I am in the process of testing Identity Awareness as want to look at using this to replace individual static IP's from accessing DMZ's as using a User Account would be much easier, and also replacing our 3rd party PROXY Internet Filtering and use the Check Point Application Control/URL Filtering blades. For both of these, I need IA setup correctly.
So far, I have setup IA Active Directory Query, Used "Assume that only one user is connected per computer" and under Identity Sharing, I have "Share local identities with other gateways" ticked.
Generally speaking this is working. I can search AD and add my security group to rules and I get internet access. I have also replaced a static IP with a user and they can access the DMZ etc.
The one issue I get, is sometimes, all of a sudden, internet stops working and I can't connect to the DMZ. Looking at the logs against my local IP address, the Source User Name has changed from neildavey (which is allowed access) to be serverneil (which is not allowed). I have not done anything other that work normally.
It looks as though this is a known issue with ADQuery:
Its a shame this happens, as this is an easy setup with nothing needing to be deployed etc and works straight away.
I am just wondering what the best method to get this working would be if anyone has done this same setup?
You have Identity Collector, but I think this does the same as Active Directory Query just on a server and sends the same data to the GW.
You have Identity Agents which I think would be what I need but I saw a section about "Users should reauthenticate every XXX minutes". This sounds as though the user would need to reauthenticate at a certain time.
I am looking for the most straightforward and seamless way to get this working so my users don't have to do anything like the AD Query does.
Any advice/suggestions appreciated.