Identity Collector

[GigaYang]

Hi All,

We tried to set up an Identity Collector host to replace the original AD Query function of the firewall.

After the erection is complete. We found it in the log column of "Source user name". No user account information appears. In the IA-related Log, we saw the following error message:
"Failed to get user groups for the domain.
Verify that this domain name is configured in your LDAP Account Unit."

We have closed the local firewall of the AD and Identity Collector hosts, but still cannot collect user information.

Our AD version is Windows Server 2019. Can someone who has encountered the same problem give guidance.

Thanks

[the_rock]

When you open IC software, does gateway show as connected status? Also, did you make sure AD query is fully off?

Andy

[PhoneBoy · Accepted solution]

Identity Collector changes how the gateways acquire users (using Security Logs instead of WMI).
The actual groups are still pulled the same way as with ADQuery: via LDAP queries from the relevant gateways.
Which means you should verify the information needed to perform these lookups is correct: https://support.checkpoint.com/results/sk/sk180392

[GigaYang · Accepted solution]

After I add a LDAP account unit object. The problem has been solved. 

[the_rock]

Good job!

[GigaYang]

We made some architectural adjustments today. The Identity Collector host is placed on a different network segment from the Gateway management interface. As a result, the Identity Collector cannot establish a connection with the Gateway, but the Allow Log is displayed. Has anyone encountered such a situation?

[the_rock]

Do you have proper rules configured? Does ping work back and forth?

Andy

[GigaYang]

Yes,

We have set the firewall rule from IC to gateway over TCP 443. And ping is work well.

[the_rock]

Does gateway show as green in IC software? Also, can you pull identity source on the software itself? I will send screenshots later of what Im referring to.

Andy

[the_rock]

K, as promised, I attached document of what I was referring to.

Andy

[GigaYang]

Hi Rock,

When IC Server and Gateway are in the same subnet. IC can function normally. But when we re-set up the IC in another subnet, the two cannot be connected. But I'm sure the IC can connect to the Gateway via TCP 443.

When unable to connect, the Gateway status on the IC is red. I'll provide footage later.

[the_rock]

That sort of makes sense, since as we all know, when hosts are on the same subnet, all that needs to happen is they know about one another's ARP, no routing needed, so its logical it works.

If it fails on different subnets, confirm the routing, as well as access policy. Do basic zdebug, as well as fw up_execute as well

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_CLI_ReferenceGuide/Topics-CLIG/FWG...

Andy

[GigaYang]

Hi Rock, attach file is my setting.

[the_rock]

Right, so we need to find out WHY it fails, so only way to know is by running basic captures, simple debugs and see where its "stuck"

Andy

[GigaYang]

Attach file is fw monitor and zdebug result. I think the connection between the Gateway and the IC host is normal.

[the_rock]

I think quick remote session with TAC would probably solve your issue, I feel like its something basic thats missing.

Andy

[GigaYang · Accepted solution]

Finally we found two problems:
1. PDP Problem: After we disable the AD Query function, the Monitor's device status will never change.
2. The VPN certificate has expired.

After weReboot the device and re-sign the certificate. The problem is solved.

[the_rock]

Good job!