Identity Awareness Enforcement

[Simon_Macpherso]

Hello,

Is it possible to enforce IA on the destination (remote) side? 

Normally we enforce IA at the source. In this scenario, the source is essentially a 3rd party which we don't manage so we don't have an appliance deployed there. Consequently, we can't enforce the IA at the source. 

The source are Azure VDIs which sit behind an Azure VPN gateway. We have a S2S IPSEC VPN configured between the Azure VPN gateway and an on-premises Checkpoint HA cluster.   

The Azure VDIs are domain joined. We have an IA collector deployed and connected to the DCs in this domain so we are getting login events.

An access rule is created using an access role as the source. The access role is configured with the Azure VDI network for network and user account or AD security group specified for users - can IA be enforced on the remote/destination (Checkpoint) end? 

Regards,

Simon

[PhoneBoy]

As long as the gateway is receiving the identities and the relevant traffic flows through the gateway, it should work.