Forescout NAC Identity Awareness API

[Jonathan_Langle]

We have the Check Point intergration to Forescout so we can add users to Access Roles in our security Policy. This is mostly working outside of one piece, the IP To User Mapping. It would appear Forescout is sending the EXAMPLE\Username instead of what our LDAP Account Unit is configured for which would be EXAMPLE.Domain.com as an example.

Has anyone else used this integration and run into this? I tried changing the UserLoginAttr on the gateway object to UserPrincipalName  but no dice. The error i am seeing is the following:Failed to get users groups for the domain. Verify that this domain name is configured in your LDAP Account Unit. Domain: EXAMPLE

[PhoneBoy]

Have you approached Forescout related to this?
Can you include a (redacted) log card as well as version/JHF level?

[Jonathan_Langle]

Not yet, i have a ticket open with Support now and sent them PDP and PEP logs. Here i dont have much of a log to go off of, but this is in smart console:

Failed to get users groups for the domain.
Verify that this domain name is configured in your LDAP Account Unit.
Domain: DOMAIN

Our Domain in the ldap account unit is DOMAIN.EXMAPLE.COM and the domain on the forescout side is sending just DOMAIN.

[Kirupa_Shankar_]

Hello @Jonathan_Langle where you able to implement this successfully?

we are trying the integration to send forescout identified device classifications to checkpoint access roles to be used in the policy. Your insight will be helpful.