topic Re: SMB Identity Collector Mystery in Spark Firewall (SMB)

SMB Identity Collector Mystery

G_W_Albrecht — Tue, 10 Mar 2020 11:40:03 GMT

If we follow sk123858: Identity Collector support on SMB Appliances, Identity Collector is not supported with 1100, 1200R, 1400, 600, 700 Gaia Embedded R77.20, R75.20 Appliances and the same is declared in sk108235 - Identity Collector - Technical Overview. sk105380 Features and Known Limitations for R77.20.xx does not mention it, but in sk159772 Check Point R80.20 for 1500 Appliances Features and Known Limitations we find that Identity Collector is supported neither Locally nor Centrally managed !

The background for this limitation: The PDP of SMB Appliances has no API listening to tcp/443.

But Identity Sharing between PDP on a Gaia GW and PEPs on SMB Appliances do work, see sk106965: Identity Sharing does not work with SMB appliance running for details.

So we have tested in lab a central GAiA GW with SMB star VPN topology. Identity Collector updates the GAiA GW and the GAiA GW performs Identity Sharing with the PEPs on the SMB Appliances! This does work, so sk123858 seems a little too narrow-minded...8)

Re: SMB Identity Collector Mystery

PhoneBoy — Wed, 11 Mar 2020 19:53:30 GMT

You're correct, the underlying issue is the Identity Awareness API is not supported on SMB appliances.
Any feature that relies on this API is therefore not supported…at least directly.
If you have a regular gateway in the environment and implement identity sharing with the SMB appliances, that most definitely works.
Not sure exactly how to best represent this in the SK, though.

Re: SMB Identity Collector Mystery

rlopesdu — Tue, 27 Sep 2022 15:16:21 GMT

Hi,

This is a very interesting solution that overcomes some of the limitations as described in the abovementioned sk.

I have a customer who is only using SMB appliances and wants to deploy Identity Awareness using a dedicated Gaia FW as PDP.

Question: as the management is only currently licensed to support SMB appliances, do we need to foresee a "full-Gaia" management license for this only firewall who will serve as PDP?

Thanks and best regards

Re: SMB Identity Collector Mystery

PhoneBoy — Tue, 27 Sep 2022 21:05:08 GMT

Yes, you will need a license to manage that gateway.

Re: SMB Identity Collector Mystery

rlopesdu — Wed, 28 Sep 2022 07:02:51 GMT

Thanks for the clarification.

Re: SMB Identity Collector Mystery

G_W_Albrecht — Wed, 28 Sep 2022 08:53:25 GMT

In R81.10.00 for Quantum spark 1500\1600\1800, Identity collector is supported for centrally managed appliances.

Re: SMB Identity Collector Mystery

Steven_Sultana — Fri, 02 Feb 2024 13:18:01 GMT

Only if there is a domain controller locally, as per sk178604.

SMBGWY-2486

An AD Domain Controller used for authenticating users that is located in the external zone of a device using Hide-NAT is not supported.

Workaround: Install another Domain Controller in the internal zone of the device.

R81.10.00