Can I implement Identity Awareness without using a PDP/PEP Broker?

[RemoteUser]

Hi everyone,

I’m working on an Identity Awareness deployment on Check Point and I’d like some clarification.

I understand that in large or complex environments, the PDP/PEP Broker is used to centralize identities and share them across multiple gateways. What I’m not sure about is:

• Is it possible to configure Identity Awareness directly on the gateway without relying on a Broker?

• In which scenarios is it sufficient to enable IA using methods like AD Query, Identity Collector, or Captive Portal directly on the firewall?

• When is an Identity Broker actually required (e.g. multi-gateway environments, distributed clusters, or multiple AD domains)?

I’d like to confirm whether, in a relatively simple setup (a single cluster and one AD domain), everything can be done without a Broker, or if there are hidden limitations I should be aware of.

Thanks in advance.

[Alex- · Accepted solution]

For a simple deployment with just a cluster and a single domain, you can use the Identity Collector and you don't need brokers or identity sharing. The Identity Collector doesn't require domain admin rights which is preferred. From there you can use other methods like Captive Portal for instance.

[Alex- · Accepted solution]

Interesting sources:

sk86441 ATRG: Identity Awareness

Tech Talk Identity Awareness Best Practices

[the_rock · Accepted solution]

Hey bro,

Yes, 100% you can use simple setup without a broker, works fine, no limitations at all.

What @Alex- gave are great references.

[the_rock]

One more reference.

https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_IdentityAwareness_AdminGuide/CP_R8...

[PhoneBoy]

Identity Broker is used to achieve better scalability reasons in larger environments.
It also enables certain use cases like one-way sharing of identity data as well as cross-SIC domain sharing.
For simple deployments with on-prem AD, Identity Collector is your best bet.
ADQuery is not recommended any longer due to security and scalability issues with WMI.