Identity Awareness Agent connectivity Issues.

[George_Sas]

Hi guys.

For almost an year now we had an issue with our Checkpoint cluster , 2 x 6600.
Since we enabled Identity Awareness Agents as identity provider , our firewalls started to experience high CPU load.
After almost an year Checkpoint said we encounter the issue because the identity awareness is configured to only listen "Trough internal Interfaces" only , and we were instructed to change the setting so the gateway listens on all interfaces.
cp1.png

Now since we did this, my clients experience connectivity issues mostly when they are connecting to the network trough VPN.
I can see the Agent trying to connect and connect and connect and when finally connected , there is still no access to internal network resources.
If I disconnect the Identity Agent and then connect again , everything works.
Also I see some clients get the popup with "Username / Password" request.

We NEVER had this problems while the gateway was configured to only listen trough the Internal Interfaces.

On the MSI installation package I distributed to clients I specified Connect to Server , and manually added CLUSTER FQDN name.
Should I change this to IP or what is the best practice ?

cp2.png

I have also configured Identity Agent Distributed Configuration and Active Directory if a client defaults to automatic.
The DEFAULT rule puts the SAME Identity server list with both Internal and External DNS name.

Then I have made rules for different satellite offices to try and connect first to the local gateway as priority 1 then to the central gateway as priority 2.

Also , WHEN does the agent use the AD Configuration ? Because according to guide, when configured for automatic discovery , it will sue DNS ?

Does anyone else that uses Identity Agents as identity providers experienced something similar ?
Or any idea where to start debugging ?

Thanks in advance.

[PhoneBoy]

FDQN is best practice, I believe, though it should be to an internal interface, not external.
The servers necessary to use for Active Directory are disclosed in the DNS records. 

[George_Sas]

Can you point me out to the DNS records that should be generated by the Distributed Configuration ? I can't find any...

Also , since we did as requested by Checkpoint and changed the Identity Awareness to listen to ALL Interfaces I started having some HUGE issues with connectivity trough firewall once in a while..one of the CPU spikes so high that the active node becomes unresponsive and my hypervisors start having packet loss and problems reaching quorum. 
So today I was forced to revert back to Internal Interfaces only.
Screenshot 2026-08-22 134534.png