AD Query which uses WMI to look into Active Directory Security Event Logs?

Regards,

Julián