topic Re: Activate Identity Web API for SMB centrally managed in Spark Firewall (SMB)

Activate Identity Web API for SMB centrally managed

D_W — Mon, 08 Mar 2021 09:51:14 GMT

Hello,

for the full Gaia Check Points there is an option to activate Identity Web API via SmartConsole.
Where is this option for SMB devices or is this not supported?!

We use this for IA with CloudGuard Connect and would need it for SMB Devices as well.

KR
David

Re: Activate Identity Web API for SMB centrally managed

G_W_Albrecht — Mon, 08 Mar 2021 10:11:33 GMT

This is not possible directly on SMB, as only Browser, AD Query, Identity Agents and RemoteAccess are valid Identity Sources. GAiA Embedded does not support RADIUS Accounting and Identity Collector. But you can select in Identity Sharing: Get Identities from other GW, then these GWs will share the information from Web API, RADIUS Accounting and Identity Collector.

Re: Activate Identity Web API for SMB centrally managed

D_W — Mon, 08 Mar 2021 10:19:18 GMT

Not the answer I wanted to hear 😉

Yes, get identites from other GWs sounds nice but will not help here because it will not allow to use the Objects generated from CloudGuard Controller in the rules for the SMB Devices... see the attached install_error.jpg (I don't know why but i cannot insert the screenshots directly into this post).

Re: Activate Identity Web API for SMB centrally managed

G_W_Albrecht — Mon, 08 Mar 2021 10:40:10 GMT

That is true - see sk128612: CloudGuard Controller is supported only on Gaia OS, not on GAiA Embedded.

Re: Activate Identity Web API for SMB centrally managed

D_W — Mon, 08 Mar 2021 13:45:01 GMT

Ok thank you.
One additional point to avoid these embedded devices.

Re: Activate Identity Web API for SMB centrally managed

G_W_Albrecht — Mon, 08 Mar 2021 13:56:51 GMT

If you need these features you better use GAiA OS. But there are many places these Embedded devices properly perform their tasks...

Re: Activate Identity Web API for SMB centrally managed

D_W — Mon, 08 Mar 2021 14:57:13 GMT

I agree that somewhere these are the correct devices. But such minor and simple "features" are no rocket science and should also work with a trimmed embedded Gaia OS. The IA Web API is existing since R77.30(?)

I'm sure this is not the correct forum thread to discuss this here but these limitations are a big pain for us. We would love to use these embedded devices to connect our smaller business sites but at the moment it will not work out. I miss small full Gaia Devices at the same cost level as SMB devices.

Re: Activate Identity Web API for SMB centrally managed

G_W_Albrecht — Mon, 08 Mar 2021 15:19:42 GMT

🤣

Re: Activate Identity Web API for SMB centrally managed

PhoneBoy — Mon, 08 Mar 2021 20:00:04 GMT

As noted, the underlying Identity Awareness API is not supported on SMB appliances.
However you should be able to share identities from a regular gateway to an SMB gateway.
Do you have any of those in your environment?

If supporting the IDA API on SMB is a requirement, I highly recommend bringing up the requirement with your local Check Point office.

Re: Activate Identity Web API for SMB centrally managed

D_W — Tue, 09 Mar 2021 08:31:32 GMT

Yes we have about 22 Full Gaia Devices - so Identity Sharing is possible but still you cannot use the Objects in the Ruleset for SMB Devices.

I already contacted now the local Check Point office 🙂

Re: Activate Identity Web API for SMB centrally managed

Markus1634 — Fri, 14 Feb 2025 07:14:13 GMT

Hi all,

4 years later with SMB version 81.10.15 it is still the same? This is a big limitation...

Is this already raised as a feature request inside of Check Point?

Best

Re: Activate Identity Web API for SMB centrally managed

PhoneBoy — Fri, 14 Feb 2025 19:32:41 GMT

As far as I know, it is still not supported.
Whether someone has filed an RFE on it or not, if this is a requirement for you, please raise the issue with your local Check Point office.