Check Point Identity Collector - Windows Server firewall Permisoins

[freeman91]

Hi all, 

I looked at all the threads related to Identity Collector, as well as the documentation for deploing Identity Collector and like other, I also have had a problem until I turned off firewall on windows server.

This is enough for me just to check if there is a connection issue to DC other then firewall. Now I want to turn on the firewall and allow only what is necessary. 
Are anyone here is willing to share setup of its windows firewall in case where its firewall is turned on, and connection with IC is green 🙂

Far now, I allowed only those 7 DCOM 135 rules  but it is not enough.

[Chris_Atkinson]

HTTPS, DCOM, RPC, LDAP, DNS are needed depending on the server role. https://sc1.checkpoint.com/documents/Identity_Awareness_Clients_Admin_Guide/Content/Topics-IA-Client...

[freeman91]

Can you assist me how does this rule looks like in firewall policy:

• Add "Allow" rule

  Remote Event Log Management > Remote Event Log Management (RPC)

[the_rock · Accepted solution]

I just add a rule that says from fw to IC (bi-directionally), allow on any port, thats it.

Andy

[freeman91]

Ok, I can accept that as a good workaround solution. 

Thank you!

[the_rock]

Glad we can help. Btw, since we all do IT security here, goes without saying ports should always be indicated whenever possible, but at the end of the day, this is just internal communication, so I dont find it would be a huge deal...just my 2 cents.

Andy

[freeman91]

I can agree. Just bc it is internal communication between DC and IC, any any policy with specified source and destination will do a job.

[the_rock]

Though you can always follow what Chris gave, its an official reference.

Andy