Can we configure CloudGuard Controller on multi domain server?

[sachintekane]

We are planning to use User Access role using Azure AD in MDS but getting error while importing the users. We just want to know weather Cloud Guard Controller is supported or not on MDS(Multi Domain Server R81 JHF 77)  

[Chris_Atkinson]

Have you discussed sk175983 with TAC already?

[sachintekane]

Thanks for sharing the SK,

I will contact TAC. But SK doesn't have info if cloudguard controller is supported or not on MDS. 

[Chris_Atkinson]

Yes supported. What's the specific concern relating to that?

(Earliest reference I could find is in sk115772).

[sachintekane]

It was giving me error when i run "cloudguard on" command from specific CMA. PFA error.

[Chris_Atkinson]

The workflow changed in recent versions, I know on regular SMS it's now activated automatically in R81 when you configure a new DC object.

Will check the error and revert.

[Gil_Sudai]

Yes it is supported. What is currently not supported (and will be supported in the next main version after R81.20) is the usage of Data Center objects in the MDS Global policy. 

[sachintekane]

Currently MDS running on R81 version and i want to use Azure AD user group in one of the CMA. Do we have any document where i can refer and enable cloudguard controller on MDS level?

[Gil_Sudai]

You do not need to manually enable anything. Just create a Data Center and start using it. The backend process will start automatically.

[sachintekane]

TAC helped to fix this issue by replacing directory.py file on MDS and able to see Azure AD users and groups.

Now we are facing challenge to authenticate  users using SAML app for mobile access. Getting error with Failed Log In - Unknown user. We could see login successful in Azure SAML sign-in log. Not sure why Security gateway not authenticating Azure AD users.

Anyone faced similar issue.

[PhoneBoy]

Recommend creating a separate thread for this issue in the Remote Access space.

[Chris_Atkinson]

Which specific remote access client are you using or is it the MAB portal?

(e.g. Capsule VPN solution doesn't currently support SAML auth - please speak with your local CP SE about an RFE where needed.)