Access role is not working with Identity collector when network roaming

[Wyl]

Hello guys,

I need some help about identity awareness. We are currently using R81.10 take 87 in VSX environment. 

I used identity collector as a identity source. This source is fine when we first authenticate to the AD. 

But during working hours, users have to changed different IPs and have to do network roaming.

When the IP is changed for that user, security gateways do not have the updated IP information and the connections are being blocked without hitting the access role policy. Other vendors' firewalls are working fine with that kind of situation.

Is there anything I missed to configure? Do I need another identity sources to work with that kind of situations.

Thanks

[PhoneBoy]

We recommend acquiring the identity of the user as close as possible to the source.
In some cases, we recommend installing an Identity Agent.
This is required in the case of Multi-User hosts and highly recommended for users who roam.
See: https://support.checkpoint.com/results/sk/sk134312 

[JoSec]

Be sure you add of your DCs to the Identity collector which I assume you did since the initial IP is working as you indicated but Identity Agent is the way to go IMHO as Phoneboy indicated.

[Wyl]

I am planning to use identity agents and terminal servers agents. Is it work with identity sharing feature since Identity agents can only connect to one VSX? Thanks for your advice.

[PhoneBoy · Accepted solution]

Yes, you can leverage Identity Sharing.