cancel
Showing results for 
Search instead for 
Did you mean: 
Create a Post

Microsoft DirectAccess, Proxy & Identity Awareness

We are using Microsoft DirectAccess and we are trying to implement CheckPoint Proxy with HTTPS Inspection. We have managed to get Proxy & URL Filtering working via DirectAccess, however the logs do not show the originating computer/user, it just shows the VPN Server as the source.

This is obviously a problem when troubleshooting a specific user's problem or when we need to generate reports based on usage etc.

Does anyone have any ideas?

0 Kudos
4 Replies
Admin
Admin

Re: Microsoft DirectAccess, Proxy & Identity Awareness

Have you enabled this option, by chance?

Highlighted

Re: Microsoft DirectAccess, Proxy & Identity Awareness

I have the first two checkboxes enabled on that Proxy Settings page.

0 Kudos

Re: Microsoft DirectAccess, Proxy & Identity Awareness

Unfortunately, you won't be able to identify your users when they are connected behind a Direct Access server. Indeed, the remote machines IP address is NATed by the DA server. As Checkpoint Identity Awareness maps a user to an IP address it won't work. Moreover, installing an IA agent doesn't help, as it cannot work through a DA server.

The only solution is to do NTLM/Kerberos authentication with an web proxy. This way, the user identity is carried by the browser request and not impacted by the IP address translation, allowing the proxy to identity the users.

Re: Microsoft DirectAccess, Proxy & Identity Awareness

Thanks David. That sounds like a viable solution, is it possible to only apply the browser request on computers that are accessing the Internet via DirectAccess?

0 Kudos