Hi everyone,
I’m dealing with a persistent Identity Awareness issue on R82 (JHF60). I would appreciate help verifying whether this is a configuration issue, cache issue, or a known IA bug.
Problem description
For several users located in specific /28 networks, PDP correctly detects both machine and user identity, but PEP does not register the corresponding network segment, and therefore the identity is never pushed to the PEP.
Symptoms:
PDP sees user + machine, roles, AD groups.
PDP shows that the /28 subnet is registered on 2 gateways.
PEP does NOT show this /28 in pep show network registration.
As a result, traffic from these users triggers Captive Portal redirects, even though the Identity Agent is installed and AD identities are valid.
This happens only on some subnets (e.g., 10.xx.xx.14/28), while others (e.g., 10.xx.xx.16/28) work correctly.
This already affected several users across different subnets (10.xx.xx.13, 10.xx.x.103, 10.xx.xx.67).
What I already did
✔ Restarted pepd (fw kill pepd)
→ No change; PEP still does not show the /28 subnet.
✔ Increased PDP caches (kbuf, ldap_cache, sessions_cache)
→ PDP load resolved, cache no longer full.
✔ Upgraded to R82 JHF Take 60
→ Issue persists.
✔ Enabled debug on both PDP and PEP
→ No new entries in pepd.elg related to this network range.
✔ Verified with Identity Agent installed on endpoint
→ Identity still not propagated to PEP.
✔ Verified traffic logs
→ PEP falls back to Captive Portal (“Redirect to CaptivePortal”), showing identity was not mapped.
✔ SmartConsole Diagnostics
Identity Awareness – Sharing mechanism error inx invalid type (0)
Checked sk63264, but symptoms do not fully match.
CLI diagnostics (shortened)
On PDP:
pdp network info → PDP knows the /28
pdp network registered → PDP thinks the PEP is registered
pdp monitor ip X.Y.Z.14 → user + machine identity present, published to the correct gateway
On PEP:
pep show network registration → no entry for the /28 subnet
→ This is the core issue.
Possible related issues
Possible incorrect identity-sharing registry state (PDP believes PEP registered, PEP does not)
Identity Cache Mode in R82 holding PEP in a “no identity for this subnet” cached state
Rare identity sharing bug similar to sk134054
Misalignment of registration paging (registered_users_page_size, though not modified)
PEP cutting the identity because the network is not mapped
Questions for the community
Has anyone seen a situation where PDP shows a registered subnet, but PEP never lists it?
Could Identity Cache Mode in R82 preserve a “broken” or empty network registration state?
How do you properly force a full rebuild of PEP network registrations, beyond pep cache clear and pdp control full_update?
Is the "inx invalid type (0)" error in diagnostics a sign of an underlying identity sharing issue?
Is this consistent with any known IA bugs affecting PDP→PEP propagation in R82/JHF?
Any recommended debug flags for pepd/pdpd specifically targeting network registration failures?
Happy to share more logs (pepd.elg, pdpd.elg, SmartConsole logs) if needed.
Thanks in advance for any hints or experience!
