Identity Awareness Issues

[ShemHunter]

There are two similar SK

https://support.checkpoint.com/results/sk/sk134292
https://support.checkpoint.com/results/sk/sk106964

And I don't understand how exactly they work, I'll explain it with an example:

I have two environments - a test environment (regular GW and cluster), and a production environment (Maestro).

In the test environment, I have AD - indeed.cp
It also has - prod.indeed.cp

In the production environment, I have AD - indeed.cp
It also has about 8-10 ADs. - europa.indeed.cp/europa1.indeed.cp - and so on.

I created a group in the prod.indeed.cp and the user himself is from indeed.cp and using the access role and pdp m u - I see the group for this user

I haven't applied any settings, but I use group nesting settings of 4 or 5 and I see the group. When using setting 2, I don't see the group. If I disable group nesting altogether, I doesn't see the group.

Connecting to the main AD via Port 636 is different from port 389.

In the production environment, everything is configured exactly the same, but at some point, access roles stopped resolving, and PDP MUI doesn't see groups and shows all users. I'll say right away that I didn't apply any settings before the problem occurred.

I use a collector in both environments.

Version 81.20, take 158

[simonemantovani]

Anything has been change on AD side?

[ShemHunter]

There have been no changes on the AD side.

Additionally to my post:

The group that was created—the group's scope is universal—if that helps solve the problem, of course.

[simonemantovani]

I haven't enough experience on Active Directory, but maybe this PDF could be an helpful point to start:

https://www.google.com/url?sa=t&source=web&rct=j&opi=89978449&url=https://community.checkpoint.com/f...

In particular take a look from page 14.

[PhoneBoy]

Maybe @Peter_Elmer can help here.