Microsoft DirectAccess, Proxy & Identity Awareness

[Matt_Parfitt]

We are using Microsoft DirectAccess and we are trying to implement CheckPoint Proxy with HTTPS Inspection. We have managed to get Proxy & URL Filtering working via DirectAccess, however the logs do not show the originating computer/user, it just shows the VPN Server as the source.

This is obviously a problem when troubleshooting a specific user's problem or when we need to generate reports based on usage etc.

Does anyone have any ideas?

[PhoneBoy]

Have you enabled this option, by chance?

[Matt_Parfitt]

I have the first two checkboxes enabled on that Proxy Settings page.

[David_GOURANTON]

Unfortunately, you won't be able to identify your users when they are connected behind a Direct Access server. Indeed, the remote machines IP address is NATed by the DA server. As Checkpoint Identity Awareness maps a user to an IP address it won't work. Moreover, installing an IA agent doesn't help, as it cannot work through a DA server.

The only solution is to do NTLM/Kerberos authentication with an web proxy. This way, the user identity is carried by the browser request and not impacted by the IP address translation, allowing the proxy to identity the users.

[Matt_Parfitt]

Thanks David. That sounds like a viable solution, is it possible to only apply the browser request on computers that are accessing the Internet via DirectAccess?