Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
fdhfdshs5454
Participant
Jump to solution

IA sharing at scale

Hello

We manage 50+ gw with full meshed IA sharing.

We face lot of isues with IA.
Some random IA not propagated accross gw, some random IA agents not able to connect to their local gw...
Something that improve the behavior a little bit is a cronjob to kill pep and pdp every night...

We think about centralising IA on a dedicated gw, so IA agents connect to this specific gw and it redistribute IA to all gw.

It's a big change that cannot be fully tested outside production and we are a little bit afraid things get worse than now.

How do you folks manage IA at scale?
Do you have to kill pep and pdp every night too?
Do you centralise IA to a single sharing gw?

Thanks for your advises.

0 Kudos
1 Solution

Accepted Solutions
fdhfdshs5454
Participant

We are slowly migrating to this setup and it looks like our issues disappear.

Checkpoint should really highlight the usage of very centric PDP to avoid IA sharing issues as soon as 2 firewalls are involved.

View solution in original post

0 Kudos
10 Replies
G_W_Albrecht
Legend
Legend
0 Kudos
fdhfdshs5454
Participant

Yes, I read that.

I want to know administator feedback about IA sharing in general, this solution or others they may have deployed to fix IA.

0 Kudos
Chris_Atkinson
Employee Employee
Employee

R81.20 has some relevant IA enhancements...

Are you using any of the following today and what version are the current Gateways?

- Identity Collector

- Identity Broker

- Dedicated PDPs

CCSM R77/R80/ELITE
0 Kudos
fdhfdshs5454
Participant

We are currently running R81.10 HFA110 on every gw.

We'll upgrade to R81.20 as soon as we get a maintenance windows.

  • Identity Collector: No. We don't use ADQuery. Only IA agents. Plus, each remote gateway fetch from its local DC
  • Identity Broker: No. We didn't invest in it as the configuration involve files modifications with complex syntax on every firewalls. Now, if you tell us it enhance the UX, we'll consider it. But how is it different from "classical" PDP? Why is it not the default PDP mecanism?
  • Dedicated PDPs: No. That's what this post is all about... Is it a good move? Is the user community doing it? what is their feeddback?...
0 Kudos
Daniel_Szydelko
Collaborator
Collaborator
0 Kudos
ProxyOps
Contributor

Hello,

we use dedicated PDP Brokers. The firewall itselfs only do the pep enforcement. We completly seperated these two services from each other. These PDP Brokers are full meshed to share all identies with each other. The peps only consume the identies from their local PDP Broker.

We don't need to kill pep / pdp every night.

We setup a centralised IA PDP Broker for every region.

We switched from our full meshed design to PDP Brokers in 2021. I draw our design and uploaded it here:

 

ProxyOps_1-1697200005813.jpeg


If you want more informations, feel free to contact me via private message.

 

Best regards



fdhfdshs5454
Participant

Hello,

Thanks for sharing.

Your setup make sense to us. We will think about making something similar.

Thanks mate!

0 Kudos
fdhfdshs5454
Participant

We are slowly migrating to this setup and it looks like our issues disappear.

Checkpoint should really highlight the usage of very centric PDP to avoid IA sharing issues as soon as 2 firewalls are involved.

0 Kudos
CP-NDA
Collaborator

Hi @ProxyOps 

 

Very interesting design!

Just wondering if your PDP Broker are working with Cluster_XL or not ? Does Cluster_XL synchronize the IA tables ?

Today we have a central design with IA Sharing accross multiples site which is just working fine. Problem is to find window maintenance to upgrade this central IA gateway.

This central Gateway is doing PDP for all users and then share identity with PEP to all remote GW.

Thank you

 

0 Kudos
ProxyOps
Contributor

Hi @CP-NDA 

we are running our PDP Broker as Clusters (Cluster_XL) active-standby on VMs. 

Our PDP Brokers are running R81 currently are cluster_xl is not snycing the relevant tables for a interruption free failover.
When we do a failover the PDP Broker has to sync from scratch again with all over PDP Brokers.

I checked the R81.20 release noted and maybe something was improved here?


"Improved resiliency, scalability, and stability for PDPs and Identity Broker. Additional threads handle authentication and authorization flows."

I know cluster_xl is syncing some IA tables for PEP but I am not able to find a sk for that.

I have to admit, that we update the PDP Broker Gateways only if required as we need them to be as stable as possible.

 

Best regards

 

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    Tue 23 Apr 2024 @ 08:00 AM (CDT)

    South US: HTTPS Inspection Best Practices

    Tue 23 Apr 2024 @ 11:00 AM (EDT)

    East US: What's New in R82

    Thu 25 Apr 2024 @ 11:00 AM (SGT)

    APAC: CPX 2024 Recap

    Tue 30 Apr 2024 @ 03:00 PM (CDT)

    EMEA: CPX 2024 Recap

    Tue 23 Apr 2024 @ 08:00 AM (CDT)

    South US: HTTPS Inspection Best Practices

    Tue 23 Apr 2024 @ 11:00 AM (EDT)

    East US: What's New in R82

    Thu 25 Apr 2024 @ 11:00 AM (SGT)

    APAC: CPX 2024 Recap

    Tue 30 Apr 2024 @ 03:00 PM (CDT)

    EMEA: CPX 2024 Recap

    Thu 02 May 2024 @ 11:00 AM (SGT)

    APAC: What's new in R82
    CheckMates Events