IA How to disable identity pull from PEP to PDP

[dehaasm]

We have an on premise PDP which is pushing/ sharing the identities to a Azure Cloudguard using the public IP address of the gateway (also restricted on the source public IP address). This is quiet helpfull as this is Out of Band management and not crossing any Azure Load Balancer. This is working and the Azure Cloudguard PEP has all the user information. The Azure Cloudguard also tries to retrieve the identities by connecting to the same IP address but the IP address from the PDP is not reachable.

We know that sk60701 explains how to change the IP address of the identity sharing gateways but we dont want to do that, hence it is already working, but the PDP "complains" that is lost its connection to the Azure Cloudguard. Again the connection from the PDP to Azure firewalls PEP are working fine and the gateways have the identities but the opposite direction is not able to establish the connection.

The only thing we try to avoid is that the PDP is reporting errors but in fact is working fine and the Azure cloudguard does not need to share its identities, but only receive from the PDP.

Is there a way to control and only enforce PDP push identities from the PDP to PEP and not to perform any PDP pull from the PEP in Azure?

Perhaps there is some neat feature called smartpush from PDP to PEP and not to perform any smartpulls, asking for a friend 🙂

[the_rock]

Personally, Im not aware of such a feature, maybe TAC would be able to confirm for you.

Best regards,

Andy

[Tobias_Moritz · Accepted solution]

You could try changing publish_method on the gateway from smart_pull to push (GuiDBedit: Table -> Network Objects -> network_objects -> FirewallName -> identity_aware_blade -> publish_method), save and install policy.

You may need to reset IA tables after that change (see sk170516 for the commands) and relearn all identities (maintenance window required).

[Tobias_Moritz · Accepted solution]

You can check afterwards with "pdp connection pep -e" on PDP. There is column named "Publish" which should show "Smart-Pull" before and "Push" after the change I mentioned.

[dehaasm]

thanks Tobias that worked for me no need to do any restart of PDPD or relearning it just works out of the box, just needed to allow port 15015 towards the gateways that is it.

[the_rock]

Thanks for letting us know, glad it worked.

Andy