Identity Sharing - updates from multiple sources

[Dor_Marcovitch]

hey,

i am writing a document for a regarding the IA blade.

currently we have about 8 clusters which are connected to all of the DCs in the environment which is OK from my point of view because the environment is not that large and mandatory because of the network topology.

on some computers there is a use of the "switch user" function of Windows OS, so we need to start using the IA Agent for those computers. that brings up the need of using identity sharing between the security GWs.

from what i read there are 2 methods, "smart-pull" and "push". the first one the PEP only ask the PDP for the identity if it is unknown for the GW, but because the computer is connected to the DC it might get the identity from it and not ask the PDP for the identity even if a switch user was performed and the identity was updated on the PDP.

regarding the "push" method wont it create a sort of "loop" of notifications because all FWs connects to all DCs and an update from a DC will also update all the FWs using the Identity Sharing feature?

am i right or do i miss anything ? 

thanks

dor

[PhoneBoy]

What precise methods are you using to acquire identities here?
You mention agents, what else?

In general gateways should acquire identities from sources as close to the user as possible and share identities between other gateways.
However, multiple gateway clusters should not be acquiring identities from the same AD servers.

[Dor_Marcovitch]

all GWs are connected to all of our Domain controllers to get Identities, we have acoutn 10 DCs spread over the network.

i didnt split the DCs between the GWs.

another source is for some users that use identity agent because of the need to use the switch user function of the OS

[G_W_Albrecht]

• R80.40 Identity Awareness AdminGuide
• sk86441: ATRG: Identity Awareness
• sk88520 - Best Practices - Identity Awareness Large Scale Deployment

• sk44178 - Identity Logging - FAQ
• sk60301 - Identity Awareness AD Query
• sk66761 - Identity Awareness support for Terminal Servers - FAQ
• sk44261 - Understanding the behavior of querying multiple LDAP servers