Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
DmitriyDubovik
Contributor
Jump to solution

PDP proccess don t take username using Identity Collector

Good day! 

We have:

1. SG 81.20

2. IC 81.040

3. Cisco ISE 3.0

 

GW taking logs from Identity Collector -> Identity collector taking logs from Cisco ISE -> Cisco ISE taking Identites and logs from Active Directory 

In SMS (Smarconsole):

1) We have LDAP account unit object of LDAP 

 

2) We have only Identity Collector identity source

 

In IC:

1) We have only ISE group in the Query pool. ISE machine is green. Log collected with Username. 

 

1.png

2.png

 

3) In GW 

pdp don t take username, because of it rules don t work properly (ise-1 computer that admins ise, just example)

 

3.png

 

4.png

 

In smartconsole we see this on every login attempt:

 

5.png

I checked every setting on everything, but I still don’t understand what could be wrong.

 

 

 

0 Kudos
1 Solution

Accepted Solutions
DmitriyDubovik
Contributor
7 Replies
Vincent_Bacher
Advisor
Advisor

Do you receive sAMAccountName or UserPrincipalName as user name?
I remember in the past to be forced to define the ldap search query accordingly in Guidbedit to be able to get correct ldap search results.

and now to something completely different - CCVS, CCAS, CCTE, CCCS, CCSM elite
0 Kudos
DmitriyDubovik
Contributor

nothing at all

0 Kudos
Vincent_Bacher
Advisor
Advisor

I meant from ISE. What's the Username collected from ISE? sAMAccountName or UserPrincipalName?
PDP needs something to make ldap query for group membership resolution.
Error message from Smartlog in your post may point to the issue that the wrong one is used.
In case the Attr received leads to errors when trying to resolve group memberships, sometimes UserLoginAttr is to be modified in the Checkpoint Database using guidbedit.

identity-collector-ldap.png
 

In case pdp process queries using wrong attr, user cannot be found, leading to same error message as above.

To clarify, you might want to debug.

Then first enable debug on the PDP

 

 

fw debug fwd off PDP_LOG_SIZE=50000000
fw debug fwd off PDP_NUM_LOGS=20
fw kill pdpd
pdp debug off
pdp debug reset
pdp debug set all all

 

 

replicate issue

disable debug

 

 

fw debug fwd off PDP_LOG_SIZE=10000000
fw debug fwd off PDP_NUM_LOGS=10
pdp debug off
pdp debug reset
fw kill pdpd

 

 

and then you are able to analyse the collected files in $FWDIR/logs/pdpd.elg*
In case my idea is correct, you could see hints pointing to that.
Or maybe pointing to a different root cause.

and now to something completely different - CCVS, CCAS, CCTE, CCCS, CCSM elite
0 Kudos
DmitriyDubovik
Contributor
Matlu
Advisor

Hello,

Are the tshoot commands similar for "SMB" machines?

I have a "negotiation" problem between my GW 1590 SMB, and my SRV AD which has the IDC installed.

On these machines, is it viable to "restart" the PDP process with the command, "fw kill pdpd"?

Greetings.

0 Kudos
the_rock
Legend
Legend

Can you verify ldap account unit is configured properly in smart console? You still need that even with IC set up.

Andy

0 Kudos
PhoneBoy
Admin
Admin

Gateways must be able to query Active Directory to obtain the groups the user is associated with.
This points to an issue in your LDAP configuration.
For troubleshooting that, see: https://support.checkpoint.com/results/sk/sk100406 

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events