Identity awareness collector changes user identity for same IP while connecting to RDP

[dehaasm]

Hi All we have something strange with Identity Awareness collector installed on server, let me explain;

A client with IP 10.0.0.1 (example) connects to the gateway and the Idenitity awareness collector identifies the user as nick. When the same user/client IP established a RDP connection to external server 192.168.1.1 (example) and logs into that remote server as nick-admin the gateway receives an identity update from the identity awareness collector indicating that 10.0.0.1 is nick-admin which is obviously not correct. We would expect the external server IP 192.168.1.1 to be nick-admin and the 10.0.0.1 to remain nick.

How is this possible that the IA collector is identifying the user incorrectly on the laptop?

note: this issue is easy to reproduce and I wonder if we need to open TAC case and/or understand if there is somehing we need to adjust on the IA collector?

[RK91]

Hello Daniel,

Did you manage to escalate the ticket?

Is there any news from Checkpoint?

Thanks &  regards

[Daniel_Hainich]

i escalated this to checkpoint. it is by design and all is fine. 😞 

[RK91]

then we have to accept it - very annoying although this is really a problem and apparently several people have it

[jameelalsarraj]

Was this issue solved? cause I have the same issue and I've just solved it now.
If it is still open, please let me know so I can explain the solution to you.

[RK91]

Hi jameelalsarraj,

Yes we still have the issue. It would be great if you can explain the solution.

Thanks & regards

[jameelalsarraj]

Hi RK91,

From the Identity Collector tool in your Identity Collector server, click on "Filters" --> Open "Global" filter, on the left side click on "Identity Filter", select "Exclude" and add the user that you want to exclude (you can also add a wildcard)

Please take a look at the attached photo, which provides a clearer view.