Identity Awareness MUH agent queries

[cem82]

Hi

We are currently running IA collector and looking to install MUH agent on our terminal servers.  Something that concerns me in sk164998 is the below line.  Surely this doesn't mean that we should only have the agent installed on 50 term servers or what does this 50 relate to?  Is there a way for the MUH agent to feed into the IA collector and then send the identities that way to save opening up FW rules between all the TS to the GW?  I presume we don't need to update the gateway "allowed-client" list to include the TS as this connectivity is to the GW itself on https?

How many MUHv2 Agents are supported on one Security Gateway?

It is a recommended best practice to have a maximum of 50 MUHv2 agents on one Security Gateway.

[_Val_ · Accepted solution]

Each terminal server should have a MUH agent. SK is saying, a single PDP should not have more than 50 agents reporting to it.

[PhoneBoy · Accepted solution]

And a PDP exists on a gateway, so yes, it means no more than 50 MUHv2 agents should be reporting to a single gateway.
You can, of course, have different MUHv2 agents reporting to different gateways which share identities.
You may also want to have dedicated Identity Awareness gateways in some configurations that merely exist to consume and share identities with other gateways.

[cem82]

Thanks for clarifying, I am surprised but does the number of expected users come into play on the recommendation of 50 agents?  EG if some TS are likely to only have a few users logged in at a time or is user count irrelevant and just the total number of TS should be less than 50?

[_Val_]

Each agent can work with 256 users at the same terminal server, but you are correct, the amount of users connected is not in play here. One PDP - up to 50 MUHv2

[cem82]

Awesome thanks for clarifying 🙂

[Wolfgang]

@_Val_ @and @PhoneBoy  any changes about these limitation ?

How many MUHv2 Agents are supported on one Security Gateway?

It is a recommended best practice to have a maximum of 50 MUHv2 agents on one Security Gateway.

We have a use case for 10.000 users connecting from a larger Citrix environment. Each Citrix host will be used by around 50 users, 200 Citrix hosts with MUHv2 agents needed.

50 MUHv2 agents for one PDP needs 4 separate gateways and some more for redundancy.  They’re doing nothing then running PDP and sharing identities. 
Are there any changes upcoming to support more MUHv2 per PDP ?

[PhoneBoy]

In R81.20, there are some underlying infrastructure changes that should allow for better redundancy/resiliency/scalability.
What the final number are, not sure yet.

[Rafal_N]

Can MUH information can be shared across gateways via IA sharing?? Or is it just to connected gateway??

MUH -> GW1 PDP (Internal GW) <-IA sharing-> GW2 PDP (Internet GW)

Does GW2 in that topology would understand packet tagging from MUH and we can build Access Role policy there??

How can we identify packet tag on pcap (wireshark)? Is it in readable format?

[PhoneBoy]

Any identity source can be shared with any other gateway--that includes MUH.
And yes, you can build the appropriate access policy (with Access Roles) on other gateways as a result.
The packet tagging we do is described here: https://supportcenter.us.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&so... 
The tags aren't readable.