- CheckMates
- :
- Products
- :
- Quantum
- :
- Security Gateways
- :
- Re: Identity awareness and ADS machine identity pr...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Are you a member of CheckMates?
×- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Identity awareness and ADS machine identity propagation
Hi,
In our setup we are using the Identity Awareness blade on a R80.40 Security Gateway, which receives identities from an Identity Collector. The Identity Collector itself collects the identities from a pool of Microsoft Active Directory servers.
Everything seems to be working fine for some time now, but I've noticed that for the Active Directory servers themselfs the Security Gateway isn't receiving Machine Identity Propagation login or updates. Is this by design?
Kind regards,
--Niels
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You mean when someone logs into the AD server itself?
Note only AD users are acquired, no local users will be acquired.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Phoneboy,
No, it is for the AD server itself. For other non-AD-servers I see log entries like shown below.
Id: 0a6000f1-b607-a64b-6064-724300000001
Marker: @A@@B@1617193489@C@911804
Log Server Origin: x.x.x.x
Time: 2021-03-31T12:59:47Z
Id Generated By Indexer:false
First: true
Sequencenum: 87
Domain Name: example.com
Source: y.y.y.y
Endpoint IP: y.y.y.y
Authentication Status: Successful Login
Identity Source: Identity Collector (Active Directory)
Session ID: 66d6b3c5
Source Machine Name: servername
Source Machine Group: All Machines; ad_group_my_servers;
Authentication Method: Machine Identity Propagation
Identity Type: machine
Authentication Trial: this is a reauthentication for session xxxxxx
Roles: My_Servers
Action: Update
Type: Log
Blade: Identity Awareness
Origin: FW-A
Product Family: Network
Logid: 131073
Description: Successful Login
Updates like these are not being received for the AD servers themself.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
But you're using an actual AD account to log in, correct?
Maybe @Adi_Babai or @Royi_Priov know here.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Well as far as I know, it is the AD server itself. I think the 'Machine Identity Propagation' update is send when a system itself is domain joined en authenticates itself to the AD server or domain. Maybe the AD represents the domain itself, and therefore doesn't join the domain like non-ADS servers do. That could be the reason that I don't see updates on the Security Gateway.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Your explanation seems reasonable to me, at least.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Niels,
summary: it appears only the AD Servers , selected as an identity source that appear to be affected.
long:
We have the same behaviour in our environment. (1st time posting on checkpoint.... hooray.)
> other domain controllers, NOT in the Identity Collector as sources are registering just fine here.
It's only those that are enlisted as "Identity Collector Sources" that are not registering as "machine identity". Exactly what you described.
Was this fixed for you somehow recently? or still an open question? Wondering if we should open a case @ CP for this or not.
Honestly we don't know if it has always been like this - but considering the Ruleset we stumbled upon a couple issues - and narrowed it down to the fact those specific Domain Controllers are not having their machine identity updated towards our Security Gateway.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm wondering if machine identity propagation can be turned off when it's not being used. We're just using network and user authentication to validate access not machine identity.
Also, the domain controllers its trying to get to are not configured in our LDAP account unit by design. We are only using domain controllers in domain A, not B or C to validate users. Those domain controllers exist for off site customers.
In the case I did want to use those other domain controllers from other domains, I assume I would have to use MDS for management (multiple domains). IOW, if someone LDAP used a domain from domain B, a DC in domain A wouldn't find it even if I had it listed as a DC. You can't control which DC is used for each rule. Maybe, that will change in R81.20?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No, I'm still seeing all these messages.
Failed to get users groups for the domain.
Verify that this domain name is configured in your LDAP Account Unit.
Domain: somegroup.local
the answer maybe to add these domains to the IDC, there's a few differentusers who log in.
After adding the new domain to IDC and adding an account unit for the new domain, I'm still seeing these in R81.20
Machine Identity propagation Failed Login Failed to get users groups for the domain.
Verify that this domain name is configured in your LDAP Account Unit. (Yes, it is so ?)
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Getting the same error here, actually a lot of them... ? Propagation deactivation option would be helpful
Any other leads ?
![](/skins/images/84DAB6BD358ECB13CE1094473F6E2961/responsive_peak/images/icon_anonymous_message.png)