topic Re: SMB integrate AD issue in Spark Firewall (SMB)

SMB integrate AD issue

patrick2 — Thu, 15 Aug 2024 03:20:24 GMT

Hi there,

I am currently encountering an AD issue at a client’s site. I would like to know if anyone else has experienced the following:

I integrated SMB with AD and added a user account in AD with domain admin and schema admin permissions.
I created a new group in AD.
I added a remote access user in SMB, but the newly created group in AD cannot be found. Interestingly, existing groups can be found.

It seems like an AD issue. Are there any additional settings required in AD?

Re: SMB integrate AD issue

AkosBakos — Thu, 15 Aug 2024 07:50:08 GMT

Hi @patrick2

To get closer to the issue:

Do you use Identity Collecor, or how do you connect the SMB to the AD?

If you want to browse the whole tree in the Access Role object, you can find all ot the groups, except the newly created one?

Here:

Ad Query is not a supported way as earlier was. Check Point recommends to use Identity Collector as the Identity Source instead of AD Query

There is an sk: https://support.checkpoint.com/results/sk/sk106133 maybe it can help to start the investigation way.

Akos

Re: SMB integrate AD issue

PhoneBoy — Thu, 15 Aug 2024 17:27:59 GMT

What firmware version?
Sounds like a caching issue.
This may require a TAC case.

Re: SMB integrate AD issue

Dafna — Fri, 16 Aug 2024 05:13:51 GMT

Hi,

Do you use centrally or locally managed SMB?

Please note that, by default, AD groups are automatically synced every 24 hours.

Thanks,

Dafna

Re: SMB integrate AD issue

patrick2 — Fri, 16 Aug 2024 05:14:07 GMT

Hi Akos

1.I use Active Directory Queries in SMB to integrate AD and do not use the Identity Collector function.

2.Yes, I can find all the groups except for the newly created ones.

Re: SMB integrate AD issue

patrick2 — Fri, 16 Aug 2024 05:14:43 GMT

Hi PhoneBoy

R81.10.10 (996002993)

Re: SMB integrate AD issue

PhoneBoy — Fri, 16 Aug 2024 18:07:36 GMT

Is there a way to force the sync with AD to occur?
Because it seems like that's the issue here...that a new group was created and it is not available on the appliance.

Re: SMB integrate AD issue

AkosBakos — Sat, 17 Aug 2024 09:30:19 GMT

Hi @PhoneBoy

The #pdp update all command maybe helps

Command: root->update

Available options:
all - recalculate all users and machines group membership
specific - recalculate group membership for a user/machine
refetch_interval - LDAP user info refetch interval
update_rate - the max number of sessions updated within a minute

Akos