Problem with creating LDAP Account Unit

[fafeka22]

Hello everyone

I am having a problem with Check Point R81.20. I cannot create a new LDAP Account Unit or edit an existing one because I cannot get Branches.

I also tried to enter them manually, but when I try to add them, they simply do not appear in the field.

The current LDAP Account Unit was created automatically when I enabled and configured Identity Awareness.

[Vincent_Bacher]

I have already created several au's and there have been cases where “Fetch branches” has not worked for various reasons. However, since you cannot enter a branch via “Add,” I would recommend creating an SR in UC at this point.

There is either something wrong with the SmartConsole, the API, or whatever.

The only thing I would do before the SR (if you haven't already) is install the latest R81.20 SmartConsole. If it's up to date, as I said —> SR

[Chris_Atkinson · Accepted solution]

If the issue you're having matches sk184190 or similar please reach out to TAC for a new SmartConsole build.

[fafeka22]

Yes its match the followed sk, but i already have the latest build of smart console installed, i will try to re-install SmartConsole and open ticket in TAC

[the_rock]

Just to confirm, is this S1C management? If so, its expected that it would not work. If its onprem mgmt, then I would verify basic connectivity and follow sk Chris referenced.

[Vincent_Bacher]

Would manually entering a branch also not work with S1C management? I'm asking because I've never worked with it before. Apart from Harmony Endpoint Management.

[the_rock]

Yep, thats works 100%, just fetch does not.

[Lesley]

Check for blocked ports from the system you run smart console on. Check for ldap or ldaps traffic. Firewall could block traffic or firewall on dc server itself. 

If 636 does not work, try 389 and other way around. 636 is recommended because of encryption. Try to fetch fingerprint then you know connections works. Consider to leave the fingerprint empty if you are done to avoid down time if certificates are automatically renewed on dc at a random moment. Also consider using identity collectors to avoid unnecessary load on the gateway 

[the_rock]

Sometimes, can happen port 636 does not work, definitely worth checking.

[Chris_Atkinson]

Most likely it is this: sk184190: "Fetch branches" button does not show "Branches in use"

There is a fixed version of smartconsole available via TAC.

[Vincent_Bacher]

All of this would explain why fetching does not work. However, it does not quite fit with the symptom that even manual entry does not work –  would expect an error message when there would be a connection attempt when entering the branch – which makes the whole thing somewhat mysterious to me.

[fafeka22]

I opened SR to TAC because re-install SmartConsole dont helm me, i also cant finf my problem in  list of all resolved issues on SmartConsole Download page https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20_SC/R81.20/R81.20-List-of-all-Resolved-Issues.h...

I think there is a problem in R81.20 release because on R82 it work fine

[Chris_Atkinson · Accepted solution]

As per the SK referenced earlier TAC will provide a new build of Smartconsole with the fix, this build isn't yet available publicly.

[fafeka22]

Thank you, the TAC provided me SmartConsole Build and i installed it, everything work now. But why this build dont published and only provided via TAC?

[Chris_Atkinson]

Imagine it's simply a matter of timing and only temporary until the next planned release.

[the_rock]

Glad that worked!

[fafeka22]

The connectivity is ok because i checked it via ldapsearch from GW,SMS and SmartConsole, i also tried port 636 abd 389, the results same

[TJ_Aus]

It was happening to us too last week, I raised a case and TAC gave us the files that Chris Atkinson is referring to above.
I uninstalled Smart Console and installed the new one provided and it all works now

sk184190 - "Fetch branches" button does not show "Branches in use"