- CheckMates
- :
- Products
- :
- Quantum
- :
- Security Gateways
- :
- Re: Identity Awareness and UPN suffix
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Are you a member of CheckMates?
×- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Identity Awareness and UPN suffix
Hi Guys
I have a problem, CP Identity Awareness doesnt want to recognize users, who logged in UPN credentials. For example, XYZ.local is a standard AD Domain, but also it has UPN suffix XYZ.com for communication with O365 etc. For windows login (and WLC with Radius) doesnt matter, it can be just username, or username@XYZ.local or username@XYZ.com. CheckPoint understand only username and username@XYZ.local.
I talked to CP support, they advised to create additional LDAP account unit (XYZ.com), but it doesnt's work, still same issues with name recognizing, and also Remote Access VPN stops (lose access to original domain XYZ.local)
do you have any ideas how to fix it?
thanks
Accepted Solutions
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks @Royi_Priov
For completeness do we have any other options to manipulate the RADIUS data (realm matching) if it can't be done upstream?
Cheers,
Chris
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Not sure, @Royi_Priov ?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Which identity sources are used?
Royi Priov
R&D Group manager, Infinity Identity
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Active Directory Query (LDAP), and RADIUS accounting turned on... WLC sends info to checkpoint, and i can recognize wireless users in CP logs
thanks
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Some manipulation on the RADIUS side might help e.g.
https://docs.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-crp-realm-names
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This feature allows to replace one domain with another - read more about it on our admin guide.
As for Identity Collector vs. AD Query differences - see sk108235.
Royi Priov
R&D Group manager, Infinity Identity
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks @Royi_Priov
For completeness do we have any other options to manipulate the RADIUS data (realm matching) if it can't be done upstream?
Cheers,
Chris
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Royi, i deployed IC, it works, but it not recognize Radius users, dont see them, anyway i kept it.
Chris, your solution works (i played with realm info), but looks like WLC send info to CheckPoint (and own log) before NPS (Radius) server, i can change realm info, but CHeckPoint sees original request with domain info.
I blocked any access to wireless with domain info, just username, or no wifi 🙂
Also opened Cisco's support case, not sure, maybe possible to cut realm info on WLC directly
thanks guys!
