Identity awareness Access Rules

[Johan_Rudberg]

Hello

We are using Identity awareness with identity collector. When we create a access rule within the access policy in order to block a group of computers from accessing the internet, however this does not work, the traffic doesnt even match this rule. Creating a simular rule for users from the AD works just fine but not the computers. 

Any ideas?

Running version R80.20 HFA Take 91 

//Johan

[PhoneBoy]

What does the Access Role you’ve configured look like?

[Johan_Rudberg]

It is a AD Group configured under Machine in the Access Role

[abihsot__]

probably there is no match for this access role. When you select specific workstations, which setting you have for "users" section?

Is your workstation exist here?

pep s u q mchn <workstation_name>

[Daniel_Taney]

Are the computers you are trying to block part of the AD domain? or are they standalone? 

[Kaspars_Zibarts]

I remember I had to split "mixed"roles after upgrade to R80.x as machine IDs stopped working if the same role also had user IDs.

Try using role that has machine IDs / groups only if you have not done that

[Johan_Rudberg]

We resolved this problem by rebooting the management server, now the rule works!

However from the moment when a computer is added to the AD group it takes X hours before the rule deny the traffic, why is that so?

//Johan

[abihsot__ · Accepted solution]

By default it is 4 hours. You have to change it if you want more frequent active directory fetch for group membership. You can do manually by using following command:

pdp update

Command: root->update

Available options:
all - recalculate all users and machines group membership
specific - recalculate group membership for a user/machine
refetch_interval - LDAP user info refetch interval
update_rate - the max number of sessions updated within a minute