The IA collectors at 2 DCs and then sharing to other gateways has been working great! We gotten a few access roles deployed and so far its working as we imagined.
For the MAC issue, this is really due to MAC OS. With any MAC OSX joined to AD, the MAC is not 'site aware' and therefore we were getting auths sent to DCs that we were 1) not monitoring with the collector and 2) really didn't want them going randomly cross site.
The temp fix was to set a prefered AD server in the Active Directory config on the MAC. That has consistantly gotten the login but have to sometimes 'force' the update with "kinit" via terminal.
Long term (outside of using the machine agent from Checkpoint), we have been testing NOMAD with the MACs. NOMAD is site aware and our initial testing gets the MAC as close to windows in regards to AD.
One item did come up that caught us offguard: 2 of DCs we are collecting from stopped connecting. Its for a sister company of ours and think something changes on a config or patch. Regardless, my question is: how do you monitor this type of event on the Identity Collector itself?
I've seen post on custom querries to the gateways to detect when they stop getting feeds from the collector itself. I've also seen the updated SK (sk108235) on the monitoring capabilities via SNMP to R80.20 gateways for the collector status.
I simply can't find in any searches or admin guides on how to monitor issues on the IA collector itself in regards to its "identity sources" status.
Does anyone know how to detect such an event?
Lastly, during my search, I see that there is a newer collector out (sk134312). We are currently running 80.72.0000 and I'd like to plan to upgrade it......but can't seem to find any docs on how to upgrade 🙂 Plenty on install but nothing on upgrading a existing collector.
- Do you export the config, delete the agent and reinstall?
- Any changes needed to resynch with the gateways, its identity sources, etc?
- Does it support a direct upgrade when running the new MSI package?
- Does the configs stay in a 'in place' upgrade?