Session Expiration-Captive Portal-Identity Awareness

[sukruozdemir]

Hello,
I have two 23500 R81.10 firewalls running in cluster mode. When I install a policy, the authentications of people who have verified themselves in Captive Portal drop. They have to login again.

In addition, even though the session timeout period that I set on the gateway for Linux users who have to use Captive Portal does not expire, session times expire at irregular time intervals.

It is unfortunate that Linux distributions do not have Identity Agent and VPN Client.

Best wishes
Sukru Ozdemir

[PhoneBoy]

As far as I know, authenticated users shouldn't disappear on a policy installation.
As an example, see: https://support.checkpoint.com/results/sk/sk79060
As such, I recommend a TAC case: https://help.checkpoint.com 

On the more general subject of Linux users with Identity Awareness, they can be authenticated with Active Directory like Windows machines.
Which means you should be able to use Identity Collector or Kerberos to acquire the identities.
That assumes the Linux machines are tied into Active Directory, of curse.

To the best of my knowledge there are no plans to implement a native VPN client or Identity Awareness client for Linux.
Requests for these items should be discussed with your local Check Point office. 

[sukruozdemir]

I was thinking that I can solve it without opening a case so that users do not fall in policy installation, but it turns out that I will have to open a case.
Collecting from AD with collector is not always a good solution for Linux users. We are using Exchange Server in our local, when the person using the computer logs in to a different e-mail address other than his own via /owa, the information he receives from collector AD changes and I begin to see it as if the common mail account is using that computer.
Installing an agent on the client is the most guaranteed solution for me, but unfortunately there is no agent even though there are many users on the linux side.

Thank you for your response
Best wishes 
Sukru

[Ruan_Kotze]

Hi Sukru,

A workaround might be to schedule a cron job that enumerates the Netlogon share on a DC for example.  Anything that will cause a login event to be created, really.  You'd have to be mindful of password expiry and account lockouts though.

Thanks,
Ruan

[sukruozdemir]

Hello Ruan,
Thank you for the information.
Kind regards
Sukru