topic Re: Quantum Spark DAIP GW - Identity options in Spark Firewall (SMB)

Quantum Spark DAIP GW - Identity options

Dr_Steve_Brule — Fri, 30 Jun 2023 22:34:45 GMT

Hello,

For our main office, we are currently using Identity Collectors with our main 7000 GW cluster to handle IA for all of our office users (around 1500 users). We will be opening a couple of remote branch offices where we'll be using DAIP SMB gateways. I would prefer to use Identity sharing from our main 7000 GW cluster, but it appears this isn't compatible with DAIP gateways. Also, AD query is no longer a viable option.

These remote office will only have 5-10 users, so I'd like to avoid deploying agents to these random users. With that said, is tying the SMBs to my existing ID collectors the best option? Is there any concern about the SMBs learning thousands of identities via the existing ID collectors?

Also, the DAIP gateways (Spark 1570s) will be centrally managed and running R81.10.05 (or R81.10.07).

Re: Quantum Spark DAIP GW - Identity options

G_W_Albrecht — Sat, 01 Jul 2023 13:35:27 GMT

That should work fine.

Re: Quantum Spark DAIP GW - Identity options

PhoneBoy — Sat, 01 Jul 2023 15:37:24 GMT

Not clear if this is supported on SMB appliances or not, but maybe you can use Identity Broker instead?
See: https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_IdentityAwareness_AdminGuide/Topics-IDAG/Identity-Broker-Configuration.htm

Re: Quantum Spark DAIP GW - Identity options

TobiFW — Tue, 02 Jul 2024 07:40:42 GMT

Hi,

did you find a solution?
I have the same situation and identity sharing isn't working with DAIP GWs.

Thanks

Re: Quantum Spark DAIP GW - Identity options

G_W_Albrecht — Tue, 02 Jul 2024 11:08:18 GMT

Should work since R81.10.05 - see https://sc1.checkpoint.com/documents/SMB_R81.10.X/CLI/EN/Content/Topics/set-user-awareness-identity-collector-mode.htm?tocpath=Configuring%20User%20Awareness%20Settings%7C_____11