Identity awareness and ADS machine identity propagation

[Niels_van_Sluis]

Hi,

In our setup we are using the Identity Awareness blade on a R80.40 Security Gateway, which receives identities from an Identity Collector. The Identity Collector itself collects the identities from a pool of Microsoft Active Directory servers.

Everything seems to be working fine for some time now, but I've noticed that for the Active Directory servers themselfs the Security Gateway isn't receiving Machine Identity Propagation login or updates. Is this by design? 

Kind regards,

     --Niels

[PhoneBoy]

You mean when someone logs into the AD server itself?
Note only AD users are acquired, no local users will be acquired.

[Niels_van_Sluis]

Hi Phoneboy,

No, it is for the AD server itself. For other non-AD-servers I see log entries like shown below.

Id: 0a6000f1-b607-a64b-6064-724300000001
Marker: @A@@B@1617193489@C@911804
Log Server Origin: x.x.x.x
Time: 2021-03-31T12:59:47Z
Id Generated By Indexer:false
First: true
Sequencenum: 87
Domain Name: example.com
Source: y.y.y.y
Endpoint IP: y.y.y.y
Authentication Status: Successful Login
Identity Source: Identity Collector (Active Directory)
Session ID: 66d6b3c5
Source Machine Name: servername
Source Machine Group: All Machines; ad_group_my_servers;
Authentication Method: Machine Identity Propagation
Identity Type: machine
Authentication Trial: this is a reauthentication for session xxxxxx
Roles: My_Servers
Action: Update
Type: Log
Blade: Identity Awareness
Origin: FW-A
Product Family: Network
Logid: 131073
Description: Successful Login 

Updates like these are not being received for the AD servers themself. 

[PhoneBoy]

But you're using an actual AD account to log in, correct?
Maybe @Adi_Babai or @Royi_Priov know here.

[Niels_van_Sluis]

Well as far as I know, it is the AD server itself. I think the 'Machine Identity Propagation' update is send when a system itself is domain joined en authenticates itself to the AD server or domain. Maybe the AD represents the domain itself, and therefore doesn't join the domain like non-ADS servers do. That could be the reason that I don't see updates on the Security Gateway.  

[PhoneBoy]

Your explanation seems reasonable to me, at least.

[alexander_ae]

Hi Niels,

summary: it appears only the AD Servers , selected as an identity source that appear to be affected.

long:

We have the same behaviour in our environment. (1st time posting on checkpoint.... hooray.)
> other domain controllers,   NOT in the Identity Collector as sources are registering just fine here.

It's only those  that are enlisted as "Identity Collector Sources"  that are not registering as "machine identity". Exactly what you described.

Was this fixed for you somehow recently? or still an open question? Wondering if we should open a case @ CP for this or not.
Honestly we don't know if it has always been like this - but considering the Ruleset we stumbled upon a couple issues - and narrowed it down to the fact those specific Domain Controllers are not having their machine identity updated towards our Security Gateway.

[Daniel_Kavan]

I'm wondering if machine identity propagation can be turned off when it's not being used.   We're just using network and user authentication to validate access not machine identity.  

Also, the domain controllers its trying to get to are not configured in our LDAP account unit by design.   We are only using domain controllers in domain A, not B or C to validate users.    Those domain controllers exist for off site customers.

In the case I did want to use those other domain controllers from other domains, I assume I would have to use MDS for management (multiple domains).   IOW, if someone LDAP used a domain from domain B, a DC in domain A wouldn't find it even if I had it listed as a DC.  You can't control which DC is used for each rule.  Maybe, that will change in R81.20?

[Daniel_Kavan]

No, I'm still seeing all these messages.

Failed to get users groups for the domain.
Verify that this domain name is configured in your LDAP Account Unit.
Domain: somegroup.local

the answer maybe to add these domains to the IDC, there's a few differentusers who log in.

After adding the new domain to IDC and adding an account unit for the new domain, I'm still seeing these in R81.20

Machine Identity propagation Failed Login  Failed to get users groups for the domain.
Verify that this domain name is configured in your LDAP Account Unit.  (Yes, it is so ?)

[Phil_Pasquier]

Getting the same error here, actually a lot of them... ? Propagation deactivation option would be helpful

Any other leads ?